How to debug "ERROR! Unexpected Exception: Non-hexadecimal digit found" in Ansible and Vagrant?

Question

I am facing a problem trying to run Vagrant with Ansible. Here is the error that I'm getting when I'm trying to run vagrant up or vagrant provision in terminal (git bash) on Windows 7:

ERROR! Unexpected Exception: Non-hexadecimal digit found
to see the full traceback, use -vvv
Ansible failed to complete successfully. Any error output should be
visible above. Please fix these errors and try again.

It happens because the Ansible-vault file .vault_pass is not hexadecimal (it is a string and it can't be changed). On computers of my coleagues it works normally, but on mine it doesn't.

The problematic string in .vault_pass file looks like DBAKWeG3KOr3jKjBDbAz.

I guess that the problem is something with Python, but I'm not sure and I don't know how to fix it.

When I try to add -vvv this is the resoult:

ERROR! Unexpected Exception: Non-hexadecimal digit found
the full traceback was:

Traceback (most recent call last):
  File "/usr/bin/ansible-playbook", line 92, in 
    exit_code = cli.run()
  File "/usr/lib/python2.7/dist-packages/ansible/cli/playbook.py", line 132, in run
    inventory = Inventory(loader=loader, variable_manager=variable_manager, host_list=self.options.inventory)
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 85, in __init__
    self.parse_inventory(host_list)
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 144, in parse_inventory
    group.vars = combine_vars(group.vars, self.get_group_variables(group.name))
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 509, in get_group_variables
    self._vars_per_group[groupname] = self._get_group_variables(groupname, vault_password=vault_password)
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 527, in _get_group_variables
    vars = combine_vars(vars, self.get_group_vars(group))
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 707, in get_group_vars
    return self._get_hostgroup_vars(host=None, group=group, new_pb_basedir=new_pb_basedir)
  File "/usr/lib/python2.7/dist-packages/ansible/inventory/__init__.py", line 746, in _get_hostgroup_vars
    results = combine_vars(results, self._variable_manager.add_group_vars_file(base_path, self._loader))
  File "/usr/lib/python2.7/dist-packages/ansible/vars/__init__.py", line 578, in add_group_vars_file
    (name, data) = self._load_inventory_file(path, loader)
  File "/usr/lib/python2.7/dist-packages/ansible/vars/__init__.py", line 535, in _load_inventory_file
    _found, results = self._load_inventory_file(path=p, loader=loader)
  File "/usr/lib/python2.7/dist-packages/ansible/vars/__init__.py", line 550, in _load_inventory_file
    data = loader.load_from_file(path)
  File "/usr/lib/python2.7/dist-packages/ansible/parsing/dataloader.py", line 113, in load_from_file
    (file_data, show_content) = self._get_file_contents(file_name)
  File "/usr/lib/python2.7/dist-packages/ansible/parsing/dataloader.py", line 172, in _get_file_contents
    data = self._vault.decrypt(data)
  File "/usr/lib/python2.7/dist-packages/ansible/parsing/vault/__init__.py", line 169, in decrypt
    b_data = this_cipher.decrypt(b_data, self.b_password)
  File "/usr/lib/python2.7/dist-packages/ansible/parsing/vault/__init__.py", line 674, in decrypt
    data = unhexlify(data)
TypeError: Non-hexadecimal digit found
Ansible failed to complete successfully. Any error output should be
visible above. Please fix these errors and try again.

