IBM Cloud CLI, Pinned Where IBM Publishes No Checksum
ibmcloud on EL 10 from IBM's download host, refused by get_url unless the tarball's SHA-256 is the one pinned beside the version: IBM publishes no checksum, and the ibmcloud.sig inside the tarball has no public key to check it against. The live test hashes the tarball again and runs ibmcloud target before any endpoint is set. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-20 · podman 4.9.3 · ansible 2.21.4 · how we verify
Documentation
ibmcloud-cli
The IBM Cloud CLI (ibmcloud) on EL 10 from IBM's download host,
checked against a SHA-256 pinned beside the version, installed as root's
binary in /usr/local/bin. Original role for EL 10, live-tested with
podman on Rocky Linux 10.
No package, and no checksum file to speak of. EL 10 carries no
ibmcloud. IBM publishes the tarball on download.clis.cloud.ibm.com with no checksum beside it (the GitHub release carries links, not assets), and ships an ibmcloud.sig inside it: 512 raw bytes with no public key published to check them against. The values here are the SHA-256 of the two tarballs, read on 2026-09-20. This role pins the SHA-256 per architecture
beside the version, has Ansible's get_url refuse the asset unless it
matches, and the live test checksums the asset on disk again. A new
release is a new pair, on purpose.
Proven to run. The live test calls ibmcloud target with no
credentials and expects "No API endpoint set" - the binary and its
IBM Cloud client ran; only the credentials were missing.
The binary only. The tarball's install script would also drop
shell completion under /usr/local/ibmcloud; this role installs
Bluemix_CLI/bin/ibmcloud as /usr/local/bin/ibmcloud and nothing else.
Plugins, the API endpoint and the login live in each user's ~/.bluemix;
ibmcloud config --check-version false stops the version check that
runs on ibmcloud api and ibmcloud login. The live test calls
ibmcloud target before any endpoint is set, which fails on the missing
endpoint without a network round trip.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test