GitHub Workflow执行Ansible遇E:Invalid archive signature本地Docker正常

问题背景 #

使用GitHub Workflow增量测试Ansible Playbook时，仅在GitHub官方执行环境中出现Unable to install package: E:Invalid archive signature错误，本地Docker容器、用act模拟Workflow、Docker内手动运行均能成功安装Hamachi的deb包。涉及的Playbook任务逻辑如下：

---

- name: Ensure Download directory exists for new user
  file:
    path: "/home/{{ ansible_user }}/Downloads"
    state: directory
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
  become: True

- name: Copy hamachi installation package
  copy:
    src: logmein-hamachi_{{ hamachi_version }}.deb
    dest: /home/{{ ansible_user }}/Downloads/logmein-hamachi_{{ hamachi_version }}.deb
  when: ansible_architecture == "x86_64"

- name: Install hamachi client
  apt:
    deb: /home/{{ ansible_user }}/Downloads/logmein-hamachi_{{ hamachi_version }}.deb
  become: yes
  when: ansible_architecture == "x86_64"

排查与解决方向 #

1. 验证Deb包完整性 #

GitHub环境中copy模块可能因传输或环境差异导致文件损坏，可添加哈希校验步骤：

- name: Verify Hamachi deb package integrity
  command: sha256sum /home/{{ ansible_user }}/Downloads/logmein-hamachi_{{ hamachi_version }}.deb
  register: deb_sha256
  failed_when: deb_sha256.stdout.split(' ')[0] != "本地预计算的SHA256哈希值"
  when: ansible_architecture == "x86_64"

或改用get_url直接从官方源下载，规避本地复制风险：

- name: Download Hamachi deb package
  get_url:
    url: "https://secure.logmein.com/labs/logmein-hamachi_{{ hamachi_version }}.deb"
    dest: /home/{{ ansible_user }}/Downloads/logmein-hamachi_{{ hamachi_version }}.deb
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
  when: ansible_architecture == "x86_64"

2. 适配GitHub Runner的APT签名校验策略 #

部分GitHub Runner镜像默认开启严格签名校验，可尝试两种处理方式：

• 临时允许未认证包（仅测试用）：

  - name: Install hamachi client with allow unauthenticated
    apt:
      deb: /home/{{ ansible_user }}/Downloads/logmein-hamachi_{{ hamachi_version }}.deb
      allow_unauthenticated: yes
    become: yes
    when: ansible_architecture == "x86_64"
  

• 导入Hamachi官方GPG密钥，让系统信任包签名：

  - name: Add Hamachi GPG key
    apt_key:
      url: https://secure.logmein.com/labs/logmein-hamachi.gpg
      state: present
    become: yes
    when: ansible_architecture == "x86_64"
  

3. 修复文件权限限制 #

GitHub Runner可能有额外安全限制，导致deb包无法被正确读取：

- name: Fix deb package permissions
  file:
    path: /home/{{ ansible_user }}/Downloads/logmein-hamachi_{{ hamachi_version }}.deb
    mode: '0644'
  when: ansible_architecture == "x86_64"

4. 统一APT工具版本 #

本地与GitHub Runner的APT/python-apt版本差异可能引发兼容性问题，可先更新工具：

- name: Update apt tools
  apt:
    name: apt, python3-apt
    state: latest
  become: yes

调试建议 #

在Workflow中添加步骤，输出deb包的文件信息用于对比：

- name: Debug deb package info
  command: |
    ls -lh /home/{{ ansible_user }}/Downloads/logmein-hamachi_{{ hamachi_version }}.deb
    sha256sum /home/{{ ansible_user }}/Downloads/logmein-hamachi_{{ hamachi_version }}.deb
  when: ansible_architecture == "x86_64"

内容的提问来源于stack exchange，提问作者sage