ansible-sign

What it is and what it does

ansible-sign is a library and command-line tool for cryptographically verifying Ansible content. It generates SHA256 checksums and GPG detached signatures to ensure that Ansible playbooks, roles, and other artifacts have not been tampered with and come from a trusted source. The package provides both a Python API for programmatic use and stable CLI commands for manual verification workflows.

The tool is intended for developers, system administrators, and information technology professionals who need to validate the integrity and authenticity of Ansible content in their environments. It depends on distlib for distribution utilities and python-gnupg to handle GPG operations. The CLI interface is considered stable within major versions, though the underlying library API may evolve.

Use it for:

• Verify that downloaded Ansible roles or collections have not been modified or compromised before deployment.
• Generate signed manifests for Ansible content you publish to ensure end users can authenticate your releases.
• Integrate content verification into CI/CD pipelines to block deployment of unsigned or tampered Ansible artifacts.
• Validate checksum integrity of Ansible playbooks distributed across teams or organizations.
• Establish a chain of trust for Ansible automation by cryptographically signing and verifying all content.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Generates and validates checksums and GPG signatures for Ansible content to verify authenticity and integrity.

Yes, if you need to sign or verify Ansible content. The package is actively maintained, has no known vulnerabilities, installs cleanly, and is licensed permissively under MIT. The CLI is stable; be aware the library API is not officially supported and may change. Suitable for production use in verification workflows.

Install

ansible-sign on PyPI

pip install ansible-sign

uv add ansible-sign

poetry add ansible-sign

Installing ansible-sign

Before you install

Low install friction with just two runtime dependencies (distlib and python-gnupg). Active maintenance with a release 45 days ago and recent commits; marked Production/Stable.

License in practice

MIT license permits commercial and private use with minimal restrictions; you may use, modify, and distribute this package freely provided you retain the license notice.

Quickstart

pip install ansible-sign

from ansible_sign.cli import main
# or use the CLI directly: ansible-sign --help

Requires Python 3.11 or later; GPG must be installed on the system for signature operations to work.

Verify before relying

• Whether the library API is production-ready despite the documentation's note that it is not officially supported and may change.
• Specific performance characteristics when handling large Ansible content collections or manifests.

Package facts

Evidence: ansible_sign-0.1.6-py3-none-any.whl

Keywords: ansible, sign

Tags

More Utilities packages