Add debian 13 deb822 compatibility (#97)

* Add debian 13 compatibility by using deb822 on Debian 13 distributions
* Add debian 13 docker image for molecule
* Add base url for deb repo and deb822 install
---------
* python3-debian is required for DEB822 support added task to make sure its installed
* Fixed ansible-lint findings

Signed-off-by: Gary Bright <gary@mondoo.com>
Co-authored-by: Gary Bright <gary@mondoo.com>

Author: elivlo

.github/workflows/ansible-ci.yaml

@@ -12,6 +12,8 @@ jobs:
         config:
           - image: geerlingguy/docker-ubuntu2204-ansible
             tag: latest
+          - image: geerlingguy/docker-debian13-ansible
+            tag: latest
           - image: geerlingguy/docker-rockylinux9-ansible
             tag: latest
           - image: rsprta/opensuse-ansible

defaults/main.yml

@@ -35,7 +35,8 @@ update_windows_time: "12:00:00"
 mondoo_gpg_keyid: 4CE909E26AE7439C39CE7647AC69C65100E1C42B
 
 # deb repo
-mondoo_deb_repo: "https://releases.mondoo.com/debian/ stable main"
+mondoo_deb_repo_base_url: "https://releases.mondoo.com/debian/"
+mondoo_deb_repo: "{{ mondoo_deb_repo_base_url }} stable main"
 mondoo_deb_gpgkey: "https://releases.mondoo.com/debian/pubkey.gpg"
 mondoo_deb_gpgkey_dest: "/usr/share/keyrings/mondoo-archive-keyring.gpg"
 

tasks/pkg_debian.yml

@@ -3,45 +3,67 @@
 
 ---
 
-- name: Install gpg
+- name: Install gpg and apt-transport-https
   ansible.builtin.apt:
-    name: gpg
+    name:
+      - gpg
+      - apt-transport-https
     state: present
     update_cache: yes
   become: true
   when: not ansible_check_mode
 
-- name: Add Mondoo apt repository key.
-  ansible.builtin.get_url:
-    url: "{{ mondoo_deb_gpgkey }}"
-    dest: "/etc/apt/trusted.gpg.d/mondoo.asc"
-    mode: '0644'
-    force: true
-  become: true
-  when: not ansible_check_mode
+- name: Configure repository for Debian <= 12 and other distributions
+  when:
+    - not ansible_check_mode
+    - ansible_distribution != "Debian" or (ansible_distribution == "Debian" and ansible_distribution_major_version | int <= 12)
+  block:
+    - name: Add Mondoo apt repository key.
+      ansible.builtin.get_url:
+        url: "{{ mondoo_deb_gpgkey }}"
+        dest: "/etc/apt/trusted.gpg.d/mondoo.asc"
+        mode: '0644'
+        force: true
+      become: true
 
-- name: Pack Mondoo gpg key
-  ansible.builtin.command: gpg --dearmor --batch --yes --output {{ mondoo_deb_gpgkey_dest }} /etc/apt/trusted.gpg.d/mondoo.asc
-  changed_when: false
-  no_log: true
-  become: "{{ use_become }}"
+    - name: Pack Mondoo gpg key
+      ansible.builtin.command: gpg --dearmor --batch --yes --output {{ mondoo_deb_gpgkey_dest }} /etc/apt/trusted.gpg.d/mondoo.asc
+      changed_when: false
+      no_log: true
+      become: "{{ use_become }}"
+
+    - name: Configure Mondoo deb repository
+      ansible.builtin.apt_repository:
+        repo: "deb [signed-by={{ mondoo_deb_gpgkey_dest }}] {{ mondoo_deb_repo }}"
+        filename: "mondoo"
+        state: "present"
+        update_cache: yes
+      become: "{{ use_become }}"
 
-- name: Install apt-transport-https
+- name: Install python3-debian for DEB822 repository support (Debian 13+)
   ansible.builtin.apt:
-    name: apt-transport-https
+    name: python3-debian
     state: present
     update_cache: yes
   become: true
-  when: not ansible_check_mode
+  when:
+    - not ansible_check_mode
+    - ansible_distribution == "Debian"
+    - ansible_distribution_major_version | int >= 13
 
-- name: Configure Mondoo deb repository
-  ansible.builtin.apt_repository:
-    repo: "deb [signed-by={{ mondoo_deb_gpgkey_dest }}] {{ mondoo_deb_repo }}"
-    filename: "mondoo"
-    state: "present"
-    update_cache: yes
+- name: Configure Mondoo deb repository (DEB822 format)
+  ansible.builtin.deb822_repository:
+    name: mondoo
+    types: deb
+    uris: "{{ mondoo_deb_repo_base_url }}"
+    suites: stable
+    components: main
+    signed_by: "{{ mondoo_deb_gpgkey }}"
   become: "{{ use_become }}"
-  when: not ansible_check_mode
+  when:
+    - not ansible_check_mode
+    - ansible_distribution == "Debian"
+    - ansible_distribution_major_version | int >= 13
 
 - name: Ensure cnquery and cnspec are installed
   ansible.builtin.apt: