Repository: ansible/ansible

Issue:
APT: silently uses "--allow-untrusted" with `aptitude` on "safe-upgrade" [security]
I've just discovered irresponsible/insecure use of `--allow-untrusted` in _apt_ module:
on `safe-upgrade` operation with `aptitude`:

[lib/ansible/modules/packaging/os/apt.py#L747](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/packaging/os/apt.py#L747)

This is what _[aptitude(8)](https://manpages.debian.org/unstable/aptitude/aptitude.8.en.html)_ man page says about `--allow-untrusted`:

> Install packages from untrusted sources without prompting. You should only use this if you know what you are doing, as it could easily compromise your system's security.

Needless to say that `--allow-untrusted` should be removed ASAP and never used by default without being explicitly requested.

##### ISSUE TYPE
 - Bug Report :: security

##### COMPONENT NAME
_apt_ module

##### ANSIBLE VERSION
2.2.1.0

##### OS / ENVIRONMENT
N/A

##### STEPS TO REPRODUCE
~~~~
      apt:
        upgrade: safe
        force: true
        allow_unauthenticated: false
        install_recommends: true
~~~~

FYI @hlieberman.


Discussion:
It's not actually the `upgrade: safe` that's adding it, it's the `force: true`. That should probably be more clearly set out in the docs at least, or made a separate option...
it is also only way to avoid prompts, which can make the task get 'stuck'
Yeah, I suspect if we split that out to its own option and changed the default behavior now that it'd break a lot of folks... Might be something we could handle with `apt` alone better (rather than aptitude) on newer releases, but I haven't been keeping up with the state of the art there. 
It is very confusing how _apt_ module uses two different package management tools (`apt-get`, `aptitude`).
IMHO this is a bad design on its own and I'd recommend to restrict _apt_ module to `apt-get` only.
cc @mgwilliams
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
We've talked about this today with the understanding that force: True is necessary in order to avoid hanging in the module.  For 2.5 we'll document that the apt module is using force: True which installs packages from unverified sources.  We'll take a closer look at whether a fix is possible but cannot offer a guess as to the results of that without doing more research.

Resolving patch:
diff --git a/lib/ansible/modules/packaging/os/apt.py b/lib/ansible/modules/packaging/os/apt.py
--- a/lib/ansible/modules/packaging/os/apt.py
+++ b/lib/ansible/modules/packaging/os/apt.py
@@ -60,6 +60,8 @@
   force:
     description:
       - 'Corresponds to the C(--force-yes) to I(apt-get) and implies C(allow_unauthenticated: yes)'
+      - "This option will disable checking both the packages' signatures and the certificates of the
+        web servers they are downloaded from."
       - 'This option *is not* the equivalent of passing the C(-f) flag to I(apt-get) on the command line'
       - '**This is a destructive operation with the potential to destroy your system, and it should almost never be used.**
          Please also see C(man apt-get) for more information.'


Test patch: