CryptographyDeprecationWarnings in Ansible output

[RobinR1]

When the passbolt ansible lookup plugin is used 3 warnings are logged whenever the lookup is performed by Ansible:

 SymmetricKeyAlgorithm.CAST5: algorithms.CAST5,
/usr/local/lib/python3.9/site-packages/pgpy/constants.py:195: CryptographyDeprecationWarning: Blowfish has been deprecated and will be removed in a future release
  SymmetricKeyAlgorithm.Blowfish: algorithms.Blowfish,
/usr/local/lib/python3.9/site-packages/pgpy/constants.py:192: CryptographyDeprecationWarning: IDEA has been deprecated and will be removed in a future release
  bs = {SymmetricKeyAlgorithm.IDEA: algorithms.IDEA,
/usr/local/lib/python3.9/site-packages/pgpy/constants.py:194: CryptographyDeprecationWarning: CAST5 has been deprecated and will be removed in a future release

I assume this is due to: SecurityInnovation/PGPy#398
reported 2 years ago, but it doesn't seem that the pgpy project has much activity..
Can we get rid of these warnings in the Passbolt Ansible plugin?

[Robert-75]

Is there any way to suppress these warnings atleast?

[RobinR1]

The warnings are getting more and more urging, now claiming that those methods will be removed from version 45.0.0:

/usr/local/lib/python3.13/site-packages/pgpy/constants.py:192: CryptographyDeprecationWarning: IDEA has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.IDEA and will be removed from this module in 45.0.0.
  bs = {SymmetricKeyAlgorithm.IDEA: algorithms.IDEA,
/usr/local/lib/python3.13/site-packages/pgpy/constants.py:193: CryptographyDeprecationWarning: TripleDES has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES and will be removed from this module in 48.0.0.
  SymmetricKeyAlgorithm.TripleDES: algorithms.TripleDES,
/usr/local/lib/python3.13/site-packages/pgpy/constants.py:194: CryptographyDeprecationWarning: CAST5 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.CAST5 and will be removed from this module in 45.0.0.
  SymmetricKeyAlgorithm.CAST5: algorithms.CAST5,
/usr/local/lib/python3.13/site-packages/pgpy/constants.py:195: CryptographyDeprecationWarning: Blowfish has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.Blowfish and will be removed from this module in 45.0.0.

Will the Ansible lookup plugin stop working when version 45.0.0 of the module is reached ?

[AnatomicJC]

Hi @RobinR1,

Thanks for the ping on this issue. Unfortunately, it seems the PGPy has no activity since 2 years and this warning come from this library 🙁

The passbolt lookup plugin works also with gnupg library. Are you able to work with this library instead of PGPy?

I’m afraid than I will be forced to deprecate the PGPy library.

Best regards,

[RobinR1]

For that to test, I have to import the private key into the AWX Execution Environment somewhere during the image build process and to be able to do that, I will have to integrate passbolt into GitLab CI/CD to prevent pushing the private key to git..
should all be doable.. but quite some extra work to research..
I will try to do this, but it will take some time..

[RobinR1]

Since I'm a bit uncomfortable baking in the private key into the Execution Environment, I currently try to import the private key at the start of each playbook using:

- name: Test passbolt lookup plugin
  hosts: localhost
  gather_facts: no
  environment:
    PASSBOLT_GPG_LIBRARY: gnupg
    PASSBOLT_FINGERPRINT: XXXXXXXXXXXXXXXXXXXXXXXX
  tasks:
    - name: copy pgp key
      ansible.builtin.copy:
        content: "{{ lookup('ansible.builtin.env', 'PASSBOLT_PRIVATE_KEY') }}"
        dest: /tmp/private.key
        mode: "0600"

    - name: configure gpg
      ansible.builtin.lineinfile:
        path: "~/.gnupg/gpg.conf"
        state: present
        regexp: "^{{ item }}"
        line: "{{ item }}"
        create: true
      loop:
        - use-agent
        - pinentry-mode loopback
        - no-greeting

    - name: configure gpg agent
      ansible.builtin.lineinfile:
        path: "~/.gnupg/gpg-agent.conf"
        state: present
        regexp: "^{{ item }}"
        line: "{{ item }}"
        create: true
      loop:
        - allow-loopback-pinentry
        - allow-preset-passphrase
        - max-cache-ttl 60480000
        - default-cache-ttl 60480000
    
    - name: (re)start agent
      ansible.builtin.shell: "echo RELOADAGENT | gpg-connect-agent"
    
