320 Role vbotka.freebsd.packages¶
Use case¶
Using the role vbotka.freebsd.packages to install packages in Ansible clients. Audit installed packages.
Tree¶
shell> tree .
.
├── ansible.cfg
├── group_vars
│ └── all
│ └── ansible-client.yml
├── hosts
│ ├── 02_iocage.yml
│ └── 99_constructed.yml
├── iocage.ini
├── pb-pkg-update.yml
├── pb-test-01.yml
└── pb-test-02.yml
Synopsis¶
At the managed node iocage_02:
playbook
pb-pkg-update.yml:upgrade the package
ports-mgmt/pkgupdate FreeBSD repository catalogue (default cached = false).
At all running jails:
playbook
pb-test-01.yml:display variables
install packages
audit installed packages.
At the managed node iocage_02:
playbook
pb-test-02.yml:audit installed packages.
Requirements¶
Running jails at the iocage host.
Notes¶
Jail name doesn’t work in the parameter name of the module community.general.pkgng if the jail was created by iocage. Use JID instead
pkg_jail: "{{ iocage_jid }}"
The play
pb-test-01.ymlruns in the jails. The inventoryiocage.iniis needed when a task is delegated to an iocage hostpkg_delegate: "{{ iocage_tags.vmm }}"
Disable use_globs
pkg_use_globs: false
to use the packages in the form pkg-origin
pkg_list: - security/sudo - lang/python311 - ports-mgmt/pkg
The playbook
pb-pkg-update.ymlupdates the repositories. Then, use the cached local package base instead of fetching an updated onepkg_cached: true
Note
vbotka.freebsd.packages is the role packages in the collection vbotka.freebsd.
vbotka.freebsd_packages is the role freebsd_packages in the namespace vbotka.
Please make sure the versions are the same before you switch between them.
See also
module community.general.pkgng
Jails at iocage_02¶
[iocage_02]# iocage list -l
+-----+----------+------+-------+------+-----------------+--------------------+-----+----------------+----------+
| JID | NAME | BOOT | STATE | TYPE | RELEASE | IP4 | IP6 | TEMPLATE | BASEJAIL |
+=====+==========+======+=======+======+=================+====================+=====+================+==========+
| 60 | test_111 | off | up | jail | 14.2-RELEASE-p3 | epair0b|10.1.0.174 | - | ansible_client | no |
+-----+----------+------+-------+------+-----------------+--------------------+-----+----------------+----------+
| 61 | test_112 | off | up | jail | 14.2-RELEASE-p3 | epair0b|10.1.0.147 | - | ansible_client | no |
+-----+----------+------+-------+------+-----------------+--------------------+-----+----------------+----------+
| 62 | test_113 | off | up | jail | 14.2-RELEASE-p3 | epair0b|10.1.0.231 | - | ansible_client | no |
+-----+----------+------+-------+------+-----------------+--------------------+-----+----------------+----------+
ansible.cfg¶
Do not display skipped hosts. See the option display_skipped_hosts
[defaults]
gathering = explicit
callback_result_format = yaml
display_skipped_hosts = false
[connection]
pipelining = true
Inventory iocage.ini¶
iocage_01 ansible_host=10.1.0.18
iocage_02 ansible_host=10.1.0.73
iocage_03 ansible_host=10.1.0.17
iocage_04 ansible_host=10.1.0.29
[iocage]
iocage_02
[iocage:vars]
ansible_user=admin
ansible_become=true
ansible_python_interpreter=auto_silent
group_vars¶
group_vars/all/ansible-client.yml¶
freebsd_install_method: packages
freebsd_install_retries: 3
freebsd_install_delay: 5
pkg_delegate: "{{ iocage_tags.vmm }}"
pkg_jail: "{{ iocage_jid }}"
pkg_use_globs: false
pkg_cached: true
pkg_list:
- security/sudo
