Ansible "apt" puts unwanted second repository into sources list

user_3856660 0
Viewed 36

On Linux Mint 21 I am trying to install signed packages from external repos. I have the same problem with 5 different repos.

I can get the PGP key and add the repo to the /etc/apt/sources.list.d/ directory, but when I call apt, it makes another entry in the sources directory (but without the pointer to the key). This causes the install to fail.

If I remove the second entry, then the package installs correctly. I have tried several of the parameters to apt, but without success.

Here is an example, to install Chrome:

 - name: Add Chrome signing key
   get_url:
     url: https://dl.google.com/linux/linux_signing_key.pub
     dest: /usr/share/keyrings/google-chrome.asc
     mode: '0644'
     force: true
 - name: Add Chrome repository
   apt_repository:
     repo: deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.asc] https://dl.google.com/linux/chrome/deb/ stable main
     state: present

At this point I correctly have:

/etc/apt/sources.list.d/dl_google_com_linux_chrome_deb.list

which correctly contains:

deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.asc] https://dl.google.com/linux/chrome/deb/ stable main

After calling

  - name: Add Chrome package
    apt:
     name: "google-chrome-stable"

there is a second list in the sources directory:

/etc/apt/sources.list.d/dl_google_com_linux_chrome_deb.list
/etc/apt/sources.list.d/google-chrome.list

This second list points to the repo, but without the key:

### THIS FILE IS AUTOMATICALLY CONFIGURED ###
# You may comment out this entry, but any other modifications may be lost.
deb [arch=amd64] https://dl.google.com/linux/chrome/deb/ stable main

Like I say, if I remove the second entry, then the package installs correctly.

Question: How do I stop this incorrect list from being added?

Further testing: I used Ansible to get the key and add the repo to /etc/apt/sources.list.d/ and then I manually called

sudo apt install google-chrome-stable

It correctly installed but then also added the google-chrome.list file.

The same thing happens when I try to install Docker, TeamViewer, VS Code, and 1Password so it isn't just Chrome.

So how do I use Ansible to install signed external packages?

ansible
1 Answers

I have experienced such behavior a few times when manually installing deb packages. When the deb package is installed, a sources-list file is automatically created.

I can think of a few possibilities you could test:

  1. Obviously when chrome is installed, the file google-chrome.list is created. You could test if this is overwritten during installation if you name your file google-chrome.list instead of dl_google_com_linux_chrome_deb.list. You have to add the parameter filename (without specifying the file extension).

    - name: Add Chrome repository
  apt_repository:
    repo: deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.asc] https://dl.google.com/linux/chrome/deb/ stable main
    state: present
    filename: google-chrome

    As long as the existing file is not overwritten, everything should be fine. If it is overwritten again, you could try to run the apt_repository command again after the installation.

  2. You could delete the file created by Chrome after the installation. However, based on the note in the file "any other modifications may be lost.", I don't know if that holds.

    - name: Remove google-chrome.list file
  file:
    path: /etc/apt/sources.list.d/google-chrome.list
    state: absent

  3. You could comment out the deb line in the new file after installation. As it is mentioned there, this modification should then hopefully be preserved.

    - name: Comment out Chrome's default source.
  lineinfile:
    path: /etc/apt/sources.list.d/google-chrome.list
    regexp: '^(deb .*)$'
    line: '# \g<1>'
    backrefs: yes

However, you should still test how the behavior is during an update, if the file is overwritten/created again every time. If there is a switch to prevent the creation of the sources-list-file directly during the installation, I don't know.

Edit: Combination of solution 1 and 3:

- name: Add Chrome repository
  apt_repository:
    repo: deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.asc] https://dl.google.com/linux/chrome/deb/ stable main
    state: present
    filename: google-chrome

- name: Add Chrome package
  apt:
    name: "google-chrome-stable"

- name: Comment out Chrome's default source.
  lineinfile:
    path: /etc/apt/sources.list.d/google-chrome.list
    regexp: '^(deb \[arch=amd64\] .*)$'
    line: '# \g<1>'
    backrefs: yes

I have adjusted the regexp, so only the deb line without signature key matches.

user_51714120
Related