diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-28 16:03:42 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-28 16:03:42 +0000 |
| commit | 66cec45960ce1d9c794e9399de15c138acb18aed (patch) | |
| tree | 59cd19d69e9d56b7989b080da7c20ef1a3fe2a5a /ansible_collections/community/sops | |
| parent | Initial commit. (diff) | |
| download | ansible-upstream.tar.xz ansible-upstream.zip | |
Adding upstream version 7.3.0+dfsg.upstream/7.3.0+dfsgupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'ansible_collections/community/sops')
275 files changed, 13218 insertions, 0 deletions
diff --git a/ansible_collections/community/sops/.github/dependabot.yml b/ansible_collections/community/sops/.github/dependabot.yml new file mode 100644 index 00000000..2f4ff900 --- /dev/null +++ b/ansible_collections/community/sops/.github/dependabot.yml @@ -0,0 +1,11 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/ansible_collections/community/sops/.github/pull_request_template.md b/ansible_collections/community/sops/.github/pull_request_template.md new file mode 100644 index 00000000..917af7ed --- /dev/null +++ b/ansible_collections/community/sops/.github/pull_request_template.md @@ -0,0 +1,8 @@ +### Motivation +<!-- describe why this changes are necessary/useful --> + +### Changes description +<!-- describe what changes are in this PR. Overview is OK, details shall be found in the git commits --> + +### Additional notes +<!-- any note related to these changes, please add them here --> diff --git a/ansible_collections/community/sops/.github/pull_request_template.md.license b/ansible_collections/community/sops/.github/pull_request_template.md.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/.github/pull_request_template.md.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/.github/workflows/ansible-test.yml b/ansible_collections/community/sops/.github/workflows/ansible-test.yml new file mode 100644 index 00000000..187e5d77 --- /dev/null +++ b/ansible_collections/community/sops/.github/workflows/ansible-test.yml @@ -0,0 +1,240 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +# For the comprehensive list of the inputs supported by the ansible-community/ansible-test-gh-action GitHub Action, see +# https://github.com/marketplace/actions/ansible-test + +name: CI +on: + # Run CI against all pushes (direct commits, also merged PRs), Pull Requests + push: + branches: + - main + - stable-* + pull_request: + # Run CI once per day (at 05:30 UTC) + schedule: + - cron: '30 5 * * *' + +jobs: + sanity: + name: Sanity (Ⓐ${{ matrix.ansible }}) + strategy: + matrix: + ansible: + # It's important that Sanity is tested against all stable-X.Y branches + # Testing against `devel` may fail as new tests are added. + - stable-2.9 + - stable-2.10 + - stable-2.11 + - stable-2.12 + - stable-2.13 + - stable-2.14 + - devel + # Ansible-test on various stable branches does not yet work well with cgroups v2. + # Since ubuntu-latest now uses Ubuntu 22.04, we need to fall back to the ubuntu-20.04 + # image for these stable branches. The list of branches where this is necessary will + # shrink over time, check out https://github.com/ansible-collections/news-for-maintainers/issues/28 + # for the latest list. + runs-on: >- + ${{ contains(fromJson( + '["stable-2.9", "stable-2.10", "stable-2.11"]' + ), matrix.ansible) && 'ubuntu-20.04' || 'ubuntu-latest' }} + steps: + - name: Perform sanity testing + uses: felixfontein/ansible-test-gh-action@main + with: + ansible-core-version: ${{ matrix.ansible }} + testing-type: sanity + + integration: + # Ansible-test on various stable branches does not yet work well with cgroups v2. + # Since ubuntu-latest now uses Ubuntu 22.04, we need to fall back to the ubuntu-20.04 + # image for these stable branches. The list of branches where this is necessary will + # shrink over time, check out https://github.com/ansible-collections/news-for-maintainers/issues/28 + # for the latest list. + runs-on: >- + ${{ contains(fromJson( + '["stable-2.9", "stable-2.10", "stable-2.11"]' + ), matrix.ansible) && 'ubuntu-20.04' || 'ubuntu-latest' }} + permissions: + contents: read + strategy: + matrix: + ansible: + - devel + docker_container: + - ubuntu2004 + - ubuntu2204 + - fedora37 + sops_version: + - 3.5.0 + - 3.6.0 + - 3.7.3 + python_version: + - '' + include: + # 2.9 + - ansible: stable-2.9 + docker_container: ubuntu1604 + sops_version: 3.5.0 + - ansible: stable-2.9 + docker_container: ubuntu1804 + sops_version: 3.7.1 + # 2.10 + - ansible: stable-2.10 + docker_container: ubuntu1804 + sops_version: 3.6.0 + # 2.11 + - ansible: stable-2.11 + docker_container: ubuntu2004 + sops_version: 3.7.2 + # 2.12 + - ansible: stable-2.12 + docker_container: ubuntu2004 + sops_version: 3.7.0 + # 2.13 + - ansible: stable-2.13 + docker_container: ubuntu2004 + sops_version: 3.7.3 + # 2.14 + - ansible: stable-2.14 + docker_container: ubuntu2204 + sops_version: 3.7.3 + # devel + - ansible: devel + docker_container: quay.io/ansible-community/test-image:archlinux + python_version: '3.10' + sops_version: latest + - ansible: devel + docker_container: quay.io/ansible-community/test-image:debian-bullseye + python_version: '3.9' + sops_version: latest + - ansible: devel + docker_container: quay.io/ansible-community/test-image:centos-stream8 + python_version: '3.8' + sops_version: latest + steps: + - name: >- + Perform integration testing against + Ansible version ${{ matrix.ansible }} + under ${{ matrix.docker_container }} + with sops ${{ matrix.sops_version }} + uses: felixfontein/ansible-test-gh-action@main + with: + ansible-core-version: ${{ matrix.ansible }} + docker-image: ${{ matrix.docker_container }} + integration-continue-on-error: 'false' + integration-diff: 'false' + integration-retry-on-error: 'true' + # NOTE: we're installing with git to work around Galaxy being a huge PITA (https://github.com/ansible/galaxy/issues/2429) + pre-test-cmd: |- + echo 'override_sops_version: ${{ matrix.sops_version }}' > tests/integration/integration_config.yml + echo 'github_token: ${{ secrets.GITHUB_TOKEN }}' >> tests/integration/integration_config.yml + git clone --depth=1 --single-branch https://github.com/ansible-collections/community.general.git ../../community/general + testing-type: integration + target-python-version: ${{ matrix.python_version }} + target: gha/main/ + + integration-install: + # Ansible-test on various stable branches does not yet work well with cgroups v2. + # Since ubuntu-latest now uses Ubuntu 22.04, we need to fall back to the ubuntu-20.04 + # image for these stable branches. The list of branches where this is necessary will + # shrink over time, check out https://github.com/ansible-collections/news-for-maintainers/issues/28 + # for the latest list. + runs-on: >- + ${{ contains(fromJson( + '["stable-2.9", "stable-2.10", "stable-2.11"]' + ), matrix.ansible) && 'ubuntu-20.04' || 'ubuntu-latest' }} + permissions: + contents: read + strategy: + matrix: + ansible: + - devel + docker_container: + - '' + python_version: + - '' + target: + - gha/install/ + pre-test-cmd: + - '' + github_latest_detection: + - '' + exclude: + - docker_container: '' + include: + # Install specific sops + - ansible: devel + docker_container: ubuntu2204 + python_version: '' + target: gha/install/1/ + # Install on localhost vs. remote host + - ansible: devel + docker_container: ubuntu2004 + python_version: '' + target: gha/install/2/ + # Install latest sops + - ansible: devel + docker_container: quay.io/ansible-community/test-image:archlinux + python_version: '3.10' + target: gha/install/3/ + github_latest_detection: auto + # NOTE: we're installing with git to work around Galaxy being a huge PITA (https://github.com/ansible/galaxy/issues/2429) + pre-test-cmd: |- + git clone --depth=1 --single-branch https://github.com/ansible-collections/community.general.git ../../community/general + - ansible: devel + docker_container: quay.io/ansible-community/test-image:centos-stream8 + python_version: '3.8' + target: gha/install/3/ + github_latest_detection: auto + - ansible: devel + docker_container: quay.io/ansible-community/test-image:debian-bullseye + python_version: '3.9' + target: gha/install/3/ + github_latest_detection: auto + - ansible: devel + docker_container: fedora37 + python_version: '' + target: gha/install/3/ + github_latest_detection: auto + - ansible: devel + docker_container: ubuntu2004 + python_version: '' + target: gha/install/3/ + github_latest_detection: api + - ansible: devel + docker_container: ubuntu2204 + python_version: '' + target: gha/install/3/ + github_latest_detection: latest-release + # - ansible: devel + # docker_container: alpine3 -- so far only alpine3 edge supports sops + # python_version: '' + # target: gha/install/3/ + # github_latest_detection: auto + # # NOTE: we're installing with git to work around Galaxy being a huge PITA (https://github.com/ansible/galaxy/issues/2429) + # pre-test-cmd: |- + # git clone --depth=1 --single-branch https://github.com/ansible-collections/community.general.git ../../community/general + steps: + - name: >- + Perform sops installation integration testing against + Ansible version ${{ matrix.ansible }} + under ${{ matrix.docker_container }} + uses: felixfontein/ansible-test-gh-action@main + with: + ansible-core-version: ${{ matrix.ansible }} + docker-image: ${{ matrix.docker_container }} + integration-continue-on-error: 'false' + integration-diff: 'false' + integration-retry-on-error: 'true' + pre-test-cmd: |- + echo 'github_token: ${{ secrets.GITHUB_TOKEN }}' > tests/integration/integration_config.yml + echo 'github_latest_detection: ${{ matrix.github_latest_detection || 'auto' }}' >> tests/integration/integration_config.yml + ${{ matrix.pre-test-cmd || 'echo' }} + testing-type: integration + target-python-version: ${{ matrix.python_version }} + target: ${{ matrix.target }} diff --git a/ansible_collections/community/sops/.github/workflows/docs-pr.yml b/ansible_collections/community/sops/.github/workflows/docs-pr.yml new file mode 100644 index 00000000..44667b5b --- /dev/null +++ b/ansible_collections/community/sops/.github/workflows/docs-pr.yml @@ -0,0 +1,92 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +name: Collection Docs +concurrency: + group: docs-pr-${{ github.head_ref }} + cancel-in-progress: true +on: + pull_request_target: + types: [opened, synchronize, reopened, closed] + +env: + GHP_BASE_URL: https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }} + +jobs: + build-docs: + permissions: + contents: read + name: Build Ansible Docs + uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-pr.yml@main + with: + collection-name: community.sops + init-lenient: false + init-fail-on-error: true + squash-hierarchy: true + init-project: Community.Sops Collection + init-copyright: Community.Sops Contributors + init-title: Community.Sops Collection Documentation + init-html-short-title: Community.Sops Collection Docs + init-extra-html-theme-options: | + documentation_home_url=https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}/branch/main/ + render-file-line: '> * `$<status>` [$<path_tail>](https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}/pr/${{ github.event.number }}/$<path_tail>)' + + publish-docs-gh-pages: + # for now we won't run this on forks + if: github.repository == 'ansible-collections/community.sops' + permissions: + contents: write + needs: [build-docs] + name: Publish Ansible Docs + uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-publish-gh-pages.yml@main + with: + artifact-name: ${{ needs.build-docs.outputs.artifact-name }} + action: ${{ (github.event.action == 'closed' || needs.build-docs.outputs.changed != 'true') && 'teardown' || 'publish' }} + secrets: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + comment: + permissions: + pull-requests: write + runs-on: ubuntu-latest + needs: [build-docs, publish-docs-gh-pages] + name: PR comments + steps: + - name: PR comment + uses: ansible-community/github-docs-build/actions/ansible-docs-build-comment@main + with: + body-includes: '## Docs Build' + reactions: heart + action: ${{ needs.build-docs.outputs.changed != 'true' && 'remove' || '' }} + on-closed-body: | + ## Docs Build 📝 + + This PR is closed and any previously published docsite has been unpublished. + on-merged-body: | + ## Docs Build 📝 + + Thank you for contribution!✨ + + This PR has been merged and the docs are now incorporated into `main`: + ${{ env.GHP_BASE_URL }}/branch/main + body: | + ## Docs Build 📝 + + Thank you for contribution!✨ + + The docs for **this PR** have been published here: + ${{ env.GHP_BASE_URL }}/pr/${{ github.event.number }} + + You can compare to the docs for the `main` branch here: + ${{ env.GHP_BASE_URL }}/branch/main + + The docsite for **this PR** is also available for download as an artifact from this run: + ${{ needs.build-docs.outputs.artifact-url }} + + File changes: + + ${{ needs.build-docs.outputs.diff-files-rendered }} + + ${{ needs.build-docs.outputs.diff-rendered }} diff --git a/ansible_collections/community/sops/.github/workflows/docs-push.yml b/ansible_collections/community/sops/.github/workflows/docs-push.yml new file mode 100644 index 00000000..6b803710 --- /dev/null +++ b/ansible_collections/community/sops/.github/workflows/docs-push.yml @@ -0,0 +1,52 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +name: Collection Docs +concurrency: + group: docs-push-${{ github.sha }} + cancel-in-progress: true +on: + push: + branches: + - main + - stable-* + tags: + - '*' + # Run CI once per day (at 05:30 UTC) + schedule: + - cron: '30 5 * * *' + # Allow manual trigger (for newer antsibull-docs, sphinx-ansible-theme, ... versions) + workflow_dispatch: + +jobs: + build-docs: + permissions: + contents: read + name: Build Ansible Docs + uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-push.yml@main + with: + collection-name: community.sops + init-lenient: false + init-fail-on-error: true + squash-hierarchy: true + init-project: Community.Sops Collection + init-copyright: Community.Sops Contributors + init-title: Community.Sops Collection Documentation + init-html-short-title: Community.Sops Collection Docs + init-extra-html-theme-options: | + documentation_home_url=https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}/branch/main/ + + publish-docs-gh-pages: + # for now we won't run this on forks + if: github.repository == 'ansible-collections/community.sops' + permissions: + contents: write + needs: [build-docs] + name: Publish Ansible Docs + uses: ansible-community/github-docs-build/.github/workflows/_shared-docs-build-publish-gh-pages.yml@main + with: + artifact-name: ${{ needs.build-docs.outputs.artifact-name }} + secrets: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/ansible_collections/community/sops/.github/workflows/ee.yml b/ansible_collections/community/sops/.github/workflows/ee.yml new file mode 100644 index 00000000..a3d730e7 --- /dev/null +++ b/ansible_collections/community/sops/.github/workflows/ee.yml @@ -0,0 +1,120 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +name: execution environment +on: + # Run CI against all pushes (direct commits, also merged PRs), Pull Requests + push: + branches: + - main + - stable-* + pull_request: + # Run CI once per day (at 05:30 UTC) + # This ensures that even if there haven't been commits that we are still testing against latest version of ansible-builder + schedule: + - cron: '30 5 * * *' + +env: + NAMESPACE: community + COLLECTION_NAME: sops + +jobs: + build: + name: Build and test EE (Ⓐ${{ matrix.runner_tag }}) + strategy: + matrix: + runner_tag: + - devel + - stable-2.12-latest + - stable-2.11-latest + execute_playbook: + - ansible-playbook -v community.sops.install_localhost + include: + - runner_tag: stable-2.9-latest + execute_playbook: ansible localhost -m include_role -a name=community.sops.install -e sops_install_on_localhost=true -e ansible_python_interpreter=/usr/libexec/platform-python + runs-on: ubuntu-latest + steps: + - name: Check out code + uses: actions/checkout@v3 + with: + path: ansible_collections/${{ env.NAMESPACE }}/${{ env.COLLECTION_NAME }} + + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: '3.10' + + - name: Install ansible-builder and ansible-navigator + run: pip install ansible-builder ansible-navigator + + - name: Verify requirements + run: ansible-builder introspect --sanitize . + + - name: Make sure galaxy.yml has version entry + run: >- + python -c + 'import yaml ; + f = open("galaxy.yml", "rb") ; + data = yaml.safe_load(f) ; + f.close() ; + data["version"] = data.get("version") or "0.0.1" ; + f = open("galaxy.yml", "wb") ; + f.write(yaml.dump(data).encode("utf-8")) ; + f.close() ; + ' + working-directory: ansible_collections/${{ env.NAMESPACE }}/${{ env.COLLECTION_NAME }} + + - name: Build collection + run: | + ansible-galaxy collection build --output-path ../../../ + working-directory: ansible_collections/${{ env.NAMESPACE }}/${{ env.COLLECTION_NAME }} + + - name: Create files for building execution environment + run: | + COLLECTION_FILENAME="$(ls "${{ env.NAMESPACE }}-${{ env.COLLECTION_NAME }}"-*.tar.gz)" + + # EE config + cat > execution-environment.yml <<EOF + --- + version: 1 + build_arg_defaults: + EE_BASE_IMAGE: 'quay.io/ansible/ansible-runner:${{ matrix.runner_tag }}' + dependencies: + galaxy: requirements.yml + additional_build_steps: + append: + - RUN ${{ matrix.execute_playbook }} + EOF + echo "::group::execution-environment.yml" + cat execution-environment.yml + echo "::endgroup::" + + # Requirements + cat > requirements.yml <<EOF + --- + collections: + - name: ${COLLECTION_FILENAME} + type: file + EOF + echo "::group::requirements.yml" + cat requirements.yml + echo "::endgroup::" + + - name: Build image based on ${{ matrix.runner_tag }} + run: | + mkdir -p context/_build/ + cp "${{ env.NAMESPACE }}-${{ env.COLLECTION_NAME }}"-*.tar.gz context/_build/ + ansible-builder build -v 3 -t test-ee:latest --container-runtime=podman + + - name: Run basic tests + run: > + ansible-navigator run + --mode stdout + --pull-policy never + --set-environment-variable ANSIBLE_PRIVATE_ROLE_VARS=true + --execution-environment-image test-ee:latest + -v + all.yml + working-directory: ansible_collections/${{ env.NAMESPACE }}/${{ env.COLLECTION_NAME }}/tests/ee diff --git a/ansible_collections/community/sops/.github/workflows/extra-tests.yml b/ansible_collections/community/sops/.github/workflows/extra-tests.yml new file mode 100644 index 00000000..fd2f7f55 --- /dev/null +++ b/ansible_collections/community/sops/.github/workflows/extra-tests.yml @@ -0,0 +1,48 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +name: extra-tests +on: + # Run CI against all pushes (direct commits, also merged PRs), Pull Requests + push: + branches: + - main + - stable-* + pull_request: + # Run CI once per day (at 05:30 UTC) + # This ensures that even if there haven't been commits that we are still testing against latest version of ansible-test for each ansible-base version + schedule: + - cron: '30 5 * * *' +env: + NAMESPACE: community + COLLECTION_NAME: sops + +jobs: + extra-sanity: + name: Extra Sanity + runs-on: ubuntu-latest + steps: + + - name: Check out code + uses: actions/checkout@v3 + with: + path: ansible_collections/${{env.NAMESPACE}}/${{env.COLLECTION_NAME}} + + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: '3.10' + + - name: Install ansible-core + run: pip install https://github.com/ansible/ansible/archive/devel.tar.gz --disable-pip-version-check + + - name: Install collection dependencies + run: git clone --depth=1 --single-branch https://github.com/ansible-collections/community.internal_test_tools.git ./ansible_collections/community/internal_test_tools + # NOTE: we're installing with git to work around Galaxy being a huge PITA (https://github.com/ansible/galaxy/issues/2429) + # run: ansible-galaxy collection install community.internal_test_tools -p . + + - name: Run sanity tests + run: ../../community/internal_test_tools/tools/run.py --color + working-directory: ./ansible_collections/${{env.NAMESPACE}}/${{env.COLLECTION_NAME}} diff --git a/ansible_collections/community/sops/.github/workflows/import-galaxy.yml b/ansible_collections/community/sops/.github/workflows/import-galaxy.yml new file mode 100644 index 00000000..ae472845 --- /dev/null +++ b/ansible_collections/community/sops/.github/workflows/import-galaxy.yml @@ -0,0 +1,88 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +name: import-galaxy +on: + # Run CI against all pushes (direct commits, also merged PRs) to main, and all Pull Requests + push: + branches: + - main + - stable-* + pull_request: + +env: + # Adjust this to your collection + NAMESPACE: community + COLLECTION_NAME: sops + +jobs: + build-collection: + name: Build collection artifact + runs-on: ubuntu-latest + steps: + - name: Check out code + uses: actions/checkout@v3 + with: + path: ./checkout + + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: '3.10' + + - name: Install ansible-core + run: pip install https://github.com/ansible/ansible/archive/devel.tar.gz --disable-pip-version-check + + - name: Make sure galaxy.yml has version entry + run: >- + python -c + 'import yaml ; + f = open("galaxy.yml", "rb") ; + data = yaml.safe_load(f) ; + f.close() ; + data["version"] = data.get("version") or "0.0.1" ; + f = open("galaxy.yml", "wb") ; + f.write(yaml.dump(data).encode("utf-8")) ; + f.close() ; + ' + working-directory: ./checkout + + - name: Build collection + run: ansible-galaxy collection build + working-directory: ./checkout + + - name: Copy artifact into subdirectory + run: mkdir ./artifact && mv ./checkout/${{ env.NAMESPACE }}-${{ env.COLLECTION_NAME }}-*.tar.gz ./artifact + + - name: Upload artifact + uses: actions/upload-artifact@v3 + with: + name: ${{ env.NAMESPACE }}-${{ env.COLLECTION_NAME }}-${{ github.sha }} + path: ./artifact/ + + import-galaxy: + name: Import artifact with Galaxy importer + runs-on: ubuntu-latest + needs: + - build-collection + steps: + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: '3.10' + + - name: Install ansible-core + run: pip install https://github.com/ansible/ansible/archive/devel.tar.gz --disable-pip-version-check + + - name: Install galaxy-importer + run: pip install galaxy-importer --disable-pip-version-check + + - name: Download artifact + uses: actions/download-artifact@v3 + with: + name: ${{ env.NAMESPACE }}-${{ env.COLLECTION_NAME }}-${{ github.sha }} + + - name: Run Galaxy importer + run: python -m galaxy_importer.main ${{ env.NAMESPACE }}-${{ env.COLLECTION_NAME }}-*.tar.gz diff --git a/ansible_collections/community/sops/.github/workflows/reuse.yml b/ansible_collections/community/sops/.github/workflows/reuse.yml new file mode 100644 index 00000000..f487d796 --- /dev/null +++ b/ansible_collections/community/sops/.github/workflows/reuse.yml @@ -0,0 +1,32 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +name: Verify REUSE + +on: + push: + branches: [main] + pull_request: + branches: [main] + # Run CI once per day (at 05:30 UTC) + schedule: + - cron: '30 5 * * *' + +jobs: + check: + permissions: + contents: read + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Install dependencies + run: | + pip install reuse + + - name: Check REUSE compliance + run: | + reuse lint diff --git a/ansible_collections/community/sops/.gitignore b/ansible_collections/community/sops/.gitignore new file mode 100644 index 00000000..8e398ff2 --- /dev/null +++ b/ansible_collections/community/sops/.gitignore @@ -0,0 +1,136 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +/tests/output/ +/changelogs/.plugin-cache.yaml + +# Byte-compiled / optimized / DLL files +__pycache__/ +*.py[cod] +*$py.class + +# C extensions +*.so + +# Distribution / packaging +.Python +build/ +develop-eggs/ +dist/ +downloads/ +eggs/ +.eggs/ +lib/ +lib64/ +parts/ +sdist/ +var/ +wheels/ +pip-wheel-metadata/ +share/python-wheels/ +*.egg-info/ +.installed.cfg +*.egg +MANIFEST + +# PyInstaller +# Usually these files are written by a python script from a template +# before PyInstaller builds the exe, so as to inject date/other infos into it. +*.manifest +*.spec + +# Installer logs +pip-log.txt +pip-delete-this-directory.txt + +# Unit test / coverage reports +htmlcov/ +.tox/ +.nox/ +.coverage +.coverage.* +.cache +nosetests.xml +coverage.xml +*.cover +*.py,cover +.hypothesis/ +.pytest_cache/ + +# Translations +*.mo +*.pot + +# Django stuff: +*.log +local_settings.py +db.sqlite3 +db.sqlite3-journal + +# Flask stuff: +instance/ +.webassets-cache + +# Scrapy stuff: +.scrapy + +# Sphinx documentation +docs/_build/ + +# PyBuilder +target/ + +# Jupyter Notebook +.ipynb_checkpoints + +# IPython +profile_default/ +ipython_config.py + +# pyenv +.python-version + +# pipenv +# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control. +# However, in case of collaboration, if having platform-specific dependencies or dependencies +# having no cross-platform support, pipenv may install dependencies that don't work, or not +# install all needed dependencies. +#Pipfile.lock + +# PEP 582; used by e.g. github.com/David-OConnor/pyflow +__pypackages__/ + +# Celery stuff +celerybeat-schedule +celerybeat.pid + +# SageMath parsed files +*.sage.py + +# Environments +.env +.venv +env/ +venv/ +ENV/ +env.bak/ +venv.bak/ + +# Spyder project settings +.spyderproject +.spyproject + +# Rope project settings +.ropeproject + +# mkdocs documentation +/site + +# mypy +.mypy_cache/ +.dmypy.json +dmypy.json + +# Pyre type checker +.pyre/ diff --git a/ansible_collections/community/sops/.reuse/dep5 b/ansible_collections/community/sops/.reuse/dep5 new file mode 100644 index 00000000..0c3745eb --- /dev/null +++ b/ansible_collections/community/sops/.reuse/dep5 @@ -0,0 +1,5 @@ +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ + +Files: changelogs/fragments/* +Copyright: Ansible Project +License: GPL-3.0-or-later diff --git a/ansible_collections/community/sops/CHANGELOG.rst b/ansible_collections/community/sops/CHANGELOG.rst new file mode 100644 index 00000000..e1932bfa --- /dev/null +++ b/ansible_collections/community/sops/CHANGELOG.rst @@ -0,0 +1,297 @@ +============================ +Community Sops Release Notes +============================ + +.. contents:: Topics + + +v1.6.1 +====== + +Release Summary +--------------- + +Maintenance release. + +Bugfixes +-------- + +- action plugin helper - fix handling of deprecations for ansible-core 2.14.2 (https://github.com/ansible-collections/community.sops/pull/136). +- various plugins - remove unnecessary imports (https://github.com/ansible-collections/community.sops/pull/133). + +v1.6.0 +====== + +Release Summary +--------------- + +Feature release improving the installation role. + +Minor Changes +------------- + +- install role - add ``sops_github_latest_detection`` option that allows to configure which method to use for detecting the latest release on GitHub. By default (``auto``) first tries to retrieve a list of recent releases using the API, and if that fails due to rate limiting, tries to obtain the latest GitHub release from a semi-documented URL (https://github.com/ansible-collections/community.sops/pull/133). +- install role - add ``sops_github_token`` option to allow passing a GitHub token. This can for example be used to avoid rate limits when using the role in GitHub Actions (https://github.com/ansible-collections/community.sops/pull/132). +- install role - implement another method to determine the latest release on GitHub than using the GitHub API, which can make installation fail due to rate-limiting (https://github.com/ansible-collections/community.sops/pull/131). + +v1.5.0 +====== + +Release Summary +--------------- + +Feature release. + +Minor Changes +------------- + +- Automatically install GNU Privacy Guard (GPG) in execution environments. To install Mozilla sops a manual step needs to be added to the EE definition, see the collection's documentation for details (https://github.com/ansible-collections/community.sops/pull/98). + +New Playbooks +------------- + +- community.sops.install - Installs sops and GNU Privacy Guard on all remote hosts +- community.sops.install_localhost - Installs sops and GNU Privacy Guard on localhost + +New Roles +--------- + +- community.sops.install - Install Mozilla sops + +v1.4.1 +====== + +Release Summary +--------------- + +Maintenance release to improve compatibility with future ansible-core releases. + +Bugfixes +-------- + +- load_vars - ensure compatibility with newer versions of ansible-core (https://github.com/ansible-collections/community.sops/pull/121). + +v1.4.0 +====== + +Release Summary +--------------- + +Feature release. + +Minor Changes +------------- + +- Allow to specify age keys as ``age_key``, or age keyfiles as ``age_keyfile`` (https://github.com/ansible-collections/community.sops/issues/116, https://github.com/ansible-collections/community.sops/pull/117). +- sops_encrypt - allow to specify age recipients (https://github.com/ansible-collections/community.sops/issues/116, https://github.com/ansible-collections/community.sops/pull/117). + +v1.3.0 +====== + +Release Summary +--------------- + +Feature release. + +Minor Changes +------------- + +- All software licenses are now in the ``LICENSES/`` directory of the collection root, and the collection repository conforms to the `REUSE specification <https://reuse.software/spec/>`__ except for the changelog fragments (https://github.com/ansible-collections/community.crypto/sops/108, https://github.com/ansible-collections/community.sops/pull/113). +- sops vars plugin - added a configuration option to temporarily disable the vars plugin (https://github.com/ansible-collections/community.sops/pull/114). + +v1.2.3 +====== + +Release Summary +--------------- + +Fix formatting bug in documentation. No code changes. + +v1.2.2 +====== + +Release Summary +--------------- + +Maintenance release. + +Bugfixes +-------- + +- Include ``simplified_bsd.txt`` license file for the ``sops`` module utils. + +v1.2.1 +====== + +Release Summary +--------------- + +Maintenance release with updated documentation. + +v1.2.0 +====== + +Release Summary +--------------- + +Collection release for inclusion in Ansible 4.9.0 and 5.1.0. + +This release contains a change allowing to configure generic plugin options with ansible.cfg keys and env variables. + +Minor Changes +------------- + +- sops lookup and vars plugin - allow to configure almost all generic options by ansible.cfg entries and environment variables (https://github.com/ansible-collections/community.sops/pull/81). + +Bugfixes +-------- + +- Fix error handling in calls of the ``sops`` binary when negative errors are returned (https://github.com/ansible-collections/community.sops/issues/82, https://github.com/ansible-collections/community.sops/pull/83). + +v1.1.0 +====== + +Release Summary +--------------- + +A minor release for inclusion in Ansible 4.2.0. + +Minor Changes +------------- + +- Avoid internal ansible-core module_utils in favor of equivalent public API available since at least Ansible 2.9 (https://github.com/ansible-collections/community.sops/pull/73). + +New Plugins +----------- + +Filter +~~~~~~ + +- community.sops.decrypt - Decrypt sops-encrypted data + +v1.0.6 +====== + +Release Summary +--------------- + +This release makes the collection compatible to the latest beta release of ansible-core 2.11. + +Bugfixes +-------- + +- action_module plugin helper - make compatible with latest changes in ansible-core 2.11.0b3 (https://github.com/ansible-collections/community.sops/pull/58). +- community.sops.load_vars - make compatible with latest changes in ansible-core 2.11.0b3 (https://github.com/ansible-collections/community.sops/pull/58). + +v1.0.5 +====== + +Release Summary +--------------- + +This release fixes a bug that prevented correct YAML file to be created when the output was ending in `.yaml`. + +Bugfixes +-------- + +- community.sops.sops_encrypt - use output type ``yaml`` when path ends with ``.yaml`` (https://github.com/ansible-collections/community.sops/pull/56). + +v1.0.4 +====== + +Release Summary +--------------- + +This is a security release, fixing a potential information leak in the ``community.sops.sops_encrypt`` module. + +Security Fixes +-------------- + +- community.sops.sops_encrypt - mark the ``aws_secret_access_key`` and ``aws_session_token`` parameters as ``no_log`` to avoid leakage of secrets (https://github.com/ansible-collections/community.sops/pull/54). + +v1.0.3 +====== + +Release Summary +--------------- + +This release include some fixes to Ansible docs and required changes for inclusion in Ansible. + +Bugfixes +-------- + +- community.sops.sops lookup plugins - fix wrong format of Ansible variables so that these are actually used (https://github.com/ansible-collections/community.sops/pull/51). +- community.sops.sops vars plugins - remove non-working Ansible variables (https://github.com/ansible-collections/community.sops/pull/51). + +v1.0.2 +====== + +Release Summary +--------------- + +Fix of 1.0.1 release which had no changelog entry. + +v1.0.1 +====== + +Release Summary +--------------- + +Re-release of 1.0.0 to counteract error during release. + +v1.0.0 +====== + +Release Summary +--------------- + +First stable release. This release is expected to be included in Ansible 3.0.0. + +Minor Changes +------------- + +- All plugins and modules: allow to pass generic sops options with new options ``config_path``, ``enable_local_keyservice``, ``keyservice``. Also allow to pass AWS parameters with options ``aws_profile``, ``aws_access_key_id``, ``aws_secret_access_key``, and ``aws_session_token`` (https://github.com/ansible-collections/community.sops/pull/47). +- community.sops.sops_encrypt - allow to pass encryption-specific options ``kms``, ``gcp_kms``, ``azure_kv``, ``hc_vault_transit``, ``pgp``, ``unencrypted_suffix``, ``encrypted_suffix``, ``unencrypted_regex``, ``encrypted_regex``, ``encryption_context``, and ``shamir_secret_sharing_threshold`` to sops (https://github.com/ansible-collections/community.sops/pull/47). + +v0.2.0 +====== + +Release Summary +--------------- + +This release adds features for the lookup and vars plugins. + +Minor Changes +------------- + +- community.sops.sops lookup plugin - add ``empty_on_not_exist`` option which allows to return an empty string instead of an error when the file does not exist (https://github.com/ansible-collections/community.sops/pull/33). +- community.sops.sops vars plugin - add option to control caching (https://github.com/ansible-collections/community.sops/pull/32). +- community.sops.sops vars plugin - add option to determine when vars are loaded (https://github.com/ansible-collections/community.sops/pull/32). + +v0.1.0 +====== + +Release Summary +--------------- + +First release of the `community.sops` collection! +This release includes multiple plugins: an `action` plugin, a `lookup` plugin and a `vars` plugin. + +New Plugins +----------- + +Lookup +~~~~~~ + +- community.sops.sops - Read sops encrypted file contents + +Vars +~~~~ + +- community.sops.sops - Loading sops-encrypted vars files + +New Modules +----------- + +- community.sops.load_vars - Load sops-encrypted variables from files, dynamically within a task +- community.sops.sops_encrypt - Encrypt data with sops diff --git a/ansible_collections/community/sops/CHANGELOG.rst.license b/ansible_collections/community/sops/CHANGELOG.rst.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/CHANGELOG.rst.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/CONTRIBUTING.md b/ansible_collections/community/sops/CONTRIBUTING.md new file mode 100644 index 00000000..56ecce67 --- /dev/null +++ b/ansible_collections/community/sops/CONTRIBUTING.md @@ -0,0 +1,37 @@ +<!-- +Copyright (c) Ansible Project +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +--> + +# Contributing + +Hello and welcome! Thank you for being interested in contributing to this project. + +First of all get confident with the [Ansible Collections Overview](https://github.com/ansible-collections/overview). + +We accept pull requests for bugfixes, new features, and other improvements, assuming they pass our review. If you are planning a larger feature or refactoring, please create an issue first to discuss it with us. + +## :bug: Reporting an issue + +Please [search in the issue list](https://github.com/ansible-collections/community.sops/issues) and if has not been already reported, [open a new issue](https://github.com/ansible-collections/community.sops/issues/new/choose) + +## 🏗 To contribute + +A more extensive walk-through can be found in [Ansible's Contributing to collections](https://docs.ansible.com/ansible/latest/dev_guide/developing_collections.html#hacking-collections). + +1. Fork this repo (when checking it out, see [here](https://docs.ansible.com/ansible/latest/dev_guide/developing_collections.html#contributing-to-collections) for how to place the checkout correctly) +1. Create a feature branch +1. Commit and push your code. To make the process faster, please ensure: + + - the tests are green. Tests runs using [GitHub Actions](https://help.github.com/en/actions) + - you added a [changelog fragment](https://docs.ansible.com/ansible/latest/community/development_process.html#changelogs-how-to) + +Please note that all PRs that are not strictly documentation, testing, or add a new plugin or module, require a changelog fragment. See [Creating a changelog fragment](https://docs.ansible.com/ansible/latest/community/development_process.html#changelogs-how-to) for information on that. + +Further resources: + +- [Ansible Developer guide: developing collections](https://docs.ansible.com/ansible/latest/dev_guide/developing_collections.html) +- [Ansible Developer guide](https://docs.ansible.com/ansible/latest/dev_guide/index.html) + +This repository adheres to the [Ansible Community code of conduct](https://docs.ansible.com/ansible/latest/community/code_of_conduct.html) diff --git a/ansible_collections/community/sops/COPYING b/ansible_collections/community/sops/COPYING new file mode 100644 index 00000000..f288702d --- /dev/null +++ b/ansible_collections/community/sops/COPYING @@ -0,0 +1,674 @@ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/> + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + <one line to give the program's name and a brief idea of what it does.> + Copyright (C) <year> <name of author> + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <https://www.gnu.org/licenses/>. + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + <program> Copyright (C) <year> <name of author> + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +<https://www.gnu.org/licenses/>. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +<https://www.gnu.org/licenses/why-not-lgpl.html>. diff --git a/ansible_collections/community/sops/FILES.json b/ansible_collections/community/sops/FILES.json new file mode 100644 index 00000000..8db0fc5f --- /dev/null +++ b/ansible_collections/community/sops/FILES.json @@ -0,0 +1,2511 @@ +{ + "files": [ + { + "name": ".", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": ".github", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": ".github/workflows", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": ".github/workflows/ansible-test.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7f65ceec5a0a857a201d4d940710aded3b19d7831076da9bd8c96821412f5008", + "format": 1 + }, + { + "name": ".github/workflows/docs-pr.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "fce21c2eace7d11208fb4c1a118cd2cdfc5a873e952a9c11e4f53f03411b0d53", + "format": 1 + }, + { + "name": ".github/workflows/docs-push.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e6965e0b786bf01627dbac761bebe432c677541d2e5bc69c3073e8676e13b806", + "format": 1 + }, + { + "name": ".github/workflows/ee.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "2981175a622355e18addce3678af366c8d3e12f9b73172485f33eea2bb1165a1", + "format": 1 + }, + { + "name": ".github/workflows/extra-tests.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "d37c57a221512fa1d7e7477c382cd11941df95c39ddccc9ede1fc49c205ccfcb", + "format": 1 + }, + { + "name": ".github/workflows/import-galaxy.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "12f44c852cdcf4d6606110a18180751ce115c7431d9ecac8860c38ca68de3c95", + "format": 1 + }, + { + "name": ".github/workflows/reuse.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "dc3684b09ddd4dea6622cbf4501c0bd4408f676bb9d05cedb6aff72529b6b4d0", + "format": 1 + }, + { + "name": ".github/dependabot.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f314f2fce46d346ef9559fdeae3a55ce6d799bab45a255092446c31e17e6874d", + "format": 1 + }, + { + "name": ".github/pull_request_template.md", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "b21ab066348ab442ca1036e16ba8c201945c9d902941745bb1c547eff97eb6ec", + "format": 1 + }, + { + "name": ".github/pull_request_template.md.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": ".reuse", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": ".reuse/dep5", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "9d8cb20d72d7e81aaf2e7f0ddce7eacdb3d47a890541717d7fae08a6cab7ebed", + "format": 1 + }, + { + "name": "LICENSES", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "LICENSES/GPL-3.0-or-later.txt", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986", + "format": 1 + }, + { + "name": "LICENSES/BSD-2-Clause.txt", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f11e51ed1eec39ad21d458ba44d805807a301c17ee9fe39538ccc9e2b280936c", + "format": 1 + }, + { + "name": "changelogs", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "changelogs/fragments", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "changelogs/fragments/.keep", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "format": 1 + }, + { + "name": "changelogs/changelog.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c29065f415e2a3977cf35d9991c43c35f9ddcd28b14de73d3030652925178b45", + "format": 1 + }, + { + "name": "changelogs/changelog.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "changelogs/config.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "872f269bfce59f3bd9aa5603e6c881043c81b89a2f2ae19a6f54307bff96200e", + "format": 1 + }, + { + "name": "docs", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "docs/docsite", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "docs/docsite/rst", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "docs/docsite/rst/guide.rst", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "32f8fc68467e5c175a4d1301596f5647c7f1f7a6f36187cde01ec8e6047ab9b4", + "format": 1 + }, + { + "name": "docs/docsite/extra-docs.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "48427a12a6ad4b45d88a54221a229ff06541e0b9c95955371f76d795b1f2fb76", + "format": 1 + }, + { + "name": "docs/docsite/links.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "3631132252515708e695594ec85386e307f9a5b923103c21723eb40661078be5", + "format": 1 + }, + { + "name": "meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "meta/ee-bindep.txt", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "8e29f260b34c124f718cc779c30a6837ef867ee9aea33b0a1b03fa96b4548cde", + "format": 1 + }, + { + "name": "meta/execution-environment.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c7db7c82053279bd826cc4c66fa24c647faa5372757897fa925e1a9d98039d67", + "format": 1 + }, + { + "name": "meta/runtime.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "4ed63a88ab6b7c15fc1ba0c16d2accb77b3305fff800731770f40609a7593393", + "format": 1 + }, + { + "name": "playbooks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "playbooks/install.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "93fee7588dee542e45962f6abfa4aaf4eda01816ab8cfc8c6d622eabf9e1e7ac", + "format": 1 + }, + { + "name": "playbooks/install_localhost.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "879cd17a52630b3c85c3667d8a73bdf60e41d4cbad31f0e1027b7519e1cc0ee6", + "format": 1 + }, + { + "name": "plugins", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "plugins/action", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "plugins/action/load_vars.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "5562cec881f2db37d28b3752502cef6e1af5aa26a2289dcc7e8c7cb1ca90d19a", + "format": 1 + }, + { + "name": "plugins/doc_fragments", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "plugins/doc_fragments/attributes.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "693112b2c633f1434f1e8d54ccdc5835134343988ecf41bd976ab81ab52bd11e", + "format": 1 + }, + { + "name": "plugins/doc_fragments/sops.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "b301331d83a268914aa2c3e3042430de79bf572aa53a80d7b50fb5b00761b58f", + "format": 1 + }, + { + "name": "plugins/filter", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "plugins/filter/_latest_version.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6db24f13e472ba499e1d891507b9bc14c5df17c73e8ad12d31fe2f362a69f177", + "format": 1 + }, + { + "name": "plugins/filter/decrypt.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "47f4aea8e22c96d0ba032644299306d593c568fc4b2e04be1cb3ad81d20160a6", + "format": 1 + }, + { + "name": "plugins/lookup", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "plugins/lookup/sops.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c2b9f850e93e4cde59e3f21f101ed06fc7174211fc9cd110f83cbe3271a992f9", + "format": 1 + }, + { + "name": "plugins/module_utils", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "plugins/module_utils/io.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "996eba535346394823463b599620b1c865671c842c56ff32ac161c5cc49a8e88", + "format": 1 + }, + { + "name": "plugins/module_utils/sops.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "34e358a918b7bfa0985203faada16b5f11424ba69a6ca1afed9f17c51bdd6fde", + "format": 1 + }, + { + "name": "plugins/modules", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "plugins/modules/load_vars.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "5c83a9e5afcc1cd978f07375510c0beb5928cbdfe0b132380f54dfedce7eda73", + "format": 1 + }, + { + "name": "plugins/modules/sops_encrypt.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "31eb7e974044dbcfb20aceeaa35dbe6a4db40cde34d8106376d0b87c618db3e2", + "format": 1 + }, + { + "name": "plugins/plugin_utils", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "plugins/plugin_utils/action_module.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "85a7710cb1cafaeeff3c5f274ef77184e3cb515e62bb8315772b3500158a86a0", + "format": 1 + }, + { + "name": "plugins/vars", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "plugins/vars/sops.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "8e69aae9a1f264fade4bab781b1ec69fd28dea343af3e79cdd76015b94de68bc", + "format": 1 + }, + { + "name": "roles", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "roles/_install_age", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "roles/_install_age/defaults", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "roles/_install_age/defaults/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "64b0ffb3994173665d42d8d1e5a642a02d85080eaa146529bdbc36a1a86ee036", + "format": 1 + }, + { + "name": "roles/_install_age/meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "roles/_install_age/meta/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "598aaf54d9f9bdcecdfd61c4eabc6f314a5c1fa812ed0a92bd76980334e757bb", + "format": 1 + }, + { + "name": "roles/_install_age/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "roles/_install_age/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "198c6e349d9ba8c19164aac275cce2d2c5b00e91ec578543706aec00d39020bc", + "format": 1 + }, + { + "name": "roles/_install_age/vars", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "roles/_install_age/vars/D-Debian-10.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7105ecc5fd0abddd3671660be86555a44088050e564b74f2b1136d1b2b6db735", + "format": 1 + }, + { + "name": "roles/_install_age/vars/D-Ubuntu-16.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7105ecc5fd0abddd3671660be86555a44088050e564b74f2b1136d1b2b6db735", + "format": 1 + }, + { + "name": "roles/_install_age/vars/D-Ubuntu-18.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7105ecc5fd0abddd3671660be86555a44088050e564b74f2b1136d1b2b6db735", + "format": 1 + }, + { + "name": "roles/_install_age/vars/D-Ubuntu-20.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7105ecc5fd0abddd3671660be86555a44088050e564b74f2b1136d1b2b6db735", + "format": 1 + }, + { + "name": "roles/_install_age/vars/D-Alpine.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7c8db91a48f120ad6285cfb5c7af8fc883a50d8b201791d0c91bbc21ee60def6", + "format": 1 + }, + { + "name": "roles/_install_age/vars/D-Archlinux.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7c8db91a48f120ad6285cfb5c7af8fc883a50d8b201791d0c91bbc21ee60def6", + "format": 1 + }, + { + "name": "roles/_install_age/vars/D-Fedora.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7c8db91a48f120ad6285cfb5c7af8fc883a50d8b201791d0c91bbc21ee60def6", + "format": 1 + }, + { + "name": "roles/_install_age/vars/OS-Debian.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7c8db91a48f120ad6285cfb5c7af8fc883a50d8b201791d0c91bbc21ee60def6", + "format": 1 + }, + { + "name": "roles/_install_age/vars/default.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7105ecc5fd0abddd3671660be86555a44088050e564b74f2b1136d1b2b6db735", + "format": 1 + }, + { + "name": "roles/_install_age/README.md", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "07ac7d3cc67a5ab083da48b82b291eaf4c33a6ce2369d0b92500dadfb4c4c61a", + "format": 1 + }, + { + "name": "roles/install", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "roles/install/defaults", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "roles/install/defaults/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e21e3d199dfa4e67150043423d7246df7178fefbb6a4708ea89a0d2170191a29", + "format": 1 + }, + { + "name": "roles/install/meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "roles/install/meta/argument_specs.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "365a49e747895ee0b404ef735fcf92b29c3dbcdd5fbc5844d5cb545d1d9fbde5", + "format": 1 + }, + { + "name": "roles/install/meta/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "aec443fa842205021f4e5df3be4263de4344d8ce157307eca5f4523718a736e2", + "format": 1 + }, + { + "name": "roles/install/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "roles/install/tasks/detect_source.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "a41e9f21298934acaac8dd481250382999c06620274574577403e91f9d518608", + "format": 1 + }, + { + "name": "roles/install/tasks/github.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "2bb7bba0741eb59f9d9318ddefe1822130e7408b2b98e98d4655edd373d174fe", + "format": 1 + }, + { + "name": "roles/install/tasks/github_api.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "d2686f68158196c379e609f7c149d0ac8a3887b0685995ba3c6caac9f2990779", + "format": 1 + }, + { + "name": "roles/install/tasks/github_latest_release.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "3fcf412aa7c3a0c87c08ab45f8d0235304180212d37c0c8efc9097326516adfc", + "format": 1 + }, + { + "name": "roles/install/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "d5829e87926b7f08652a7af6ee9282e63510fe5f32eafa5fba6dcd135201aeaf", + "format": 1 + }, + { + "name": "roles/install/tasks/system.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "456ed0aaab23e48618b9f273236ee22223141a261acafd6abf5c825922bc93bf", + "format": 1 + }, + { + "name": "roles/install/vars", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "roles/install/vars/D-Alpine.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "1b5cc289609a2404abb08ebf6282d1384dd637e276cc7ec41f141a15ff10d3db", + "format": 1 + }, + { + "name": "roles/install/vars/D-Archlinux.