blob: 5a890b1dbe33a3d2c6d38dc276908e00cf039443 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
---
- name: download Release and Signature file
loop:
- Release
- Release.gpg
get_url:
url: "{{ debian_installer_base_url | dirname | dirname | dirname | dirname }}/{{ item }}"
dest: "{{ installer_path }}/{{ debian_installer_distro }}-{{ debian_installer_codename }}/{{ debian_installer_arch }}-{{ debian_installer_variant }}/{{ item }}"
- name: verfiy signature of Release file
command: >-
gpg --no-options --trust-model always --no-default-keyring --secret-keyring /dev/null
--keyring "{{ global_files_dir }}/common/keyrings/debian-{{ install_codename }}.gpg"
--verify "{{ installer_path }}/{{ debian_installer_distro }}-{{ debian_installer_codename }}/{{ debian_installer_arch }}-{{ debian_installer_variant }}/Release.gpg"
"{{ installer_path }}/{{ debian_installer_distro }}-{{ debian_installer_codename }}/{{ debian_installer_arch }}-{{ debian_installer_variant }}/Release"
changed_when: False
register: debian_installer_gpg_result
- debug:
var: debian_installer_gpg_result.stderr_lines
- name: extract checksum file hash from Release file
command: grep -E "^ [0-9a-z]{64} .* main/installer-{{ debian_installer_arch }}/current/{{ [debian_installer_distro, debian_installer_codename] | di_images_path }}/SHA256SUMS$" "{{ installer_path }}/{{ debian_installer_distro }}-{{ debian_installer_codename }}/{{ debian_installer_arch }}-{{ debian_installer_variant }}/Release"
changed_when: false
register: debian_installer_inrelease_sha256
- name: download SHA256SUMS
get_url:
url: "{{ debian_installer_base_url }}/SHA256SUMS"
dest: "{{ installer_path }}/{{ debian_installer_distro }}-{{ debian_installer_codename }}/{{ debian_installer_arch }}-{{ debian_installer_variant }}/SHA256SUMS"
checksum: "sha256:{{ (debian_installer_inrelease_sha256.stdout | trim).split(' ') | first }}"
- name: extract kernel image hash from SHA256SUMS
command: grep -E "^[0-9a-z]{64}\s+(./)?{{ debian_installer_variant_path }}/{{ debian_installer_variant_kernal_image_name }}$" "{{ installer_path }}/{{ debian_installer_distro }}-{{ debian_installer_codename }}/{{ debian_installer_arch }}-{{ debian_installer_variant }}/SHA256SUMS"
changed_when: false
register: debian_installer_sha256sums_kernel
- name: extract inital ramdisk hash from SHA256SUMS
command: grep -E "^[0-9a-z]{64}\s+(./)?{{ debian_installer_variant_path }}/initrd.gz$" "{{ installer_path }}/{{ debian_installer_distro }}-{{ debian_installer_codename }}/{{ debian_installer_arch }}-{{ debian_installer_variant }}/SHA256SUMS"
changed_when: false
register: debian_installer_sha256sums_initrd
- name: set checksum variables
set_fact:
debian_installer_kernel_checksum: "sha256:{{ debian_installer_sha256sums_kernel.stdout.split(' ') | first }}"
debian_installer_initrd_checksum: "sha256:{{ debian_installer_sha256sums_initrd.stdout.split(' ') | first }}"
|