- lang/python311
- ports-mgmt/pkg
Inventory hosts¶
hosts/02_iocage.yml¶
plugin: vbotka.freebsd.iocage
host: 10.1.0.73
user: admin
env:
CRYPTOGRAPHY_OPENSSL_NO_LEGACY: 1
get_properties: True
hooks_results:
- /var/db/dhclient-hook.address.epair0b
compose:
ansible_host: (iocage_hooks.0 == '-') | ternary(iocage_ip4, iocage_hooks.0)
iocage_tags: dict(iocage_properties.notes | split | map('split', '='))
hosts/99_constructed.yml¶
plugin: ansible.builtin.constructed
groups:
up: iocage_state == 'up'
Display inventory¶
(env) > ansible-inventory -i hosts -i iocage.ini --graph
@all:
|--@ungrouped:
|--@up:
| |--test_111
| |--test_112
| |--test_113
|--@iocage:
| |--iocage_01
| |--iocage_02
Playbook pb-pkg-update.yml¶
- name: Upgrade package ports-mgmt/pkg
hosts: iocage
gather_facts: true
tasks:
- name: Upgrade package ports-mgmt/pkg
register: out
community.general.pkgng:
name: ports-mgmt/pkg
state: latest
use_globs: false
- name: Debug
when: debug | d(false) | bool
ansible.builtin.debug:
var: out
Playbook output - Update repo¶
(env) > ansible-playbook pb-pkg-update.yml -i iocage.ini -e debug=true
PLAY [Upgrade package ports-mgmt/pkg] ******************************************
TASK [Gathering Facts] *********************************************************
ok: [iocage_02]
TASK [Upgrade package ports-mgmt/pkg] ******************************************
changed: [iocage_02]
TASK [Debug] *******************************************************************
ok: [iocage_02] =>
out:
changed: true
failed: false
msg: upgraded 1 package
stderr: ''
stderr_lines: []
stdout: |-
Updating FreeBSD repository catalogue...
Fetching data.pkg: .......... done
Processing entries: .......... done
Fetching provides database: .......... done
Extracting database....success
FreeBSD repository update completed. 35950 packages processed.
All repositories are up to date.
New version of pkg detected; it needs to be installed first.
The following 1 package(s) will be affected (of 0 checked):
Installed packages to be UPGRADED:
pkg: 1.21.3 -> 2.1.0 [FreeBSD]
Number of packages to be upgraded: 1
12 MiB to be downloaded.
[1/1] Fetching pkg-2.1.0.pkg: .......... done
Checking integrity... done (0 conflicting)
[1/1] Upgrading pkg from 1.21.3 to 2.1.0...
[1/1] Extracting pkg-2.1.0: .......... done
You may need to manually remove /usr/local/etc/pkg.conf if it is no longer needed.
Checking integrity... done (0 conflicting)
Your packages are up to date.
stdout_lines:
- Updating FreeBSD repository catalogue...
- 'Fetching data.pkg: .......... done'
- 'Processing entries: .......... done'
- 'Fetching provides database: .......... done'
- Extracting database....success
- FreeBSD repository update completed. 35950 packages processed.
- All repositories are up to date.
- New version of pkg detected; it needs to be installed first.
- 'The following 1 package(s) will be affected (of 0 checked):'
- ''
- 'Installed packages to be UPGRADED:'
- "\tpkg: 1.21.3 -> 2.1.0 [FreeBSD]"
- ''
- 'Number of packages to be upgraded: 1'
- ''
- 12 MiB to be downloaded.
- '[1/1] Fetching pkg-2.1.0.pkg: .......... done'
- Checking integrity... done (0 conflicting)
- '[1/1] Upgrading pkg from 1.21.3 to 2.1.0...'
- '[1/1] Extracting pkg-2.1.0: .......... done'
- You may need to manually remove /usr/local/etc/pkg.conf if it is no longer needed.
- Checking integrity... done (0 conflicting)
- Your packages are up to date.
