diff options
Diffstat (limited to 'ansible_collections/community/crypto')
127 files changed, 5354 insertions, 1341 deletions
diff --git a/ansible_collections/community/crypto/.azure-pipelines/azure-pipelines.yml b/ansible_collections/community/crypto/.azure-pipelines/azure-pipelines.yml index d9ae3f866..8697acd43 100644 --- a/ansible_collections/community/crypto/.azure-pipelines/azure-pipelines.yml +++ b/ansible_collections/community/crypto/.azure-pipelines/azure-pipelines.yml @@ -46,7 +46,7 @@ variables: resources: containers: - container: default - image: quay.io/ansible/azure-pipelines-test-container:3.0.0 + image: quay.io/ansible/azure-pipelines-test-container:4.0.1 pool: Standard @@ -65,6 +65,17 @@ stages: test: 'devel/sanity/extra' - name: Units test: 'devel/units/1' + - stage: Ansible_2_16 + displayName: Sanity & Units 2.16 + dependsOn: [] + jobs: + - template: templates/matrix.yml + parameters: + targets: + - name: Sanity + test: '2.16/sanity/1' + - name: Units + test: '2.16/units/1' - stage: Ansible_2_15 displayName: Sanity & Units 2.15 dependsOn: [] @@ -87,17 +98,6 @@ stages: test: '2.14/sanity/1' - name: Units test: '2.14/units/1' - - stage: Ansible_2_13 - displayName: Sanity & Units 2.13 - dependsOn: [] - jobs: - - template: templates/matrix.yml - parameters: - targets: - - name: Sanity - test: '2.13/sanity/1' - - name: Units - test: '2.13/units/1' ### Docker - stage: Docker_devel displayName: Docker devel @@ -107,12 +107,8 @@ stages: parameters: testFormat: devel/linux/{0} targets: - - name: Fedora 37 - test: fedora37 - - name: openSUSE 15 - test: opensuse15 - - name: Ubuntu 20.04 - test: ubuntu2004 + - name: Fedora 39 + test: fedora39 - name: Ubuntu 22.04 test: ubuntu2204 - name: Alpine 3 @@ -120,50 +116,46 @@ stages: groups: - 1 - 2 - - stage: Docker_2_15 - displayName: Docker 2.15 + - stage: Docker_2_16 + displayName: Docker 2.16 dependsOn: [] jobs: - template: templates/matrix.yml parameters: - testFormat: 2.15/linux/{0} + testFormat: 2.16/linux/{0} targets: - - name: CentOS 7 - test: centos7 + - name: Fedora 38 + test: fedora38 + - name: openSUSE 15 + test: opensuse15 groups: - 1 - 2 - - stage: Docker_2_14 - displayName: Docker 2.14 + - stage: Docker_2_15 + displayName: Docker 2.15 dependsOn: [] jobs: - template: templates/matrix.yml parameters: - testFormat: 2.14/linux/{0} + testFormat: 2.15/linux/{0} targets: - - name: Fedora 36 - test: fedora36 + - name: Fedora 37 + test: fedora37 + - name: CentOS 7 + test: centos7 groups: - 1 - 2 - - stage: Docker_2_13 - displayName: Docker 2.13 + - stage: Docker_2_14 + displayName: Docker 2.14 dependsOn: [] jobs: - template: templates/matrix.yml parameters: - testFormat: 2.13/linux/{0} + testFormat: 2.14/linux/{0} targets: - - name: openSUSE 15 py2 - test: opensuse15py2 - - name: Fedora 35 - test: fedora35 - - name: Fedora 34 - test: fedora34 - - name: Ubuntu 18.04 - test: ubuntu1804 - - name: Alpine 3 - test: alpine3 + - name: Ubuntu 20.04 + test: ubuntu2004 groups: - 1 - 2 @@ -179,12 +171,10 @@ stages: targets: - name: Debian Bullseye test: debian-bullseye/3.9 + - name: Debian Bookworm + test: debian-bookworm/3.11 - name: ArchLinux test: archlinux/3.11 - - name: CentOS Stream 8 with Python 3.9 - test: centos-stream8/3.9 - - name: CentOS Stream 8 with Python 3.6 - test: centos-stream8/3.6 groups: - 1 - 2 @@ -198,12 +188,10 @@ stages: parameters: testFormat: devel/{0} targets: - - name: Alpine 3.17 - test: alpine/3.17 - - name: Fedora 37 - test: fedora/37 - - name: Ubuntu 20.04 - test: ubuntu/20.04 + - name: Alpine 3.18 + test: alpine/3.18 + - name: Fedora 39 + test: fedora/39 - name: Ubuntu 22.04 test: ubuntu/22.04 groups: @@ -218,15 +206,28 @@ stages: targets: - name: macOS 13.2 test: macos/13.2 - - name: RHEL 9.1 - test: rhel/9.1 - - name: FreeBSD 12.4 - test: freebsd/12.4 + - name: RHEL 9.3 + test: rhel/9.3 - name: FreeBSD 13.2 test: freebsd/13.2 groups: - 1 - 2 + - stage: Remote_2_16 + displayName: Remote 2.16 + dependsOn: [] + jobs: + - template: templates/matrix.yml + parameters: + testFormat: 2.16/{0} + targets: + - name: RHEL 9.2 + test: rhel/9.2 + - name: RHEL 8.8 + test: rhel/8.8 + groups: + - 1 + - 2 - stage: Remote_2_15 displayName: Remote 2.15 dependsOn: [] @@ -235,10 +236,16 @@ stages: parameters: testFormat: 2.15/{0} targets: + - name: RHEL 9.1 + test: rhel/9.1 + - name: RHEL 8.7 + test: rhel/8.7 - name: RHEL 7.9 test: rhel/7.9 - - name: FreeBSD 13.1 - test: freebsd/13.1 + # - name: FreeBSD 13.1 + # test: freebsd/13.1 + # - name: FreeBSD 12.4 + # test: freebsd/12.4 groups: - 1 - 2 @@ -250,27 +257,12 @@ stages: parameters: testFormat: 2.14/{0} targets: - - name: macOS 12.0 - test: macos/12.0 + #- name: macOS 12.0 + # test: macos/12.0 - name: RHEL 9.0 test: rhel/9.0 - - name: FreeBSD 12.3 - test: freebsd/12.3 - groups: - - 1 - - 2 - - stage: Remote_2_13 - displayName: Remote 2.13 - dependsOn: [] - jobs: - - template: templates/matrix.yml - parameters: - testFormat: 2.13/{0} - targets: - - name: RHEL 8.5 - test: rhel/8.5 - - name: FreeBSD 13.0 - test: freebsd/13.0 + #- name: FreeBSD 12.4 + # test: freebsd/12.4 groups: - 1 - 2 @@ -284,53 +276,54 @@ stages: nameFormat: Python {0} testFormat: devel/generic/{0} targets: - - test: 2.7 - - test: 3.6 - test: 3.7 # - test: 3.8 # - test: 3.9 # - test: "3.10" - test: "3.11" + - test: "3.12" groups: - 1 - 2 - - stage: Generic_2_15 - displayName: Generic 2.15 + - stage: Generic_2_16 + displayName: Generic 2.16 dependsOn: [] jobs: - template: templates/matrix.yml parameters: nameFormat: Python {0} - testFormat: 2.15/generic/{0} + testFormat: 2.16/generic/{0} targets: - - test: 3.5 - - test: "3.10" + - test: "2.7" + - test: "3.6" + - test: "3.11" groups: - 1 - 2 - - stage: Generic_2_14 - displayName: Generic 2.14 + - stage: Generic_2_15 + displayName: Generic 2.15 dependsOn: [] jobs: - template: templates/matrix.yml parameters: nameFormat: Python {0} - testFormat: 2.14/generic/{0} + testFormat: 2.15/generic/{0} targets: - - test: 3.9 + - test: 3.5 + - test: "3.10" groups: - 1 - 2 - - stage: Generic_2_13 - displayName: Generic 2.13 + - stage: Generic_2_14 + displayName: Generic 2.14 dependsOn: [] jobs: - template: templates/matrix.yml parameters: nameFormat: Python {0} - testFormat: 2.13/generic/{0} + testFormat: 2.14/generic/{0} targets: - - test: 3.8 + - test: 3.9 groups: - 1 - 2 @@ -341,22 +334,22 @@ stages: condition: succeededOrFailed() dependsOn: - Ansible_devel + - Ansible_2_16 - Ansible_2_15 - Ansible_2_14 - - Ansible_2_13 - Remote_devel_extra_vms - Remote_devel + - Remote_2_16 - Remote_2_15 - Remote_2_14 - - Remote_2_13 - Docker_devel + - Docker_2_16 - Docker_2_15 - Docker_2_14 - - Docker_2_13 - Docker_community_devel - Generic_devel + - Generic_2_16 - Generic_2_15 - Generic_2_14 - - Generic_2_13 jobs: - template: templates/coverage.yml diff --git a/ansible_collections/community/crypto/.github/workflows/ansible-test.yml b/ansible_collections/community/crypto/.github/workflows/ansible-test.yml index 325dc5275..be831028b 100644 --- a/ansible_collections/community/crypto/.github/workflows/ansible-test.yml +++ b/ansible_collections/community/crypto/.github/workflows/ansible-test.yml @@ -33,6 +33,7 @@ jobs: - '2.10' - '2.11' - '2.12' + - '2.13' # Ansible-test on various stable branches does not yet work well with cgroups v2. # Since ubuntu-latest now uses Ubuntu 22.04, we need to fall back to the ubuntu-20.04 # image for these stable branches. The list of branches where this is necessary will @@ -72,6 +73,7 @@ jobs: - '2.10' - '2.11' - '2.12' + - '2.13' steps: - name: >- @@ -202,6 +204,55 @@ jobs: docker: default python: '3.9' target: azp/generic/2/ + # 2.13 + - ansible: '2.13' + docker: opensuse15py2 + python: '' + target: azp/posix/1/ + - ansible: '2.13' + docker: opensuse15py2 + python: '' + target: azp/posix/2/ + - ansible: '2.13' + docker: fedora35 + python: '' + target: azp/posix/1/ + - ansible: '2.13' + docker: fedora35 + python: '' + target: azp/posix/2/ + - ansible: '2.13' + docker: fedora34 + python: '' + target: azp/posix/1/ + - ansible: '2.13' + docker: fedora34 + python: '' + target: azp/posix/2/ + - ansible: '2.13' + docker: ubuntu1804 + python: '' + target: azp/posix/1/ + - ansible: '2.13' + docker: ubuntu1804 + python: '' + target: azp/posix/2/ + - ansible: '2.13' + docker: alpine3 + python: '' + target: azp/posix/1/ + - ansible: '2.13' + docker: alpine3 + python: '' + target: azp/posix/2/ + - ansible: '2.13' + docker: default + python: '3.8' + target: azp/generic/1/ + - ansible: '2.13' + docker: default + python: '3.8' + target: azp/generic/2/ steps: - name: >- diff --git a/ansible_collections/community/crypto/.github/workflows/ee.yml b/ansible_collections/community/crypto/.github/workflows/ee.yml index edd4d047b..74f48476f 100644 --- a/ansible_collections/community/crypto/.github/workflows/ee.yml +++ b/ansible_collections/community/crypto/.github/workflows/ee.yml @@ -46,6 +46,10 @@ jobs: - name: ansible-core devel @ RHEL UBI 9 ansible_core: https://github.com/ansible/ansible/archive/devel.tar.gz ansible_runner: ansible-runner + other_deps: |2 + python_interpreter: + package_system: python3.11 python3.11-pip python3.11-wheel python3.11-cryptography + python_path: "/usr/bin/python3.11" base_image: docker.io/redhat/ubi9:latest pre_base: '"#"' # For some reason ansible-builder will not install EPEL dependencies on RHEL @@ -87,12 +91,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: path: ansible_collections/${{ env.NAMESPACE }}/${{ env.COLLECTION_NAME }} - name: Set up Python - uses: actions/setup-python@v4 + uses: actions/setup-python@v5 with: python-version: '3.11' diff --git a/ansible_collections/community/crypto/.github/workflows/import-galaxy.yml b/ansible_collections/community/crypto/.github/workflows/import-galaxy.yml new file mode 100644 index 000000000..0c0ee402a --- /dev/null +++ b/ansible_collections/community/crypto/.github/workflows/import-galaxy.yml @@ -0,0 +1,20 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +name: import-galaxy +'on': + # Run CI against all pushes (direct commits, also merged PRs) to main, and all Pull Requests + push: + branches: + - main + - stable-* + pull_request: + +jobs: + import-galaxy: + permissions: + contents: read + name: Test to import built collection artifact with Galaxy importer + uses: ansible-community/github-action-test-galaxy-import/.github/workflows/test-galaxy-import.yml@main diff --git a/ansible_collections/community/crypto/.github/workflows/reuse.yml b/ansible_collections/community/crypto/.github/workflows/reuse.yml index 3b01cd8ac..29b1f951a 100644 --- a/ansible_collections/community/crypto/.github/workflows/reuse.yml +++ b/ansible_collections/community/crypto/.github/workflows/reuse.yml @@ -21,14 +21,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - - name: Install dependencies - run: | - pip install reuse - - - name: Check REUSE compliance (except some PEM files) + - name: Remove some files before checking REUSE compliance run: | rm -f tests/integration/targets/*/files/*.pem rm -f tests/integration/targets/*/files/roots/*.pem - reuse lint + + - name: REUSE Compliance Check + uses: fsfe/reuse-action@v2 diff --git a/ansible_collections/community/crypto/CHANGELOG.md b/ansible_collections/community/crypto/CHANGELOG.md new file mode 100644 index 000000000..f54352a87 --- /dev/null +++ b/ansible_collections/community/crypto/CHANGELOG.md @@ -0,0 +1,1350 @@ +# Community Crypto Release Notes + +**Topics** +- <a href="#v2-18-0">v2\.18\.0</a> + - <a href="#release-summary">Release Summary</a> + - <a href="#minor-changes">Minor Changes</a> + - <a href="#deprecated-features">Deprecated Features</a> + - <a href="#bugfixes">Bugfixes</a> + - <a href="#new-plugins">New Plugins</a> + - <a href="#filter">Filter</a> +- <a href="#v2-17-1">v2\.17\.1</a> + - <a href="#release-summary-1">Release Summary</a> + - <a href="#bugfixes-1">Bugfixes</a> +- <a href="#v2-17-0">v2\.17\.0</a> + - <a href="#release-summary-2">Release Summary</a> + - <a href="#minor-changes-1">Minor Changes</a> +- <a href="#v2-16-2">v2\.16\.2</a> + - <a href="#release-summary-3">Release Summary</a> + - <a href="#bugfixes-2">Bugfixes</a> +- <a href="#v2-16-1">v2\.16\.1</a> + - <a href="#release-summary-4">Release Summary</a> + - <a href="#bugfixes-3">Bugfixes</a> +- <a href="#v2-16-0">v2\.16\.0</a> + - <a href="#release-summary-5">Release Summary</a> + - <a href="#minor-changes-2">Minor Changes</a> + - <a href="#bugfixes-4">Bugfixes</a> +- <a href="#v2-15-1">v2\.15\.1</a> + - <a href="#release-summary-6">Release Summary</a> + - <a href="#bugfixes-5">Bugfixes</a> +- <a href="#v2-15-0">v2\.15\.0</a> + - <a href="#release-summary-7">Release Summary</a> + - <a href="#minor-changes-3">Minor Changes</a> + - <a href="#deprecated-features-1">Deprecated Features</a> + - <a href="#bugfixes-6">Bugfixes</a> + - <a href="#new-plugins-1">New Plugins</a> + - <a href="#filter-1">Filter</a> + - <a href="#lookup">Lookup</a> +- <a href="#v2-14-1">v2\.14\.1</a> + - <a href="#release-summary-8">Release Summary</a> + - <a href="#bugfixes-7">Bugfixes</a> + - <a href="#known-issues">Known Issues</a> +- <a href="#v2-14-0">v2\.14\.0</a> + - <a href="#release-summary-9">Release Summary</a> + - <a href="#minor-changes-4">Minor Changes</a> +- <a href="#v2-13-1">v2\.13\.1</a> + - <a href="#release-summary-10">Release Summary</a> + - <a href="#bugfixes-8">Bugfixes</a> +- <a href="#v2-13-0">v2\.13\.0</a> + - <a href="#release-summary-11">Release Summary</a> + - <a href="#minor-changes-5">Minor Changes</a> + - <a href="#deprecated-features-2">Deprecated Features</a> + - <a href="#bugfixes-9">Bugfixes</a> +- <a href="#v2-12-0">v2\.12\.0</a> + - <a href="#release-summary-12">Release Summary</a> + - <a href="#minor-changes-6">Minor Changes</a> +- <a href="#v2-11-1">v2\.11\.1</a> + - <a href="#release-summary-13">Release Summary</a> +- <a href="#v2-11-0">v2\.11\.0</a> + - <a href="#release-summary-14">Release Summary</a> + - <a href="#minor-changes-7">Minor Changes</a> + - <a href="#bugfixes-10">Bugfixes</a> +- <a href="#v2-10-0">v2\.10\.0</a> + - <a href="#release-summary-15">Release Summary</a> + - <a href="#bugfixes-11">Bugfixes</a> + - <a href="#new-plugins-2">New Plugins</a> + - <a href="#filter-2">Filter</a> +- <a href="#v2-9-0">v2\.9\.0</a> + - <a href="#release-summary-16">Release Summary</a> + - <a href="#minor-changes-8">Minor Changes</a> +- <a href="#v2-8-1">v2\.8\.1</a> + - <a href="#release-summary-17">Release Summary</a> +- <a href="#v2-8-0">v2\.8\.0</a> + - <a href="#release-summary-18">Release Summary</a> + - <a href="#minor-changes-9">Minor Changes</a> +- <a href="#v2-7-1">v2\.7\.1</a> + - <a href="#release-summary-19">Release Summary</a> + - <a href="#bugfixes-12">Bugfixes</a> +- <a href="#v2-7-0">v2\.7\.0</a> + - <a href="#release-summary-20">Release Summary</a> + - <a href="#minor-changes-10">Minor Changes</a> + - <a href="#bugfixes-13">Bugfixes</a> +- <a href="#v2-6-0">v2\.6\.0</a> + - <a href="#release-summary-21">Release Summary</a> + - <a href="#minor-changes-11">Minor Changes</a> +- <a href="#v2-5-0">v2\.5\.0</a> + - <a href="#release-summary-22">Release Summary</a> + - <a href="#minor-changes-12">Minor Changes</a> +- <a href="#v2-4-0">v2\.4\.0</a> + - <a href="#release-summary-23">Release Summary</a> + - <a href="#deprecated-features-3">Deprecated Features</a> + - <a href="#bugfixes-14">Bugfixes</a> +- <a href="#v2-3-4">v2\.3\.4</a> + - <a href="#release-summary-24">Release Summary</a> +- <a href="#v2-3-3">v2\.3\.3</a> + - <a href="#release-summary-25">Release Summary</a> + - <a href="#bugfixes-15">Bugfixes</a> +- <a href="#v2-3-2">v2\.3\.2</a> + - <a href="#release-summary-26">Release Summary</a> + - <a href="#bugfixes-16">Bugfixes</a> +- <a href="#v2-3-1">v2\.3\.1</a> + - <a href="#release-summary-27">Release Summary</a> + - <a href="#bugfixes-17">Bugfixes</a> +- <a href="#v2-3-0">v2\.3\.0</a> + - <a href="#release-summary-28">Release Summary</a> + - <a href="#minor-changes-13">Minor Changes</a> + - <a href="#bugfixes-18">Bugfixes</a> +- <a href="#v2-2-4">v2\.2\.4</a> + - <a href="#release-summary-29">Release Summary</a> + - <a href="#bugfixes-19">Bugfixes</a> +- <a href="#v2-2-3">v2\.2\.3</a> + - <a href="#release-summary-30">Release Summary</a> + - <a href="#bugfixes-20">Bugfixes</a> +- <a href="#v2-2-2">v2\.2\.2</a> + - <a href="#release-summary-31">Release Summary</a> + - <a href="#bugfixes-21">Bugfixes</a> +- <a href="#v2-2-1">v2\.2\.1</a> + - <a href="#release-summary-32">Release Summary</a> + - <a href="#bugfixes-22">Bugfixes</a> +- <a href="#v2-2-0">v2\.2\.0</a> + - <a href="#release-summary-33">Release Summary</a> + - <a href="#minor-changes-14">Minor Changes</a> + - <a href="#bugfixes-23">Bugfixes</a> +- <a href="#v2-1-0">v2\.1\.0</a> + - <a href="#release-summary-34">Release Summary</a> + - <a href="#minor-changes-15">Minor Changes</a> + - <a href="#bugfixes-24">Bugfixes</a> + - <a href="#new-modules">New Modules</a> +- <a href="#v2-0-2">v2\.0\.2</a> + - <a href="#release-summary-35">Release Summary</a> +- <a href="#v2-0-1">v2\.0\.1</a> + - <a href="#release-summary-36">Release Summary</a> + - <a href="#minor-changes-16">Minor Changes</a> + - <a href="#bugfixes-25">Bugfixes</a> +- <a href="#v2-0-0">v2\.0\.0</a> + - <a href="#release-summary-37">Release Summary</a> + - <a href="#minor-changes-17">Minor Changes</a> + - <a href="#breaking-changes--porting-guide">Breaking Changes / Porting Guide</a> + - <a href="#deprecated-features-4">Deprecated Features</a> + - <a href="#removed-features-previously-deprecated">Removed Features \(previously deprecated\)</a> + - <a href="#bugfixes-26">Bugfixes</a> +- <a href="#v1-9-4">v1\.9\.4</a> + - <a href="#release-summary-38">Release Summary</a> + - <a href="#bugfixes-27">Bugfixes</a> +- <a href="#v1-9-3">v1\.9\.3</a> + - <a href="#release-summary-39">Release Summary</a> + - <a href="#bugfixes-28">Bugfixes</a> +- <a href="#v1-9-2">v1\.9\.2</a> + - <a href="#release-summary-40">Release Summary</a> +- <a href="#v1-9-1">v1\.9\.1</a> + - <a href="#release-summary-41">Release Summary</a> +- <a href="#v1-9-0">v1\.9\.0</a> + - <a href="#release-summary-42">Release Summary</a> + - <a href="#minor-changes-18">Minor Changes</a> + - <a href="#bugfixes-29">Bugfixes</a> +- <a href="#v1-8-0">v1\.8\.0</a> + - <a href="#release-summary-43">Release Summary</a> + - <a href="#minor-changes-19">Minor Changes</a> + - <a href="#bugfixes-30">Bugfixes</a> +- <a href="#v1-7-1">v1\.7\.1</a> + - <a href="#release-summary-44">Release Summary</a> + - <a href="#bugfixes-31">Bugfixes</a> +- <a href="#v1-7-0">v1\.7\.0</a> + - <a href="#release-summary-45">Release Summary</a> + - <a href="#minor-changes-20">Minor Changes</a> + - <a href="#bugfixes-32">Bugfixes</a> + - <a href="#new-modules-1">New Modules</a> +- <a href="#v1-6-2">v1\.6\.2</a> + - <a href="#release-summary-46">Release Summary</a> + - <a href="#bugfixes-33">Bugfixes</a> +- <a href="#v1-6-1">v1\.6\.1</a> + - <a href="#release-summary-47">Release Summary</a> + - <a href="#bugfixes-34">Bugfixes</a> +- <a href="#v1-6-0">v1\.6\.0</a> + - <a href="#release-summary-48">Release Summary</a> + - <a href="#minor-changes-21">Minor Changes</a> + - <a href="#deprecated-features-5">Deprecated Features</a> + - <a href="#bugfixes-35">Bugfixes</a> +- <a href="#v1-5-0">v1\.5\.0</a> + - <a href="#release-summary-49">Release Summary</a> + - <a href="#minor-changes-22">Minor Changes</a> + - <a href="#deprecated-features-6">Deprecated Features</a> + - <a