Security: Allow to verify the hash of downloaded roles

[philipp-classen]

Feature Request

Use Case

Currently, there is no easy way to verify the integrity of a downloaded role. That opens the possibility for supply chain attacks:

Assume that some attacker gets access to a repository. Relying on Git tags alone is unsafe, as an attacker with write access can move them. That allows to push arbitrary rules.

Previous related discussions:
ansible/ansible#14604
#1358

Proposed Solution

To mitigate that risk, the Git hash could be specified when describing the dependency and then verify it when downloading via "ansible-galaxy install".

Alternatives

Currently, there are ways to achieve pinning by Git hash, but they are not very elegant. For example, this is what I'm using:

https://devops.stackexchange.com/q/9836/2708

Implementation