PLAY RECAP *********************************************************************
iocage_02 : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Playbook pb-test-01.yml¶
- name: Test role vbotka.freebsd.packages
hosts: up
gather_facts: true
remote_user: admin
become: true
vars:
ansible_python_interpreter: auto_silent
roles:
- vbotka.freebsd.packages
Playbook output - Display variables¶
Limit the inventory to one jail test_111
(env) > ansible-playbook pb-test-01.yml -i hosts -l test_111 \
-t pkg_debug \
-e pkg_debug=true
PLAY [Test role vbotka.freebsd.packages] ***************************************
TASK [Gathering Facts] *********************************************************
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Set the lists for amd64] *****************
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Debug pkg_debug=true] ********************
ok: [test_111] =>
msg: |-
ansible_architecture: amd64
pkg_dict:
[]
pkg_list:
- lang/python311
- ports-mgmt/pkg
- security/sudo
pkg_list_deinstall:
[]
pkg_dict_select:
[]
TASK [vbotka.freebsd.packages : Debug pkg_debug=true] **************************
ok: [test_111] =>
msg: |-
pkg_role_version: 2.7.0
pkg_version_community_general: 9.3.0
ansible_architecture: amd64
ansible_os_family: FreeBSD
ansible_distribution: FreeBSD
ansible_distribution_major_version: 14
ansible_distribution_version: 14.2
ansible_distribution_release: 14.2-RELEASE-p1
ansible_python_version: 3.11.11
freebsd_install_method: packages
freebsd_install_retries: 3
freebsd_install_delay: 5
pkg_sanity: True
pkg_sanity_version_community_general: True
pkg_stat: False
pkg_audit_enable: False
pkg_backup_conf: False
pkg_dryrun: False
pkg_install_individually: False
pkg_delegate: "iocage_02"
pkg_owner: root
pkg_group: wheel
pkg_annotation: UNDEFINED
pkg_autoremove: UNDEFINED
pkg_cached: True
pkg_chroot: UNDEFINED
pkg_ignore_osver: UNDEFINED
pkg_jail: 60
pkg_pkgsite: UNDEFINED
pkg_rootdir: UNDEFINED
pkg_state: UNDEFINED
pkg_use_globs: False
pkg_default_repo_template: repo.j2
pkg_default_repo_conf:
[]
pkg_repos_template: repo.j2
pkg_repos_conf_clean: False
pkg_repos_conf:
[]
pkg_dict_all: False
pkg_dict_select:
[]
pkg_dict:
[]
pkg_list:
[security/sudo, lang/python311, ports-mgmt/pkg]
pkg_list_deinstall:
[]
PLAY RECAP *********************************************************************
test_111 : ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Playbook output - Install packages¶
The inventory iocage.ini is needed to delegate the tasks Install list pkg_list
(env) > ansible-playbook pb-test-01.yml -i hosts -i iocage.ini
PLAY [Test role vbotka.freebsd.packages.] **************************************
TASK [Gathering Facts] *********************************************************
ok: [test_111]
ok: [test_113]
ok: [test_112]
TASK [vbotka.freebsd.packages : Vars: Set the lists for amd64] *****************
ok: [test_111]
ok: [test_112]
ok: [test_113]
TASK [vbotka.freebsd.packages : Sanity: Test collection community_general minimal version 9.3.0] ***
ok: [test_112]
ok: [test_113]
ok: [test_111]
TASK [vbotka.freebsd.packages : Sanity: Required variable pkg_jail when pkg_delegate] ***
ok: [test_111]
ok: [test_112]
ok: [test_113]
TASK [vbotka.freebsd.packages : Packages_install: Install list pkg_list] *******
changed: [test_112 -> iocage_02(10.1.0.73)]
changed: [test_113 -> iocage_02(10.1.0.73)]
changed: [test_111 -> iocage_02(10.1.0.73)]
