To verify a signed Ansible collection, provide a GnuPG keyring that holds the signer's public key and install from a server that supplies signatures. Ansible then checks detached signatures against the collection's MANIFEST.json before trusting it. Not every distribution server offers signatures.
How the check works
If a distribution server signs a collection, it provides ASCII armored, detached signatures. Ansible uses them to verify the authenticity of the MANIFEST.json, and that manifest is then used to verify the collection's contents. The documentation notes that this option is not available on all servers.
Install with verification
ansible-galaxy collection install my_namespace.my_collection --keyring ~/.ansible/pubring.kbx
You can skip the --keyring flag if you have configured a keyring for ansible-galaxy. You can also add your own signatures with --signature, given as URIs, or list them under a signatures key in requirements.yml.
How many signatures must pass
By default, verification succeeds if at least one signature verifies. You can raise the bar with --required-valid-signature-count, or the matching environment variable, and require all signatures with the value all. Prefix a value with +, as in +all or +1, to make verification fail when no valid signature is found at all.
Limits to know
| Case | Is GnuPG verification applied |
|---|---|
| Install from a distribution server | Yes |
| Install from a Git repository | No |
| Install from a source directory | No |
| Install from a tar.gz file or URL | No |
The documentation states that user provided signatures are not used for collections installed from Git repositories, source directories or tar.gz paths. If your pipeline installs that way, signature verification does not protect those installs.
A rollout plan
- Decide which publishers you trust and import their public keys into a dedicated keyring.
- Set
ANSIBLE_GALAXY_GPG_KEYRINGin the pipeline environment. - Set the required valid signature count to a value you can defend, and use a
+prefix if unsigned content must fail. - Pin versions in
requirements.yml. - Run
ansible-galaxy collection verifywith the keyring after install.
What a signature does and does not tell you
A valid signature says the content matches what the key holder published. It does not say the content is free of defects. Keep reading release notes and diffs for versions you adopt.
Quick check
Do all Galaxy servers support signing?
No. The documentation says signing is not available on all distribution servers.
What if I do not have the signer's key?
Verification can fail with a missing public key error. The documentation describes options for handling specific GnuPG status codes, so decide this deliberately.
Are Git installs checked?
Not by the GnuPG verification described here.
Safeguard offers SBOM and dependency scanning and policy gates that can block a pull request on findings, and you can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