Halfcaste

Good question. However, please don't spoil your posts with all-caps material or bold requests for "ASAP" treatment - volunteers will get around to your question at their leisure. Thanks! – Kai

A couple of things to consider: can we see the -vvv output? Also, what computers do your colleagues run where this works? Are you all running the same version of Python and Ansible? – Kai

@halfer, thank you for answer. Right now I am upgrading windows from Win 7 to Win 10, for now it is the only difference between my computer and my colleagues computers. Phyton and Ansible are the same version. I will sned you the -vvv output when I finish installing Windows (in 1-2 hours) – Halfcaste

@Kai I added -vvv in description, please look at it. – Halfcaste

OK. I haven't used Vault yet, so my strategy here would be to work out why Ansible believes this must be a hex number. How does the .vault_pass file get created? Is there a Vault tool to encode passwords so they are in hex? – Kai

@Kai I made that file myself. I made it on all possible ways: trought notepad, notepad++, phpstorm, atom, powershell. Encoded it in UTF-8 without BOM, tried everything! :D – Halfcaste

Should the file have been created with ansible-vault create instead (docs)? – Kai

Answer 1

Just in case someone has the same problem, I had this issue when trying to manually decrypt a variable directly copied from a YAML file (or from the output of ansible-vault encrypt_string)

E.g:

Encrypting a string:

echo -n 'all that is gold does not glitter' | ansible-vault encrypt_string
Reading plaintext input from stdin. (ctrl-d to end input)
!vault |
          $ANSIBLE_VAULT;1.1;AES256
          61626566613637386434386364376236636636646263386561336463386132626335386335356463
          3930303065646433346431383463653663356332306564310a653464313035383335633065666462
          61303866343966613164623533323936383165623539623734316161373561383532326231623862
          6439306562306433360a633038626233376262373561333630356662386462343566346565636364
          64643961613064313964376266336330366566616435663130666135383739323962646563326336
          3062636437636664363039383436306535303939323535353163

Trying to decrypt:

echo '$ANSIBLE_VAULT;1.1;AES256
          61626566613637386434386364376236636636646263386561336463386132626335386335356463
          3930303065646433346431383463653663356332306564310a653464313035383335633065666462
          61303866343966613164623533323936383165623539623734316161373561383532326231623862
          6439306562306433360a633038626233376262373561333630356662386462343566346565636364
          64643961613064313964376266336330366566616435663130666135383739323962646563326336
          3062636437636664363039383436306535303939323535353163' | ansible-vault decrypt --vault-password-file ./vault-env
[WARNING]: There was a vault format error in -: Vault format unhexlify error:
Non-hexadecimal digit found
ERROR! Vault format unhexlify error: Non-hexadecimal digit found for -

To fix it, just remove the YAML indentantion spaces at the beginning:

echo '$ANSIBLE_VAULT;1.1;AES256
61626566613637386434386364376236636636646263386561336463386132626335386335356463 
3930303065646433346431383463653663356332306564310a653464313035383335633065666462 
61303866343966613164623533323936383165623539623734316161373561383532326231623862 
6439306562306433360a633038626233376262373561333630356662386462343566346565636364 
64643961613064313964376266336330366566616435663130666135383739323962646563326336 
3062636437636664363039383436306535303939323535353163' | ansible-vault decrypt --vault-password-file ./vault-env 
Decryption successful
all that is gold does not glitter%

Amatory

Answer 2

It has to do with Windows line endings at the end of encrypted file. Just switch last line ending to Unix and save the file.

Statampere

I was receiving a similar error to Vladan. For me the issue was an ansible vault file that was in windows format. I found the vault file and used my sublime text editor to convert the line endings from 'Windows' to 'Unix'. The error disappeared after that fix. – Neuberger

Answer 3

This issue may occur when encoded file contains carriage return (\r) symbol.

If you got files through git, you should configure git correctly - set core.eol = lf into .gitconfig

Tremann

Answer 4

To add another variant how this can happen: trailing spaces at the end of the vaulted string will also do it:

   mysql_pw: !vault |
           $ANSIBLE_VAULT;1.1;AES256
           35336630636134383938626366353162326236363966353535356361373465616364383336366536
           6630373462316336333830643331376464633961643633380a623863373966323432646236306239
           36326465343239343766363936653631643761646562306530363262633262323966623530373664
           3239376534303565340a623262646132623033383964366438633964303633363430373463633033
           3164    < spaces here

Depending on even/odd you might also get AnsibleVaultFormatError: Vault format unhexlify error: Odd-length string

Kiefer