PLAY RECAP *********************************************************************
test_111 : ok=5 changed=1 unreachable=0 failed=0 skipped=37 rescued=0 ignored=0
test_112 : ok=5 changed=1 unreachable=0 failed=0 skipped=36 rescued=0 ignored=0
test_113 : ok=5 changed=1 unreachable=0 failed=0 skipped=36 rescued=0 ignored=0
Hint
Optionally, do not display OK hosts. See display_ok_hosts
Playbook output - Install packages¶
Enable debug and limit the inventory to one jail test_111
(env) > ansible-playbook pb-test-01.yml -i hosts -i iocage.ini -l test_111 \
-e pkg_debug=true
PLAY [Test role vbotka.freebsd.packages.] **************************************
TASK [Gathering Facts] *********************************************************
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Set the lists for amd64] *****************
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Debug pkg_debug=true] ********************
ok: [test_111] =>
msg: |-
ansible_architecture: amd64
pkg_dict:
[]
pkg_list:
- lang/python311
- ports-mgmt/pkg
- security/sudo
pkg_list_deinstall:
[]
pkg_dict_select:
[]
TASK [vbotka.freebsd.packages : Sanity: Test collection community_general minimal version 9.3.0] ***
ok: [test_111]
TASK [vbotka.freebsd.packages : Sanity: Required variable pkg_jail when pkg_delegate] ***
ok: [test_111]
TASK [vbotka.freebsd.packages : Debug pkg_debug=true] **************************
ok: [test_111] =>
msg: |-
pkg_role_version: 2.7.0
pkg_version_community_general: 9.3.0
ansible_architecture: amd64
ansible_os_family: FreeBSD
ansible_distribution: FreeBSD
ansible_distribution_major_version: 14
ansible_distribution_version: 14.2
ansible_distribution_release: 14.2-RELEASE-p1
ansible_python_version: 3.11.11
freebsd_install_method: packages
freebsd_install_retries: 3
freebsd_install_delay: 5
pkg_sanity: True
pkg_sanity_version_community_general: True
pkg_stat: False
pkg_audit_enable: False
pkg_backup_conf: False
pkg_dryrun: False
pkg_install_individually: False
pkg_delegate: "iocage_02"
pkg_owner: root
pkg_group: wheel
pkg_annotation: UNDEFINED
pkg_autoremove: UNDEFINED
pkg_cached: True
pkg_chroot: UNDEFINED
pkg_ignore_osver: UNDEFINED
pkg_jail: 60
pkg_pkgsite: UNDEFINED
pkg_rootdir: UNDEFINED
pkg_state: UNDEFINED
pkg_use_globs: False
pkg_default_repo_template: repo.j2
pkg_default_repo_conf:
[]
pkg_repos_template: repo.j2
pkg_repos_conf_clean: False
pkg_repos_conf:
[]
pkg_dict_all: False
pkg_dict_select:
[]
pkg_dict:
[]
pkg_list:
[security/sudo, lang/python311, ports-mgmt/pkg]
pkg_list_deinstall:
[]
TASK [vbotka.freebsd.packages : Conf: Debug pkg_debug=true] ********************
ok: [test_111] =>
msg: |-
pkg_owner: root
pkg_group: wheel
pkg_backup_conf: False
pkg_default_repo_template: repo.j2
pkg_default_repo_conf:
[]
pkg_repos_template: repo.j2
pkg_repos_conf:
[]
TASK [vbotka.freebsd.packages : Packages_install: Debug list pkg_list pkg_debug=true] ***
ok: [test_111] =>
pkg_list:
- security/sudo
- lang/python311
- ports-mgmt/pkg
TASK [vbotka.freebsd.packages : Packages_install: Install list pkg_list] *******
ok: [test_111 -> iocage_02(10.1.0.73)]
TASK [vbotka.freebsd.packages : Packages_install: Debug result pkg_debug=true] ***
ok: [test_111] =>
result:
attempts: 1
changed: false
failed: false
msg: package(s) already present
stderr: ''
stderr_lines: []
stdout: ''
stdout_lines: []
PLAY RECAP *********************************************************************