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "5c75bbf18af712a90df2c56709ac74582406c84a84e60baefc653012726cd318", + "format": 1 + }, + { + "name": "roles/install/vars/OS-Debian.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f80fc923f141c7ea06989923786218befca11a5159372898d8b518110975715a", + "format": 1 + }, + { + "name": "roles/install/vars/OS-RedHat.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "69ec003b243d7a0e83e3787a2bc87e1ffd9eb88a42cf58e703deb97e03c63db3", + "format": 1 + }, + { + "name": "roles/install/vars/default.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "70c1ffe02d84556e3ec3919f090e16cc55f7a867007036715e7b7f1008208d4a", + "format": 1 + }, + { + "name": "roles/install/README.md", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "07ac7d3cc67a5ab083da48b82b291eaf4c33a6ce2369d0b92500dadfb4c4c61a", + "format": 1 + }, + { + "name": "tests", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/ee", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/ee/roles", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/ee/roles/lookup_sops", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/ee/roles/lookup_sops/files", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/ee/roles/lookup_sops/files/.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f7fed852c7549f6b77fbb5578f1412721d91720a0f8449ff4a19af313f4c7724", + "format": 1 + }, + { + "name": "tests/ee/roles/lookup_sops/files/simple.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "0a783da7d3b05e334118ad81a9f159450a450dfea34eddd670eb59004d7774f6", + "format": 1 + }, + { + "name": "tests/ee/roles/lookup_sops/files/simple.sops.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/ee/roles/lookup_sops/files/wrong.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "774ac4e358eb8d7bc880231586957139e77b8025d9f313cabe4d47e7c1409072", + "format": 1 + }, + { + "name": "tests/ee/roles/lookup_sops/files/wrong.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/ee/roles/lookup_sops/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/ee/roles/lookup_sops/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "4f505f3239bdd15832caade3ae6538f990086ef0d3a2ab5070da466c97bdbac4", + "format": 1 + }, + { + "name": "tests/ee/all.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "0274b0355d0633bc4b4ae1ac2a07aaed7fd3da81fc6c3817817a6b78db99569b", + "format": 1 + }, + { + "name": "tests/integration", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/age", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/age/meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/age/meta/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "bc66f3ccd8b2c53eee76bd77ac62eae64fa4e969f2095c3794be0d10f75e1c36", + "format": 1 + }, + { + "name": "tests/integration/targets/age/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/age/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "01bbdee0040569f28aaf3acc86181760738b3342c7388240043d18c9ba147138", + "format": 1 + }, + { + "name": "tests/integration/targets/age/tasks/test.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "3527058cb66e775de33848d092a3f0af089196605595a44b98498a5580491155", + "format": 1 + }, + { + "name": "tests/integration/targets/age/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "470b53b780d099e0c1f82cf652e55bce5eb4986d585b02ec728665520dac4d38", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f7fed852c7549f6b77fbb5578f1412721d91720a0f8449ff4a19af313f4c7724", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/binary.sops", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f7a905c43f10dd195a2eea154cfafb57c410caf85c337a950485f1b35edc3534", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/binary.sops.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/fake-sops-rep.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "3a19245065178617e87cf36c758991a86f50b972450e09c669a1e76e5e8f52f1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/fake-sops-val.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "600f10d79db3a5bea9f628adca64245c51f7f0c6e36014768a94c996b755f278", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/fake-sops.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6b08de408912442f9fc06fad2d167a3988220edbded3c9c3ef8001c904c2f7b7", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "2a280b4e00c70f46e801d0ee2a072776ceb8350b196af57d97500d1a99369ef9", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary-yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c8351dcbf94b7e163364b51222760ef2ee6254d1e0a106606e1fda000b9b730a", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c8351dcbf94b7e163364b51222760ef2ee6254d1e0a106606e1fda000b9b730a", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "06c1d23eebd6cf6298b4f244e40f17474d5815c1eb072e6d0080785187003a96", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "2a280b4e00c70f46e801d0ee2a072776ceb8350b196af57d97500d1a99369ef9", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "2a280b4e00c70f46e801d0ee2a072776ceb8350b196af57d97500d1a99369ef9", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-binary.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "b0ea5e7739b3987f67e48cd7a70b28637745f85792817fd77ff38de7297fd2c6", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-json.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "b0ea5e7739b3987f67e48cd7a70b28637745f85792817fd77ff38de7297fd2c6", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-json.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-json.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "b0ea5e7739b3987f67e48cd7a70b28637745f85792817fd77ff38de7297fd2c6", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-json.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "9766120534987766979b39f4f65f07d24f072c6fd63d4c07e14bd77c5ec470f3", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-yaml.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "9766120534987766979b39f4f65f07d24f072c6fd63d4c07e14bd77c5ec470f3", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-yaml.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-yaml.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "57d163281b9b1c914944b5cbd55171a191f99deda0c86cad40ccbbce33493c7e", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/hidden-yaml.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/rstrip.sops", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "1c3b02c75c417d5f59e39fff32233fd6fa7353320516de0a056212f199ad5881", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/rstrip.sops.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/simple.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "0a783da7d3b05e334118ad81a9f159450a450dfea34eddd670eb59004d7774f6", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/files/simple.sops.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/meta/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "52509d6021ae312164ec913cd4cdd76c0517a999a1664c6ec7036d1e3d543565", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "4b1e641508c0be242d1aca0f93724e746d61e93be35b0b3f6649b2383a0600df", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_decrypt/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e5ced53ad61a1730fd8027e388426ff76ab537963c84bee1ad84ad5fc57dbb2a", + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/meta/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "52509d6021ae312164ec913cd4cdd76c0517a999a1664c6ec7036d1e3d543565", + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "20ecb442544da9bb11d65d6ee631f6aae0025fa7ebdb7f464bc7a09918d36db2", + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/vars", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/vars/.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f7fed852c7549f6b77fbb5578f1412721d91720a0f8449ff4a19af313f4c7724", + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/vars/empty.sops.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "df2b650065df0ea33eb3b222cf0ef497d40d51c08d9784529c76b40a59ac7e95", + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/vars/empty.sops.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/vars/proper-vars-2.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c67d6bf4c6727441de8c2fc4fc471c4e020f0cca5deb3113a3871e554449f37c", + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/vars/proper-vars.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "09617f1563ee9c9113eb061fe3d6c379195f1f0063aa6ed7670655616b1d53c3", + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/vars/simple.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "1e861b6423b8cb695cf1e9619ef06d852cb2a676f96a3961cd40662b4cae1703", + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/vars/wrong.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "3db0d7497d88af37e0459662c8de65f4b16d52a9e7125a4ac757000f1800d29a", + "format": 1 + }, + { + "name": "tests/integration/targets/load_vars/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7661171157841040640d901cb4bdb167adb9a547424b57c61e757cb95514ad4a", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f7fed852c7549f6b77fbb5578f1412721d91720a0f8449ff4a19af313f4c7724", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/binary.sops", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f7a905c43f10dd195a2eea154cfafb57c410caf85c337a950485f1b35edc3534", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/binary.sops.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/fake-sops-rep.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "9812984ee2aea316f49380318664247f093c2c794892accc9e54916054cab2d8", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/fake-sops-val.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "26d8124c99350c25bcaf44b22833c9e27253dbfb22589356639ec58d571211aa", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/fake-sops.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c54bd8b8d632d7d502c1d99320c071ba466780cbac5549412a86188fbb1c78ed", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "2a280b4e00c70f46e801d0ee2a072776ceb8350b196af57d97500d1a99369ef9", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary-yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c8351dcbf94b7e163364b51222760ef2ee6254d1e0a106606e1fda000b9b730a", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary-yaml.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c8351dcbf94b7e163364b51222760ef2ee6254d1e0a106606e1fda000b9b730a", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary-yaml.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary-yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary-yaml.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "06c1d23eebd6cf6298b4f244e40f17474d5815c1eb072e6d0080785187003a96", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary-yaml.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "2a280b4e00c70f46e801d0ee2a072776ceb8350b196af57d97500d1a99369ef9", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "2a280b4e00c70f46e801d0ee2a072776ceb8350b196af57d97500d1a99369ef9", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-binary.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "b0ea5e7739b3987f67e48cd7a70b28637745f85792817fd77ff38de7297fd2c6", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-json.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "b0ea5e7739b3987f67e48cd7a70b28637745f85792817fd77ff38de7297fd2c6", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-json.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-json.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "b0ea5e7739b3987f67e48cd7a70b28637745f85792817fd77ff38de7297fd2c6", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-json.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "9766120534987766979b39f4f65f07d24f072c6fd63d4c07e14bd77c5ec470f3", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-yaml.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "9766120534987766979b39f4f65f07d24f072c6fd63d4c07e14bd77c5ec470f3", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-yaml.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-yaml.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "57d163281b9b1c914944b5cbd55171a191f99deda0c86cad40ccbbce33493c7e", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/hidden-yaml.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/rstrip.sops", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "1c3b02c75c417d5f59e39fff32233fd6fa7353320516de0a056212f199ad5881", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/rstrip.sops.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/simple.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "0a783da7d3b05e334118ad81a9f159450a450dfea34eddd670eb59004d7774f6", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/simple.sops.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/wrong.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "774ac4e358eb8d7bc880231586957139e77b8025d9f313cabe4d47e7c1409072", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/files/wrong.yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/meta/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "52509d6021ae312164ec913cd4cdd76c0517a999a1664c6ec7036d1e3d543565", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "694fd69b88f6789d5fc0201b346acfcd3b5ef581d2e181f3991051c9efe6af14", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_sops/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e5ced53ad61a1730fd8027e388426ff76ab537963c84bee1ad84ad5fc57dbb2a", + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_latest", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_latest/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_latest/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ef1261234830738bc179a0b7645c8d007c58606e889c1eae67f8e1480c26456e", + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_latest/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f30f584423afb135316f4e2526bc6a556895eee2918bfb66f87cda5ce4cfa946", + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_localhost_remote", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_localhost_remote/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_localhost_remote/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "87c852b2d102ee4d74d51c85590c416c988d3d6a8dfb802f0f594cbd837ab343", + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_localhost_remote/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "d434e2c8d436bbd2b9b9af7539f126714f355859097e12a21147328fd8925fa1", + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_version", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_version/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_version/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "1754b5e36e03ba81600f3678fd0f30de5a1f25f48999aa9b6cd9a42347edcfdb", + "format": 1 + }, + { + "name": "tests/integration/targets/role_install_version/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e45effc3296ceba464e927b222581850a6a06e387bb178921d6aa64d488464d8", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_remote_tmp_dir", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/setup_remote_tmp_dir/handlers", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/setup_remote_tmp_dir/handlers/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "eb71bb93b6958a495a1486357d097e5bc9ee2071a16dcc17f27780ad8af5ef77", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_remote_tmp_dir/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/setup_remote_tmp_dir/tasks/default-cleanup.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "54730c80c5fa787eea72dac59c88627036aeae96c48e27cbec02f9c1bd49a2d2", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_remote_tmp_dir/tasks/default.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "594627e64e5cb619d5d2a817b6f94c8750c61f21452ebfe3e85427d59996ec06", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_remote_tmp_dir/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "665db3263e44a68e5bd728127a0b1a6dcf93a93eb529e80900a4c4c3fa06d68e", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_sops", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/setup_sops/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/setup_sops/tasks/install.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "822b0c4b6890e9b401eadab8397d115af02f401c711f0d6795290452357c6219", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_sops/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "91ace51ab1fa238e00ecfd79d127a2d5ef1dee1ba27c43c87d92fb3305b55f55", + "format": 1 + }, + { + "name": "tests/integration/targets/sops_encrypt", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/sops_encrypt/files", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/sops_encrypt/files/.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f7fed852c7549f6b77fbb5578f1412721d91720a0f8449ff4a19af313f4c7724", + "format": 1 + }, + { + "name": "tests/integration/targets/sops_encrypt/files/broken-json-yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "b2c893ee6494b8be5bc4e5cf9770c69f5ea7076ee62aab16f8e8c028c9114a81", + "format": 1 + }, + { + "name": "tests/integration/targets/sops_encrypt/files/broken-json-yaml.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/sops_encrypt/files/wrong.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "3db0d7497d88af37e0459662c8de65f4b16d52a9e7125a4ac757000f1800d29a", + "format": 1 + }, + { + "name": "tests/integration/targets/sops_encrypt/meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/sops_encrypt/meta/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "bc66f3ccd8b2c53eee76bd77ac62eae64fa4e969f2095c3794be0d10f75e1c36", + "format": 1 + }, + { + "name": "tests/integration/targets/sops_encrypt/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/sops_encrypt/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "5c3d1870ddc3f41bf88bf2ae5d5eda060f6c3202331b9054c05ef33b00a1a706", + "format": 1 + }, + { + "name": "tests/integration/targets/sops_encrypt/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "470b53b780d099e0c1f82cf652e55bce5eb4986d585b02ec728665520dac4d38", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/meta/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "52509d6021ae312164ec913cd4cdd76c0517a999a1664c6ec7036d1e3d543565", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-bad-file", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-bad-file/group_vars", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-bad-file/group_vars/all.sops.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "3db0d7497d88af37e0459662c8de65f4b16d52a9e7125a4ac757000f1800d29a", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-bad-file/hosts", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ce6a439f1bdce812664b04096894bb32a403f45d48c29c9ebd7b72205e49034b", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-bad-file/playbook.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6d55b2b54f888a407111fba2ecc8e34ed88d9e51f5e7cdf2d99c8371c5d03160", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-bad-file/validate.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "0d6388a9a6f626e137979b4888bacb774a34f16419779e67028e1de66ecd5c74", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-disable-sops", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-disable-sops/group_vars", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-disable-sops/hosts", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ce6a439f1bdce812664b04096894bb32a403f45d48c29c9ebd7b72205e49034b", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-disable-sops/playbook.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "d60869452fe10424cf1f1a2c335018cd9a1f2a0ca31258744efe2b554132af26", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-disable-sops/run.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "4bc578e5023ad323f79f074c8bc22be9063d656bf5370b6c0361556fa9a50f0f", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-disable-sops/validate.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "78271c0ba3a4a18e4520c1a0ff4bb3be3ff761289a749e5221c82fa6feac83a7", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-not-dir", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-not-dir/group_vars", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "02de562c6658595ae581a5896e447a309c0b6a648ced86815ee3b271c52f0850", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-not-dir/hosts", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ce6a439f1bdce812664b04096894bb32a403f45d48c29c9ebd7b72205e49034b", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-not-dir/playbook.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "7112dadd139c189e733635f90156572181e9f845dd24dabcb115788bcbe056e4", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-not-dir/validate.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "3eeaf6e0b19a4abe0fb3272069ea106e3d852de01e46c72acd9e2835845f3dff", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-cache", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-cache/1.sops.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "1e861b6423b8cb695cf1e9619ef06d852cb2a676f96a3961cd40662b4cae1703", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-cache/2.sops.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "a6c19c1f55ba438db601ab40184d921edc9aeaea04e5f943a6a74d5884a539bb", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-cache/setup.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "66c0fce5439d5e26021c162a46663401b3642dc745362bc9532ea5dd2447983c", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-cache/validate.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "eaed8ac4f4b87877e124b6cdefd42b6994519d9ae97246dc4bc11fccb074a080", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-cache/.gitignore", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "97f36d8c16c1eb370fcf9b8b9744cefc3ba77072ea6ee2297772f9f290280b45", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-cache/hosts", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ce6a439f1bdce812664b04096894bb32a403f45d48c29c9ebd7b72205e49034b", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-cache/playbook.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "fa2fe10272ab1590be0c541979ddd32c8305ca9c99aead8c024470c53d029e05", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-cache/run.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "af2f6bd5c2e04a8bbf573705286e6c6b134a28e07d2935130b94548f84dff4e4", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-no-cache", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-no-cache/.gitignore", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "97f36d8c16c1eb370fcf9b8b9744cefc3ba77072ea6ee2297772f9f290280b45", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-no-cache/1.sops.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "1e861b6423b8cb695cf1e9619ef06d852cb2a676f96a3961cd40662b4cae1703", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-no-cache/2.sops.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "a6c19c1f55ba438db601ab40184d921edc9aeaea04e5f943a6a74d5884a539bb", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-no-cache/hosts", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ce6a439f1bdce812664b04096894bb32a403f45d48c29c9ebd7b72205e49034b", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-no-cache/playbook.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "fa2fe10272ab1590be0c541979ddd32c8305ca9c99aead8c024470c53d029e05", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-no-cache/run.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "226c5f21843ce39cfb19514ccf8a5b353842130addebf9b272a98c49cbc70a73", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-no-cache/setup.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "66c0fce5439d5e26021c162a46663401b3642dc745362bc9532ea5dd2447983c", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-inv-no-cache/validate.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "eaed8ac4f4b87877e124b6cdefd42b6994519d9ae97246dc4bc11fccb074a080", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-cache", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-cache/1.sops.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "1e861b6423b8cb695cf1e9619ef06d852cb2a676f96a3961cd40662b4cae1703", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-cache/2.sops.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "a6c19c1f55ba438db601ab40184d921edc9aeaea04e5f943a6a74d5884a539bb", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-cache/setup.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "66c0fce5439d5e26021c162a46663401b3642dc745362bc9532ea5dd2447983c", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-cache/validate.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "eaed8ac4f4b87877e124b6cdefd42b6994519d9ae97246dc4bc11fccb074a080", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-cache/.gitignore", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "97f36d8c16c1eb370fcf9b8b9744cefc3ba77072ea6ee2297772f9f290280b45", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-cache/hosts", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ce6a439f1bdce812664b04096894bb32a403f45d48c29c9ebd7b72205e49034b", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-cache/playbook.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "fa2fe10272ab1590be0c541979ddd32c8305ca9c99aead8c024470c53d029e05", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-cache/run.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "cad9eef1c4d915cbc950077855a2f450c7c521ced63af7906341923b1b305439", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-no-cache", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-no-cache/1.sops.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "1e861b6423b8cb695cf1e9619ef06d852cb2a676f96a3961cd40662b4cae1703", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-no-cache/2.sops.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "a6c19c1f55ba438db601ab40184d921edc9aeaea04e5f943a6a74d5884a539bb", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-no-cache/setup.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "66c0fce5439d5e26021c162a46663401b3642dc745362bc9532ea5dd2447983c", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-no-cache/validate.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "eaed8ac4f4b87877e124b6cdefd42b6994519d9ae97246dc4bc11fccb074a080", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-no-cache/.gitignore", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "97f36d8c16c1eb370fcf9b8b9744cefc3ba77072ea6ee2297772f9f290280b45", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-no-cache/hosts", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ce6a439f1bdce812664b04096894bb32a403f45d48c29c9ebd7b72205e49034b", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-no-cache/playbook.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "890f837d78392031d57bd4f9ef58befc28ea87dd75300b7e5dbd281b8266a963", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-stage-task-no-cache/run.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "be93bbe2194bab694623d3546a9cefd61e4a7b1dc1a084e51aad71829a76af4e", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-success", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-success/group_vars", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-success/group_vars/all", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-success/group_vars/all/test.sops.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "a6c19c1f55ba438db601ab40184d921edc9aeaea04e5f943a6a74d5884a539bb", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-success/group_vars/all.sops.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "1e861b6423b8cb695cf1e9619ef06d852cb2a676f96a3961cd40662b4cae1703", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-success/host_vars", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-success/host_vars/localhost.sops.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f6272b7880f68b10a514feb4d9db987c640a90232503706081eb3acf629f8c19", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-success/host_vars/localhost.sops.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-success/hosts", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ce6a439f1bdce812664b04096894bb32a403f45d48c29c9ebd7b72205e49034b", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-success/playbook.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6d55b2b54f888a407111fba2ecc8e34ed88d9e51f5e7cdf2d99c8371c5d03160", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/test-success/validate.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "eaed8ac4f4b87877e124b6cdefd42b6994519d9ae97246dc4bc11fccb074a080", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/.gitignore", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "bfdfca5b406d8e4878fcd339be9ecc57574200b9a37ef9c58d25f27a30344cf6", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/.sops.yaml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "f7fed852c7549f6b77fbb5578f1412721d91720a0f8449ff4a19af313f4c7724", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/README.md", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c43f777b5e871249b9b0ce642fe54d3eb5d04c8191dce97ab2c36c083e6168ae", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e5ced53ad61a1730fd8027e388426ff76ab537963c84bee1ad84ad5fc57dbb2a", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/runme.sh", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "660cf0be41fae9cd1736774f18227ba6c42db32438c93570d4c9ddb79f295fcc", + "format": 1 + }, + { + "name": "tests/integration/targets/var_sops/setup.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ac1747e8244b5a6e548f485c4a854a6a14dd91f45f679ca2d371709dc70de9de", + "format": 1 + }, + { + "name": "tests/sanity", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/sanity/extra", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/sanity/extra/extra-docs.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "63af024dcda47dda7e3cead05953d33c858853d2adc046efb47af28a6a0dc96b", + "format": 1 + }, + { + "name": "tests/sanity/extra/extra-docs.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/sanity/extra/extra-docs.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "00ae2a5eeec7f3a621074473ee4d0d16f763c67e1c6c1b2f4b7dcd3ca171262c", + "format": 1 + }, + { + "name": "tests/sanity/extra/licenses.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "8c111eb62fa6f1b6c8a1260e9ff06c8b76ef8244428c6289969d79678093618f", + "format": 1 + }, + { + "name": "tests/sanity/extra/licenses.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/sanity/extra/licenses.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ff502f0707adf15a57b2fc48842fc47d154bfbd3aeadf4c0c05e96b0589c3cd4", + "format": 1 + }, + { + "name": "tests/sanity/extra/licenses.py.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "88f745b5d91e1371369c207e3392877af6f3e1de48fbaca63a728d4dcf79e03c", + "format": 1 + }, + { + "name": "tests/sanity/extra/no-unwanted-files.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "a3d3b17f699b042958c7cd845a9d685bc935d83062e0bcf077f2c7200e2c0bac", + "format": 1 + }, + { + "name": "tests/sanity/extra/no-unwanted-files.json.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/sanity/extra/no-unwanted-files.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c0a3780ef0497719277e3dec9c3902572d7904db1a83953e0a46be8275729600", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.10.txt", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "339f0feb36bead5f3e7ea0b6f9e2a87c0c3206f495d294ecfad057f7defa0225", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.10.txt.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.11.txt", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "339f0feb36bead5f3e7ea0b6f9e2a87c0c3206f495d294ecfad057f7defa0225", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.11.txt.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.12.txt", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "339f0feb36bead5f3e7ea0b6f9e2a87c0c3206f495d294ecfad057f7defa0225", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.12.txt.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.13.txt", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "339f0feb36bead5f3e7ea0b6f9e2a87c0c3206f495d294ecfad057f7defa0225", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.13.txt.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.14.txt", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "339f0feb36bead5f3e7ea0b6f9e2a87c0c3206f495d294ecfad057f7defa0225", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.14.txt.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.15.txt", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "339f0feb36bead5f3e7ea0b6f9e2a87c0c3206f495d294ecfad057f7defa0225", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.15.txt.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.9.txt", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "339f0feb36bead5f3e7ea0b6f9e2a87c0c3206f495d294ecfad057f7defa0225", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.9.txt.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "tests/config.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "498d46cf08b5abb09880088fa8fd142315f7f775e94cdc7d41364ed20fc2cd65", + "format": 1 + }, + { + "name": ".gitignore", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "dcb31ab7347b5c812ea0f6747626adab4aba45a40c46939894652ca6a7b57e55", + "format": 1 + }, + { + "name": "CHANGELOG.rst", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "4f7be00805053b2e8248d226c1dd09788e0c9a91075cef095ea8bf8dd38ed5ac", + "format": 1 + }, + { + "name": "CHANGELOG.rst.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { + "name": "CONTRIBUTING.md", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e85c941a72f9219996e95d29d9ef1c3f8ace6e62737aa4d4381fd123bf61df26", + "format": 1 + }, + { + "name": "COPYING", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986", + "format": 1 + }, + { + "name": "README.md", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "907940525a54d4a9d69b4048a78401b9179df58b138c4b2a1da500e827b093b6", + "format": 1 + }, + { + "name": "codecov.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "17878b1333a5ad4dfeb48c0fef67b5c8b8fe4842cda8cbf8827defda286435f6", + "format": 1 + } + ], + "format": 1 +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/LICENSES/BSD-2-Clause.txt b/ansible_collections/community/sops/LICENSES/BSD-2-Clause.txt new file mode 100644 index 00000000..6810e04e --- /dev/null +++ b/ansible_collections/community/sops/LICENSES/BSD-2-Clause.txt @@ -0,0 +1,8 @@ +Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + diff --git a/ansible_collections/community/sops/LICENSES/GPL-3.0-or-later.txt b/ansible_collections/community/sops/LICENSES/GPL-3.0-or-later.txt new file mode 100644 index 00000000..f288702d --- /dev/null +++ b/ansible_collections/community/sops/LICENSES/GPL-3.0-or-later.txt @@ -0,0 +1,674 @@ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/> + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + <one line to give the program's name and a brief idea of what it does.> + Copyright (C) <year> <name of author> + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <https://www.gnu.org/licenses/>. + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + <program> Copyright (C) <year> <name of author> + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +<https://www.gnu.org/licenses/>. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +<https://www.gnu.org/licenses/why-not-lgpl.html>. diff --git a/ansible_collections/community/sops/MANIFEST.json b/ansible_collections/community/sops/MANIFEST.json new file mode 100644 index 00000000..771bf9ac --- /dev/null +++ b/ansible_collections/community/sops/MANIFEST.json @@ -0,0 +1,37 @@ +{ + "collection_info": { + "namespace": "community", + "name": "sops", + "version": "1.6.1", + "authors": [ + "Edoardo Tenani" + ], + "readme": "README.md", + "tags": [ + "sops", + "encryption", + "decryption", + "secret", + "vault" + ], + "description": "Support usage of mozilla/sops from your Ansible playbooks", + "license": [ + "GPL-3.0-or-later", + "BSD-2-Clause" + ], + "license_file": null, + "dependencies": {}, + "repository": "https://github.com/ansible-collections/community.sops", + "documentation": null, + "homepage": "https://github.com/ansible-collections/community.sops", + "issues": "https://github.com/ansible-collections/community.sops/issues" + }, + "file_manifest_file": { + "name": "FILES.json", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "d6f852123bbaa1e165de4d29357251b6ea8001e173ea60ded4042504971ba273", + "format": 1 + }, + "format": 1 +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/README.md b/ansible_collections/community/sops/README.md new file mode 100644 index 00000000..0e7c8521 --- /dev/null +++ b/ansible_collections/community/sops/README.md @@ -0,0 +1,354 @@ +<!-- +Copyright (c) Ansible Project +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +--> + +# Community Sops Collection +[](https://github.com/ansible-collections/community.sops/actions) [](https://codecov.io/gh/ansible-collections/community.sops) + +<!-- Describe the collection and why a user would want to use it. What does the collection do? --> +The `community.sops` collection allows integrating [`mozilla/sops`](https://github.com/mozilla/sops) in Ansible. + +`mozilla/sops` is a tool for encryption and decryption of files using secure keys (GPG, KMS). It can be leveraged in Ansible to provide an easy to use and flexible to manage way to manage ecrypted secrets' files. + +Please note that this collection does **not** support Windows targets. + +**Sops version compatibility** + +The following table shows which versions of sops were tested with which versions of the collection. Older (or newer) versions of sops can still work fine, it just means that we did not test them. In some cases, it could be that a minimal required version of sops is explicitly documented for a specific feature. Right now, that is not the case. + +|`community.sops` version|`mozilla/sops` version| +|---|---| +|0.1.0|`3.5.0+`| +|1.0.6|`3.5.0+`| +|`main` branch|`3.5.0`, `3.6.0`, `3.7.1`, `3.7.2`, `3.7.3`| + +## Tested with Ansible + +Tested with the current Ansible 2.9, ansible-base 2.10, ansible-core 2.11, ansible-core 2.12, ansible-core 2.13, and ansible-core 2.14 releases and the current development version of ansible-core. Ansible versions before 2.9.10 are not supported. + +The vars plugin requires ansible-base 2.10 or later. + +## External requirements + +<!-- List any external resources the collection depends on, for example minimum versions of an OS, libraries, or utilities. Do not list other Ansible collections here. --> + +You will need to install [`sops`](https://github.com/mozilla/sops) manually before using plugins provided by this +collection. + +## Collection Documentation + +Browsing the [**latest** collection documentation](https://docs.ansible.com/ansible/latest/collections/community/sops) will show docs for the _latest version released in the Ansible package_, not the latest version of the collection released on Galaxy. + +Browsing the [**devel** collection documentation](https://docs.ansible.com/ansible/devel/collections/community/sops) shows docs for the _latest version released on Galaxy_. + +We also separately publish [**latest commit** collection documentation](https://ansible-collections.github.io/community.sops/branch/main/) which shows docs for the _latest commit in the `main` branch_. + +If you use the Ansible package and do not update collections independently, use **latest**. If you install or update this collection directly from Galaxy, use **devel**. If you are looking to contribute, use **latest commit**. + +## Included content + +<!-- Galaxy will eventually list the module docs within the UI, but until that is ready, you may need to either describe your plugins etc here, or point to an external docsite to cover that information. --> + +This collection provides: + +- a [lookup plugin](https://docs.ansible.com/ansible/latest/user_guide/playbooks_lookups.html#playbooks-lookups) `sops` that allows looking up a sops-encrypted file content; +- a [vars plugin](https://docs.ansible.com/ansible/latest/plugins/vars.html) `sops` that allows loading Ansible vars from sops-encrypted files for hosts and groups; +- an [action plugin](https://docs.ansible.com/ansible/latest/plugins/action.html) `load_vars` that allows loading Ansible vars from a sops-encrypted file dynamically during a playbook or role; +- a [module](https://docs.ansible.com/ansible/latest/user_guide/basic_concepts.html#modules) `sops_encrypt` which allows to encrypt data with sops. +- a [role](https://docs.ansible.com/ansible/latest/user_guide/playbooks_reuse_roles.html) `install` which allows to install sops and GNU Privacy Guard. +- two [playbooks](https://docs.ansible.com/ansible/latest/user_guide/playbooks_intro.html) `install` and `install_localhost` which allow to install sops and GNU Privacy Guard. + +## Using this collection + +### Installing sops + +To install sops, you can use the ``community.sops.install`` role. The role also installs [GNU Privacy Guard (GPG)](https://en.wikipedia.org/wiki/GNU_Privacy_Guard). + +Examples: + +```yaml +tasks: + # To use the sops_encrypt module on a remote host, you need to install sops on it: + - name: Install sops on remote hosts + ansible.builtin.include_role: + name: community.sops.install + vars: + sops_version: 2.7.0 # per default installs the latest version + + # To use the lookup plugin, filter plugin, vars plugin, or the load_vars action, + # you need sops installed on localhost: + - name: Install sops on localhost + ansible.builtin.include_role: + name: community.sops.install + vars: + sops_install_on_localhost: true +``` + +### lookup plugin + +The lookup plugin can be accessed with the `community.sops.sops` key. + +Examples: + +```yaml +tasks: + - name: Output secrets to screen (BAD IDEA!) + ansible.builtin.debug: + msg: "Content: {{ lookup('community.sops.sops', '/path/to/sops-encrypted-file.enc.yaml') }}" + + - name: Add SSH private key + ansible.builtin.copy: + content: "{{ lookup('community.sops.sops', user + '-id_rsa') }}" + dest: /home/{{ user }}/.ssh/id_rsa + owner: "{{ user }}" + group: "{{ user }}" + mode: 0600 + no_log: true # avoid content to be written to log +``` + +See [Lookup Plugins](https://docs.ansible.com/ansible/latest/plugins/lookup.html) for more details on lookup plugins. + +### filter plugin + +The filter plugin can be used in Jinja2 expressions by the name `community.sops.decrypt`. It can decrypt sops-encrypted data coming from other sources than files. + +Example: + +```yaml +tasks: + - name: Load sops encrypted data + ansible.builtin.set_fact: + encrypted_data: "{{ lookup('file', '/path/to/sops-encrypted-file.enc.yaml') }}" + + - name: Output secrets to screen (BAD IDEA!) + ansible.builtin.debug: + msg: "Content: {{ encrypted_data | community.sops.decrypt(output_type='yaml') }}" +``` + +See [Filter Plugins](https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html) for more details on filters. + +Please note that if you put a Jinja2 expression in a variable, it will be evaluated **every time it is used**. Decrypting data takes a certain amount of time. If you need to use an expression multiple times, it is better to store its evaluated form as a fact with `ansible.bulitin.set_fact` first: + +```yaml +tasks: + - name: Decrypt data once + ansible.builtin.set_fact: + decrypted_data: "{{ encrypted_data | community.sops.decrypt }}" + run_once: true # if encrypted_data is identical on all hosts + + - name: Use decrypted secrets multiple times + ansible.builtin.openssl_privatekey: + path: "/path/to/private_{{ item }}.pem" + passphrase: "{{ decrypted_data }}" + cipher: auto + loop: + - foo + - bar + - baz +``` + +By using `{{ encrypted_data | community.sops.decrypt }}` instead of `{{ decrypted_data }}` in the `openssl_privatekey` task, the data would be decrypted three times for every host this is executed for. With the `ansible.builtin.set_fact` and `run_once: true`, it is evaluated only once. + +### vars plugin + +Vars plugins only work in ansible >= 2.10 and require explicit enabling. One +way to enable the plugin is by adding the following to the `defaults` section of +your `ansible.cfg`: + +```ini +vars_plugins_enabled = host_group_vars,community.sops.sops +``` + +See [VARIABLE_PLUGINS_ENABLED](https://docs.ansible.com/ansible/devel/reference_appendices/config.html#variable-plugins-enabled) for more details. + +After the plugin is enabled, correctly named group and host vars files will be +transparently decrypted with sops. + +The files must end with one of these extensions: + +* `.sops.yaml` +* `.sops.yml` +* `.sops.json` + +Here is an example file structure + +``` +├── inventory/ +│ ├── group_vars/ +│ │ └── all.sops.yml +│ ├── host_vars/ +│ │ ├── server1.sops.yml +│ │ └── server2/ +│ │ └── data.sops.yml +│ └── hosts +├── playbooks/ +│ └── setup-server.yml +└── ansible.cfg +``` + +You could execute the playbook in this example with the following command. The +sops vars files would be decrypted and used. + +```console +$ ansible-playbook playbooks/setup-server.yml -i inventory/hosts +``` + +#### Determine when to load variables + +Ansible 2.10 allows to determine [when vars plugins load the data](https://docs.ansible.com/ansible/latest/plugins/vars.html#using-vars-plugins). + +To run the sops vars plugin right after importing inventory, you can add the following to `ansible.cfg`: + +```ini +[community.sops] +vars_stage = inventory +``` + +#### Caching variable files + +By default, the sops vars plugin caches decrypted files to avoid having to decrypt them every task. If this is not wanted, it can be explicitly disabled in `ansible.cfg`: + +```ini +[community.sops] +vars_cache = false +``` + +Please note that when using vars plugin staging, this setting only has effect if the variables are not only loaded during the `inventory` stage. See the documentation of the `community.sops.sops` vars plugin for more details. + +### load_vars action plugin + +The `load_vars` action plugin can be used similarly to Ansible's `include_vars`, except that it right now only supports single files. Also, it does not allow to load proper variables (i.e. "unsafe" Jinja2 expressions which evaluate on usage), but only facts. It does allow to evaluate expressions on load-time though. + +Examples: + +```yaml +tasks: + - name: Load variables from file and store them in a variable + community.sops.load_vars: + file: path/to/sops-encrypted-file.sops.yaml + name: variable_to_store_contents_in + + - name: Load variables from file into global namespace, and evaluate Jinja2 expressions + community.sops.load_vars: + file: path/to/sops-encrypted-file-with-jinja2-expressions.sops.yaml + # The following allows to use Jinja2 expressions in the encrypted file! + # They are evaluated right now, i.e. not later like when loaded with include_vars. + expressions: evaluate-on-load +``` + +### sops_encrypt module + +The `sops_encrypt` module can be used to create and update sops encrypted files. It assumes that sops is configured via environment variables or a `.sops.yaml` file. + +Examples: + +```yaml +tasks: + - name: Store secret text sops encrypted + community.sops.sops_encrypt: + path: path/to/sops-encrypted-file.sops + content_text: This is some secret text. + + - name: Store secret binary data sops encrypted + community.sops.sops_encrypt: + path: path/to/sops-encrypted-file.sops + content_binary: "{{ some_secret_binary_data | b64encode }}" + + - name: Store secret JSON data + community.sops.sops_encrypt: + path: path/to/sops-encrypted-file.sops.json + content_json: + key1: value1 + key2: + - value2 + - key3: value3 + key4: value5 + + - name: Store secret YAML data + community.sops.sops_encrypt: + path: path/to/sops-encrypted-file.sops.yaml + content_yaml: + key1: value1 + key2: + - value2 + - key3: value3 + key4: value5 +``` + +## Troubleshooting + +### Spurious failures during encryption and decryption with gpg + +Sops calls `gpg` with `--use-agent`. When running multiple of these in parallel, for example when loading variables or looking up files for various hosts at once, some of these can randomly fail with messages such as +``` +Failed to get the data key required to decrypt the SOPS file. + +Group 0: FAILED + D13xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: FAILED + - | could not decrypt data key with PGP key: + | golang.org/x/crypto/openpgp error: Reading PGP message + | failed: openpgp: incorrect key; GPG binary error: exit + | status 2 + + 828xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: FAILED + - | could not decrypt data key with PGP key: + | golang.org/x/crypto/openpgp error: Reading PGP message + | failed: openpgp: incorrect key; GPG binary error: exit + | status 2 + +Recovery failed because no master key was able to decrypt the file. In +order for SOPS to recover the file, at least one key has to be successful, +but none were. +``` +This is a limitation of gpg-agent which can be fixed by adding `auto-expand-secmem` to `~/.gnupg/gpg-agent.conf` ([reference on option](https://www.gnupg.org/documentation/manuals/gnupg/Agent-Options.html#index-ssh_002dfingerprint_002ddigest), [reference on config file](https://www.gnupg.org/documentation/manuals/gnupg/Agent-Configuration.html)). + +(See https://github.com/ansible-collections/community.sops/issues/34 and https://dev.gnupg.org/T4146 for more details.) + +## Contributing to this collection + +<!--Describe how the community can contribute to your collection. At a minimum, include how and where users can create issues to report problems or request features for this collection. List contribution requirements, including preferred workflows and necessary testing, so you can benefit from community PRs. If you are following general Ansible contributor guidelines, you can link to - [Ansible Community Guide](https://docs.ansible.com/ansible/latest/community/index.html). --> + +See [CONTRIBUTING.md](./CONTRIBUTING.md) + +## Release notes + +See [CHANGELOG.rst](https://github.com/ansible-collections/community.sops/blob/main/CHANGELOG.rst). + +## Releasing, Versioning and Deprecation + +This collection follows [Semantic Versioning](https://semver.org/). More details on versioning can be found [in the Ansible docs](https://docs.ansible.com/ansible/latest/dev_guide/developing_collections.html#collection-versions). + +We plan to regularly release new minor or bugfix versions once new features or bugfixes have been implemented. + +Releasing the current major version happens from the `main` branch. We will create a `stable-1` branch for 1.x.y versions once we start working on a 2.0.0 release, to allow backporting bugfixes and features from the 2.0.0 branch (`main`) to `stable-1`. A `stable-2` branch will be created once we work on a 3.0.0 release, and so on. + +We currently are not planning any deprecations or new major releases like 2.0.0 containing backwards incompatible changes. If backwards incompatible changes are needed, we plan to deprecate the old behavior as early as possible. We also plan to backport at least bugfixes for the old major version for some time after releasing a new major version. We will not block community members from backporting other bugfixes and features from the latest stable version to older release branches, under the condition that these backports are of reasonable quality. + +### TODO + +- add a role providing sops installation (with version pinning) +- a full test suite + +## Code of Conduct + +This repository adheres to the [Ansible Community code of conduct](https://docs.ansible.com/ansible/latest/community/code_of_conduct.html) + +## More information + +<!