Answers: <p>The feature is currently (Nov 2019) not directly supported in Ansible Galaxy.</p>
  
  <p>There have been related discussions in the past (<a href="https://github.com/ansible/ansible/issues/14604" rel="nofollow noreferrer">#14604</a> and <a href="https://github.com/ansible/galaxy/issues/1358" rel="nofollow noreferrer">#1358</a>), but the latest state can be followed in the new issue <a href="https://github.com/ansible/galaxy/issues/2108" rel="nofollow noreferrer">#2108</a>.</p>
  
  <p>In the meantime, the workaround described in the question can be used, at the cost of some verbosity.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-11-18T14:41:50.160Z
Answers: 2019-11-18T14:41:50.160Z
Answers: Philipp Claßen
Body: <p>From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware  of an official solution to enforce checks.</p>
  
  <p>This is the best that I could come up with:</p>
  
  <pre><code># requirements.yaml:
  - src: git+https://github.com/geerlingguy/ansible-role-nodejs.git
    version: 405a113ccbde0c99614f6f815fb4285cb742ad25 # == release 5.0.0
    name: geerlingguy.nodejs.trusted_hash
  </code></pre>
  
  <p>And in the playbook, use it as:</p>
  
  <pre><code>- roles:
    - role: geerlingguy.nodejs.trusted_hash
      nodejs_version: "12.x"
  </code></pre>
  
  <p>It works, but feels a bit overly complicated. Is there an easier way?</p>
  
Comments: CC BY-SA 4.0
Comments: 2019-11-18T12:01:05.950Z
Comments: Did you check the [issue list](https://github.com/ansible/galaxy/issues)? If there is no such item, could you create one and add the link to this Q&A to create awareness?
Comments: 030
Comments: CC BY-SA 4.0
Comments: 2019-11-18T12:29:02.803Z
Comments: @030 Did not find any, although there were older discussion about it. I created a new one: https://github.com/ansible/galaxy/issues/2108
Comments: Philipp Claßen
Comments: CC BY-SA 4.0
Comments: 2019-11-18T13:36:34.857Z
Comments: In the meantime could you answer the question (even if in the negative?), with your findings? Thanks!
Comments: Bruce Becker
Comments: CC BY-SA 4.0
Comments: 2019-11-18T13:38:03.257Z
Comments: I also wonder - perhaps hashes can be altered, but what about verifying signed tags or commits, with the signers public key? This would likely have to be done outside of galaxy, but it should still show signs of tampering if they were present.
Comments: Bruce Becker
Comments: CC BY-SA 4.0
Comments: 2019-11-18T14:44:04.453Z
Comments: @BruceBecker I added a answer based on my current understanding.
Comments: Philipp Claßen
Tags: <ansible><security><ansible-galaxy>
Title: How to verify hashes of Ansible Galaxy dependencies?
UserDisplayName: Philipp Claßen
ThreadText: # How to verify hashes of Ansible Galaxy dependencies?
  
  (Asked by: username_0 on 2019-11-18)
  
  From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware of an official solution to enforce checks.
  
  This is the best that I could come up with:
  
  ```
  # requirements.yaml:
  - src: git+https://github.com/geerlingguy/ansible-role-nodejs.git
    version: 405a113ccbde0c99614f6f815fb4285cb742ad25 # == release 5.0.0
    name: geerlingguy.nodejs.trusted_hash
  
  ```
  
  And in the playbook, use it as:
  
  ```
  - roles:
    - role: geerlingguy.nodejs.trusted_hash
      nodejs_version: "12.x"
  
  ```
  
  It works, but feels a bit overly complicated. Is there an easier way?
  
  **Tags:** ansible, security, ansible-galaxy
  
  > **Comments:**
  > **username_1**: Did you check the [issue list](https://github.com/ansible/galaxy/issues)? If there is no such item, could you create one and add the link to this Q&A to create awareness?  
  > **username_0**: @username_1 Did not find any, although there were older discussion about it. I created a new one: https://github.com/ansible/galaxy/issues/2108  
  > **username_2**: In the meantime could you answer the question (even if in the negative?), with your findings? Thanks!  
  > **username_2**: I also wonder - perhaps hashes can be altered, but what about verifying signed tags or commits, with the signers public key? This would likely have to be done outside of galaxy, but it should still show signs of tampering if they were present.  
  > **username_0**: @username_2 I added a answer based on my current understanding.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-11-18. Score: 1 | Accepted answer
  
  The feature is currently (Nov 2019) not directly supported in Ansible Galaxy.
  
  There have been related discussions in the past ([#14604](https://github.com/ansible/ansible/issues/14604) and [#1358](https://github.com/ansible/galaxy/issues/1358)), but the latest state can be followed in the new issue [#2108](https://github.com/ansible/galaxy/issues/2108).
  
  In the meantime, the workaround described in the question can be used, at the cost of some verbosity.
  
  
  ---
  
  