test_111 : ok=10 changed=0 unreachable=0 failed=0 skipped=32 rescued=0 ignored=0
Playbook output - Audit installed packages¶
There are no installed packages with known vulnerabilities
(env) > ansible-playbook pb-test-01.yml -i hosts \
-t pkg_stat \
-e pkg_stat=true -e pkg_audit_enable=true \
-e pkg_debug=true
PLAY [Test role vbotka.freebsd.packages.] **************************************
TASK [Gathering Facts] *********************************************************
ok: [test_112]
ok: [test_113]
ok: [test_111]
TASK [vbotka.freebsd.packages : Vars: Set the lists for amd64] *****************
ok: [test_111]
ok: [test_112]
ok: [test_113]
TASK [vbotka.freebsd.packages : Vars: Debug pkg_debug=true] ********************
ok: [test_111] =>
msg: |-
ansible_architecture: amd64
pkg_dict:
[]
pkg_list:
- lang/python311
- ports-mgmt/pkg
- security/sudo
pkg_list_deinstall:
[]
pkg_dict_select:
[]
ok: [test_112] =>
msg: |-
ansible_architecture: amd64
pkg_dict:
[]
pkg_list:
- lang/python311
- ports-mgmt/pkg
- security/sudo
pkg_list_deinstall:
[]
pkg_dict_select:
[]
ok: [test_113] =>
msg: |-
ansible_architecture: amd64
pkg_dict:
[]
pkg_list:
- lang/python311
- ports-mgmt/pkg
- security/sudo
pkg_list_deinstall:
[]
pkg_dict_select:
[]
TASK [vbotka.freebsd.packages : Stat: Get pkg audit] ***************************
ok: [test_112]
ok: [test_111]
ok: [test_113]
TASK [vbotka.freebsd.packages : Stat: Debug pkg audit pkg_debug=true] **********
ok: [test_111] =>
pkg_audit:
test_111:
pkg_count: 0
test_112:
pkg_count: 0
test_113:
pkg_count: 0
PLAY RECAP *********************************************************************
test_111 : ok=5 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
test_112 : ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
test_113 : ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Playbook pb-test-02.yml¶
- name: Test role vbotka.freebsd.packages.
hosts: iocage
gather_facts: true
roles:
- vbotka.freebsd.packages
Playbook output - Audit installed packages at iocage_02¶
There are 9 packages with known vulnerabilities
(env) > ansible-playbook pb-test-02.yml -i iocage.ini \
-t pkg_stat \
-e pkg_stat=true -e pkg_audit_enable=true -e pkg_debug=true
PLAY [Test role vbotka.freebsd.packages.] **************************************
TASK [Gathering Facts] *********************************************************
ok: [iocage_02]
TASK [vbotka.freebsd.packages : Vars: Set the lists for amd64] *****************
ok: [iocage_02]
TASK [vbotka.freebsd.packages : Vars: Debug pkg_debug=true] ********************
ok: [iocage_02] =>
msg: |-
ansible_architecture: amd64
pkg_dict:
[]
pkg_list:
- lang/python311
- ports-mgmt/pkg
- security/sudo
pkg_list_deinstall:
[]
pkg_dict_select:
[]
TASK [vbotka.freebsd.packages : Stat: Get pkg audit] ***************************
ok: [iocage_02]
TASK [vbotka.freebsd.packages : Stat: Debug pkg audit pkg_debug=true] **********
ok: [iocage_02] =>
pkg_audit:
iocage_02:
packages:
cups:
issue_count: 1
issues:
- Affected versions:
- < 2.4.11
cve:
- CVE-2024-47176
- CVE-2024-47175
- CVE-2024-47076
description: cups-filters -- remote code execution
url: https://vuxml.FreeBSD.org/freebsd/24375796-7cbc-11ef-a3a9-001cc0382b2f.html
reverse dependencies:
- gtk3
version: 2.4.10_1
emacs-nox:
issue_count: 1
issues:
- Affected versions:
- < 30.1,3
cve:
- CVE-2025-1244
description: Emacs -- Arbitrary code execution vulnerability
