Repository: ansible/ansible

Issue:
APT: silently uses "--allow-untrusted" with `aptitude` on "safe-upgrade" [security]
I've just discovered irresponsible/insecure use of `--allow-untrusted` in _apt_ module:
on `safe-upgrade` operation with `aptitude`:

[lib/ansible/modules/packaging/os/apt.py#L747](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/packaging/os/apt.py#L747)

This is what _[aptitude(8)](https://manpages.debian.org/unstable/aptitude/aptitude.8.en.html)_ man page says about `--allow-untrusted`:

> Install packages from untrusted sources without prompting. You should only use this if you know what you are doing, as it could easily compromise your system's security.

Needless to say that `--allow-untrusted` should be removed ASAP and never used by default without being explicitly requested.

##### ISSUE TYPE
 - Bug Report :: security

##### COMPONENT NAME
_apt_ module

##### ANSIBLE VERSION
2.2.1.0

##### OS / ENVIRONMENT
N/A

##### STEPS TO REPRODUCE
~~~~
      apt:
        upgrade: safe
        force: true
        allow_unauthenticated: false
        install_recommends: true
~~~~

FYI @hlieberman.


Discussion:
It's not actually the `upgrade: safe` that's adding it, it's the `force: true`. That should probably be more clearly set out in the docs at least, or made a separate option...
it is also only way to avoid prompts, which can make the task get 'stuck'
Yeah, I suspect if we split that out to its own option and changed the default behavior now that it'd break a lot of folks... Might be something we could handle with `apt` alone better (rather than aptitude) on newer releases, but I haven't been keeping up with the state of the art there. 
It is very confusing how _apt_ module uses two different package management tools (`apt-get`, `aptitude`).
IMHO this is a bad design on its own and I'd recommend to restrict _apt_ module to `apt-get` only.
cc @mgwilliams
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
We've talked about this today with the understanding that force: True is necessary in order to avoid hanging in the module.  For 2.5 we'll document that the apt module is using force: True which installs packages from unverified sources.  We'll take a closer look at whether a fix is possible but cannot offer a guess as to the results of that without doing more research.
On reviewing the code, --allow-untrusted or its equivalents are only being used if the user specifies ```force: True``` as a parameter so this is not a "default".  I've added information to the apt documentation that this is a behaviour of the force parameter in this PR: https://github.com/ansible/ansible/pull/37353

@onlyjob also note that in ansible-2.4.x we've added the parameter force_apt_get which, if set to True uses apt-get instead of aptitude.  This parameter defaults to False (at least for the moment) for backwards compatibility.  If aptitude is not installed, then we also fall back to apt-get in 2.4 as well.

Resolving patch:
diff --git a/lib/ansible/modules/packaging/os/apt.py b/lib/ansible/modules/packaging/os/apt.py
--- a/lib/ansible/modules/packaging/os/apt.py
+++ b/lib/ansible/modules/packaging/os/apt.py
@@ -60,6 +60,8 @@
   force:
     description:
       - 'Corresponds to the C(--force-yes) to I(apt-get) and implies C(allow_unauthenticated: yes)'
+      - "This option will disable checking both the packages' signatures and the certificates of the
+        web servers they are downloaded from."
       - 'This option *is not* the equivalent of passing the C(-f) flag to I(apt-get) on the command line'
       - '**This is a destructive operation with the potential to destroy your system, and it should almost never be used.**
          Please also see C(man apt-get) for more information.'


Test patch: