Consider installing Ansible from PPA?!

[JedMeister]

As noted by @Dude4Linux in a comment on a pull request; Ansible recommend Debian install using the Ubuntu PPA (see here).

As I noted (later in the conversation), whist generally installing on Debian via Ubuntu PPA is frowned on (due to binary incompatibility between Debian and Ubuntu) in the case of a Python package, it shouldn't matter...

So this may be a good option for installation of Ansible?! I think that it's (at least marginally) more secure than using pip and will provide a more up to date version of Ansible than we could currently get from backports. Either way, we're not going to get auto sec updates, so the PPA seems like probably the best option.

Please note that if we do go that way (i.e. install via apt from PPA), then we'll need to add the PPA repo as per third party repo "best practice" - see #1033. We'd also need to configure pinning so that only the packages required for Ansible could ever be installed from that repo (as we do for other 3rd party apt installs).

Any feedback welcome but unless anyone has any serious concerns, I'm inclined to go the PPA route!

[JedMeister]

Can you please have a look at this one too @OnGle?

Note that the apt key magic will also be required for this...

[Dude4Linux]

@JedMeister - FYI I did take a look at this earlier, but I guess I failed to update the thread. When I checked into using the Ubuntu PPA for Ansible, I found that it would not be supported by automatic security updates. For me, that would be the primary reason for using a Debian repo versus a pip install. I concluded that for v15.0, we should just continue using the pip install method.

I have noted that there have been a couple of bug fix updates to Ansible since the v15.0rc1 release.

[JedMeister]

Hey @Dude4Linux

We don't include 3rd party repos in auto-security updates. The main reason for that is that usually upstream repos don't provide backported security updates, only updated versions. As APIs can change between versions, to avoid users getting nasty surprises, it's generally best not to automatically force version updates.

Having said that, if you wanted to, you could configure your own Ansible server to auto update by adding the PPA to the apt security list or creating a separate cron job to update ansible. We wouldn't want to do that for the default TurnKey appliance though.

TBH, I still think that there is a marginal security advantage of installing from a GPG signed PPA repo (assuming that they provide the same version). Unless you have a firm preference, I'm inclined to do it that way.

OTOH, at this late stage of the release, having one less thing to take care of is certainly appealing! 😄 Although if we are to change to the PPA, doing it now for the .0 release is preferable (to in a later update release).

Input welcome.

[Dude4Linux]

I just issued a PR for some changes I don't want to get lost if the conversion to PPA repo takes place.
See Dude4Linux/ansible#3

[JedMeister]

We didn't end up implementing this for v15.0. I'm not sure if we should implement it or not, but in the meantime, I've moved it to v15.1 milestone and added the wishlist tag.