href="#bugfixes-36">Bugfixes</a> +- <a href="#v1-4-0">v1\.4\.0</a> + - <a href="#release-summary-50">Release Summary</a> + - <a href="#minor-changes-23">Minor Changes</a> + - <a href="#bugfixes-37">Bugfixes</a> +- <a href="#v1-3-0">v1\.3\.0</a> + - <a href="#release-summary-51">Release Summary</a> + - <a href="#minor-changes-24">Minor Changes</a> + - <a href="#bugfixes-38">Bugfixes</a> + - <a href="#new-modules-2">New Modules</a> +- <a href="#v1-2-0">v1\.2\.0</a> + - <a href="#release-summary-52">Release Summary</a> + - <a href="#minor-changes-25">Minor Changes</a> + - <a href="#security-fixes">Security Fixes</a> + - <a href="#bugfixes-39">Bugfixes</a> +- <a href="#v1-1-1">v1\.1\.1</a> + - <a href="#release-summary-53">Release Summary</a> + - <a href="#bugfixes-40">Bugfixes</a> +- <a href="#v1-1-0">v1\.1\.0</a> + - <a href="#release-summary-54">Release Summary</a> + - <a href="#minor-changes-26">Minor Changes</a> + - <a href="#bugfixes-41">Bugfixes</a> + - <a href="#new-modules-3">New Modules</a> +- <a href="#v1-0-0">v1\.0\.0</a> + - <a href="#release-summary-55">Release Summary</a> + - <a href="#minor-changes-27">Minor Changes</a> + - <a href="#deprecated-features-7">Deprecated Features</a> + - <a href="#removed-features-previously-deprecated-1">Removed Features \(previously deprecated\)</a> + - <a href="#bugfixes-42">Bugfixes</a> + - <a href="#new-modules-4">New Modules</a> + +<a id="v2-18-0"></a> +## v2\.18\.0 + +<a id="release-summary"></a> +### Release Summary + +Bugfix and feature release\. + +<a id="minor-changes"></a> +### Minor Changes + +* x509\_crl \- the new option <code>serial\_numbers</code> allow to configure in which format serial numbers can be provided to <code>revoked\_certificates\[\]\.serial\_number</code>\. The default is as integers \(<code>serial\_numbers\=integer</code>\) for backwards compatibility\; setting <code>serial\_numbers\=hex\-octets</code> allows to specify colon\-separated hex octet strings like <code>00\:11\:22\:FF</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/687](https\://github\.com/ansible\-collections/community\.crypto/issues/687)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/715](https\://github\.com/ansible\-collections/community\.crypto/pull/715)\)\. + +<a id="deprecated-features"></a> +### Deprecated Features + +* openssl\_csr\_pipe\, openssl\_privatekey\_pipe\, x509\_certificate\_pipe \- the current behavior of check mode is deprecated and will change in community\.crypto 3\.0\.0\. The current behavior is similar to the modules without <code>\_pipe</code>\: if the object needs to be \(re\-\)generated\, only the <code>changed</code> status is set\, but the object is not updated\. From community\.crypto 3\.0\.0 on\, the modules will ignore check mode and always act as if check mode is not active\. This behavior can already achieved now by adding <code>check\_mode\: false</code> to the task\. If you think this breaks your use\-case of this module\, please [create an issue in the community\.crypto repository](https\://github\.com/ansible\-collections/community\.crypto/issues/new/choose) \([https\://github\.com/ansible\-collections/community\.crypto/issues/712](https\://github\.com/ansible\-collections/community\.crypto/issues/712)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/714](https\://github\.com/ansible\-collections/community\.crypto/pull/714)\)\. + +<a id="bugfixes"></a> +### Bugfixes + +* luks\_device \- fixed module a bug that prevented using <code>remove\_keyslot</code> with the value <code>0</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/710](https\://github\.com/ansible\-collections/community\.crypto/pull/710)\)\. +* luks\_device \- fixed module falsely outputting <code>changed\=false</code> when trying to add a new slot with a key that is already present in another slot\. The module now rejects adding keys that are already present in another slot \([https\://github\.com/ansible\-collections/community\.crypto/pull/710](https\://github\.com/ansible\-collections/community\.crypto/pull/710)\)\. +* luks\_device \- fixed testing of LUKS passphrases in when specifying a keyslot for cryptsetup version 2\.0\.3\. The output of this cryptsetup version slightly differs from later versions \([https\://github\.com/ansible\-collections/community\.crypto/pull/710](https\://github\.com/ansible\-collections/community\.crypto/pull/710)\)\. + +<a id="new-plugins"></a> +### New Plugins + +<a id="filter"></a> +#### Filter + +* parse\_serial \- Convert a serial number as a colon\-separated list of hex numbers to an integer +* to\_serial \- Convert an integer to a colon\-separated list of hex numbers + +<a id="v2-17-1"></a> +## v2\.17\.1 + +<a id="release-summary-1"></a> +### Release Summary + +Bugfix release for compatibility with cryptography 42\.0\.0\. + +<a id="bugfixes-1"></a> +### Bugfixes + +* openssl\_dhparam \- was using an internal function instead of the public API to load DH param files when using the <code>cryptography</code> backend\. The internal function was removed in cryptography 42\.0\.0\. The module now uses the public API\, which has been available since support for DH params was added to cryptography \([https\://github\.com/ansible\-collections/community\.crypto/pull/698](https\://github\.com/ansible\-collections/community\.crypto/pull/698)\)\. +* openssl\_privatekey\_info \- <code>check\_consistency\=true</code> no longer works for RSA keys with cryptography 42\.0\.0\+ \([https\://github\.com/ansible\-collections/community\.crypto/pull/701](https\://github\.com/ansible\-collections/community\.crypto/pull/701)\)\. +* openssl\_privatekey\_info \- <code>check\_consistency\=true</code> now reports a warning if it cannot determine consistency \([https\://github\.com/ansible\-collections/community\.crypto/pull/705](https\://github\.com/ansible\-collections/community\.crypto/pull/705)\)\. + +<a id="v2-17-0"></a> +## v2\.17\.0 + +<a id="release-summary-2"></a> +### Release Summary + +Feature release\. + +<a id="minor-changes-1"></a> +### Minor Changes + +* luks\_device \- add allow discards option \([https\://github\.com/ansible\-collections/community\.crypto/pull/693](https\://github\.com/ansible\-collections/community\.crypto/pull/693)\)\. + +<a id="v2-16-2"></a> +## v2\.16\.2 + +<a id="release-summary-3"></a> +### Release Summary + +Bugfix release\. + +<a id="bugfixes-2"></a> +### Bugfixes + +* acme\_\* modules \- directly react on bad return data for account creation/retrieval/updating requests \([https\://github\.com/ansible\-collections/community\.crypto/pull/682](https\://github\.com/ansible\-collections/community\.crypto/pull/682)\)\. +* acme\_\* modules \- fix improved error reporting in case of socket errors\, bad status lines\, and unknown connection errors \([https\://github\.com/ansible\-collections/community\.crypto/pull/684](https\://github\.com/ansible\-collections/community\.crypto/pull/684)\)\. +* acme\_\* modules \- increase number of retries from 5 to 10 to increase stability with unstable ACME endpoints \([https\://github\.com/ansible\-collections/community\.crypto/pull/685](https\://github\.com/ansible\-collections/community\.crypto/pull/685)\)\. +* acme\_\* modules \- make account registration handling more flexible to accept 404 instead of 400 send by DigiCert\'s ACME endpoint when an account does not exist \([https\://github\.com/ansible\-collections/community\.crypto/pull/681](https\://github\.com/ansible\-collections/community\.crypto/pull/681)\)\. + +<a id="v2-16-1"></a> +## v2\.16\.1 + +<a id="release-summary-4"></a> +### Release Summary + +Bugfix release\. + +<a id="bugfixes-3"></a> +### Bugfixes + +* acme\_\* modules \- also retry requests in case of socket errors\, bad status lines\, and unknown connection errors\; improve error messages in these cases \([https\://github\.com/ansible\-collections/community\.crypto/issues/680](https\://github\.com/ansible\-collections/community\.crypto/issues/680)\)\. + +<a id="v2-16-0"></a> +## v2\.16\.0 + +<a id="release-summary-5"></a> +### Release Summary + +Bugfix release\. + +<a id="minor-changes-2"></a> +### Minor Changes + +* luks\_devices \- add new options <code>keyslot</code>\, <code>new\_keyslot</code>\, and <code>remove\_keyslot</code> to allow adding/removing keys to/from specific keyslots \([https\://github\.com/ansible\-collections/community\.crypto/pull/664](https\://github\.com/ansible\-collections/community\.crypto/pull/664)\)\. + +<a id="bugfixes-4"></a> +### Bugfixes + +* openssl\_pkcs12 \- modify autodetect to not detect pyOpenSSL \>\= 23\.3\.0\, which removed PKCS\#12 support \([https\://github\.com/ansible\-collections/community\.crypto/pull/666](https\://github\.com/ansible\-collections/community\.crypto/pull/666)\)\. + +<a id="v2-15-1"></a> +## v2\.15\.1 + +<a id="release-summary-6"></a> +### Release Summary + +Bugfix release\. + +<a id="bugfixes-5"></a> +### Bugfixes + +* acme\_\* modules \- correctly handle error documents without <code>type</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/651](https\://github\.com/ansible\-collections/community\.crypto/issues/651)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/652](https\://github\.com/ansible\-collections/community\.crypto/pull/652)\)\. + +<a id="v2-15-0"></a> +## v2\.15\.0 + +<a id="release-summary-7"></a> +### Release Summary + +Bugfix and feature release\. + +<a id="minor-changes-3"></a> +### Minor Changes + +* openssh\_keypair \- fail when comment cannot be updated \([https\://github\.com/ansible\-collections/community\.crypto/pull/646](https\://github\.com/ansible\-collections/community\.crypto/pull/646)\)\. + +<a id="deprecated-features-1"></a> +### Deprecated Features + +* get\_certificate \- the default <code>false</code> of the <code>asn1\_base64</code> option is deprecated and will change to <code>true</code> in community\.crypto 3\.0\.0 \([https\://github\.com/ansible\-collections/community\.crypto/pull/600](https\://github\.com/ansible\-collections/community\.crypto/pull/600)\)\. + +<a id="bugfixes-6"></a> +### Bugfixes + +* openssh\_cert\, openssh\_keypair \- the modules ignored return codes of <code>ssh</code> and <code>ssh\-keygen</code> in some cases \([https\://github\.com/ansible\-collections/community\.crypto/issues/645](https\://github\.com/ansible\-collections/community\.crypto/issues/645)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/646](https\://github\.com/ansible\-collections/community\.crypto/pull/646)\)\. +* openssh\_keypair \- fix comment updating for OpenSSH before 6\.5 \([https\://github\.com/ansible\-collections/community\.crypto/pull/646](https\://github\.com/ansible\-collections/community\.crypto/pull/646)\)\. + +<a id="new-plugins-1"></a> +### New Plugins + +<a id="filter-1"></a> +#### Filter + +* gpg\_fingerprint \- Retrieve a GPG fingerprint from a GPG public or private key + +<a id="lookup"></a> +#### Lookup + +* gpg\_fingerprint \- Retrieve a GPG fingerprint from a GPG public or private key file + +<a id="v2-14-1"></a> +## v2\.14\.1 + +<a id="release-summary-8"></a> +### Release Summary + +Bugfix and maintenance release with updated documentation\. + +From this version on\, community\.crypto is using the new [Ansible semantic markup](https\://docs\.ansible\.com/ansible/devel/dev\_guide/developing\_modules\_documenting\.html\#semantic\-markup\-within\-module\-documentation) +in its documentation\. If you look at documentation with the ansible\-doc CLI tool +from ansible\-core before 2\.15\, please note that it does not render the markup +correctly\. You should be still able to read it in most cases\, but you need +ansible\-core 2\.15 or later to see it as it is intended\. Alternatively you can +look at [the devel docsite](https\://docs\.ansible\.com/ansible/devel/collections/community/crypto/) +for the rendered HTML version of the documentation of the latest release\. + +<a id="bugfixes-7"></a> +### Bugfixes + +* Fix PEM detection/identification to also accept random other lines before the line starting with <code>\-\-\-\-\-BEGIN</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/627](https\://github\.com/ansible\-collections/community\.crypto/issues/627)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/628](https\://github\.com/ansible\-collections/community\.crypto/pull/628)\)\. + +<a id="known-issues"></a> +### Known Issues + +* Ansible markup will show up in raw form on ansible\-doc text output for ansible\-core before 2\.15\. If you have trouble deciphering the documentation markup\, please upgrade to ansible\-core 2\.15 \(or newer\)\, or read the HTML documentation on [https\://docs\.ansible\.com/ansible/devel/collections/community/crypto/](https\://docs\.ansible\.com/ansible/devel/collections/community/crypto/)\. + +<a id="v2-14-0"></a> +## v2\.14\.0 + +<a id="release-summary-9"></a> +### Release Summary + +Feature release\. + +<a id="minor-changes-4"></a> +### Minor Changes + +* acme\_certificate \- allow to use no challenge by providing <code>no challenge</code> for the <code>challenge</code> option\. This is needed for ACME servers where validation is done without challenges \([https\://github\.com/ansible\-collections/community\.crypto/issues/613](https\://github\.com/ansible\-collections/community\.crypto/issues/613)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/615](https\://github\.com/ansible\-collections/community\.crypto/pull/615)\)\. +* acme\_certificate \- validate and wait for challenges in parallel instead handling them one after another \([https\://github\.com/ansible\-collections/community\.crypto/pull/617](https\://github\.com/ansible\-collections/community\.crypto/pull/617)\)\. +* x509\_certificate\_info \- added support for certificates in DER format when using <code>path</code> parameter \([https\://github\.com/ansible\-collections/community\.crypto/issues/603](https\://github\.com/ansible\-collections/community\.crypto/issues/603)\)\. + +<a id="v2-13-1"></a> +## v2\.13\.1 + +<a id="release-summary-10"></a> +### Release Summary + +Bugfix release\. + +<a id="bugfixes-8"></a> +### Bugfixes + +* execution environment definition \- fix installation of <code>python3\-pyOpenSSL</code> package on CentOS and RHEL \([https\://github\.com/ansible\-collections/community\.crypto/pull/606](https\://github\.com/ansible\-collections/community\.crypto/pull/606)\)\. +* execution environment definition \- fix source of <code>python3\-pyOpenSSL</code> package for Rocky Linux 9\+ \([https\://github\.com/ansible\-collections/community\.crypto/pull/606](https\://github\.com/ansible\-collections/community\.crypto/pull/606)\)\. + +<a id="v2-13-0"></a> +## v2\.13\.0 + +<a id="release-summary-11"></a> +### Release Summary + +Bugfix and maintenance release\. + +<a id="minor-changes-5"></a> +### Minor Changes + +* x509\_crl \- the <code>crl\_mode</code> option has been added to replace the existing <code>mode</code> option \([https\://github\.com/ansible\-collections/community\.crypto/issues/596](https\://github\.com/ansible\-collections/community\.crypto/issues/596)\)\. + +<a id="deprecated-features-2"></a> +### Deprecated Features + +* x509\_crl \- the <code>mode</code> option is deprecated\; use <code>crl\_mode</code> instead\. The <code>mode</code> option will change its meaning in community\.crypto 3\.0\.0\, and will refer to the CRL file\'s mode instead \([https\://github\.com/ansible\-collections/community\.crypto/issues/596](https\://github\.com/ansible\-collections/community\.crypto/issues/596)\)\. + +<a id="bugfixes-9"></a> +### Bugfixes + +* openssh\_keypair \- always generate a new key pair if the private key does not exist\. Previously\, the module would fail when <code>regenerate\=fail</code> without an existing key\, contradicting the documentation \([https\://github\.com/ansible\-collections/community\.crypto/pull/598](https\://github\.com/ansible\-collections/community\.crypto/pull/598)\)\. +* x509\_crl \- remove problem with ansible\-core 2\.16 due to <code>AnsibleModule</code> is now validating the <code>mode</code> parameter\'s values \([https\://github\.com/ansible\-collections/community\.crypto/issues/596](https\://github\.com/ansible\-collections/community\.crypto/issues/596)\)\. + +<a id="v2-12-0"></a> +## v2\.12\.0 + +<a id="release-summary-12"></a> +### Release Summary + +Feature release\. + +<a id="minor-changes-6"></a> +### Minor Changes + +* get\_certificate \- add <code>asn1\_base64</code> option to control whether the ASN\.1 included in the <code>extensions</code> return value is binary data or Base64 encoded \([https\://github\.com/ansible\-collections/community\.crypto/pull/592](https\://github\.com/ansible\-collections/community\.crypto/pull/592)\)\. + +<a id="v2-11-1"></a> +## v2\.11\.1 + +<a id="release-summary-13"></a> +### Release Summary + +Maintenance release with improved documentation\. + +<a id="v2-11-0"></a> +## v2\.11\.0 + +<a id="release-summary-14"></a> +### Release Summary + +Feature and bugfix release\. + +<a id="minor-changes-7"></a> +### Minor Changes + +* get\_certificate \- adds <code>ciphers</code> option for custom cipher selection \([https\://github\.com/ansible\-collections/community\.crypto/pull/571](https\://github\.com/ansible\-collections/community\.crypto/pull/571)\)\. + +<a id="bugfixes-10"></a> +### Bugfixes + +* action plugin helper \- fix handling of deprecations for ansible\-core 2\.14\.2 \([https\://github\.com/ansible\-collections/community\.crypto/pull/572](https\://github\.com/ansible\-collections/community\.crypto/pull/572)\)\. +* execution environment binary dependencies \(bindep\.txt\) \- fix <code>python3\-pyOpenSSL</code> dependency resolution on RHEL 9\+ / CentOS Stream 9\+ platforms \([https\://github\.com/ansible\-collections/community\.crypto/pull/575](https\://github\.com/ansible\-collections/community\.crypto/pull/575)\)\. +* various plugins \- remove unnecessary imports \([https\://github\.com/ansible\-collections/community\.crypto/pull/569](https\://github\.com/ansible\-collections/community\.crypto/pull/569)\)\. + +<a id="v2-10-0"></a> +## v2\.10\.0 + +<a id="release-summary-15"></a> +### Release Summary + +Bugfix and feature release\. + +<a id="bugfixes-11"></a> +### Bugfixes + +* openssl\_csr\, openssl\_csr\_pipe \- prevent invalid values for <code>crl\_distribution\_points</code> that do not have one of <code>full\_name</code>\, <code>relative\_name</code>\, and <code>crl\_issuer</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/560](https\://github\.com/ansible\-collections/community\.crypto/pull/560)\)\. +* openssl\_publickey\_info \- do not crash with internal error when public key cannot be parsed \([https\://github\.com/ansible\-collections/community\.crypto/pull/551](https\://github\.com/ansible\-collections/community\.crypto/pull/551)\)\. + +<a id="new-plugins-2"></a> +### New Plugins + +<a id="filter-2"></a> +#### Filter + +* openssl\_csr\_info \- Retrieve information from OpenSSL Certificate Signing Requests \(CSR\) +* openssl\_privatekey\_info \- Retrieve information from OpenSSL private keys +* openssl\_publickey\_info \- Retrieve information from OpenSSL public keys in PEM format +* split\_pem \- Split PEM file contents into multiple objects +* x509\_certificate\_info \- Retrieve information from X\.509 certificates in PEM format +* x509\_crl\_info \- Retrieve information from X\.509 CRLs in PEM format + +<a id="v2-9-0"></a> +## v2\.9\.0 + +<a id="release-summary-16"></a> +### Release