Crypto keys generated after installing collections - Can they be removed?

[jpfloresibm]

SUMMARY

Installing ansible-collections creates the following files that introduce failures in vulnerability scans:

/opt/ansible/.ansible/collections/ansible_collections/community/crypto/tests/unit/plugins/module_utils/acme/fixtures/privatekey_1.pem
/opt/ansible/.ansible/collections/ansible_collections/community/general/tests/integration/targets/mail/files/smtpserver.key
/opt/ansible/.ansible/collections/ansible_collections/community/general/tests/integration/targets/setup_tls/files/ca_key.pem
/opt/ansible/.ansible/collections/ansible_collections/community/general/tests/integration/targets/setup_tls/files/client_key.pem
/opt/ansible/.ansible/collections/ansible_collections/community/general/tests/integration/targets/setup_tls/files/server_key.pem
/opt/ansible/.ansible/collections/ansible_collections/community/crypto/plugins/module_utils/crypto/pem.py

ISSUE TYPE

• Security

COMPONENT NAME

ansible collections 1.2.1

Questions: Are these files needed? Can they be removed after installing collections? All but last seem to be related to tests.

[felixfontein]

Please note that all the files in /opt/ansible/.ansible/collections/ansible_collections/community/general/ belong to community.general and not to this collection.

Anyway, the files in /opt/ansible/.ansible/collections/ansible_collections/*/*/tests/ are tests and not needed for using the collections, so you can delete them. /opt/ansible/.ansible/collections/ansible_collections/community/crypto/plugins/module_utils/crypto/pem.py is part of this collection and is needed by it. Deleting it will break some of the modules in this collection.

Installing ansible-collections creates the following files that introduce failures in vulnerability scans:

Out of curiosity: which vulnerability scans (plural) are highlighting these files?

[jpfloresibm]

We are using twistlock scans to determine if our images contain vulnerabilities. Our docker image installs ansible-collections and the twistlock scan reports a HIGH compliance issue on those keys that get generated.

[felixfontein]

About https://github.com/ansible-collections/community.crypto/blob/main/plugins/module_utils/crypto/pem.py: I guess the tool is triggered by https://github.com/ansible-collections/community.crypto/blob/main/plugins/module_utils/crypto/pem.py#L24-L25? You might want to file an issue with them so they can fix this bug in their software.