Hi Ed,
On 15/08/2025 03:16, Ed Blackman wrote:
Package: ansible-core
Version: 2.14.18-0+deb12u2
Severity: important
Dear Maintainer,
I am attempting to use my ansible playbooks on an up-to-date bookworm
system to create a new trixie VM. Several of the playbooks use get_url
to retrieve a URL's content on the remote system.
When I run one of those playbooks, I get
failed: [example.lan] (item={'url': 'https://example.org/some/path/foo.txt',
'dest': '/another/path/foo.txt'}) => {"ansible_loop_var": "item",
"changed": false, "dest": "/another/path/foo.txt", "elapsed": 0, "item":
{"dest": "/another/path/foo.txt", "url":
"https://example.org/some/path/foo.txt"}, "msg": "An unknown error
occurred: HTTPSConnection.__init__() got an unexpected keyword argument
'cert_file'", "url": "https://example.org/some/path/foo.txt"}
Doing some online searching (eg [1]) I belive the problem occurs because
the bookworm host system is passing 'cert_file' in Python executed on
the remote system, but the remote system has Python 3.12+ and
HTTPSConnection doesn't allow a 'cert_file' keyword. (Note that the play
doesn't have a cert_file option specified.)
My search ([1]) indicates the problem was fixed in ansible-core 2.16.0,
but bookworm is based on 2.14.18, and there's no bookworm-backport for
ansible.
Generally that is correct, and expected behaviour. ansible only supports python
version that existed at the release of the version. The support matrix is
available here:
https://docs.ansible.com/ansible/latest/reference_appendices/release_and_maintenance.html#ansible-core-support-matrix
You can see that ansible 2.14 does support python up to version 3.11, whereas
trixie has python 3.13.
If I'm wrong with the assumption that you're trying to run ansible 2.14 against
a trixie target, and instead both your controller and target are bookworm,
please provide a minimal reproducer.
Would it be possible to backport some version of the fix to bookworm?
I will generally not do that, since I expect a lot of 2.14 code to fail on
python 3.13, and I do not want to retroactively widen the support matrix that
upstream isn't even willing to support. As such, I'll tag this bug wontfix.
However, several alternatives exist:
Your options are either upgrading to trixie that ships ansible 2.19, which
supports python3.13 (but then again drops 2.7 support, so you need to check if
you have very old machines). Or installing ansible via pip in a virtual environment.
I might provide a backported ansible 2.19.1 for bookworm, but that will happen
earliest in a few weeks, after it has been released and the version in trixie is
updated.
Hope I could help!
Greets,
Lee
[1] https://forum.ansible.com/t/unknown-error-httpsconnection-init/38811
-- System Information:
Debian Release: 12.11
APT prefers oldstable-security
APT policy: (500, 'oldstable-security'), (500, 'oldstable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.1.0-35-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages ansible-core depends on:
ii openssh-client 1:9.2p1-2+deb12u6
ii python3 3.11.2-1+b1
ii python3-cryptography 38.0.4-3+deb12u1
ii python3-distutils 3.11.2-3
ii python3-dnspython 2.3.0-1
ii python3-httplib2 0.20.4-3
ii python3-jinja2 3.1.2-1+deb12u2
ii python3-netaddr 0.8.0-2
ii python3-packaging 23.0-1
ii python3-paramiko 2.12.0-2
ii python3-resolvelib 0.9.0-2
ii python3-yaml 6.0-3+b2
Versions of packages ansible-core recommends:
ii ansible 7.7.0+dfsg-3+deb12u1
ii python3-argcomplete 2.0.0-1
ii python3-jmespath 1.0.1-1
ii python3-kerberos 1.1.14-3.1+b7
ii python3-libcloud 3.4.1-5
ii python3-passlib 1.7.4-3
ii python3-selinux 3.4-1+b6
ii python3-winrm 0.3.0-4+deb12u1
ii python3-xmltodict 0.13.0-1
Versions of packages ansible-core suggests:
pn cowsay <none>
pn sshpass <none>
-- no debconf information