-- List out where the user can find additional information, such as working group meeting times, slack/IRC channels, or documentation for the product this collection automates. At a minimum, link to: --> + +- [Ansible Collection overview](https://github.com/ansible-collections/overview) +- [Ansible User guide](https://docs.ansible.com/ansible/latest/user_guide/index.html) +- [Ansible Developer guide](https://docs.ansible.com/ansible/latest/dev_guide/index.html) + +## Licensing + +This collection is primarily licensed and distributed as a whole under the GNU General Public License v3.0 or later. + +See [LICENSES/GPL-3.0-or-later.txt](https://github.com/ansible-collections/community.sops/blob/main/COPYING) for the full text. + +Parts of the collection are licensed under the [BSD 2-Clause license](https://github.com/ansible-collections/community.sops/blob/main/LICENSES/BSD-2-Clause.txt). + +All files have a machine readable `SDPX-License-Identifier:` comment denoting its respective license(s) or an equivalent entry in an accompanying `.license` file. Only changelog fragments (which will not be part of a release) are covered by a blanket statement in `.reuse/dep5`. This conforms to the [REUSE specification](https://reuse.software/spec/). diff --git a/ansible_collections/community/sops/changelogs/changelog.yaml b/ansible_collections/community/sops/changelogs/changelog.yaml new file mode 100644 index 00000000..033c6f87 --- /dev/null +++ b/ansible_collections/community/sops/changelogs/changelog.yaml @@ -0,0 +1,266 @@ +ancestor: null +releases: + 0.1.0: + changes: + release_summary: 'First release of the `community.sops` collection! + + This release includes multiple plugins: an `action` plugin, a `lookup` plugin + and a `vars` plugin.' + fragments: + - 0.1.0.yml + modules: + - description: Load sops-encrypted variables from files, dynamically within a + task + name: load_vars + namespace: '' + - description: Encrypt data with sops + name: sops_encrypt + namespace: '' + plugins: + lookup: + - description: Read sops encrypted file contents + name: sops + namespace: null + vars: + - description: Loading sops-encrypted vars files + name: sops + namespace: null + release_date: '2020-10-23' + 0.2.0: + changes: + minor_changes: + - community.sops.sops lookup plugin - add ``empty_on_not_exist`` option which + allows to return an empty string instead of an error when the file does not + exist (https://github.com/ansible-collections/community.sops/pull/33). + - community.sops.sops vars plugin - add option to control caching (https://github.com/ansible-collections/community.sops/pull/32). + - community.sops.sops vars plugin - add option to determine when vars are loaded + (https://github.com/ansible-collections/community.sops/pull/32). + release_summary: This release adds features for the lookup and vars plugins. + fragments: + - 0.2.0.yml + - 32-vars-stage.yml + - 33-lookup-empty_on_not_exist.yml + release_date: '2020-12-16' + 1.0.0: + changes: + minor_changes: + - 'All plugins and modules: allow to pass generic sops options with new options + ``config_path``, ``enable_local_keyservice``, ``keyservice``. Also allow to + pass AWS parameters with options ``aws_profile``, ``aws_access_key_id``, ``aws_secret_access_key``, + and ``aws_session_token`` (https://github.com/ansible-collections/community.sops/pull/47).' + - community.sops.sops_encrypt - allow to pass encryption-specific options ``kms``, + ``gcp_kms``, ``azure_kv``, ``hc_vault_transit``, ``pgp``, ``unencrypted_suffix``, + ``encrypted_suffix``, ``unencrypted_regex``, ``encrypted_regex``, ``encryption_context``, + and ``shamir_secret_sharing_threshold`` to sops (https://github.com/ansible-collections/community.sops/pull/47). + release_summary: First stable release. This release is expected to be included + in Ansible 3.0.0. + fragments: + - 1.0.0.yml + - 47-sops-options.yml + release_date: '2021-01-14' + 1.0.1: + changes: + release_summary: Re-release of 1.0.0 to counteract error during release. + release_date: '2021-01-14' + 1.0.2: + changes: + release_summary: Fix of 1.0.1 release which had no changelog entry. + fragments: + - 1.0.2.yml + release_date: '2021-01-14' + 1.0.3: + changes: + bugfixes: + - community.sops.sops lookup plugins - fix wrong format of Ansible variables + so that these are actually used (https://github.com/ansible-collections/community.sops/pull/51). + - community.sops.sops vars plugins - remove non-working Ansible variables (https://github.com/ansible-collections/community.sops/pull/51). + release_summary: This release include some fixes to Ansible docs and required + changes for inclusion in Ansible. + fragments: + - 1.0.3.yml + - 51-fix-vars-arguments.yml + release_date: '2021-01-22' + 1.0.4: + changes: + release_summary: This is a security release, fixing a potential information + leak in the ``community.sops.sops_encrypt`` module. + security_fixes: + - community.sops.sops_encrypt - mark the ``aws_secret_access_key`` and ``aws_session_token`` + parameters as ``no_log`` to avoid leakage of secrets (https://github.com/ansible-collections/community.sops/pull/54). + fragments: + - 1.0.4.yml + - 54-no_log-fixes.yml + release_date: '2021-02-06' + 1.0.5: + changes: + bugfixes: + - community.sops.sops_encrypt - use output type ``yaml`` when path ends with + ``.yaml`` (https://github.com/ansible-collections/community.sops/pull/56). + release_summary: This release fixes a bug that prevented correct YAML file to + be created when the output was ending in `.yaml`. + fragments: + - 1.0.5.yml + - 56-sops_encrypt-yaml-output.yaml + release_date: '2021-03-05' + 1.0.6: + changes: + bugfixes: + - action_module plugin helper - make compatible with latest changes in ansible-core + 2.11.0b3 (https://github.com/ansible-collections/community.sops/pull/58). + - community.sops.load_vars - make compatible with latest changes in ansible-core + 2.11.0b3 (https://github.com/ansible-collections/community.sops/pull/58). + release_summary: This release makes the collection compatible to the latest + beta release of ansible-core 2.11. + fragments: + - 1.0.6.yml + - 58-actionmodule-plugin-utils-ansible-core-2.11.yml + release_date: '2021-03-21' + 1.1.0: + changes: + minor_changes: + - Avoid internal ansible-core module_utils in favor of equivalent public API + available since at least Ansible 2.9 (https://github.com/ansible-collections/community.sops/pull/73). + release_summary: A minor release for inclusion in Ansible 4.2.0. + fragments: + - 1.1.0.yml + - 71-decrypt-filter.yml + - ansible-core-_text.yml + plugins: + filter: + - description: Decrypt sops-encrypted data + name: decrypt + namespace: null + release_date: '2021-06-29' + 1.2.0: + changes: + bugfixes: + - Fix error handling in calls of the ``sops`` binary when negative errors are + returned (https://github.com/ansible-collections/community.sops/issues/82, + https://github.com/ansible-collections/community.sops/pull/83). + minor_changes: + - sops lookup and vars plugin - allow to configure almost all generic options + by ansible.cfg entries and environment variables (https://github.com/ansible-collections/community.sops/pull/81). + release_summary: 'Collection release for inclusion in Ansible 4.9.0 and 5.1.0. + + + This release contains a change allowing to configure generic plugin options + with ansible.cfg keys and env variables.' + fragments: + - 1.2.0.yml + - 81-plugin-options.yml + - 83-fix-error-handling.yml + release_date: '2021-11-16' + 1.2.1: + changes: + release_summary: Maintenance release with updated documentation. + fragments: + - 1.2.1.yml + release_date: '2022-03-22' + 1.2.2: + changes: + bugfixes: + - Include ``simplified_bsd.txt`` license file for the ``sops`` module utils. + release_summary: Maintenance release. + fragments: + - 1.2.2.yml + - simplified-bsd-license.yml + release_date: '2022-06-02' + 1.2.3: + changes: + release_summary: Fix formatting bug in documentation. No code changes. + fragments: + - 1.2.3.yml + release_date: '2022-06-29' + 1.3.0: + changes: + minor_changes: + - All software licenses are now in the ``LICENSES/`` directory of the collection + root, and the collection repository conforms to the `REUSE specification <https://reuse.software/spec/>`__ + except for the changelog fragments (https://github.com/ansible-collections/community.crypto/sops/108, + https://github.com/ansible-collections/community.sops/pull/113). + - sops vars plugin - added a configuration option to temporarily disable the + vars plugin (https://github.com/ansible-collections/community.sops/pull/114). + release_summary: Feature release. + fragments: + - 1.3.0.yml + - 108-licenses.yml + - 114-disable-vars-plugin.yml + release_date: '2022-08-23' + 1.4.0: + changes: + minor_changes: + - Allow to specify age keys as ``age_key``, or age keyfiles as ``age_keyfile`` + (https://github.com/ansible-collections/community.sops/issues/116, https://github.com/ansible-collections/community.sops/pull/117). + - sops_encrypt - allow to specify age recipients (https://github.com/ansible-collections/community.sops/issues/116, + https://github.com/ansible-collections/community.sops/pull/117). + release_summary: Feature release. + fragments: + - 1.4.0.yml + - 117-age.yml + release_date: '2022-09-11' + 1.4.1: + changes: + bugfixes: + - load_vars - ensure compatibility with newer versions of ansible-core (https://github.com/ansible-collections/community.sops/pull/121). + release_summary: Maintenance release to improve compatibility with future ansible-core + releases. + fragments: + - 1.4.1.yml + - 121-action-module-compat.yml + release_date: '2022-09-23' + 1.5.0: + changes: + minor_changes: + - Automatically install GNU Privacy Guard (GPG) in execution environments. To + install Mozilla sops a manual step needs to be added to the EE definition, + see the collection's documentation for details (https://github.com/ansible-collections/community.sops/pull/98). + release_summary: Feature release. + fragments: + - 1.5.0.yml + - 98-playbooks.yml + objects: + playbook: + - description: Installs sops and GNU Privacy Guard on all remote hosts + name: install + namespace: null + - description: Installs sops and GNU Privacy Guard on localhost + name: install_localhost + namespace: null + role: + - description: Install Mozilla sops + name: install + namespace: null + release_date: '2022-12-02' + 1.6.0: + changes: + minor_changes: + - install role - add ``sops_github_latest_detection`` option that allows to + configure which method to use for detecting the latest release on GitHub. + By default (``auto``) first tries to retrieve a list of recent releases using + the API, and if that fails due to rate limiting, tries to obtain the latest + GitHub release from a semi-documented URL (https://github.com/ansible-collections/community.sops/pull/133). + - install role - add ``sops_github_token`` option to allow passing a GitHub + token. This can for example be used to avoid rate limits when using the role + in GitHub Actions (https://github.com/ansible-collections/community.sops/pull/132). + - install role - implement another method to determine the latest release on + GitHub than using the GitHub API, which can make installation fail due to + rate-limiting (https://github.com/ansible-collections/community.sops/pull/131). + release_summary: Feature release improving the installation role. + fragments: + - 1.6.0.yml + - 131.yml + - 132.yml + - 133.yml + release_date: '2023-01-01' + 1.6.1: + changes: + bugfixes: + - action plugin helper - fix handling of deprecations for ansible-core 2.14.2 + (https://github.com/ansible-collections/community.sops/pull/136). + - various plugins - remove unnecessary imports (https://github.com/ansible-collections/community.sops/pull/133). + release_summary: Maintenance release. + fragments: + - 1.6.1.yml + - 136-action-module.yml + - remove-unneeded-imports.yml + release_date: '2023-02-20' diff --git a/ansible_collections/community/sops/changelogs/changelog.yaml.license b/ansible_collections/community/sops/changelogs/changelog.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/changelogs/changelog.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/changelogs/config.yaml b/ansible_collections/community/sops/changelogs/config.yaml new file mode 100644 index 00000000..844c5dec --- /dev/null +++ b/ansible_collections/community/sops/changelogs/config.yaml @@ -0,0 +1,35 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +changelog_filename_template: ../CHANGELOG.rst +changelog_filename_version_depth: 0 +changes_file: changelog.yaml +changes_format: combined +keep_fragments: false +mention_ancestor: true +new_plugins_after_name: removed_features +notesdir: fragments +prelude_section_name: release_summary +prelude_section_title: Release Summary +sections: +- - major_changes + - Major Changes +- - minor_changes + - Minor Changes +- - breaking_changes + - Breaking Changes / Porting Guide +- - deprecated_features + - Deprecated Features +- - removed_features + - Removed Features (previously deprecated) +- - security_fixes + - Security Fixes +- - bugfixes + - Bugfixes +- - known_issues + - Known Issues +title: Community Sops +trivial_section_name: trivial +use_fqcn: true diff --git a/ansible_collections/community/sops/changelogs/fragments/.keep b/ansible_collections/community/sops/changelogs/fragments/.keep new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/ansible_collections/community/sops/changelogs/fragments/.keep diff --git a/ansible_collections/community/sops/codecov.yml b/ansible_collections/community/sops/codecov.yml new file mode 100644 index 00000000..7f0932ba --- /dev/null +++ b/ansible_collections/community/sops/codecov.yml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +fixes: + - "ansible_collections/community/sops/::" diff --git a/ansible_collections/community/sops/docs/docsite/extra-docs.yml b/ansible_collections/community/sops/docs/docsite/extra-docs.yml new file mode 100644 index 00000000..3224ebdc --- /dev/null +++ b/ansible_collections/community/sops/docs/docsite/extra-docs.yml @@ -0,0 +1,9 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +sections: + - title: Scenario Guide + toctree: + - guide diff --git a/ansible_collections/community/sops/docs/docsite/links.yml b/ansible_collections/community/sops/docs/docsite/links.yml new file mode 100644 index 00000000..72753cd4 --- /dev/null +++ b/ansible_collections/community/sops/docs/docsite/links.yml @@ -0,0 +1,27 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +edit_on_github: + repository: ansible-collections/community.sops + branch: main + path_prefix: '' + +extra_links: + - description: Submit a bug report + url: https://github.com/ansible-collections/community.sops/issues/new?assignees=&labels=&template=bug_report.md + - description: Request a feature + url: https://github.com/ansible-collections/community.sops/issues/new?assignees=&labels=&template=feature_request.md + +communication: + matrix_rooms: + - topic: General usage and support questions + room: '#users:ansible.im' + irc_channels: + - topic: General usage and support questions + network: Libera + channel: '#ansible' + mailing_lists: + - topic: Ansible Project List + url: https://groups.google.com/g/ansible-project diff --git a/ansible_collections/community/sops/docs/docsite/rst/guide.rst b/ansible_collections/community/sops/docs/docsite/rst/guide.rst new file mode 100644 index 00000000..bc071a19 --- /dev/null +++ b/ansible_collections/community/sops/docs/docsite/rst/guide.rst @@ -0,0 +1,495 @@ +.. + Copyright (c) Ansible Project + GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) + SPDX-License-Identifier: GPL-3.0-or-later + +.. _ansible_collections.community.sops.docsite.guide: + +Protecting Ansible secrets with Mozilla SOPS +============================================ + +`Mozilla SOPS <https://github.com/mozilla/sops>`_ allows to encrypt and decrypt files using various key sources (GPG, AWS KMS, GCP KMS, ...). For structured data, such as YAML, JSON, INI and ENV files, it will encrypt values, but not mapping keys. For YAML files, it also encrypts comments. This makes it a great tool for encrypting credentials with Ansible: you can easily see which files contain which variable, but the variables themselves are encrypted. + +The ability to utilize various keysources makes it easier to use in complex environments than `Ansible Vault <https://docs.ansible.com/ansible/latest/user_guide/vault.html>`_. + +.. contents:: + :local: + :depth: 1 + +Installing sops +--------------- + +You can find binaries and packages `on the project's release page <https://github.com/mozilla/sops/releases>`_. Depending on your operating system, you might also be able to install it with your system's package manager. + +This collection provides a `role community.sops.install <ansible_collections.community.sops.install_role>`_ which allows to install sops and `GNU Privacy Guard (GPG) <https://en.wikipedia.org/wiki/GNU_Privacy_Guard>`__. The role allows to install sops from the system's package manager or from GitHub. Both sops and GPG can be installed on the remote hosts or the Ansible controller. + +.. code-block:: yaml + + - name: Playbook to install sops + hosts: all + tasks: + # To use the sops_encrypt module on a remote host, you need to install sops on it: + - name: Install sops on remote hosts + ansible.builtin.include_role: + name: community.sops.install + vars: + sops_version: 2.7.0 # per default installs the latest version + + # To use the lookup plugin, filter plugin, vars plugin, or the load_vars action, + # you need sops installed on localhost: + - name: Install sops on localhost + ansible.builtin.include_role: + name: community.sops.install + vars: + sops_install_on_localhost: true + +When using ansible-core 2.11 or later, you can also use two convenience playbooks: + +.. code-block:: bash + + # Install sops on Ansible controller + $ ansible-playbook community.sops.install_localhost + + # Install sops on remote servers + $ ansible-playbook community.sops.install --inventory /path/to/inventory + +Installing community.sops in an Execution Environment +----------------------------------------------------- + +When building an execution environment containing community.sops, please note that by default sops is not automatically installed. This is due to a limitation of the dependency specification system for execution environments. If you are building an execution environment that contains community.sops, you should make sure that sops is installed in it. + +The simplest way of ensuring this is to use the ``community.sops.install_localhost`` playbook. When defining an execution environment, you can add a ``RUN`` additional build step to your ``execution-environment.yml``: + +.. code-block:: yaml + + --- + version: 1 + dependencies: + galaxy: requirements.yml + additional_build_steps: + append: + # Ensure that sops is installed in the EE, assuming the EE is for ansible-core 2.11 or newer + - RUN ansible-playbook -v community.sops.install_localhost + +Note that this only works if the execution environment is built with ansible-core 2.11 or newer. When using an execution environment with Ansible 2.9, you have to use the ``community.sops.install`` role manually. Also note that you need to make sure that Ansible 2.9 uses the correct Python interpreter to be able to install system packages with; in the below example we are assuming a RHEL/CentOS based execution environment base image: + +.. code-block:: yaml + + --- + version: 1 + dependencies: + galaxy: requirements.yml + additional_build_steps: + append: + # Special step needed for Ansible 2.9 based EEs + - >- + RUN ansible localhost -m include_role -a name=community.sops.install + -e sops_install_on_localhost=true + -e ansible_python_interpreter=/usr/libexec/platform-python + +Once this step has been taken care of, you can use all plugins and modules (on ``localhost``) from community.sops in the execution environment. + +Setting up sops +--------------- + +From now on this guide assumes that you have installed Mozilla SOPS. + +For simplicity, you can work with GPG keys. If you do not have one, or do not want to use yours, you can run ``gpg --quick-generate-key me@example.com`` to create a GPG key for the user ID ``me@example.com``. You will need its 40 hex-digit key ID that is printed at the end. The first step is to create a ``.sops.yaml`` file in the directory tree you are working in: + +.. code-block:: yaml + + creation_rules: + - pgp: 'FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4' + +Here, ``FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4`` is the 40 hex-digit key ID. With this file you can create a sops encrypted file by running the following in the directory where ``.sops.yaml`` was placed, or a subdirectory of it: + +.. code-block:: bash + + $ sops test.sops.yaml + +This will open an editor window with an example YAML file. Put the following content in: + +.. code-block:: yaml + + # This is a comment + hello: world + foo: + - bar + - baz + +After closing the editor, sops will create ``test.sops.yaml`` with the encrypted contents: + +.. code-block:: yaml + + #ENC[AES256_GCM,data:r6Ok05DzzHBO4tonlz2t49CF,iv:Y0P39iXwaGYU9NG5oRC3NuaGVL40uruSze0CxbDTpTk=,tag:EzoG+X+BJAHbxE0asSyGlQ==,type:comment] + hello: ENC[AES256_GCM,data:onBZqWk=,iv:bwj4bwaeh3vpVDYqY2AnYo1thF955i5vbFpCC1DwJtM=,tag:4qbVzuHTaPrXm64r2Rqz1Q==,type:str] + foo: + - ENC[AES256_GCM,data:UsY8,iv:USv71rKfvbTF+3a5T2WO56wGVu609/0uigqkO0pa6U4=,tag:s8NdqLp+8OOQg4xDfE78oA==,type:str] + - ENC[AES256_GCM,data:Dhmo,iv:qWs5gN2SCXYq0EfGelZhODsdViKB9w2taQMhsqy0D2g=,tag:I+ZFvuxnsvQmywqz+a/M9w==,type:str] + sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: [] + lastmodified: "2021-06-15T19:36:34Z" + mac: ENC[AES256_GCM,data:HAvLeOvt7xWI7B5TCeDEsL6sOSzGGeTbgBSJaZkwadmoAm3Ny4IZPF8JAbFaPPLmN8FJVAt4D61aIWa6Xwi3xMj1g6DmxFfgK6JFJqWqW122UlMhqZ/WuMWFV6yVxpTLDXgemndgGDJqUTUi14FMh/MzPDg4f6kFP64kA9fpLrY=,iv:LdhswnMymZG8J9na/jnF3WYnX0DvzvoBlvjUCu4nI6c=,tag:Qt4d7L3FXsgfmg9iOs8P4A==,type:str] + pgp: + - created_at: "2021-06-15T19:36:01Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAT8OAKnWLBQRG3kT5lZCmyoPzK6RwF0zRkwCzJkLNl6xg + nQjUjpD03ZD4FtiRidspXEj7NvCLDghJ0UETtDjmrwsTeJ5YAK/JxouWmoNhVVdF + p0qOlj/THXIV+ypVaqrisZGZiTqeWjUNFuayknvjm3XduOOPZA1MIJ14pQxcgca4 + NWmKwPwXTWEy3RJ0ZsnjjjYvKHjHyvbHdbDgARu8R1jEgdNPKPBRVpEY6RNeafXI + gFBVRfrhPKD6HmnmNvjHwUc/K+wOa1ciIYVrT4mPXoyBsFkyV0egh/QRf0JO8+X7 + Ut/jEtCrl9BXJCNYGmC5EU3PPiFlAu1MRxlCiPNWltLmASn2w62wMpgih6f+OpI/ + zyEOdz0qx80LEfhv3+jBbDfBwz4GqpAHUr0fCXDzeDiKfzlU6isagoIAhJfwX6oG + NeQ47ktk1XhPmgIwxxuvonG14iQoU2cA + =GoXQ + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.7.1 + +The first line contains the encrypted content. The second line contains the unencrypted key of ``hello: world``, and the encrypted string value ``world``. The next few lines contain the unencrypted key ``foo`` with the encrypted list elements. + +At the end, the ``sops`` section contains metadata, which includes the private key needed to decrypt the file encrypted with the public key of the GPG key ID ``FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4``. If you had multiple GPG keys configured, or also other key sources, you can also find the file secret key encrypted with these keys here. + +Working with encrypted files +---------------------------- + +You can decrypt sops-encrypted files with the :ref:`community.sops.sops lookup plugin <ansible_collections.community.sops.sops_lookup>`, and dynamically encrypt data with the :ref:`community.sops.sops_encrypt module <ansible_collections.community.sops.sops_encrypt_module>`. Being able to encrypt is useful when you create or update secrets in your Ansible playbooks. + +Assume that you have an encrypted private key ``keys/private_key.pem.sops``, which was in PEM format before being encrypted by sops: + +.. code-block:: bash + + $ openssl genrsa -out keys/private_key.pem 2048 + $ sops --encrypt keys/private_key.pem > keys/private_key.pem.sops + $ wipe keys/private_key.pem + +To use it in a playbook, for example to pass it to the :ref:`community.crypto.openssl_csr module <ansible_collections.community.crypto.openssl_csr_module>` to create a certificate signing request (CSR), you can use the :ref:`community.sops.sops lookup plugin <ansible_collections.community.sops.sops_lookup>` to load it: + +.. code-block:: yaml+jinja + + --- + - name: Load sops-encrypted private key + hosts: localhost + gather_facts: false + tasks: + - name: Create CSR with encrypted private key + community.crypto.openssl_csr: + # The private key is provided with sops: + privatekey_content: "{{ lookup('community.sops.sops', 'keys/private_key.pem.sops') }}" + # Store the CSR on disk unencrypted: + path: ansible.com.csr + # This is going to be a CSR for ansible.com and www.ansible.com + subject_alt_name: + - DNS:ansible.com + - DNS:www.ansible.com + use_common_name_for_san: false + +This results in the following output: + +.. code-block:: ansible-output + + PLAY [Load sops-encrypted private key] *************************************************************************** + + TASK [Create CSR with encrypted private key] ********************************************************************* + ok: [localhost] + + PLAY RECAP ******************************************************************************************************* + localhost : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + +Afterwards, you will have a CSR ``ansible.com.csr`` for the encrypted private key ``keys/private_key.pem.sops``. + +If you want to use Ansible to generate (or update) the encrypted private key, you can use the :ref:`community.crypto.openssl_privatekey_pipe module <ansible_collections.community.crypto.openssl_privatekey_pipe_module>` to generate (or update) the private key, and use the :ref:`community.sops.sops_encrypt module <ansible_collections.community.sops.sops_encrypt_module>` to write it to disk in encrypted form: + +.. code-block:: yaml+jinja + + --- + - name: Create sops-encrypted private key + hosts: localhost + gather_facts: false + tasks: + - block: + - name: Create private key + community.crypto.openssl_privatekey_pipe: + size: 2048 + no_log: true # Always use this with openssl_privatekey_pipe! + register: private_key + + - name: Write encrypted key to disk + community.sops.sops_encrypt: + path: keys/private_key.pem.sops + content_text: "{{ private_key.privatekey }}" + + always: + - name: Wipe private key from Ansible's facts + # This is particularly important if the playbook doesn't end here! + set_fact: + private_key: '' + +This playbook creates a new key on every run. If you want the private key creation to be idempotent, you need to do a little more work: + +.. code-block:: yaml+jinja + + --- + - name: Create sops-encrypted private key + hosts: localhost + gather_facts: false + tasks: + - block: + - name: Create private key + community.crypto.openssl_privatekey_pipe: + size: 2048 + content: >- + {{ lookup( + 'community.sops.sops', + 'keys/private_key.pem.sops', + empty_on_not_exist=true + ) }} + no_log: true # Always use this with openssl_privatekey_pipe! + register: private_key + + - name: Write encrypted key to disk + community.sops.sops_encrypt: + path: keys/private_key.pem.sops + content_text: "{{ private_key.privatekey }}" + when: private_key is changed + + always: + - name: Wipe private key from Ansible's facts + # This is particularly important if the playbook doesn't end here! + set_fact: + private_key: '' + +The ``empty_on_not_exist=true`` flag is needed to avoid the lookup to fail when the key does not yet exist. When this playbook is run twice, the output will be: + +.. code-block:: ansible-output + + PLAY [Create sops-encrypted private key] ************************************************************************* + + TASK [Create private key] **************************************************************************************** + ok: [localhost] + + TASK [Write encrypted key to disk] ******************************************************************************* + skipping: [localhost] + + TASK [Wipe private key from Ansible's facts] ********************************************************************* + ok: [localhost] + + PLAY RECAP ******************************************************************************************************* + localhost : ok=2 changed=0 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 + +Working with encrypted data from other sources +---------------------------------------------- + +You can use the :ref:`community.sops.decrypt Jinja2 filter <ansible_collections.community.sops.decrypt_filter>` to decrypt arbitrary data. This can be data read earlier from a file, returned from an action, or obtained through some other means. + +For example, assume that you want to decrypt a file retrieved from a HTTPS server with the `ansible.builtin.uri module <ansible_collections.ansible.builtin.uri_module>`_. To use the :ref:`community.sops.sops lookup <ansible_collections.community.sops.sops_lookup>`, you have to write it to a file first. With the filter, you can directly decrypt it: + +.. code-block:: yaml+jinja + + --- + - name: Decrypt file fetched from URL + hosts: localhost + gather_facts: false + tasks: + - name: Fetch file from URL + ansible.builtin.uri: + url: https://raw.githubusercontent.com/mozilla/sops/master/functional-tests/res/comments.enc.yaml + return_content: true + register: encrypted_content + + - name: Show encrypted data + debug: + msg: "{{ encrypted_content.content | ansible.builtin.from_yaml }}" + + - name: Decrypt data and decode decrypted YAML + set_fact: + decrypted_data: "{{ encrypted_content.content | community.sops.decrypt | ansible.builtin.from_yaml }}" + + - name: Show decrypted data + debug: + msg: "{{ decrypted_data }}" + +The output will be: + +.. code-block:: ansible-output + + PLAY [Decrypt file fetched from URL] ***************************************************************************** + + TASK [Fetch file from URL] *************************************************************************************** + ok: [localhost] + + TASK [Show encrypted data] *************************************************************************************** + ok: [localhost] => { + "msg": { + "dolor": "ENC[AES256_GCM,data:IgvT,iv:wtPNYbDTARFE810PH6ldOLzCDcAjkB/dzPsZjpgHcko=,tag:zwE8P+AwO1hrHkgF6pTbZw==,type:str]", + "lorem": "ENC[AES256_GCM,data:PhmSdTs=,iv:J5ugEWq6RfyNx+5zDXvcTdoQ18YYZkqesDED7LNzou4=,tag:0Qrom6J6aUnZMZzGz5XCxw==,type:str]", + "sops": { + "age": [], + "azure_kv": [], + "gcp_kms": [], + "hc_vault": [], + "kms": [], + "lastmodified": "2020-10-07T15:49:13Z", + "mac": "ENC[AES256_GCM,data:2dhyKdHYSynjXPwYrn9356wA7vRKw+T5qwBenI2vZrgthpQBOCQG4M6f7eeH3VLTxB4mN4CAchb25dsNRoGr6A38VruaSSAhPco3Rh4AlvKSvXuhgRnzZvNxE/bnHX1D4K5cdTb4FsJg/Ue1l7UcWrlrv1s3H3SwLHP/nf+suD0=,iv:6xBYURjjaQzlUOKOrs2NWOChiNFZVAGPJZQZ59MwX3o=,tag:uXD5VYme+c8eHcCc5TD2YA==,type:str]", + "pgp": [ + { + "created_at": "2019-08-29T21:52:32Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhQEMAyUpShfNkFB/AQgAlvpTj0NYqF4mQyIeM7wX2SHLb4U07/flpqDpp2W/30Pz\nAHA7sYrgP0l8BrjT2kwtgCN0cdfoIHJudezrNjANp2P5TbP2b9kYYNxpehzB9PFj\nFixnCS7Zp8WIt1yXr1TX+ANZoXLopVcRbMaQ5OdH7CN1pNQtMR+R3FR3X/IqKxiU\nDo1YLaooRJICUC8LJw2Tb4K+lYnTSqd/HalLGym++ivFvdDB1Ya1GhT1FswXidXK\nIRjsOVbxV0q5VeNOR0zxsheOvuHyCje16c7NXJtATJVWtTFABJB8u7CY5HhZSgq+\nrXJHyLHqVLzJ8E4WqHQkMNUlVcrqAz7glZ6xbAhfI9JeAYk5SuBOQOQ4yvASqH4K\nb0N3+/abluBY7YPqKuRZBiEtmcYlZ+zIHuOTP1rD/7L5VY8CwE5U8SFlEqwM7nQJ\n6/vtl6qngOFjwt34WrhZzUfLPB/wRV/m1Qv2kr0RNA==\n=Ykiw\n-----END PGP MESSAGE-----\n", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } + } + } + + TASK [Decrypt data] ********************************************************************************************** + ok: [localhost] + + TASK [Show decrypted data] *************************************************************************************** + ok: [localhost] => { + "msg": { + "dolor": "sit", + "lorem": "ipsum" + } + } + + PLAY RECAP ******************************************************************************************************* + localhost : ok=4 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + +Please note that if you put a Jinja2 expression in a variable, it will be evaluated **every time it is used**. Decrypting data takes a certain amount of time. If you need to use an expression multiple times, it is better to store its evaluated form as a fact with `ansible.bulitin.set_fact <ansible_collections.ansible.builtin.set_fact_module>`_ first. This can be important if decrypted data should be passed to a role + +.. code-block:: yaml+jinja + + --- + - name: Decrypt file fetched from URL + hosts: localhost + gather_facts: false + tasks: + - name: Fetch file from URL + ansible.builtin.uri: + url: https://raw.githubusercontent.com/mozilla/sops/master/functional-tests/res/comments.enc.yaml + return_content: true + register: encrypted_content + + # BAD: every time the role uses decrypted_data, the data will be decrypted! + + - name: Call role with decrypted data + include_role: + name: myrole + vars: + role_parameter: "{{ encrypted_content.content | community.sops.decrypt | ansible.builtin.from_yaml }}" + + # GOOD: the data is decrypted once before the role is called, + + - name: Store decrypted data as fact + set_fact: + decrypted_data: "{{ encrypted_content.content | community.sops.decrypt | ansible.builtin.from_yaml }}" + + - name: Call role with decrypted data + include_role: + name: myrole + vars: + role_parameter: "{{ decrypted_data }}" + +Working with encrypted variables +-------------------------------- + +You can load encrypted variables similarly to the :ref:`ansible.builtin.host_group_vars vars plugin <ansible_collections.ansible.builtin.host_group_vars_vars>` with the :ref:`community.sops.sops vars plugin <ansible_collections.community.sops.sops_vars>`. If you need to load variables dynamically similarly to the :ref:`ansible.builtin.include_vars action <ansible_collections.ansible.builtin.include_vars_module>`, you can use the :ref:`community.sops.load_vars action <ansible_collections.community.sops.load_vars_module>`. + +To use the vars plugin, you need to enable it in your Ansible config file (``ansible.cfg``): + +.. code-block:: ini + + [defaults] + vars_plugins_enabled = host_group_vars,community.sops.sops + +See :ref:`VARIABLE_PLUGINS_ENABLED <VARIABLE_PLUGINS_ENABLED>` for more details on enabling vars plugins. Then you can put files with the following extensions into the ``group_vars`` and ``host_vars`` directories: + +- ``.sops.yaml`` +- ``.sops.yml`` +- ``.sops.json`` + +The vars plugin will decrypt them and you can use their unencrypted content transparently. + +If you need to dynamically load encrypted variables, similar to the built-in :ref:`ansible.builtin.include_vars action <ansible_collections.ansible.builtin.include_vars_module>`, you can use the :ref:`community.sops.load_vars action <ansible_collections.community.sops.load_vars_module>` action. Please note that it is not a perfect replacement, since the built-in action relies on some hard-coded special casing in ansible-core which allows it to load the variables actually as variables (more precisely: as "unsafe" Jinja2 expressions which are automatically evaluated when used). Other action plugins, such as ``community.sops.load_vars``, cannot do that and have to load the variables as facts instead. + +This is mostly relevant if you use Jinja2 expressions in the encrypted variable file. When ``include_vars`` loads a variable file with expressions, these expressions will only be evaluated when the variable that defines them needs to be evaluated (lazy evaluation). Since ``community.sops.load_vars`` returns facts, it has to directly evaluate expressions at load time. (For this, set its ``expressions`` option to ``evaluate-on-load``.) This is mostly relevant if you want to refer to other variables from the same file: this will not work, since Ansible does not know the other variable yet while evaluating the first. It will only "know" them as facts after all have been evaluated and the action finishes. + +For the following example, assume you have the encrypted file ``keys/credentials.sops.yml`` which decrypts to: + +.. code-block:: yaml + + encrypted_password: foo + expression: "{{ inventory_hostname }}" + +Consider the following playbook: + +.. code-block:: yaml+jinja + + --- + - name: Create sops-encrypted private key + hosts: localhost + gather_facts: false + tasks: + - name: Load encrypted credentials + community.sops.load_vars: + file: keys/credentials.sops.yml + expressions: ignore # explicitly do not evaluate expressions + # on load (this is the default) + + - name: Show password + debug: + msg: "The password is {{ encrypted_password }}" + + - name: Show expression + debug: + msg: "The expression is {{ expression }}" + +Running it produces: + +.. code-block:: ansible-output + + PLAY [Create sops-encrypted private key] ************************************************************************* + + TASK [Load encrypted credentials] ******************************************************************************** + ok: [localhost] + + TASK [Show password] ********************************************************************************************* + ok: [localhost] => { + "msg": "The password is foo" + } + + TASK [Show expression] ******************************************************************************************* + ok: [localhost] => { + "msg": "The expression is {{ inventory_hostname }}" + } + + PLAY RECAP ******************************************************************************************************* + localhost : ok=3 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + +If you change the variable loading task to: + +.. code-block:: yaml+jinja + + - name: Load encrypted credentials + community.sops.load_vars: + file: keys/credentials.sops.yml + expressions: evaluate-on-load + +The last task will now show the evaluated expression: + +.. code-block:: ansible-output + + TASK [Show expression] ******************************************************************************************* + ok: [localhost] => { + "msg": "The expression is localhost" + } diff --git a/ansible_collections/community/sops/meta/ee-bindep.txt b/ansible_collections/community/sops/meta/ee-bindep.txt new file mode 100644 index 00000000..9ca64d74 --- /dev/null +++ b/ansible_collections/community/sops/meta/ee-bindep.txt @@ -0,0 +1,6 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +gnupg [platform:dpkg] +gnupg2 [platform:rpm] diff --git a/ansible_collections/community/sops/meta/execution-environment.yml b/ansible_collections/community/sops/meta/execution-environment.yml new file mode 100644 index 00000000..00cd8f37 --- /dev/null +++ b/ansible_collections/community/sops/meta/execution-environment.yml @@ -0,0 +1,8 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +version: 1 +dependencies: + system: meta/ee-bindep.txt diff --git a/ansible_collections/community/sops/meta/runtime.yml b/ansible_collections/community/sops/meta/runtime.yml new file mode 100644 index 00000000..d642fb89 --- /dev/null +++ b/ansible_collections/community/sops/meta/runtime.yml @@ -0,0 +1,6 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +requires_ansible: '>=2.9.10' diff --git a/ansible_collections/community/sops/playbooks/install.yml b/ansible_collections/community/sops/playbooks/install.yml new file mode 100644 index 00000000..faff3b99 --- /dev/null +++ b/ansible_collections/community/sops/playbooks/install.yml @@ -0,0 +1,12 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Install sops + gather_facts: true + hosts: all + tasks: + - name: Install sops on remote hosts + ansible.builtin.include_role: + name: community.sops.install diff --git a/ansible_collections/community/sops/playbooks/install_localhost.yml b/ansible_collections/community/sops/playbooks/install_localhost.yml new file mode 100644 index 00000000..55f65152 --- /dev/null +++ b/ansible_collections/community/sops/playbooks/install_localhost.yml @@ -0,0 +1,14 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Install sops on localhost + gather_facts: false + hosts: localhost + tasks: + - name: Install sops on localhost + ansible.builtin.include_role: + name: community.sops.install + vars: + sops_install_on_localhost: true diff --git a/ansible_collections/community/sops/plugins/action/load_vars.py b/ansible_collections/community/sops/plugins/action/load_vars.py new file mode 100644 index 00000000..0d67732f --- /dev/null +++ b/ansible_collections/community/sops/plugins/action/load_vars.py @@ -0,0 +1,83 @@ +# Copyright (c) 2020, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +from ansible.module_utils.common._collections_compat import Sequence, Mapping +from ansible.module_utils.six import iteritems, string_types +from ansible.module_utils.common.text.converters import to_native +from ansible.utils.display import Display + +from ansible_collections.community.sops.plugins.module_utils.sops import Sops, get_sops_argument_spec + +from ansible_collections.community.sops.plugins.plugin_utils.action_module import ActionModuleBase, ArgumentSpec + +display = Display() + + +class ActionModule(ActionModuleBase): + + def _load(self, filename, module): + def get_option_value(argument_name): + return module.params.get(argument_name) + + output = Sops.decrypt(filename, display=display, get_option_value=get_option_value) + + data = self._loader.load(output, file_name=filename, show_content=False) + if not data: + data = dict() + if not isinstance(data, dict): + # Should not happen with sops-encrypted files + raise Exception('{0} must be stored as a dictionary/hash'.format(to_native(filename))) + return data + + def _evaluate(self, value): + if isinstance(value, string_types): + # must come *before* Sequence, as strings are also instances of Sequence + return self._templar.template(value) + if isinstance(value, Sequence): + return [self._evaluate(v) for v in value] + if isinstance(value, Mapping): + return dict((k, self._evaluate(v)) for k, v in iteritems(value)) + return value + + @staticmethod + def setup_module(): + argument_spec = ArgumentSpec( + argument_spec=dict( + file=dict(type='path', required=True), + name=dict(type='str'), + expressions=dict(type='str', default='ignore', choices=['ignore', 'evaluate-on-load']), + ), + ) + argument_spec.argument_spec.update(get_sops_argument_spec()) + return argument_spec, {} + + def run_module(self, module): + data = dict() + files = [] + try: + filename = self._find_needle('vars', module.params['file']) + data.update(self._load(filename, module)) + files.append(filename) + except Exception as e: + module.fail_json(msg=to_native(e)) + + name = module.params['name'] + if name is None: + value = data + else: + value = dict() + value[name] = data + + expressions = module.params['expressions'] + if expressions == 'evaluate-on-load': + value = self._evaluate(value) + + module.exit_json( + ansible_included_var_files=files, + ansible_facts=value, + _ansible_no_log=True, + ) diff --git a/ansible_collections/community/sops/plugins/doc_fragments/attributes.py b/ansible_collections/community/sops/plugins/doc_fragments/attributes.py new file mode 100644 index 00000000..72298504 --- /dev/null +++ b/ansible_collections/community/sops/plugins/doc_fragments/attributes.py @@ -0,0 +1,74 @@ +# -*- coding: utf-8 -*- + +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + + +class ModuleDocFragment(object): + + # Standard documentation fragment + DOCUMENTATION = r''' +options: {} +attributes: + check_mode: + description: Can run in C(check_mode) and return changed status prediction without modifying target. + diff_mode: + description: Will return details on what has changed (or possibly needs changing in C(check_mode)), when in diff mode. +''' + + # Should be used together with the standard fragment + INFO_MODULE = r''' +options: {} +attributes: + check_mode: + support: full + details: + - This action does not modify state. + diff_mode: + support: N/A + details: + - This action does not modify state. +''' + + FACTS = r''' +options: {} +attributes: + facts: + description: Action returns an C(ansible_facts) dictionary that will update existing host facts. +''' + + # Should be used together with the standard fragment and the FACTS fragment + FACTS_MODULE = r''' +options: {} +attributes: + check_mode: + support: full + details: + - This action does not modify state. + diff_mode: + support: N/A + details: + - This action does not modify state. + facts: + support: full +''' + + FILES = r''' +options: {} +attributes: + safe_file_operations: + description: Uses Ansible's strict file operation functions to ensure proper permissions and avoid data corruption. +''' + + FLOW = r''' +options: {} +attributes: + action: + description: Indicates this has a corresponding action plugin so some parts of the options can be executed on the controller. + async: + description: Supports being used with the C(async) keyword. +''' diff --git a/ansible_collections/community/sops/plugins/doc_fragments/sops.py b/ansible_collections/community/sops/plugins/doc_fragments/sops.py new file mode 100644 index 00000000..ffbfe2d5 --- /dev/null +++ b/ansible_collections/community/sops/plugins/doc_fragments/sops.py @@ -0,0 +1,300 @@ +# -*- coding: utf-8 -*- + +# Copyright (c) 2020 Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + + +class ModuleDocFragment(object): + DOCUMENTATION = r''' +options: + sops_binary: + description: + - Path to the sops binary. + - By default uses C(sops). + type: path + version_added: 1.0.0 + age_key: + description: + - One or more age private keys that can be used to decrypt encrypted files. + - Will be set as the C(SOPS_AGE_KEY) environment variable when calling sops. + type: str + version_added: 1.4.0 + age_keyfile: + description: + - The file containing the age private keys that sops can use to decrypt + encrypted files. + - Will be set as the C(SOPS_AGE_KEY_FILE) environment variable when calling sops. + - By default, sops looks for C(sops/age/keys.txt) inside your user configuration + directory. + type: path + version_added: 1.4.0 + aws_profile: + description: + - The AWS profile to use for requests to AWS. + - This corresponds to the sops C(--aws-profile) option. + type: str + version_added: 1.0.0 + aws_access_key_id: + description: + - The AWS access key ID to use for requests to AWS. + - Sets the environment variable C(AWS_ACCESS_KEY_ID) for the sops call. + type: str + version_added: 1.0.0 + aws_secret_access_key: + description: + - The AWS secret access key to use for requests to AWS. + - Sets the environment variable C(AWS_SECRET_ACCESS_KEY) for the sops call. + type: str + version_added: 1.0.0 + aws_session_token: + description: + - The AWS session token to use for requests to AWS. + - Sets the environment variable C(AWS_SESSION_TOKEN) for the sops call. + type: str + version_added: 1.0.0 + config_path: + description: + - Path to the sops configuration file. + - If not set, sops will recursively search for the config file starting at + the file that is encrypted or decrypted. + - This corresponds to the sops C(--config) option. + type: path + version_added: 1.0.0 + enable_local_keyservice: + description: + - Tell sops to use local key service. + - This corresponds to the sops C(--enable-local-keyservice) option. + type: bool + default: false + version_added: 1.0.0 + keyservice: + description: + - Specify key services to use next to the local one. + - A key service must be specified in the form C(protocol://address), for + example C(tcp://myserver.com:5000). + - This corresponds to the sops C(--keyservice) option. + type: list + elements: str + version_added: 1.0.0 +''' + + ANSIBLE_VARIABLES = r''' +options: + sops_binary: + vars: + - name: sops_binary + age_key: + vars: + - name: sops_age_key + age_keyfile: + vars: + - name: sops_age_keyfile + aws_profile: + vars: + - name: sops_aws_profile + aws_access_key_id: + vars: + - name: sops_aws_access_key_id + aws_secret_access_key: + vars: + - name: sops_aws_secret_access_key + aws_session_token: + vars: + - name: sops_session_token + - name: sops_aws_session_token + version_added: 1.2.0 + config_path: + vars: + - name: sops_config_path + enable_local_keyservice: + vars: + - name: sops_enable_local_keyservice + keyservice: + vars: + - name: sops_keyservice +''' + + ANSIBLE_ENV = r''' +options: + sops_binary: + env: + - name: ANSIBLE_SOPS_BINARY + version_added: 1.2.0 + age_key: + env: + - name: ANSIBLE_SOPS_AGE_KEY + age_keyfile: + env: + - name: ANSIBLE_SOPS_AGE_KEYFILE + aws_profile: + env: + - name: ANSIBLE_SOPS_AWS_PROFILE + version_added: 1.2.0 + aws_access_key_id: + env: + - name: ANSIBLE_SOPS_AWS_ACCESS_KEY_ID + version_added: 1.2.0 + aws_secret_access_key: + env: + - name: ANSIBLE_SOPS_AWS_SECRET_ACCESS_KEY + version_added: 1.2.0 + aws_session_token: + env: + - name: ANSIBLE_SOPS_AWS_SESSION_TOKEN + version_added: 1.2.0 + config_path: + env: + - name: ANSIBLE_SOPS_CONFIG_PATH + version_added: 1.2.0 + enable_local_keyservice: + env: + - name: ANSIBLE_SOPS_ENABLE_LOCAL_KEYSERVICE + version_added: 1.2.0 + keyservice: + env: + - name: ANSIBLE_SOPS_KEYSERVICE + version_added: 1.2.0 +''' + + ANSIBLE_INI = r''' +options: + sops_binary: + ini: + - section: community.sops + key: binary + version_added: 1.2.0 + # We do not provide an INI key for + # age_key + # to make sure that secrets cannot be provided in ansible.ini. Use environment variables or another mechanism for that. + age_keyfile: + ini: + - section: community.sops + key: age_keyfile + aws_profile: + ini: + - section: community.sops + key: aws_profile + version_added: 1.2.0 + aws_access_key_id: + ini: + - section: community.sops + key: aws_access_key_id + version_added: 1.2.0 + # We do not provide an INI key for + # aws_secret_access_key + # to make sure that secrets cannot be provided in ansible.ini. Use environment variables or another mechanism for that. + aws_session_token: + ini: + - section: community.sops + key: aws_session_token + version_added: 1.2.0 + config_path: + ini: + - section: community.sops + key: config_path + version_added: 1.2.0 + enable_local_keyservice: + ini: + - section: community.sops + key: enable_local_keyservice + version_added: 1.2.0 + keyservice: + ini: + - section: community.sops + key: keyservice + version_added: 1.2.0 +''' + + ENCRYPT_SPECIFIC = r''' +options: + age: + description: + - Age fingerprints to use. + - This corresponds to the sops C(--age) option. + type: list + elements: str + version_added: 1.4.0 + kms: + description: + - List of KMS ARNs to use. + - This corresponds to the sops C(--kms) option. + type: list + elements: str + version_added: 1.0.0 + gcp_kms: + description: + - GCP KMS resource IDs to use. + - This corresponds to the sops C(--gcp-kms) option. + type: list + elements: str + version_added: 1.0.0 + azure_kv: + description: + - Azure Key Vault URLs to use. + - This corresponds to the sops C(--azure-kv) option. + type: list + elements: str + version_added: 1.0.0 + hc_vault_transit: + description: + - HashiCorp Vault key URIs to use. + - For example, C(https://vault.example.org:8200/v1/transit/keys/dev). + - This corresponds to the sops C(--hc-vault-transit) option. + type: list + elements: str + version_added: 1.0.0 + pgp: + description: + - PGP fingerprints to use. + - This corresponds