From 31aeb8cc85e6ce4d2d1ff769e998ca3d877a6d31 Mon Sep 17 00:00:00 2001
From: Daniil Anfimov <anfimovdan@gmail.com>
Date: Wed, 4 Feb 2026 14:54:19 +0200
Subject: [PATCH] Add pre-install step for nss packages on EL7 systems

---
 alts/worker/runners/base.py                      |  2 ++
 resources/roles/install_uninstall/tasks/main.yml | 10 ++++++++++
 2 files changed, 12 insertions(+)

diff --git a/alts/worker/runners/base.py b/alts/worker/runners/base.py
index f6b3f12..0db80ea 100644
--- a/alts/worker/runners/base.py
+++ b/alts/worker/runners/base.py
@@ -885,6 +885,8 @@ def install_package_no_log(
             '-e',
             f'pkg_name={full_pkg_name}',
             '-e',
+            f'pkg_version={package_version}',
+            '-e',
             f'dist_name={dist_name}',
         ]
         if module_name and module_stream and module_version:
diff --git a/resources/roles/install_uninstall/tasks/main.yml b/resources/roles/install_uninstall/tasks/main.yml
index 24039ac..36e5b91 100644
--- a/resources/roles/install_uninstall/tasks/main.yml
+++ b/resources/roles/install_uninstall/tasks/main.yml
@@ -101,6 +101,16 @@
   tags:
     - install_package
 
+- name: Downgrade nss packages on EL7
+  ansible.builtin.shell:
+    cmd: "yum downgrade -y nss*-{{ pkg_version }}"
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - ansible_facts.distribution_major_version == '7'
+    - pkg_name.startswith('nss')
+  tags:
+    - install_package
+
 - name: Install RPM package
   ansible.builtin.package:
     name: "{{ pkg_name }}"