Summary + +Regular feature release\. + +<a id="minor-changes-8"></a> +### Minor Changes + +* x509\_certificate\_info \- adds <code>issuer\_uri</code> field in return value based on Authority Information Access data \([https\://github\.com/ansible\-collections/community\.crypto/pull/530](https\://github\.com/ansible\-collections/community\.crypto/pull/530)\)\. + +<a id="v2-8-1"></a> +## v2\.8\.1 + +<a id="release-summary-17"></a> +### Release Summary + +Maintenance release with improved documentation\. + +<a id="v2-8-0"></a> +## v2\.8\.0 + +<a id="release-summary-18"></a> +### Release Summary + +Feature release\. + +<a id="minor-changes-9"></a> +### Minor Changes + +* acme\_\* modules \- handle more gracefully if CA\'s new nonce call does not return a nonce \([https\://github\.com/ansible\-collections/community\.crypto/pull/525](https\://github\.com/ansible\-collections/community\.crypto/pull/525)\)\. +* acme\_\* modules \- include symbolic HTTP status codes in error and log messages when available \([https\://github\.com/ansible\-collections/community\.crypto/pull/524](https\://github\.com/ansible\-collections/community\.crypto/pull/524)\)\. +* openssl\_pkcs12 \- add option <code>encryption\_level</code> which allows to chose <code>compatibility2022</code> when cryptography \>\= 38\.0\.0 is used to enable a more backwards compatible encryption algorithm\. If cryptography uses OpenSSL 3\.0\.0 or newer\, the default algorithm is not compatible with older software \([https\://github\.com/ansible\-collections/community\.crypto/pull/523](https\://github\.com/ansible\-collections/community\.crypto/pull/523)\)\. + +<a id="v2-7-1"></a> +## v2\.7\.1 + +<a id="release-summary-19"></a> +### Release Summary + +Maintenance release\. + +<a id="bugfixes-12"></a> +### Bugfixes + +* acme\_\* modules \- improve feedback when importing <code>cryptography</code> does not work \([https\://github\.com/ansible\-collections/community\.crypto/issues/518](https\://github\.com/ansible\-collections/community\.crypto/issues/518)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/519](https\://github\.com/ansible\-collections/community\.crypto/pull/519)\)\. + +<a id="v2-7-0"></a> +## v2\.7\.0 + +<a id="release-summary-20"></a> +### Release Summary + +Feature release\. + +<a id="minor-changes-10"></a> +### Minor Changes + +* acme\* modules \- also support the HTTP 503 Service Unavailable and 408 Request Timeout response status for automatic retries \([https\://github\.com/ansible\-collections/community\.crypto/pull/513](https\://github\.com/ansible\-collections/community\.crypto/pull/513)\)\. + +<a id="bugfixes-13"></a> +### Bugfixes + +* openssl\_privatekey\_pipe \- ensure compatibility with newer versions of ansible\-core \([https\://github\.com/ansible\-collections/community\.crypto/pull/515](https\://github\.com/ansible\-collections/community\.crypto/pull/515)\)\. + +<a id="v2-6-0"></a> +## v2\.6\.0 + +<a id="release-summary-21"></a> +### Release Summary + +Feature release\. + +<a id="minor-changes-11"></a> +### Minor Changes + +* acme\* modules \- support the HTTP 429 Too Many Requests response status \([https\://github\.com/ansible\-collections/community\.crypto/pull/508](https\://github\.com/ansible\-collections/community\.crypto/pull/508)\)\. +* openssh\_keypair \- added <code>pkcs1</code>\, <code>pkcs8</code>\, and <code>ssh</code> to the available choices for the <code>private\_key\_format</code> option \([https\://github\.com/ansible\-collections/community\.crypto/pull/511](https\://github\.com/ansible\-collections/community\.crypto/pull/511)\)\. + +<a id="v2-5-0"></a> +## v2\.5\.0 + +<a id="release-summary-22"></a> +### Release Summary + +Maintenance release with improved licensing declaration and documentation fixes\. + +<a id="minor-changes-12"></a> +### Minor Changes + +* All software licenses are now in the <code>LICENSES/</code> directory of the collection root\. Moreover\, <code>SPDX\-License\-Identifier\:</code> is used to declare the applicable license for every file that is not automatically generated \([https\://github\.com/ansible\-collections/community\.crypto/pull/491](https\://github\.com/ansible\-collections/community\.crypto/pull/491)\)\. + +<a id="v2-4-0"></a> +## v2\.4\.0 + +<a id="release-summary-23"></a> +### Release Summary + +Deprecation and bugfix release\. No new features this time\. + +<a id="deprecated-features-3"></a> +### Deprecated Features + +* Support for Ansible 2\.9 and ansible\-base 2\.10 is deprecated\, and will be removed in the next major release \(community\.crypto 3\.0\.0\)\. Some modules might still work with these versions afterwards\, but we will no longer keep compatibility code that was needed to support them \([https\://github\.com/ansible\-collections/community\.crypto/pull/460](https\://github\.com/ansible\-collections/community\.crypto/pull/460)\)\. + +<a id="bugfixes-14"></a> +### Bugfixes + +* openssl\_pkcs12 \- when using the pyOpenSSL backend\, do not crash when trying to read non\-existing other certificates \([https\://github\.com/ansible\-collections/community\.crypto/issues/486](https\://github\.com/ansible\-collections/community\.crypto/issues/486)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/487](https\://github\.com/ansible\-collections/community\.crypto/pull/487)\)\. + +<a id="v2-3-4"></a> +## v2\.3\.4 + +<a id="release-summary-24"></a> +### Release Summary + +Re\-release of what was intended to be 2\.3\.3\. + +A mistake during the release process caused the 2\.3\.3 tag to end up on the +commit for 1\.9\.17\, which caused the release pipeline to re\-publish 1\.9\.17 +as 2\.3\.3\. + +This release is identical to what should have been 2\.3\.3\, except that the +version number has been bumped to 2\.3\.4 and this changelog entry for 2\.3\.4 +has been added\. + +<a id="v2-3-3"></a> +## v2\.3\.3 + +<a id="release-summary-25"></a> +### Release Summary + +Bugfix release\. + +<a id="bugfixes-15"></a> +### Bugfixes + +* Include <code>Apache\-2\.0\.txt</code> file for <code>plugins/module\_utils/crypto/\_obj2txt\.py</code> and <code>plugins/module\_utils/crypto/\_objects\_data\.py</code>\. +* openssl\_csr \- the module no longer crashes with \'permitted\_subtrees/excluded\_subtrees must be a non\-empty list or None\' if only one of <code>name\_constraints\_permitted</code> and <code>name\_constraints\_excluded</code> is provided \([https\://github\.com/ansible\-collections/community\.crypto/issues/481](https\://github\.com/ansible\-collections/community\.crypto/issues/481)\)\. +* x509\_crl \- do not crash when signing CRL with Ed25519 or Ed448 keys \([https\://github\.com/ansible\-collections/community\.crypto/issues/473](https\://github\.com/ansible\-collections/community\.crypto/issues/473)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/474](https\://github\.com/ansible\-collections/community\.crypto/pull/474)\)\. + +<a id="v2-3-2"></a> +## v2\.3\.2 + +<a id="release-summary-26"></a> +### Release Summary + +Maintenance and bugfix release\. + +<a id="bugfixes-16"></a> +### Bugfixes + +* Include <code>simplified\_bsd\.txt</code> license file for the ECS module utils\. +* certificate\_complete\_chain \- do not stop execution if an unsupported signature algorithm is encountered\; warn instead \([https\://github\.com/ansible\-collections/community\.crypto/pull/457](https\://github\.com/ansible\-collections/community\.crypto/pull/457)\)\. + +<a id="v2-3-1"></a> +## v2\.3\.1 + +<a id="release-summary-27"></a> +### Release Summary + +Maintenance release\. + +<a id="bugfixes-17"></a> +### Bugfixes + +* Include <code>PSF\-license\.txt</code> file for <code>plugins/module\_utils/\_version\.py</code>\. + +<a id="v2-3-0"></a> +## v2\.3\.0 + +<a id="release-summary-28"></a> +### Release Summary + +Feature and bugfix release\. + +<a id="minor-changes-13"></a> +### Minor Changes + +* Prepare collection for inclusion in an Execution Environment by declaring its dependencies\. Please note that system packages are used for cryptography and PyOpenSSL\, which can be rather limited\. If you need features from newer cryptography versions\, you will have to manually force a newer version to be installed by pip by specifying something like <code>cryptography \>\= 37\.0\.0</code> in your Execution Environment\'s Python dependencies file \([https\://github\.com/ansible\-collections/community\.crypto/pull/440](https\://github\.com/ansible\-collections/community\.crypto/pull/440)\)\. +* Support automatic conversion for Internalionalized Domain Names \(IDNs\)\. When passing general names\, for example Subject Alternative Names to <code>community\.crypto\.openssl\_csr</code>\, these will automatically be converted to IDNA\. Conversion will be done per label to IDNA2008 if possible\, and IDNA2003 if IDNA2008 conversion fails for that label\. Note that IDNA conversion requires [the Python idna library](https\://pypi\.org/project/idna/) to be installed\. Please note that depending on which versions of the cryptography library are used\, it could try to process the converted IDNA another time with the Python <code>idna</code> library and reject IDNA2003 encoded values\. Using a new enough <code>cryptography</code> version avoids this \([https\://github\.com/ansible\-collections/community\.crypto/issues/426](https\://github\.com/ansible\-collections/community\.crypto/issues/426)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/436](https\://github\.com/ansible\-collections/community\.crypto/pull/436)\)\. +* acme\_\* modules \- add parameter <code>request\_timeout</code> to manage HTTP\(S\) request timeout \([https\://github\.com/ansible\-collections/community\.crypto/issues/447](https\://github\.com/ansible\-collections/community\.crypto/issues/447)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/448](https\://github\.com/ansible\-collections/community\.crypto/pull/448)\)\. +* luks\_devices \- added <code>perf\_same\_cpu\_crypt</code>\, <code>perf\_submit\_from\_crypt\_cpus</code>\, <code>perf\_no\_read\_workqueue</code>\, <code>perf\_no\_write\_workqueue</code> for performance tuning when opening LUKS2 containers \([https\://github\.com/ansible\-collections/community\.crypto/issues/427](https\://github\.com/ansible\-collections/community\.crypto/issues/427)\)\. +* luks\_devices \- added <code>persistent</code> option when opening LUKS2 containers \([https\://github\.com/ansible\-collections/community\.crypto/pull/434](https\://github\.com/ansible\-collections/community\.crypto/pull/434)\)\. +* openssl\_csr\_info \- add <code>name\_encoding</code> option to control the encoding \(IDNA\, Unicode\) used to return domain names in general names \([https\://github\.com/ansible\-collections/community\.crypto/pull/436](https\://github\.com/ansible\-collections/community\.crypto/pull/436)\)\. +* openssl\_pkcs12 \- allow to provide the private key as text instead of having to read it from a file\. This allows to store the private key in an encrypted form\, for example in Ansible Vault \([https\://github\.com/ansible\-collections/community\.crypto/pull/452](https\://github\.com/ansible\-collections/community\.crypto/pull/452)\)\. +* x509\_certificate\_info \- add <code>name\_encoding</code> option to control the encoding \(IDNA\, Unicode\) used to return domain names in general names \([https\://github\.com/ansible\-collections/community\.crypto/pull/436](https\://github\.com/ansible\-collections/community\.crypto/pull/436)\)\. +* x509\_crl \- add <code>name\_encoding</code> option to control the encoding \(IDNA\, Unicode\) used to return domain names in general names \([https\://github\.com/ansible\-collections/community\.crypto/pull/436](https\://github\.com/ansible\-collections/community\.crypto/pull/436)\)\. +* x509\_crl\_info \- add <code>name\_encoding</code> option to control the encoding \(IDNA\, Unicode\) used to return domain names in general names \([https\://github\.com/ansible\-collections/community\.crypto/pull/436](https\://github\.com/ansible\-collections/community\.crypto/pull/436)\)\. + +<a id="bugfixes-18"></a> +### Bugfixes + +* Make collection more robust when PyOpenSSL is used with an incompatible cryptography version \([https\://github\.com/ansible\-collections/community\.crypto/pull/445](https\://github\.com/ansible\-collections/community\.crypto/pull/445)\)\. +* x509\_crl \- fix crash when <code>issuer</code> for a revoked certificate is specified \([https\://github\.com/ansible\-collections/community\.crypto/pull/441](https\://github\.com/ansible\-collections/community\.crypto/pull/441)\)\. + +<a id="v2-2-4"></a> +## v2\.2\.4 + +<a id="release-summary-29"></a> +### Release Summary + +Regular maintenance release\. + +<a id="bugfixes-19"></a> +### Bugfixes + +* openssh\_\* modules \- fix exception handling to report traceback to users for enhanced traceability \([https\://github\.com/ansible\-collections/community\.crypto/pull/417](https\://github\.com/ansible\-collections/community\.crypto/pull/417)\)\. + +<a id="v2-2-3"></a> +## v2\.2\.3 + +<a id="release-summary-30"></a> +### Release Summary + +Regular bugfix release\. + +<a id="bugfixes-20"></a> +### Bugfixes + +* luks\_device \- fix parsing of <code>lsblk</code> output when device name ends with <code>crypt</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/409](https\://github\.com/ansible\-collections/community\.crypto/issues/409)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/410](https\://github\.com/ansible\-collections/community\.crypto/pull/410)\)\. + +<a id="v2-2-2"></a> +## v2\.2\.2 + +<a id="release-summary-31"></a> +### Release Summary + +Regular bugfix release\. + +In this release\, we extended the test matrix to include Alpine 3\, ArchLinux\, Debian Bullseye\, and CentOS Stream 8\. CentOS 8 was removed from the test matrix\. + +<a id="bugfixes-21"></a> +### Bugfixes + +* certificate\_complete\_chain \- allow multiple potential intermediate certificates to have the same subject \([https\://github\.com/ansible\-collections/community\.crypto/issues/399](https\://github\.com/ansible\-collections/community\.crypto/issues/399)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/403](https\://github\.com/ansible\-collections/community\.crypto/pull/403)\)\. +* x509\_certificate \- for the <code>ownca</code> provider\, check whether the CA private key actually belongs to the CA certificate \([https\://github\.com/ansible\-collections/community\.crypto/pull/407](https\://github\.com/ansible\-collections/community\.crypto/pull/407)\)\. +* x509\_certificate \- regenerate certificate when the CA\'s public key changes for <code>provider\=ownca</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/407](https\://github\.com/ansible\-collections/community\.crypto/pull/407)\)\. +* x509\_certificate \- regenerate certificate when the CA\'s subject changes for <code>provider\=ownca</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/400](https\://github\.com/ansible\-collections/community\.crypto/issues/400)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/402](https\://github\.com/ansible\-collections/community\.crypto/pull/402)\)\. +* x509\_certificate \- regenerate certificate when the private key changes for <code>provider\=selfsigned</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/407](https\://github\.com/ansible\-collections/community\.crypto/pull/407)\)\. + +<a id="v2-2-1"></a> +## v2\.2\.1 + +<a id="release-summary-32"></a> +### Release Summary + +Bugfix release\. + +<a id="bugfixes-22"></a> +### Bugfixes + +* openssh\_cert \- fixed false <code>changed</code> status for <code>host</code> certificates when using <code>full\_idempotence</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/395](https\://github\.com/ansible\-collections/community\.crypto/issues/395)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/396](https\://github\.com/ansible\-collections/community\.crypto/pull/396)\)\. + +<a id="v2-2-0"></a> +## v2\.2\.0 + +<a id="release-summary-33"></a> +### Release Summary + +Regular bugfix and feature release\. + +<a id="minor-changes-14"></a> +### Minor Changes + +* openssh\_cert \- added <code>ignore\_timestamps</code> parameter so it can be used semi\-idempotent with relative timestamps in <code>valid\_to</code>/<code>valid\_from</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/379](https\://github\.com/ansible\-collections/community\.crypto/issues/379)\)\. + +<a id="bugfixes-23"></a> +### Bugfixes + +* luks\_devices \- set <code>LANG</code> and similar environment variables to avoid translated output\, which can break some of the module\'s functionality like key management \([https\://github\.com/ansible\-collections/community\.crypto/pull/388](https\://github\.com/ansible\-collections/community\.crypto/pull/388)\, [https\://github\.com/ansible\-collections/community\.crypto/issues/385](https\://github\.com/ansible\-collections/community\.crypto/issues/385)\)\. + +<a id="v2-1-0"></a> +## v2\.1\.0 + +<a id="release-summary-34"></a> +### Release Summary + +Feature and bugfix release\. + +<a id="minor-changes-15"></a> +### Minor Changes + +* Adjust error messages that indicate <code>cryptography</code> is not installed from <code>Can\'t</code> to <code>Cannot</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/374](https\://github\.com/ansible\-collections/community\.crypto/pull/374)\)\. + +<a id="bugfixes-24"></a> +### Bugfixes + +* Various modules and plugins \- use vendored version of <code>distutils\.version</code> instead of the deprecated Python standard library <code>distutils</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/353](https\://github\.com/ansible\-collections/community\.crypto/pull/353)\)\. +* certificate\_complete\_chain \- do not append root twice if the chain already ends with a root certificate \([https\://github\.com/ansible\-collections/community\.crypto/pull/360](https\://github\.com/ansible\-collections/community\.crypto/pull/360)\)\. +* certificate\_complete\_chain \- do not hang when infinite loop is found \([https\://github\.com/ansible\-collections/community\.crypto/issues/355](https\://github\.com/ansible\-collections/community\.crypto/issues/355)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/360](https\://github\.com/ansible\-collections/community\.crypto/pull/360)\)\. + +<a id="new-modules"></a> +### New Modules + +* crypto\_info \- Retrieve cryptographic capabilities +* openssl\_privatekey\_convert \- Convert OpenSSL private keys + +<a id="v2-0-2"></a> +## v2\.0\.2 + +<a id="release-summary-35"></a> +### Release Summary + +Documentation fix release\. No actual code changes\. + +<a id="v2-0-1"></a> +## v2\.0\.1 + +<a id="release-summary-36"></a> +### Release Summary + +Bugfix release with extra forward compatibility for newer versions of cryptography\. + +<a id="minor-changes-16"></a> +### Minor Changes + +* acme\_\* modules \- fix usage of <code>fetch\_url</code> with changes in latest ansible\-core <code>devel</code> branch \([https\://github\.com/ansible\-collections/community\.crypto/pull/339](https\://github\.com/ansible\-collections/community\.crypto/pull/339)\)\. + +<a id="bugfixes-25"></a> +### Bugfixes + +* acme\_certificate \- avoid passing multiple certificates to <code>cryptography</code>\'s X\.509 certificate loader when <code>fullchain\_dest</code> is used \([https\://github\.com/ansible\-collections/community\.crypto/pull/324](https\://github\.com/ansible\-collections/community\.crypto/pull/324)\)\. +* get\_certificate\, openssl\_csr\_info\, x509\_certificate\_info \- add fallback code for extension parsing that works with cryptography 36\.0\.0 and newer\. This code re\-serializes de\-serialized extensions and thus can return slightly different values if the extension in the original CSR resp\. certificate was not canonicalized correctly\. This code is currently used as a fallback if the existing code stops working\, but we will switch it to be the main code in a future release \([https\://github\.com/ansible\-collections/community\.crypto/pull/331](https\://github\.com/ansible\-collections/community\.crypto/pull/331)\)\. +* luks\_device \- now also runs a built\-in LUKS signature cleaner on <code>state\=absent</code> to make sure that also the secondary LUKS2 header is wiped when older versions of wipefs are used \([https\://github\.com/ansible\-collections/community\.crypto/issues/326](https\://github\.com/ansible\-collections/community\.crypto/issues/326)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/327](https\://github\.com/ansible\-collections/community\.crypto/pull/327)\)\. +* openssl\_pkcs12 \- use new PKCS\#12 deserialization infrastructure from cryptography 36\.0\.0 if available \([https\://github\.com/ansible\-collections/community\.crypto/pull/302](https\://github\.com/ansible\-collections/community\.crypto/pull/302)\)\. + +<a id="v2-0-0"></a> +## v2\.0\.0 + +<a id="release-summary-37"></a> +### Release Summary + +A new major release of the <code>community\.crypto</code> collection\. The main changes are removal of the PyOpenSSL backends for almost all modules \(<code>openssl\_pkcs12</code> being the only exception\)\, and removal of the <code>assertonly</code> provider in the <code>x509\_certificate</code> provider\. There are also some other breaking changes which should improve the user interface/experience of this collection long\-term\. + +<a id="minor-changes-17"></a> +### Minor Changes + +* acme\_certificate \- the <code>subject</code> and <code>issuer</code> fields in in the <code>select\_chain</code> entries are now more strictly validated \([https\://github\.com/ansible\-collections/community\.crypto/pull/316](https\://github\.com/ansible\-collections/community\.crypto/pull/316)\)\. +* openssl\_csr\, openssl\_csr\_pipe \- provide a new <code>subject\_ordered</code> option if the order of the components in the subject is of importance \([https\://github\.com/ansible\-collections/community\.crypto/issues/291](https\://github\.com/ansible\-collections/community\.crypto/issues/291)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/316](https\://github\.com/ansible\-collections/community\.crypto/pull/316)\)\. +* openssl\_csr\, openssl\_csr\_pipe \- there is now stricter validation of the values of the <code>subject</code> option \([https\://github\.com/ansible\-collections/community\.crypto/pull/316](https\://github\.com/ansible\-collections/community\.crypto/pull/316)\)\. +* openssl\_privatekey\_info \- add <code>check\_consistency</code> option to request private key consistency checks to be done \([https\://github\.com/ansible\-collections/community\.crypto/pull/309](https\://github\.com/ansible\-collections/community\.crypto/pull/309)\)\. +* x509\_certificate\, x509\_certificate\_pipe \- add <code>ignore\_timestamps</code> option which allows to enable idempotency for \'not before\' and \'not after\' options \([https\://github\.com/ansible\-collections/community\.crypto/issues/295](https\://github\.com/ansible\-collections/community\.crypto/issues/295)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/317](https\://github\.com/ansible\-collections/community\.crypto/pull/317)\)\. +* x509\_crl \- provide a new <code>issuer\_ordered</code> option if the order of the components in the issuer is of importance \([https\://github\.com/ansible\-collections/community\.crypto/issues/291](https\://github\.com/ansible\-collections/community\.crypto/issues/291)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/316](https\://github\.com/ansible\-collections/community\.crypto/pull/316)\)\. +* x509\_crl \- there is now stricter validation of the values of the <code>issuer</code> option \([https\://github\.com/ansible\-collections/community\.crypto/pull/316](https\://github\.com/ansible\-collections/community\.crypto/pull/316)\)\. + +<a id="breaking-changes--porting-guide"></a> +### Breaking Changes / Porting Guide + +* Adjust <code>dirName</code> text parsing and to text converting code to conform to [Sections 2 and 3 of RFC 4514](https\://datatracker\.ietf\.org/doc/html/rfc4514\.html)\. This is similar to how [cryptography handles this](https\://cryptography\.io/en/latest/x509/reference/\#cryptography\.x509\.Name\.rfc4514\_string) \([https\://github\.com/ansible\-collections/community\.crypto/pull/274](https\://github\.com/ansible\-collections/community\.crypto/pull/274)\)\. +* acme module utils \- removing compatibility code \([https\://github\.com/ansible\-collections/community\.crypto/pull/290](https\://github\.com/ansible\-collections/community\.crypto/pull/290)\)\. +* acme\_\* modules \- removed vendored copy of the Python library <code>ipaddress</code>\. If you are using Python 2\.x\, please make sure to install the library \([https\://github\.com/ansible\-collections/community\.crypto/pull/287](https\://github\.com/ansible\-collections/community\.crypto/pull/287)\)\. +* compatibility module\_utils \- removed vendored copy of the Python library <code>ipaddress</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/287](https\://github\.com/ansible\-collections/community\.crypto/pull/287)\)\. +* crypto module utils \- removing compatibility code \([https\://github\.com/ansible\-collections/community\.crypto/pull/290](https\://github\.com/ansible\-collections/community\.crypto/pull/290)\)\. +* get\_certificate\, openssl\_csr\_info\, x509\_certificate\_info \- depending on the <code>cryptography</code> version used\, the modules might not return the ASN\.1 value for an extension as contained in the certificate respectively CSR\, but a re\-encoded version of it\. This should usually be identical to the value contained in the source file\, unless the value was malformed\. For extensions not handled by C\(cryptography\) the value contained in the source file is always returned unaltered \([https\://github\.com/ansible\-collections/community\.crypto/pull/318](https\://github\.com/ansible\-collections/community\.crypto/pull/318)\)\. +* module\_utils \- removed various PyOpenSSL support functions and default backend values that are not needed for the openssl\_pkcs12 module \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* openssl\_csr\, openssl\_csr\_pipe\, x509\_crl \- the <code>subject</code> respectively <code>issuer</code> fields no longer ignore empty values\, but instead fail when encountering them \([https\://github\.com/ansible\-collections/community\.crypto/pull/316](https\://github\.com/ansible\-collections/community\.crypto/pull/316)\)\. +* openssl\_privatekey\_info \- by default consistency checks are not run\; they need to be explicitly requested by passing <code>check\_consistency\=true</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/309](https\://github\.com/ansible\-collections/community\.crypto/pull/309)\)\. +* x509\_crl \- for idempotency checks\, the <code>issuer</code> order is ignored\. If order is important\, use the new <code>issuer\_ordered</code> option \([https\://github\.com/ansible\-collections/community\.crypto/pull/316](https\://github\.com/ansible\-collections/community\.crypto/pull/316)\)\. + +<a id="deprecated-features-4"></a> +### Deprecated Features + +* acme\_\* modules \- ACME version 1 is now deprecated and support for it will be removed in community\.crypto 2\.0\.0 \([https\://github\.com/ansible\-collections/community\.crypto/pull/288](https\://github\.com/ansible\-collections/community\.crypto/pull/288)\)\. + +<a id="removed-features-previously-deprecated"></a> +### Removed Features \(previously deprecated\) + +* acme\_\* modules \- the <code>acme\_directory</code> option is now required \([https\://github\.com/ansible\-collections/community\.crypto/pull/290](https\://github\.com/ansible\-collections/community\.crypto/pull/290)\)\. +* acme\_\* modules \- the <code>acme\_version</code> option is now required \([https\://github\.com/ansible\-collections/community\.crypto/pull/290](https\://github\.com/ansible\-collections/community\.crypto/pull/290)\)\. +* acme\_account\_facts \- the deprecated redirect has been removed\. Use community\.crypto\.acme\_account\_info instead \([https\://github\.com/ansible\-collections/community\.crypto/pull/290](https\://github\.com/ansible\-collections/community\.crypto/pull/290)\)\. +* acme\_account\_info \- <code>retrieve\_orders\=url\_list</code> no longer returns the return value <code>orders</code>\. Use the <code>order\_uris</code> return value instead \([https\://github\.com/ansible\-collections/community\.crypto/pull/290](https\://github\.com/ansible\-collections/community\.crypto/pull/290)\)\. +* crypto\.info module utils \- the deprecated redirect has been removed\. Use <code>crypto\.pem</code> instead \([https\://github\.com/ansible\-collections/community\.crypto/pull/290](https\://github\.com/ansible\-collections/community\.crypto/pull/290)\)\. +* get\_certificate \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* openssl\_certificate \- the deprecated redirect has been removed\. Use community\.crypto\.x509\_certificate instead \([https\://github\.com/ansible\-collections/community\.crypto/pull/290](https\://github\.com/ansible\-collections/community\.crypto/pull/290)\)\. +* openssl\_certificate\_info \- the deprecated redirect has been removed\. Use community\.crypto\.x509\_certificate\_info instead \([https\://github\.com/ansible\-collections/community\.crypto/pull/290](https\://github\.com/ansible\-collections/community\.crypto/pull/290)\)\. +* openssl\_csr \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* openssl\_csr and openssl\_csr\_pipe \- <code>version</code> now only accepts the \(default\) value 1 \([https\://github\.com/ansible\-collections/community\.crypto/pull/290](https\://github\.com/ansible\-collections/community\.crypto/pull/290)\)\. +* openssl\_csr\_info \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* openssl\_csr\_pipe \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* openssl\_privatekey \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* openssl\_privatekey\_info \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* openssl\_privatekey\_pipe \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* openssl\_publickey \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* openssl\_publickey\_info \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* openssl\_signature \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* openssl\_signature\_info \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* x509\_certificate \- remove <code>assertonly</code> provider \([https\://github\.com/ansible\-collections/community\.crypto/pull/289](https\://github\.com/ansible\-collections/community\.crypto/pull/289)\)\. +* x509\_certificate \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* x509\_certificate\_info \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. +* x509\_certificate\_pipe \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. + +<a id="bugfixes-26"></a> +### Bugfixes + +* cryptography backend \- improve Unicode handling for Python 2 \([https\://github\.com/ansible\-collections/community\.crypto/pull/313](https\://github\.com/ansible\-collections/community\.crypto/pull/313)\)\. +* get\_certificate \- fix compatibility with the cryptography 35\.0\.0 release \([https\://github\.com/ansible\-collections/community\.crypto/pull/294](https\://github\.com/ansible\-collections/community\.crypto/pull/294)\)\. +* openssl\_csr\_info \- fix compatibility with the cryptography 35\.0\.0 release \([https\://github\.com/ansible\-collections/community\.crypto/pull/294](https\://github\.com/ansible\-collections/community\.crypto/pull/294)\)\. +* openssl\_pkcs12 \- fix compatibility with the cryptography 35\.0\.0 release \([https\://github\.com/ansible\-collections/community\.crypto/pull/296](https\://github\.com/ansible\-collections/community\.crypto/pull/296)\)\. +* x509\_certificate\_info \- fix compatibility with the cryptography 35\.0\.0 release \([https\://github\.com/ansible\-collections/community\.crypto/pull/294](https\://github\.com/ansible\-collections/community\.crypto/pull/294)\)\. + +<a id="v1-9-4"></a> +## v1\.9\.4 + +<a id="release-summary-38"></a> +### Release Summary + +Regular bugfix release\. + +<a id="bugfixes-27"></a> +### Bugfixes + +* acme\_\* modules \- fix commands composed for OpenSSL backend to retrieve information on CSRs and certificates from stdin to use <code>/dev/stdin</code> instead of <code>\-</code>\. This is needed for OpenSSL 1\.0\.1 and 1\.0\.2\, apparently \([https\://github\.com/ansible\-collections/community\.crypto/pull/279](https\://github\.com/ansible\-collections/community\.crypto/pull/279)\)\. +* acme\_challenge\_cert\_helper \- only return exception when cryptography is not installed\, not when a too old version of it is installed\. This prevents Ansible\'s callback to crash \([https\://github\.com/ansible\-collections/community\.crypto/pull/281](https\://github\.com/ansible\-collections/community\.crypto/pull/281)\)\. + +<a id="v1-9-3"></a> +## v1\.9\.3 + +<a id="release-summary-39"></a> +### Release Summary + +Regular bugfix release\. + +<a id="bugfixes-28"></a> +### Bugfixes + +* openssl\_csr and openssl\_csr\_pipe \- make sure that Unicode strings are used to compare strings with the cryptography backend\. This fixes idempotency problems with non\-ASCII letters on Python 2 \([https\://github\.com/ansible\-collections/community\.crypto/issues/270](https\://github\.com/ansible\-collections/community\.crypto/issues/270)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/271](https\://github\.com/ansible\-collections/community\.crypto/pull/271)\)\. + +<a id="v1-9-2"></a> +## v1\.9\.2 + +<a id="release-summary-40"></a> +### Release Summary + +Bugfix release to fix the changelog\. No other change compared to 1\.9\.0\. + +<a id="v1-9-1"></a> +## v1\.9\.1 + +<a id="release-summary-41"></a> +### Release Summary + +Accidental 1\.9\.1 release\. Identical to 1\.9\.0\. + +<a id="v1-9-0"></a> +## v1\.9\.0 + +<a id="release-summary-42"></a> +### Release Summary + +Regular feature release\. + +<a id="minor-changes-18"></a> +### Minor Changes + +* get\_certificate \- added <code>starttls</code> option to retrieve certificates from servers which require clients to request an encrypted connection \([https\://github\.com/ansible\-collections/community\.crypto/pull/264](https\://github\.com/ansible\-collections/community\.crypto/pull/264)\)\. +* openssh\_keypair \- added <code>diff</code> support \([https\://github\.com/ansible\-collections/community\.crypto/pull/260](https\://github\.com/ansible\-collections/community\.crypto/pull/260)\)\. + +<a id="bugfixes-29"></a> +### Bugfixes + +* keypair\_backend module utils \- simplify code to pass sanity tests \([https\://github\.com/ansible\-collections/community\.crypto/pull/263](https\://github\.com/ansible\-collections/community\.crypto/pull/263)\)\. +* openssh\_keypair \- fixed <code>cryptography</code> backend to preserve original file permissions when regenerating a keypair requires existing files to be overwritten \([https\://github\.com/ansible\-collections/community\.crypto/pull/260](https\://github\.com/ansible\-collections/community\.crypto/pull/260)\)\. +* openssh\_keypair \- fixed error handling to restore original keypair if regeneration fails \([https\://github\.com/ansible\-collections/community\.crypto/pull/260](https\://github\.com/ansible\-collections/community\.crypto/pull/260)\)\. +* x509\_crl \- restore inherited function signature to pass sanity tests \([https\://github\.com/ansible\-collections/community\.crypto/pull/263](https\://github\.com/ansible\-collections/community\.crypto/pull/263)\)\. + +<a id="v1-8-0"></a> +## v1\.8\.0 + +<a id="release-summary-43"></a> +### Release Summary + +Regular bugfix and feature release\. + +<a id="minor-changes-19"></a> +### Minor Changes + +* Avoid internal ansible\-core module\_utils in favor of equivalent public API available since at least Ansible 2\.9 \([https\://github\.com/ansible\-collections/community\.crypto/pull/253](https\://github\.com/ansible\-collections/community\.crypto/pull/253)\)\. +* openssh certificate module utils \- new module\_utils for parsing OpenSSH certificates \([https\://github\.com/ansible\-collections/community\.crypto/pull/246](https\://github\.com/ansible\-collections/community\.crypto/pull/246)\)\. +* openssh\_cert \- added <code>regenerate</code> option to validate additional certificate parameters which trigger regeneration of an existing certificate \([https\://github\.com/ansible\-collections/community\.crypto/pull/256](https\://github\.com/ansible\-collections/community\.crypto/pull/256)\)\. +* openssh\_cert \- adding <code>diff</code> support \([https\://github\.com/ansible\-collections/community\.crypto/pull/255](https\://github\.com/ansible\-collections/community\.crypto/pull/255)\)\. + +<a id="bugfixes-30"></a> +### Bugfixes + +* openssh\_cert \- fixed certificate generation to restore original certificate if an error is encountered \([https\://github\.com/ansible\-collections/community\.crypto/pull/255](https\://github\.com/ansible\-collections/community\.crypto/pull/255)\)\. +* openssh\_keypair \- fixed a bug that prevented custom file attributes being applied to public keys \([https\://github\.com/ansible\-collections/community\.crypto/pull/257](https\://github\.com/ansible\-collections/community\.crypto/pull/257)\)\. + +<a id="v1-7-1"></a> +## v1\.7\.1 + +<a id="release-summary-44"></a> +### Release Summary + +Bugfix release\. + +<a id="bugfixes-31"></a> +### Bugfixes + +* openssl\_pkcs12 \- fix crash when loading passphrase\-protected PKCS\#12 files with <code>cryptography</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/issues/247](https\://github\.com/ansible\-collections/community\.crypto/issues/247)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/248](https\://github\.com/ansible\-collections/community\.crypto/pull/248)\)\. + +<a id="v1-7-0"></a> +## v1\.7\.0 + +<a id="release-summary-45"></a> +### Release Summary + +Regular feature and bugfix release\. + +<a id="minor-changes-20"></a> +### Minor Changes + +* cryptography\_openssh module utils \- new module\_utils for managing asymmetric keypairs and OpenSSH formatted/encoded asymmetric keypairs \([https\://github\.com/ansible\-collections/community\.crypto/pull/213](https\://github\.com/ansible\-collections/community\.crypto/pull/213)\)\. +* openssh\_keypair \- added <code>backend</code> parameter for selecting between the cryptography library or the OpenSSH binary for the execution of actions performed by <code>openssh\_keypair</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/236](https\://github\.com/ansible\-collections/community\.crypto/pull/236)\)\. +* openssh\_keypair \- added <code>passphrase</code> parameter for encrypting/decrypting OpenSSH private keys \([https\://github\.com/ansible\-collections/community\.crypto/pull/225](https\://github\.com/ansible\-collections/community\.crypto/pull/225)\)\. +* openssl\_csr \- add diff mode \([https\://github\.com/ansible\-collections/community\.crypto/issues/38](https\://github\.com/ansible\-collections/community\.crypto/issues/38)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/150](https\://github\.com/ansible\-collections/community\.crypto/pull/150)\)\. +* openssl\_csr\_info \- now returns <code>public\_key\_type</code> and <code>public\_key\_data</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/233](https\://github\.com/ansible\-collections/community\.crypto/pull/233)\)\. +* openssl\_csr\_info \- refactor module to allow code reuse for diff mode \([https\://github\.com/ansible\-collections/community\.crypto/pull/204](https\://github\.com/ansible\-collections/community\.crypto/pull/204)\)\. +* openssl\_csr\_pipe \- add diff mode \([https\://github\.com/ansible\-collections/community\.crypto/issues/38](https\://github\.com/ansible\-collections/community\.crypto/issues/38)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/150](https\://github\.com/ansible\-collections/community\.crypto/pull/150)\)\. +* openssl\_pkcs12 \- added option <code>select\_crypto\_backend</code> and a <code>cryptography</code> backend\. This requires cryptography 3\.0 or newer\, and does not support the <code>iter\_size</code> and <code>maciter\_size</code> options \([https\://github\.com/ansible\-collections/community\.crypto/pull/234](https\://github\.com/ansible\-collections/community\.crypto/pull/234)\)\. +* openssl\_privatekey \- add diff mode \([https\://github\.com/ansible\-collections/community\.crypto/issues/38](https\://github\.com/ansible\-collections/community\.crypto/issues/38)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/150](https\://github\.com/ansible\-collections/community\.crypto/pull/150)\)\. +* openssl\_privatekey\_info \- refactor module to allow code reuse for diff mode \([https\://github\.com/ansible\-collections/community\.crypto/pull/205](https\://github\.com/ansible\-collections/community\.crypto/pull/205)\)\. +* openssl\_privatekey\_pipe \- add diff mode \([https\://github\.com/ansible\-collections/community\.crypto/issues/38](https\://github\.com/ansible\-collections/community\.crypto/issues/38)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/150](https\://github\.com/ansible\-collections/community\.crypto/pull/150)\)\. +* openssl\_publickey \- add diff mode \([https\://github\.com/ansible\-collections/community\.crypto/issues/38](https\://github\.com/ansible\-collections/community\.crypto/issues/38)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/150](https\://github\.com/ansible\-collections/community\.crypto/pull/150)\)\. +* x509\_certificate \- add diff mode \([https\://github\.com/ansible\-collections/community\.crypto/issues/38](https\://github\.com/ansible\-collections/community\.crypto/issues/38)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/150](https\://github\.com/ansible\-collections/community\.crypto/pull/150)\)\. +* x509\_certificate\_info \- now returns <code>public\_key\_type</code> and <code>public\_key\_data</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/233](https\://github\.com/ansible\-collections/community\.crypto/pull/233)\)\. +* x509\_certificate\_info \- refactor module to allow code reuse for diff mode \([https\://github\.com/ansible\-collections/community\.crypto/pull/206](https\://github\.com/ansible\-collections/community\.crypto/pull/206)\)\. +* x509\_certificate\_pipe \- add diff mode \([https\://github\.com/ansible\-collections/community\.crypto/issues/38](https\://github\.com/ansible\-collections/community\.crypto/issues/38)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/150](https\://github\.com/ansible\-collections/community\.crypto/pull/150)\)\. +* x509\_crl \- add diff mode \([https\://github\.com/ansible\-collections/community\.crypto/issues/38](https\://github\.com/ansible\-collections/community\.crypto/issues/38)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/150](https\://github\.com/ansible\-collections/community\.crypto/pull/150)\)\. +* x509\_crl\_info \- add <code>list\_revoked\_certificates</code> option to avoid enumerating all revoked certificates \([https\://github\.com/ansible\-collections/community\.crypto/pull/232](https\://github\.com/ansible\-collections/community\.crypto/pull/232)\)\. +* x509\_crl\_info \- refactor module to allow code reuse for diff mode \([https\://github\.com/ansible\-collections/community\.crypto/pull/203](https\://github\.com/ansible\-collections/community\.crypto/pull/203)\)\. + +<a id="bugfixes-32"></a> +### Bugfixes + +* openssh\_keypair \- fix <code>check\_mode</code> to populate return values for existing keypairs \([https\://github\.com/ansible\-collections/community\.crypto/issues/113](https\://github\.com/ansible\-collections/community\.crypto/issues/113)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/230](https\://github\.com/ansible\-collections/community\.crypto/pull/230)\)\. +* various modules \- prevent crashes when modules try to set attributes on not yet existing files in check mode\. This will be fixed in ansible\-core 2\.12\, but it is not backported to every Ansible version we support \([https\://github\.com/ansible\-collections/community\.crypto/issue/242](https\://github\.com/ansible\-collections/community\.crypto/issue/242)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/243](https\://github\.com/ansible\-collections/community\.crypto/pull/243)\)\. +* x509\_certificate \- fix crash when <code>assertonly</code> provider is used and some error conditions should be reported \([https\://github\.com/ansible\-collections/community\.crypto/issues/240](https\://github\.com/ansible\-collections/community\.crypto/issues/240)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/241](https\://github\.com/ansible\-collections/community\.crypto/pull/241)\)\. + +<a id="new-modules-1"></a> +### New Modules + +* openssl\_publickey\_info \- Provide information for OpenSSL public keys + +<a id="v1-6-2"></a> +## v1\.6\.2 + +<a id="release-summary-46"></a> +### Release Summary + +Bugfix release\. Fixes compatibility issue of ACME modules with step\-ca\. + +<a id="bugfixes-33"></a> +### Bugfixes + +* acme\_\* modules \- avoid crashing for ACME servers where the <code>meta</code> directory key is not present \([https\://github\.com/ansible\-collections/community\.crypto/issues/220](https\://github\.com/ansible\-collections/community\.crypto/issues/220)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/221](https\://github\.com/ansible\-collections/community\.crypto/pull/221)\)\. + +<a id="v1-6-1"></a> +## v1\.6\.1 + +<a id="release-summary-47"></a> +### Release Summary + +Bugfix release\. + +<a id="bugfixes-34"></a> +### Bugfixes + +* acme\_\* modules \- fix wrong usages of <code>ACMEProtocolException</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/216](https\://github\.com/ansible\-collections/community\.crypto/pull/216)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/217](https\://github\.com/ansible\-collections/community\.crypto/pull/217)\)\. + +<a id="v1-6-0"></a> +## v1\.6\.0 + +<a id="release-summary-48"></a> +### Release Summary + +Fixes compatibility issues with the latest ansible\-core 2\.11 beta\, and contains a lot of internal refactoring for the ACME modules and support for private key passphrases for them\. + +<a id="minor-changes-21"></a> +### Minor Changes + +* acme module\_utils \- the <code>acme</code> module\_utils has been split up into several Python modules \([https\://github\.com/ansible\-collections/community\.crypto/pull/184](https\://github\.com/ansible\-collections/community\.crypto/pull/184)\)\. +* acme\_\* modules \- codebase refactor which should not be visible to end\-users \([https\://github\.com/ansible\-collections/community\.crypto/pull/184](https\://github\.com/ansible\-collections/community\.crypto/pull/184)\)\. +* acme\_\* modules \- support account key passphrases for <code>cryptography</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/issues/197](https\://github\.com/ansible\-collections/community\.crypto/issues/197)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/207](https\://github\.com/ansible\-collections/community\.crypto/pull/207)\)\. +* acme\_certificate\_revoke \- support revoking by private keys that are passphrase protected for <code>cryptography</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/207](https\://github\.com/ansible\-collections/community\.crypto/pull/207)\)\. +* acme\_challenge\_cert\_helper \- add <code>private\_key\_passphrase</code> parameter \([https\://github\.com/ansible\-collections/community\.crypto/pull/207](https\://github\.com/ansible\-collections/community\.crypto/pull/207)\)\. + +<a id="deprecated-features-5"></a> +### Deprecated Features + +* acme module\_utils \- the <code>acme</code> module\_utils \(<code>ansible\_collections\.community\.crypto\.plugins\.module\_utils\.acme</code>\) is deprecated and will be removed in community\.crypto 2\.0\.0\. Use the new Python modules in the <code>acme</code> package instead \(<code>ansible\_collections\.community\.crypto\.plugins\.module\_utils\.acme\.xxx</code>\) \([https\://github\.com/ansible\-collections/community\.crypto/pull/184](https\://github\.com/ansible\-collections/community\.crypto/pull/184)\)\. + +<a id="bugfixes-35"></a> +### Bugfixes + +* action\_module plugin helper \- make compatible with latest changes in ansible\-core 2\.11\.0b3 \([https\://github\.com/ansible\-collections/community\.crypto/pull/202](https\://github\.com/ansible\-collections/community\.crypto/pull/202)\)\. +* openssl\_privatekey\_pipe \- make compatible with latest changes in ansible\-core 2\.11\.0b3 \([https\://github\.com/ansible\-collections/community\.crypto/pull/202](https\://github\.com/ansible\-collections/community\.crypto/pull/202)\)\. + +<a id="v1-5-0"></a> +## v1\.5\.0 + +<a id="release-summary-49"></a> +### Release Summary + +Regular feature and bugfix release\. Deprecates a return value\. + +<a id="minor-changes-22"></a> +### Minor Changes + +* acme\_account\_info \- when <code>retrieve\_orders</code> is not <code>ignore</code> and the ACME server allows to query orders\, the new return value <code>order\_uris</code> is always populated with a list of URIs \([https\://github\.com/ansible\-collections/community\.crypto/pull/178](https\://github\.com/ansible\-collections/community\.crypto/pull/178)\)\. +* luks\_device \- allow to specify sector size for LUKS2 containers with new <code>sector\_size</code> parameter \([https\://github\.com/ansible\-collections/community\.crypto/pull/193](https\://github\.com/ansible\-collections/community\.crypto/pull/193)\)\. + +<a id="deprecated-features-6"></a> +### Deprecated Features + +* acme\_account\_info \- when <code>retrieve\_orders\=url\_list</code>\, <code>orders</code> will no longer be returned in community\.crypto 2\.0\.0\. Use <code>order\_uris</code> instead \([https\://github\.com/ansible\-collections/community\.crypto/pull/178](https\://github\.com/ansible\-collections/community\.crypto/pull/178)\)\. + +<a id="bugfixes-36"></a> +### Bugfixes + +* openssl\_csr \- no longer fails when comparing CSR without basic constraint when <code>basic\_constraints</code> is specified \([https\://github\.com/ansible\-collections/community\.crypto/issues/179](https\://github\.com/ansible\-collections/community\.crypto/issues/179)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/180](https\://github\.com/ansible\-collections/community\.crypto/pull/180)\)\. + +<a id="v1-4-0"></a> +## v1\.4\.0 + +<a id="release-summary-50"></a> +### Release Summary + +Release with several new features and bugfixes\. + +<a id="minor-changes-23"></a> +### Minor Changes + +* The ACME module\_utils has been relicensed back from the Simplified BSD License \([https\://opensource\.org/licenses/BSD\-2\-Clause](https\://opensource\.org/licenses/BSD\-2\-Clause)\) to the GPLv3\+ \(same license used by most other code in this collection\)\. This undoes a licensing change when the original GPLv3\+ licensed code was moved to module\_utils in [https\://github\.com/ansible/ansible/pull/40697](https\://github\.com/ansible/ansible/pull/40697) \([https\://github\.com/ansible\-collections/community\.crypto/pull/165](https\://github\.com/ansible\-collections/community\.crypto/pull/165)\)\. +* The <code>crypto/identify\.py</code> module\_utils has been renamed to <code>crypto/pem\.py</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/166](https\://github\.com/ansible\-collections/community\.crypto/pull/166)\)\. +* luks\_device \- <code>new\_keyfile</code>\, <code>new\_passphrase</code>\, <code>remove\_keyfile</code> and <code>remove\_passphrase</code> are now idempotent \([https\://github\.com/ansible\-collections/community\.crypto/issues/19](https\://github\.com/ansible\-collections/community\.crypto/issues/19)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/168](https\://github\.com/ansible\-collections/community\.crypto/pull/168)\)\. +* luks\_device \- allow to configure PBKDF \([https\://github\.com/ansible\-collections/community\.crypto/pull/163](https\://github\.com/ansible\-collections/community\.crypto/pull/163)\)\. +* openssl\_csr\, openssl\_csr\_pipe \- allow to specify CRL distribution endpoints with <code>crl\_distribution\_points</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/147](https\://github\.com/ansible\-collections/community\.crypto/issues/147)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/167](https\://github\.com/ansible\-collections/community\.crypto/pull/167)\)\. +* openssl\_pkcs12 \- allow to specify certificate bundles in <code>other\_certificates</code> by using new option <code>other\_certificates\_parse\_all</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/149](https\://github\.com/ansible\-collections/community\.crypto/issues/149)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/166](https\://github\.com/ansible\-collections/community\.crypto/pull/166)\)\. + +<a id="bugfixes-37"></a> +### Bugfixes + +* acme\_certificate \- error when requested challenge type is not found for non\-valid challenges\, instead of hanging on step 2 \([https\://github\.com/ansible\-collections/community\.crypto/issues/171](https\://github\.com/ansible\-collections/community\.crypto/issues/171)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/173](https\://github\.com/ansible\-collections/community\.crypto/pull/173)\)\. + +<a id="v1-3-0"></a> +## v1\.3\.0 + +<a id="release-summary-51"></a> +### Release Summary + +Contains new modules <code>openssl\_privatekey\_pipe</code>\, <code>openssl\_csr\_pipe</code> and <code>x509\_certificate\_pipe</code> which allow to create or update private keys\, CSRs and X\.509 certificates without having to write them to disk\. + +<a id="minor-changes-24"></a> +### Minor Changes + +* openssh\_cert \- add module parameter <code>use\_agent</code> to enable using signing keys stored in ssh\-agent \([https\://github\.com/ansible\-collections/community\.crypto/issues/116](https\://github\.com/ansible\-collections/community\.crypto/issues/116)\)\. +* openssl\_csr \- refactor module to allow code reuse by openssl\_csr\_pipe \([https\://github\.com/ansible\-collections/community\.crypto/pull/123](https\://github\.com/ansible\-collections/community\.crypto/pull/123)\)\. +* openssl\_privatekey \- refactor module to allow code reuse by openssl\_privatekey\_pipe \([https\://github\.com/ansible\-collections/community\.crypto/pull/119](https\://github\.com/ansible\-collections/community\.crypto/pull/119)\)\. +* openssl\_privatekey \- the elliptic curve <code>secp192r1</code> now triggers a security warning\. Elliptic curves of at least 224 bits should be used for new keys\; see [here](https\://cryptography\.io/en/latest/hazmat/primitives/asymmetric/ec\.html\#elliptic\-curves) \([https\://github\.com/ansible\-collections/community\.crypto/pull/132](https\://github\.com/ansible\-collections/community\.crypto/pull/132)\)\. +* x509\_certificate \- for the <code>selfsigned</code> provider\, a CSR is not required anymore\. If no CSR is provided\, the module behaves as if a minimal CSR which only contains the public key has been provided \([https\://github\.com/ansible\-collections/community\.crypto/issues/32](https\://github\.com/ansible\-collections/community\.crypto/issues/32)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/129](https\://github\.com/ansible\-collections/community\.crypto/pull/129)\)\. +* x509\_certificate \- refactor module to allow code reuse by x509\_certificate\_pipe \([https\://github\.com/ansible\-collections/community\.crypto/pull/135](https\://github\.com/ansible\-collections/community\.crypto/pull/135)\)\. + +<a id="bugfixes-38"></a> +### Bugfixes + +* openssl\_pkcs12 \- report the correct state when <code>action</code> is <code>parse</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/143](https\://github\.com/ansible\-collections/community\.crypto/issues/143)\)\. +* support code \- improve handling of certificate and certificate signing request \(CSR\) loading with the <code>cryptography</code> backend when errors occur \([https\://github\.com/ansible\-collections/community\.crypto/issues/138](https\://github\.com/ansible\-collections/community\.crypto/issues/138)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/139](https\://github\.com/ansible\-collections/community\.crypto/pull/139)\)\. +* x509\_certificate \- fix <code>entrust</code> provider\, which was broken since community\.crypto 0\.1\.0 due to a feature added before the collection move \([https\://github\.com/ansible\-collections/community\.crypto/pull/135](https\://github\.com/ansible\-collections/community\.crypto/pull/135)\)\. + +<a id="new-modules-2"></a> +### New Modules + +* openssl\_csr\_pipe \- Generate OpenSSL Certificate Signing Request \(CSR\) +* openssl\_privatekey\_pipe \- Generate OpenSSL private keys without disk access +* x509\_certificate\_pipe \- Generate and/or check OpenSSL certificates + +<a id="v1-2-0"></a> +## v1\.2\.0 + +<a id="release-summary-52"></a> +### Release Summary + +Please note that this release fixes a security issue \(CVE\-2020\-25646\)\. + +<a id="minor-changes-25"></a> +### Minor Changes + +* acme\_certificate \- allow to pass CSR file as content with new option <code>csr\_content</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/115](https\://github\.com/ansible\-collections/community\.crypto/pull/115)\)\. +* x509\_certificate\_info \- add <code>fingerprints</code> return value which returns certificate fingerprints \([https\://github\.com/ansible\-collections/community\.crypto/pull/121](https\://github\.com/ansible\-collections/community\.crypto/pull/121)\)\. + +<a id="security-fixes"></a> +### Security Fixes + +* openssl\_csr \- the option <code>privatekey\_content</code> was not marked as <code>no\_log</code>\, resulting in it being dumped into the system log by default\, and returned in the registered results in the <code>invocation</code> field \(CVE\-2020\-25646\, [https\://github\.com/ansible\-collections/community\.crypto/pull/125](https\://github\.com/ansible\-collections/community\.crypto/pull/125)\)\. +* openssl\_privatekey\_info \- the option <code>content</code> was not marked as <code>no\_log</code>\, resulting in it being dumped into the system log by default\, and returned in the registered results in the <code>invocation</code> field \(CVE\-2020\-25646\, [https\://github\.com/ansible\-collections/community\.crypto/pull/125](https\://github\.com/ansible\-collections/community\.crypto/pull/125)\)\. +* openssl\_publickey \- the option <code>privatekey\_content</code> was not marked as <code>no\_log</code>\, resulting in it being dumped into the system log by default\, and returned in the registered results in the <code>invocation</code> field \(CVE\-2020\-25646\, [https\://github\.com/ansible\-collections/community\.crypto/pull/125](https\://github\.com/ansible\-collections/community\.crypto/pull/125)\)\. +* openssl\_signature \- the option <code>privatekey\_content</code> was not marked as <code>no\_log</code>\, resulting in it being dumped into the system log by default\, and returned in the registered results in the <code>invocation</code> field \(CVE\-2020\-25646\, [https\://github\.com/ansible\-collections/community\.crypto/pull/125](https\://github\.com/ansible\-collections/community\.crypto/pull/125)\)\. +* x509\_certificate \- the options <code>privatekey\_content</code> and <code>ownca\_privatekey\_content</code> were not marked as <code>no\_log</code>\, resulting in it being dumped into the system log by default\, and returned in the registered results in the <code>invocation</code> field \(CVE\-2020\-25646\, [https\://github\.com/ansible\-collections/community\.crypto/pull/125](https\://github\.com/ansible\-collections/community\.crypto/pull/125)\)\. +* x509\_crl \- the option <code>privatekey\_content</code> was not marked as <code>no\_log</code>\, resulting in it being dumped into the system log by default\, and returned in the registered results in the <code>invocation</code> field \(CVE\-2020\-25646\, [https\://github\.com/ansible\-collections/community\.crypto/pull/125](https\://github\.com/ansible\-collections/community\.crypto/pull/125)\)\. + +<a id="bugfixes-39"></a> +### Bugfixes + +* openssl\_pkcs12 \- do not crash when reading PKCS\#12 file which has no private key and/or no main certificate \([https\://github\.com/ansible\-collections/community\.crypto/issues/103](https\://github\.com/ansible\-collections/community\.crypto/issues/103)\)\. + +<a id="v1-1-1"></a> +## v1\.1\.1 + +<a id="release-summary-53"></a> +### Release Summary + +Bugfixes for Ansible 2\.10\.0\. + +<a id="bugfixes-40"></a> +### Bugfixes + +* meta/runtime\.yml \- convert Ansible version numbers for old names of modules to collection version numbers \([https\://github\.com/ansible\-collections/community\.crypto/pull/108](https\://github\.com/ansible\-collections/community\.crypto/pull/108)\)\. +* openssl\_csr \- improve handling of IDNA errors \([https\://github\.com/ansible\-collections/community\.crypto/issues/105](https\://github\.com/ansible\-collections/community\.crypto/issues/105)\)\. + +<a id="v1-1-0"></a> +## v1\.1\.0 + +<a id="release-summary-54"></a> +### Release Summary + +Release for Ansible 2\.10\.0\. + +<a id="minor-changes-26"></a> +### Minor Changes + +* acme\_account \- add <code>external\_account\_binding</code> option to allow creation of ACME accounts with External Account Binding \([https\://github\.com/ansible\-collections/community\.crypto/issues/89](https\://github\.com/ansible\-collections/community\.crypto/issues/89)\)\. +* acme\_certificate \- allow new selector <code>test\_certificates\: first</code> for <code>select\_chain</code> parameter \([https\://github\.com/ansible\-collections/community\.crypto/pull/102](https\://github\.com/ansible\-collections/community\.crypto/pull/102)\)\. +* cryptography backends \- support arbitrary dotted OIDs \([https\://github\.com/ansible\-collections/community\.crypto/issues/39](https\://github\.com/ansible\-collections/community\.crypto/issues/39)\)\. +* get\_certificate \- add support for SNI \([https\://github\.com/ansible\-collections/community\.crypto/issues/69](https\://github\.com/ansible\-collections/community\.crypto/issues/69)\)\. +* luks\_device \- add support for encryption options on container creation \([https\://github\.com/ansible\-collections/community\.crypto/pull/97](https\://github\.com/ansible\-collections/community\.crypto/pull/97)\)\. +* openssh\_cert \- add support for PKCS\#11 tokens \([https\://github\.com/ansible\-collections/community\.crypto/pull/95](https\://github\.com/ansible\-collections/community\.crypto/pull/95)\)\. +* openssl\_certificate \- the PyOpenSSL backend now uses 160 bits of randomness for serial numbers\, instead of a random number between 1000 and 99999\. Please note that this is not a high quality random number \([https\://github\.com/ansible\-collections/community\.crypto/issues/76](https\://github\.com/ansible\-collections/community\.crypto/issues/76)\)\. +* openssl\_csr \- add support for name constraints extension \([https\://github\.com/ansible\-collections/community\.crypto/issues/46](https\://github\.com/ansible\-collections/community\.crypto/issues/46)\)\. +* openssl\_csr\_info \- add support for name constraints extension \([https\://github\.com/ansible\-collections/community\.crypto/issues/46](https\://github\.com/ansible\-collections/community\.crypto/issues/46)\)\. + +<a id="bugfixes-41"></a> +### Bugfixes + +* acme\_inspect \- fix problem with Python 3\.5 that JSON was not decoded \([https\://github\.com/ansible\-collections/community\.crypto/issues/86](https\://github\.com/ansible\-collections/community\.crypto/issues/86)\)\. +* get\_certificate \- fix <code>ca\_cert</code> option handling when <code>proxy\_host</code> is used \([https\://github\.com/ansible\-collections/community\.crypto/pull/84](https\://github\.com/ansible\-collections/community\.crypto/pull/84)\)\. +* openssl\_\*\, x509\_\* modules \- fix handling of general names which refer to IP networks and not IP addresses \([https\://github\.com/ansible\-collections/community\.crypto/pull/92](https\://github\.com/ansible\-collections/community\.crypto/pull/92)\)\. + +<a id="new-modules-3"></a> +### New Modules + +* openssl\_signature \- Sign data with openssl +* openssl\_signature\_info \- Verify signatures with openssl + +<a id="v1-0-0"></a> +## v1\.0\.0 + +<a id="release-summary-55"></a> +### Release Summary + +This is the first proper release of the <code>community\.crypto</code> collection\. This changelog contains all changes to the modules in this collection that were added after the release of Ansible 2\.9\.0\. + +<a id="minor-changes-27"></a> +### Minor Changes + +* luks\_device \- accept <code>passphrase</code>\, <code>new\_passphrase</code> and <code>remove\_passphrase</code>\. +* luks\_device \- add <code>keysize</code> parameter to set key size at LUKS container creation +* luks\_device \- added support to use UUIDs\, and labels with LUKS2 containers +* luks\_device \- added the <code>type</code> option that allows user explicit define the LUKS container format version +* openssh\_keypair \- instead of regenerating some broken or password protected keys\, fail the module\. Keys can still be regenerated by calling the module with <code>force\=yes</code>\. +* openssh\_keypair \- the <code>regenerate</code> option allows to configure the module\'s behavior when it should or needs to regenerate private keys\. +* openssl\_\* modules \- the cryptography backend now properly supports <code>dirName</code>\, <code>otherName</code> and <code>RID</code> \(Registered ID\) names\. +* openssl\_certificate \- Add option for changing which ACME directory to use with acme\-tiny\. Set the default ACME directory to Let\'s Encrypt instead of using acme\-tiny\'s default\. \(acme\-tiny also uses Let\'s Encrypt at the time being\, so no action should be necessary\.\) +* openssl\_certificate \- Change the required version of acme\-tiny to \>\= 4\.0\.0 +* openssl\_certificate \- allow to provide content of some input files via the <code>csr\_content</code>\, <code>privatekey\_content</code>\, <code>ownca\_privatekey\_content</code> and <code>ownca\_content</code> options\. +* openssl\_certificate \- allow to return the existing/generated certificate directly as <code>certificate</code> by setting <code>return\_content</code> to <code>yes</code>\. +* openssl\_certificate\_info \- allow to provide certificate content via <code>content</code> option \([https\://github\.com/ansible/ansible/issues/64776](https\://github\.com/ansible/ansible/issues/64776)\)\. +* openssl\_csr \- Add support for specifying the SAN <code>otherName</code> value in the OpenSSL ASN\.1 UTF8 string format\, <code>otherName\:\<OID\>\;UTF8\:string value</code>\. +* openssl\_csr \- allow to provide private key content via <code>private\_key\_content</code> option\. +* openssl\_csr \- allow to return the existing/generated CSR directly as <code>csr</code> by setting <code>return\_content</code> to <code>yes</code>\. +* openssl\_csr\_info \- allow to provide CSR content via <code>content</code> option\. +* openssl\_dhparam \- allow to return the existing/generated DH params directly as <code>dhparams</code> by setting <code>return\_content</code> to <code>yes</code>\. +* openssl\_dhparam \- now supports a <code>cryptography</code>\-based backend\. Auto\-detection can be overwritten with the <code>select\_crypto\_backend</code> option\. +* openssl\_pkcs12 \- allow to return the existing/generated PKCS\#12 directly as <code>pkcs12</code> by setting <code>return\_content</code> to <code>yes</code>\. +* openssl\_privatekey \- add <code>format</code> and <code>format\_mismatch</code> options\. +* openssl\_privatekey \- allow to return the existing/generated private key directly as <code>privatekey</code> by setting <code>return\_content</code> to <code>yes</code>\. +* openssl\_privatekey \- the <code>regenerate</code> option allows to configure the module\'s behavior when it should or needs to regenerate private keys\. +* openssl\_privatekey\_info \- allow to provide private key content via <code>content</code> option\. +* openssl\_publickey \- allow to provide private key content via <code>private\_key\_content</code> option\. +* openssl\_publickey \- allow to return the existing/generated public key directly as <code>publickey</code> by setting <code>return\_content</code> to <code>yes</code>\. + +<a id="deprecated-features-7"></a> +### Deprecated Features + +* openssl\_csr \- all values for the <code>version</code> option except <code>1</code> are deprecated\. The value 1 denotes the current only standardized CSR version\. + +<a id="removed-features-previously-deprecated-1"></a> +### Removed Features \(previously deprecated\) + +* The <code>letsencrypt</code> module has been removed\. Use <code>acme\_certificate</code> instead\. + +<a id="bugfixes-42"></a> +### Bugfixes + +* ACME modules\: fix bug in ACME v1 account update code +* ACME modules\: make sure some connection errors are handled properly +* ACME modules\: support Buypass\' ACME v1 endpoint +* acme\_certificate \- fix crash when module is used with Python 2\.x\. +* acme\_certificate \- fix misbehavior when ACME v1 is used with <code>modify\_account</code> set to <code>false</code>\. +* ecs\_certificate \- Always specify header <code>connection\: keep\-alive</code> for ECS API connections\. +* ecs\_certificate \- Fix formatting of contents of <code>full\_chain\_path</code>\. +* get\_certificate \- Fix cryptography backend when pyopenssl is unavailable \([https\://github\.com/ansible/ansible/issues/67900](https\://github\.com/ansible/ansible/issues/67900)\) +* openssh\_keypair \- add logic to avoid breaking password protected keys\. +* openssh\_keypair \- fixes idempotence issue with public key \([https\://github\.com/ansible/ansible/issues/64969](https\://github\.com/ansible/ansible/issues/64969)\)\. +* openssh\_keypair \- public key\'s file attributes \(permissions\, owner\, group\, etc\.\) are now set to the same values as the private key\. +* openssl\_\* modules \- prevent crash on fingerprint determination in FIPS mode \([https\://github\.com/ansible/ansible/issues/67213](https\://github\.com/ansible/ansible/issues/67213)\)\. +* openssl\_certificate \- When provider is <code>entrust</code>\, use a <code>connection\: keep\-alive</code> header for ECS API connections\. +* openssl\_certificate \- <code>provider</code> option was documented as required\, but it was not checked whether it was provided\. It is now only required when <code>state</code> is <code>present</code>\. +* openssl\_certificate \- fix <code>assertonly</code> provider certificate verification\, causing \'private key mismatch\' and \'subject mismatch\' errors\. +* openssl\_certificate and openssl\_csr \- fix Ed25519 and Ed448 private key support for <code>cryptography</code> backend\. This probably needs at least cryptography 2\.8\, since older versions have problems with signing certificates or CSRs with such keys\. \([https\://github\.com/ansible/ansible/issues/59039](https\://github\.com/ansible/ansible/issues/59039)\, PR [https\://github\.com/ansible/ansible/pull/63984](https\://github\.com/ansible/ansible/pull/63984)\) +* openssl\_csr \- a warning is issued if an unsupported value for <code>version</code> is used for the <code>cryptography</code> backend\. +* openssl\_csr \- the module will now enforce that <code>privatekey\_path</code> is specified when <code>state\=present</code>\. +* openssl\_publickey \- fix a module crash caused when pyOpenSSL is not installed \([https\://github\.com/ansible/ansible/issues/67035](https\://github\.com/ansible/ansible/issues/67035)\)\. + +<a id="new-modules-4"></a> +### New Modules + +* ecs\_domain \- Request validation of a domain with the Entrust Certificate Services \(ECS\) API +* x509\_crl \- Generate Certificate Revocation Lists \(CRLs\) +* x509\_crl\_info \- Retrieve information on Certificate Revocation Lists \(CRLs\) diff --git a/ansible_collections/community/crypto/CHANGELOG.md.license b/ansible_collections/community/crypto/CHANGELOG.md.license new file mode 100644 index 000000000..edff8c768 --- /dev/null +++ b/ansible_collections/community/crypto/CHANGELOG.md.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/crypto/CHANGELOG.rst b/ansible_collections/community/crypto/CHANGELOG.rst index 940ed0c43..320169717 100644 --- a/ansible_collections/community/crypto/CHANGELOG.rst +++ b/ansible_collections/community/crypto/CHANGELOG.rst @@ -4,6 +4,191 @@ Community Crypto Release Notes .. contents:: Topics +v2.18.0 +======= + +Release Summary +--------------- + +Bugfix and feature release. + +Minor Changes +------------- + +- x509_crl - the new option ``serial_numbers`` allow to configure in which format serial numbers can be provided to ``revoked_certificates[].serial_number``. The default is as integers (``serial_numbers=integer``) for backwards compatibility; setting ``serial_numbers=hex-octets`` allows to specify colon-separated hex octet strings like ``00:11:22:FF`` (https://github.com/ansible-collections/community.crypto/issues/687, https://github.com/ansible-collections/community.crypto/pull/715). + +Deprecated Features +------------------- + +- openssl_csr_pipe, openssl_privatekey_pipe, x509_certificate_pipe - the current behavior of check mode is deprecated and will change in community.crypto 3.0.0. The current behavior is similar to the modules without ``_pipe``: if the object needs to be (re-)generated, only the ``changed`` status is set, but the object is not updated. From community.crypto 3.0.0 on, the modules will ignore check mode and always act as if check mode is not active. This behavior can already achieved now by adding ``check_mode: false`` to the task. If you think this breaks your use-case of this module, please `create an issue in the community.crypto repository <https://github.com/ansible-collections/community.crypto/issues/new/choose>`__ (https://github.com/ansible-collections/community.crypto/issues/712, https://github.com/ansible-collections/community.crypto/pull/714). + +Bugfixes +-------- + +- luks_device - fixed module a bug that prevented using ``remove_keyslot`` with the value ``0`` (https://github.com/ansible-collections/community.crypto/pull/710). +- luks_device - fixed module falsely outputting ``changed=false`` when trying to add a new slot with a key that is already present in another slot. The module now rejects adding keys that are already present in another slot (https://github.com/ansible-collections/community.crypto/pull/710). +- luks_device - fixed testing of LUKS passphrases in when specifying a keyslot for cryptsetup version 2.0.3. The output of this cryptsetup version slightly differs from later versions (https://github.com/ansible-collections/community.crypto/pull/710). + +New Plugins +----------- + +Filter +~~~~~~ + +- parse_serial - Convert a serial number as a colon-separated list of hex numbers to an integer +- to_serial - Convert an integer to a colon-separated list of hex numbers + +v2.17.1 +======= + +Release Summary +--------------- + +Bugfix release for compatibility with cryptography 42.0.0. + +Bugfixes +-------- + +- openssl_dhparam - was using an internal function instead of the public API to load DH param files when using the ``cryptography`` backend. The internal function was removed in cryptography 42.0.0. The module now uses the public API, which has been available since support for DH params was added to cryptography (https://github.com/ansible-collections/community.crypto/pull/698). +- openssl_privatekey_info - ``check_consistency=true`` no longer works for RSA keys with cryptography 42.0.0+ (https://github.com/ansible-collections/community.crypto/pull/701). +- openssl_privatekey_info - ``check_consistency=true`` now reports a warning if it cannot determine consistency (https://github.com/ansible-collections/community.crypto/pull/705). + +v2.17.0 +======= + +Release Summary +--------------- + +Feature release. + +Minor Changes +------------- + +- luks_device - add allow discards option (https://github.com/ansible-collections/community.crypto/pull/693). + +v2.16.2 +======= + +Release Summary +--------------- + +Bugfix release. + +Bugfixes +-------- + +- acme_* modules - directly react on bad return data for account creation/retrieval/updating requests (https://github.com/ansible-collections/community.crypto/pull/682). +- acme_* modules - fix improved error reporting in case of socket errors, bad status lines, and unknown connection errors (https://github.com/ansible-collections/community.crypto/pull/684). +- acme_* modules - increase number of retries from 5 to 10 to increase stability with unstable ACME endpoints (https://github.com/ansible-collections/community.crypto/pull/685). +- acme_* modules - make account registration handling more flexible to accept 404 instead of 400 send by DigiCert's ACME endpoint when an account does not exist (https://github.com/ansible-collections/community.crypto/pull/681). + +v2.16.1 +======= + +Release Summary +--------------- + +Bugfix release. + +Bugfixes +-------- + +- acme_* modules - also retry requests in case of socket errors, bad status lines, and unknown connection errors; improve error messages in these cases (https://github.com/ansible-collections/community.crypto/issues/680). + +v2.16.0 +======= + +Release Summary +--------------- + +Bugfix release. + +Minor Changes +------------- + +- luks_devices - add new options ``keyslot``, ``new_keyslot``, and ``remove_keyslot`` to allow adding/removing keys to/from specific keyslots (https://github.com/ansible-collections/community.crypto/pull/664). + +Bugfixes +-------- + +- openssl_pkcs12 - modify autodetect to not detect pyOpenSSL >= 23.3.0, which removed PKCS#12 support (https://github.com/ansible-collections/community.crypto/pull/666). + +v2.15.1 +======= + +Release Summary +--------------- + +Bugfix release. + +Bugfixes +-------- + +- acme_* modules - correctly handle error documents without ``type`` (https://github.com/ansible-collections/community.crypto/issues/651, https://github.com/ansible-collections/community.crypto/pull/652). + +v2.15.0 +======= + +Release Summary +--------------- + +Bugfix and feature release. + +Minor Changes +------------- + +- openssh_keypair - fail when comment cannot be updated (https://github.com/ansible-collections/community.crypto/pull/646). + +Deprecated Features +------------------- + +- get_certificate - the default ``false`` of the ``asn1_base64`` option is deprecated and will change to ``true`` in community.crypto 3.0.0 (https://github.com/ansible-collections/community.crypto/pull/600). + +Bugfixes +-------- + +- openssh_cert, openssh_keypair - the modules ignored return codes of ``ssh`` and ``ssh-keygen`` in some cases (https://github.com/ansible-collections/community.crypto/issues/645, https://github.com/ansible-collections/community.crypto/pull/646). +- openssh_keypair - fix comment updating for OpenSSH before 6.5 (https://github.com/ansible-collections/community.crypto/pull/646). + +New Plugins +----------- + +Filter +~~~~~~ + +- gpg_fingerprint - Retrieve a GPG fingerprint from a GPG public or private key + +Lookup +~~~~~~ + +- gpg_fingerprint - Retrieve a GPG fingerprint from a GPG public or private key file + +v2.14.1 +======= + +Release Summary +--------------- + +Bugfix and maintenance release with updated documentation. + +From this version on, community.crypto is using the new `Ansible semantic markup +<https://docs.ansible.com/ansible/devel/dev_guide/developing_modules_documenting.html#semantic-markup-within-module-documentation>`__ +in its documentation. If you look at documentation with the ansible-doc CLI tool +from ansible-core before 2.15, please note that it does not render the markup +correctly. You should be still able to read it in most cases, but you need +ansible-core 2.15 or later to see it as it is intended. Alternatively you can +look at `the devel docsite <https://docs.ansible.com/ansible/devel/collections/community/crypto/>`__ +for the rendered HTML version of the documentation of the latest release. + +Bugfixes +-------- + +- Fix PEM detection/identification to also accept random other lines before the line starting with ``-----BEGIN`` (https://github.com/ansible-collections/community.crypto/issues/627, https://github.com/ansible-collections/community.crypto/pull/628). + +Known Issues +------------ + +- Ansible markup will show up in raw form on ansible-doc text output for ansible-core before 2.15. If you have trouble deciphering the documentation markup, please upgrade to ansible-core 2.15 (or newer), or read the HTML documentation on https://docs.ansible.com/ansible/devel/collections/community/crypto/. v2.14.0 ======= @@ -254,7 +439,6 @@ This release is identical to what should have been 2.3.3, except that the version number has been bumped to 2.3.4 and this changelog entry for 2.3.4 has been added. - v2.3.3 ====== @@ -309,7 +493,7 @@ Minor Changes ------------- - Prepare collection for inclusion in an Execution Environment by declaring its dependencies. Please note that system packages are used for cryptography and PyOpenSSL, which can be rather limited. If you need features from newer cryptography versions, you will have to manually force a newer version to be installed by pip by specifying something like ``cryptography >= 37.0.0`` in your Execution Environment's Python dependencies file (https://github.com/ansible-collections/community.crypto/pull/440). -- Support automatic conversion for Internalionalized Domain Names (IDNs). When passing general names, for example Subject Altenative Names to ``community.crypto.openssl_csr``, these will automatically be converted to IDNA. Conversion will be done per label to IDNA2008 if possible, and IDNA2003 if IDNA2008 conversion fails for that label. Note that IDNA conversion requires `the Python idna library <https://pypi.org/project/idna/>`_ to be installed. Please note that depending on which versions of the cryptography library are used, it could try to process the converted IDNA another time with the Python ``idna`` library and reject IDNA2003 encoded values. Using a new enough ``cryptography`` version avoids this (https://github.com/ansible-collections/community.crypto/issues/426, https://github.com/ansible-collections/community.crypto/pull/436). +- Support automatic conversion for Internalionalized Domain Names (IDNs). When passing general names, for example Subject Alternative Names to ``community.crypto.openssl_csr``, these will automatically be converted to IDNA. Conversion will be done per label to IDNA2008 if possible, and IDNA2003 if IDNA2008 conversion fails for that label. Note that IDNA conversion requires `the Python idna library <https://pypi.org/project/idna/>`_ to be installed. Please note that depending on which versions of the cryptography library are used, it could try to process the converted IDNA another time with the Python ``idna`` library and reject IDNA2003 encoded values. Using a new enough ``cryptography`` version avoids this (https://github.com/ansible-collections/community.crypto/issues/426, https://github.com/ansible-collections/community.crypto/pull/436). - acme_* modules - add parameter ``request_timeout`` to manage HTTP(S) request timeout (https://github.com/ansible-collections/community.crypto/issues/447, https://github.com/ansible-collections/community.crypto/pull/448). - luks_devices - added ``perf_same_cpu_crypt``, ``perf_submit_from_crypt_cpus``, ``perf_no_read_workqueue``, ``perf_no_write_workqueue`` for performance tuning when opening LUKS2 containers (https://github.com/ansible-collections/community.crypto/issues/427). - luks_devices - added ``persistent`` option when opening LUKS2 containers (https://github.com/ansible-collections/community.crypto/pull/434). @@ -361,7 +545,6 @@ Regular bugfix release. In this release, we extended the test matrix to include Alpine 3, ArchLinux, Debian Bullseye, and CentOS Stream 8. CentOS 8 was removed from the test matrix. - Bugfixes -------- @@ -465,7 +648,6 @@ Release Summary A new major release of the ``community.crypto`` collection. The main changes are removal of the PyOpenSSL backends for almost all modules (``openssl_pkcs12`` being the only exception), and removal of the ``assertonly`` provider in the ``x509_certificate`` provider. There are also some other breaking changes which should improve the user interface/experience of this collection long-term. - Minor Changes ------------- @@ -648,20 +830,20 @@ Minor Changes - openssh_keypair - added ``passphrase`` parameter for encrypting/decrypting OpenSSH private keys (https://github.com/ansible-collections/community.crypto/pull/225). - openssl_csr - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). - openssl_csr_info - now returns ``public_key_type`` and ``public_key_data`` (https://github.com/ansible-collections/community.crypto/pull/233). -- openssl_csr_info - refactor module to allow code re-use for diff mode (https://github.com/ansible-collections/community.crypto/pull/204). +- openssl_csr_info - refactor module to allow code reuse for diff mode (https://github.com/ansible-collections/community.crypto/pull/204). - openssl_csr_pipe - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). - openssl_pkcs12 - added option ``select_crypto_backend`` and a ``cryptography`` backend. This requires cryptography 3.0 or newer, and does not support the ``iter_size`` and ``maciter_size`` options (https://github.com/ansible-collections/community.crypto/pull/234). - openssl_privatekey - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). -- openssl_privatekey_info - refactor module to allow code re-use for diff mode (https://github.com/ansible-collections/community.crypto/pull/205). +- openssl_privatekey_info - refactor module to allow code reuse for diff mode (https://github.com/ansible-collections/community.crypto/pull/205). - openssl_privatekey_pipe - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). - openssl_publickey - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). - x509_certificate - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). - x509_certificate_info - now returns ``public_key_type`` and ``public_key_data`` (https://github.com/ansible-collections/community.crypto/pull/233). -- x509_certificate_info - refactor module to allow code re-use for diff mode (https://github.com/ansible-collections/community.crypto/pull/206). +- x509_certificate_info - refactor module to allow code reuse for diff mode (https://github.com/ansible-collections/community.crypto/pull/206). - x509_certificate_pipe - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). - x509_crl - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). - x509_crl_info - add ``list_revoked_certificates`` option to avoid enumerating all revoked certificates (https://github.com/ansible-collections/community.crypto/pull/232). -- x509_crl_info - refactor module to allow code re-use for diff mode (https://github.com/ansible-collections/community.crypto/pull/203). +- x509_crl_info - refactor module to allow code reuse for diff mode (https://github.com/ansible-collections/community.crypto/pull/203). Bugfixes -------- @@ -784,16 +966,15 @@ Release Summary Contains new modules ``openssl_privatekey_pipe``, ``openssl_csr_pipe`` and ``x509_certificate_pipe`` which allow to create or update private keys, CSRs and X.509 certificates without having to write them to disk. - Minor Changes ------------- - openssh_cert - add module parameter ``use_agent`` to enable using signing keys stored in ssh-agent (https://github.com/ansible-collections/community.crypto/issues/116). -- openssl_csr - refactor module to allow code re-use by openssl_csr_pipe (https://github.com/ansible-collections/community.crypto/pull/123). -- openssl_privatekey - refactor module to allow code re-use by openssl_privatekey_pipe (https://github.com/ansible-collections/community.crypto/pull/119). +- openssl_csr - refactor module to allow code reuse by openssl_csr_pipe (https://github.com/ansible-collections/community.crypto/pull/123). +- openssl_privatekey - refactor module to allow code reuse by openssl_privatekey_pipe (https://github.com/ansible-collections/community.crypto/pull/119). - openssl_privatekey - the elliptic curve ``secp192r1`` now triggers a security warning. Elliptic curves of at least 224 bits should be used for new keys; see `here <https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec.html#elliptic-curves>`_ (https://github.com/ansible-collections/community.crypto/pull/132). - x509_certificate - for the ``selfsigned`` provider, a CSR is not required anymore. If no CSR is provided, the module behaves as if a minimal CSR which only contains the public key has been provided (https://github.com/ansible-collections/community.crypto/issues/32, https://github.com/ansible-collections/community.crypto/pull/129). -- x509_certificate - refactor module to allow code re-use by x509_certificate_pipe (https://github.com/ansible-collections/community.crypto/pull/135). +- x509_certificate - refactor module to allow code reuse by x509_certificate_pipe (https://github.com/ansible-collections/community.crypto/pull/135). Bugfixes -------- @@ -860,7 +1041,6 @@ Release Summary Release for Ansible 2.10.0. - Minor Changes ------------- @@ -895,7 +1075,6 @@ Release Summary This is the first proper release of the ``community.crypto`` collection. This changelog contains all changes to the modules in this collection that were added after the release of Ansible 2.9.0. - Minor Changes ------------- @@ -906,7 +1085,7 @@ Minor Changes - openssh_keypair - instead of regenerating some broken or password protected keys, fail the module. Keys can still be regenerated by calling the module with ``force=yes``. - openssh_keypair - the ``regenerate`` option allows to configure the module's behavior when it should or needs to regenerate private keys. - openssl_* modules - the cryptography backend now properly supports ``dirName``, ``otherName`` and ``RID`` (Registered ID) names. -- openssl_certificate - Add option for changing which ACME directory to use with acme-tiny. Set the default ACME directory to Let's Encrypt instead of using acme-tiny's default. (acme-tiny also uses Let's Encrypt at the time being, so no action should be neccessary.) +- openssl_certificate - Add option for changing which ACME directory to use with acme-tiny. Set the default ACME directory to Let's Encrypt instead of using acme-tiny's default. (acme-tiny also uses Let's Encrypt at the time being, so no action should be necessary.) - openssl_certificate - Change the required version of acme-tiny to >= 4.0.0 - openssl_certificate - allow to provide content of some input files via the ``csr_content``, ``privatekey_content``, ``ownca_privatekey_content`` and ``ownca_content`` options. - openssl_certificate - allow to return the existing/generated certificate directly as ``certificate`` by setting ``return_content`` to ``yes``. diff --git a/ansible_collections/community/crypto/FILES.json b/ansible_collections/community/crypto/FILES.json index 1b50debec..249caaa96 100644 --- a/ansible_collections/community/crypto/FILES.json +++ b/ansible_collections/community/crypto/FILES.json @@ -109,7 +109,7 @@ "name": ".azure-pipelines/azure-pipelines.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "691ac4e41aaa53e9b556a626fac186a38637ccb41093d0d15023fa80b550fc85", + "chksum_sha256": "82056264d02238b30cfe7740554b4dcde7ec173c7a5de5e494f2fad309462455", "format": 1 }, { @@ -130,7 +130,7 @@ "name": ".github/workflows/ansible-test.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "7b70d3a4a411debb31f68a1d6d2e22d94f871e0c48f356728aa679b003c5b04e", + "chksum_sha256": "aac90c499964bd9233fc13565169248e29e9eda7cf97a2d4db56f6fdba9558ed", "format": 1 }, { @@ -151,14 +151,21 @@ "name": ".github/workflows/ee.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "29b85993d26447dc9aba53b7a8cfbc997125595de343fe943e7a701ecd3b928a", + "chksum_sha256": "c482219d3ea4b769a0951e146c43522e5076ea629e3a2263e6cee903e27087fc", + "format": 1 + }, + { + "name": ".github/workflows/import-galaxy.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "739c36223d6e0e6ccc98907c43cba53296e7b1ccd64a2d995c2ff21df4ab25a5", "format": 1 }, { "name": ".github/workflows/reuse.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "7642b7c0999df1190506e7d73be3ea67f5e7f9bb78e809951a96b2f5418a8798", + "chksum_sha256": "907950e209820f04e0122e100c86690cf5ac0f4a15cb950cce4d2af6eaaddb37", "format": 1 }, { @@ -256,7 +263,7 @@ "name": "changelogs/changelog.yaml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "75e5ff73018cb4f36565a129cffe94719e80e7a7c0704195416962eac2d6888e", + "chksum_sha256": "e03726652f634d6ff4b51599ec42f48c6ff77aaec7d59c186770af2c599b2d3f", "format": 1 }, { @@ -270,7 +277,7 @@ "name": "changelogs/config.yaml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "35eb45f26e27a9f2830eb5cd398b976e603c12a7e302e5748b2860782f8ebe76", + "chksum_sha256": "57d7548204ea1fd0b699f4cca0181e85a556bff89d5a35e52073d6dd44010b99", "format": 1 }, { @@ -298,14 +305,14 @@ "name": "docs/docsite/rst/guide_ownca.rst", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "2da13087991e7e9c56edbc1f55a974953d40c85516135a02ec39df147d82ab4b", + "chksum_sha256": "ae96f9410adaeaf32b5121d4d7eb3f2a93beff46980ddf9412d1e130ce655f24", "format": 1 }, { "name": "docs/docsite/rst/guide_selfsigned.rst", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "ba38bd4f0c1e7e96d051be283484f97b5a317f437720f178c13990798ce5510a", + "chksum_sha256": "17f1e754f67c08a3c2f873905d3678328bdb9763128ef0f80c63f58f5b3c151e", "format": 1 }, { @@ -375,7 +382,7 @@ "name": "plugins/action/openssl_privatekey_pipe.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "b5fa69f89faba559bb4530aa3b4ae1e0ac8faa7b0cf242a3b155ca8fce52aeff", + "chksum_sha256": "be0b2baa47125aaa82d45481f659956cdc7ab556b2d28c59bfbad0088b7928f2", "format": 1 }, { @@ -389,7 +396,7 @@ "name": "plugins/doc_fragments/acme.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "db00eecb26e0877afdaa69303adeee2f8b36ba7566c5729e0bee15458c100d55", + "chksum_sha256": "72d44b4b7dc88ed9cedd76eec52a796b60da62283a14e68ad41e6adce69665f4", "format": 1 }, { @@ -410,35 +417,35 @@ "name": "plugins/doc_fragments/module_certificate.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "8dfa16820dd58a10c3480ff33bb2a80d59d49d7ff69e8bb87f0d489690a5bb05", + "chksum_sha256": "01ec54e9528e80cd51a70ee9070a79b71f5dbb0b7cac3ce1dc7dc3d7bc538e9f", "format": 1 }, { "name": "plugins/doc_fragments/module_csr.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "088ff6848934ec374afd0947e41e1ba180f1e22c306736550f8abb7348337b19", + "chksum_sha256": "ec6b6f13f943d007c7280eae9552e30ffa657e8410d142564e6353160748098b", "format": 1 }, { "name": "plugins/doc_fragments/module_privatekey.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "0228ad1f1652630271882932537c14c833eca5303f77cfd31024e6026f92b6c0", + "chksum_sha256": "f40cdec3ba65257ac99bb9ef2b885101b58d1b234076781c640e8e8cc37eee32", "format": 1 }, { "name": "plugins/doc_fragments/module_privatekey_convert.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "29872291df81d1b07f8bd474255cec6af84069dd9ba958205630e9b5e0ee6d71", + "chksum_sha256": "61d860313987e850926b343e41c645650365cb6f45b8e03f223ed73185f383bf", "format": 1 }, { "name": "plugins/doc_fragments/name_encoding.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "51f5cfce1cce8d055ae05979965dcfa4384056ad01862a1d3a24b71c0841e90b", + "chksum_sha256": "2528f3c5d69406f80d1bfa54b57f0ba73ab1d510c5c59cbf86c294f660e84717", "format": 1 }, { @@ -449,24 +456,38 @@ "format": 1 }, { + "name": "plugins/filter/gpg_fingerprint.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "dadd6641ad736f0f39f045047b7c5dc0b295d65c19a4c0c6516a34865bb472b6", + "format": 1 + }, + { "name": "plugins/filter/openssl_csr_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "1dd1bf8947cf3de522d52922c863814d88f4f4ffd16e63ad498bc188047180ea", + "chksum_sha256": "1390798cb555af429e300d9c43226924fdbcf38ae79af125dc2fa10915c32c47", "format": 1 }, { "name": "plugins/filter/openssl_privatekey_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "9b3b7098951f0349af2c48c1ab4dd3169949110dce189fa9a12397a66fcca914", + "chksum_sha256": "7c9a8599a44073ddebd701b737b68b708a86d7012c5a5f7e9cb00a3ee5239048", "format": 1 }, { "name": "plugins/filter/openssl_publickey_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "0e5a2bf5b101d83b5e6cce4b945c9cb3aec35a0a0869770de8c329a29575d733", + "chksum_sha256": "7d2dc1b5fc9b21394a71364f6edd8c16766dd7af12ff01443e7d802e3944dab1", + "format": 1 + }, + { + "name": "plugins/filter/parse_serial.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "558fd33dcdc4c140e6bc780e70c3b7ce0306d08bede307603fa29d45a32a9e05", "format": 1 }, { @@ -477,17 +498,38 @@ "format": 1 }, { + "name": "plugins/filter/to_serial.