to the sops C(--pgp) option. + type: list + elements: str + version_added: 1.0.0 + unencrypted_suffix: + description: + - Override the unencrypted key suffix. + - This corresponds to the sops C(--unencrypted-suffix) option. + type: str + version_added: 1.0.0 + encrypted_suffix: + description: + - Override the encrypted key suffix. + - When set to an empty string, all keys will be encrypted that are not explicitly + marked by I(unencrypted_suffix). + - This corresponds to the sops C(--encrypted-suffix) option. + type: str + version_added: 1.0.0 + unencrypted_regex: + description: + - Set the unencrypted key suffix. + - When specified, only keys matching the regular expression will be left unencrypted. + - This corresponds to the sops C(--unencrypted-regex) option. + type: str + version_added: 1.0.0 + encrypted_regex: + description: + - Set the encrypted key suffix. + - When specified, only keys matching the regular expression will be encrypted. + - This corresponds to the sops C(--encrypted-regex) option. + type: str + version_added: 1.0.0 + encryption_context: + description: + - List of KMS encryption context pairs of format C(key:value). + - This corresponds to the sops C(--encryption-context) option. + type: list + elements: str + version_added: 1.0.0 + shamir_secret_sharing_threshold: + description: + - The number of distinct keys required to retrieve the data key with + L(Shamir's Secret Sharing, https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing). + - If not set here and in the sops config file, will default to C(0). + - This corresponds to the sops C(--shamir-secret-sharing-threshold) option. + type: int + version_added: 1.0.0 +''' diff --git a/ansible_collections/community/sops/plugins/filter/_latest_version.py b/ansible_collections/community/sops/plugins/filter/_latest_version.py new file mode 100644 index 00000000..a4de0f17 --- /dev/null +++ b/ansible_collections/community/sops/plugins/filter/_latest_version.py @@ -0,0 +1,75 @@ +# -*- coding: utf-8 -*- + +# Copyright (c) 2022, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import absolute_import, division, print_function +__metaclass__ = type + +DOCUMENTATION = ''' +name: _latest_version +short_description: "[INTERNAL] Get latest version from a list of versions" +version_added: 1.4.0 +author: + - Felix Fontein (@felixfontein) +description: + - B(This is an internal tool and must only be used from roles in this collection!) + If you use it from outside this collection, be warned that its behavior can change + and it can be removed at any time, even in bugfix releases! + - Given a list of version numbers, returns the largest of them. +options: + _input: + description: + - A list of strings. Every string must be a version number. + type: list + elements: string + required: true +''' + +EXAMPLES = ''' +- name: Print latest version + ansible.builtin.debug: + msg: "{{ versions | community.sops._latest_version }}" + vars: + versions: + - 1.0.0 + - 1.0.0rc1 + - 1.1.0 +''' + +RETURN = ''' +_value: + description: + - The latest version from the input. + type: string +''' + +from ansible.module_utils.six import raise_from + +try: + from ansible.module_utils.compat.version import LooseVersion +except ImportError: + try: + from distutils.version import LooseVersion + except ImportError as exc: + msg = ( + 'To use this plugin or module with ansible-core 2.11, ansible-base 2.10,' + ' or Ansible 2.9, you need to use Python < 3.12 with distutils.version present' + ) + raise_from(ImportError(msg), exc) + + +def pick_latest_version(version_list): + '''Pick latest version from a list of versions.''' + if not version_list: + return '' + return sorted(version_list, key=LooseVersion, reverse=True)[0] + + +class FilterModule(object): + '''Helper filters.''' + def filters(self): + return { + '_latest_version': pick_latest_version, + } diff --git a/ansible_collections/community/sops/plugins/filter/decrypt.py b/ansible_collections/community/sops/plugins/filter/decrypt.py new file mode 100644 index 00000000..a27d1c70 --- /dev/null +++ b/ansible_collections/community/sops/plugins/filter/decrypt.py @@ -0,0 +1,172 @@ +# -*- coding: utf-8 -*- + +# Copyright (c) 2021, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import absolute_import, division, print_function +__metaclass__ = type + +DOCUMENTATION = ''' +name: decrpyt +short_description: Decrypt sops encrypted data +version_added: 1.1.0 +author: + - Felix Fontein (@felixfontein) +description: + - Decrypt sops encrypted data. + - Allows to decrypt data that has been provided by an arbitrary source. + - Note that due to Ansible lazy-evaluating expressions, it is better to use M(ansible.builtin.set_fact) + to store the result of an evaluation in a fact to avoid recomputing the value every time the expression + is used. +options: + _input: + description: + - The data to decrypt. + type: string + required: true + rstrip: + description: + - Whether to remove trailing newlines and spaces. + type: bool + default: true + input_type: + description: + - Tell sops how to interpret the encrypted data. + - There is no auto-detection since we do not have a filename. By default + sops is told to treat the input as YAML. If that is wrong, please set this + option to the correct value. + type: str + choices: + - binary + - json + - yaml + - dotenv + default: yaml + output_type: + description: + - Tell sops how to interpret the decrypted file. + - Please note that the output is always text or bytes, depending on the value of I(decode_output). + To parse the resulting JSON or YAML, use corresponding filters such as C(ansible.builtin.from_json) + and C(ansible.builtin.from_yaml). + type: str + choices: + - binary + - json + - yaml + - dotenv + default: yaml + decode_output: + description: + - Whether to decode the output to bytes. + - When I(output_type=binary), and the file isn't known to contain UTF-8 encoded text, + this should better be set to C(false) to prevent mangling the data with UTF-8 decoding. + type: bool + default: true +extends_documentation_fragment: + - community.sops.sops +seealso: + - plugin: community.sops.sops + plugin_type: lookup + - plugin: community.sops.sops + plugin_type: vars + - module: community.sops.load_vars +''' + +EXAMPLES = ''' +- name: Decrypt file fetched from URL + hosts: localhost + gather_facts: false + tasks: + - name: Fetch file from URL + ansible.builtin.uri: + url: https://raw.githubusercontent.com/mozilla/sops/master/functional-tests/res/comments.enc.yaml + return_content: true + register: encrypted_content + + - name: Show encrypted data + debug: + msg: "{{ encrypted_content.content | ansible.builtin.from_yaml }}" + + - name: Decrypt data and decode decrypted YAML + set_fact: + decrypted_data: "{{ encrypted_content.content | community.sops.decrypt | ansible.builtin.from_yaml }}" + + - name: Show decrypted data + debug: + msg: "{{ decrypted_data }}" +''' + +RETURN = ''' +_value: + description: + - Decrypted data as text (I(decode_output=true), default) or binary string (I(decode_output=false)). + type: string +''' + +from ansible.errors import AnsibleFilterError +from ansible.module_utils.common.text.converters import to_bytes, to_native +from ansible.utils.display import Display + +from ansible_collections.community.sops.plugins.module_utils.sops import Sops, SopsError + + +_VALID_TYPES = set(['binary', 'json', 'yaml', 'dotenv']) + + +def decrypt_filter(data, input_type='yaml', output_type='yaml', sops_binary='sops', rstrip=True, decode_output=True, + aws_profile=None, aws_access_key_id=None, aws_secret_access_key=None, aws_session_token=None, + config_path=None, enable_local_keyservice=False, keyservice=None, age_key=None, age_keyfile=None): + '''Decrypt sops-encrypted data.''' + + # Check parameters + if input_type not in _VALID_TYPES: + raise AnsibleFilterError('input_type must be one of {expected}; got "{value}"'.format( + expected=', '.join(sorted(_VALID_TYPES)), value=input_type)) + if output_type not in _VALID_TYPES: + raise AnsibleFilterError('output_type must be one of {expected}; got "{value}"'.format( + expected=', '.join(sorted(_VALID_TYPES)), value=output_type)) + + # Create option value querier + def get_option_value(argument_name): + if argument_name == 'sops_binary': + return sops_binary + if argument_name == 'age_key': + return age_key + if argument_name == 'age_keyfile': + return age_keyfile + if argument_name == 'aws_profile': + return aws_profile + if argument_name == 'aws_access_key_id': + return aws_access_key_id + if argument_name == 'aws_secret_access_key': + return aws_secret_access_key + if argument_name == 'aws_session_token': + return aws_session_token + if argument_name == 'config_path': + return config_path + if argument_name == 'enable_local_keyservice': + return enable_local_keyservice + if argument_name == 'keyservice': + return keyservice + raise AssertionError('internal error: should not be reached') + + # Decode + data = to_bytes(data) + try: + output = Sops.decrypt( + None, content=data, display=Display(), rstrip=rstrip, decode_output=decode_output, + input_type=input_type, output_type=output_type, get_option_value=get_option_value) + except SopsError as e: + raise AnsibleFilterError(to_native(e)) + + return output + + +class FilterModule(object): + '''Ansible jinja2 filters''' + + def filters(self): + return { + 'decrypt': decrypt_filter, + } diff --git a/ansible_collections/community/sops/plugins/lookup/sops.py b/ansible_collections/community/sops/plugins/lookup/sops.py new file mode 100644 index 00000000..64990ae5 --- /dev/null +++ b/ansible_collections/community/sops/plugins/lookup/sops.py @@ -0,0 +1,160 @@ +# -*- coding: utf-8 -*- +# +# Copyright 2018 Edoardo Tenani <e.tenani@arduino.cc> (@endorama) +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +DOCUMENTATION = """ + name: sops + author: Edoardo Tenani (@endorama) <e.tenani@arduino.cc> + short_description: Read sops encrypted file contents + version_added: '0.1.0' + description: + - This lookup returns the contents from a file on the Ansible controller's file system. + - This lookup requires the C(sops) executable to be available in the controller PATH. + options: + _terms: + description: Path(s) of files to read. + required: true + rstrip: + description: Whether to remove trailing newlines and spaces. + type: bool + default: true + base64: + description: + - Base64-encodes the parsed result. + - Use this if you want to store binary data in Ansible variables. + type: bool + default: false + input_type: + description: + - Tell sops how to interpret the encrypted file. + - By default, sops will chose the input type from the file extension. + If it detects the wrong type for a file, this could result in decryption + failing. + type: str + choices: + - binary + - json + - yaml + - dotenv + output_type: + description: + - Tell sops how to interpret the decrypted file. + - By default, sops will chose the output type from the file extension. + If it detects the wrong type for a file, this could result in decryption + failing. + type: str + choices: + - binary + - json + - yaml + - dotenv + empty_on_not_exist: + description: + - When set to C(true), will not raise an error when a file cannot be found, + but return an empty string instead. + type: bool + default: false + extends_documentation_fragment: + - community.sops.sops + - community.sops.sops.ansible_variables + - community.sops.sops.ansible_env + - community.sops.sops.ansible_ini + notes: + - This lookup does not understand 'globbing' - use the fileglob lookup instead. + seealso: + - ref: community.sops.decrypt filter <ansible_collections.community.sops.decrypt_filter> + description: The decrypt filter can be used to descrypt sops-encrypted in-memory data. + # - plugin: community.sops.decrypt + # plugin_type: filter + - ref: community.sops.sops vars plugin <ansible_collections.community.sops.sops_vars> + description: The sops vars plugin can be used to load sops-encrypted host or group variables. + # - plugin: community.sops.sops + # plugin_type: vars + - module: community.sops.load_vars +""" + +EXAMPLES = """ +- name: Output secrets to screen (BAD IDEA!) + ansible.builtin.debug: + msg: "Content: {{ lookup('community.sops.sops', item) }}" + loop: + - sops-encrypted-file.enc.yaml + +- name: Add SSH private key + ansible.builtin.copy: + # Note that rstrip=false is necessary for some SSH versions to be able to use the key + content: "{{ lookup('community.sops.sops', user + '-id_rsa', rstrip=false) }}" + dest: /home/{{ user }}/.ssh/id_rsa + owner: "{{ user }}" + group: "{{ user }}" + mode: 0600 + no_log: true # avoid content to be written to log + +- name: The file file.json is a YAML file, which contains the encryption of binary data + ansible.builtin.debug: + msg: "Content: {{ lookup('community.sops.sops', 'file.json', input_type='yaml', output_type='binary') }}" + +""" + +RETURN = """ + _raw: + description: Decrypted file content. + type: list + elements: str +""" + +import base64 + +from ansible.errors import AnsibleLookupError +from ansible.plugins.lookup import LookupBase +from ansible.module_utils.common.text.converters import to_native +from ansible_collections.community.sops.plugins.module_utils.sops import Sops, SopsError + +from ansible.utils.display import Display +display = Display() + + +class LookupModule(LookupBase): + + def run(self, terms, variables=None, **kwargs): + self.set_options(var_options=variables, direct=kwargs) + rstrip = self.get_option('rstrip') + use_base64 = self.get_option('base64') + input_type = self.get_option('input_type') + output_type = self.get_option('output_type') + empty_on_not_exist = self.get_option('empty_on_not_exist') + + ret = [] + + def get_option_value(argument_name): + return self.get_option(argument_name) + + for term in terms: + display.debug("Sops lookup term: %s" % term) + lookupfile = self.find_file_in_search_path(variables, 'files', term, ignore_missing=empty_on_not_exist) + display.vvvv(u"Sops lookup using %s as file" % lookupfile) + + if not lookupfile: + if empty_on_not_exist: + ret.append('') + continue + raise AnsibleLookupError("could not locate file in lookup: %s" % to_native(term)) + + try: + output = Sops.decrypt( + lookupfile, display=display, rstrip=rstrip, decode_output=not use_base64, + input_type=input_type, output_type=output_type, get_option_value=get_option_value) + except SopsError as e: + raise AnsibleLookupError(to_native(e)) + + if use_base64: + output = to_native(base64.b64encode(output)) + + ret.append(output) + + return ret diff --git a/ansible_collections/community/sops/plugins/module_utils/io.py b/ansible_collections/community/sops/plugins/module_utils/io.py new file mode 100644 index 00000000..5432237a --- /dev/null +++ b/ansible_collections/community/sops/plugins/module_utils/io.py @@ -0,0 +1,53 @@ +# Copyright (c), Yanis Guenane <yanis+ansible@guenane.org>, 2016 +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import absolute_import, division, print_function +__metaclass__ = type + + +import os +import tempfile + + +# This is taken from community.crypto + +def write_file(module, content): + ''' + Writes content into destination file as securely as possible. + Uses file arguments from module. + ''' + # Find out parameters for file + file_args = module.load_file_common_arguments(module.params) + # Create tempfile name + tmp_fd, tmp_name = tempfile.mkstemp(prefix=b'.ansible_tmp') + try: + os.close(tmp_fd) + except Exception: + pass + module.add_cleanup_file(tmp_name) # if we fail, let Ansible try to remove the file + try: + try: + # Create tempfile + file = os.open(tmp_name, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600) + os.write(file, content) + os.close(file) + except Exception as e: + try: + os.remove(tmp_name) + except Exception: + pass + module.fail_json(msg='Error while writing result into temporary file: {0}'.format(e)) + # Update destination to wanted permissions + if os.path.exists(file_args['path']): + module.set_fs_attributes_if_different(file_args, False) + # Move tempfile to final destination + module.atomic_move(tmp_name, file_args['path']) + # Try to update permissions again + module.set_fs_attributes_if_different(file_args, False) + except Exception as e: + try: + os.remove(tmp_name) + except Exception: + pass + module.fail_json(msg='Error while writing result: {0}'.format(e)) diff --git a/ansible_collections/community/sops/plugins/module_utils/sops.py b/ansible_collections/community/sops/plugins/module_utils/sops.py new file mode 100644 index 00000000..d3c98d1d --- /dev/null +++ b/ansible_collections/community/sops/plugins/module_utils/sops.py @@ -0,0 +1,303 @@ +# Copyright (c), Edoardo Tenani <e.tenani@arduino.cc>, 2018-2020 +# Simplified BSD License (see LICENSES/BSD-2-Clause.txt or https://opensource.org/licenses/BSD-2-Clause) +# SPDX-License-Identifier: BSD-2-Clause + +from __future__ import absolute_import, division, print_function +__metaclass__ = type + + +import os + +from ansible.module_utils.common.text.converters import to_text, to_native + +# Since this is used both by plugins and modules, we need subprocess in case the `module` parameter is not used +from subprocess import Popen, PIPE + + +# From https://github.com/mozilla/sops/blob/master/cmd/sops/codes/codes.go +# Should be manually updated +SOPS_ERROR_CODES = { + 1: "ErrorGeneric", + 2: "CouldNotReadInputFile", + 3: "CouldNotWriteOutputFile", + 4: "ErrorDumpingTree", + 5: "ErrorReadingConfig", + 6: "ErrorInvalidKMSEncryptionContextFormat", + 7: "ErrorInvalidSetFormat", + 8: "ErrorConflictingParameters", + 21: "ErrorEncryptingMac", + 23: "ErrorEncryptingTree", + 24: "ErrorDecryptingMac", + 25: "ErrorDecryptingTree", + 49: "CannotChangeKeysFromNonExistentFile", + 51: "MacMismatch", + 52: "MacNotFound", + 61: "ConfigFileNotFound", + 85: "KeyboardInterrupt", + 91: "InvalidTreePathFormat", + 100: "NoFileSpecified", + 128: "CouldNotRetrieveKey", + 111: "NoEncryptionKeyFound", + 200: "FileHasNotBeenModified", + 201: "NoEditorFound", + 202: "FailedToCompareVersions", + 203: "FileAlreadyEncrypted" +} + + +def _create_single_arg(argument_name): + def f(value, arguments, env): + arguments.extend([argument_name, to_native(value)]) + + return f + + +def _create_comma_separated(argument_name): + def f(value, arguments, env): + arguments.extend([argument_name, ','.join([to_native(v) for v in value])]) + + return f + + +def _create_repeated(argument_name): + def f(value, arguments, env): + for v in value: + arguments.extend([argument_name, to_native(v)]) + + return f + + +def _create_boolean(argument_name): + def f(value, arguments, env): + if value: + arguments.append(argument_name) + + return f + + +def _create_env_variable(argument_name): + def f(value, arguments, env): + env[argument_name] = value + + return f + + +GENERAL_OPTIONS = { + 'age_key': _create_env_variable('SOPS_AGE_KEY'), + 'age_keyfile': _create_env_variable('SOPS_AGE_KEY_FILE'), + 'aws_profile': _create_single_arg('--aws-profile'), + 'aws_access_key_id': _create_env_variable('AWS_ACCESS_KEY_ID'), + 'aws_secret_access_key': _create_env_variable('AWS_SECRET_ACCESS_KEY'), + 'aws_session_token': _create_env_variable('AWS_SESSION_TOKEN'), + 'config_path': _create_single_arg('--config'), + 'enable_local_keyservice': _create_boolean('--enable-local-keyservice'), + 'keyservice': _create_repeated('--keyservice'), +} + + +ENCRYPT_OPTIONS = { + 'age': _create_comma_separated('--age'), + 'kms': _create_comma_separated('--kms'), + 'gcp_kms': _create_comma_separated('--gcp-kms'), + 'azure_kv': _create_comma_separated('--azure-kv'), + 'hc_vault_transit': _create_comma_separated('--hc-vault-transit'), + 'pgp': _create_comma_separated('--pgp'), + 'unencrypted_suffix': _create_single_arg('--unencrypted-suffix'), + 'encrypted_suffix': _create_single_arg('--encrypted-suffix'), + 'unencrypted_regex': _create_single_arg('--unencrypted-regex'), + 'encrypted_regex': _create_single_arg('--encrypted-regex'), + 'encryption_context': _create_comma_separated('--encryption-context'), + 'shamir_secret_sharing_threshold': _create_single_arg('--shamir-secret-sharing-threshold'), +} + + +class SopsError(Exception): + ''' Extend Exception class with sops specific informations ''' + + def __init__(self, filename, exit_code, message, decryption=True): + if exit_code in SOPS_ERROR_CODES: + exception_name = SOPS_ERROR_CODES[exit_code] + message = "error with file %s: %s exited with code %d: %s" % ( + filename, exception_name, exit_code, to_native(message)) + else: + message = "could not %s file %s; Unknown sops error code: %s; message: %s" % ( + 'decrypt' if decryption else 'encrypt', filename, exit_code, to_native(message)) + super(SopsError, self).__init__(message) + + +class Sops(): + ''' Utility class to perform sops CLI actions ''' + + @staticmethod + def _add_options(command, env, get_option_value, options): + if get_option_value is None: + return + for option, f in options.items(): + v = get_option_value(option) + if v is not None: + f(v, command, env) + + @staticmethod + def get_sops_binary(get_option_value): + cmd = get_option_value('sops_binary') if get_option_value else None + if cmd is None: + cmd = 'sops' + return cmd + + @staticmethod + def decrypt(encrypted_file, content=None, + display=None, decode_output=True, rstrip=True, input_type=None, output_type=None, get_option_value=None, module=None): + # Run sops directly, python module is deprecated + command = [Sops.get_sops_binary(get_option_value)] + env = os.environ.copy() + Sops._add_options(command, env, get_option_value, GENERAL_OPTIONS) + if input_type is not None: + command.extend(["--input-type", input_type]) + if output_type is not None: + command.extend(["--output-type", output_type]) + if content is not None: + encrypted_file = '/dev/stdin' + command.extend(["--decrypt", encrypted_file]) + + if module: + exit_code, output, err = module.run_command(command, environ_update=env, encoding=None, data=content, binary_data=True) + else: + process = Popen(command, stdin=None if content is None else PIPE, stdout=PIPE, stderr=PIPE, env=env) + (output, err) = process.communicate(input=content) + exit_code = process.returncode + + if decode_output: + # output is binary, we want UTF-8 string + output = to_text(output, errors='surrogate_or_strict') + # the process output is the decrypted secret; be cautious + + # sops logs always to stderr, as stdout is used for + # file content + if err and display: + display.vvvv(to_text(err, errors='surrogate_or_strict')) + + if exit_code != 0: + raise SopsError(encrypted_file, exit_code, err, decryption=True) + + if rstrip: + output = output.rstrip() + + return output + + @staticmethod + def encrypt(data, display=None, cwd=None, input_type=None, output_type=None, get_option_value=None, module=None): + # Run sops directly, python module is deprecated + command = [Sops.get_sops_binary(get_option_value)] + env = os.environ.copy() + Sops._add_options(command, env, get_option_value, GENERAL_OPTIONS) + Sops._add_options(command, env, get_option_value, ENCRYPT_OPTIONS) + if input_type is not None: + command.extend(["--input-type", input_type]) + if output_type is not None: + command.extend(["--output-type", output_type]) + command.extend(["--encrypt", "/dev/stdin"]) + + if module: + exit_code, output, err = module.run_command(command, data=data, binary_data=True, cwd=cwd, environ_update=env, encoding=None) + else: + process = Popen(command, stdin=PIPE, stdout=PIPE, stderr=PIPE, cwd=cwd, env=env) + (output, err) = process.communicate(input=data) + exit_code = process.returncode + + # sops logs always to stderr, as stdout is used for + # file content + if err and display: + display.vvvv(to_text(err, errors='surrogate_or_strict')) + + if exit_code != 0: + raise SopsError('to stdout', exit_code, err, decryption=False) + + return output + + +def get_sops_argument_spec(add_encrypt_specific=False): + argument_spec = { + 'sops_binary': { + 'type': 'path', + }, + 'age_key': { + 'type': 'str', + 'no_log': True, + }, + 'age_keyfile': { + 'type': 'path', + }, + 'aws_profile': { + 'type': 'str', + }, + 'aws_access_key_id': { + 'type': 'str', + }, + 'aws_secret_access_key': { + 'type': 'str', + 'no_log': True, + }, + 'aws_session_token': { + 'type': 'str', + 'no_log': True, + }, + 'config_path': { + 'type': 'path', + }, + 'enable_local_keyservice': { + 'type': 'bool', + 'default': False, + }, + 'keyservice': { + 'type': 'list', + 'elements': 'str', + }, + } + if add_encrypt_specific: + argument_spec.update({ + 'age': { + 'type': 'list', + 'elements': 'str', + }, + 'kms': { + 'type': 'list', + 'elements': 'str', + }, + 'gcp_kms': { + 'type': 'list', + 'elements': 'str', + }, + 'azure_kv': { + 'type': 'list', + 'elements': 'str', + }, + 'hc_vault_transit': { + 'type': 'list', + 'elements': 'str', + }, + 'pgp': { + 'type': 'list', + 'elements': 'str', + }, + 'unencrypted_suffix': { + 'type': 'str', + }, + 'encrypted_suffix': { + 'type': 'str', + }, + 'unencrypted_regex': { + 'type': 'str', + }, + 'encrypted_regex': { + 'type': 'str', + }, + 'encryption_context': { + 'type': 'list', + 'elements': 'str', + }, + 'shamir_secret_sharing_threshold': { + 'type': 'int', + 'no_log': False, + }, + }) + return argument_spec diff --git a/ansible_collections/community/sops/plugins/modules/load_vars.py b/ansible_collections/community/sops/plugins/modules/load_vars.py new file mode 100644 index 00000000..27e9ae8c --- /dev/null +++ b/ansible_collections/community/sops/plugins/modules/load_vars.py @@ -0,0 +1,117 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import absolute_import, division, print_function +__metaclass__ = type + + +DOCUMENTATION = r''' +--- +author: Felix Fontein (@felixfontein) +module: load_vars +short_description: Load sops-encrypted variables from files, dynamically within a task +version_added: '0.1.0' +description: + - Loads sops-encrypted YAML/JSON variables dynamically from a file during task runtime. + - To assign included variables to a different host than C(inventory_hostname), + use C(delegate_to) and set C(delegate_facts=true). +options: + file: + description: + - The file name from which variables should be loaded. + - If the path is relative, it will look for the file in C(vars/) subdirectory of a role or relative to playbook. + type: path + name: + description: + - The name of a variable into which assign the included vars. + - If omitted (C(null)) they will be made top level vars. + type: str + expressions: + description: + - This option controls how Jinja2 expressions in values in the loaded file are handled. + - If set to C(ignore), expressions will not be evaluated, but treated as regular strings. + - If set to C(evaluate-on-load), expressions will be evaluated on execution of this module, + in other words, when the file is loaded. + - Unfortunately, there is no way for non-core modules to handle expressions "unsafe", + in other words, evaluate them only on use. This can only achieved by M(ansible.builtin.include_vars), + which unfortunately cannot handle sops-encrypted files. + type: str + default: ignore + choices: + - ignore + - evaluate-on-load +extends_documentation_fragment: + - community.sops.sops + - community.sops.attributes + - community.sops.attributes.facts + - community.sops.attributes.flow +attributes: + action: + support: full + async: + support: none + details: + - This action runs completely on the controller. + check_mode: + support: full + diff_mode: + support: N/A + details: + - This action does not modify state. + facts: + support: full +seealso: + - module: ansible.builtin.set_fact + - module: ansible.builtin.include_vars + - ref: playbooks_delegation + description: More information related to task delegation. + - ref: community.sops.sops lookup <ansible_collections.community.sops.sops_lookup> + description: The sops lookup can be used decrypt sops-encrypted files. + # - plugin: community.sops.sops + # plugin_type: lookup + - ref: community.sops.decrypt filter <ansible_collections.community.sops.decrypt_filter> + description: The decrypt filter can be used to descrypt sops-encrypted in-memory data. + # - plugin: community.sops.decrypt + # plugin_type: filter + - ref: community.sops.sops vars plugin <ansible_collections.community.sops.sops_vars> + description: The sops vars plugin can be used to load sops-encrypted host or group variables. + # - plugin: community.sops.sops + # plugin_type: vars +''' + +EXAMPLES = r''' +- name: Include variables of stuff.sops.yaml into the 'stuff' variable + community.sops.load_vars: + file: stuff.sops.yaml + name: stuff + expressions: evaluate-on-load # interpret Jinja2 expressions in stuf.sops.yaml on load-time! + +- name: Conditionally decide to load in variables into 'plans' when x is 0, otherwise do not + community.sops.load_vars: + file: contingency_plan.sops.yaml + name: plans + expressions: ignore # do not interpret possible Jinja2 expressions + when: x == 0 + +- name: Load variables into the global namespace + community.sops.load_vars: + file: contingency_plan.sops.yaml +''' + +RETURN = r''' +ansible_facts: + description: Variables that were included and their values. + returned: success + type: dict + sample: {'variable': 'value'} +ansible_included_var_files: + description: A list of files that were successfully included + returned: success + type: list + elements: str + sample: [ /path/to/file.sops.yaml ] +''' diff --git a/ansible_collections/community/sops/plugins/modules/sops_encrypt.py b/ansible_collections/community/sops/plugins/modules/sops_encrypt.py new file mode 100644 index 00000000..d4ba3435 --- /dev/null +++ b/ansible_collections/community/sops/plugins/modules/sops_encrypt.py @@ -0,0 +1,237 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +# Copyright (c) 2020, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import absolute_import, division, print_function +__metaclass__ = type + + +DOCUMENTATION = r''' +--- +author: Felix Fontein (@felixfontein) +module: sops_encrypt +short_description: Encrypt data with sops +version_added: '0.1.0' +description: + - Allows to encrypt binary data (Base64 encoded), text data, JSON or YAML data with sops. +options: + path: + description: + - The sops encrypt file. + type: path + required: true + force: + description: + - Force rewriting the encrypted file. + type: bool + default: false + content_text: + description: + - The data to encrypt. Must be a Unicode text. + - Please note that the module might not be idempotent if the text can be parsed as JSON or YAML. + - Exactly one of I(content_text), I(content_binary), I(content_json) and I(content_yaml) must be specified. + type: str + content_binary: + description: + - The data to encrypt. Must be L(Base64 encoded,https://en.wikipedia.org/wiki/Base64) binary data. + - Please note that the module might not be idempotent if the data can be parsed as JSON or YAML. + - Exactly one of I(content_text), I(content_binary), I(content_json) and I(content_yaml) must be specified. + type: str + content_json: + description: + - The data to encrypt. Must be a JSON dictionary. + - Exactly one of I(content_text), I(content_binary), I(content_json) and I(content_yaml) must be specified. + type: dict + content_yaml: + description: + - The data to encrypt. Must be a YAML dictionary. + - Please note that Ansible only allows to pass data that can be represented as a JSON dictionary. + - Exactly one of I(content_text), I(content_binary), I(content_json) and I(content_yaml) must be specified. + type: dict +extends_documentation_fragment: + - ansible.builtin.files + - community.sops.sops + - community.sops.sops.encrypt_specific + - community.sops.attributes + - community.sops.attributes.files +attributes: + check_mode: + support: full + diff_mode: + support: none + safe_file_operations: + support: full +seealso: + - ref: community.sops.sops lookup <ansible_collections.community.sops.sops_lookup> + description: The sops lookup can be used decrypt sops-encrypted files. + # - plugin: community.sops.sops + # plugin_type: lookup +''' + +EXAMPLES = r''' +- name: Encrypt a secret text + community.sops.sops_encrypt: + path: text-data.sops + content_text: This is a secret text. + +- name: Encrypt the contents of a file + community.sops.sops_encrypt: + path: binary-data.sops + content_binary: "{{ lookup('ansible.builtin.file', '/path/to/file', rstrip=false) | b64encode }}" + +- name: Encrypt some datastructure as YAML + community.sops.sops_encrypt: + path: stuff.sops.yaml + content_yaml: "{{ result }}" +''' + +RETURN = r''' # ''' + + +import base64 +import json +import os +import traceback + +from ansible.module_utils.basic import AnsibleModule, missing_required_lib +from ansible.module_utils.common.text.converters import to_text + +from ansible_collections.community.sops.plugins.module_utils.io import write_file +from ansible_collections.community.sops.plugins.module_utils.sops import Sops, SopsError, get_sops_argument_spec + +try: + import yaml + YAML_IMP_ERR = None + HAS_YAML = True +except ImportError: + YAML_IMP_ERR = traceback.format_exc() + HAS_YAML = False + yaml = None + + +def get_data_type(module): + if module.params['content_text'] is not None: + return 'binary' + if module.params['content_binary'] is not None: + return 'binary' + if module.params['content_json'] is not None: + return 'json' + if module.params['content_yaml'] is not None: + return 'yaml' + module.fail_json(msg='Internal error: unknown content type') + + +def compare_encoded_content(module, binary_data, content): + if module.params['content_text'] is not None: + return content == module.params['content_text'].encode('utf-8') + if module.params['content_binary'] is not None: + return content == binary_data + if module.params['content_json'] is not None: + # Compare JSON + try: + return json.loads(content) == module.params['content_json'] + except Exception: + # Treat parsing errors as content not equal + return False + if module.params['content_yaml'] is not None: + # Compare YAML + try: + return yaml.safe_load(content) == module.params['content_yaml'] + except Exception: + # Treat parsing errors as content not equal + return False + module.fail_json(msg='Internal error: unknown content type') + + +def get_encoded_type_content(module, binary_data): + if module.params['content_text'] is not None: + return 'binary', module.params['content_text'].encode('utf-8') + if module.params['content_binary'] is not None: + return 'binary', binary_data + if module.params['content_json'] is not None: + return 'json', json.dumps(module.params['content_json']).encode('utf-8') + if module.params['content_yaml'] is not None: + return 'yaml', yaml.safe_dump(module.params['content_yaml']).encode('utf-8') + module.fail_json(msg='Internal error: unknown content type') + + +def main(): + argument_spec = dict( + path=dict(type='path', required=True), + force=dict(type='bool', default=False), + content_text=dict(type='str', no_log=True), + content_binary=dict(type='str', no_log=True), + content_json=dict(type='dict', no_log=True), + content_yaml=dict(type='dict', no_log=True), + ) + argument_spec.update(get_sops_argument_spec(add_encrypt_specific=True)) + module = AnsibleModule( + argument_spec=argument_spec, + mutually_exclusive=[ + ('content_text', 'content_binary', 'content_json', 'content_yaml'), + ], + required_one_of=[ + ('content_text', 'content_binary', 'content_json', 'content_yaml'), + ], + supports_check_mode=True, + add_file_common_args=True, + ) + + # Check YAML + if module.params['content_yaml'] is not None and not HAS_YAML: + module.fail_json(msg=missing_required_lib('pyyaml'), exception=YAML_IMP_ERR) + + # Decode binary data + binary_data = None + if module.params['content_binary'] is not None: + try: + binary_data = base64.b64decode(module.params['content_binary']) + except Exception as e: + module.fail_json(msg='Cannot decode Base64 encoded data: {0}'.format(e)) + + path = module.params['path'] + directory = os.path.dirname(path) or None + changed = False + + def get_option_value(argument_name): + return module.params.get(argument_name) + + try: + if module.params['force'] or not os.path.exists(path): + # Simply encrypt + changed = True + else: + # Change detection: check if encrypted data equals new data + decrypted_content = Sops.decrypt( + path, decode_output=False, output_type=get_data_type(module), rstrip=False, + get_option_value=get_option_value, module=module, + ) + if not compare_encoded_content(module, binary_data, decrypted_content): + changed = True + + if changed and not module.check_mode: + input_type, input_data = get_encoded_type_content(module, binary_data) + output_type = None + if path.endswith('.json'): + output_type = 'json' + elif path.endswith('.yaml'): + output_type = 'yaml' + data = Sops.encrypt( + data=input_data, cwd=directory, input_type=input_type, output_type=output_type, + get_option_value=get_option_value, module=module, + ) + write_file(module, data) + except SopsError as e: + module.fail_json(msg=to_text(e)) + + file_args = module.load_file_common_arguments(module.params) + changed = module.set_fs_attributes_if_different(file_args, changed) + + module.exit_json(changed=changed) + + +if __name__ == '__main__': + main() diff --git a/ansible_collections/community/sops/plugins/plugin_utils/action_module.py b/ansible_collections/community/sops/plugins/plugin_utils/action_module.py new file mode 100644 index 00000000..f926c1d3 --- /dev/null +++ b/ansible_collections/community/sops/plugins/plugin_utils/action_module.py @@ -0,0 +1,786 @@ +# -*- coding: utf-8 -*- +# +# Copyright (c) 2012-2013 Michael DeHaan <michael.dehaan@gmail.com> +# Copyright (c) 2016 Toshio Kuratomi <tkuratomi@ansible.com> +# Copyright (c) 2019 Ansible Project +# Copyright (c) 2020 Felix Fontein <felix@fontein.de> +# Copyright (c) 2021 Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +# Parts taken from ansible.module_utils.basic and ansible.module_utils.common.warnings. + +# NOTE: THIS IS ONLY FOR ACTION PLUGINS! + +from __future__ import absolute_import, division, print_function +__metaclass__ = type + + +import abc +import copy +import traceback + +from ansible import constants as C +from ansible.errors import AnsibleError +from ansible.module_utils import six +from ansible.module_utils.basic import AnsibleFallbackNotFound, SEQUENCETYPE, remove_values +from ansible.module_utils.common._collections_compat import ( + Mapping +) +from ansible.module_utils.common.parameters import ( + PASS_VARS, + PASS_BOOLS, +) +from ansible.module_utils.common.validation import ( + check_mutually_exclusive, + check_required_arguments, + check_required_by, + check_required_if, + check_required_one_of, + check_required_together, + count_terms, + check_type_bool, + check_type_bits, + check_type_bytes, + check_type_float, + check_type_int, + check_type_jsonarg, + check_type_list, + check_type_dict, + check_type_path, + check_type_raw, + check_type_str, + safe_eval, +) +from ansible.module_utils.common.text.formatters import ( + lenient_lowercase, +) +from ansible.module_utils.parsing.convert_bool import BOOLEANS_FALSE, BOOLEANS_TRUE +from ansible.module_utils.six import ( + binary_type, + string_types, + text_type, +) +from ansible.module_utils.common.text.converters import to_native, to_text +from ansible.plugins.action import ActionBase + + +try: + # For ansible-core 2.11, we can use the ArgumentSpecValidator. We also import + # ModuleArgumentSpecValidator since that indicates that the 'classical' approach + # will no longer work. + from ansible.module_utils.common.arg_spec import ( # noqa: F401, pylint: disable=unused-import + ArgumentSpecValidator, + ModuleArgumentSpecValidator, # ModuleArgumentSpecValidator is not used + ) + from ansible.module_utils.errors import UnsupportedError + HAS_ARGSPEC_VALIDATOR = True +except ImportError: + # For ansible-base 2.10 and Ansible 2.9, we need to use the 'classical' approach + from ansible.module_utils.common.parameters import ( + handle_aliases, + list_deprecations, + list_no_log_values, + ) + HAS_ARGSPEC_VALIDATOR = False + + +class _ModuleExitException(Exception): + def __init__(self, result): + super(_ModuleExitException, self).__init__() + self.result = result + + +class AnsibleActionModule(object): + def __init__(self, action_plugin, argument_spec, bypass_checks=False, + mutually_exclusive=None, required_together=None, + required_one_of=None, supports_check_mode=False, + required_if=None, required_by=None): + # Internal data + self.__action_plugin = action_plugin + self.__warnings = [] + self.__deprecations = [] + + # AnsibleModule data + self._name = self.__action_plugin._task.action + self.argument_spec = argument_spec + self.supports_check_mode = supports_check_mode + self.check_mode = self.__action_plugin._play_context.check_mode + self.bypass_checks = bypass_checks + self.no_log = self.__action_plugin._play_context.no_log + + self.mutually_exclusive = mutually_exclusive + self.required_together = required_together + self.required_one_of = required_one_of + self.required_if = required_if + self.required_by = required_by + self._diff = self.__action_plugin._play_context.diff + self._verbosity = self.__action_plugin._display.verbosity + + self.aliases = {} + self._legal_inputs = [] + self._options_context = list() + + self.params = copy.deepcopy(self.__action_plugin._task.args) + self.no_log_values = set() + if HAS_ARGSPEC_VALIDATOR: + self._validator = ArgumentSpecValidator( + self.argument_spec, + self.mutually_exclusive, + self.required_together, + self.required_one_of, + self.required_if, + self.required_by, + ) + self._validation_result = self._validator.validate(self.params) + self.params.update(self._validation_result.validated_parameters) + self.no_log_values.update(self._validation_result._no_log_values) + + try: + error = self._validation_result.errors[0] + except IndexError: + error = None + + # We cannot use ModuleArgumentSpecValidator directly since it uses mechanisms for reporting + # warnings and deprecations that do not work in plugins. This is a copy of that code adjusted + # for our use-case: + for d in self._validation_result._deprecations: + # Before ansible-core 2.14.2, deprecations were always for aliases: + if 'name' in d: + self.deprecate( + "Alias '{name}' is deprecated. See the module docs for more information".format(name=d['name']), + version=d.get('version'), date=d.get('date'), collection_name=d.get('collection_name')) + # Since ansible-core 2.14.2, a message is present that can be directly printed: + if 'msg' in d: + self.deprecate(d['msg'], version=d.get('version'), date=d.get('date'), collection_name=d.get('collection_name')) + + for w in self._validation_result._warnings: + self.warn('Both option {option} and its alias {alias} are set.'.format(option=w['option'], alias=w['alias'])) + + # Fail for validation errors, even in check mode + if error: + msg = self._validation_result.errors.msg + if isinstance(error, UnsupportedError): + msg = "Unsupported parameters for ({name}) {kind}: {msg}".format(name=self._name, kind='module', msg=msg) + + self.fail_json(msg=msg) + else: + self._set_fallbacks() + + # append to legal_inputs and then possibly check against them + try: + self.aliases = self._handle_aliases() + except (ValueError, TypeError) as e: + # Use exceptions here because it isn't safe to call fail_json until no_log is processed + raise _ModuleExitException(dict(failed=True, msg="Module alias error: %s" % to_native(e))) + + # Save parameter values that should never be logged + self._handle_no_log_values() + + self._check_arguments() + + # check exclusive early + if not bypass_checks: + self._check_mutually_exclusive(mutually_exclusive) + + self._set_defaults(pre=True) + + self._CHECK_ARGUMENT_TYPES_DISPATCHER = { + 'str': self._check_type_str, + 'list': check_type_list, + 'dict': check_type_dict, + 'bool': check_type_bool, + 'int': check_type_int, + 'float': check_type_float, + 'path': check_type_path, + 'raw': check_type_raw, + 'jsonarg': check_type_jsonarg, + 'json': check_type_jsonarg, + 'bytes': check_type_bytes, + 'bits': check_type_bits, + } + if not bypass_checks: + self._check_required_arguments() + self._check_argument_types() + self._check_argument_values() + self._check_required_together(required_together) + self._check_required_one_of(required_one_of) + self._check_required_if(required_if) + self._check_required_by(required_by) + + self._set_defaults(pre=False) + + # deal with options sub-spec + self._handle_options() + + def _handle_aliases(self, spec=None, param=None, option_prefix=''): + if spec is None: + spec = self.argument_spec + if param is None: + param = self.params + + # this uses exceptions as it happens before we can safely call fail_json + alias_warnings = [] + alias_results, self._legal_inputs = handle_aliases(spec, param, alias_warnings=alias_warnings) # pylint: disable=used-before-assignment + for option, alias in alias_warnings: + self.warn('Both option %s and its alias %s are set.' % (option_prefix + option, option_prefix + alias)) + + deprecated_aliases = [] + for i in spec.keys(): + if 'deprecated_aliases' in spec[i].keys(): + for alias in spec[i]['deprecated_aliases']: + deprecated_aliases.append(alias) + + for deprecation in deprecated_aliases: + if deprecation['name'] in param.keys(): + self.deprecate("Alias '%s' is deprecated. See the module docs for more information" % deprecation['name'], + version=deprecation.get('version'), date=deprecation.get('date'), + collection_name=deprecation.get('collection_name')) + return alias_results + + def _handle_no_log_values(self, spec=None, param=None): + if spec is None: + spec = self.argument_spec + if param is None: + param = self.params + + try: + self.no_log_values.update(list_no_log_values(spec, param)) # pylint: disable=used-before-assignment + except TypeError as te: + self.fail_json(msg="Failure when processing no_log parameters. Module invocation will be hidden. " + "%s" % to_native(te), invocation={'module_args': 'HIDDEN DUE TO FAILURE'}) + + for message in list_deprecations(spec, param): # pylint: disable=used-before-assignment + self.deprecate(message['msg'], version=message.get('version'), date=message.get('date'), + collection_name=message.get('collection_name')) + + def _check_arguments(self, spec=None, param=None, legal_inputs=None): + self._syslog_facility = 'LOG_USER' + unsupported_parameters = set() + if spec is None: + spec = self.argument_spec + if param is None: + param = self.params + if legal_inputs is None: + legal_inputs = self._legal_inputs + + for k in list(param.keys()): + + if k not in legal_inputs: + unsupported_parameters.add(k) + + for k in PASS_VARS: + # handle setting internal properties from internal ansible vars + param_key = '_ansible_%s' % k + if param_key in param: + if k in PASS_BOOLS: + setattr(self, PASS_VARS[k][0], self.boolean(param[param_key])) + else: + setattr(self, PASS_VARS[k][0], param[param_key]) + + # clean up internal top level params: + if param_key in self.params: + del self.params[param_key] + else: + # use defaults if not already set + if not hasattr(self, PASS_VARS[k][0]): + setattr(self, PASS_VARS[k][0], PASS_VARS[k][1]) + + if unsupported_parameters: + msg = "Unsupported parameters for (%s) module: %s" % (self._name, ', '.join(sorted(list(unsupported_parameters)))) + if self._options_context: + msg += " found in %s." % " -> ".join(self._options_context) + supported_parameters = list() + for key in sorted(spec.keys()): + if 'aliases' in spec[key] and spec[key]['aliases']: + supported_parameters.append("%s (%s)" % (key, ', '.join(sorted(spec[key]['aliases'])))) + else: + supported_parameters.append(key) + msg += " Supported parameters include: %s" % (', '.join(supported_parameters)) + self.fail_json(msg=msg) + if self.check_mode and not self.supports_check_mode: + self.exit_json(skipped=True, msg="action module (%s) does not support check mode" % self._name) + + def _count_terms(self, check, param=None): + if param is None: + param = self.params + return count_terms(check, param) + + def _check_mutually_exclusive(self, spec, param=None): + if param is None: + param = self.params + + try: + check_mutually_exclusive(spec, param) + except TypeError as e: + msg = to_native(e) + if self._options_context: + msg += " found in %s" % " -> ".join(self._options_context) + self.fail_json(msg=msg) + + def _check_required_one_of(self, spec, param=None): + if spec is None: + return + + if param is None: + param = self.params + + try: + check_required_one_of(spec, param) + except TypeError as e: + msg = to_native(e) + if self._options_context: + msg += " found in %s" % " -> ".join(self._options_context) + self.fail_json(msg=msg) + + def _check_required_together(self, spec, param=None): + if spec is None: + return + if param is None: + param = self.params + + try: + check_required_together(spec, param) + except TypeError as e: + msg = to_native(e) + if self._options_context: + msg += " found in %s" % " -> ".join(self._options_context) + self.fail_json(msg=msg) + + def _check_required_by(self, spec, param=None): + if spec is None: + return + if param is None: + param = self.params + + try: + check_required_by(spec, param) + except TypeError as e: + self.fail_json(msg=to_native(e)) + + def _check_required_arguments(self, spec=None, param=None): + if spec is None: + spec = self.argument_spec + if param is None: + param = self.params + + try: + check_required_arguments(spec, param) + except TypeError as e: + msg = to_native(e) + if self._options_context: + msg += " found in %s" % " -> ".join(self._options_context) + self.fail_json(msg=msg) + + def _check_required_if(self, spec, param=None): + ''' ensure that parameters which conditionally required are present ''' + if spec is None: + return + if param is None: + param = self.params + + try: + check_required_if(spec, param) + except TypeError as e: + msg = to_native(e) + if self._options_context: + msg += " found in %s" % " -> ".join(self._options_context) + self.fail_json(msg=msg) + + def _check_argument_values(self, spec=None, param=None): + ''' ensure all arguments have the requested values, and there are no stray arguments ''' + if spec is None: + spec = self.argument_spec + if param is None: + param = self.params + for (k, v) in spec.items(): + choices = v.get('choices', None) + if choices is None: + continue + if isinstance(choices, SEQUENCETYPE) and not isinstance(choices, (binary_type, text_type)): + if k in param: + # Allow one or more when type='list' param with choices + if isinstance(param[k], list): + diff_list = ", ".join([item for item in param[k] if item not in choices]) + if diff_list: + choices_str = ", ".join([to_native(c) for c in choices]) + msg = "value of %s must be one or more of: %s. Got no match for: %s" % (k, choices_str, diff_list) + if self._options_context: + msg += " found in %s" % " -> ".join(self._options_context) + self.fail_json(msg=msg) + elif param[k] not in choices: + # PyYaml converts certain strings to bools. If we can unambiguously convert back, do so before checking + # the value. If we can't figure this out, module author is responsible. + lowered_choices = None + if param[k] == 'False': + lowered_choices = lenient_lowercase(choices) + overlap = BOOLEANS_FALSE.intersection(choices) + if len(overlap) == 1: + # Extract from a set + (param[k],) = overlap + + if param[k] == 'True': + if lowered_choices is None: + lowered_choices = lenient_lowercase(choices) + overlap = BOOLEANS_TRUE.intersection(choices) + if len(overlap) == 1: + (param[k],) = overlap + + if param[k] not in choices: + choices_str = ", ".join([to_native(c) for c in choices]) + msg = "value of %s must be one of: %s, got: %s" % (k, choices_str, param[k]) + if self._options_context: + msg += " found in %s" % " -> ".join(self._options_context) + self.fail_json(msg=msg) + else: + msg = "internal error: choices for argument %s are not iterable: %s" % (k, choices) + if self._options_context: + msg += " found in %s" % " -> ".join(self._options_context) + self.fail_json(msg=msg) + + def safe_eval(self, value, locals=None, include_exceptions=False): + return safe_eval(value, locals, include_exceptions) + + def _check_type_str(self, value, param=None, prefix=''): + opts = { + 'error': False, + 'warn': False, + 'ignore': True + } + + # Ignore, warn, or error when converting to a string. + allow_conversion = opts.get(C.STRING_CONVERSION_ACTION, True) + try: + return check_type_str(value, allow_conversion) + except TypeError: + common_msg = 'quote the entire value to ensure it does not change.' + from_msg = '{0!r}'.format(value) + to_msg = '{0!r}'.format(to_text(value)) + + if param is not None: + if prefix: + param = '{0}{1}'.format(prefix, param) + + from_msg = '{0}: {1!r}'.format(param, value) + to_msg = '{0}: {1!r}'.format(param, to_text(value)) + + if C.STRING_CONVERSION_ACTION == 'error': + msg = common_msg.capitalize() + raise TypeError(to_native(msg)) + elif C.STRING_CONVERSION_ACTION == 'warn': + msg = ('The value "{0}" (type {1.