<p>The feature is currently (Nov 2019) not directly supported in Ansible Galaxy.</p>

<p>There have been related discussions in the past (<a href="https://github.com/ansible/ansible/issues/14604" rel="nofollow noreferrer">#14604</a> and <a href="https://github.com/ansible/galaxy/issues/1358" rel="nofollow noreferrer">#1358</a>), but the latest state can be followed in the new issue <a href="https://github.com/ansible/galaxy/issues/2108" rel="nofollow noreferrer">#2108</a>.</p>

<p>In the meantime, the workaround described in the question can be used, at the cost of some verbosity.</p>

CC BY-SA 4.0
2019-11-18T14:41:50.160Z
2019-11-18T14:41:50.160Z
Philipp Claßen
<p>From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware  of an official solution to enforce checks.</p>

<p>This is the best that I could come up with:</p>

<pre><code># requirements.yaml:
- src: git+https://github.com/geerlingguy/ansible-role-nodejs.git
  version: 405a113ccbde0c99614f6f815fb4285cb742ad25 # == release 5.0.0
  name: geerlingguy.nodejs.trusted_hash
</code></pre>

<p>And in the playbook, use it as:</p>

<pre><code>- roles:
  - role: geerlingguy.nodejs.trusted_hash
    nodejs_version: "12.x"
</code></pre>

<p>It works, but feels a bit overly complicated. Is there an easier way?</p>

CC BY-SA 4.0
2019-11-18T12:01:05.950Z
Did you check the [issue list](https://github.com/ansible/galaxy/issues)? If there is no such item, could you create one and add the link to this Q&A to create awareness?
030
CC BY-SA 4.0
2019-11-18T12:29:02.803Z
@030 Did not find any, although there were older discussion about it. I created a new one: https://github.com/ansible/galaxy/issues/2108
Philipp Claßen
CC BY-SA 4.0
2019-11-18T13:36:34.857Z
In the meantime could you answer the question (even if in the negative?), with your findings? Thanks!
Bruce Becker
CC BY-SA 4.0
2019-11-18T13:38:03.257Z
I also wonder - perhaps hashes can be altered, but what about verifying signed tags or commits, with the signers public key? This would likely have to be done outside of galaxy, but it should still show signs of tampering if they were present.
Bruce Becker
CC BY-SA 4.0
2019-11-18T14:44:04.453Z
@BruceBecker I added a answer based on my current understanding.
Philipp Claßen
<ansible><security><ansible-galaxy>
How to verify hashes of Ansible Galaxy dependencies?
Philipp Claßen
# How to verify hashes of Ansible Galaxy dependencies?

(Asked by: username_0 on 2019-11-18)

From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware  of an official solution to enforce checks.
This is the best that I could come up with:
# requirements.yaml:
- src: git+https://github.com/geerlingguy/ansible-role-nodejs.git
  version: 405a113ccbde0c99614f6f815fb4285cb742ad25 # == release 5.0.0
  name: geerlingguy.nodejs.trusted_hash

And in the playbook, use it as:
- roles:
  - role: geerlingguy.nodejs.trusted_hash
    nodejs_version: "12.x"

It works, but feels a bit overly complicated. Is there an easier way?

**Tags:** ansible, security, ansible-galaxy

> **Comments:**
> **username_1**: Did you check the [issue list](https://github.com/ansible/galaxy/issues)? If there is no such item, could you create one and add the link to this Q&A to create awareness?  
> **username_0**: @username_1 Did not find any, although there were older discussion about it. I created a new one: https://github.com/ansible/galaxy/issues/2108  
> **username_2**: In the meantime could you answer the question (even if in the negative?), with your findings? Thanks!  
> **username_2**: I also wonder - perhaps hashes can be altered, but what about verifying signed tags or commits, with the signers public key? This would likely have to be done outside of galaxy, but it should still show signs of tampering if they were present.  
> **username_0**: @BruceBecker I added a answer based on my current understanding.  

---

## 1 answers

### Answer by username_0 on 2019-11-18. Score: 1 | Accepted answer

The feature is currently (Nov 2019) not directly supported in Ansible Galaxy.

There have been related discussions in the past ([#14604](https://github.com/ansible/ansible/issues/14604) and [#1358](https://github.com/ansible/galaxy/issues/1358)), but the latest state can be followed in the new issue [#2108](https://github.com/ansible/galaxy/issues/2108).

In the meantime, the workaround described in the question can be used, at the cost of some verbosity.


---

