How to debug “ERROR! Unexpected Exception: Non-hexadecimal digit found” in Ansible and Vagrant?

4
votes

I am facing a problem trying to run Vagrant with Ansible. Here is the error that I'm getting when I'm trying to run vagrant up or vagrant provision in terminal (git bash) on Windows 7:

ERROR! Unexpected Exception: Non-hexadecimal digit found
to see the full traceback, use -vvv
Ansible failed to complete successfully. Any error output should be
visible above. Please fix these errors and try again.

It happens because the Ansible-vault file .vault_pass is not hexadecimal (it is a string and it can't be changed). On computers of my coleagues it works normally, but on mine it doesn't.

The problematic string in .vault_pass file looks like DBAKWeG3KOr3jKjBDbAz.

I guess that the problem is something with Python, but I'm not sure and I don't know how to fix it.

When I try to add -vvv this is the resoult: 

ERROR! Unexpected Exception: Non-hexadecimal digit found
the full traceback was:

Traceback (most recent call last):
  File "/usr/bin/ansible-playbook", line 92, in 
    exit_code = cli.run()
  File "/usr/lib/python2.7/dist-packages/ansible/cli/playbook.py", line 132, in run
    inventory = Inventory(loader=loader, variable_manager=variable_manager, host_list=self.options.inventory)
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 85, in __init__
    self.parse_inventory(host_list)
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 144, in parse_inventory
    group.vars = combine_vars(group.vars, self.get_group_variables(group.name))
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 509, in get_group_variables
    self._vars_per_group[groupname] = self._get_group_variables(groupname, vault_password=vault_password)
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 527, in _get_group_variables
    vars = combine_vars(vars, self.get_group_vars(group))
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 707, in get_group_vars
    return self._get_hostgroup_vars(host=None, group=group, new_pb_basedir=new_pb_basedir)
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 746, in _get_hostgroup_vars
    results = combine_vars(results, self._variable_manager.add_group_vars_file(base_path, self._loader))
  File "/usr/lib/python2.7/dist-packages/ansible/vars/__init__.py", line 578, in add_group_vars_file
    (name, data) = self._load_inventory_file(path, loader)
  File "/usr/lib/python2.7/dist-packages/ansible/vars/__init__.py", line 535, in _load_inventory_file
    _found, results = self._load_inventory_file(path=p, loader=loader)
  File "/usr/lib/python2.7/dist-packages/ansible/vars/__init__.py", line 550, in _load_inventory_file
    data = loader.load_from_file(path)
  File "/usr/lib/python2.7/dist-packages/ansible/parsing/dataloader.py", line 113, in load_from_file
    (file_data, show_content) = self._get_file_contents(file_name)
  File "/usr/lib/python2.7/dist-packages/ansible/parsing/dataloader.py", line 172, in _get_file_contents
    data = self._vault.decrypt(data)
  File "/usr/lib/python2.7/dist-packages/ansible/parsing/vault/__init__.py", line 169, in decrypt
    b_data = this_cipher.decrypt(b_data, self.b_password)
  File "/usr/lib/python2.7/dist-packages/ansible/parsing/vault/__init__.py", line 674, in decrypt
    data = unhexlify(data)
TypeError: Non-hexadecimal digit found
Ansible failed to complete successfully. Any error output should be
visible above. Please fix these errors and try again.
4
vagrantvirtualboxansiblevagrant-windowsansible-vault
Good question. However, please don't spoil your posts with all-caps material or bold requests for "ASAP" treatment - volunteers will get around to your question at their leisure. Thanks! – halfer
A couple of things to consider: can we see the -vvv output? Also, what computers do your colleagues run where this works? Are you all running the same version of Python and Ansible? – halfer
@halfer, thank you for answer. Right now I am upgrading windows from Win 7 to Win 10, for now it is the only difference between my computer and my colleagues computers. Phyton and Ansible are the same version. I will sned you the -vvv output when I finish installing Windows (in 1-2 hours) – Vladan Grubo Paunovic
@halfer I added -vvv in description, please look at it. – Vladan Grubo Paunovic
OK. I haven't used Vault yet, so my strategy here would be to work out why Ansible believes this must be a hex number. How does the .vault_pass file get created? Is there a Vault tool to encode passwords so they are in hex? – halfer

4 Answers

6
votes

It has to do with Windows line endings at the end of encrypted file. Just switch last line ending to Unix and save the file.

5
votes

This issue may occur when encoded file contains carriage return (\r) symbol.

If you got files through git, you should configure git correctly - set core.eol = lf into .gitconfig

3
votes

Just in case someone has the same problem, I had this issue when trying to manually decrypt a variable directly copied from a YAML file (or from the output of ansible-vault encrypt_string)

E.g:

Encrypting a string:

echo -n 'all that is gold does not glitter' | ansible-vault encrypt_string
Reading plaintext input from stdin. (ctrl-d to end input)
!vault |
          $ANSIBLE_VAULT;1.1;AES256
          61626566613637386434386364376236636636646263386561336463386132626335386335356463
          3930303065646433346431383463653663356332306564310a653464313035383335633065666462
          61303866343966613164623533323936383165623539623734316161373561383532326231623862
          6439306562306433360a633038626233376262373561333630356662386462343566346565636364
          64643961613064313964376266336330366566616435663130666135383739323962646563326336
          3062636437636664363039383436306535303939323535353163

Trying to decrypt:

echo '$ANSIBLE_VAULT;1.1;AES256
          61626566613637386434386364376236636636646263386561336463386132626335386335356463
          3930303065646433346431383463653663356332306564310a653464313035383335633065666462
          61303866343966613164623533323936383165623539623734316161373561383532326231623862
          6439306562306433360a633038626233376262373561333630356662386462343566346565636364
          64643961613064313964376266336330366566616435663130666135383739323962646563326336
          3062636437636664363039383436306535303939323535353163' | ansible-vault decrypt --vault-password-file ./vault-env
[WARNING]: There was a vault format error in -: Vault format unhexlify error:
Non-hexadecimal digit found
ERROR! Vault format unhexlify error: Non-hexadecimal digit found for -

To fix it, just remove the YAML indentantion spaces at the beginning:

echo '$ANSIBLE_VAULT;1.1;AES256
61626566613637386434386364376236636636646263386561336463386132626335386335356463 
3930303065646433346431383463653663356332306564310a653464313035383335633065666462 
61303866343966613164623533323936383165623539623734316161373561383532326231623862 
6439306562306433360a633038626233376262373561333630356662386462343566346565636364 
64643961613064313964376266336330366566616435663130666135383739323962646563326336 
3062636437636664363039383436306535303939323535353163' | ansible-vault decrypt --vault-password-file ./vault-env 
Decryption successful
all that is gold does not glitter%
0
votes

To add another variant how this can happen: trailing spaces at the end of the vaulted string will also do it:

   mysql_pw: !vault |
           $ANSIBLE_VAULT;1.1;AES256
           35336630636134383938626366353162326236363966353535356361373465616364383336366536
           6630373462316336333830643331376464633961643633380a623863373966323432646236306239
           36326465343239343766363936653631643761646562306530363262633262323966623530373664
           3239376534303565340a623262646132623033383964366438633964303633363430373463633033
           3164    < spaces here

Depending on even/odd you might also get AnsibleVaultFormatError: Vault format unhexlify error: Odd-length string