__class__.__name__}) was converted to "{2}" (type string). ' + 'If this does not look like what you expect, {3}').format(from_msg, value, to_msg, common_msg) + self.warn(to_native(msg)) + return to_native(value, errors='surrogate_or_strict') + + def _handle_options(self, argument_spec=None, params=None, prefix=''): + ''' deal with options to create sub spec ''' + if argument_spec is None: + argument_spec = self.argument_spec + if params is None: + params = self.params + + for (k, v) in argument_spec.items(): + wanted = v.get('type', None) + if wanted == 'dict' or (wanted == 'list' and v.get('elements', '') == 'dict'): + spec = v.get('options', None) + if v.get('apply_defaults', False): + if spec is not None: + if params.get(k) is None: + params[k] = {} + else: + continue + elif spec is None or k not in params or params[k] is None: + continue + + self._options_context.append(k) + + if isinstance(params[k], dict): + elements = [params[k]] + else: + elements = params[k] + + for idx, param in enumerate(elements): + if not isinstance(param, dict): + self.fail_json(msg="value of %s must be of type dict or list of dict" % k) + + new_prefix = prefix + k + if wanted == 'list': + new_prefix += '[%d]' % idx + new_prefix += '.' + + self._set_fallbacks(spec, param) + options_aliases = self._handle_aliases(spec, param, option_prefix=new_prefix) + + options_legal_inputs = list(spec.keys()) + list(options_aliases.keys()) + + self._check_arguments(spec, param, options_legal_inputs) + + # check exclusive early + if not self.bypass_checks: + self._check_mutually_exclusive(v.get('mutually_exclusive', None), param) + + self._set_defaults(pre=True, spec=spec, param=param) + + if not self.bypass_checks: + self._check_required_arguments(spec, param) + self._check_argument_types(spec, param, new_prefix) + self._check_argument_values(spec, param) + + self._check_required_together(v.get('required_together', None), param) + self._check_required_one_of(v.get('required_one_of', None), param) + self._check_required_if(v.get('required_if', None), param) + self._check_required_by(v.get('required_by', None), param) + + self._set_defaults(pre=False, spec=spec, param=param) + + # handle multi level options (sub argspec) + self._handle_options(spec, param, new_prefix) + self._options_context.pop() + + def _get_wanted_type(self, wanted, k): + if not callable(wanted): + if wanted is None: + # Mostly we want to default to str. + # For values set to None explicitly, return None instead as + # that allows a user to unset a parameter + wanted = 'str' + try: + type_checker = self._CHECK_ARGUMENT_TYPES_DISPATCHER[wanted] + except KeyError: + self.fail_json(msg="implementation error: unknown type %s requested for %s" % (wanted, k)) + else: + # set the type_checker to the callable, and reset wanted to the callable's name (or type if it doesn't have one, ala MagicMock) + type_checker = wanted + wanted = getattr(wanted, '__name__', to_native(type(wanted))) + + return type_checker, wanted + + def _handle_elements(self, wanted, param, values): + type_checker, wanted_name = self._get_wanted_type(wanted, param) + validated_params = [] + # Get param name for strings so we can later display this value in a useful error message if needed + # Only pass 'kwargs' to our checkers and ignore custom callable checkers + kwargs = {} + if wanted_name == 'str' and isinstance(wanted, string_types): + if isinstance(param, string_types): + kwargs['param'] = param + elif isinstance(param, dict): + kwargs['param'] = list(param.keys())[0] + for value in values: + try: + validated_params.append(type_checker(value, **kwargs)) + except (TypeError, ValueError) as e: + msg = "Elements value for option %s" % param + if self._options_context: + msg += " found in '%s'" % " -> ".join(self._options_context) + msg += " is of type %s and we were unable to convert to %s: %s" % (type(value), wanted_name, to_native(e)) + self.fail_json(msg=msg) + return validated_params + + def _check_argument_types(self, spec=None, param=None, prefix=''): + ''' ensure all arguments have the requested type ''' + + if spec is None: + spec = self.argument_spec + if param is None: + param = self.params + + for (k, v) in spec.items(): + wanted = v.get('type', None) + if k not in param: + continue + + value = param[k] + if value is None: + continue + + type_checker, wanted_name = self._get_wanted_type(wanted, k) + # Get param name for strings so we can later display this value in a useful error message if needed + # Only pass 'kwargs' to our checkers and ignore custom callable checkers + kwargs = {} + if wanted_name == 'str' and isinstance(type_checker, string_types): + kwargs['param'] = list(param.keys())[0] + + # Get the name of the parent key if this is a nested option + if prefix: + kwargs['prefix'] = prefix + + try: + param[k] = type_checker(value, **kwargs) + wanted_elements = v.get('elements', None) + if wanted_elements: + if wanted != 'list' or not isinstance(param[k], list): + msg = "Invalid type %s for option '%s'" % (wanted_name, param) + if self._options_context: + msg += " found in '%s'." % " -> ".join(self._options_context) + msg += ", elements value check is supported only with 'list' type" + self.fail_json(msg=msg) + param[k] = self._handle_elements(wanted_elements, k, param[k]) + + except (TypeError, ValueError) as e: + msg = "argument %s is of type %s" % (k, type(value)) + if self._options_context: + msg += " found in '%s'." % " -> ".join(self._options_context) + msg += " and we were unable to convert to %s: %s" % (wanted_name, to_native(e)) + self.fail_json(msg=msg) + + def _set_defaults(self, pre=True, spec=None, param=None): + if spec is None: + spec = self.argument_spec + if param is None: + param = self.params + for (k, v) in spec.items(): + default = v.get('default', None) + if pre is True: + # this prevents setting defaults on required items + if default is not None and k not in param: + param[k] = default + else: + # make sure things without a default still get set None + if k not in param: + param[k] = default + + def _set_fallbacks(self, spec=None, param=None): + if spec is None: + spec = self.argument_spec + if param is None: + param = self.params + + for (k, v) in spec.items(): + fallback = v.get('fallback', (None,)) + fallback_strategy = fallback[0] + fallback_args = [] + fallback_kwargs = {} + if k not in param and fallback_strategy is not None: + for item in fallback[1:]: + if isinstance(item, dict): + fallback_kwargs = item + else: + fallback_args = item + try: + param[k] = fallback_strategy(*fallback_args, **fallback_kwargs) + except AnsibleFallbackNotFound: + continue + + def warn(self, warning): + # Copied from ansible.module_utils.common.warnings: + if isinstance(warning, string_types): + self.__warnings.append(warning) + else: + raise TypeError("warn requires a string not a %s" % type(warning)) + + def deprecate(self, msg, version=None, date=None, collection_name=None): + if version is not None and date is not None: + raise AssertionError("implementation error -- version and date must not both be set") + + # Copied from ansible.module_utils.common.warnings: + if isinstance(msg, string_types): + # For compatibility, we accept that neither version nor date is set, + # and treat that the same as if version would haven been set + if date is not None: + self.__deprecations.append({'msg': msg, 'date': date, 'collection_name': collection_name}) + else: + self.__deprecations.append({'msg': msg, 'version': version, 'collection_name': collection_name}) + else: + raise TypeError("deprecate requires a string not a %s" % type(msg)) + + def _return_formatted(self, kwargs): + if 'invocation' not in kwargs: + kwargs['invocation'] = {'module_args': self.params} + + if 'warnings' in kwargs: + if isinstance(kwargs['warnings'], list): + for w in kwargs['warnings']: + self.warn(w) + else: + self.warn(kwargs['warnings']) + + if self.__warnings: + kwargs['warnings'] = self.__warnings + + if 'deprecations' in kwargs: + if isinstance(kwargs['deprecations'], list): + for d in kwargs['deprecations']: + if isinstance(d, SEQUENCETYPE) and len(d) == 2: + self.deprecate(d[0], version=d[1]) + elif isinstance(d, Mapping): + self.deprecate(d['msg'], version=d.get('version'), date=d.get('date'), + collection_name=d.get('collection_name')) + else: + self.deprecate(d) # pylint: disable=ansible-deprecated-no-version + else: + self.deprecate(kwargs['deprecations']) # pylint: disable=ansible-deprecated-no-version + + if self.__deprecations: + kwargs['deprecations'] = self.__deprecations + + kwargs = remove_values(kwargs, self.no_log_values) + raise _ModuleExitException(kwargs) + + def exit_json(self, **kwargs): + result = dict(kwargs) + if 'failed' not in result: + result['failed'] = False + self._return_formatted(result) + + def fail_json(self, msg, **kwargs): + result = dict(kwargs) + result['failed'] = True + result['msg'] = msg + self._return_formatted(result) + + +@six.add_metaclass(abc.ABCMeta) +class ActionModuleBase(ActionBase): + @abc.abstractmethod + def setup_module(self): + """Return pair (ArgumentSpec, kwargs).""" + pass + + @abc.abstractmethod + def run_module(self, module): + """Run module code""" + module.fail_json(msg='Not implemented.') + + def run(self, tmp=None, task_vars=None): + if task_vars is None: + task_vars = dict() + + result = super(ActionModuleBase, self).run(tmp, task_vars) + del tmp # tmp no longer has any effect + + try: + argument_spec, kwargs = self.setup_module() + module = argument_spec.create_ansible_module_helper(AnsibleActionModule, (self, ), **kwargs) + self.run_module(module) + raise AnsibleError('Internal error: action module did not call module.exit_json()') + except _ModuleExitException as mee: + result.update(mee.result) + return result + except Exception as dummy: + result['failed'] = True + result['msg'] = 'MODULE FAILURE' + result['exception'] = traceback.format_exc() + return result + + +class ArgumentSpec: + def __init__(self, argument_spec, mutually_exclusive=None, required_together=None, required_one_of=None, required_if=None, required_by=None): + self.argument_spec = argument_spec + self.mutually_exclusive = mutually_exclusive or [] + self.required_together = required_together or [] + self.required_one_of = required_one_of or [] + self.required_if = required_if or [] + self.required_by = required_by or {} + + def create_ansible_module_helper(self, clazz, args, **kwargs): + return clazz( + *args, + argument_spec=self.argument_spec, + mutually_exclusive=self.mutually_exclusive, + required_together=self.required_together, + required_one_of=self.required_one_of, + required_if=self.required_if, + required_by=self.required_by, + **kwargs) diff --git a/ansible_collections/community/sops/plugins/vars/sops.py b/ansible_collections/community/sops/plugins/vars/sops.py new file mode 100644 index 00000000..54748035 --- /dev/null +++ b/ansible_collections/community/sops/plugins/vars/sops.py @@ -0,0 +1,165 @@ +# -*- coding: utf-8 -*- +# +# Copyright (c) 2018 Edoardo Tenani <e.tenani@arduino.cc> (@endorama) +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +DOCUMENTATION = ''' + name: sops + author: Edoardo Tenani (@endorama) <e.tenani@arduino.cc> + short_description: Loading sops-encrypted vars files + version_added: '0.1.0' + description: + - Load encrypted YAML files into corresponding groups/hosts in group_vars/ and host_vars/ directories. + - Files are encrypted prior to reading, making this plugin an effective companion to host_group_vars plugin. + - Files are restricted to .sops.yaml, .sops.yml, .sops.json extensions. + - Hidden files are ignored. + options: + _valid_extensions: + default: [".sops.yml", ".sops.yaml", ".sops.json"] + description: + - "Check all of these extensions when looking for 'variable' files which should be YAML or JSON or vaulted versions of these." + - 'This affects vars_files, include_vars, inventory and vars plugins among others.' + type: list + elements: string + stage: + version_added: 0.2.0 + ini: + - key: vars_stage + section: community.sops + env: + - name: ANSIBLE_VARS_SOPS_PLUGIN_STAGE + cache: + description: + - Whether to cache decrypted files or not. + - If the cache is disabled, the files will be decrypted for almost every task. This is very slow! + - Only disable caching if you modify the variable files during a playbook run and want the updated + result to be available from the next task on. + - "Note that setting I(stage) to C(inventory) has the same effect as setting I(cache) to C(true): + the variables will be loaded only once (during inventory loading) and the vars plugin will not + be called for every task." + type: bool + default: true + version_added: 0.2.0 + ini: + - key: vars_cache + section: community.sops + env: + - name: ANSIBLE_VARS_SOPS_PLUGIN_CACHE + _disable_vars_plugin_temporarily: + description: + - Temporarily disable this plugin. + - Useful if ansible-inventory is supposed to be run without decrypting secrets (in AWX for instance). + type: bool + default: false + version_added: 1.3.0 + env: + - name: SOPS_ANSIBLE_AWX_DISABLE_VARS_PLUGIN_TEMPORARILY + extends_documentation_fragment: + - ansible.builtin.vars_plugin_staging + - community.sops.sops + - community.sops.sops.ansible_env + - community.sops.sops.ansible_ini + seealso: + - ref: community.sops.sops lookup <ansible_collections.community.sops.sops_lookup> + description: The sops lookup can be used decrypt sops-encrypted files. + # - plugin: community.sops.sops + # plugin_type: lookup + - ref: community.sops.decrypt filter <ansible_collections.community.sops.decrypt_filter> + description: The decrypt filter can be used to descrypt sops-encrypted in-memory data. + # - plugin: community.sops.decrypt + # plugin_type: filter + - module: community.sops.load_vars +''' + +import os +from ansible.errors import AnsibleParserError +from ansible.module_utils.common.text.converters import to_bytes, to_native, to_text +from ansible.plugins.vars import BaseVarsPlugin +from ansible.inventory.host import Host +from ansible.inventory.group import Group +from ansible.utils.vars import combine_vars +from ansible_collections.community.sops.plugins.module_utils.sops import Sops + +from ansible.utils.display import Display +display = Display() + + +FOUND = {} +DECRYPTED = {} +DEFAULT_VALID_EXTENSIONS = [".sops.yaml", ".sops.yml", ".sops.json"] + + +class VarsModule(BaseVarsPlugin): + + def get_vars(self, loader, path, entities, cache=None): + ''' parses the inventory file ''' + + if not isinstance(entities, list): + entities = [entities] + + super(VarsModule, self).get_vars(loader, path, entities) + + def get_option_value(argument_name): + return self.get_option(argument_name) + + if cache is None: + cache = self.get_option('cache') + + if self.get_option('_disable_vars_plugin_temporarily'): + return {} + + data = {} + for entity in entities: + if isinstance(entity, Host): + subdir = 'host_vars' + elif isinstance(entity, Group): + subdir = 'group_vars' + else: + raise AnsibleParserError("Supplied entity must be Host or Group, got %s instead" % (type(entity))) + + # avoid 'chroot' type inventory hostnames /path/to/chroot + if not entity.name.startswith(os.path.sep): + try: + found_files = [] + # load vars + b_opath = os.path.realpath(to_bytes(os.path.join(self._basedir, subdir))) + opath = to_text(b_opath) + key = '%s.%s' % (entity.name, opath) + self._display.vvvv("key: %s" % (key)) + if cache and key in FOUND: + found_files = FOUND[key] + else: + # no need to do much if path does not exist for basedir + if os.path.exists(b_opath): + if os.path.isdir(b_opath): + self._display.debug("\tprocessing dir %s" % opath) + # NOTE: iterating without extension allow retriving files recursively + # A filter is then applied by iterating on all results and filtering by + # extension. + # See: + # - https://github.com/ansible-collections/community.sops/pull/6 + found_files = loader.find_vars_files(opath, entity.name, extensions=DEFAULT_VALID_EXTENSIONS, allow_dir=False) + found_files.extend([file_path for file_path in loader.find_vars_files(opath, entity.name) + if any(to_text(file_path).endswith(extension) for extension in DEFAULT_VALID_EXTENSIONS)]) + FOUND[key] = found_files + else: + self._display.warning("Found %s that is not a directory, skipping: %s" % (subdir, opath)) + + for found in found_files: + if cache and found in DECRYPTED: + file_content = DECRYPTED[found] + else: + file_content = Sops.decrypt(found, display=display, get_option_value=get_option_value) + DECRYPTED[found] = file_content + new_data = loader.load(file_content) + if new_data: # ignore empty files + data = combine_vars(data, new_data) + + except Exception as e: + raise AnsibleParserError(to_native(e)) + + return data diff --git a/ansible_collections/community/sops/roles/_install_age/README.md b/ansible_collections/community/sops/roles/_install_age/README.md new file mode 100644 index 00000000..a8541545 --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/README.md @@ -0,0 +1,7 @@ +<!-- +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: 2022, Felix Fontein +--> + +See [the documentation](https://docs.ansible.com/ansible/devel/collections/community/sops/). diff --git a/ansible_collections/community/sops/roles/_install_age/defaults/main.yml b/ansible_collections/community/sops/roles/_install_age/defaults/main.yml new file mode 100644 index 00000000..83e6bea5 --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/defaults/main.yml @@ -0,0 +1,7 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +sops_install_on_localhost: false +sops_become_on_install: true diff --git a/ansible_collections/community/sops/roles/_install_age/meta/main.yml b/ansible_collections/community/sops/roles/_install_age/meta/main.yml new file mode 100644 index 00000000..6e671781 --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/meta/main.yml @@ -0,0 +1,11 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +galaxy_info: + standalone: false + description: > + [INTERNAL] Install age (https://github.com/FiloSottile/age/). + +dependencies: [] diff --git a/ansible_collections/community/sops/roles/_install_age/tasks/main.yml b/ansible_collections/community/sops/roles/_install_age/tasks/main.yml new file mode 100644 index 00000000..6bdfa445 --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/tasks/main.yml @@ -0,0 +1,64 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +- name: Gather required information on localhost + when: sops_install_on_localhost + ansible.builtin.setup: + gather_subset: + - '!all' + - '!min' + - architecture + - distribution + - distribution_major_version + - distribution_version + - os_family + delegate_to: localhost + delegate_facts: true + run_once: true + +- vars: + _community_sops_install_age_facts: >- + {{ hostvars['localhost' if sops_install_on_localhost else inventory_hostname].ansible_facts }} + block: + - name: Show system information + ansible.builtin.debug: + msg: |- + Architecture: {{ _community_sops_install_age_facts.architecture }} + Distribution: {{ _community_sops_install_age_facts.distribution }} {{ _community_sops_install_age_facts.distribution_major_version }} + Distribution version: {{ _community_sops_install_age_facts.distribution_version }} + OS family: {{ _community_sops_install_age_facts.os_family }} + + - name: Include distribution specific variables + ansible.builtin.include_vars: '{{ lookup("ansible.builtin.first_found", params) }}' + vars: + params: + files: + - >- + D-{{ _community_sops_install_age_facts.distribution }}-{{ _community_sops_install_age_facts.distribution_version }}.yml + - >- + D-{{ _community_sops_install_age_facts.distribution }}-{{ _community_sops_install_age_facts.distribution_major_version }}.yml + - >- + D-{{ _community_sops_install_age_facts.distribution }}.yml + - >- + OS-{{ _community_sops_install_age_facts.os_family }}-{{ _community_sops_install_age_facts.distribution_major_version }}.yml + - >- + OS-{{ _community_sops_install_age_facts.os_family }}.yml + - default.yml + paths: + - '{{ role_path }}/vars' + + - name: Install system packages + ansible.builtin.package: + name: '{{ _community_sops_install_age_system_packages }}' + become: '{{ sops_become_on_install }}' + delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}' + run_once: '{{ sops_install_on_localhost or omit }}' + when: _community_sops_install_age_system_packages | length > 0 + + - name: Set results + ansible.builtin.set_fact: + age_installed: "{{ _community_sops_install_age_has_age }}" + delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}' + delegate_facts: '{{ true if sops_install_on_localhost else omit }}' diff --git a/ansible_collections/community/sops/roles/_install_age/vars/D-Alpine.yml b/ansible_collections/community/sops/roles/_install_age/vars/D-Alpine.yml new file mode 100644 index 00000000..002c8136 --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/vars/D-Alpine.yml @@ -0,0 +1,9 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_age_system_packages: + - age + +_community_sops_install_age_has_age: true diff --git a/ansible_collections/community/sops/roles/_install_age/vars/D-Archlinux.yml b/ansible_collections/community/sops/roles/_install_age/vars/D-Archlinux.yml new file mode 100644 index 00000000..002c8136 --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/vars/D-Archlinux.yml @@ -0,0 +1,9 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_age_system_packages: + - age + +_community_sops_install_age_has_age: true diff --git a/ansible_collections/community/sops/roles/_install_age/vars/D-Debian-10.yml b/ansible_collections/community/sops/roles/_install_age/vars/D-Debian-10.yml new file mode 100644 index 00000000..5ee19d4c --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/vars/D-Debian-10.yml @@ -0,0 +1,8 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_age_system_packages: [] + +_community_sops_install_age_has_age: false diff --git a/ansible_collections/community/sops/roles/_install_age/vars/D-Fedora.yml b/ansible_collections/community/sops/roles/_install_age/vars/D-Fedora.yml new file mode 100644 index 00000000..002c8136 --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/vars/D-Fedora.yml @@ -0,0 +1,9 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_age_system_packages: + - age + +_community_sops_install_age_has_age: true diff --git a/ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-16.yml b/ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-16.yml new file mode 100644 index 00000000..5ee19d4c --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-16.yml @@ -0,0 +1,8 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_age_system_packages: [] + +_community_sops_install_age_has_age: false diff --git a/ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-18.yml b/ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-18.yml new file mode 100644 index 00000000..5ee19d4c --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-18.yml @@ -0,0 +1,8 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_age_system_packages: [] + +_community_sops_install_age_has_age: false diff --git a/ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-20.yml b/ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-20.yml new file mode 100644 index 00000000..5ee19d4c --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/vars/D-Ubuntu-20.yml @@ -0,0 +1,8 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_age_system_packages: [] + +_community_sops_install_age_has_age: false diff --git a/ansible_collections/community/sops/roles/_install_age/vars/OS-Debian.yml b/ansible_collections/community/sops/roles/_install_age/vars/OS-Debian.yml new file mode 100644 index 00000000..002c8136 --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/vars/OS-Debian.yml @@ -0,0 +1,9 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_age_system_packages: + - age + +_community_sops_install_age_has_age: true diff --git a/ansible_collections/community/sops/roles/_install_age/vars/default.yml b/ansible_collections/community/sops/roles/_install_age/vars/default.yml new file mode 100644 index 00000000..5ee19d4c --- /dev/null +++ b/ansible_collections/community/sops/roles/_install_age/vars/default.yml @@ -0,0 +1,8 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_age_system_packages: [] + +_community_sops_install_age_has_age: false diff --git a/ansible_collections/community/sops/roles/install/README.md b/ansible_collections/community/sops/roles/install/README.md new file mode 100644 index 00000000..a8541545 --- /dev/null +++ b/ansible_collections/community/sops/roles/install/README.md @@ -0,0 +1,7 @@ +<!-- +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: 2022, Felix Fontein +--> + +See [the documentation](https://docs.ansible.com/ansible/devel/collections/community/sops/). diff --git a/ansible_collections/community/sops/roles/install/defaults/main.yml b/ansible_collections/community/sops/roles/install/defaults/main.yml new file mode 100644 index 00000000..7e793f13 --- /dev/null +++ b/ansible_collections/community/sops/roles/install/defaults/main.yml @@ -0,0 +1,10 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +sops_version: latest +sops_source: auto +sops_install_on_localhost: false +sops_become_on_install: true +sops_github_latest_detection: auto diff --git a/ansible_collections/community/sops/roles/install/meta/argument_specs.yml b/ansible_collections/community/sops/roles/install/meta/argument_specs.yml new file mode 100644 index 00000000..e6f3e874 --- /dev/null +++ b/ansible_collections/community/sops/roles/install/meta/argument_specs.yml @@ -0,0 +1,72 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +argument_specs: + main: + short_description: Install Mozilla sops + version_added: 1.5.0 + description: + - This role installs L(Mozilla sops,https://github.com/mozilla/sops) and Gnu Privacy Guard (GPG). + - >- + This role supports the following operating systems: + Alpine (new enough), + Arch Linux, + CentOS 7, Stream 8, or newer, + Debian 10 (Buster) or newer, + Fedora (new enough), + RHEL 7 or newer, + Ubuntu 16.04 or newer LTS versions + - The Ansible facts C(ansible_facts.architecture), C(ansible_facts.distribution), C(ansible_facts.distribution_major_version), + C(ansible_facts.distribution_version), and C(ansible_facts.os_family) are expected to be present if I(sops_install_on_localhost) is C(false). + author: + - Felix Fontein (@felixfontein) + options: + sops_version: + default: latest + description: + - The version of sops to install. + - Should be a version like C(3.7.2). The special value C(latest) will select the latest version available form the given source. + type: str + sops_source: + default: auto + description: + - Determines the source from where sops is installed. + - The value C(github) will install sops from the Mozilla sops releases on GitHub (U(https://github.com/mozilla/sops/releases/)). + - The value C(system) will install sops from the system packages. Note that not all system package repositories support sops. + - The value C(auto) will determine the best source to install sops from. Here, system package repositories are preferred over GitHub. + type: str + choices: + - auto + - github + - system + sops_install_on_localhost: + default: false + description: + - Installs sops on the Ansible controller (C(localhost)) instead of the remote host. + type: bool + sops_become_on_install: + default: true + description: + - 'Whether the role should use C(become: true) when installing packages.' + type: bool + sops_github_latest_detection: + description: + - When installing the latest sops version from GitHub, configures how the latest release is detected. + - C(auto) tries C(api) first and then uses C(latest-release). + - C(api) asks the GitHub API for a list of recent releases and picks the highest version. + - C(latest-release) uses a not fully documented URL to retrieve the release marked as "latest" by the repository maintainers. + type: str + choices: + - auto + - api + - latest-release + version_added: 1.6.0 + sops_github_token: + description: + - Token to provide when querying the GitHub API for the latest release. Without the token + there are rather strict rate limits. + - Should mainly be used in GitHub Actions. + type: str + version_added: 1.6.0 diff --git a/ansible_collections/community/sops/roles/install/meta/main.yml b/ansible_collections/community/sops/roles/install/meta/main.yml new file mode 100644 index 00000000..f6dc6814 --- /dev/null +++ b/ansible_collections/community/sops/roles/install/meta/main.yml @@ -0,0 +1,11 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +galaxy_info: + standalone: false + description: > + Install Mozilla sops (https://github.com/mozilla/sops). + +dependencies: [] diff --git a/ansible_collections/community/sops/roles/install/tasks/detect_source.yml b/ansible_collections/community/sops/roles/install/tasks/detect_source.yml new file mode 100644 index 00000000..e31c0fa9 --- /dev/null +++ b/ansible_collections/community/sops/roles/install/tasks/detect_source.yml @@ -0,0 +1,26 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +- name: Check whether system packages are a valid source of sops {{ sops_version }} + when: + - _community_sops_install_system_has_system + - not (sops_version != 'latest' and _community_sops_install_system_has_system_latest_only) + ansible.builtin.set_fact: + _community_sops_install_effective_sops_source: system + +- name: Check whether GitHub is a valid source of sops + when: + - _community_sops_install_system_has_github + - _community_sops_install_effective_sops_source == 'auto' + ansible.builtin.set_fact: + _community_sops_install_effective_sops_source: github + +- name: Ensure that something was detected + ansible.builtin.fail: + msg: >- + Was not able to determine installation source for sops {{ sops_version }} + for {{ _community_sops_install_facts.distribution }} {{ _community_sops_install_facts.distribution_version }}. + Please open an issue in https://github.com/ansible-collections/community.sops/issues if you think this should work. + when: _community_sops_install_effective_sops_source == 'auto' diff --git a/ansible_collections/community/sops/roles/install/tasks/github.yml b/ansible_collections/community/sops/roles/install/tasks/github.yml new file mode 100644 index 00000000..f5719220 --- /dev/null +++ b/ansible_collections/community/sops/roles/install/tasks/github.yml @@ -0,0 +1,50 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +- name: Make sure that sops can be installed from GitHub + ansible.builtin.fail: + msg: >- + Sops cannot be installed from GitHub for + {{ _community_sops_install_facts.distribution }} {{ _community_sops_install_facts.distribution_version }}. + when: not _community_sops_install_system_has_github + +- name: Start determining sops version + ansible.builtin.set_fact: + _community_sops_install_effective_sops_version: '{{ "" if sops_version == "latest" else sops_version }}' + +# This method uses the GitHub API, which is rate-limited. +- name: Determine latest version (fallback) + when: + - _community_sops_install_effective_sops_version == '' + - sops_github_latest_detection in ['auto', 'api'] + ansible.builtin.include_tasks: github_api.yml + +# This method asks GitHub for the latest release, which depends on the release to be +# correctly marked as "latest" in the GitHub UI. Fortunately this is not as aggressively +# rate-limited as the API (used in the fallback). +- name: Determine latest version + when: + - _community_sops_install_effective_sops_version == '' + - sops_github_latest_detection in ['auto', 'latest-release'] + ansible.builtin.include_tasks: github_latest_release.yml + +- name: Fail when latest version could not be selected + ansible.builtin.fail: + msg: Could not determine the latest GitHub release + when: _community_sops_install_effective_sops_version == '' + +- name: Show selected version + ansible.builtin.debug: + msg: The latest sops version is sops {{ _community_sops_install_effective_sops_version }}. + when: sops_version == 'latest' + +- name: Set variables + ansible.builtin.set_fact: + _community_sops_install_system_packages_actual: >- + {{ _community_sops_install_system_packages + _community_sops_install_system_packages_github }} + _community_sops_install_system_packages_unsigned_actual: >- + {{ _community_sops_install_system_packages_unsigned + _community_sops_install_system_packages_unsigned_github }} + _community_sops_install_system_package_deb_actual: >- + {{ _community_sops_install_system_package_deb_github }} diff --git a/ansible_collections/community/sops/roles/install/tasks/github_api.yml b/ansible_collections/community/sops/roles/install/tasks/github_api.yml new file mode 100644 index 00000000..01d9b77b --- /dev/null +++ b/ansible_collections/community/sops/roles/install/tasks/github_api.yml @@ -0,0 +1,38 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +- name: Fetch list of releases from GitHub + ansible.builtin.uri: + headers: + Accept: application/vnd.github+json + Authorization: "{{ ('Bearer ' ~ sops_github_token) if sops_github_token is defined and sops_github_token else '' }}" + status_code: + - 200 + - 403 # "HTTP Error 403: rate limit exceeded" + url: https://api.github.com/repos/mozilla/sops/releases + register: _community_sops_install_github_releases + delegate_to: localhost + run_once: true + +- name: In case rate limit was exceeded, inform user + ansible.builtin.debug: + msg: >- + Rate limit exceeded! Make sure to provide a GitHub token + as `sops_github_token` to reduce the chance of this error. + when: _community_sops_install_github_releases.status == 403 + +- name: Determine the latest release + ansible.builtin.set_fact: + _community_sops_install_effective_sops_version: >- + {{ + ( + _community_sops_install_github_releases.json + | rejectattr("prerelease") + | rejectattr("draft") + | map(attribute="tag_name") + | map("ansible.builtin.regex_replace", "^v", "") + | community.sops._latest_version + ) if _community_sops_install_github_releases.status == 200 else '' + }} diff --git a/ansible_collections/community/sops/roles/install/tasks/github_latest_release.yml b/ansible_collections/community/sops/roles/install/tasks/github_latest_release.yml new file mode 100644 index 00000000..ca67b3cd --- /dev/null +++ b/ansible_collections/community/sops/roles/install/tasks/github_latest_release.yml @@ -0,0 +1,34 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +- name: Fetch the latest release from GitHub + ansible.builtin.uri: + follow_redirects: false + status_code: + - 302 + - 307 + url: https://github.com/mozilla/sops/releases/latest/ + register: _community_sops_install_github_latest_release + delegate_to: localhost + run_once: true + +- name: Determine the latest release + ansible.builtin.set_fact: + _community_sops_install_effective_sops_version: >- + {{ + _community_sops_install_github_latest_release.location + | default("", true) + | ansible.builtin.regex_search("(?<=/releases/tag/)([0-9a-z._-]+)") + | default("", true) + | ansible.builtin.regex_replace("^v", "") + }} + +- name: In case this failed, inform user + ansible.builtin.debug: + msg: >- + Could not obtain latest version from https://github.com/mozilla/sops/releases/latest/. + Please create an issue in https://github.com/ansible-collections/community.sops/issues/ + if there is not already one. + when: _community_sops_install_effective_sops_version == '' diff --git a/ansible_collections/community/sops/roles/install/tasks/main.yml b/ansible_collections/community/sops/roles/install/tasks/main.yml new file mode 100644 index 00000000..548c8201 --- /dev/null +++ b/ansible_collections/community/sops/roles/install/tasks/main.yml @@ -0,0 +1,100 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +- name: Gather required information on localhost + when: sops_install_on_localhost + ansible.builtin.setup: + gather_subset: + - '!all' + - '!min' + - architecture + - distribution + - distribution_major_version + - distribution_version + - os_family + delegate_to: localhost + delegate_facts: true + run_once: true + +- vars: + _community_sops_install_facts: >- + {{ hostvars['localhost' if sops_install_on_localhost else inventory_hostname].ansible_facts }} + block: + - name: Show system information + ansible.builtin.debug: + msg: |- + Architecture: {{ _community_sops_install_facts.architecture }} + Distribution: {{ _community_sops_install_facts.distribution }} {{ _community_sops_install_facts.distribution_major_version }} + Distribution version: {{ _community_sops_install_facts.distribution_version }} + OS family: {{ _community_sops_install_facts.os_family }} + + - name: Include distribution specific variables + ansible.builtin.include_vars: '{{ lookup("ansible.builtin.first_found", params) }}' + vars: + params: + files: + - >- + D-{{ _community_sops_install_facts.distribution }}-{{ _community_sops_install_facts.distribution_version }}.yml + - >- + D-{{ _community_sops_install_facts.distribution }}-{{ _community_sops_install_facts.distribution_major_version }}.yml + - >- + D-{{ _community_sops_install_facts.distribution }}.yml + - >- + OS-{{ _community_sops_install_facts.os_family }}-{{ _community_sops_install_facts.distribution_major_version }}.yml + - >- + OS-{{ _community_sops_install_facts.os_family }}.yml + - default.yml + paths: + - '{{ role_path }}/vars' + + - name: Start determining source + ansible.builtin.set_fact: + _community_sops_install_effective_sops_source: '{{ sops_source }}' + + - name: Auto-detect source to install sops from + ansible.builtin.include_tasks: detect_source.yml + when: _community_sops_install_effective_sops_source == 'auto' + + - name: Install Mozilla sops from GitHub + ansible.builtin.include_tasks: github.yml + when: _community_sops_install_effective_sops_source == 'github' + + - name: Install Mozilla sops from system package repositories + ansible.builtin.include_tasks: system.yml + when: _community_sops_install_effective_sops_source == 'system' + + - name: Install system packages + ansible.builtin.package: + name: '{{ _community_sops_install_system_packages_actual }}' + allow_downgrade: '{{ true if _community_sops_install_allow_downgrade and sops_version != "latest" else omit }}' + become: '{{ sops_become_on_install }}' + delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}' + run_once: '{{ sops_install_on_localhost or omit }}' + when: _community_sops_install_system_packages_actual | length > 0 + + - name: Install unsigned system packages + ansible.builtin.package: + name: '{{ _community_sops_install_system_packages_unsigned_actual }}' + allow_downgrade: '{{ true if _community_sops_install_allow_downgrade and sops_version != "latest" else omit }}' + disable_gpg_check: true + become: '{{ sops_become_on_install }}' + delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}' + run_once: '{{ sops_install_on_localhost or omit }}' + when: _community_sops_install_system_packages_unsigned_actual | length > 0 + + - name: Install packages from URL/path (Debian) + ansible.builtin.apt: + deb: '{{ _community_sops_install_system_package_deb_actual }}' + allow_downgrade: '{{ true if _community_sops_install_allow_downgrade and sops_version != "latest" else omit }}' + become: '{{ sops_become_on_install }}' + delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}' + run_once: '{{ sops_install_on_localhost or omit }}' + when: _community_sops_install_system_package_deb_actual is string + + - name: Set results + ansible.builtin.set_fact: + sops_installed: true + delegate_to: '{{ "localhost" if sops_install_on_localhost else omit }}' + delegate_facts: '{{ true if sops_install_on_localhost else omit }}' diff --git a/ansible_collections/community/sops/roles/install/tasks/system.yml b/ansible_collections/community/sops/roles/install/tasks/system.yml new file mode 100644 index 00000000..bc82176c --- /dev/null +++ b/ansible_collections/community/sops/roles/install/tasks/system.yml @@ -0,0 +1,26 @@ +--- +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2022, Felix Fontein + +- name: Make sure that sops can be installed from system packages + ansible.builtin.fail: + msg: >- + Sops cannot be installed from system packages for + {{ _community_sops_install_facts.distribution }} {{ _community_sops_install_facts.distribution_version }}. + when: not _community_sops_install_system_has_system + +- name: Make sure that systems only supporting 'latest' are not told to install another version + ansible.builtin.fail: + msg: >- + Sops version {{ sops_version }} was requested, but we can only install latest sops from system packages. + when: sops_version != 'latest' and _community_sops_install_system_has_system_latest_only + +- name: Set variables + ansible.builtin.set_fact: + _community_sops_install_system_packages_actual: >- + {{ _community_sops_install_system_packages + _community_sops_install_system_packages_system }} + _community_sops_install_system_packages_unsigned_actual: >- + {{ _community_sops_install_system_packages_unsigned + _community_sops_install_system_packages_unsigned_system }} + _community_sops_install_system_package_deb_actual: >- + {{ _community_sops_install_system_package_deb_system }} diff --git a/ansible_collections/community/sops/roles/install/vars/D-Alpine.yml b/ansible_collections/community/sops/roles/install/vars/D-Alpine.yml new file mode 100644 index 00000000..27577c48 --- /dev/null +++ b/ansible_collections/community/sops/roles/install/vars/D-Alpine.yml @@ -0,0 +1,23 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_system_has_system: true +_community_sops_install_system_has_system_latest_only: true +_community_sops_install_system_has_github: false + +_community_sops_install_allow_downgrade: false + +_community_sops_install_system_packages: + - gpg +_community_sops_install_system_packages_unsigned: [] + +_community_sops_install_system_package_deb_github: false +_community_sops_install_system_packages_github: [] +_community_sops_install_system_packages_unsigned_github: [] + +_community_sops_install_system_package_deb_system: false +_community_sops_install_system_packages_system: + - sops +_community_sops_install_system_packages_unsigned_system: [] diff --git a/ansible_collections/community/sops/roles/install/vars/D-Archlinux.yml b/ansible_collections/community/sops/roles/install/vars/D-Archlinux.yml new file mode 100644 index 00000000..51e34a8d --- /dev/null +++ b/ansible_collections/community/sops/roles/install/vars/D-Archlinux.yml @@ -0,0 +1,23 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_system_has_system: true +_community_sops_install_system_has_system_latest_only: true +_community_sops_install_system_has_github: false + +_community_sops_install_allow_downgrade: false + +_community_sops_install_system_packages: + - gnupg +_community_sops_install_system_packages_unsigned: [] + +_community_sops_install_system_package_deb_github: false +_community_sops_install_system_packages_github: [] +_community_sops_install_system_packages_unsigned_github: [] + +_community_sops_install_system_package_deb_system: false +_community_sops_install_system_packages_system: + - sops +_community_sops_install_system_packages_unsigned_system: [] diff --git a/ansible_collections/community/sops/roles/install/vars/OS-Debian.yml b/ansible_collections/community/sops/roles/install/vars/OS-Debian.yml new file mode 100644 index 00000000..5f9cf260 --- /dev/null +++ b/ansible_collections/community/sops/roles/install/vars/OS-Debian.yml @@ -0,0 +1,31 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_system_has_system: false +_community_sops_install_system_has_system_latest_only: true +_community_sops_install_system_has_github: true + +_community_sops_install_allow_downgrade: '{{ ansible_version.full is version("2.12", ">=") }}' + +_community_sops_install_system_packages: + - gnupg +_community_sops_install_system_packages_unsigned: [] + +_community_sops_install_arch_transform: + x86_64: amd64 +_community_sops_install_system_package_deb_github: >- + https://github.com/mozilla/sops/releases/download/v{{ + _community_sops_install_effective_sops_version + }}/sops_{{ + _community_sops_install_effective_sops_version + }}_{{ + _community_sops_install_arch_transform.get(ansible_facts.architecture, ansible_facts.architecture) + }}.deb +_community_sops_install_system_packages_github: [] +_community_sops_install_system_packages_unsigned_github: [] + +_community_sops_install_system_package_deb_system: false +_community_sops_install_system_packages_system: [] +_community_sops_install_system_packages_unsigned_system: [] diff --git a/ansible_collections/community/sops/roles/install/vars/OS-RedHat.yml b/ansible_collections/community/sops/roles/install/vars/OS-RedHat.yml new file mode 100644 index 00000000..95f7d2ab --- /dev/null +++ b/ansible_collections/community/sops/roles/install/vars/OS-RedHat.yml @@ -0,0 +1,32 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_system_has_system: false +_community_sops_install_system_has_system_latest_only: true +_community_sops_install_system_has_github: true + +_community_sops_install_allow_downgrade: true + +_community_sops_install_system_packages: + - gnupg2 +_community_sops_install_system_packages_unsigned: [] + +_community_sops_install_system_package_deb_github: false +_community_sops_install_system_packages_github: [] +_community_sops_install_system_packages_unsigned_github: + - >- + https://github.com/mozilla/sops/releases/download/v{{ + _community_sops_install_effective_sops_version + }}/sops-{{ + (_community_sops_install_effective_sops_version is version('3.6.0', '<')) | ternary('v', '') + }}{{ + _community_sops_install_effective_sops_version + }}-1.{{ + ansible_facts.architecture + }}.rpm + +_community_sops_install_system_package_deb_system: false +_community_sops_install_system_packages_system: [] +_community_sops_install_system_packages_unsigned_system: [] diff --git a/ansible_collections/community/sops/roles/install/vars/default.yml b/ansible_collections/community/sops/roles/install/vars/default.yml new file mode 100644 index 00000000..24d14b18 --- /dev/null +++ b/ansible_collections/community/sops/roles/install/vars/default.yml @@ -0,0 +1,21 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +_community_sops_install_system_has_system: false +_community_sops_install_system_has_system_latest_only: true +_community_sops_install_system_has_github: false + +_community_sops_install_allow_downgrade: false + +_community_sops_install_system_packages: [] +_community_sops_install_system_packages_unsigned: [] + +_community_sops_install_system_package_deb_github: false +_community_sops_install_system_packages_github: [] +_community_sops_install_system_packages_unsigned_github: [] + +_community_sops_install_system_package_deb_system: false +_community_sops_install_system_packages_system: [] +_community_sops_install_system_packages_unsigned_system: [] diff --git a/ansible_collections/community/sops/tests/config.yml b/ansible_collections/community/sops/tests/config.yml new file mode 100644 index 00000000..38590f2e --- /dev/null +++ b/ansible_collections/community/sops/tests/config.yml @@ -0,0 +1,9 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +# See template for more information: +# https://github.com/ansible/ansible/blob/devel/test/lib/ansible_test/config/config.yml +modules: + python_requires: default diff --git a/ansible_collections/community/sops/tests/ee/all.yml b/ansible_collections/community/sops/tests/ee/all.yml new file mode 100644 index 00000000..c201a096 --- /dev/null +++ b/ansible_collections/community/sops/tests/ee/all.yml @@ -0,0 +1,25 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- hosts: localhost + tasks: + - name: Download sops test GPG key on localhost + get_url: + url: https://raw.githubusercontent.com/mozilla/sops/master/pgp/sops_functional_tests_key.asc + dest: /tmp/sops_functional_tests_key.asc + - name: Import sops test GPG key on localhost + command: gpg --import /tmp/sops_functional_tests_key.asc + ignore_errors: true + - name: Find all roles + find: + paths: + - "{{ (playbook_dir | default('.')) ~ '/roles' }}" + file_type: directory + depth: 1 + register: result + - name: Include all roles + include_role: + name: "{{ item }}" + loop: "{{ result.files | map(attribute='path') | map('regex_replace', '.*/', '') | sort }}" diff --git a/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/.sops.yaml b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/.sops.yaml new file mode 100644 index 00000000..e28ce962 --- /dev/null +++ b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/.sops.yaml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +creation_rules: + - pgp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 diff --git a/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/simple.sops.yaml b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/simple.sops.yaml new file mode 100644 index 00000000..d7bfc2ea --- /dev/null +++ b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/simple.sops.yaml @@ -0,0 +1,25 @@ +foo: ENC[AES256_GCM,data:a25L,iv:X8ILHZr+YiyLWa90Y+cwoMD1nVuel7JyTs0A5+oiOOo=,tag:GbBtp+Yqx1KEjdyztqS4EQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-02-20T10:44:32Z' + mac: ENC[AES256_GCM,data:BAwQqD9sHgHkmlxPQLKq28Xy48qPp1B/+GDLEsIxir6WNhZgw8OgjVF1u/wCAad6qHkmN02Bwenr+aay6uKfCuOEsTRSvZ7v80yAU+h0wL3zJ/KMkRsE3QP3CWxcLQxInt+YaBjR+Q0IUjDXKm3u6ZomixZe5F5pwWr36ErV6Y0=,iv:e/iiyXQiCh8C2w/bc8mr/Psv+ehmqEMqEC1/bbGFHpY=,tag:NSDo2HISIBJhYvsqrU0mSA==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/simple.sops.yaml.license b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/simple.sops.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/simple.sops.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/wrong.yaml b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/wrong.yaml new file mode 100644 index 00000000..2df12739 --- /dev/null +++ b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/wrong.yaml @@ -0,0 +1,2 @@ +--- +this-is-not: a sops file diff --git a/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/wrong.yaml.license b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/wrong.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/files/wrong.