Use dnf allow_downgrade for openssl EL9 workaround#1964
Merged
zjhuntin merged 1 commit intoJul 8, 2026
Conversation
Odilhao
approved these changes
Jul 8, 2026
Member
|
Did you consider that the dnf module has a provision for downgrade? https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/dnf_module.html#parameter-allow_downgrade |
Contributor
Author
|
@ehelms I did and tried it locally with that, but it failed 😦 |
Member
|
This worked for me: |
Contributor
Author
|
@ehelms my bad, it does work with that. I had tried it with all three packages and it did not work, with just the one that works, thanks! |
Swap the task order: downgrade first using ansible.builtin.dnf with allow_downgrade, then set excludepkgs to prevent update_os_packages from pulling 3.5.7-1 back in. The previous order failed because the excludes blocked depsolve during the downgrade. Tested on a CentOS 9 Stream box with openssl 3.5.7-1 installed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
zjhuntin
force-pushed
the
fix-openssl-fips-provider-downgrade
branch
from
67fda8f to
f7c40fb
Compare
ehelms
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ansible.builtin.package with state: present won't downgrade when a newer version is already installed. Switch to ansible.builtin.dnf with allow_downgrade: true so the pinned NVRs actually replace the broken 3.5.7-1 packages.