    - name: import gpg key
      ansible.builtin.command: gpg --no-tty --batch --yes --passphrase {{ lookup('ansible.builtin.env', 'PASSBOLT_PASSPHRASE') }} --import /tmp/private.key 

    - name: Lookup predefined resource
      ansible.builtin.debug:
        msg: "Password resource 1 is: {{ lookup('anatomicjc.passbolt.passbolt', 'Ansible predefined test resource').password }}"

But I get this error:

  msg: 'An unhandled exception occurred while running the lookup plugin ''anatomicjc.passbolt.passbolt''.
    Error was a <class ''TypeError''>, original message: string indices must be integers,
    not ''str''. string indices must be integers, not ''str'''

[RobinR1]

After much trail and error I was finally able to make Passbolt lookup work using GPG inside an Execution Environment without baking in the private key into the EE image.
While building the EE image I now make sure that /root/.gnupg exists and that gpg.conf and gpg-agent.conf are present in /etc/gnupg/:

execution-environment.yml:

additional_build_files:
  - src: files/gpg.conf
    dest: configs
  - src: files/gpg-agent.conf
    dest: configs

 append_final:
    # Configure GnuPG for use by Ansible
    - RUN mkdir -m 0600 -p /root/.gnupg
    - ADD _build/configs/gpg.conf /etc/gnupg/gpg.conf
    - ADD _build/configs/gpg-agent.conf /etc/gnupg/gpg-agent.conf

gpg.conf:

use-agent
no-greeting
trust-model always
batch
no-tty

gpg-agent.conf:

allow-loopback-pinentry
allow-preset-passphrase
max-cache-ttl 60480000
default-cache-ttl 60480000

I will now have to add this to every Ansible playbook using Passbolt lookup:

- name: Initialize passbolt lookup plugin
  hosts: localhost
  gather_facts: no
  environment:
    PASSBOLT_GPG_LIBRARY: gnupg
    PASSBOLT_FINGERPRINT: "{{ lookup('ansible.builtin.env', 'PASSBOLT_PRIVATE_KEY') | community.crypto.gpg_fingerprint }}" 
  tasks:
    - name: Check GnuPG keys
      ansible.builtin.shell: |
        set -o pipefail
        [[ $(echo "KEYINFO --list" | gpg-connect-agent | awk '/KEYINFO/ { print $8 }' | grep -e '^P$' | wc -l) -eq 2 ]]
      failed_when: false
      changed_when: false
      register: gpg_check

    - name: Initialize GnuPG for use by Passbolt
      ansible.builtin.shell: |
        set -o pipefail
        # Ensure agent is started
        echo RELOADAGENT | gpg-connect-agent || exit 1
        # Import private key
        echo "{{ lookup('ansible.builtin.env', 'PASSBOLT_PRIVATE_KEY') }}" | gpg --import || exit 1
       # Preload passphrase
        keygrip=$(echo "KEYINFO --list" | gpg-connect-agent | awk '/KEYINFO/ { print $3 }')
        for k in $keygrip; do
          echo "{{ lookup('ansible.builtin.env', 'PASSBOLT_PASSPHRASE') }}" | \
            "$(gpgconf --list-dirs libexecdir)"/gpg-preset-passphrase --preset $k
        done
        # Check for correctly preloaded passphrase
        [[ $(echo "KEYINFO --list" | gpg-connect-agent | awk '/KEYINFO/ { print $8 }' | grep -e '^P$' | wc -l) -eq 2 ]]
      register: gpg_import_key
      changed_when: false
      failed_when:
        - "'secret key imported' not in gpg_import_key.stderr"
        - gpg_import_key.rc != 0
      when: gpg_check.rc != 0
      no_log: true

This way it has 'backwards compatibility' with the PGPy method of providing the private key as environment variable.

Is there any chance that you can implement this or similar logic into the lookup plugin or the passbolt python library?

[RobinR1]

After some succesfull tests, I tried implementing this method in production. But soon I found out that many passwords no longer work due to the error:

Error was a <class ''ansible.errors.AnsibleError''>, original message: An                                                                                                                                
unhandled exception occurred while running the lookup plugin ''anatomicjc.passbolt.cached''.                                                                                                                   
Error was a <class ''TypeError''>, original message: Object of type bytes is not
JSON serializable. Object of type bytes is not JSON serializable'

It seems the cached plugin somehow no longer works reliably as when I change the failing lookup back to a straight anatomicjc.passbolt.passbolt lookup instead of a anatomicjc.passbolt.cached; It does work.

Strange however is that other passwords (those I initially tested with) all work correctly, also when using the cached plugin.
(I'm currently using a patched version of the cached plugin: #23 (comment))