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/ee/roles/lookup_sops/tasks/main.yml b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/tasks/main.yml new file mode 100644 index 00000000..436af5e0 --- /dev/null +++ b/ansible_collections/community/sops/tests/ee/roles/lookup_sops/tasks/main.yml @@ -0,0 +1,47 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Test lookup with missing file + set_fact: + sops_file_does_not_exists: "{{ lookup('community.sops.sops', 'file-does-not-exists.sops.yml') }}" + ignore_errors: true + register: sops_lookup_missing_file + +- assert: + that: + - "sops_lookup_missing_file is failed" + - "'could not locate file in lookup: file-does-not-exists.sops.yml' in sops_lookup_missing_file.msg" + +- name: Test lookup with missing file with empty_on_not_exist + set_fact: + sops_file_does_not_exists_empty: "{{ lookup('community.sops.sops', 'file-does-not-exists.sops.yml', empty_on_not_exist=true) }}" + register: sops_lookup_missing_file_empty_on_not_exist + +- assert: + that: + - "sops_lookup_missing_file_empty_on_not_exist is success" + - "sops_file_does_not_exists_empty == ''" + +- name: Test lookup of non-sops file + set_fact: + sops_wrong_file: "{{ lookup('community.sops.sops', 'wrong.yaml') }}" + ignore_errors: true + register: sops_lookup_wrong_file + +- assert: + that: + - "sops_lookup_wrong_file is failed" + - "'sops metadata not found' in sops_lookup_wrong_file.msg" + +- name: Test simple lookup + set_fact: + sops_success: "{{ lookup('community.sops.sops', 'simple.sops.yaml') }}" + ignore_errors: true + register: sops_lookup_simple + +- assert: + that: + - "sops_lookup_simple is success" + - "sops_success == 'foo: bar'" diff --git a/ansible_collections/community/sops/tests/integration/targets/age/aliases b/ansible_collections/community/sops/tests/integration/targets/age/aliases new file mode 100644 index 00000000..3a9daf6c --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/age/aliases @@ -0,0 +1,8 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +gha/main +skip/aix +skip/osx +skip/freebsd diff --git a/ansible_collections/community/sops/tests/integration/targets/age/meta/main.yml b/ansible_collections/community/sops/tests/integration/targets/age/meta/main.yml new file mode 100644 index 00000000..344e8b86 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/age/meta/main.yml @@ -0,0 +1,8 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +dependencies: + - setup_sops + - setup_remote_tmp_dir diff --git a/ansible_collections/community/sops/tests/integration/targets/age/tasks/main.yml b/ansible_collections/community/sops/tests/integration/targets/age/tasks/main.yml new file mode 100644 index 00000000..a48c847e --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/age/tasks/main.yml @@ -0,0 +1,87 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Get sops version + command: sops --version + when: sops_installed + register: installed_sops_version + +- name: Determine whether sops, age, and sops with age are supported + set_fact: + supports_sops_and_age: >- + {{ sops_installed and age_installed and (installed_sops_version.stdout | regex_search('sops (\d+\.\d+\.\d+)', '\1') | first) is version('3.7.0', '>=') }} + +- when: supports_sops_and_age + block: + - name: Create local temporary directory + tempfile: + state: directory + suffix: .test + delegate_to: localhost + register: local_tmp_dir + + - name: Record local temporary directory + set_fact: + local_tmp_dir: "{{ local_tmp_dir.path }}" + + - name: Create age keys + command: age-keygen --output {{ local_tmp_dir }}/{{ item }} + delegate_to: localhost + loop: + - identity_1 + - identity_2 + - identity_3 + - identity_4 + + - vars: + identity_files: + - name: identities_all + id_files: + - identity_1 + - identity_2 + - identity_3 + - identity_4 + - name: identities_1_2_3 + id_files: + - identity_1 + - identity_2 + - identity_3 + - name: identities_4 + id_files: + - identity_4 + block: + - name: Create local identity files + copy: + dest: '{{ local_tmp_dir }}/{{ item.name }}' + content: | + {% for id_file in item.id_files %} + {{ lookup('file', local_tmp_dir ~ '/' ~ id_file) }} + {% endfor %} + delegate_to: localhost + loop: '{{ identity_files }}' + + - name: Create remote identity files + copy: + dest: '{{ remote_tmp_dir }}/{{ item.name }}' + content: | + {% for id_file in item.id_files %} + {{ lookup('file', local_tmp_dir ~ '/' ~ id_file) }} + {% endfor %} + loop: '{{ identity_files }}' + + - name: Read identity public keys + set_fact: + identity_1: "{{ lookup('file', local_tmp_dir ~ '/identity_1') | regex_search('public key: ([a-zA-Z0-9]+)', '\\1') | first }}" + identity_2: "{{ lookup('file', local_tmp_dir ~ '/identity_2') | regex_search('public key: ([a-zA-Z0-9]+)', '\\1') | first }}" + identity_3: "{{ lookup('file', local_tmp_dir ~ '/identity_3') | regex_search('public key: ([a-zA-Z0-9]+)', '\\1') | first }}" + identity_4: "{{ lookup('file', local_tmp_dir ~ '/identity_4') | regex_search('public key: ([a-zA-Z0-9]+)', '\\1') | first }}" + + - include_tasks: test.yml + always: + - name: Delete temporary directory + file: + path: '{{ local_tmp_dir }}' + state: absent + delegate_to: localhost diff --git a/ansible_collections/community/sops/tests/integration/targets/age/tasks/test.yml b/ansible_collections/community/sops/tests/integration/targets/age/tasks/test.yml new file mode 100644 index 00000000..85f3cb15 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/age/tasks/test.yml @@ -0,0 +1,122 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Create encrypted files + sops_encrypt: + path: '{{ remote_tmp_dir }}/{{ item.name }}.sops.yaml' + age: '{{ item.identities }}' + age_keyfile: '{{ remote_tmp_dir }}/identities_all' + content_yaml: '{{ item.data }}' + loop: '{{ data }}' + vars: + data: + - name: enc-1 + identities: + - '{{ identity_1 }}' + - '{{ identity_2 }}' + - '{{ identity_3 }}' + - '{{ identity_4 }}' + data: + foo: bar + baz: this is a secret + bam: true + int: 3 + - name: enc-2 + identities: + - '{{ identity_1 }}' + - '{{ identity_2 }}' + - '{{ identity_4 }}' + data: + foo: 19 + bar: this is another secret + - name: enc-3 + identities: + - '{{ identity_4 }}' + data: + foo: 23 + +- name: Copy encrypted files to localhost + fetch: + src: '{{ remote_tmp_dir }}/{{ item }}.sops.yaml' + dest: '{{ local_tmp_dir }}/' + flat: true + loop: + - enc-1 + - enc-2 + - enc-3 + +- name: Decrypt some data + set_fact: + decrypt_1: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identities_all') | from_yaml }}" + decrypt_1_1: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_1') | from_yaml }}" + decrypt_1_2: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_2') | from_yaml }}" + decrypt_1_3: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_3') | from_yaml }}" + decrypt_1_4: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_4') | from_yaml }}" + decrypt_1_1_2_3: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_keyfile=local_tmp_dir ~ '/identities_1_2_3') | from_yaml }}" + decrypt_1b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identities_all')) | from_yaml }}" + decrypt_1_1b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identity_1')) | from_yaml }}" + decrypt_1_2b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identity_2')) | from_yaml }}" + decrypt_1_3b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identity_3')) | from_yaml }}" + decrypt_1_4b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identity_4')) | from_yaml }}" + decrypt_1_1_2_3b: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-1.sops.yaml', age_key=lookup('file', local_tmp_dir ~ '/identities_1_2_3')) | from_yaml }}" + decrypt_2: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identities_all') | from_yaml }}" + decrypt_2_1: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_1') | from_yaml }}" + decrypt_2_2: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_2') | from_yaml }}" + decrypt_2_4: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_4') | from_yaml }}" + decrypt_2_1_2_3: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identities_1_2_3') | from_yaml }}" + decrypt_3: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-3.sops.yaml', age_keyfile=local_tmp_dir ~ '/identities_all') | from_yaml }}" + decrypt_3_4: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-3.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_4') | from_yaml }}" + +- name: Validate decryption + assert: + that: + - decrypt_1.foo == 'bar' + - decrypt_1.baz == 'this is a secret' + - decrypt_1.bam == true + - decrypt_1.int == 3 + - decrypt_1 == decrypt_1_1 + - decrypt_1 == decrypt_1_2 + - decrypt_1 == decrypt_1_3 + - decrypt_1 == decrypt_1_4 + - decrypt_1 == decrypt_1_1_2_3 + - decrypt_1 == decrypt_1b + - decrypt_1 == decrypt_1_1b + - decrypt_1 == decrypt_1_2b + - decrypt_1 == decrypt_1_3b + - decrypt_1 == decrypt_1_4b + - decrypt_1 == decrypt_1_1_2_3b + - decrypt_2.foo == 19 + - decrypt_2.bar == 'this is another secret' + - decrypt_2.bam is undefined + - decrypt_2.int is undefined + - decrypt_2 == decrypt_2_1 + - decrypt_2 == decrypt_2_2 + - decrypt_2 == decrypt_2_4 + - decrypt_2 == decrypt_2_1_2_3 + - decrypt_3.foo == 23 + - decrypt_3.bar is undefined + - decrypt_3.bam is undefined + - decrypt_3.int is undefined + - decrypt_3 == decrypt_3_4 + +- name: Failed encryption 1 + debug: + msg: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-2.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_3') | from_yaml }}" + ignore_errors: true + register: failure_1 + +- name: Failed encryption 2 + debug: + msg: "{{ lookup('community.sops.sops', local_tmp_dir ~ '/enc-3.sops.yaml', age_keyfile=local_tmp_dir ~ '/identity_1') | from_yaml }}" + ignore_errors: true + register: failure_2 + +- name: Validate failed decryption + assert: + that: + - failure_1 is failed + - "'CouldNotRetrieveKey' in failure_1.msg" + - failure_2 is failed + - "'CouldNotRetrieveKey' in failure_2.msg" diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/aliases b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/aliases new file mode 100644 index 00000000..977ec388 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/aliases @@ -0,0 +1,9 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +gha/main +skip/aix +skip/osx +skip/freebsd +skip/python2.6 # lookups are controller only, and we no longer support Python 2.6 on the controller diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/.sops.yaml b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/.sops.yaml new file mode 100644 index 00000000..e28ce962 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/.sops.yaml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +creation_rules: + - pgp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/binary.sops b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/binary.sops new file mode 100644 index 00000000..af344ef2 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/binary.sops @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:TrEN6YJBOg==,iv:aUozScYsBrM4khbqD2lMbGpEEXXO0Vy8YytBoG4HIf4=,tag:JlLZHqj2fsTi6v1rGeaxWw==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-02T18:26:32Z", + "mac": "ENC[AES256_GCM,data:m4PPDNMYOPcDECiKJLF9Hg4jIInHj/xpj5bnGUkQxMm4XO2CDPal9g1FwTzwjOK9rXLUkdhWc8FuRh542EviVV8vOyUkjVAwN0x0bpXodBXB5r/9PPDwtObe/CUWnjo90Ow7IuX/BnQI6lf1sdPHf0MeTjGN9/l7tr6xg+92bIc=,iv:7q+TxZ65n2a+Vdb9KY6ISX92c1lEG2yTpa9KCt/QcUk=,tag:uR1AfcNd1dvH6LZy2oBDiw==,type:str]", + "pgp": [ + { + "created_at": "2020-10-02T18:26:31Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAR4QrVAJ5LhfX41457whWBdB74/O4OEZ76CkUGBvCVkGb\nHjJf9PAHFYH12UVnHEK3ZHKxKrVKPM2Pf3hsMGPuruS2wDuCWLteuMfQtlvCg1Xv\nLxiOfyEUEFc7Rl7uKmvni7XBeexIYN0DpxYa1Paz28ptQJCxZ84FK9y2jrFg2bUF\nq8R1JSTiY+YDXQBKSw3XgdJjjX2Yrpe85BV/l7pgREcwKEG4ZIU8n/zH2mgCObxp\nVfa50dAs5mfooU4g+xF34INhk7L+JPF0EBAbdrPyiw/7220dQSfCW0K3rgQkL1ZE\nB0wjH3S2anRO5t8E4S/YvXerq8LwtpCMczflLsCZ89LgAeStGGLFgZU53ASmq2dt\nqwQw4dCY4CngwuG/PuCt4nYV6VPgz+V+txpuq/aKQvcuFNhGsRtm4oP/vUlhqZQA\nivnqgO/DveCH5MxW9oMGLnYj4Jkbp0gRyALiqwNRz+HfSgA=\n=3dNe\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/binary.sops.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/binary.sops.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/binary.sops.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/fake-sops-rep.sh b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/fake-sops-rep.sh new file mode 100755 index 00000000..0c1ab43f --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/fake-sops-rep.sh @@ -0,0 +1,14 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +if [ "$1" != "--keyservice" ] || [ "$2" != "a" ] || [ "$3" != "--keyservice" ] || [ "$4" != "b" ] || [ "$5" != "--input-type" ] || [ "$6" != "yaml" ] || [ "$7" != "--output-type" ] || [ "$8" != "yaml" ] || [ "$9" != "--decrypt" ] || [ "${10}" != "/dev/stdin" ] || [ "${11}" != "" ]; then + echo "Command (fake-sops-rep): $*" > /dev/stderr + exit 1 +fi +if [ "${AWS_SESSION_TOKEN}" != "zzz" ]; then + echo "AWS_SESSION_TOKEN is '${AWS_SESSION_TOKEN}'" > /dev/stderr + exit 1 +fi +echo 'fake sops output 3' diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/fake-sops-val.sh b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/fake-sops-val.sh new file mode 100755 index 00000000..6e8b3667 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/fake-sops-val.sh @@ -0,0 +1,14 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +if [ "$1" != "--config" ] || [ "$2" != "/path/to/asdf" ] || [ "$3" != "--input-type" ] || [ "$4" != "yaml" ] || [ "$5" != "--output-type" ] || [ "$6" != "yaml" ] || [ "$7" != "--decrypt" ] || [ "$8" != "/dev/stdin" ] || [ "$9" != "" ]; then + echo "Command (fake-sops-val): $*" > /dev/stderr + exit 1 +fi +if [ "${AWS_SECRET_ACCESS_KEY}" != "yyy" ]; then + echo "AWS_SECRET_ACCESS_KEY is '${AWS_SECRET_ACCESS_KEY}'" > /dev/stderr + exit 1 +fi +echo 'fake sops output 2' diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/fake-sops.sh b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/fake-sops.sh new file mode 100755 index 00000000..4c6985d0 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/fake-sops.sh @@ -0,0 +1,14 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +if [ "$1" != "--enable-local-keyservice" ] || [ "$2" != "--input-type" ] || [ "$3" != "yaml" ] || [ "$4" != "--output-type" ] || [ "$5" != "yaml" ] || [ "$6" != "--decrypt" ] || [ "$7" != "/dev/stdin" ] || [ "$8" != "" ]; then + echo "Command (fake-sops): $*" > /dev/stderr + exit 1 +fi +if [ "${AWS_ACCESS_KEY_ID}" != "xxx" ]; then + echo "AWS_ACCESS_KEY_ID is '${AWS_ACCESS_KEY_ID}'" > /dev/stderr + exit 1 +fi +echo 'fake sops output' diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary new file mode 100644 index 00000000..5f1a9a9b --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:oJurKkZjXi4HVqV51shzRbl8,iv:OIg1gqchya6dMQtjYTMBeEfcddQLCtxL+ONnhR0jXEo=,tag:z0toZPLcUG3ZWB/tu59tqQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:46Z", + "mac": "ENC[AES256_GCM,data:fIH8AhiNyca43zDcKRFy5vkTHHY/OyWA1LXRCPRUJyHSFu8TQwJJ+7+5c7F/mI3P3exNjWv+sG53VAcxImqRsrd98QhllLJ6OjnVxpwKFTOjLJWfsvPEmoD+TpCnpuKxZSk303j2jCnIJ2cW0gOpPiUjm6LQ7JroMrBXKki71Ss=,iv:qM2PPktRKd7E5e1xmvmJzRaHnIOFk3dkaQ38Gg8idiw=,tag:ki7fs/rDf6vovyqBknVVHA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:39Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAfr3xj1fG9yF91g+WMV1SG1dA+vR+nDkuGdNq3mn88660\nKiXOkEA8A6FrSpstKqsUb9Q6cotYiq3ld3dGPHve0AP9KzWvZEcogCpuk+CKaTnh\nimswI1Rr7jxZ9DecGn2koS07nGhNCXSdy2eAy0pDHpXbJnmb0CgHMXISeXiBZfs8\n19NtCMpcTbek4uR5jhazd0zSZWf1Gxls6pupBNaapwX0YyY+4cxc9O/spgDBd/R8\nrGNVOlA8svOnBQ8G0Ha+mn4p8ia7diSmPorRw1OGT9fJqnveVGsqk71rwem/5lv0\nEGSdXeYazjMP6Vlx0AaVBJFDNas9ozH3FMX2BRqWJNLgAeQE2dWrcbysQIi+QS6v\nfn3a4XYH4BzgcuHoQuAU4jqpMC3gv+UpiN+WK/Vc4Df/iMWQJB9uUm5iEbPRWwQx\n29a574BPbeBk5FxrDyMROm9YKb9GKa0F6WrimK5sdeF6VgA=\n=lJUR\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml new file mode 100644 index 00000000..8ac6f945 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml @@ -0,0 +1,26 @@ +data: ENC[AES256_GCM,data:Mf66wk+/MdrPhiG3WMYkfTcs5Fdl,iv:r/CUJSou0b0w3pF7i3heDecV49jn82pTw2oQrMYModI=,tag:y342mhP4BfgsI5feBsJgoA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:25:54Z' + mac: ENC[AES256_GCM,data:srcP514/YUzHZErkByGupUKTF/QqfbzGkNC4Ojmyks5lHw0yWcz7T0GvuZEvXfrHAKUdBYjgaKvQnmed7CfBg5zlb8PL7Pg8b36WPM27EAJkAJzJG39xBov2u8l6sK7JcXMO31qIgzJDhPGsPfkk8yqs45EQC43DmYKU8dZkVaU=,iv:v8MeNADiPdl4fQPwfMSX12y3M0WoP7+9OXF4BWM8bkM=,tag:bXBIzoRtKydGp56fOTTctQ==,type:str] + pgp: + - created_at: '2020-10-07T20:25:49Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAb66JsAFfpWA1r11UevicTHKtZ6U8aT4wLlOWK9JilyTc + YlS0SfoU8v/CKbTlMndskCQOlhdK7b3LJG294/Gj6+v1bAz/yC9ivxmO/WeLupsl + XlcxrbMJcUASq0qsh4XYOhbNt1p47Ay5to8Ov+K/vPwA1a1QbsO5YbtMVrqQGNor + SoThRkVQ51yaxvIMStHXqPKuq4hdn4//pa+afThvbCCEopyc4SYbKXgNTX7+l7+N + r2LOKzDxg/koVN1HSpQ+kBDXiF4i4zSaBPBXN35Tv1y4vC0KUzdzVWiekMWksOqA + 5ibGSLPhoOzIIz/Vda2t5o2LMeCaa36VXSbcXoL3i9LgAeQuZoNyyhrfwBOhARbi + ge7d4Q+o4ODgOOFSjeCr4msn9j3gCOX4+rKE2e9ZSFmSZzGv2vgWEo+h6qDxN29A + m2vhUzvrd+Br5DZRGB3LtEr3O4/lAN8DfwriyUDGKOEKRgA= + =4sXd + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.json b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.json new file mode 100644 index 00000000..8ac6f945 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.json @@ -0,0 +1,26 @@ +data: ENC[AES256_GCM,data:Mf66wk+/MdrPhiG3WMYkfTcs5Fdl,iv:r/CUJSou0b0w3pF7i3heDecV49jn82pTw2oQrMYModI=,tag:y342mhP4BfgsI5feBsJgoA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:25:54Z' + mac: ENC[AES256_GCM,data:srcP514/YUzHZErkByGupUKTF/QqfbzGkNC4Ojmyks5lHw0yWcz7T0GvuZEvXfrHAKUdBYjgaKvQnmed7CfBg5zlb8PL7Pg8b36WPM27EAJkAJzJG39xBov2u8l6sK7JcXMO31qIgzJDhPGsPfkk8yqs45EQC43DmYKU8dZkVaU=,iv:v8MeNADiPdl4fQPwfMSX12y3M0WoP7+9OXF4BWM8bkM=,tag:bXBIzoRtKydGp56fOTTctQ==,type:str] + pgp: + - created_at: '2020-10-07T20:25:49Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAb66JsAFfpWA1r11UevicTHKtZ6U8aT4wLlOWK9JilyTc + YlS0SfoU8v/CKbTlMndskCQOlhdK7b3LJG294/Gj6+v1bAz/yC9ivxmO/WeLupsl + XlcxrbMJcUASq0qsh4XYOhbNt1p47Ay5to8Ov+K/vPwA1a1QbsO5YbtMVrqQGNor + SoThRkVQ51yaxvIMStHXqPKuq4hdn4//pa+afThvbCCEopyc4SYbKXgNTX7+l7+N + r2LOKzDxg/koVN1HSpQ+kBDXiF4i4zSaBPBXN35Tv1y4vC0KUzdzVWiekMWksOqA + 5ibGSLPhoOzIIz/Vda2t5o2LMeCaa36VXSbcXoL3i9LgAeQuZoNyyhrfwBOhARbi + ge7d4Q+o4ODgOOFSjeCr4msn9j3gCOX4+rKE2e9ZSFmSZzGv2vgWEo+h6qDxN29A + m2vhUzvrd+Br5DZRGB3LtEr3O4/lAN8DfwriyUDGKOEKRgA= + =4sXd + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.json.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.yaml b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.yaml new file mode 100644 index 00000000..b6175280 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.yaml @@ -0,0 +1,26 @@ +data: ENC[AES256_GCM,data:Mf66wk+/MdrPhiG3WMYkfTcs5Fdl,iv:r/CUJSou0b0w3pF7i3heDecV49jn82pTw2oQrMYModI=,tag:y342mhP4BfgsI5feBsJgoA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:25:54Z' + mac: ENC[AES256_GCM,data:srcP514/YUzHZErkByGupUKTF/QqfbzGkNC4Ojmyks5lHw0yWcz7T0GvuZEvXfrHAKUdBYjgaKvQnmed7CfBg5zlb8PL7Pg8b36WPM27EAJkAJzJG39xBov2u8l6sK7JcXMO31qIgzJDhPGsPfkk8yqs45EQC43DmYKU8dZkVaU=,iv:v8MeNADiPdl4fQPwfMSX12y3M0WoP7+9OXF4BWM8bkM=,tag:bXBIzoRtKydGp56fOTTctQ==,type:str] + pgp: + - created_at: '2020-10-07T20:25:49Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAb66JsAFfpWA1r11UevicTHKtZ6U8aT4wLlOWK9JilyTc + YlS0SfoU8v/CKbTlMndskCQOlhdK7b3LJG294/Gj6+v1bAz/yC9ivxmO/WeLupsl + XlcxrbMJcUASq0qsh4XYOhbNt1p47Ay5to8Ov+K/vPwA1a1QbsO5YbtMVrqQGNor + SoThRkVQ51yaxvIMStHXqPKuq4hdn4//pa+afThvbCCEopyc4SYbKXgNTX7+l7+N + r2LOKzDxg/koVN1HSpQ+kBDXiF4i4zSaBPBXN35Tv1y4vC0KUzdzVWiekMWksOqA + 5ibGSLPhoOzIIz/Vda2t5o2LMeCaa36VXSbcXoL3i9LgAeQuZoNyyhrfwBOhARbi + ge7d4Q+o4ODgOOFSjeCr4msn9j3gCOX4+rKE2e9ZSFmSZzGv2vgWEo+h6qDxN29A + m2vhUzvrd+Br5DZRGB3LtEr3O4/lAN8DfwriyUDGKOEKRgA= + =4sXd + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.yaml.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary-yaml.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.json b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.json new file mode 100644 index 00000000..5f1a9a9b --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.json @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:oJurKkZjXi4HVqV51shzRbl8,iv:OIg1gqchya6dMQtjYTMBeEfcddQLCtxL+ONnhR0jXEo=,tag:z0toZPLcUG3ZWB/tu59tqQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:46Z", + "mac": "ENC[AES256_GCM,data:fIH8AhiNyca43zDcKRFy5vkTHHY/OyWA1LXRCPRUJyHSFu8TQwJJ+7+5c7F/mI3P3exNjWv+sG53VAcxImqRsrd98QhllLJ6OjnVxpwKFTOjLJWfsvPEmoD+TpCnpuKxZSk303j2jCnIJ2cW0gOpPiUjm6LQ7JroMrBXKki71Ss=,iv:qM2PPktRKd7E5e1xmvmJzRaHnIOFk3dkaQ38Gg8idiw=,tag:ki7fs/rDf6vovyqBknVVHA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:39Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAfr3xj1fG9yF91g+WMV1SG1dA+vR+nDkuGdNq3mn88660\nKiXOkEA8A6FrSpstKqsUb9Q6cotYiq3ld3dGPHve0AP9KzWvZEcogCpuk+CKaTnh\nimswI1Rr7jxZ9DecGn2koS07nGhNCXSdy2eAy0pDHpXbJnmb0CgHMXISeXiBZfs8\n19NtCMpcTbek4uR5jhazd0zSZWf1Gxls6pupBNaapwX0YyY+4cxc9O/spgDBd/R8\nrGNVOlA8svOnBQ8G0Ha+mn4p8ia7diSmPorRw1OGT9fJqnveVGsqk71rwem/5lv0\nEGSdXeYazjMP6Vlx0AaVBJFDNas9ozH3FMX2BRqWJNLgAeQE2dWrcbysQIi+QS6v\nfn3a4XYH4BzgcuHoQuAU4jqpMC3gv+UpiN+WK/Vc4Df/iMWQJB9uUm5iEbPRWwQx\n29a574BPbeBk5FxrDyMROm9YKb9GKa0F6WrimK5sdeF6VgA=\n=lJUR\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.json.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.yaml b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.yaml new file mode 100644 index 00000000..5f1a9a9b --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.yaml @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:oJurKkZjXi4HVqV51shzRbl8,iv:OIg1gqchya6dMQtjYTMBeEfcddQLCtxL+ONnhR0jXEo=,tag:z0toZPLcUG3ZWB/tu59tqQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:46Z", + "mac": "ENC[AES256_GCM,data:fIH8AhiNyca43zDcKRFy5vkTHHY/OyWA1LXRCPRUJyHSFu8TQwJJ+7+5c7F/mI3P3exNjWv+sG53VAcxImqRsrd98QhllLJ6OjnVxpwKFTOjLJWfsvPEmoD+TpCnpuKxZSk303j2jCnIJ2cW0gOpPiUjm6LQ7JroMrBXKki71Ss=,iv:qM2PPktRKd7E5e1xmvmJzRaHnIOFk3dkaQ38Gg8idiw=,tag:ki7fs/rDf6vovyqBknVVHA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:39Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAfr3xj1fG9yF91g+WMV1SG1dA+vR+nDkuGdNq3mn88660\nKiXOkEA8A6FrSpstKqsUb9Q6cotYiq3ld3dGPHve0AP9KzWvZEcogCpuk+CKaTnh\nimswI1Rr7jxZ9DecGn2koS07nGhNCXSdy2eAy0pDHpXbJnmb0CgHMXISeXiBZfs8\n19NtCMpcTbek4uR5jhazd0zSZWf1Gxls6pupBNaapwX0YyY+4cxc9O/spgDBd/R8\nrGNVOlA8svOnBQ8G0Ha+mn4p8ia7diSmPorRw1OGT9fJqnveVGsqk71rwem/5lv0\nEGSdXeYazjMP6Vlx0AaVBJFDNas9ozH3FMX2BRqWJNLgAeQE2dWrcbysQIi+QS6v\nfn3a4XYH4BzgcuHoQuAU4jqpMC3gv+UpiN+WK/Vc4Df/iMWQJB9uUm5iEbPRWwQx\n29a574BPbeBk5FxrDyMROm9YKb9GKa0F6WrimK5sdeF6VgA=\n=lJUR\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.yaml.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-binary.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json new file mode 100644 index 00000000..61dc55e9 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json @@ -0,0 +1,21 @@ +{ + "a": "ENC[AES256_GCM,data:/Q==,iv:q+yypwZjX2frKGNruAFF+XSnmz+IU3AQ5XuUMWhhyhA=,tag:skm5wsq8a3/EESLVic8yKw==,type:str]", + "c": "ENC[AES256_GCM,data:DQ==,iv:JvvR1pXyp6L+i4keXDwLM79oxP6K1nqeGkIC5OgR38c=,tag:QbtjRLx47fN5M4+zaaQBVA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:33Z", + "mac": "ENC[AES256_GCM,data:rbWY/H6bj2UFpybJHqsS02wjy8VMvNvzQUtd6fBMSsvvv1fYWWoULO32LGA635spoFkVyOpX4hipqVyjRfQ1KyP1rNssggaHMz+nRUUFOmiQAcT9wi/Y0IKWjgN1cjI1stCU10b5cfJZQ0SPi/OFC8KcptMaHpfDVF47ZfnprFs=,iv:rVtp2Ti4xHNOWeS4MKju1jFZ/VyE7oXXdTSpp4jSU34=,tag:kd0IeyLXY598kdvSX0+1DA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:18Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAPQ6Bn3MlvYUPs+e0njFUoq4AZAhR38BIWGAzTAMeWfIH\n0JZwol5f1leoyKX5Bmye1S+n72zZz3C4FxhSqh80boxNpHuVyeLrAkzv25AaAS8Q\n/9mSYquvJcIL7nWX/QmgTVTaXrqlxZSVva6Slwf7zlaLBqVJfv1RDwT6JEWDIJig\nJp35PKpwRe70IZDGAelcDtJicmjQrvfVhyb1/0kTTv4JdylixVnQdh9X/zw5ZSBG\nusEW/JG9nZ/xzKsEQpafCBLhP80jx3z37zKbsJ+4K2xsBTGQQdU5KdDSnosw/L/b\nHlOCwaMQgb/dQPA5fpwVyGnVas6GK7gQvzznHAiHc9LgAeT0brybsEaAPOuA94/V\nA/ny4cub4Mzg0eFWf+C94i6lS1/gtuWI2PEva3259aEycV6gpYSOoPh3tYlBoVlM\ntj01l2eYfeBn5MNIWuhqfGTL4mLuzfiYsvnigdvTsOEIwgA=\n=yKCo\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.json b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.json new file mode 100644 index 00000000..61dc55e9 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.json @@ -0,0 +1,21 @@ +{ + "a": "ENC[AES256_GCM,data:/Q==,iv:q+yypwZjX2frKGNruAFF+XSnmz+IU3AQ5XuUMWhhyhA=,tag:skm5wsq8a3/EESLVic8yKw==,type:str]", + "c": "ENC[AES256_GCM,data:DQ==,iv:JvvR1pXyp6L+i4keXDwLM79oxP6K1nqeGkIC5OgR38c=,tag:QbtjRLx47fN5M4+zaaQBVA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:33Z", + "mac": "ENC[AES256_GCM,data:rbWY/H6bj2UFpybJHqsS02wjy8VMvNvzQUtd6fBMSsvvv1fYWWoULO32LGA635spoFkVyOpX4hipqVyjRfQ1KyP1rNssggaHMz+nRUUFOmiQAcT9wi/Y0IKWjgN1cjI1stCU10b5cfJZQ0SPi/OFC8KcptMaHpfDVF47ZfnprFs=,iv:rVtp2Ti4xHNOWeS4MKju1jFZ/VyE7oXXdTSpp4jSU34=,tag:kd0IeyLXY598kdvSX0+1DA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:18Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAPQ6Bn3MlvYUPs+e0njFUoq4AZAhR38BIWGAzTAMeWfIH\n0JZwol5f1leoyKX5Bmye1S+n72zZz3C4FxhSqh80boxNpHuVyeLrAkzv25AaAS8Q\n/9mSYquvJcIL7nWX/QmgTVTaXrqlxZSVva6Slwf7zlaLBqVJfv1RDwT6JEWDIJig\nJp35PKpwRe70IZDGAelcDtJicmjQrvfVhyb1/0kTTv4JdylixVnQdh9X/zw5ZSBG\nusEW/JG9nZ/xzKsEQpafCBLhP80jx3z37zKbsJ+4K2xsBTGQQdU5KdDSnosw/L/b\nHlOCwaMQgb/dQPA5fpwVyGnVas6GK7gQvzznHAiHc9LgAeT0brybsEaAPOuA94/V\nA/ny4cub4Mzg0eFWf+C94i6lS1/gtuWI2PEva3259aEycV6gpYSOoPh3tYlBoVlM\ntj01l2eYfeBn5MNIWuhqfGTL4mLuzfiYsvnigdvTsOEIwgA=\n=yKCo\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.json.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.yaml b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.yaml new file mode 100644 index 00000000..61dc55e9 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.yaml @@ -0,0 +1,21 @@ +{ + "a": "ENC[AES256_GCM,data:/Q==,iv:q+yypwZjX2frKGNruAFF+XSnmz+IU3AQ5XuUMWhhyhA=,tag:skm5wsq8a3/EESLVic8yKw==,type:str]", + "c": "ENC[AES256_GCM,data:DQ==,iv:JvvR1pXyp6L+i4keXDwLM79oxP6K1nqeGkIC5OgR38c=,tag:QbtjRLx47fN5M4+zaaQBVA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:33Z", + "mac": "ENC[AES256_GCM,data:rbWY/H6bj2UFpybJHqsS02wjy8VMvNvzQUtd6fBMSsvvv1fYWWoULO32LGA635spoFkVyOpX4hipqVyjRfQ1KyP1rNssggaHMz+nRUUFOmiQAcT9wi/Y0IKWjgN1cjI1stCU10b5cfJZQ0SPi/OFC8KcptMaHpfDVF47ZfnprFs=,iv:rVtp2Ti4xHNOWeS4MKju1jFZ/VyE7oXXdTSpp4jSU34=,tag:kd0IeyLXY598kdvSX0+1DA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:18Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAPQ6Bn3MlvYUPs+e0njFUoq4AZAhR38BIWGAzTAMeWfIH\n0JZwol5f1leoyKX5Bmye1S+n72zZz3C4FxhSqh80boxNpHuVyeLrAkzv25AaAS8Q\n/9mSYquvJcIL7nWX/QmgTVTaXrqlxZSVva6Slwf7zlaLBqVJfv1RDwT6JEWDIJig\nJp35PKpwRe70IZDGAelcDtJicmjQrvfVhyb1/0kTTv4JdylixVnQdh9X/zw5ZSBG\nusEW/JG9nZ/xzKsEQpafCBLhP80jx3z37zKbsJ+4K2xsBTGQQdU5KdDSnosw/L/b\nHlOCwaMQgb/dQPA5fpwVyGnVas6GK7gQvzznHAiHc9LgAeT0brybsEaAPOuA94/V\nA/ny4cub4Mzg0eFWf+C94i6lS1/gtuWI2PEva3259aEycV6gpYSOoPh3tYlBoVlM\ntj01l2eYfeBn5MNIWuhqfGTL4mLuzfiYsvnigdvTsOEIwgA=\n=yKCo\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.yaml.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-json.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml new file mode 100644 index 00000000..d3a52a22 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml @@ -0,0 +1,27 @@ +a: ENC[AES256_GCM,data:lQ==,iv:8RdyROFAynjfYVNniCd0t8OQrFEboZREoBzAAOSudig=,tag:700olmYZs3sRhqcwnzor9A==,type:str] +c: ENC[AES256_GCM,data:wQ==,iv:11sU7IEMYeDWHwNFsx6CgvUNG8Inc26vujykniuF+dc=,tag:ijRW/zjV+G0w3mwnHp4I8Q==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:21:14Z' + mac: ENC[AES256_GCM,data:QHcAe20/paYldZucaM1PN21K0i5ngS0UxMMryReTi9M40x9J18pNXo8TUoQuq/4iWZqgAKph1/m/u5pTU8LyKTeBX/HGlkWLjYUH521OJoBWJ0gDKHcZ01L3djlPi8Gts0w5MW/hrUlVqE3hyccy32VsCseuQckkq6dWnvtOmw4=,iv:dMqoZy2JhitE9dAwDxaI5q0NIo0N+rTiXjlnZBUG06k=,tag:8D9RcA8RGV6pCq/HLayGWw==,type:str] + pgp: + - created_at: '2020-10-07T20:21:08Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAmsvCa83tx8AfOH2cVM4DMNcFSPeR8hQcrILjkvcWqk5s + dd9YqTo+b6nxbZGcRUcvMmMOUo8OOIjVGyT7Yk6itLm2AFjY4T40wE2UyNEW3Jys + ZG3Tvel28T++FXquMhhs0iqfEOFDwRyOAbW/dDCEfzqmPGnjHNYiiE70EwJ6dlQG + xqhmUQrEgcdgBO9fmCsREA8IJt6z1Le1SGAQPhBAYwJU/Gr8OzI5GvlHj8vdLWmJ + dSPG62Ju6MhGIpOdkKY6zH/XVRFrP1v1LwJ+kigUFNuSORczITHPGFbH8Mpysp2G + uz1y+LX49Ynq1MApJxoCMSapWwYE1nv4w0eDwjLJzdLgAeThTu8/4A029VVXtiu9 + dxtt4V0i4CPgkuFo0eB34hoAk4fgu+Vpe7jKQlaKKDYG0/hDUVcoEA+GBTO1GpKC + I0hrHJt5O+DY5Ecvy/je21+8tQOOfoohMT/i6tB0wuE56wA= + =NXWv + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.json b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.json new file mode 100644 index 00000000..d3a52a22 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.json @@ -0,0 +1,27 @@ +a: ENC[AES256_GCM,data:lQ==,iv:8RdyROFAynjfYVNniCd0t8OQrFEboZREoBzAAOSudig=,tag:700olmYZs3sRhqcwnzor9A==,type:str] +c: ENC[AES256_GCM,data:wQ==,iv:11sU7IEMYeDWHwNFsx6CgvUNG8Inc26vujykniuF+dc=,tag:ijRW/zjV+G0w3mwnHp4I8Q==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:21:14Z' + mac: ENC[AES256_GCM,data:QHcAe20/paYldZucaM1PN21K0i5ngS0UxMMryReTi9M40x9J18pNXo8TUoQuq/4iWZqgAKph1/m/u5pTU8LyKTeBX/HGlkWLjYUH521OJoBWJ0gDKHcZ01L3djlPi8Gts0w5MW/hrUlVqE3hyccy32VsCseuQckkq6dWnvtOmw4=,iv:dMqoZy2JhitE9dAwDxaI5q0NIo0N+rTiXjlnZBUG06k=,tag:8D9RcA8RGV6pCq/HLayGWw==,type:str] + pgp: + - created_at: '2020-10-07T20:21:08Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAmsvCa83tx8AfOH2cVM4DMNcFSPeR8hQcrILjkvcWqk5s + dd9YqTo+b6nxbZGcRUcvMmMOUo8OOIjVGyT7Yk6itLm2AFjY4T40wE2UyNEW3Jys + ZG3Tvel28T++FXquMhhs0iqfEOFDwRyOAbW/dDCEfzqmPGnjHNYiiE70EwJ6dlQG + xqhmUQrEgcdgBO9fmCsREA8IJt6z1Le1SGAQPhBAYwJU/Gr8OzI5GvlHj8vdLWmJ + dSPG62Ju6MhGIpOdkKY6zH/XVRFrP1v1LwJ+kigUFNuSORczITHPGFbH8Mpysp2G + uz1y+LX49Ynq1MApJxoCMSapWwYE1nv4w0eDwjLJzdLgAeThTu8/4A029VVXtiu9 + dxtt4V0i4CPgkuFo0eB34hoAk4fgu+Vpe7jKQlaKKDYG0/hDUVcoEA+GBTO1GpKC + I0hrHJt5O+DY5Ecvy/je21+8tQOOfoohMT/i6tB0wuE56wA= + =NXWv + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.json.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.yaml b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.yaml new file mode 100644 index 00000000..5ae3291d --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.yaml @@ -0,0 +1,27 @@ +a: ENC[AES256_GCM,data:lQ==,iv:8RdyROFAynjfYVNniCd0t8OQrFEboZREoBzAAOSudig=,tag:700olmYZs3sRhqcwnzor9A==,type:str] +c: ENC[AES256_GCM,data:wQ==,iv:11sU7IEMYeDWHwNFsx6CgvUNG8Inc26vujykniuF+dc=,tag:ijRW/zjV+G0w3mwnHp4I8Q==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:21:14Z' + mac: ENC[AES256_GCM,data:QHcAe20/paYldZucaM1PN21K0i5ngS0UxMMryReTi9M40x9J18pNXo8TUoQuq/4iWZqgAKph1/m/u5pTU8LyKTeBX/HGlkWLjYUH521OJoBWJ0gDKHcZ01L3djlPi8Gts0w5MW/hrUlVqE3hyccy32VsCseuQckkq6dWnvtOmw4=,iv:dMqoZy2JhitE9dAwDxaI5q0NIo0N+rTiXjlnZBUG06k=,tag:8D9RcA8RGV6pCq/HLayGWw==,type:str] + pgp: + - created_at: '2020-10-07T20:21:08Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAmsvCa83tx8AfOH2cVM4DMNcFSPeR8hQcrILjkvcWqk5s + dd9YqTo+b6nxbZGcRUcvMmMOUo8OOIjVGyT7Yk6itLm2AFjY4T40wE2UyNEW3Jys + ZG3Tvel28T++FXquMhhs0iqfEOFDwRyOAbW/dDCEfzqmPGnjHNYiiE70EwJ6dlQG + xqhmUQrEgcdgBO9fmCsREA8IJt6z1Le1SGAQPhBAYwJU/Gr8OzI5GvlHj8vdLWmJ + dSPG62Ju6MhGIpOdkKY6zH/XVRFrP1v1LwJ+kigUFNuSORczITHPGFbH8Mpysp2G + uz1y+LX49Ynq1MApJxoCMSapWwYE1nv4w0eDwjLJzdLgAeThTu8/4A029VVXtiu9 + dxtt4V0i4CPgkuFo0eB34hoAk4fgu+Vpe7jKQlaKKDYG0/hDUVcoEA+GBTO1GpKC + I0hrHJt5O+DY5Ecvy/je21+8tQOOfoohMT/i6tB0wuE56wA= + =NXWv + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.yaml.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/hidden-yaml.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/rstrip.sops b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/rstrip.sops new file mode 100644 index 00000000..a704dbad --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/rstrip.sops @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:+x5Q1yGxpgvMQiwwMiCAiU0B5KA7i1eMvuRRxNLpKH0LEEs/7rpOInqKtA==,iv:96ihzWMxW45FqN28BCtX1emDBcXln9FN87Yf8bTlbbA=,tag:a8SiDQjFffOYHwKp5IhU2Q==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-02T18:14:42Z", + "mac": "ENC[AES256_GCM,data:CyLyYbG6rVwT8sRqLxLBuWUrgtUHz8XVwCx7iyiJDL925jzMvkA2ZEYxH6CsiWwc5/7tcFGLDSCjYw3AHD9x42LmsaAefk7F4X55++EI5VZbmSwyHdxCqvMVycKLJm3YXfodos8bbEWDDXhbmMT92uJs7H/IBXywnQHG3qoJWJE=,iv:ljY/d++R5v8VY5Q8nV0lnNwaeuEiKG4VTY8fSgFJD+w=,tag:MEtTIFuiSj8ReQOZNxO1IQ==,type:str]", + "pgp": [ + { + "created_at": "2020-10-02T18:11:54Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAblvrgBIPsg01TJjde7YskLvPKC/1jt1kI/eoOQ/KdemW\ngaJf4PIWGzFUxZEXeRzo70HTS+sPTi0TQDDkwOfcNjlGb3dC1KQdIZ1UiuqhL1//\n1G0doMMztEyZ63SOElv3OaWHjcnvmP224rTuFpO6Pm8HHMKEbaw9N7YHObgSdIpk\nfqEP369xj6bk/yQNEuMbgQOk+7LAYPs8na7oxIrdkWrmIlVj5jEz08lVS/FJecty\nUDalNDBkRrqMgTvSAw0vJTzaPzw/V+6WTrHh/0FRvLKJlKOsesaoxahW2/H1Dxmr\npySYTs2omqOtr3RzkCrUXmHijim9DIwg0JsIjo5xytLgAeSjSr9/W1EucekSGbeM\nmYK+4cN/4ILgRuH75OAw4qu0IgrgWuX6Eo7vO2HPrUiFLA/j+7/Bi+HkBZZuMrlR\njhd7C7MQGuD85NF3TzP2hW895ZiDznjWutHi69caRuEeZQA=\n=Aqvj\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/rstrip.sops.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/rstrip.sops.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/rstrip.sops.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/simple.sops.yaml b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/simple.sops.yaml new file mode 100644 index 00000000..d7bfc2ea --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/simple.sops.yaml @@ -0,0 +1,25 @@ +foo: ENC[AES256_GCM,data:a25L,iv:X8ILHZr+YiyLWa90Y+cwoMD1nVuel7JyTs0A5+oiOOo=,tag:GbBtp+Yqx1KEjdyztqS4EQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-02-20T10:44:32Z' + mac: ENC[AES256_GCM,data:BAwQqD9sHgHkmlxPQLKq28Xy48qPp1B/+GDLEsIxir6WNhZgw8OgjVF1u/wCAad6qHkmN02Bwenr+aay6uKfCuOEsTRSvZ7v80yAU+h0wL3zJ/KMkRsE3QP3CWxcLQxInt+YaBjR+Q0IUjDXKm3u6ZomixZe5F5pwWr36ErV6Y0=,iv:e/iiyXQiCh8C2w/bc8mr/Psv+ehmqEMqEC1/bbGFHpY=,tag:NSDo2HISIBJhYvsqrU0mSA==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/simple.sops.yaml.license b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/simple.sops.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/files/simple.sops.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/meta/main.yml b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/meta/main.yml new file mode 100644 index 00000000..b7f89500 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/meta/main.yml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +dependencies: + - setup_sops diff --git a/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/tasks/main.yml b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/tasks/main.yml new file mode 100644 index 00000000..4f0e8734 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/filter_decrypt/tasks/main.yml @@ -0,0 +1,133 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- when: sops_installed + block: + - name: Test bad parameter detection (1/2) + set_fact: + sops_bad_input_type: "{{ 'this-is-not: a sops file' | community.sops.decrypt(input_type='foo') }}" + ignore_errors: true + register: sops_bad_input_type + + - name: Test bad parameter detection (2/2) + set_fact: + sops_bad_output_type: "{{ 'this-is-not: a sops file' | community.sops.decrypt(output_type=23) }}" + ignore_errors: true + register: sops_bad_output_type + + - assert: + that: + - "sops_bad_input_type is failed" + - "'input_type must be one of' in sops_bad_input_type.msg" + - "'; got \"foo\"' in sops_bad_input_type.msg" + - "sops_bad_output_type is failed" + - "'output_type must be one of' in sops_bad_output_type.msg" + - "'; got \"23\"' in sops_bad_output_type.msg" + + - name: Test decrypt of non-sops file + set_fact: + sops_wrong_file: "{{ 'this-is-not: a sops file' | community.sops.decrypt }}" + ignore_errors: true + register: sops_filter_wrong_file + + - assert: + that: + - "sops_filter_wrong_file is failed" + - "'sops metadata not found' in sops_filter_wrong_file.msg" + + - name: Test simple filter + set_fact: + sops_success: "{{ lookup('file', 'simple.sops.yaml') | community.sops.decrypt }}" + ignore_errors: true + register: sops_filter_simple + + - assert: + that: + - "sops_filter_simple is success" + - "sops_success == 'foo: bar'" + + - name: Test rstrip + set_fact: + with_rstrip: "{{ lookup('file', 'rstrip.sops') | community.sops.decrypt(rstrip=true, output_type='binary') }}" + without_rstrip: "{{ lookup('file', 'rstrip.sops') | community.sops.decrypt(rstrip=false, output_type='binary') }}" + default_rstrip: "{{ lookup('file', 'rstrip.sops') | community.sops.decrypt(output_type='binary') }}" + + - assert: + that: + - with_rstrip == 'This file has three newlines at the end.' + - without_rstrip == 'This file has three newlines at the end.\n\n\n' + - default_rstrip == 'This file has three newlines at the end.' + + - name: Test binary + set_fact: + binary_with_rstrip: "{{ lookup('file', 'binary.sops') | community.sops.decrypt(rstrip=true, decode_output=false, output_type='binary') | b64encode }}" + binary_without_rstrip: "{{ lookup('file', 'binary.sops') | community.sops.decrypt(rstrip=false, decode_output=false, output_type='binary') | b64encode }}" + + - assert: + that: + - binary_with_rstrip == 'AQIDAAQ=' + - binary_without_rstrip == 'AQIDAAQgCg==' + + - name: Test hidden binary + set_fact: + hidden_binary: "{{ lookup('file', 'hidden-binary') | community.sops.decrypt(output_type='binary') }}" + hidden_binary__json: "{{ lookup('file', 'hidden-binary.json') | community.sops.decrypt(output_type='binary') }}" + hidden_binary__yaml: "{{ lookup('file', 'hidden-binary.yaml') | community.sops.decrypt(output_type='binary') }}" + hidden_binary_yaml: "{{ lookup('file', 'hidden-binary-yaml') | community.sops.decrypt(input_type='yaml', output_type='binary') }}" + hidden_binary_yaml__json: "{{ lookup('file', 'hidden-binary-yaml.json') | community.sops.decrypt(input_type='yaml', output_type='binary') }}" + hidden_binary_yaml__yaml: "{{ lookup('file', 'hidden-binary-yaml.yaml') | community.sops.decrypt(input_type='yaml', output_type='binary') }}" + hidden_json: "{{ lookup('file', 'hidden-json') | community.sops.decrypt(input_type='json', output_type='json') }}" + hidden_json__json: "{{ lookup('file', 'hidden-json.json') | community.sops.decrypt(input_type='json', output_type='json') }}" + hidden_json__yaml: "{{ lookup('file', 'hidden-json.yaml') | community.sops.decrypt(input_type='json', output_type='json') }}" + hidden_yaml: "{{ lookup('file', 'hidden-yaml') | community.sops.decrypt(input_type='yaml', output_type='yaml') }}" + hidden_yaml__json: "{{ lookup('file', 'hidden-yaml.json') | community.sops.decrypt(input_type='yaml', output_type='yaml') }}" + hidden_yaml__yaml: "{{ lookup('file', 'hidden-yaml.yaml') | community.sops.decrypt(input_type='yaml', output_type='yaml') }}" + hidden_json__as_yaml: "{{ lookup('file', 'hidden-json') | community.sops.decrypt(input_type='json', output_type='yaml') }}" + hidden_json__json__as_yaml: "{{ lookup('file', 'hidden-json.json') | community.sops.decrypt(input_type='json', output_type='yaml') }}" + hidden_json__yaml__as_yaml: "{{ lookup('file', 'hidden-json.yaml') | community.sops.decrypt(input_type='json', output_type='yaml') }}" + hidden_yaml__as_json: "{{ lookup('file', 'hidden-yaml') | community.sops.decrypt(input_type='yaml', output_type='json') }}" + hidden_yaml__json__as_json: "{{ lookup('file', 'hidden-yaml.json') | community.sops.decrypt(input_type='yaml', output_type='json') }}" + hidden_yaml__yaml__as_json: "{{ lookup('file', 'hidden-yaml.yaml') | community.sops.decrypt(input_type='yaml', output_type='json') }}" + + - assert: + that: + - hidden_binary == test_str_abcd + - hidden_binary__json == test_str_abcd + - hidden_binary__yaml == test_str_abcd + - hidden_binary_yaml == test_str_binary_data + - hidden_binary_yaml__json == test_str_binary_data + - hidden_binary_yaml__yaml == test_str_binary_data + - hidden_json == test_dict + - hidden_json__json == test_dict + - hidden_json__yaml == test_dict + - hidden_yaml == test_dict_yaml + - hidden_yaml__json == test_dict_yaml + - hidden_yaml__yaml == test_dict_yaml + - hidden_json__as_yaml == test_dict_yaml + - hidden_json__json__as_yaml == test_dict_yaml + - hidden_json__yaml__as_yaml == test_dict_yaml + - hidden_yaml__as_json == test_dict + - hidden_yaml__json__as_json == test_dict + - hidden_yaml__yaml__as_json == test_dict + vars: + test_dict: + a: b + c: d + test_dict_yaml: + "a: b\nc: d" + test_str_binary_data: This is binary data. + test_str_abcd: a is b, and c is d + + - name: Test fake sops binary + set_fact: + fake_sops_output: "{{ lookup('file', 'simple.sops.yaml') | community.sops.decrypt(sops_binary=role_path ~ '/files/fake-sops.sh', enable_local_keyservice=True, aws_access_key_id='xxx') }}" + fake_sops_output_2: "{{ lookup('file', 'simple.sops.yaml') | community.sops.decrypt(sops_binary=role_path ~ '/files/fake-sops-val.sh', config_path='/path/to/asdf', aws_secret_access_key='yyy') }}" + fake_sops_output_3: "{{ lookup('file', 'simple.sops.yaml') | community.sops.decrypt(sops_binary=role_path ~ '/files/fake-sops-rep.sh', keyservice=['a', 'b'], aws_session_token='zzz') }}" + + - assert: + that: + - fake_sops_output == 'fake sops output' + - fake_sops_output_2 == 'fake sops output 2' + - fake_sops_output_3 == 'fake sops output 3' diff --git a/ansible_collections/community/sops/tests/integration/targets/load_vars/aliases b/ansible_collections/community/sops/tests/integration/targets/load_vars/aliases new file mode 100644 index 00000000..ba51f599 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/load_vars/aliases @@ -0,0 +1,10 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +gha/main +skip/aix +skip/osx +skip/freebsd +skip/python2.6 # lookups are controller only, and we no longer support Python 2.6 on the controller +context/controller diff --git a/ansible_collections/community/sops/tests/integration/targets/load_vars/meta/main.yml b/ansible_collections/community/sops/tests/integration/targets/load_vars/meta/main.yml new file mode 100644 index 00000000..b7f89500 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/load_vars/meta/main.yml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +dependencies: + - setup_sops diff --git a/ansible_collections/community/sops/tests/integration/targets/load_vars/tasks/main.yml b/ansible_collections/community/sops/tests/integration/targets/load_vars/tasks/main.yml new file mode 100644 index 00000000..29d7d652 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/load_vars/tasks/main.yml @@ -0,0 +1,130 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- when: sops_installed + block: + - name: Test load_vars with missing option + community.sops.load_vars: + ignore_errors: true + register: load_vars_missing_option + + - assert: + that: + - load_vars_missing_option is failed + - '"missing required arguments: file" in load_vars_missing_option.msg' + + - name: Test load_vars with wrong choice value + community.sops.load_vars: + file: a + expressions: invalid value + ignore_errors: true + register: load_vars_invalid_value + + - assert: + that: + - load_vars_invalid_value is failed + - '"value of expressions must be one of: ignore, evaluate-on-load, got: invalid value" in load_vars_invalid_value.msg' + + - name: Test load_vars with missing file + community.sops.load_vars: + file: non-existent.sops.yaml + ignore_errors: true + register: load_vars_missing_file + + - assert: + that: + - load_vars_missing_file is failed + - | + "Could not find or access 'non-existent.sops.yaml'\n" in load_vars_missing_file.msg + + - name: Test load_vars with non-sops file + community.sops.load_vars: + file: wrong.yaml + ignore_errors: true + register: load_vars_wrong_file + + - assert: + that: + - load_vars_wrong_file is failed + - "'sops metadata not found' in load_vars_wrong_file.msg" + + - name: Test load_vars with simple file into variable + community.sops.load_vars: + file: simple.sops.yaml + name: dest_variable + register: load_vars_simple + + - assert: + that: + - load_vars_simple is success + - "load_vars_simple.ansible_facts == {'dest_variable': {'foo': 'bar'}}" + - dest_variable.foo == 'bar' + - foo is undefined + + - name: Test load_vars with empty file + community.sops.load_vars: + file: empty.sops.json + register: load_vars_empty + + - assert: + that: + - load_vars_empty is success + - load_vars_empty.ansible_facts | length == 0 + + - name: Test load_vars with simple file into global namespace + community.sops.load_vars: + file: simple.sops.yaml + register: load_vars_simple_global + + - assert: + that: + - load_vars_simple_global is success + - "load_vars_simple_global.ansible_facts == {'foo': 'bar'}" + - foo == 'bar' + + - name: Test load_vars with expressions ignored + community.sops.load_vars: + file: proper-vars.sops.yaml + expressions: ignore + register: load_vars_expr_ignore + + - assert: + that: + - load_vars_expr_ignore is success + - test1 == '{' ~ '{ bar }' ~ '}' + - test2 == '{' ~ '{ this_will_not_get_evaluated }' ~ '}' + - bar == 'baz' + + - set_fact: + to_be_defined_earlier: something_defined_before + bar_2: baz + + - name: Test load_vars with expressions evaluated now + community.sops.load_vars: + file: proper-vars-2.sops.yaml + expressions: evaluate-on-load + register: load_vars_expr_evaluated_now + + - set_fact: + to_be_defined_earlier: something_else + + - assert: + that: + - load_vars_expr_evaluated_now is success + - test1_2 == 'baz' + - test2_2 == 'something_defined_before' + - test3_2[0] == 'baz' + - test4_2.test_4_2_1 == 'bazbaz' + + - name: Test load_vars with expressions evaluated now (again) + community.sops.load_vars: + file: proper-vars-2.sops.yaml + expressions: evaluate-on-load + register: load_vars_expr_evaluated_now_2 + + - assert: + that: + - load_vars_expr_evaluated_now_2 is success + - test2_2 == 'something_else' diff --git a/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/.sops.yaml b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/.sops.yaml new file mode 100644 index 00000000..e28ce962 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/.sops.yaml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +creation_rules: + - pgp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 diff --git a/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/empty.sops.json b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/empty.sops.json new file mode 100644 index 00000000..82c8cf38 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/empty.sops.json @@ -0,0 +1,19 @@ +{ + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-09-21T05:20:22Z", + "mac": "ENC[AES256_GCM,data:/lmY2rbeFuc9D1CvPQVWfgBsMiO9A+xDvUlO5vxovcXTrI+FHV/O8NO0VyCuXxvPpzXpsbJq9g7YjBVyllsH1Y2zveWAPNH7hoPdMTsa7g0D/qANLnkDIkr0Gj5EIi1Pek1CT631u1SPHBih60AinwulkArEWs4Z4Sh9t881jSc=,iv:CSwOl2eqZb+bw53m2GTuWdmvFYOjDlH1um5MHAB1gxg=,tag:IQ3AXbHZ1RYlHjcY0JSr9Q==,type:str]", + "pgp": [ + { + "created_at": "2020-09-21T05:20:18Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAYKF/spYZXKeQlZ0kl6RiJCcbfbRBL69jQREerUvET78Q\nqystnEdijf3Dhf0i5wrIFdSrN7uxCQISAYaxa/upklsOuoWD5tQQIVctKDfGgrSH\nVcQrcBO19PQaH6ESF0T1udbalqdjWo8UXIbVzi1aLnaPlUYuzlqPzUTbhl9H0EGE\nNThYC3tfqbsM11d/qkRkxhqyVBOlt/tMkIQZqWc3eITs6ilT1PmkBcSUdoUTpVqi\nuxuTVP5DDoMi23/AGLbXowNn36FvcytPNnMFiRQffrFOv2lBkFgfoYOGeenYfPof\nm6A+b08DlPlNJBMhtyVYo0fzWY8uJqO9NtFdxPPaHNLgAeQunj4ltnJ5644D71Tp\nceSH4Rb74ETgqOEU6eD14oSdeIXgIeWG0zzYuaCDGyU9hWLvc3SEBS8/CMMetVvx\nzKMDxxsaM+Bd5J8z8kw/c6LSUGTSaAr55XziFq0PW+Fw/QA=\n=P0+p\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/empty.sops.json.license b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/empty.sops.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/empty.sops.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/proper-vars-2.sops.yaml b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/proper-vars-2.sops.yaml new file mode 100644 index 00000000..bffe0521 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/proper-vars-2.sops.yaml @@ -0,0 +1,37 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +test1_2: ENC[AES256_GCM,data:iNGUgLK6RdJZQWA=,iv:FEx7YO17wTadHLcppnpElb5G5UIukfcHDatUkPzZ0rU=,tag:bKx9qwKiirzi7/lR0EQTEA==,type:str] +test2_2: ENC[AES256_GCM,data:4rFASWUQQLqJgLnL3KAYIWpBoMGz38pTt4+w,iv:42avbhH4HzHhsCNdiPvZbowKbaWx76c+OYD8iZMELyk=,tag:9GSsbCYDQHX698S68cZe+g==,type:str] +test3_2: +- ENC[AES256_GCM,data:nna0AD3fT6ySb7o=,iv:oX4yr3haXMCKvPNvbuzbnY1VeJQtT6svyij5IxkM8U4=,tag:T5C0b67m4Gu5OMFQLua7cw==,type:str] +- ENC[AES256_GCM,data:iFsZo/M=,iv:Rt0S7vSQqT9eBt74/xLkUeRu91jLaroPs1oU707dqZ0=,tag:PHE2U6vUjOwc+vuERU5M8A==,type:int] +test4_2: + test_4_2_1: ENC[AES256_GCM,data:PdqR2Sj2YI9YgWxrHd+iLszygZnzLA==,iv:rzY3GH7WH1E56vDirZ820R3oP7GTqjh1h/p0blTOBts=,tag:IDYNvBfTm2iklZVAI5Y4dw==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T19:09:46Z' + mac: ENC[AES256_GCM,data:ukYXQmbbOnausOseL6dcmBxZrPE5oHRirIebO8IUorFlas3NTUVFJCPJgJBA6cUa8KhFJDzfv2O+49y5h8j4Xu4w+3EuR42YukATVNbqLR1zQCO3N9fythqWWbxeiTlCXIK+Q+7FhC+UrY0FhFIKDc2iQOWdFYDSeBYg9vx1Spg=,iv:ksQOlDfvr4x25s+bbZywsRqVhvfbe2l81tBKzYVUBwI=,tag:mUD6aR6VbtCSF42dZwwnqg==,type:str] + pgp: + - created_at: '2020-09-20T20:29:09Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAXN27E1QUMoQcdyFW1D/vNJ1B022/1q8Sg+G9FbsXLTBL + XXLRpm+H2R8OEBT9zfW0gTp+RUcffcbEQ4zFPYghXTcfEWB18Dyz4YsemrbjW4NB + oHsto+5sqGAALo7grBnUeNFxp3W263YodUSbRnG8lgQeBHulK4IhOoMBr2JnRDJg + w/qrZBDBKQQjhl1nr6QtnKA/jlckbyw7wbtDxi8b/0w76un1gpgou+dSaF6rWo1R + R7gaCbOzEUm3jdIRARFPeEn7YYgm8Pacxy8krPldjHk1EDuOTL9Ubs2NGHFo2WKo + iZqxTPw8MhrNmWC+y90KKFx1JHmS0KLMvi5x4/cqpNLgAeQEW4NCFfCu7wZ8UvfE + Xcd44dol4ETgmeH8EOAy4kS1MjrgvuWQPrw+f5VRfUpd0F7RcdLmKSSn9yZ4JGoz + eXgIH/SWy+Bu5MgUwqKeFy/Y6BICNKdziLriOvVIYOH4dAA= + =VJGY + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/proper-vars.sops.yaml b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/proper-vars.sops.yaml new file mode 100644 index 00000000..95f3bbf0 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/proper-vars.sops.yaml @@ -0,0 +1,33 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +test1: ENC[AES256_GCM,data:9Pqw99u2f3qG,iv:AhLP4qOm/OVA2GuRgAxARR8t5tdxjLxU5Cqjq2rSalU=,tag:6mKhNKuv7SQ43SiL1FcrPg==,type:str] +test2: ENC[AES256_GCM,data:hDPhuyLcFDVddSf4V0bCc67AB6Je62EIYhLT3lr6wfL0,iv:RwY/Upk/es5Y5xzCkZawNDp8wjGkS/qzZo9ErKIwYbc=,tag:h73bPO+pYM08q9Wjx/6N2w==,type:str] +bar: ENC[AES256_GCM,data:l4r5,iv:bxtHopVoSImLBY0u+1FUPe5qwJGk9nfy2ODI4vYhgiI=,tag:FjdNMkU0YFisswXbgEjCjA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T18:48:09Z' + mac: ENC[AES256_GCM,data:u4+EQNjFXHsN2nF/WvXXoIkpFgAnagpH+NexBjicZbvAyrWuUgJxKQQxA6RtFdbvf1B3dT5PncPU+FyuUneN4/2ZMgcSGDl0HrA5+C3k7jKWwpk3lRBnkhPth+M4P51ThZ8mZRxRUKoRTivCip6/tL7NDqfCMPUmVG1NplRwhn4=,iv:k79E4eAU7EQLDi840VAPZXbFRmHKlx5HbAyJEBszztM=,tag:kknO0CvGVZaRFLB+plyctg==,type:str] + pgp: + - created_at: '2020-09-20T20:07:20Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAkSnBl8glONDFOH6XOjo9YbfYCf3L/i8aYueZ/O9VlIX8 + uyG5JzSfhQu0Yy9BXwuZfELo54SvxqQvlTIF0lQ3VDjBVcZgosaxN+yvMsB9jn6b + gbdK0nqduXcwuZGUJqcnq8TBixiWQI+oFMSQUsHrA4O0IqDb0UzGcTDMmVv0FqZu + p3C5Femn1z1E/QqLKRU2YGAHbbfBVdNkQiAFAvT6AlchnvNEIyaLeS3D8yueIrBR + B76/YNsjSVUff1ZnHm2B0zn/HnC+vQQuMLDnKrQffXJHRJ2AEt0lls/al+NXLiOm + TlkE0F6/ZGPIfznt9+tpXhUyAXsOpEZXWYPIfrheodLgAeS3rZfS0Ey7RI02QSq0 + Jk/g4dSl4DjgAOGcW+Dl4gnGdMjgUuV1tnG4e5riZleM7a+5TSoWZWIJFJqAXO/6 + EqdSmUvN2uAS5O3DU0mrnMTHTDX4Ghjorh3iPwK2++GT8QA= + =SfPv + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/simple.sops.yaml b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/simple.sops.yaml new file mode 100644 index 00000000..02ad8294 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/simple.sops.yaml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +foo: ENC[AES256_GCM,data:a25L,iv:X8ILHZr+YiyLWa90Y+cwoMD1nVuel7JyTs0A5+oiOOo=,tag:GbBtp+Yqx1KEjdyztqS4EQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-02-20T10:44:32Z' + mac: ENC[AES256_GCM,data:BAwQqD9sHgHkmlxPQLKq28Xy48qPp1B/+GDLEsIxir6WNhZgw8OgjVF1u/wCAad6qHkmN02Bwenr+aay6uKfCuOEsTRSvZ7v80yAU+h0wL3zJ/KMkRsE3QP3CWxcLQxInt+YaBjR+Q0IUjDXKm3u6ZomixZe5F5pwWr36ErV6Y0=,iv:e/iiyXQiCh8C2w/bc8mr/Psv+ehmqEMqEC1/bbGFHpY=,tag:NSDo2HISIBJhYvsqrU0mSA==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/wrong.yaml b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/wrong.yaml new file mode 100644 index 00000000..3f3fff63 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/load_vars/vars/wrong.yaml @@ -0,0 +1,6 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +this-is-not: a sops file diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/aliases b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/aliases new file mode 100644 index 00000000..977ec388 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/aliases @@ -0,0 +1,9 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +gha/main +skip/aix +skip/osx +skip/freebsd +skip/python2.6 # lookups are controller only, and we no longer support Python 2.6 on the controller diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/.sops.yaml b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/.sops.yaml new file mode 100644 index 00000000..e28ce962 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/.sops.yaml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +creation_rules: + - pgp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/binary.sops b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/binary.sops new file mode 100644 index 00000000..af344ef2 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/binary.sops @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:TrEN6YJBOg==,iv:aUozScYsBrM4khbqD2lMbGpEEXXO0Vy8YytBoG4HIf4=,tag:JlLZHqj2fsTi6v1rGeaxWw==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-02T18:26:32Z", + "mac": "ENC[AES256_GCM,data:m4PPDNMYOPcDECiKJLF9Hg4jIInHj/xpj5bnGUkQxMm4XO2CDPal9g1FwTzwjOK9rXLUkdhWc8FuRh542EviVV8vOyUkjVAwN0x0bpXodBXB5r/9PPDwtObe/CUWnjo90Ow7IuX/BnQI6lf1sdPHf0MeTjGN9/l7tr6xg+92bIc=,iv:7q+TxZ65n2a+Vdb9KY6ISX92c1lEG2yTpa9KCt/QcUk=,tag:uR1AfcNd1dvH6LZy2oBDiw==,type:str]", + "pgp": [ + { + "created_at": "2020-10-02T18:26:31Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAR4QrVAJ5LhfX41457whWBdB74/O4OEZ76CkUGBvCVkGb\nHjJf9PAHFYH12UVnHEK3ZHKxKrVKPM2Pf3hsMGPuruS2wDuCWLteuMfQtlvCg1Xv\nLxiOfyEUEFc7Rl7uKmvni7XBeexIYN0DpxYa1Paz28ptQJCxZ84FK9y2jrFg2bUF\nq8R1JSTiY+YDXQBKSw3XgdJjjX2Yrpe85BV/l7pgREcwKEG4ZIU8n/zH2mgCObxp\nVfa50dAs5mfooU4g+xF34INhk7L+JPF0EBAbdrPyiw/7220dQSfCW0K3rgQkL1ZE\nB0wjH3S2anRO5t8E4S/YvXerq8LwtpCMczflLsCZ89LgAeStGGLFgZU53ASmq2dt\nqwQw4dCY4CngwuG/PuCt4nYV6VPgz+V+txpuq/aKQvcuFNhGsRtm4oP/vUlhqZQA\nivnqgO/DveCH5MxW9oMGLnYj4Jkbp0gRyALiqwNRz+HfSgA=\n=3dNe\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/binary.sops.