From 81ca04512dbe52f6057895a2525484bc5b60a837 Mon Sep 17 00:00:00 2001 From: Matt Martz Date: Wed, 22 Aug 2018 10:24:11 -0500 Subject: [PATCH] Raise a nicer error when we cannot execute the editor (#44423) * Raise a nicer error when we cannot execute the editor. Fixes #44419 * Don't use to_bytes when constructing an exception * Add changelog fragment --- changelogs/fragments/vault-errors.yaml | 2 ++ lib/ansible/parsing/vault/__init__.py | 15 ++++++++------- 2 files changed, 10 insertions(+), 7 deletions(-) create mode 100644 changelogs/fragments/vault-errors.yaml diff --git a/changelogs/fragments/vault-errors.yaml b/changelogs/fragments/vault-errors.yaml new file mode 100644 index 00000000000..5cfbc88a73a --- /dev/null +++ b/changelogs/fragments/vault-errors.yaml @@ -0,0 +1,2 @@ +bugfixes: +- vault - fix error message encoding, and ensure we present a friendlier error when the EDITOR is missing (https://github.com/ansible/ansible/pull/44423) diff --git a/lib/ansible/parsing/vault/__init__.py b/lib/ansible/parsing/vault/__init__.py index d5ef4fca493..61d7430b256 100644 --- a/lib/ansible/parsing/vault/__init__.py +++ b/lib/ansible/parsing/vault/__init__.py @@ -853,16 +853,17 @@ class VaultEditor: fd, tmp_path = tempfile.mkstemp(suffix=ext) os.close(fd) + cmd = self._editor_shell_command(tmp_path) try: if existing_data: self.write_data(existing_data, tmp_path, shred=False) # drop the user into an editor on the tmp file - subprocess.call(self._editor_shell_command(tmp_path)) - except: + subprocess.call(cmd) + except Exception as e: # whatever happens, destroy the decrypted file self._shred_file(tmp_path) - raise + raise AnsibleError('Unable to execute the command "%s": %s' % (' '.join(cmd), to_native(e))) b_tmpdata = self.read_data(tmp_path) @@ -917,7 +918,7 @@ class VaultEditor: try: plaintext = self.vault.decrypt(ciphertext, filename=filename) except AnsibleError as e: - raise AnsibleError("%s for %s" % (to_bytes(e), to_bytes(filename))) + raise AnsibleError("%s for %s" % (to_native(e), to_native(filename))) self.write_data(plaintext, output_file or filename, shred=False) def create_file(self, filename, secret, vault_id=None): @@ -951,7 +952,7 @@ class VaultEditor: # TODO: return the vault_id that worked? plaintext, vault_id_used, vault_secret_used = self.vault.decrypt_and_get_vault_id(vaulttext) except AnsibleError as e: - raise AnsibleError("%s for %s" % (to_bytes(e), to_bytes(filename))) + raise AnsibleError("%s for %s" % (to_native(e), to_native(filename))) # Figure out the vault id from the file, to select the right secret to re-encrypt it # (duplicates parts of decrypt, but alas...) @@ -980,7 +981,7 @@ class VaultEditor: plaintext = self.vault.decrypt(vaulttext, filename=filename) return plaintext except AnsibleError as e: - raise AnsibleVaultError("%s for %s" % (to_bytes(e), to_bytes(filename))) + raise AnsibleVaultError("%s for %s" % (to_native(e), to_native(filename))) # FIXME/TODO: make this use VaultSecret def rekey_file(self, filename, new_vault_secret, new_vault_id=None): @@ -997,7 +998,7 @@ class VaultEditor: try: plaintext, vault_id_used, _dummy = self.vault.decrypt_and_get_vault_id(vaulttext) except AnsibleError as e: - raise AnsibleError("%s for %s" % (to_bytes(e), to_bytes(filename))) + raise AnsibleError("%s for %s" % (to_native(e), to_native(filename))) # This is more or less an assert, see #18247 if new_vault_secret is None: