I have been using a pip/virtualenv based workflow with ansible for a
long time, with colleagues that sadly wouldn't appreciate Nix. I haven't
used this package for a long time and maybe there is someone out there
who will fill this spot better than I could.
- Drop pkgs/tools/admin/ansible and move everything into top-level and
throws into central aliases.nix
- Drop the Ansible 2.8 throw
- Remove Ansible 2.9/2.10, both will be EOL before the 22.05 release
- Remove Ansible 2.11, it will go EOL during the 22.05 release
- Expose the collections as `python3Packages.ansible`
Closes: #157591
This addresses the following security issues:
* Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs (CVE-2019-14864)
* CVE-2019-14846 - Several Ansible plugins could disclose aws
credentials in log files. inventory/aws_ec2.py, inventory/aws_rds.py,
lookup/aws_account_attribute.py, and lookup/aws_secret.py,
lookup/aws_ssm.py use the boto3 library from the Ansible process. The
boto3 library logs credentials at log level DEBUG. If Ansible's
logging was enabled (by setting LOG_PATH to a value) Ansible would set
the global log level to DEBUG. This was inherited by boto and would
then log boto credentials to the file specified by LOG_PATH. This did
not affect aws ansible modules as those are executed in a separate
process. This has been fixed by switching to log level INFO
* Convert CLI provided passwords to text initially, to prevent unsafe
context being lost when converting from bytes->text during post
processing of PlayContext. This prevents CLI provided passwords from
being incorrectly templated (CVE-2019-14856)
* properly hide parameters marked with no_log in suboptions when
invalid parameters are passed to the module (CVE-2019-14858)
Changelog: https://github.com/ansible/ansible/blob/24220a618a6d5cd3b5c99f8c7f7771661ed08d33/changelogs/CHANGELOG-v2.8.rst
* ansible: Fix use of connection plugins
Ansible tries to execute the ansible-connection script as a python
script from within it's task executor. This does not work when it is
encapsulated in a shell script. Therefore remove the call to the python
interpreter and use the wrapped version directly.
Fixes#71342
* ansible: Add ncclient to support NETCONF connections
* ansible: Some cleanups
- boto was dropped from propagatedBuildInputs in 4af94d0f
- lib/ansible/constants.py does not have "/usr" anywhere in v2.4..v2.9
Martin Weinelt