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/binary.sops.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/binary.sops.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/fake-sops-rep.sh b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/fake-sops-rep.sh new file mode 100755 index 00000000..74f22ac2 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/fake-sops-rep.sh @@ -0,0 +1,14 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +if [ "$1" != "--keyservice" ] || [ "$2" != "a" ] || [ "$3" != "--keyservice" ] || [ "$4" != "b" ] || [ "$5" != "--decrypt" ] || [ "$(basename "$6")" != "simple.sops.yaml" ] || [ "$7" != "" ]; then + echo "Command (fake-sops-rep): $*" > /dev/stderr + exit 1 +fi +if [ "${AWS_SESSION_TOKEN}" != "zzz" ]; then + echo "AWS_SESSION_TOKEN is '${AWS_SESSION_TOKEN}'" > /dev/stderr + exit 1 +fi +echo 'fake sops output 3' diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/fake-sops-val.sh b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/fake-sops-val.sh new file mode 100755 index 00000000..f29b9f7e --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/fake-sops-val.sh @@ -0,0 +1,14 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +if [ "$1" != "--config" ] || [ "$2" != "/path/to/asdf" ] || [ "$3" != "--decrypt" ] || [ "$(basename "$4")" != "simple.sops.yaml" ] || [ "$5" != "" ]; then + echo "Command (fake-sops-val): $*" > /dev/stderr + exit 1 +fi +if [ "${AWS_SECRET_ACCESS_KEY}" != "yyy" ]; then + echo "AWS_SECRET_ACCESS_KEY is '${AWS_SECRET_ACCESS_KEY}'" > /dev/stderr + exit 1 +fi +echo 'fake sops output 2' diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/fake-sops.sh b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/fake-sops.sh new file mode 100755 index 00000000..0e78b2b0 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/fake-sops.sh @@ -0,0 +1,14 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +if [ "$1" != "--enable-local-keyservice" ] || [ "$2" != "--decrypt" ] || [ "$(basename "$3")" != "simple.sops.yaml" ] || [ "$4" != "" ]; then + echo "Command (fake-sops): $*" > /dev/stderr + exit 1 +fi +if [ "${AWS_ACCESS_KEY_ID}" != "xxx" ]; then + echo "AWS_ACCESS_KEY_ID is '${AWS_ACCESS_KEY_ID}'" > /dev/stderr + exit 1 +fi +echo 'fake sops output' diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary new file mode 100644 index 00000000..5f1a9a9b --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:oJurKkZjXi4HVqV51shzRbl8,iv:OIg1gqchya6dMQtjYTMBeEfcddQLCtxL+ONnhR0jXEo=,tag:z0toZPLcUG3ZWB/tu59tqQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:46Z", + "mac": "ENC[AES256_GCM,data:fIH8AhiNyca43zDcKRFy5vkTHHY/OyWA1LXRCPRUJyHSFu8TQwJJ+7+5c7F/mI3P3exNjWv+sG53VAcxImqRsrd98QhllLJ6OjnVxpwKFTOjLJWfsvPEmoD+TpCnpuKxZSk303j2jCnIJ2cW0gOpPiUjm6LQ7JroMrBXKki71Ss=,iv:qM2PPktRKd7E5e1xmvmJzRaHnIOFk3dkaQ38Gg8idiw=,tag:ki7fs/rDf6vovyqBknVVHA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:39Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAfr3xj1fG9yF91g+WMV1SG1dA+vR+nDkuGdNq3mn88660\nKiXOkEA8A6FrSpstKqsUb9Q6cotYiq3ld3dGPHve0AP9KzWvZEcogCpuk+CKaTnh\nimswI1Rr7jxZ9DecGn2koS07nGhNCXSdy2eAy0pDHpXbJnmb0CgHMXISeXiBZfs8\n19NtCMpcTbek4uR5jhazd0zSZWf1Gxls6pupBNaapwX0YyY+4cxc9O/spgDBd/R8\nrGNVOlA8svOnBQ8G0Ha+mn4p8ia7diSmPorRw1OGT9fJqnveVGsqk71rwem/5lv0\nEGSdXeYazjMP6Vlx0AaVBJFDNas9ozH3FMX2BRqWJNLgAeQE2dWrcbysQIi+QS6v\nfn3a4XYH4BzgcuHoQuAU4jqpMC3gv+UpiN+WK/Vc4Df/iMWQJB9uUm5iEbPRWwQx\n29a574BPbeBk5FxrDyMROm9YKb9GKa0F6WrimK5sdeF6VgA=\n=lJUR\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml new file mode 100644 index 00000000..8ac6f945 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml @@ -0,0 +1,26 @@ +data: ENC[AES256_GCM,data:Mf66wk+/MdrPhiG3WMYkfTcs5Fdl,iv:r/CUJSou0b0w3pF7i3heDecV49jn82pTw2oQrMYModI=,tag:y342mhP4BfgsI5feBsJgoA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:25:54Z' + mac: ENC[AES256_GCM,data:srcP514/YUzHZErkByGupUKTF/QqfbzGkNC4Ojmyks5lHw0yWcz7T0GvuZEvXfrHAKUdBYjgaKvQnmed7CfBg5zlb8PL7Pg8b36WPM27EAJkAJzJG39xBov2u8l6sK7JcXMO31qIgzJDhPGsPfkk8yqs45EQC43DmYKU8dZkVaU=,iv:v8MeNADiPdl4fQPwfMSX12y3M0WoP7+9OXF4BWM8bkM=,tag:bXBIzoRtKydGp56fOTTctQ==,type:str] + pgp: + - created_at: '2020-10-07T20:25:49Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAb66JsAFfpWA1r11UevicTHKtZ6U8aT4wLlOWK9JilyTc + YlS0SfoU8v/CKbTlMndskCQOlhdK7b3LJG294/Gj6+v1bAz/yC9ivxmO/WeLupsl + XlcxrbMJcUASq0qsh4XYOhbNt1p47Ay5to8Ov+K/vPwA1a1QbsO5YbtMVrqQGNor + SoThRkVQ51yaxvIMStHXqPKuq4hdn4//pa+afThvbCCEopyc4SYbKXgNTX7+l7+N + r2LOKzDxg/koVN1HSpQ+kBDXiF4i4zSaBPBXN35Tv1y4vC0KUzdzVWiekMWksOqA + 5ibGSLPhoOzIIz/Vda2t5o2LMeCaa36VXSbcXoL3i9LgAeQuZoNyyhrfwBOhARbi + ge7d4Q+o4ODgOOFSjeCr4msn9j3gCOX4+rKE2e9ZSFmSZzGv2vgWEo+h6qDxN29A + m2vhUzvrd+Br5DZRGB3LtEr3O4/lAN8DfwriyUDGKOEKRgA= + =4sXd + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.json b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.json new file mode 100644 index 00000000..8ac6f945 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.json @@ -0,0 +1,26 @@ +data: ENC[AES256_GCM,data:Mf66wk+/MdrPhiG3WMYkfTcs5Fdl,iv:r/CUJSou0b0w3pF7i3heDecV49jn82pTw2oQrMYModI=,tag:y342mhP4BfgsI5feBsJgoA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:25:54Z' + mac: ENC[AES256_GCM,data:srcP514/YUzHZErkByGupUKTF/QqfbzGkNC4Ojmyks5lHw0yWcz7T0GvuZEvXfrHAKUdBYjgaKvQnmed7CfBg5zlb8PL7Pg8b36WPM27EAJkAJzJG39xBov2u8l6sK7JcXMO31qIgzJDhPGsPfkk8yqs45EQC43DmYKU8dZkVaU=,iv:v8MeNADiPdl4fQPwfMSX12y3M0WoP7+9OXF4BWM8bkM=,tag:bXBIzoRtKydGp56fOTTctQ==,type:str] + pgp: + - created_at: '2020-10-07T20:25:49Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAb66JsAFfpWA1r11UevicTHKtZ6U8aT4wLlOWK9JilyTc + YlS0SfoU8v/CKbTlMndskCQOlhdK7b3LJG294/Gj6+v1bAz/yC9ivxmO/WeLupsl + XlcxrbMJcUASq0qsh4XYOhbNt1p47Ay5to8Ov+K/vPwA1a1QbsO5YbtMVrqQGNor + SoThRkVQ51yaxvIMStHXqPKuq4hdn4//pa+afThvbCCEopyc4SYbKXgNTX7+l7+N + r2LOKzDxg/koVN1HSpQ+kBDXiF4i4zSaBPBXN35Tv1y4vC0KUzdzVWiekMWksOqA + 5ibGSLPhoOzIIz/Vda2t5o2LMeCaa36VXSbcXoL3i9LgAeQuZoNyyhrfwBOhARbi + ge7d4Q+o4ODgOOFSjeCr4msn9j3gCOX4+rKE2e9ZSFmSZzGv2vgWEo+h6qDxN29A + m2vhUzvrd+Br5DZRGB3LtEr3O4/lAN8DfwriyUDGKOEKRgA= + =4sXd + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.json.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.yaml b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.yaml new file mode 100644 index 00000000..b6175280 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.yaml @@ -0,0 +1,26 @@ +data: ENC[AES256_GCM,data:Mf66wk+/MdrPhiG3WMYkfTcs5Fdl,iv:r/CUJSou0b0w3pF7i3heDecV49jn82pTw2oQrMYModI=,tag:y342mhP4BfgsI5feBsJgoA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:25:54Z' + mac: ENC[AES256_GCM,data:srcP514/YUzHZErkByGupUKTF/QqfbzGkNC4Ojmyks5lHw0yWcz7T0GvuZEvXfrHAKUdBYjgaKvQnmed7CfBg5zlb8PL7Pg8b36WPM27EAJkAJzJG39xBov2u8l6sK7JcXMO31qIgzJDhPGsPfkk8yqs45EQC43DmYKU8dZkVaU=,iv:v8MeNADiPdl4fQPwfMSX12y3M0WoP7+9OXF4BWM8bkM=,tag:bXBIzoRtKydGp56fOTTctQ==,type:str] + pgp: + - created_at: '2020-10-07T20:25:49Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAb66JsAFfpWA1r11UevicTHKtZ6U8aT4wLlOWK9JilyTc + YlS0SfoU8v/CKbTlMndskCQOlhdK7b3LJG294/Gj6+v1bAz/yC9ivxmO/WeLupsl + XlcxrbMJcUASq0qsh4XYOhbNt1p47Ay5to8Ov+K/vPwA1a1QbsO5YbtMVrqQGNor + SoThRkVQ51yaxvIMStHXqPKuq4hdn4//pa+afThvbCCEopyc4SYbKXgNTX7+l7+N + r2LOKzDxg/koVN1HSpQ+kBDXiF4i4zSaBPBXN35Tv1y4vC0KUzdzVWiekMWksOqA + 5ibGSLPhoOzIIz/Vda2t5o2LMeCaa36VXSbcXoL3i9LgAeQuZoNyyhrfwBOhARbi + ge7d4Q+o4ODgOOFSjeCr4msn9j3gCOX4+rKE2e9ZSFmSZzGv2vgWEo+h6qDxN29A + m2vhUzvrd+Br5DZRGB3LtEr3O4/lAN8DfwriyUDGKOEKRgA= + =4sXd + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.yaml.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary-yaml.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.json b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.json new file mode 100644 index 00000000..5f1a9a9b --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.json @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:oJurKkZjXi4HVqV51shzRbl8,iv:OIg1gqchya6dMQtjYTMBeEfcddQLCtxL+ONnhR0jXEo=,tag:z0toZPLcUG3ZWB/tu59tqQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:46Z", + "mac": "ENC[AES256_GCM,data:fIH8AhiNyca43zDcKRFy5vkTHHY/OyWA1LXRCPRUJyHSFu8TQwJJ+7+5c7F/mI3P3exNjWv+sG53VAcxImqRsrd98QhllLJ6OjnVxpwKFTOjLJWfsvPEmoD+TpCnpuKxZSk303j2jCnIJ2cW0gOpPiUjm6LQ7JroMrBXKki71Ss=,iv:qM2PPktRKd7E5e1xmvmJzRaHnIOFk3dkaQ38Gg8idiw=,tag:ki7fs/rDf6vovyqBknVVHA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:39Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAfr3xj1fG9yF91g+WMV1SG1dA+vR+nDkuGdNq3mn88660\nKiXOkEA8A6FrSpstKqsUb9Q6cotYiq3ld3dGPHve0AP9KzWvZEcogCpuk+CKaTnh\nimswI1Rr7jxZ9DecGn2koS07nGhNCXSdy2eAy0pDHpXbJnmb0CgHMXISeXiBZfs8\n19NtCMpcTbek4uR5jhazd0zSZWf1Gxls6pupBNaapwX0YyY+4cxc9O/spgDBd/R8\nrGNVOlA8svOnBQ8G0Ha+mn4p8ia7diSmPorRw1OGT9fJqnveVGsqk71rwem/5lv0\nEGSdXeYazjMP6Vlx0AaVBJFDNas9ozH3FMX2BRqWJNLgAeQE2dWrcbysQIi+QS6v\nfn3a4XYH4BzgcuHoQuAU4jqpMC3gv+UpiN+WK/Vc4Df/iMWQJB9uUm5iEbPRWwQx\n29a574BPbeBk5FxrDyMROm9YKb9GKa0F6WrimK5sdeF6VgA=\n=lJUR\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.json.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.yaml b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.yaml new file mode 100644 index 00000000..5f1a9a9b --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.yaml @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:oJurKkZjXi4HVqV51shzRbl8,iv:OIg1gqchya6dMQtjYTMBeEfcddQLCtxL+ONnhR0jXEo=,tag:z0toZPLcUG3ZWB/tu59tqQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:46Z", + "mac": "ENC[AES256_GCM,data:fIH8AhiNyca43zDcKRFy5vkTHHY/OyWA1LXRCPRUJyHSFu8TQwJJ+7+5c7F/mI3P3exNjWv+sG53VAcxImqRsrd98QhllLJ6OjnVxpwKFTOjLJWfsvPEmoD+TpCnpuKxZSk303j2jCnIJ2cW0gOpPiUjm6LQ7JroMrBXKki71Ss=,iv:qM2PPktRKd7E5e1xmvmJzRaHnIOFk3dkaQ38Gg8idiw=,tag:ki7fs/rDf6vovyqBknVVHA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:39Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAfr3xj1fG9yF91g+WMV1SG1dA+vR+nDkuGdNq3mn88660\nKiXOkEA8A6FrSpstKqsUb9Q6cotYiq3ld3dGPHve0AP9KzWvZEcogCpuk+CKaTnh\nimswI1Rr7jxZ9DecGn2koS07nGhNCXSdy2eAy0pDHpXbJnmb0CgHMXISeXiBZfs8\n19NtCMpcTbek4uR5jhazd0zSZWf1Gxls6pupBNaapwX0YyY+4cxc9O/spgDBd/R8\nrGNVOlA8svOnBQ8G0Ha+mn4p8ia7diSmPorRw1OGT9fJqnveVGsqk71rwem/5lv0\nEGSdXeYazjMP6Vlx0AaVBJFDNas9ozH3FMX2BRqWJNLgAeQE2dWrcbysQIi+QS6v\nfn3a4XYH4BzgcuHoQuAU4jqpMC3gv+UpiN+WK/Vc4Df/iMWQJB9uUm5iEbPRWwQx\n29a574BPbeBk5FxrDyMROm9YKb9GKa0F6WrimK5sdeF6VgA=\n=lJUR\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.yaml.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-binary.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json new file mode 100644 index 00000000..61dc55e9 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json @@ -0,0 +1,21 @@ +{ + "a": "ENC[AES256_GCM,data:/Q==,iv:q+yypwZjX2frKGNruAFF+XSnmz+IU3AQ5XuUMWhhyhA=,tag:skm5wsq8a3/EESLVic8yKw==,type:str]", + "c": "ENC[AES256_GCM,data:DQ==,iv:JvvR1pXyp6L+i4keXDwLM79oxP6K1nqeGkIC5OgR38c=,tag:QbtjRLx47fN5M4+zaaQBVA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:33Z", + "mac": "ENC[AES256_GCM,data:rbWY/H6bj2UFpybJHqsS02wjy8VMvNvzQUtd6fBMSsvvv1fYWWoULO32LGA635spoFkVyOpX4hipqVyjRfQ1KyP1rNssggaHMz+nRUUFOmiQAcT9wi/Y0IKWjgN1cjI1stCU10b5cfJZQ0SPi/OFC8KcptMaHpfDVF47ZfnprFs=,iv:rVtp2Ti4xHNOWeS4MKju1jFZ/VyE7oXXdTSpp4jSU34=,tag:kd0IeyLXY598kdvSX0+1DA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:18Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAPQ6Bn3MlvYUPs+e0njFUoq4AZAhR38BIWGAzTAMeWfIH\n0JZwol5f1leoyKX5Bmye1S+n72zZz3C4FxhSqh80boxNpHuVyeLrAkzv25AaAS8Q\n/9mSYquvJcIL7nWX/QmgTVTaXrqlxZSVva6Slwf7zlaLBqVJfv1RDwT6JEWDIJig\nJp35PKpwRe70IZDGAelcDtJicmjQrvfVhyb1/0kTTv4JdylixVnQdh9X/zw5ZSBG\nusEW/JG9nZ/xzKsEQpafCBLhP80jx3z37zKbsJ+4K2xsBTGQQdU5KdDSnosw/L/b\nHlOCwaMQgb/dQPA5fpwVyGnVas6GK7gQvzznHAiHc9LgAeT0brybsEaAPOuA94/V\nA/ny4cub4Mzg0eFWf+C94i6lS1/gtuWI2PEva3259aEycV6gpYSOoPh3tYlBoVlM\ntj01l2eYfeBn5MNIWuhqfGTL4mLuzfiYsvnigdvTsOEIwgA=\n=yKCo\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.json b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.json new file mode 100644 index 00000000..61dc55e9 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.json @@ -0,0 +1,21 @@ +{ + "a": "ENC[AES256_GCM,data:/Q==,iv:q+yypwZjX2frKGNruAFF+XSnmz+IU3AQ5XuUMWhhyhA=,tag:skm5wsq8a3/EESLVic8yKw==,type:str]", + "c": "ENC[AES256_GCM,data:DQ==,iv:JvvR1pXyp6L+i4keXDwLM79oxP6K1nqeGkIC5OgR38c=,tag:QbtjRLx47fN5M4+zaaQBVA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:33Z", + "mac": "ENC[AES256_GCM,data:rbWY/H6bj2UFpybJHqsS02wjy8VMvNvzQUtd6fBMSsvvv1fYWWoULO32LGA635spoFkVyOpX4hipqVyjRfQ1KyP1rNssggaHMz+nRUUFOmiQAcT9wi/Y0IKWjgN1cjI1stCU10b5cfJZQ0SPi/OFC8KcptMaHpfDVF47ZfnprFs=,iv:rVtp2Ti4xHNOWeS4MKju1jFZ/VyE7oXXdTSpp4jSU34=,tag:kd0IeyLXY598kdvSX0+1DA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:18Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAPQ6Bn3MlvYUPs+e0njFUoq4AZAhR38BIWGAzTAMeWfIH\n0JZwol5f1leoyKX5Bmye1S+n72zZz3C4FxhSqh80boxNpHuVyeLrAkzv25AaAS8Q\n/9mSYquvJcIL7nWX/QmgTVTaXrqlxZSVva6Slwf7zlaLBqVJfv1RDwT6JEWDIJig\nJp35PKpwRe70IZDGAelcDtJicmjQrvfVhyb1/0kTTv4JdylixVnQdh9X/zw5ZSBG\nusEW/JG9nZ/xzKsEQpafCBLhP80jx3z37zKbsJ+4K2xsBTGQQdU5KdDSnosw/L/b\nHlOCwaMQgb/dQPA5fpwVyGnVas6GK7gQvzznHAiHc9LgAeT0brybsEaAPOuA94/V\nA/ny4cub4Mzg0eFWf+C94i6lS1/gtuWI2PEva3259aEycV6gpYSOoPh3tYlBoVlM\ntj01l2eYfeBn5MNIWuhqfGTL4mLuzfiYsvnigdvTsOEIwgA=\n=yKCo\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.json.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.yaml b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.yaml new file mode 100644 index 00000000..61dc55e9 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.yaml @@ -0,0 +1,21 @@ +{ + "a": "ENC[AES256_GCM,data:/Q==,iv:q+yypwZjX2frKGNruAFF+XSnmz+IU3AQ5XuUMWhhyhA=,tag:skm5wsq8a3/EESLVic8yKw==,type:str]", + "c": "ENC[AES256_GCM,data:DQ==,iv:JvvR1pXyp6L+i4keXDwLM79oxP6K1nqeGkIC5OgR38c=,tag:QbtjRLx47fN5M4+zaaQBVA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T20:21:33Z", + "mac": "ENC[AES256_GCM,data:rbWY/H6bj2UFpybJHqsS02wjy8VMvNvzQUtd6fBMSsvvv1fYWWoULO32LGA635spoFkVyOpX4hipqVyjRfQ1KyP1rNssggaHMz+nRUUFOmiQAcT9wi/Y0IKWjgN1cjI1stCU10b5cfJZQ0SPi/OFC8KcptMaHpfDVF47ZfnprFs=,iv:rVtp2Ti4xHNOWeS4MKju1jFZ/VyE7oXXdTSpp4jSU34=,tag:kd0IeyLXY598kdvSX0+1DA==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T20:21:18Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAPQ6Bn3MlvYUPs+e0njFUoq4AZAhR38BIWGAzTAMeWfIH\n0JZwol5f1leoyKX5Bmye1S+n72zZz3C4FxhSqh80boxNpHuVyeLrAkzv25AaAS8Q\n/9mSYquvJcIL7nWX/QmgTVTaXrqlxZSVva6Slwf7zlaLBqVJfv1RDwT6JEWDIJig\nJp35PKpwRe70IZDGAelcDtJicmjQrvfVhyb1/0kTTv4JdylixVnQdh9X/zw5ZSBG\nusEW/JG9nZ/xzKsEQpafCBLhP80jx3z37zKbsJ+4K2xsBTGQQdU5KdDSnosw/L/b\nHlOCwaMQgb/dQPA5fpwVyGnVas6GK7gQvzznHAiHc9LgAeT0brybsEaAPOuA94/V\nA/ny4cub4Mzg0eFWf+C94i6lS1/gtuWI2PEva3259aEycV6gpYSOoPh3tYlBoVlM\ntj01l2eYfeBn5MNIWuhqfGTL4mLuzfiYsvnigdvTsOEIwgA=\n=yKCo\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.yaml.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-json.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml new file mode 100644 index 00000000..d3a52a22 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml @@ -0,0 +1,27 @@ +a: ENC[AES256_GCM,data:lQ==,iv:8RdyROFAynjfYVNniCd0t8OQrFEboZREoBzAAOSudig=,tag:700olmYZs3sRhqcwnzor9A==,type:str] +c: ENC[AES256_GCM,data:wQ==,iv:11sU7IEMYeDWHwNFsx6CgvUNG8Inc26vujykniuF+dc=,tag:ijRW/zjV+G0w3mwnHp4I8Q==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:21:14Z' + mac: ENC[AES256_GCM,data:QHcAe20/paYldZucaM1PN21K0i5ngS0UxMMryReTi9M40x9J18pNXo8TUoQuq/4iWZqgAKph1/m/u5pTU8LyKTeBX/HGlkWLjYUH521OJoBWJ0gDKHcZ01L3djlPi8Gts0w5MW/hrUlVqE3hyccy32VsCseuQckkq6dWnvtOmw4=,iv:dMqoZy2JhitE9dAwDxaI5q0NIo0N+rTiXjlnZBUG06k=,tag:8D9RcA8RGV6pCq/HLayGWw==,type:str] + pgp: + - created_at: '2020-10-07T20:21:08Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAmsvCa83tx8AfOH2cVM4DMNcFSPeR8hQcrILjkvcWqk5s + dd9YqTo+b6nxbZGcRUcvMmMOUo8OOIjVGyT7Yk6itLm2AFjY4T40wE2UyNEW3Jys + ZG3Tvel28T++FXquMhhs0iqfEOFDwRyOAbW/dDCEfzqmPGnjHNYiiE70EwJ6dlQG + xqhmUQrEgcdgBO9fmCsREA8IJt6z1Le1SGAQPhBAYwJU/Gr8OzI5GvlHj8vdLWmJ + dSPG62Ju6MhGIpOdkKY6zH/XVRFrP1v1LwJ+kigUFNuSORczITHPGFbH8Mpysp2G + uz1y+LX49Ynq1MApJxoCMSapWwYE1nv4w0eDwjLJzdLgAeThTu8/4A029VVXtiu9 + dxtt4V0i4CPgkuFo0eB34hoAk4fgu+Vpe7jKQlaKKDYG0/hDUVcoEA+GBTO1GpKC + I0hrHJt5O+DY5Ecvy/je21+8tQOOfoohMT/i6tB0wuE56wA= + =NXWv + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.json b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.json new file mode 100644 index 00000000..d3a52a22 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.json @@ -0,0 +1,27 @@ +a: ENC[AES256_GCM,data:lQ==,iv:8RdyROFAynjfYVNniCd0t8OQrFEboZREoBzAAOSudig=,tag:700olmYZs3sRhqcwnzor9A==,type:str] +c: ENC[AES256_GCM,data:wQ==,iv:11sU7IEMYeDWHwNFsx6CgvUNG8Inc26vujykniuF+dc=,tag:ijRW/zjV+G0w3mwnHp4I8Q==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:21:14Z' + mac: ENC[AES256_GCM,data:QHcAe20/paYldZucaM1PN21K0i5ngS0UxMMryReTi9M40x9J18pNXo8TUoQuq/4iWZqgAKph1/m/u5pTU8LyKTeBX/HGlkWLjYUH521OJoBWJ0gDKHcZ01L3djlPi8Gts0w5MW/hrUlVqE3hyccy32VsCseuQckkq6dWnvtOmw4=,iv:dMqoZy2JhitE9dAwDxaI5q0NIo0N+rTiXjlnZBUG06k=,tag:8D9RcA8RGV6pCq/HLayGWw==,type:str] + pgp: + - created_at: '2020-10-07T20:21:08Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAmsvCa83tx8AfOH2cVM4DMNcFSPeR8hQcrILjkvcWqk5s + dd9YqTo+b6nxbZGcRUcvMmMOUo8OOIjVGyT7Yk6itLm2AFjY4T40wE2UyNEW3Jys + ZG3Tvel28T++FXquMhhs0iqfEOFDwRyOAbW/dDCEfzqmPGnjHNYiiE70EwJ6dlQG + xqhmUQrEgcdgBO9fmCsREA8IJt6z1Le1SGAQPhBAYwJU/Gr8OzI5GvlHj8vdLWmJ + dSPG62Ju6MhGIpOdkKY6zH/XVRFrP1v1LwJ+kigUFNuSORczITHPGFbH8Mpysp2G + uz1y+LX49Ynq1MApJxoCMSapWwYE1nv4w0eDwjLJzdLgAeThTu8/4A029VVXtiu9 + dxtt4V0i4CPgkuFo0eB34hoAk4fgu+Vpe7jKQlaKKDYG0/hDUVcoEA+GBTO1GpKC + I0hrHJt5O+DY5Ecvy/je21+8tQOOfoohMT/i6tB0wuE56wA= + =NXWv + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.json.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.yaml b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.yaml new file mode 100644 index 00000000..5ae3291d --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.yaml @@ -0,0 +1,27 @@ +a: ENC[AES256_GCM,data:lQ==,iv:8RdyROFAynjfYVNniCd0t8OQrFEboZREoBzAAOSudig=,tag:700olmYZs3sRhqcwnzor9A==,type:str] +c: ENC[AES256_GCM,data:wQ==,iv:11sU7IEMYeDWHwNFsx6CgvUNG8Inc26vujykniuF+dc=,tag:ijRW/zjV+G0w3mwnHp4I8Q==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + lastmodified: '2020-10-07T20:21:14Z' + mac: ENC[AES256_GCM,data:QHcAe20/paYldZucaM1PN21K0i5ngS0UxMMryReTi9M40x9J18pNXo8TUoQuq/4iWZqgAKph1/m/u5pTU8LyKTeBX/HGlkWLjYUH521OJoBWJ0gDKHcZ01L3djlPi8Gts0w5MW/hrUlVqE3hyccy32VsCseuQckkq6dWnvtOmw4=,iv:dMqoZy2JhitE9dAwDxaI5q0NIo0N+rTiXjlnZBUG06k=,tag:8D9RcA8RGV6pCq/HLayGWw==,type:str] + pgp: + - created_at: '2020-10-07T20:21:08Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgAmsvCa83tx8AfOH2cVM4DMNcFSPeR8hQcrILjkvcWqk5s + dd9YqTo+b6nxbZGcRUcvMmMOUo8OOIjVGyT7Yk6itLm2AFjY4T40wE2UyNEW3Jys + ZG3Tvel28T++FXquMhhs0iqfEOFDwRyOAbW/dDCEfzqmPGnjHNYiiE70EwJ6dlQG + xqhmUQrEgcdgBO9fmCsREA8IJt6z1Le1SGAQPhBAYwJU/Gr8OzI5GvlHj8vdLWmJ + dSPG62Ju6MhGIpOdkKY6zH/XVRFrP1v1LwJ+kigUFNuSORczITHPGFbH8Mpysp2G + uz1y+LX49Ynq1MApJxoCMSapWwYE1nv4w0eDwjLJzdLgAeThTu8/4A029VVXtiu9 + dxtt4V0i4CPgkuFo0eB34hoAk4fgu+Vpe7jKQlaKKDYG0/hDUVcoEA+GBTO1GpKC + I0hrHJt5O+DY5Ecvy/je21+8tQOOfoohMT/i6tB0wuE56wA= + =NXWv + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.6.1 diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.yaml.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/hidden-yaml.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/rstrip.sops b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/rstrip.sops new file mode 100644 index 00000000..a704dbad --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/rstrip.sops @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:+x5Q1yGxpgvMQiwwMiCAiU0B5KA7i1eMvuRRxNLpKH0LEEs/7rpOInqKtA==,iv:96ihzWMxW45FqN28BCtX1emDBcXln9FN87Yf8bTlbbA=,tag:a8SiDQjFffOYHwKp5IhU2Q==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-02T18:14:42Z", + "mac": "ENC[AES256_GCM,data:CyLyYbG6rVwT8sRqLxLBuWUrgtUHz8XVwCx7iyiJDL925jzMvkA2ZEYxH6CsiWwc5/7tcFGLDSCjYw3AHD9x42LmsaAefk7F4X55++EI5VZbmSwyHdxCqvMVycKLJm3YXfodos8bbEWDDXhbmMT92uJs7H/IBXywnQHG3qoJWJE=,iv:ljY/d++R5v8VY5Q8nV0lnNwaeuEiKG4VTY8fSgFJD+w=,tag:MEtTIFuiSj8ReQOZNxO1IQ==,type:str]", + "pgp": [ + { + "created_at": "2020-10-02T18:11:54Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAblvrgBIPsg01TJjde7YskLvPKC/1jt1kI/eoOQ/KdemW\ngaJf4PIWGzFUxZEXeRzo70HTS+sPTi0TQDDkwOfcNjlGb3dC1KQdIZ1UiuqhL1//\n1G0doMMztEyZ63SOElv3OaWHjcnvmP224rTuFpO6Pm8HHMKEbaw9N7YHObgSdIpk\nfqEP369xj6bk/yQNEuMbgQOk+7LAYPs8na7oxIrdkWrmIlVj5jEz08lVS/FJecty\nUDalNDBkRrqMgTvSAw0vJTzaPzw/V+6WTrHh/0FRvLKJlKOsesaoxahW2/H1Dxmr\npySYTs2omqOtr3RzkCrUXmHijim9DIwg0JsIjo5xytLgAeSjSr9/W1EucekSGbeM\nmYK+4cN/4ILgRuH75OAw4qu0IgrgWuX6Eo7vO2HPrUiFLA/j+7/Bi+HkBZZuMrlR\njhd7C7MQGuD85NF3TzP2hW895ZiDznjWutHi69caRuEeZQA=\n=Aqvj\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/rstrip.sops.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/rstrip.sops.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/rstrip.sops.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/simple.sops.yaml b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/simple.sops.yaml new file mode 100644 index 00000000..d7bfc2ea --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/simple.sops.yaml @@ -0,0 +1,25 @@ +foo: ENC[AES256_GCM,data:a25L,iv:X8ILHZr+YiyLWa90Y+cwoMD1nVuel7JyTs0A5+oiOOo=,tag:GbBtp+Yqx1KEjdyztqS4EQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-02-20T10:44:32Z' + mac: ENC[AES256_GCM,data:BAwQqD9sHgHkmlxPQLKq28Xy48qPp1B/+GDLEsIxir6WNhZgw8OgjVF1u/wCAad6qHkmN02Bwenr+aay6uKfCuOEsTRSvZ7v80yAU+h0wL3zJ/KMkRsE3QP3CWxcLQxInt+YaBjR+Q0IUjDXKm3u6ZomixZe5F5pwWr36ErV6Y0=,iv:e/iiyXQiCh8C2w/bc8mr/Psv+ehmqEMqEC1/bbGFHpY=,tag:NSDo2HISIBJhYvsqrU0mSA==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/simple.sops.yaml.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/simple.sops.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/simple.sops.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/wrong.yaml b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/wrong.yaml new file mode 100644 index 00000000..2df12739 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/wrong.yaml @@ -0,0 +1,2 @@ +--- +this-is-not: a sops file diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/wrong.yaml.license b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/wrong.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/files/wrong.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/meta/main.yml b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/meta/main.yml new file mode 100644 index 00000000..b7f89500 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/meta/main.yml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +dependencies: + - setup_sops diff --git a/ansible_collections/community/sops/tests/integration/targets/lookup_sops/tasks/main.yml b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/tasks/main.yml new file mode 100644 index 00000000..0131f01e --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/lookup_sops/tasks/main.yml @@ -0,0 +1,178 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- when: sops_installed + block: + + - name: Test lookup with missing file + set_fact: + sops_file_does_not_exists: "{{ lookup('community.sops.sops', 'file-does-not-exists.sops.yml') }}" + ignore_errors: true + register: sops_lookup_missing_file + + - assert: + that: + - "sops_lookup_missing_file is failed" + - "'could not locate file in lookup: file-does-not-exists.sops.yml' in sops_lookup_missing_file.msg" + + - name: Test lookup with missing file with empty_on_not_exist + set_fact: + sops_file_does_not_exists_empty: "{{ lookup('community.sops.sops', 'file-does-not-exists.sops.yml', empty_on_not_exist=true) }}" + register: sops_lookup_missing_file_empty_on_not_exist + + - assert: + that: + - "sops_lookup_missing_file_empty_on_not_exist is success" + - "sops_file_does_not_exists_empty == ''" + + - name: Test lookup of non-sops file + set_fact: + sops_wrong_file: "{{ lookup('community.sops.sops', 'wrong.yaml') }}" + ignore_errors: true + register: sops_lookup_wrong_file + + - assert: + that: + - "sops_lookup_wrong_file is failed" + - "'sops metadata not found' in sops_lookup_wrong_file.msg" + + - name: Test simple lookup + set_fact: + sops_success: "{{ lookup('community.sops.sops', 'simple.sops.yaml') }}" + ignore_errors: true + register: sops_lookup_simple + + - assert: + that: + - "sops_lookup_simple is success" + - "sops_success == 'foo: bar'" + + - name: Test rstrip + set_fact: + with_rstrip: "{{ lookup('community.sops.sops', 'rstrip.sops', rstrip=true) }}" + without_rstrip: "{{ lookup('community.sops.sops', 'rstrip.sops', rstrip=false) }}" + default_rstrip: "{{ lookup('community.sops.sops', 'rstrip.sops') }}" + + - assert: + that: + - with_rstrip == 'This file has three newlines at the end.' + - without_rstrip == 'This file has three newlines at the end.\n\n\n' + - default_rstrip == 'This file has three newlines at the end.' + + - name: Test binary + set_fact: + binary_with_rstrip: "{{ lookup('community.sops.sops', 'binary.sops', rstrip=true, base64=true) }}" + binary_without_rstrip: "{{ lookup('community.sops.sops', 'binary.sops', rstrip=false, base64=true) }}" + + - assert: + that: + - binary_with_rstrip == 'AQIDAAQ=' + - binary_without_rstrip == 'AQIDAAQgCg==' + + - name: Test hidden binary + set_fact: + hidden_binary: "{{ lookup('community.sops.sops', 'hidden-binary', output_type='binary') }}" + hidden_binary__json: "{{ lookup('community.sops.sops', 'hidden-binary.json', output_type='binary') }}" + hidden_binary__yaml: "{{ lookup('community.sops.sops', 'hidden-binary.yaml', output_type='binary') }}" + hidden_binary_yaml: "{{ lookup('community.sops.sops', 'hidden-binary-yaml', input_type='yaml', output_type='binary') }}" + hidden_binary_yaml__json: "{{ lookup('community.sops.sops', 'hidden-binary-yaml.json', input_type='yaml', output_type='binary') }}" + hidden_binary_yaml__yaml: "{{ lookup('community.sops.sops', 'hidden-binary-yaml.yaml', input_type='yaml', output_type='binary') }}" + hidden_json: "{{ lookup('community.sops.sops', 'hidden-json', input_type='json', output_type='json') }}" + hidden_json__json: "{{ lookup('community.sops.sops', 'hidden-json.json', input_type='json', output_type='json') }}" + hidden_json__yaml: "{{ lookup('community.sops.sops', 'hidden-json.yaml', input_type='json', output_type='json') }}" + hidden_yaml: "{{ lookup('community.sops.sops', 'hidden-yaml', input_type='yaml', output_type='yaml') }}" + hidden_yaml__json: "{{ lookup('community.sops.sops', 'hidden-yaml.json', input_type='yaml', output_type='yaml') }}" + hidden_yaml__yaml: "{{ lookup('community.sops.sops', 'hidden-yaml.yaml', input_type='yaml', output_type='yaml') }}" + hidden_json__as_yaml: "{{ lookup('community.sops.sops', 'hidden-json', input_type='json', output_type='yaml') }}" + hidden_json__json__as_yaml: "{{ lookup('community.sops.sops', 'hidden-json.json', input_type='json', output_type='yaml') }}" + hidden_json__yaml__as_yaml: "{{ lookup('community.sops.sops', 'hidden-json.yaml', input_type='json', output_type='yaml') }}" + hidden_yaml__as_json: "{{ lookup('community.sops.sops', 'hidden-yaml', input_type='yaml', output_type='json') }}" + hidden_yaml__json__as_json: "{{ lookup('community.sops.sops', 'hidden-yaml.json', input_type='yaml', output_type='json') }}" + hidden_yaml__yaml__as_json: "{{ lookup('community.sops.sops', 'hidden-yaml.yaml', input_type='yaml', output_type='json') }}" + + - assert: + that: + - hidden_binary == test_str_abcd + - hidden_binary__json == test_str_abcd + - hidden_binary__yaml == test_str_abcd + - hidden_binary_yaml == test_str_binary_data + - hidden_binary_yaml__json == test_str_binary_data + - hidden_binary_yaml__yaml == test_str_binary_data + - hidden_json == test_dict + - hidden_json__json == test_dict + - hidden_json__yaml == test_dict + - hidden_yaml == test_dict_yaml + - hidden_yaml__json == test_dict_yaml + - hidden_yaml__yaml == test_dict_yaml + - hidden_json__as_yaml == test_dict_yaml + - hidden_json__json__as_yaml == test_dict_yaml + - hidden_json__yaml__as_yaml == test_dict_yaml + - hidden_yaml__as_json == test_dict + - hidden_yaml__json__as_json == test_dict + - hidden_yaml__yaml__as_json == test_dict + vars: + test_dict: + a: b + c: d + test_dict_yaml: + "a: b\nc: d" + test_str_binary_data: This is binary data. + test_str_abcd: a is b, and c is d + + - name: Test fake sops binary (lookup parameters) + set_fact: + fake_sops_output: "{{ lookup('community.sops.sops', 'simple.sops.yaml', sops_binary=role_path ~ '/files/fake-sops.sh', enable_local_keyservice=True, aws_access_key_id='xxx') }}" + fake_sops_output_2: "{{ lookup('community.sops.sops', 'simple.sops.yaml', sops_binary=role_path ~ '/files/fake-sops-val.sh', config_path='/path/to/asdf', aws_secret_access_key='yyy') }}" + fake_sops_output_3: "{{ lookup('community.sops.sops', 'simple.sops.yaml', sops_binary=role_path ~ '/files/fake-sops-rep.sh', keyservice=['a', 'b'], aws_session_token='zzz') }}" + + - assert: + that: + - fake_sops_output == 'fake sops output' + - fake_sops_output_2 == 'fake sops output 2' + - fake_sops_output_3 == 'fake sops output 3' + + - name: Work around Ansible bug for next test + # https://github.com/ansible/ansible/issues/73268 + set_fact: + sops_binary: "{{ role_path }}/files/fake-sops.sh" + - name: Test fake sops binary (Ansible variables, 1/3) + set_fact: + fake_sops_output: "{{ lookup('community.sops.sops', 'simple.sops.yaml') }}" + vars: + # sops_binary: "{{ role_path }}/files/fake-sops.sh" + sops_enable_local_keyservice: true + sops_aws_access_key_id: xxx + + - name: Work around Ansible bug for next test + # https://github.com/ansible/ansible/issues/73268 + set_fact: + sops_binary: "{{ role_path }}/files/fake-sops-val.sh" + - name: Test fake sops binary (Ansible variables, 2/3) + set_fact: + fake_sops_output_2: "{{ lookup('community.sops.sops', 'simple.sops.yaml') }}" + vars: + # sops_binary: "{{ role_path }}/files/fake-sops-val.sh" + sops_config_path: /path/to/asdf + sops_aws_secret_access_key: yyy + + - name: Work around Ansible bug for next test + # https://github.com/ansible/ansible/issues/73268 + set_fact: + sops_binary: "{{ role_path }}/files/fake-sops-rep.sh" + - name: Test fake sops binary (Ansible variables, 3/3) + set_fact: + fake_sops_output_3: "{{ lookup('community.sops.sops', 'simple.sops.yaml') }}" + vars: + # sops_binary: "{{ role_path }}/files/fake-sops-rep.sh" + sops_keyservice: + - a + - b + sops_session_token: zzz + + - assert: + that: + - fake_sops_output == 'fake sops output' + - fake_sops_output_2 == 'fake sops output 2' + - fake_sops_output_3 == 'fake sops output 3' diff --git a/ansible_collections/community/sops/tests/integration/targets/role_install_latest/aliases b/ansible_collections/community/sops/tests/integration/targets/role_install_latest/aliases new file mode 100644 index 00000000..9493a6ee --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/role_install_latest/aliases @@ -0,0 +1,5 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +gha/install/3 diff --git a/ansible_collections/community/sops/tests/integration/targets/role_install_latest/tasks/main.yml b/ansible_collections/community/sops/tests/integration/targets/role_install_latest/tasks/main.yml new file mode 100644 index 00000000..97011dff --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/role_install_latest/tasks/main.yml @@ -0,0 +1,21 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Install latest sops + include_role: + name: community.sops.install + vars: + sops_version: latest + sops_github_token: "{{ github_token | default('') }}" + sops_github_latest_detection: "{{ github_latest_detection | default('auto') }}" + +- name: Figure out sops version + command: + cmd: sops --version + register: output + +- name: Print sops version + debug: + msg: '{{ output.stdout_lines | first }}' diff --git a/ansible_collections/community/sops/tests/integration/targets/role_install_localhost_remote/aliases b/ansible_collections/community/sops/tests/integration/targets/role_install_localhost_remote/aliases new file mode 100644 index 00000000..c8f115fa --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/role_install_localhost_remote/aliases @@ -0,0 +1,5 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +gha/install/2 diff --git a/ansible_collections/community/sops/tests/integration/targets/role_install_localhost_remote/tasks/main.yml b/ansible_collections/community/sops/tests/integration/targets/role_install_localhost_remote/tasks/main.yml new file mode 100644 index 00000000..2e836038 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/role_install_localhost_remote/tasks/main.yml @@ -0,0 +1,39 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Install sops 3.7.3 on localhost + include_role: + name: community.sops.install + vars: + sops_version: 3.7.3 + sops_install_on_localhost: true + sops_github_token: "{{ github_token | default('') | string }}" + +- name: Install sops 3.7.0 on remote + include_role: + name: community.sops.install + vars: + sops_version: 3.7.0 + sops_install_on_localhost: false + sops_github_token: "{{ github_token | default('') | string }}" + +- name: Figure out sops version on localhost + command: + cmd: sops --version + delegate_to: localhost + register: output_localhost + +- name: Figure out sops version on remote host + command: + cmd: sops --version + register: output_remote + +- name: Check sops version + assert: + that: + - >- + 'sops 3.7.3' in output_localhost.stdout + - >- + 'sops 3.7.0' in output_remote.stdout diff --git a/ansible_collections/community/sops/tests/integration/targets/role_install_version/aliases b/ansible_collections/community/sops/tests/integration/targets/role_install_version/aliases new file mode 100644 index 00000000..eb3fa263 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/role_install_version/aliases @@ -0,0 +1,5 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +gha/install/1 diff --git a/ansible_collections/community/sops/tests/integration/targets/role_install_version/tasks/main.yml b/ansible_collections/community/sops/tests/integration/targets/role_install_version/tasks/main.yml new file mode 100644 index 00000000..037a13b5 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/role_install_version/tasks/main.yml @@ -0,0 +1,40 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Install sops 3.7.3 + include_role: + name: community.sops.install + vars: + sops_version: 3.7.3 + sops_github_token: "{{ github_token | default('') | string }}" + +- name: Figure out sops version + command: + cmd: sops --version + register: output + +- name: Check sops version + assert: + that: + - >- + 'sops 3.7.3' in output.stdout + +- name: Install sops 3.7.0 + include_role: + name: community.sops.install + vars: + sops_version: 3.7.0 + sops_github_token: "{{ github_token | default('') | string }}" + +- name: Figure out sops version + command: + cmd: sops --version + register: output + +- name: Check sops version + assert: + that: + - >- + 'sops 3.7.0' in output.stdout diff --git a/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/handlers/main.yml b/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/handlers/main.yml new file mode 100644 index 00000000..f1c55b04 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/handlers/main.yml @@ -0,0 +1,10 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: delete temporary directory + include_tasks: default-cleanup.yml + +- name: delete temporary directory (windows) + include_tasks: windows-cleanup.yml diff --git a/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/tasks/default-cleanup.yml b/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/tasks/default-cleanup.yml new file mode 100644 index 00000000..cc74b70a --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/tasks/default-cleanup.yml @@ -0,0 +1,10 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: delete temporary directory + file: + path: "{{ remote_tmp_dir }}" + state: absent + no_log: true diff --git a/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/tasks/default.yml b/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/tasks/default.yml new file mode 100644 index 00000000..c9d871c6 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/tasks/default.yml @@ -0,0 +1,16 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: create temporary directory + tempfile: + state: directory + suffix: .test + register: remote_tmp_dir + notify: + - delete temporary directory + +- name: record temporary directory + set_fact: + remote_tmp_dir: "{{ remote_tmp_dir.path }}" diff --git a/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/tasks/main.yml b/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/tasks/main.yml new file mode 100644 index 00000000..babbdad0 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/setup_remote_tmp_dir/tasks/main.yml @@ -0,0 +1,20 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +#################################################################### +# WARNING: These are designed specifically for Ansible tests # +# and should not be used as examples of how to write Ansible roles # +#################################################################### + +- name: make sure we have the ansible_os_family and ansible_distribution_version facts + setup: + gather_subset: distribution + when: ansible_facts == {} + +- include_tasks: "{{ lookup('first_found', files)}}" + vars: + files: + - "{{ ansible_os_family | lower }}.yml" + - "default.yml" diff --git a/ansible_collections/community/sops/tests/integration/targets/setup_sops/tasks/install.yml b/ansible_collections/community/sops/tests/integration/targets/setup_sops/tasks/install.yml new file mode 100644 index 00000000..819d895e --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/setup_sops/tasks/install.yml @@ -0,0 +1,51 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Install sops on localhost + include_role: + name: community.sops.install + vars: + sops_install_on_localhost: true + sops_version: '{{ override_sops_version | default("latest") }}' + sops_github_token: "{{ github_token | default('') | string }}" + +- name: Install age on localhost + include_role: + name: community.sops._install_age + vars: + sops_install_on_localhost: true + +- name: Download sops test GPG key on localhost + get_url: + url: https://raw.githubusercontent.com/mozilla/sops/master/pgp/sops_functional_tests_key.asc + dest: /tmp/sops_functional_tests_key.asc + delegate_to: localhost + +- name: Import sops test GPG key on localhost + command: gpg --import /tmp/sops_functional_tests_key.asc + ignore_errors: true + delegate_to: localhost + +# --------------------------------------------------------------------------- + +- name: Install sops on remote + include_role: + name: community.sops.install + vars: + sops_version: '{{ override_sops_version | default("latest") }}' + sops_github_token: "{{ github_token | default('') | string }}" + +- name: Install age on remote + include_role: + name: community.sops._install_age + +- name: Download sops test GPG key on remote + get_url: + url: https://raw.githubusercontent.com/mozilla/sops/master/pgp/sops_functional_tests_key.asc + dest: /tmp/sops_functional_tests_key.asc + +- name: Import sops test GPG key on remote + command: gpg --import /tmp/sops_functional_tests_key.asc + ignore_errors: true diff --git a/ansible_collections/community/sops/tests/integration/targets/setup_sops/tasks/main.yml b/ansible_collections/community/sops/tests/integration/targets/setup_sops/tasks/main.yml new file mode 100644 index 00000000..e5ec6325 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/setup_sops/tasks/main.yml @@ -0,0 +1,28 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Test whether sops is installed + command: sops --help + ignore_errors: true + changed_when: false + register: sops_help_command + +- name: Install sops + include_tasks: install.yml + when: sops_help_command is failed + +- name: Skip sops installation + when: sops_help_command is not failed + block: + - name: Test whether age is installed + command: age --version + ignore_errors: true + changed_when: false + register: age_version_command + + - name: Set results + set_fact: + sops_installed: true + age_installed: '{{ age_version_command is not failed }}' diff --git a/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/aliases b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/aliases new file mode 100644 index 00000000..3a9daf6c --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/aliases @@ -0,0 +1,8 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +gha/main +skip/aix +skip/osx +skip/freebsd diff --git a/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/.sops.yaml b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/.sops.yaml new file mode 100644 index 00000000..e28ce962 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/.sops.yaml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +creation_rules: + - pgp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 diff --git a/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/broken-json-yaml b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/broken-json-yaml new file mode 100644 index 00000000..d6d7f7f2 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/broken-json-yaml @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:Gw==,iv:zVZEcknNNtMsjB7jLYUZglzdLIrHS658uwjOD4Kth6A=,tag:gzP41dCGjBAedV+XiQFepw==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-10-07T19:25:02Z", + "mac": "ENC[AES256_GCM,data:KnhqQH9rRqJ0XC40qhI79WtNBSiE9ym3SO58Bw09Bev9kq6uMVxAm9iOZvjQazOupELHaJiLO6fWT3FCoZfiU0IJBkN8JzFsKr2C59UH4B8f0RJZhNrAJ3AriBFPateFneDbrwjld0xEhP+2f286yIFv/xc/DEEPduIKRvkVN4I=,iv:yg06T0+gQ4j+bF3NAxQqwwPlJGBCcHTV6APzKT1x334=,tag:cVQ7oAh0HJ2rM8b6gVpdUg==,type:str]", + "pgp": [ + { + "created_at": "2020-10-07T19:24:59Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgApb3VzPV0KmRyGRSiqPVRaM0cBthJtHu9H22QGXFAb8X/\nBLPXFBlFoFKbg9eUzG0EfKDzF1f5Aeeme3Fq6cGjmtU1oyynQLFtb3369zAC+Itf\nZo3u8pjC8YDPg2NpEFrAg4YZgVIr56UdEjjC4CDvzgYd08WCIYABIO6iedSneTh2\nBcqCDc5WY5vzUnon29kUnpolOPHXjDE3PHCynbdoELrlYY3lmw4ymD0sBdtcBDER\nAtM4s3Xz7C5XhF134GmxMdQ5P/QdxSR2L1vgludDs8/Q62OxSGw3vnLXFXkHmaBQ\nxYrt+0ehNAreL/TaR5em0Bu3Bk00RxmQnrUFLc1G2dLgAeRUspltx0tjMT7eiBxx\nwQ0I4W5u4PvgVOGSG+Bp4uin1nXgduUcQnRT3Dmr1EpBbDAhZ9ldlthrxk7Ir15H\ndEJxe7jtsOAk5HlYOWliZOyFb2JtqtNqMGjimD4JPeEXOgA=\n=eh24\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/broken-json-yaml.license b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/broken-json-yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/broken-json-yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/wrong.yaml b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/wrong.yaml new file mode 100644 index 00000000..3f3fff63 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/files/wrong.yaml @@ -0,0 +1,6 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +this-is-not: a sops file diff --git a/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/meta/main.yml b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/meta/main.yml new file mode 100644 index 00000000..344e8b86 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/meta/main.yml @@ -0,0 +1,8 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +dependencies: + - setup_sops + - setup_remote_tmp_dir diff --git a/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/tasks/main.yml b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/tasks/main.yml new file mode 100644 index 00000000..4696a7b3 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/sops_encrypt/tasks/main.yml @@ -0,0 +1,411 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- when: sops_installed + block: + - name: Place .sops.yaml + copy: + src: ".sops.yaml" + dest: "{{ remote_tmp_dir }}/.sops.yaml" + + - name: Define test objects + set_fact: + text_value_1: This is a text. + text_value_2: |+ + This is another text! + + it has two newlines at the end. + + binary_value_1_b64: 'AQIDAAQ=' + binary_value_2_b64: 'AQIDAAQgCg==' + json_value_1: + key1: value1 + key2: + - value2.1 + - value2.2 + json_value_2: + key1: value1 + key3: + - value3.1 + - value3.2 + - value3.3 + - value3.4 + + # Invalid Base64 + + - name: Create binary file + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_bad_base64" + content_binary: This is not Base64 + ignore_errors: true + register: result_not_base64 + + - assert: + that: + - result_not_base64 is failed + - '"Cannot decode Base64 encoded data" in result_not_base64.msg' + + # Broken file overwrite + + - name: Place broken file + copy: + dest: "{{ remote_tmp_dir }}/broken" + content: I'm not sops encrypted + + - name: Cannot decode existing file (overwrite, check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/broken" + content_text: Test + ignore_errors: true + register: result_cannot_decode_check + check_mode: true + + - name: Cannot decode existing file (overwrite) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/broken" + content_text: Test + ignore_errors: true + register: result_cannot_decode + + - name: Cannot decode existing file (force, check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/broken" + content_text: Test + force: true + register: result_cannot_decode_force_check + check_mode: true + + - name: Cannot decode existing file (force) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/broken" + content_text: Test + force: true + register: result_cannot_decode_force + + - slurp: + src: "{{ remote_tmp_dir ~ '/broken' }}" + register: slurp + - set_fact: + value: "{{ slurp.content | b64decode | community.sops.decrypt(rstrip=False, output_type='binary') }}" + + - assert: + that: + - result_cannot_decode_check is failed + - result_cannot_decode is failed + - result_cannot_decode_force_check is changed + - result_cannot_decode_force is changed + - value == 'Test' + + # Text content + + - name: Create text file (check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_text" + content_text: "{{ text_value_1 }}" + check_mode: true + register: result_check + + - name: Create text file + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_text" + content_text: "{{ text_value_1 }}" + register: result + + - slurp: + src: "{{ remote_tmp_dir ~ '/test_text' }}" + register: slurp + - set_fact: + value_1: "{{ slurp.content | b64decode | community.sops.decrypt(rstrip=False, output_type='binary') }}" + + - name: Create text file (idempotency, check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_text" + content_text: "{{ text_value_1 }}" + check_mode: true + register: result_idempotent_check + + - name: Create text file (idempotency) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_text" + content_text: "{{ text_value_1 }}" + register: result_idempotent + + - name: Create text file (change, check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_text" + content_text: "{{ text_value_2 }}" + check_mode: true + register: result_change_check + + - name: Create text file (change) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_text" + content_text: "{{ text_value_2 }}" + register: result_change + + - slurp: + src: "{{ remote_tmp_dir ~ '/test_text' }}" + register: slurp + - set_fact: + value_2: "{{ slurp.content | b64decode | community.sops.decrypt(rstrip=false, output_type='binary') }}" + + - assert: + that: + - result_check is changed + - result is changed + - value_1 == text_value_1 + - result_idempotent_check is not changed + - result_idempotent is not changed + - result_change_check is changed + - result_change is changed + - value_2 == text_value_2 + + # Binary content + + - name: Create binary file (check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_binary" + content_binary: "{{ binary_value_1_b64 }}" + check_mode: true + register: result_check + + - name: Create binary file + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_binary" + content_binary: "{{ binary_value_1_b64 }}" + register: result + + - slurp: + src: "{{ remote_tmp_dir ~ '/test_binary' }}" + register: slurp + - set_fact: + value_1: "{{ slurp.content | b64decode | community.sops.decrypt(rstrip=False, output_type='binary') | b64encode }}" + + - name: Create binary file (idempotency, check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_binary" + content_binary: "{{ binary_value_1_b64 }}" + check_mode: true + register: result_idempotent_check + + - name: Create binary file (idempotency) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_binary" + content_binary: "{{ binary_value_1_b64 }}" + register: result_idempotent + + - name: Create binary file (change, check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_binary" + content_binary: "{{ binary_value_2_b64 }}" + check_mode: true + register: result_change_check + + - name: Create binary file (change) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_binary" + content_binary: "{{ binary_value_2_b64 }}" + register: result_change + + - slurp: + src: "{{ remote_tmp_dir ~ '/test_binary' }}" + register: slurp + - set_fact: + value_2: "{{ slurp.content | b64decode | community.sops.decrypt(rstrip=false, output_type='binary') | b64encode }}" + + - assert: + that: + - result_check is changed + - result is changed + - value_1 == binary_value_1_b64 + - result_idempotent_check is not changed + - result_idempotent is not changed + - result_change_check is changed + - result_change is changed + - value_2 == binary_value_2_b64 + + # JSON content + + - name: Create JSON file (check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_json" + content_json: "{{ json_value_1 }}" + check_mode: true + register: result_check + + - name: Create JSON file + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_json" + content_json: "{{ json_value_1 }}" + register: result + + - slurp: + src: "{{ remote_tmp_dir ~ '/test_json' }}" + register: slurp + - set_fact: + value_1_raw: "{{ slurp.content | b64decode | community.sops.decrypt(output_type='json') | b64encode }}" + value_1: "{{ slurp.content | b64decode | community.sops.decrypt(output_type='json') | from_json }}" + + - name: Create JSON file (idempotency, check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_json" + content_json: "{{ json_value_1 }}" + check_mode: true + register: result_idempotent_check + + - name: Create JSON file (idempotency) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_json" + content_json: "{{ json_value_1 }}" + register: result_idempotent + + - name: Create JSON file (change, check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_json" + content_json: "{{ json_value_2 }}" + check_mode: true + register: result_change_check + + - name: Create JSON file (change) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_json" + content_json: "{{ json_value_2 }}" + register: result_change + + - slurp: + src: "{{ remote_tmp_dir ~ '/test_json' }}" + register: slurp + - set_fact: + value_2: "{{ slurp.content | b64decode | community.sops.decrypt(output_type='json') | from_json }}" + + - name: Place broken JSON file + copy: + src: "broken-json-yaml" + dest: "{{ remote_tmp_dir }}/test_json_broken" + + - name: Update broken JSON file + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_json_broken" + content_json: "{{ json_value_1 }}" + register: result_broken_change + + - assert: + that: + - result_check is changed + - result is changed + - (value_1_raw | b64decode).startswith('{') + - value_1 == json_value_1 + - result_idempotent_check is not changed + - result_idempotent is not changed + - result_change_check is changed + - result_change is changed + - value_2 == json_value_2 + - result_broken_change is changed + + # YAML content + + - name: Create YAML file (check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_yaml" + content_yaml: "{{ json_value_1 }}" + check_mode: true + register: result_check + + - name: Create YAML file + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_yaml" + content_yaml: "{{ json_value_1 }}" + register: result + + - slurp: + src: "{{ remote_tmp_dir ~ '/test_yaml' }}" + register: slurp + - set_fact: + value_1_raw: "{{ slurp.content | b64decode | community.sops.decrypt(output_type='yaml') | b64encode }}" + value_1: "{{ slurp.content | b64decode | community.sops.decrypt(output_type='yaml') | from_yaml }}" + + - name: Create YAML file (idempotency, check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_yaml" + content_yaml: "{{ json_value_1 }}" + check_mode: true + register: result_idempotent_check + + - name: Create YAML file (idempotency) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_yaml" + content_yaml: "{{ json_value_1 }}" + register: result_idempotent + + - name: Create YAML file (change, check mode) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_yaml" + content_yaml: "{{ json_value_2 }}" + check_mode: true + register: result_change_check + + - name: Create YAML file (change) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_yaml" + content_yaml: "{{ json_value_2 }}" + register: result_change + + - slurp: + src: "{{ remote_tmp_dir ~ '/test_yaml' }}" + register: slurp + - set_fact: + value_2: "{{ slurp.content | b64decode | community.sops.decrypt(output_type='yaml') | from_yaml }}" + + - name: Place broken YAML file + copy: + src: "broken-json-yaml" + dest: "{{ remote_tmp_dir }}/test_yaml_broken" + + - name: Update broken YAML file + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_yaml_broken" + content_json: "{{ json_value_1 }}" + register: result_broken_change + + - assert: + that: + - result_check is changed + - result is changed + - not (value_1_raw | b64decode).startswith('{') + - value_1 == json_value_1 + - result_idempotent_check is not changed + - result_idempotent is not changed + - result_change_check is changed + - result_change is changed + - value_2 == json_value_2 + - result_broken_change is changed + + # Output type JSON + + - name: Create text file with output type JSON + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_output_type.json" + content_text: "{{ text_value_1 }}" + register: result + + - slurp: + src: "{{ remote_tmp_dir ~ '/test_output_type.json' }}" + register: slurp + - set_fact: + value_1: "{{ slurp.content | b64decode | community.sops.decrypt(rstrip=False, output_type='json') | from_json }}" + value_2: "{{ slurp.content | b64decode }}" + + - name: Create text file with output type JSON (idempotency) + community.sops.sops_encrypt: + path: "{{ remote_tmp_dir }}/test_output_type.json" + content_text: "{{ text_value_1 }}" + register: result_idem + + - assert: + that: + - result_idem is not changed + - value_1.data == text_value_1 + - '"data" in value_2' + - value_2.data.startswith('ENC[') diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/.gitignore b/ansible_collections/community/sops/tests/integration/targets/var_sops/.gitignore new file mode 100644 index 00000000..d35533bf --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/.gitignore @@ -0,0 +1,5 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +*/out diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/.sops.yaml b/ansible_collections/community/sops/tests/integration/targets/var_sops/.sops.yaml new file mode 100644 index 00000000..e28ce962 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/.sops.yaml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +creation_rules: + - pgp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/README.md b/ansible_collections/community/sops/tests/integration/targets/var_sops/README.md new file mode 100644 index 00000000..38a3cfaa --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/README.md @@ -0,0 +1,26 @@ +<!