From 625e93b5241c710e24f4432f693d0524de0e3dc6 Mon Sep 17 00:00:00 2001
From: Markus Pesch <markus.pesch@cryptic.systems>
Date: Mon, 7 Sep 2026 17:24:19 +0200
Subject: [PATCH] fix: install cryptography via the distribution package
 manager

Installing the python cryptography bindings with ansible.builtin.pip is rejected by PEP 668 on distributions
which mark their python installation as externally managed. Fedora 38+, Ubuntu 23.04+ and RHEL 10 are
affected, so the role aborted on its very first task there.

The package names are resolved from vars/ via first_found, which keeps distribution specifics out of the
task file. vars/main.yaml provides python3-cryptography as a fallback for every family without a dedicated
file, Archlinux overrides it with python-cryptography.

Co-authored-by: Copilot <copilot@github.com>
---
 tasks/main.yaml     | 19 ++++++++++++++++---
 vars/Archlinux.yaml |  4 ++++
 vars/main.yaml      |  6 ++++++
 3 files changed, 26 insertions(+), 3 deletions(-)
 create mode 100644 vars/Archlinux.yaml
 create mode 100644 vars/main.yaml

diff --git a/tasks/main.yaml b/tasks/main.yaml
index 1f64cab..1ff1ce2 100644
--- a/tasks/main.yaml
+++ b/tasks/main.yaml
@@ -1,8 +1,21 @@
 ---
 
-- name: Install required python library cryptography
-  ansible.builtin.pip:
-    name: cryptography>=1.2.3
+- name: Include OS-specific variables
+  ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
+  vars:
+    params:
+      files:
+      - "{{ ansible_facts['distribution'] }}_{{ ansible_facts['architecture'] }}.yaml"
+      - "{{ ansible_facts['distribution'] }}.yaml"
+      - "{{ ansible_facts['os_family'] }}_{{ ansible_facts['architecture'] }}.yaml"
+      - "{{ ansible_facts['os_family'] }}.yaml"
+      - main.yaml
+      paths:
+      - vars
+
+- name: Install required python libraries
+  ansible.builtin.package:
+    name: "{{ certificate_authority_python_packages }}"
     state: present
 
 - name: Create or import a root Certificate Authority (CA)
diff --git a/vars/Archlinux.yaml b/vars/Archlinux.yaml
new file mode 100644
index 0000000..6e52599
--- /dev/null
+++ b/vars/Archlinux.yaml
@@ -0,0 +1,4 @@
+---
+
+certificate_authority_python_packages:
+- python-cryptography
diff --git a/vars/main.yaml b/vars/main.yaml
new file mode 100644
index 0000000..6625c88
--- /dev/null
+++ b/vars/main.yaml
@@ -0,0 +1,6 @@
+---
+
+# Fallback for distributions without a dedicated vars file. Overridden by the
+# os-specific file included in tasks/main.yaml.
+certificate_authority_python_packages:
+- python3-cryptography