url: https://vuxml.FreeBSD.org/freebsd/e60e538f-e795-4a00-b475-cc85a7546e00.html
reverse dependencies: []
version: 29.4,3
expat:
issue_count: 1
issues:
- Affected versions:
- < 2.6.3
cve:
- CVE-2024-45492
- CVE-2024-45491
- CVE-2024-45490
description: expat -- multiple vulnerabilities
url: https://vuxml.FreeBSD.org/freebsd/ca5f3bbc-7a62-11ef-9533-f875a43e1796.html
reverse dependencies:
- mesa-dri
- xorg-server
- nvidia-driver-304
- mesa-libs
- git
- py311-iocage
- apache24
- mod_php83
- apr
- dbus-glib
- avahi-app
- cups
- gtk3
- fontconfig
- ffmpeg
- libass
- librsvg2-rust
- pango
- cairo
- libXft
- dbus
- at-spi2-core
- colord
- polkit
- wayland
- libva
- vulkan-loader
- libplacebo
- libxkbcommon
version: 2.6.2
git:
issue_count: 1
issues:
- Affected versions:
- < 2.48.1
cve:
- CVE-2024-52006
- CVE-2024-50349
description: git -- multiple vulnerabilities
url: https://vuxml.FreeBSD.org/freebsd/3445e4b6-d2b8-11ef-9ff3-43c2b5d6c4c8.html
reverse dependencies:
- py311-iocage
version: 2.46.0
openssl:
issue_count: 1
issues:
- Affected versions:
- < 3.0.15_1,1
cve:
- CVE-2024-9143
description: OpenSSL -- OOB memory access vulnerability
url: https://vuxml.FreeBSD.org/freebsd/c6f4177c-8e29-11ef-98e7-84a93843eb75.html
reverse dependencies:
- ssmtp
- mod_php83
- acme-tiny
- git
- py311-iocage
- wget
- rsync
- rsnapshot
- apache24
- apr
- curl
- rust
- libevent
- avahi-app
- cups
- gtk3
- ruby
- portupgrade
- ruby32-bdb
- p5-Net-SSLeay
- p5-IO-Socket-SSL
- libssh2
- db18
- py311-cryptography
- py311-dnspython
- py311-aioquic
- py311-service-identity
- py311-certbot
- py311-openssl
- py311-acme
- py311-josepy
- py311-ansible-core
- py311-ansible-lint
- py311-ansible-compat
- py311-ansible
- py311-ansible-runner
version: 3.0.14,1
py311-Jinja2:
issue_count: 1
issues:
- Affected versions:
- < 3.1.4
cve:
- CVE-2024-34064
description: Jinja2 -- Vulnerable to HTML attribute injection
when passing user input as keys to xmlattr filter
url: https://vuxml.FreeBSD.org/freebsd/04c9c3f8-5ed3-11ef-8262-b0416f0c4c67.html
reverse dependencies:
- py311-ansible-core
- py311-ansible-lint
- py311-ansible-compat
- py311-ansible
- py311-ansible-runner
version: 3.1.3
py311-configobj:
issue_count: 1
issues:
- Affected versions:
- <= 5.0.8
cve:
- CVE-2023-26112
description: Configobj -- Regular Expression Denial of Service
attack
url: https://vuxml.FreeBSD.org/freebsd/46419e8c-65d9-11ef-ac06-b0416f0c4c67.html
reverse dependencies:
- py311-certbot
version: 5.0.8
rsync:
issue_count: 1
issues:
- Affected versions:
- < 3.4.0
cve:
- CVE-2024-12747
- CVE-2024-12088
- CVE-2024-12087
- CVE-2024-12086
- CVE-2024-12085
- CVE-2024-12084
description: rsync -- Multiple security fixes
url: https://vuxml.FreeBSD.org/freebsd/163edccf-d2ba-11ef-b10e-589cfc10a551.html
reverse dependencies:
- rsnapshot
version: 3.3.0
xorg-server:
issue_count: 1
issues:
- Affected versions:
- < 21.1.16,1
cve:
- CVE-2025-26601
- CVE-2025-26600
- CVE-2025-26599
- CVE-2025-26598
- CVE-2025-26597
- CVE-2025-26596
- CVE-2025-26595
- CVE-2025-26594
description: xorg server -- Multiple vulnerabilities
url: https://vuxml.FreeBSD.org/freebsd/f4297478-fa62-11ef-b597-001fc69cd6dc.html
reverse dependencies:
- nvidia-driver-304
version: 21.1.14,1
pkg_count: 9
PLAY RECAP *********************************************************************
iocage_02 : ok=5 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0