-- +Copyright (c) Ansible Project +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +--> + +## How the tests work + +`ansible-test integration --docker ubuntu1804 -v var_sops` essentially executes `runme.sh`. That script does: + +1. Make sure it isn't run for Ansible 2.9 (which does not support vars plugins); +2. Use the `setup.yml` playbook to install the requirements (sops); +3. Look at all subdirectories called `test-*`, and for each of them: + 1. Execute the playbook `playbook.yml` in it; + 2. Call `validate.sh` in it with parameters `<exit_code> <path_to_captured_output>`; + 3. If `validate.sh` exists with an exit code not equal to 0, the test has failed. + +## Adding more tests + +If possible, extend an existing test. If that's not possible, or if you are afraid to pollute one's test environment with more data, create a new one: + +1. Create a subdirectory `test-<name_of_your_test>`; +2. Create a `playbook.yml` and `validate.sh` in there (copy from a similar test and adjust); +3. Create subdirectories `group_vars` and/or `host_vars` and fill them as needed. + +For creating sops encrypted files, use the private GPG keys from https://raw.githubusercontent.com/mozilla/sops/master/pgp/sops_functional_tests_key.asc. There is a `.sops.yaml` file in this directory which makes sure that sops automatically uses the correct one of the keys provided in that file. diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/aliases b/ansible_collections/community/sops/tests/integration/targets/var_sops/aliases new file mode 100644 index 00000000..977ec388 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/aliases @@ -0,0 +1,9 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +gha/main +skip/aix +skip/osx +skip/freebsd +skip/python2.6 # lookups are controller only, and we no longer support Python 2.6 on the controller diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/meta/main.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/meta/main.yml new file mode 100644 index 00000000..b7f89500 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/meta/main.yml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +dependencies: + - setup_sops diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/runme.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/runme.sh new file mode 100755 index 00000000..2b9e6ee2 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/runme.sh @@ -0,0 +1,37 @@ +#!/usr/bin/env bash +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -eux + +# Don't run this on Ansible 2.9 +if (ansible --version | grep '^ansible 2\.9\.'); then + # Ansible 2.9 doesn't know about var plugins + exit +fi + +# Install sops +ANSIBLE_ROLES_PATH=.. ansible-playbook setup.yml + +if [ "$(command -v sops)" == "" ]; then + # sops was not installed + exit +fi + +for TEST in $(find . -maxdepth 1 -type d -name 'test-*' | sort); do + ( + cd "${TEST}" + if [ -x "setup.sh" ]; then + ./setup.sh + fi + if [ -x "run.sh" ]; then + ANSIBLE_VARS_ENABLED=host_group_vars,community.sops.sops ./run.sh "$@" 2>&1 | tee out + RESULT=${PIPESTATUS[0]} + else + ANSIBLE_VARS_ENABLED=host_group_vars,community.sops.sops ansible-playbook playbook.yml -i hosts -v "$@" 2>&1 | tee out + RESULT=${PIPESTATUS[0]} + fi + ./validate.sh "${RESULT}" out + ) +done diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/setup.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/setup.yml new file mode 100644 index 00000000..d1a65821 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/setup.yml @@ -0,0 +1,10 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- hosts: localhost + tasks: + - name: Setup sops + import_role: + name: setup_sops diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/group_vars/all.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/group_vars/all.sops.yml new file mode 100644 index 00000000..3f3fff63 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/group_vars/all.sops.yml @@ -0,0 +1,6 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +this-is-not: a sops file diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/hosts b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/hosts new file mode 100644 index 00000000..f43ae790 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/hosts @@ -0,0 +1,6 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +[all] +localhost ansible_connection=local ansible_python_interpreter="{{ ansible_playbook_python }}" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/playbook.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/playbook.yml new file mode 100644 index 00000000..b5329165 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/playbook.yml @@ -0,0 +1,14 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- hosts: localhost + gather_facts: false + tasks: + - name: Make sure group_vars/all.sops.yaml was found + debug: + msg: '{{ foo }}' + - name: Make sure group_vars/all/test.sops.yaml was found + debug: + msg: '{{ bar }}' diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/validate.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/validate.sh new file mode 100755 index 00000000..4e21434c --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-bad-file/validate.sh @@ -0,0 +1,13 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -eux + +if [ "$1" != 4 ]; then + exit 1 +fi + +grep -F "ERROR! error with file" "$2" +grep "sops metadata not found" "$2" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/group_vars/all.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/group_vars/all.sops.yml new file mode 100644 index 00000000..02ad8294 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/group_vars/all.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +foo: ENC[AES256_GCM,data:a25L,iv:X8ILHZr+YiyLWa90Y+cwoMD1nVuel7JyTs0A5+oiOOo=,tag:GbBtp+Yqx1KEjdyztqS4EQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-02-20T10:44:32Z' + mac: ENC[AES256_GCM,data:BAwQqD9sHgHkmlxPQLKq28Xy48qPp1B/+GDLEsIxir6WNhZgw8OgjVF1u/wCAad6qHkmN02Bwenr+aay6uKfCuOEsTRSvZ7v80yAU+h0wL3zJ/KMkRsE3QP3CWxcLQxInt+YaBjR+Q0IUjDXKm3u6ZomixZe5F5pwWr36ErV6Y0=,iv:e/iiyXQiCh8C2w/bc8mr/Psv+ehmqEMqEC1/bbGFHpY=,tag:NSDo2HISIBJhYvsqrU0mSA==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/group_vars/all/test.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/group_vars/all/test.sops.yml new file mode 100644 index 00000000..8d9120d2 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/group_vars/all/test.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +bar: ENC[AES256_GCM,data:UGteX9JKWhU=,iv:hgH8BeRf2W4gY4FSyXR/VKR879piGW2MSKJIppFgIJo=,tag:2XKpN3jGGEBBXiJPHi93ew==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-09-01T16:17:15Z' + mac: ENC[AES256_GCM,data:jw/wSpkqwN1Nun1VGLecyJy/yZLtyB57kmoODRhK9/c7nZU8pgTfcATfysyUq0YXWGvpy3mxvlGhaMrHu0DzNCGlsic6OXWDJBPVX3xYeeiUw5KmLxbYPpIXXLYfyu/mWDrToY2o1rpGzJqT7SuZwfFIEX1gZMFnATdROXwVKBU=,iv:ZrgM8BoaLHh4knvJlTqsycOdHNt2oqiFCl/81fr9zP0=,tag:UfhMIr1ByFQhY9B9GpYAmQ==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/hosts b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/hosts new file mode 100644 index 00000000..f43ae790 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/hosts @@ -0,0 +1,6 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +[all] +localhost ansible_connection=local ansible_python_interpreter="{{ ansible_playbook_python }}" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/playbook.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/playbook.yml new file mode 100644 index 00000000..12de052b --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/playbook.yml @@ -0,0 +1,11 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- hosts: localhost + gather_facts: false + tasks: + - name: Make sure group_vars/all.sops.yaml was not loaded. + debug: + msg: '{{ foo }}' # Will throw an undefined error. diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/run.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/run.sh new file mode 100755 index 00000000..db563575 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/run.sh @@ -0,0 +1,8 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -e +SOPS_ANSIBLE_AWX_DISABLE_VARS_PLUGIN_TEMPORARILY=true \ +ansible-playbook playbook.yml -i hosts -v "$@" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/validate.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/validate.sh new file mode 100755 index 00000000..ecd1625b --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-disable-sops/validate.sh @@ -0,0 +1,12 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -eux + +if [ "$1" != 2 ]; then + exit 1 +fi + +grep -F "The error was: 'foo' is undefined" "$2" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/group_vars b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/group_vars new file mode 100644 index 00000000..6ffd5ab0 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/group_vars @@ -0,0 +1,3 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/hosts b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/hosts new file mode 100644 index 00000000..f43ae790 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/hosts @@ -0,0 +1,6 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +[all] +localhost ansible_connection=local ansible_python_interpreter="{{ ansible_playbook_python }}" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/playbook.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/playbook.yml new file mode 100644 index 00000000..814477e3 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/playbook.yml @@ -0,0 +1,11 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- hosts: localhost + gather_facts: false + tasks: + - name: Idle + debug: + msg: '' diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/validate.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/validate.sh new file mode 100755 index 00000000..bc3804f5 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-not-dir/validate.sh @@ -0,0 +1,12 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -eux + +if [ "$1" != 0 ]; then + exit 1 +fi + +grep -F "[WARNING]: Found group_vars that is not a directory, skipping:" "$2" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/.gitignore b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/.gitignore new file mode 100644 index 00000000..c93c3681 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/.gitignore @@ -0,0 +1,5 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +group_vars/ diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/1.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/1.sops.yml new file mode 100644 index 00000000..02ad8294 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/1.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +foo: ENC[AES256_GCM,data:a25L,iv:X8ILHZr+YiyLWa90Y+cwoMD1nVuel7JyTs0A5+oiOOo=,tag:GbBtp+Yqx1KEjdyztqS4EQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-02-20T10:44:32Z' + mac: ENC[AES256_GCM,data:BAwQqD9sHgHkmlxPQLKq28Xy48qPp1B/+GDLEsIxir6WNhZgw8OgjVF1u/wCAad6qHkmN02Bwenr+aay6uKfCuOEsTRSvZ7v80yAU+h0wL3zJ/KMkRsE3QP3CWxcLQxInt+YaBjR+Q0IUjDXKm3u6ZomixZe5F5pwWr36ErV6Y0=,iv:e/iiyXQiCh8C2w/bc8mr/Psv+ehmqEMqEC1/bbGFHpY=,tag:NSDo2HISIBJhYvsqrU0mSA==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/2.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/2.sops.yml new file mode 100644 index 00000000..8d9120d2 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/2.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +bar: ENC[AES256_GCM,data:UGteX9JKWhU=,iv:hgH8BeRf2W4gY4FSyXR/VKR879piGW2MSKJIppFgIJo=,tag:2XKpN3jGGEBBXiJPHi93ew==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-09-01T16:17:15Z' + mac: ENC[AES256_GCM,data:jw/wSpkqwN1Nun1VGLecyJy/yZLtyB57kmoODRhK9/c7nZU8pgTfcATfysyUq0YXWGvpy3mxvlGhaMrHu0DzNCGlsic6OXWDJBPVX3xYeeiUw5KmLxbYPpIXXLYfyu/mWDrToY2o1rpGzJqT7SuZwfFIEX1gZMFnATdROXwVKBU=,iv:ZrgM8BoaLHh4knvJlTqsycOdHNt2oqiFCl/81fr9zP0=,tag:UfhMIr1ByFQhY9B9GpYAmQ==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/hosts b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/hosts new file mode 100644 index 00000000..f43ae790 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/hosts @@ -0,0 +1,6 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +[all] +localhost ansible_connection=local ansible_python_interpreter="{{ ansible_playbook_python }}" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/playbook.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/playbook.yml new file mode 100644 index 00000000..18326389 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/playbook.yml @@ -0,0 +1,22 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- hosts: localhost + gather_facts: false + tasks: + - name: Make sure group_vars/all.sops.yaml was loaded + assert: + that: + - foo is defined + - bar is not defined + - name: Replace group_vars/all.sops.yaml + copy: + src: 2.sops.yml + dest: group_vars/all.sops.yaml + - name: Make sure that updated group_vars/all.sops.yaml was not loaded + assert: + that: + - foo is defined + - bar is not defined diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/run.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/run.sh new file mode 100755 index 00000000..f05dbab3 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/run.sh @@ -0,0 +1,9 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -e +ANSIBLE_VARS_SOPS_PLUGIN_STAGE=inventory \ +ANSIBLE_VARS_SOPS_PLUGIN_CACHE=true \ +ansible-playbook playbook.yml -i hosts -v "$@" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/setup.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/setup.sh new file mode 100755 index 00000000..e4448001 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/setup.sh @@ -0,0 +1,8 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +rm -rf group_vars/ +mkdir -p group_vars/ +cp 1.sops.yml group_vars/all.sops.yaml diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/validate.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/validate.sh new file mode 100755 index 00000000..bbd8c591 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-cache/validate.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -eux + +if [ "$1" != 0 ]; then + exit 1 +fi diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/.gitignore b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/.gitignore new file mode 100644 index 00000000..c93c3681 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/.gitignore @@ -0,0 +1,5 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +group_vars/ diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/1.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/1.sops.yml new file mode 100644 index 00000000..02ad8294 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/1.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +foo: ENC[AES256_GCM,data:a25L,iv:X8ILHZr+YiyLWa90Y+cwoMD1nVuel7JyTs0A5+oiOOo=,tag:GbBtp+Yqx1KEjdyztqS4EQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-02-20T10:44:32Z' + mac: ENC[AES256_GCM,data:BAwQqD9sHgHkmlxPQLKq28Xy48qPp1B/+GDLEsIxir6WNhZgw8OgjVF1u/wCAad6qHkmN02Bwenr+aay6uKfCuOEsTRSvZ7v80yAU+h0wL3zJ/KMkRsE3QP3CWxcLQxInt+YaBjR+Q0IUjDXKm3u6ZomixZe5F5pwWr36ErV6Y0=,iv:e/iiyXQiCh8C2w/bc8mr/Psv+ehmqEMqEC1/bbGFHpY=,tag:NSDo2HISIBJhYvsqrU0mSA==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/2.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/2.sops.yml new file mode 100644 index 00000000..8d9120d2 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/2.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +bar: ENC[AES256_GCM,data:UGteX9JKWhU=,iv:hgH8BeRf2W4gY4FSyXR/VKR879piGW2MSKJIppFgIJo=,tag:2XKpN3jGGEBBXiJPHi93ew==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-09-01T16:17:15Z' + mac: ENC[AES256_GCM,data:jw/wSpkqwN1Nun1VGLecyJy/yZLtyB57kmoODRhK9/c7nZU8pgTfcATfysyUq0YXWGvpy3mxvlGhaMrHu0DzNCGlsic6OXWDJBPVX3xYeeiUw5KmLxbYPpIXXLYfyu/mWDrToY2o1rpGzJqT7SuZwfFIEX1gZMFnATdROXwVKBU=,iv:ZrgM8BoaLHh4knvJlTqsycOdHNt2oqiFCl/81fr9zP0=,tag:UfhMIr1ByFQhY9B9GpYAmQ==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/hosts b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/hosts new file mode 100644 index 00000000..f43ae790 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/hosts @@ -0,0 +1,6 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +[all] +localhost ansible_connection=local ansible_python_interpreter="{{ ansible_playbook_python }}" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/playbook.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/playbook.yml new file mode 100644 index 00000000..18326389 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/playbook.yml @@ -0,0 +1,22 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- hosts: localhost + gather_facts: false + tasks: + - name: Make sure group_vars/all.sops.yaml was loaded + assert: + that: + - foo is defined + - bar is not defined + - name: Replace group_vars/all.sops.yaml + copy: + src: 2.sops.yml + dest: group_vars/all.sops.yaml + - name: Make sure that updated group_vars/all.sops.yaml was not loaded + assert: + that: + - foo is defined + - bar is not defined diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/run.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/run.sh new file mode 100755 index 00000000..fd848bdc --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/run.sh @@ -0,0 +1,9 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -e +ANSIBLE_VARS_SOPS_PLUGIN_STAGE=inventory \ +ANSIBLE_VARS_SOPS_PLUGIN_CACHE=false \ +ansible-playbook playbook.yml -i hosts -v "$@" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/setup.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/setup.sh new file mode 100755 index 00000000..e4448001 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/setup.sh @@ -0,0 +1,8 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +rm -rf group_vars/ +mkdir -p group_vars/ +cp 1.sops.yml group_vars/all.sops.yaml diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/validate.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/validate.sh new file mode 100755 index 00000000..bbd8c591 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-inv-no-cache/validate.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -eux + +if [ "$1" != 0 ]; then + exit 1 +fi diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/.gitignore b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/.gitignore new file mode 100644 index 00000000..c93c3681 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/.gitignore @@ -0,0 +1,5 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +group_vars/ diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/1.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/1.sops.yml new file mode 100644 index 00000000..02ad8294 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/1.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +foo: ENC[AES256_GCM,data:a25L,iv:X8ILHZr+YiyLWa90Y+cwoMD1nVuel7JyTs0A5+oiOOo=,tag:GbBtp+Yqx1KEjdyztqS4EQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-02-20T10:44:32Z' + mac: ENC[AES256_GCM,data:BAwQqD9sHgHkmlxPQLKq28Xy48qPp1B/+GDLEsIxir6WNhZgw8OgjVF1u/wCAad6qHkmN02Bwenr+aay6uKfCuOEsTRSvZ7v80yAU+h0wL3zJ/KMkRsE3QP3CWxcLQxInt+YaBjR+Q0IUjDXKm3u6ZomixZe5F5pwWr36ErV6Y0=,iv:e/iiyXQiCh8C2w/bc8mr/Psv+ehmqEMqEC1/bbGFHpY=,tag:NSDo2HISIBJhYvsqrU0mSA==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/2.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/2.sops.yml new file mode 100644 index 00000000..8d9120d2 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/2.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +bar: ENC[AES256_GCM,data:UGteX9JKWhU=,iv:hgH8BeRf2W4gY4FSyXR/VKR879piGW2MSKJIppFgIJo=,tag:2XKpN3jGGEBBXiJPHi93ew==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-09-01T16:17:15Z' + mac: ENC[AES256_GCM,data:jw/wSpkqwN1Nun1VGLecyJy/yZLtyB57kmoODRhK9/c7nZU8pgTfcATfysyUq0YXWGvpy3mxvlGhaMrHu0DzNCGlsic6OXWDJBPVX3xYeeiUw5KmLxbYPpIXXLYfyu/mWDrToY2o1rpGzJqT7SuZwfFIEX1gZMFnATdROXwVKBU=,iv:ZrgM8BoaLHh4knvJlTqsycOdHNt2oqiFCl/81fr9zP0=,tag:UfhMIr1ByFQhY9B9GpYAmQ==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/hosts b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/hosts new file mode 100644 index 00000000..f43ae790 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/hosts @@ -0,0 +1,6 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +[all] +localhost ansible_connection=local ansible_python_interpreter="{{ ansible_playbook_python }}" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/playbook.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/playbook.yml new file mode 100644 index 00000000..18326389 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/playbook.yml @@ -0,0 +1,22 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- hosts: localhost + gather_facts: false + tasks: + - name: Make sure group_vars/all.sops.yaml was loaded + assert: + that: + - foo is defined + - bar is not defined + - name: Replace group_vars/all.sops.yaml + copy: + src: 2.sops.yml + dest: group_vars/all.sops.yaml + - name: Make sure that updated group_vars/all.sops.yaml was not loaded + assert: + that: + - foo is defined + - bar is not defined diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/run.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/run.sh new file mode 100755 index 00000000..4fcc013b --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/run.sh @@ -0,0 +1,9 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -e +ANSIBLE_VARS_SOPS_PLUGIN_STAGE=task \ +ANSIBLE_VARS_SOPS_PLUGIN_CACHE=true \ +ansible-playbook playbook.yml -i hosts -v "$@" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/setup.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/setup.sh new file mode 100755 index 00000000..e4448001 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/setup.sh @@ -0,0 +1,8 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +rm -rf group_vars/ +mkdir -p group_vars/ +cp 1.sops.yml group_vars/all.sops.yaml diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/validate.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/validate.sh new file mode 100755 index 00000000..bbd8c591 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-cache/validate.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -eux + +if [ "$1" != 0 ]; then + exit 1 +fi diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/.gitignore b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/.gitignore new file mode 100644 index 00000000..c93c3681 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/.gitignore @@ -0,0 +1,5 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +group_vars/ diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/1.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/1.sops.yml new file mode 100644 index 00000000..02ad8294 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/1.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +foo: ENC[AES256_GCM,data:a25L,iv:X8ILHZr+YiyLWa90Y+cwoMD1nVuel7JyTs0A5+oiOOo=,tag:GbBtp+Yqx1KEjdyztqS4EQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-02-20T10:44:32Z' + mac: ENC[AES256_GCM,data:BAwQqD9sHgHkmlxPQLKq28Xy48qPp1B/+GDLEsIxir6WNhZgw8OgjVF1u/wCAad6qHkmN02Bwenr+aay6uKfCuOEsTRSvZ7v80yAU+h0wL3zJ/KMkRsE3QP3CWxcLQxInt+YaBjR+Q0IUjDXKm3u6ZomixZe5F5pwWr36ErV6Y0=,iv:e/iiyXQiCh8C2w/bc8mr/Psv+ehmqEMqEC1/bbGFHpY=,tag:NSDo2HISIBJhYvsqrU0mSA==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/2.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/2.sops.yml new file mode 100644 index 00000000..8d9120d2 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/2.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +bar: ENC[AES256_GCM,data:UGteX9JKWhU=,iv:hgH8BeRf2W4gY4FSyXR/VKR879piGW2MSKJIppFgIJo=,tag:2XKpN3jGGEBBXiJPHi93ew==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-09-01T16:17:15Z' + mac: ENC[AES256_GCM,data:jw/wSpkqwN1Nun1VGLecyJy/yZLtyB57kmoODRhK9/c7nZU8pgTfcATfysyUq0YXWGvpy3mxvlGhaMrHu0DzNCGlsic6OXWDJBPVX3xYeeiUw5KmLxbYPpIXXLYfyu/mWDrToY2o1rpGzJqT7SuZwfFIEX1gZMFnATdROXwVKBU=,iv:ZrgM8BoaLHh4knvJlTqsycOdHNt2oqiFCl/81fr9zP0=,tag:UfhMIr1ByFQhY9B9GpYAmQ==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/hosts b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/hosts new file mode 100644 index 00000000..f43ae790 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/hosts @@ -0,0 +1,6 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +[all] +localhost ansible_connection=local ansible_python_interpreter="{{ ansible_playbook_python }}" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/playbook.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/playbook.yml new file mode 100644 index 00000000..f654090d --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/playbook.yml @@ -0,0 +1,22 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- hosts: localhost + gather_facts: false + tasks: + - name: Make sure group_vars/all.sops.yaml was loaded + assert: + that: + - foo is defined + - bar is not defined + - name: Replace group_vars/all.sops.yaml + copy: + src: 2.sops.yml + dest: group_vars/all.sops.yaml + - name: Make sure that updated group_vars/all.sops.yaml was loaded + assert: + that: + - foo is not defined + - bar is defined diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/run.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/run.sh new file mode 100755 index 00000000..4b6fa33f --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/run.sh @@ -0,0 +1,9 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -e +ANSIBLE_VARS_SOPS_PLUGIN_STAGE=task \ +ANSIBLE_VARS_SOPS_PLUGIN_CACHE=false \ +ansible-playbook playbook.yml -i hosts -v "$@" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/setup.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/setup.sh new file mode 100755 index 00000000..e4448001 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/setup.sh @@ -0,0 +1,8 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +rm -rf group_vars/ +mkdir -p group_vars/ +cp 1.sops.yml group_vars/all.sops.yaml diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/validate.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/validate.sh new file mode 100755 index 00000000..bbd8c591 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-stage-task-no-cache/validate.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -eux + +if [ "$1" != 0 ]; then + exit 1 +fi diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/group_vars/all.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/group_vars/all.sops.yml new file mode 100644 index 00000000..02ad8294 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/group_vars/all.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +foo: ENC[AES256_GCM,data:a25L,iv:X8ILHZr+YiyLWa90Y+cwoMD1nVuel7JyTs0A5+oiOOo=,tag:GbBtp+Yqx1KEjdyztqS4EQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-02-20T10:44:32Z' + mac: ENC[AES256_GCM,data:BAwQqD9sHgHkmlxPQLKq28Xy48qPp1B/+GDLEsIxir6WNhZgw8OgjVF1u/wCAad6qHkmN02Bwenr+aay6uKfCuOEsTRSvZ7v80yAU+h0wL3zJ/KMkRsE3QP3CWxcLQxInt+YaBjR+Q0IUjDXKm3u6ZomixZe5F5pwWr36ErV6Y0=,iv:e/iiyXQiCh8C2w/bc8mr/Psv+ehmqEMqEC1/bbGFHpY=,tag:NSDo2HISIBJhYvsqrU0mSA==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/group_vars/all/test.sops.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/group_vars/all/test.sops.yml new file mode 100644 index 00000000..8d9120d2 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/group_vars/all/test.sops.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +bar: ENC[AES256_GCM,data:UGteX9JKWhU=,iv:hgH8BeRf2W4gY4FSyXR/VKR879piGW2MSKJIppFgIJo=,tag:2XKpN3jGGEBBXiJPHi93ew==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + lastmodified: '2020-09-01T16:17:15Z' + mac: ENC[AES256_GCM,data:jw/wSpkqwN1Nun1VGLecyJy/yZLtyB57kmoODRhK9/c7nZU8pgTfcATfysyUq0YXWGvpy3mxvlGhaMrHu0DzNCGlsic6OXWDJBPVX3xYeeiUw5KmLxbYPpIXXLYfyu/mWDrToY2o1rpGzJqT7SuZwfFIEX1gZMFnATdROXwVKBU=,iv:ZrgM8BoaLHh4knvJlTqsycOdHNt2oqiFCl/81fr9zP0=,tag:UfhMIr1ByFQhY9B9GpYAmQ==,type:str] + pgp: + - created_at: '2020-02-20T10:44:32Z' + enc: |- + -----BEGIN PGP MESSAGE----- + + wcBMAyUpShfNkFB/AQgALJTUwdx6rAPckJ+reP5TEq+lXzHI1Zi7aHYOqZQBnA2s + z8h1gRce/fn7RPkmdsjsdSYmxGGKqwDXxUYsbN1aWXk6mb4Juktdvjl/GndF6PkU + TiN/l1GM6upgS+GPxA01NKsGkVmEtKR5NhsNEnE6OzY29+PFLsBX2vO1Zfg7kzBz + cDl6PT8fbFTEaFeyuYl9IslIV8yYsj1oHL3CF76RjCP6b18NSOHM23ytlH+KVaBV + ntoSVkTyWDx5o9iEHBEWSEGNpaCWWiEgkDEkA1VqMHdUlsW+IjZ8ggg5NJbcVtrG + YkN8rlGsNEzx+g4O4b1160A2K6AdTBcoGHwHD3u3XdLgAeTqT1ekE2N3yNT6w4sm + 6uET4eTS4Cvg1OFCgOC34uUzlY3gbuVy20h8RNyQoAfhSN4DD2MexKqcMMCVCtn0 + OhRMTP2jjOCe5Ex3/p3awcVxwx7qeJ26Vnfiwtg6ueFI5AA= + =tcnq + -----END PGP MESSAGE----- + fp: FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4 + unencrypted_suffix: _unencrypted + version: 3.4.0 diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/host_vars/localhost.sops.json b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/host_vars/localhost.sops.json new file mode 100644 index 00000000..f2b777a5 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/host_vars/localhost.sops.json @@ -0,0 +1,19 @@ +{ + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "lastmodified": "2020-09-21T05:55:39Z", + "mac": "ENC[AES256_GCM,data:Igq1Of0up5cBLd4blecOJSeSqSc+qExqlcEmgaHbhL88e+YxfOd0HxIELYd4SuEAnzYxroQDop741frXLm3RbkFGJuoyW8Ur/GHHx/0e1GsNHGWJL3yfI5NKt0zb3D/pxLP0MrKmsdqlnEnewxeCb5M0xRDJqtRSLP4X4VHOop0=,iv:wzYu6PJsY1FtxuQnNhxDivCCUwfciZpBT232TS/qXZI=,tag:wg8Ijf3mqkfnt7BZ3DSBWQ==,type:str]", + "pgp": [ + { + "created_at": "2020-09-21T05:55:37Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nwcBMAyUpShfNkFB/AQgAY4Sok1zPyUO/sm8PcSWii6QDoOKkLB0LYNaCtJXcGttx\nenLAYAQtNKb4OgeSr2mrgUi5ceyMDAWME9xA0MQSHqU6IrTDRnBOM57wJb+4f029\nbh2PaPuwONcS6jZm+PobJ4sXbKrzigqF6NYdCHjc+3QSWuC2cklKWm1bX5Z0dBwu\nW+7pap7Ol+DCaWmrPx8qjZFR/E0aKcWQGuSryCfZNa6lXXlRxBB/47EBybG6Juks\nyGQBYDLyLxXsd4f0qVRs+A4ra5MkKF5UdAXjrBt5CgUjx2HVSqCD0ScQVwHuiC7L\n2hz3u2EDTB18kf87MFEs7M0Ef9+flJPozPw0Hjih4dLgAeSyNr8t/mZriYpTRIGg\nm1Ll4WKY4A7gkeHcfuA94oS488TgkuUeLeFnZyjEyWGNS8jcgcEXUQKtGKWm4DKk\nD73Cf7UUJOAu5Gdwq+SSwwXZLf1GkX3HSJzieu937OHvEwA=\n=ruyt\n-----END PGP MESSAGE-----", + "fp": "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.6.1" + } +}
\ No newline at end of file diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/host_vars/localhost.sops.json.license b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/host_vars/localhost.sops.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/host_vars/localhost.sops.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/hosts b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/hosts new file mode 100644 index 00000000..f43ae790 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/hosts @@ -0,0 +1,6 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +[all] +localhost ansible_connection=local ansible_python_interpreter="{{ ansible_playbook_python }}" diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/playbook.yml b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/playbook.yml new file mode 100644 index 00000000..b5329165 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/playbook.yml @@ -0,0 +1,14 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- hosts: localhost + gather_facts: false + tasks: + - name: Make sure group_vars/all.sops.yaml was found + debug: + msg: '{{ foo }}' + - name: Make sure group_vars/all/test.sops.yaml was found + debug: + msg: '{{ bar }}' diff --git a/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/validate.sh b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/validate.sh new file mode 100755 index 00000000..bbd8c591 --- /dev/null +++ b/ansible_collections/community/sops/tests/integration/targets/var_sops/test-success/validate.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +set -eux + +if [ "$1" != 0 ]; then + exit 1 +fi diff --git a/ansible_collections/community/sops/tests/sanity/extra/extra-docs.json b/ansible_collections/community/sops/tests/sanity/extra/extra-docs.json new file mode 100644 index 00000000..c2e612e5 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/extra/extra-docs.json @@ -0,0 +1,10 @@ +{ + "include_symlinks": false, + "prefixes": [ + "docs/docsite/" + ], + "output": "path-line-column-message", + "requirements": [ + "antsibull-docs" + ] +} diff --git a/ansible_collections/community/sops/tests/sanity/extra/extra-docs.json.license b/ansible_collections/community/sops/tests/sanity/extra/extra-docs.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/extra/extra-docs.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/sanity/extra/extra-docs.py b/ansible_collections/community/sops/tests/sanity/extra/extra-docs.py new file mode 100755 index 00000000..67310492 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/extra/extra-docs.py @@ -0,0 +1,24 @@ +#!/usr/bin/env python +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +"""Check extra collection docs with antsibull-docs.""" +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +import os +import sys +import subprocess + + +def main(): + """Main entry point.""" + if not os.path.isdir(os.path.join('docs', 'docsite')): + return + p = subprocess.run(['antsibull-docs', 'lint-collection-docs', '.'], check=False) + if p.returncode not in (0, 3): + print('{0}:0:0: unexpected return code {1}'.format(sys.argv[0], p.returncode)) + + +if __name__ == '__main__': + main() diff --git a/ansible_collections/community/sops/tests/sanity/extra/licenses.json b/ansible_collections/community/sops/tests/sanity/extra/licenses.json new file mode 100644 index 00000000..50e47ca8 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/extra/licenses.json @@ -0,0 +1,4 @@ +{ + "include_symlinks": false, + "output": "path-message" +} diff --git a/ansible_collections/community/sops/tests/sanity/extra/licenses.json.license b/ansible_collections/community/sops/tests/sanity/extra/licenses.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/extra/licenses.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/sanity/extra/licenses.py b/ansible_collections/community/sops/tests/sanity/extra/licenses.py new file mode 100755 index 00000000..80eb795e --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/extra/licenses.py @@ -0,0 +1,110 @@ +#!/usr/bin/env python +# Copyright (c) 2022, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +"""Prevent files without a correct license identifier from being added to the source tree.""" +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +import os +import glob +import sys + + +def format_license_list(licenses): + if not licenses: + return '(empty)' + return ', '.join(['"%s"' % license for license in licenses]) + + +def find_licenses(filename, relax=False): + spdx_license_identifiers = [] + other_license_identifiers = [] + has_copyright = False + try: + with open(filename, 'r', encoding='utf-8') as f: + for line in f: + line = line.rstrip() + if 'Copyright ' in line: + has_copyright = True + if 'Copyright: ' in line: + print('%s: found copyright line with "Copyright:". Please remove the colon.' % (filename, )) + if 'SPDX-FileCopyrightText: ' in line: + has_copyright = True + idx = line.find('SPDX-License-Identifier: ') + if idx >= 0: + lic_id = line[idx + len('SPDX-License-Identifier: '):] + spdx_license_identifiers.extend(lic_id.split(' OR ')) + if 'GNU General Public License' in line: + if 'v3.0+' in line: + other_license_identifiers.append('GPL-3.0-or-later') + if 'version 3 or later' in line: + other_license_identifiers.append('GPL-3.0-or-later') + if 'Simplified BSD License' in line: + other_license_identifiers.append('BSD-2-Clause') + if 'Apache License 2.0' in line: + other_license_identifiers.append('Apache-2.0') + if 'PSF License' in line or 'Python-2.0' in line: + other_license_identifiers.append('PSF-2.0') + if 'MIT License' in line: + other_license_identifiers.append('MIT') + except Exception as exc: + print('%s: error while processing file: %s' % (filename, exc)) + if len(set(spdx_license_identifiers)) < len(spdx_license_identifiers): + print('%s: found identical SPDX-License-Identifier values' % (filename, )) + if other_license_identifiers and set(other_license_identifiers) != set(spdx_license_identifiers): + print('%s: SPDX-License-Identifier yielded the license list %s, while manual guessing yielded the license list %s' % ( + filename, format_license_list(spdx_license_identifiers), format_license_list(other_license_identifiers))) + if not has_copyright and not relax: + print('%s: found no copyright notice' % (filename, )) + return sorted(spdx_license_identifiers) + + +def main(): + """Main entry point.""" + paths = sys.argv[1:] or sys.stdin.read().splitlines() + + # The following paths are allowed to have no license identifier + no_comments_allowed = [ + 'changelogs/fragments/*.yml', + 'changelogs/fragments/*.yaml', + ] + + # These files are completely ignored + ignore_paths = [ + '.ansible-test-timeout.json', + '.reuse/dep5', + 'LICENSES/*.txt', + 'COPYING', + ] + + no_comments_allowed = [fn for pattern in no_comments_allowed for fn in glob.glob(pattern)] + ignore_paths = [fn for pattern in ignore_paths for fn in glob.glob(pattern)] + + valid_licenses = [license_file[len('LICENSES/'):-len('.txt')] for license_file in glob.glob('LICENSES/*.txt')] + + for path in paths: + if path.startswith('./'): + path = path[2:] + if path in ignore_paths or path.startswith('tests/output/'): + continue + if os.stat(path).st_size == 0: + continue + if not path.endswith('.license') and os.path.exists(path + '.license'): + path = path + '.license' + valid_licenses_for_path = valid_licenses + if path.startswith('plugins/') and not path.startswith(('plugins/modules/', 'plugins/module_utils/')): + valid_licenses_for_path = [license for license in valid_licenses if license == 'GPL-3.0-or-later'] + licenses = find_licenses(path, relax=path in no_comments_allowed) + if not licenses: + if path not in no_comments_allowed: + print('%s: must have at least one license' % (path, )) + else: + for license in licenses: + if license not in valid_licenses_for_path: + print('%s: found not allowed license "%s", must be one of %s' % ( + path, license, format_license_list(valid_licenses_for_path))) + + +if __name__ == '__main__': + main() diff --git a/ansible_collections/community/sops/tests/sanity/extra/licenses.py.license b/ansible_collections/community/sops/tests/sanity/extra/licenses.py.license new file mode 100644 index 00000000..6c4958fe --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/extra/licenses.py.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: 2022, Felix Fontein <felix@fontein.de> diff --git a/ansible_collections/community/sops/tests/sanity/extra/no-unwanted-files.json b/ansible_collections/community/sops/tests/sanity/extra/no-unwanted-files.json new file mode 100644 index 00000000..c789a7fd --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/extra/no-unwanted-files.json @@ -0,0 +1,7 @@ +{ + "include_symlinks": true, + "prefixes": [ + "plugins/" + ], + "output": "path-message" +} diff --git a/ansible_collections/community/sops/tests/sanity/extra/no-unwanted-files.json.license b/ansible_collections/community/sops/tests/sanity/extra/no-unwanted-files.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/extra/no-unwanted-files.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/sanity/extra/no-unwanted-files.py b/ansible_collections/community/sops/tests/sanity/extra/no-unwanted-files.py new file mode 100755 index 00000000..b39df83a --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/extra/no-unwanted-files.py @@ -0,0 +1,58 @@ +#!/usr/bin/env python +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later +"""Prevent unwanted files from being added to the source tree.""" +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +import os +import os.path +import sys + + +def main(): + """Main entry point.""" + paths = sys.argv[1:] or sys.stdin.read().splitlines() + + allowed_extensions = ( + '.cs', + '.ps1', + '.psm1', + '.py', + ) + + skip_paths = set([ + ]) + + skip_directories = ( + ) + + yaml_directories = ( + 'plugins/test/', + 'plugins/filter/', + ) + + for path in paths: + if path in skip_paths: + continue + + if any(path.startswith(skip_directory) for skip_directory in skip_directories): + continue + + if os.path.islink(path): + print('%s: is a symbolic link' % (path, )) + elif not os.path.isfile(path): + print('%s: is not a regular file' % (path, )) + + ext = os.path.splitext(path)[1] + + if ext in ('.yml', ) and any(path.startswith(yaml_directory) for yaml_directory in yaml_directories): + continue + + if ext not in allowed_extensions: + print('%s: extension must be one of: %s' % (path, ', '.join(allowed_extensions))) + + +if __name__ == '__main__': + main() diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.10.txt b/ansible_collections/community/sops/tests/sanity/ignore-2.10.txt new file mode 100644 index 00000000..787dfec7 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.10.txt @@ -0,0 +1,4 @@ +tests/integration/targets/filter_decrypt/files/hidden-binary.yaml yamllint:error +tests/integration/targets/filter_decrypt/files/hidden-json.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-binary.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-json.yaml yamllint:error diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.10.txt.license b/ansible_collections/community/sops/tests/sanity/ignore-2.10.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.10.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.11.txt b/ansible_collections/community/sops/tests/sanity/ignore-2.11.txt new file mode 100644 index 00000000..787dfec7 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.11.txt @@ -0,0 +1,4 @@ +tests/integration/targets/filter_decrypt/files/hidden-binary.yaml yamllint:error +tests/integration/targets/filter_decrypt/files/hidden-json.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-binary.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-json.yaml yamllint:error diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.11.txt.license b/ansible_collections/community/sops/tests/sanity/ignore-2.11.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.11.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.12.txt b/ansible_collections/community/sops/tests/sanity/ignore-2.12.txt new file mode 100644 index 00000000..787dfec7 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.12.txt @@ -0,0 +1,4 @@ +tests/integration/targets/filter_decrypt/files/hidden-binary.yaml yamllint:error +tests/integration/targets/filter_decrypt/files/hidden-json.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-binary.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-json.yaml yamllint:error diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.12.txt.license b/ansible_collections/community/sops/tests/sanity/ignore-2.12.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.12.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.13.txt b/ansible_collections/community/sops/tests/sanity/ignore-2.13.txt new file mode 100644 index 00000000..787dfec7 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.13.txt @@ -0,0 +1,4 @@ +tests/integration/targets/filter_decrypt/files/hidden-binary.yaml yamllint:error +tests/integration/targets/filter_decrypt/files/hidden-json.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-binary.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-json.yaml yamllint:error diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.13.txt.license b/ansible_collections/community/sops/tests/sanity/ignore-2.13.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.13.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.14.txt b/ansible_collections/community/sops/tests/sanity/ignore-2.14.txt new file mode 100644 index 00000000..787dfec7 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.14.txt @@ -0,0 +1,4 @@ +tests/integration/targets/filter_decrypt/files/hidden-binary.yaml yamllint:error +tests/integration/targets/filter_decrypt/files/hidden-json.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-binary.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-json.yaml yamllint:error diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.14.txt.license b/ansible_collections/community/sops/tests/sanity/ignore-2.14.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.14.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.15.txt b/ansible_collections/community/sops/tests/sanity/ignore-2.15.txt new file mode 100644 index 00000000..787dfec7 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.15.txt @@ -0,0 +1,4 @@ +tests/integration/targets/filter_decrypt/files/hidden-binary.yaml yamllint:error +tests/integration/targets/filter_decrypt/files/hidden-json.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-binary.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-json.yaml yamllint:error diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.15.txt.license b/ansible_collections/community/sops/tests/sanity/ignore-2.15.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.15.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.9.txt b/ansible_collections/community/sops/tests/sanity/ignore-2.9.txt new file mode 100644 index 00000000..787dfec7 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.9.txt @@ -0,0 +1,4 @@ +tests/integration/targets/filter_decrypt/files/hidden-binary.yaml yamllint:error +tests/integration/targets/filter_decrypt/files/hidden-json.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-binary.yaml yamllint:error +tests/integration/targets/lookup_sops/files/hidden-json.yaml yamllint:error diff --git a/ansible_collections/community/sops/tests/sanity/ignore-2.9.txt.license b/ansible_collections/community/sops/tests/sanity/ignore-2.9.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/ansible_collections/community/sops/tests/sanity/ignore-2.9.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project |