Roles namespace has changed with the new Galaxy website

[btravouillon]

Bug Report

SUMMARY

Our namespace mila was created in #2792.

Since then, people are using mila.<collection_name> and mila.<role_name> to install our roles and collections.

---
roles:
  - name: mila.bareos
    version: 1.5.0

  - name: mila.cobbler
    version: v0.2.2

  - name: mila.cobbler
    version: v0.3.3

collections:
  - name: mila.proxmox
    version: 0.5.2

Previously, we were able to see our published content with a single URL (https://galaxy.ansible.com/mila).

Today, there are three URLs, one for the collections and two others for the roles.

• Collections : https://galaxy.ansible.com/ui/namespaces/mila/
• Roles : https://galaxy.ansible.com/ui/standalone/namespaces/4653/ -> The namespace for the roles is incorrect. It matches the (legacy) name of our GitHub organization, but not the name we are using with Ansible Galaxy.
• Roles : https://galaxy.ansible.com/ui/standalone/namespaces/9418/ -> Has our content but links to a GitHub account which is not our organization.

STEPS TO REPRODUCE

Access to https://galaxy.ansible.com/mila/ -> you are redirected to the home page

Search for "clockwork" in the roles : this will return two results with the same content. If you enter the official role (https://galaxy.ansible.com/ui/standalone/roles/mila/clockwork/) and click on Github Repository, you'll get a 404.

EXPECTED RESULTS

I expect to see all the published content (roles and collections) in the same page (https://galaxy.ansible.com/ui/namespaces/mila/ or even better https://galaxy.ansible.com/mila/ for backward compatibility).

If that's not possible with the NG version, I would at least expect to get a coherent namespace which is mila.

ACTUAL RESULTS

[btravouillon]

Might be related : I need to publish a new version of role mila.slurm today. Before, I was using the effortless Import Role button in the GUI.

Now, there is no such button. Instead, the documentation mentions that one has to use the CLI.

(venv) me@host:~/Documents/git/ansible-slurm$ ansible-galaxy role import mila ansible-slurm
Successfully submitted import request 2050659408901112805195307551365372982
git clone for https://github.com/mila/ansible-slurm failed
  File "/venv/lib64/python3.11/site-packages/pulpcore/tasking/tasks.py", line 66, in _execute_task
    result = func(*args, **kwargs)
             ^^^^^^^^^^^^^^^^^^^^^
  File "/app/galaxy_ng/app/api/v1/tasks.py", line 93, in legacy_role_import
    raise Exception(f'git clone for {clone_url} failed')

Given that my org GitHub user is mila-iqia, let's give it a try:

(venv) me@host:~/Documents/git/ansible-slurm$ ansible-galaxy role import mila-iqia ansible-slurm
ERROR! None (HTTP Code: 403, Message: Forbidden)

Version

$ ansible-galaxy --version
ansible-galaxy [core 2.15.1]
  config file = /home/me/Documents/git/ansible-slurm/ansible.cfg
  configured module search path = ['/home/me/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/ne/.ansible/venv/lib/python3.11/site-packages/ansible
  ansible collection location = /home/ne/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/ne/.ansible/venv/bin/ansible-galaxy
  python version = 3.11.2 (main, Mar 13 2023, 12:18:29) [GCC 12.2.0] (/home/ne/.ansible/venv/bin/python3)
  jinja version = 3.1.2
  libyaml = True

Config

ansible.cfg created as per https://ansible.readthedocs.io/projects/galaxy-ng/en/latest/community/userguide/#ansible-core-cli-setup. I changed the URL from https://beta-galaxy.ansible.com/api/ to https://galaxy.ansible.com/api/.

$ cat ansible.cfg 
[galaxy]
server_list = beta

[galaxy_server.beta]
url = https://galaxy.ansible.com/api/
token = <my token API from https://ansible.readthedocs.io/projects/galaxy-ng/en/latest/community/userguide/#generating-an-api-token>

[btravouillon]

Crosspost to https://forum.ansible.com/t/roles-namespace-has-changed-with-the-new-galaxy-website/1304 which seems to be the official channel to get support with Galaxy NG.

[lkiesow]

Not only have the namespaces changed, but some namespaces/roles/… now seem to have been transferred to other users. The elan.opencast_user is the old name:

This is a severe security risk since people can easily take over and execute a supply chain attack using this

[secustor]

Also probably related, we ( @renovatebot ) getting reports that ansible roles and collections can not be resolved anymore.

We are using the v2 API btw.

[sebdanielsson]

After changing my GitHub username to all lowercase and now I got two namespaces. Tried to delete the old but the API says I don’t have permission. So now I have two versions of the same role on Galaxy. These things really should be case-insensitive…