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "451c87115f86b6f66d0fb323f2e4c93635cca0945a7b83203d380b3651b26329", + "format": 1 + }, + { "name": "plugins/filter/x509_certificate_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "61cd93f0f99d5f9d8e777ceab8388ef9b5de24cdd3e30bd19b9774ce8ab7ce34", + "chksum_sha256": "64b2090e57e13fc194ecb34d2e5a0341c6ffe5842bbfc74c2368a7a93474f0fa", "format": 1 }, { "name": "plugins/filter/x509_crl_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "22d3c47a885a4d56993ed29f5b8df9fd861c61290a9b888d807c4f4bbeec4a40", + "chksum_sha256": "8a50ae2f326becba634a55a7686bc802d4010a2d280004428e391d6c441ac25e", + "format": 1 + }, + { + "name": "plugins/lookup", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "plugins/lookup/gpg_fingerprint.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "a915770a06a1bd426fdb7fc56bab37ef00e52ee49b7d2035f56c1bdad8ffc62b", "format": 1 }, { @@ -508,21 +550,21 @@ "name": "plugins/module_utils/acme/account.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "d4b0ab4bb75e8d8b36f1dbe67b3c8a19fb40741fe332d11ccef3ae0d321390fd", + "chksum_sha256": "a3a9c254face6672fe022c168a2124f5916f515b7ddd0fb9e0e352f5c65b662f", "format": 1 }, { "name": "plugins/module_utils/acme/acme.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "06671258b9f97cc7666e6598baf77d30bfc84fcc911594debae90d9322a1ef94", + "chksum_sha256": "5d7f05fdab25dcbef2a8ce8d1edcd4c27fcc53c13c735a5c74e46aabc0098724", "format": 1 }, { "name": "plugins/module_utils/acme/backend_cryptography.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "efd7551ac178d54d692a0028da9e1bf7075834f13c42230ff12b1253239c5590", + "chksum_sha256": "4b8f578400e6bd0762ba44c0784c6a8e4fc442e436243836ace40317eb936b61", "format": 1 }, { @@ -557,7 +599,7 @@ "name": "plugins/module_utils/acme/errors.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "21be07a9794843ca25183a8827414b50f9775f7808eeff24bb5b35686f12f180", + "chksum_sha256": "76c3a7b79d02728401d3bebb790511669c32b04778144054f77809b676d2be05", "format": 1 }, { @@ -676,14 +718,14 @@ "name": "plugins/module_utils/crypto/module_backends/privatekey_convert.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "5f4d6daeed1159cbd3d3b6f3d51094b3b559cf22726364bcb392627bb90f7e1f", + "chksum_sha256": "90d164b2b338e8e15533df91394b5c8b9a425ee8d13812dbf5050e7d9b2d0388", "format": 1 }, { "name": "plugins/module_utils/crypto/module_backends/privatekey_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "7bc30ee7a4aa3bc0a8b52f38b4167382adeacba91c0bb68448cf7428f05d5225", + "chksum_sha256": "3816e0d0f43e91fd18962abd629ff1b95082c3c199fd8663d8f36ebe7fe0fd79", "format": 1 }, { @@ -739,14 +781,14 @@ "name": "plugins/module_utils/crypto/cryptography_support.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "677a5f62a270179a8adab19ba2c91b894c47d90aba0a93312a13713e9f82fe1c", + "chksum_sha256": "429ae5d529c41a60c0cf15e55b745cbd9adfd569ea315adf693527ba72499451", "format": 1 }, { "name": "plugins/module_utils/crypto/math.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "6d885ed9fd96054252e527d806846b42ebbb81fa0dbbd024eced265f02e5adb6", + "chksum_sha256": "d91f76043cd78a1c9dec5d22a7775be984e5796efb78b30792042ac5a4ebbee8", "format": 1 }, { @@ -760,7 +802,7 @@ "name": "plugins/module_utils/crypto/pem.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "9ea343de8d832afccb480a30b64514d152cbf0c5bd435bc2b56ac88e8f35a2b1", + "chksum_sha256": "9045d933bdb216615500049e5773323f005b2355868f2628c9775cf88e524ae3", "format": 1 }, { @@ -785,6 +827,20 @@ "format": 1 }, { + "name": "plugins/module_utils/gnupg", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "plugins/module_utils/gnupg/cli.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "ed11290b1bb4013983273e189683847b8234de34d55d36644bb039b15c560c55", + "format": 1 + }, + { "name": "plugins/module_utils/openssh", "ftype": "dir", "chksum_type": null, @@ -802,14 +858,14 @@ "name": "plugins/module_utils/openssh/backends/common.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "ae444b21b047d77b8638a42041b70d6053b9950161d0fca7eceacff4e16e8130", + "chksum_sha256": "c93ed32364751dcc8b383361d524beb8197e07ed0dc821fdce0b3a1aab6acbcc", "format": 1 }, { "name": "plugins/module_utils/openssh/backends/keypair_backend.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "bf2830ac27e85ee6b0955a9361aa4f344576a809ef6a36f90b6a30f5736a5c8c", + "chksum_sha256": "b96ee10604b5e6e74e532fd726b346181f4de5d71c188ea8d3c22edf2bfef325", "format": 1 }, { @@ -848,6 +904,13 @@ "format": 1 }, { + "name": "plugins/module_utils/serial.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "13a8207fcd2fbaa971097fee4ee999e461038980b70e5eebe63292a8d8991207", + "format": 1 + }, + { "name": "plugins/module_utils/version.py", "ftype": "file", "chksum_type": "sha256", @@ -865,224 +928,224 @@ "name": "plugins/modules/acme_account.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "2be0d33350136b19a27ddfef23035739747b1427d55cdc6f11c3e94ba49b9535", + "chksum_sha256": "a9c3a88169fd7a7a8bfeedad92cace558ad6ec9aed11c641bd1f84a2382c9013", "format": 1 }, { "name": "plugins/modules/acme_account_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "246523550f4005e2c89a5fcc192afa2b2531f9cf028ab9ac82733c66dc47bbe0", + "chksum_sha256": "7c83dcc40c140a22ec7131f77524aef58b07556c9268f2625741fc6a2c338b6c", "format": 1 }, { "name": "plugins/modules/acme_certificate.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "b306d1dd602e77d49134a731ba03d0b1ec298255e3937cdbf53c86e4e94c7d3d", + "chksum_sha256": "c3f29dfd43f862717692b9ea8a48a186f3bf48f73cbe400ded858aa1286662ac", "format": 1 }, { "name": "plugins/modules/acme_certificate_revoke.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "4d18dcaa1b2841a58f4a1e8495394d07deb29f2343695382d81fd406af9748b5", + "chksum_sha256": "04f1b9f3dba82c5351a0ae1eae0c8360a6af3aad6e8df118d320271e3efb04c9", "format": 1 }, { "name": "plugins/modules/acme_challenge_cert_helper.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "0526e703b1544c6c9aa1bd8a5b35b7e5476134abc64ffa74635ef6b865abf303", + "chksum_sha256": "073bd164227b3dfd709e76288c1d3185474556274257e793e77f7acbd2220904", "format": 1 }, { "name": "plugins/modules/acme_inspect.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "46a7b696d23763c8d5337a2c2278453bf32685281c682fbeef6fb5fa38779e90", + "chksum_sha256": "490494d06240823440e81a5539c91c52f7359fade12e9e19aa28f8dfc5f725da", "format": 1 }, { "name": "plugins/modules/certificate_complete_chain.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "c15e21508e5c6bc6bd8e9c8849a80e202cfb82efc8ff32216ccbebc68ec327f3", + "chksum_sha256": "73b64150590db8f6495379498d4c6d147e2eacc5aa1172d39da85fdb7613d5db", "format": 1 }, { "name": "plugins/modules/crypto_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "733397087187d0f1247e076092f3b049501bf9c57a1d0a3381ab19911d93d3a2", + "chksum_sha256": "e16e926d1750537f848d54a23c6077e30c44feecff3f161d27030a369913f8ea", "format": 1 }, { "name": "plugins/modules/ecs_certificate.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "691ac56b47be423a44b0443f85024294aeb2ebe9bf5001539429560005efea50", + "chksum_sha256": "0a5264350a46f4a5e7bf97a2b4bdf4d35391c4032dc8e3011ea6cdfe1a17e292", "format": 1 }, { "name": "plugins/modules/ecs_domain.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "296ec6b955ab523fe48f4a48501344b1eb3dd7446321fa12b28d08001cbf4956", + "chksum_sha256": "45e9967c4d6da0c575b1e289633d9855a6177eadc63e9b8b4f713290a2b8e878", "format": 1 }, { "name": "plugins/modules/get_certificate.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "07a3bbe0329e3f5ac80fda788852813d3c384c98b47cbb85ef93cec27564dbe0", + "chksum_sha256": "316e351393face995abc0334f38736f3eb27bd73a9faece5206c061f37122ab0", "format": 1 }, { "name": "plugins/modules/luks_device.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "040c47f4ca02ecbb06e165ca193ee7193ea9d3f406f23b64112bd50d5abe3905", + "chksum_sha256": "356c668dcafd8704e0acd6b4eb6049f33b934a68f55cb0142786aa3c7b16f943", "format": 1 }, { "name": "plugins/modules/openssh_cert.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "ebe08a5b115f9ce7a935d9858977174d959875ec6cc3a01ca35d5689ae7f9c46", + "chksum_sha256": "8cc8472b4ecb8b0fb8b12cf015f4819f9e8a10f15d00f67339bb47d12536e86e", "format": 1 }, { "name": "plugins/modules/openssh_keypair.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "0ff1f3cadd6721dfbd049f2e4ba82fba39cefcd647f9cec7d14919562dcb6485", + "chksum_sha256": "d5d4992f1485579e57aa3ba1e3c4b9b60f74a34e7567194e42c0f44a1a2358a8", "format": 1 }, { "name": "plugins/modules/openssl_csr.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "0f9602fb35216d8cbd881f6f8081cf8a865bf1bdeec0c88099f950cbba332314", + "chksum_sha256": "769c7559b22ac9f87bc03f5e97b533fb49714c61108210c0e4622c04f41a78d4", "format": 1 }, { "name": "plugins/modules/openssl_csr_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "ab9a98810711a5d775bd97ef3afd943820fa8ca0c09c2fd8e4c9d9686891122d", + "chksum_sha256": "00fcbfab3aaf46bf792c6c32cfb038b1eddd3801315caeafbd68c75b6d7bc669", "format": 1 }, { "name": "plugins/modules/openssl_csr_pipe.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "ed304374255a30099db7d7920027ba5fb3ac47fb2358ec0ec729fc7ed36d7638", + "chksum_sha256": "721b285be1050f3e192a3c420f5b6967aeb4b1378e05b1f3fa9e9cdc859f37f1", "format": 1 }, { "name": "plugins/modules/openssl_dhparam.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "2c9a0b0dbce23f05873ecb65e82d57208fe91480200ba19cdfc4ad67344df15b", + "chksum_sha256": "453b0f7127d1150a7c71a2e90a1591b72b23745b3ef444b3637f624e203e2b3b", "format": 1 }, { "name": "plugins/modules/openssl_pkcs12.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "fa4234411070092e3d6244edceb1406d8877a138c4e7e1480541625f107b9123", + "chksum_sha256": "47c238db11cc03870bffb1228d077cb7d20a3e6a0924fe03d0bc85ae2216df38", "format": 1 }, { "name": "plugins/modules/openssl_privatekey.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "a3e09f1db6db28aefd0dbf436af986adb3c2c7eb71157ed9012b06fcda659e2e", + "chksum_sha256": "c2e9a6df5a0507033082222b78974fbcf236eae6a0d5273c0a2206b9fff11966", "format": 1 }, { "name": "plugins/modules/openssl_privatekey_convert.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "c772ee82bbce0a2c4dfc0dfa4ed72ff99763da84ed6391f5ce2abe6a3af63565", + "chksum_sha256": "53037b0e67d81bca25685497ad8db0232d3ab862348a5b48202d7636fa0e346c", "format": 1 }, { "name": "plugins/modules/openssl_privatekey_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "0fe21ba6d3e5966bc4335058549bb67632222c9989b1355808404b38e27bc8e4", + "chksum_sha256": "4ae078612cf041b77ca1b0dc485bf5a27ff8971ed621bbba5bfec0fb0bb8b199", "format": 1 }, { "name": "plugins/modules/openssl_privatekey_pipe.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "dd514e1366f8cf11702a1124c683575c43a54626542069a8a23e8d004da763b4", + "chksum_sha256": "ccdb7c9a06d31dacb643d0adc8fc056294e0d16399dcc20902abf4b90128f9ed", "format": 1 }, { "name": "plugins/modules/openssl_publickey.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "d656ff71493152010c203a46b0f36c6fca9312e2c3b412ea3b9ec39d4fb95a90", + "chksum_sha256": "42d317be6985e6ccc85e240a08b5361aa04b3f281891742e1bc1b6bb76fa142b", "format": 1 }, { "name": "plugins/modules/openssl_publickey_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "e999f1e2cbb54f099c6733d66f74bbc405731b5bc6dd311be13a53c3cc7f3aeb", + "chksum_sha256": "3b4dc7c1afb0e78901127a1153b54c1a51b4e0268b4564d40cb91a8015fabff3", "format": 1 }, { "name": "plugins/modules/openssl_signature.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "30f457dcd3be6efbf405d842f244d0627397f71001106b48812d4c6bf0b75d7a", + "chksum_sha256": "cd4e3f1ba8f7b9bd94545cba395fe1aac3ac734d158c1065d04aa16cf64766b3", "format": 1 }, { "name": "plugins/modules/openssl_signature_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "bd092d8e5bebe70c888eee8091ed83d2821debffcf69452d20d4c37d261f3742", + "chksum_sha256": "5ab6f1b3a1ab362eb47cd4ef526f23ecf1299d670edc7dd27eb087cacd58c4b4", "format": 1 }, { "name": "plugins/modules/x509_certificate.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "9201740cdaa97912c7a488b93a8bf25b65a355c0275b0d41a55e99e6208b15b4", + "chksum_sha256": "66bb9cda2e07f4bd196b0f309a8ed705668e627ea0d3f9137cf29be408ad73b3", "format": 1 }, { "name": "plugins/modules/x509_certificate_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "32efd98d7efbac173a75af7f8bf2b3cf0ab65db22dc1f409e29d969e20429174", + "chksum_sha256": "9cdcd6e9d4d11182ff9bf203c1432b0d96d74f31548f8eb34ae5b7beb48d57fc", "format": 1 }, { "name": "plugins/modules/x509_certificate_pipe.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "c022742c244d4cf25451b6021ae656ed76300d815a160d3148bf644f7c8a7e03", + "chksum_sha256": "224f31e4b5fb1596015793c79a5897fceb8788c64875f9f876bb17b2436e52d9", "format": 1 }, { "name": "plugins/modules/x509_crl.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "0818a26da959f7d29da9334e7d0a413b5c10a26f5468889e7c28b85dabe11847", + "chksum_sha256": "bc95c541cd09e5d61f437b7c701e3c3370821618a271f98d4746de8480e9084f", "format": 1 }, { "name": "plugins/modules/x509_crl_info.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "35b6cf60c8e00ab3e5fc8e49f9c060729d340664610237c0d1ede057a7adf722", + "chksum_sha256": "137f76b43493e79acf2635de56b2a651ad7c2e96bcd363224f4303ae15db86bd", "format": 1 }, { @@ -1107,6 +1170,13 @@ "format": 1 }, { + "name": "plugins/plugin_utils/gnupg.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "c60a75840c1903795bba88c0864902dde73d300c1640cfc8fb02f44b2ba75612", + "format": 1 + }, + { "name": "tests", "ftype": "dir", "chksum_type": null, @@ -1621,7 +1691,7 @@ "name": "tests/integration/targets/acme_challenge_cert_helper/tasks/main.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "544305bba02e4b01eb3952a852af5b775e733ab585b299f0dcf942d5bb9d8891", + "chksum_sha256": "6387c7e55c9bc0981a68bcd19c53ecca7aead9b291bafa97e17096932d379253", "format": 1 }, { @@ -2073,6 +2143,48 @@ "format": 1 }, { + "name": "tests/integration/targets/filter_gpg_fingerprint", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/filter_gpg_fingerprint/meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/filter_gpg_fingerprint/meta/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e338f97b9e492736b5369c3462dce7c2242ad0e93d07898ee9e827828797dd54", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_gpg_fingerprint/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/filter_gpg_fingerprint/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "5d7829d7a4f2ec7d073111605075dd2d737b669be5f2f736a4929b5879cb39c1", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_gpg_fingerprint/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e28d467b791779a59439ace7e1092ec06529f0795d4a1b73da989f1687104b21", + "format": 1 + }, + { "name": "tests/integration/targets/filter_openssl_csr_info", "ftype": "dir", "chksum_type": null, @@ -2220,6 +2332,34 @@ "format": 1 }, { + "name": "tests/integration/targets/filter_parse_serial", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/filter_parse_serial/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/filter_parse_serial/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "585cf43b15121d3b3d9f7d189e80addc04fe112548f0e2d9d079a5959de9d0a0", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_parse_serial/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "96646c5ab7118c53b8b722f6abe91a7ed4d3eed9be401faefb399d6a8f427c2e", + "format": 1 + }, + { "name": "tests/integration/targets/filter_split_pem", "ftype": "dir", "chksum_type": null, @@ -2248,6 +2388,34 @@ "format": 1 }, { + "name": "tests/integration/targets/filter_to_serial", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/filter_to_serial/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/filter_to_serial/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "27f3a4af4e8233491f1a0927dd5919390789a4aadfffad46f1b71fea74bda6dd", + "format": 1 + }, + { + "name": "tests/integration/targets/filter_to_serial/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "96646c5ab7118c53b8b722f6abe91a7ed4d3eed9be401faefb399d6a8f427c2e", + "format": 1 + }, + { "name": "tests/integration/targets/filter_x509_certificate_info", "ftype": "dir", "chksum_type": null, @@ -2405,7 +2573,7 @@ "name": "tests/integration/targets/get_certificate/tests/validate.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "87594c273be2a7444848e55d5f08e149c8d2bc4792c7a66cc0cfdc3ffa064e16", + "chksum_sha256": "7065d5cda19e9ad371c572e42b22a0d70582639cad716654bf29e4661f232bdb", "format": 1 }, { @@ -2416,6 +2584,48 @@ "format": 1 }, { + "name": "tests/integration/targets/lookup_gpg_fingerprint", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_gpg_fingerprint/meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_gpg_fingerprint/meta/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e338f97b9e492736b5369c3462dce7c2242ad0e93d07898ee9e827828797dd54", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_gpg_fingerprint/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_gpg_fingerprint/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "483add1f93729e1e6dbeb7f015ed2c9ce5e186813d9b4686acc84a98b1c32eb8", + "format": 1 + }, + { + "name": "tests/integration/targets/lookup_gpg_fingerprint/aliases", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e28d467b791779a59439ace7e1092ec06529f0795d4a1b73da989f1687104b21", + "format": 1 + }, + { "name": "tests/integration/targets/luks_device", "ftype": "dir", "chksum_type": null, @@ -2507,6 +2717,27 @@ "format": 1 }, { + "name": "tests/integration/targets/luks_device/tasks/tests/keyslot-create-destroy.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "59ef20cc568328ed71a73daf8b38c59c9d37f233850674819d7fd0657962824f", + "format": 1 + }, + { + "name": "tests/integration/targets/luks_device/tasks/tests/keyslot-duplicate.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "3435782c79d1ab4b5002ffc5f846abbd6e6a628cff8d9ebd79dedd53321c23c4", + "format": 1 + }, + { + "name": "tests/integration/targets/luks_device/tasks/tests/keyslot-options.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6c4d2d0b33210d75a355492517f3d6f4a9501f1337d8b56143021c73cafc979f", + "format": 1 + }, + { "name": "tests/integration/targets/luks_device/tasks/tests/options.yml", "ftype": "file", "chksum_type": "sha256", @@ -2524,7 +2755,7 @@ "name": "tests/integration/targets/luks_device/tasks/tests/performance.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "b007aca0d0d7846e2f78881837c321820bc8d097da767eb23a49cea4e0d86f4f", + "chksum_sha256": "d7ecb974bf2dcaa4516fd6069fdbbd30f00f46e167c8286bbfaf0d8d068efe6e", "format": 1 }, { @@ -2552,7 +2783,7 @@ "name": "tests/integration/targets/luks_device/vars/Alpine.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "ce279a0328bf225612cf60d52eb0dc0b6efa92cf3e2bd63b0cb528729ad4f997", + "chksum_sha256": "aa7f5162096c065c2e05fb0d93f72e04c3dbdc1502b321eae3cc6b3529bb5fbe", "format": 1 }, { @@ -2615,7 +2846,7 @@ "name": "tests/integration/targets/openssh_cert/tests/idempotency.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "91b187a19efb2b8b947b5952ae19c0ffc3a1aa92f9e46e5fa89bd01ec457fd76", + "chksum_sha256": "83f71ae5911064351ed1f97ed7b715f6717401545ca7ec387f7ed83b8e37617f", "format": 1 }, { @@ -2713,7 +2944,7 @@ "name": "tests/integration/targets/openssh_keypair/tests/cryptography_backend.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "3a394c9e1e941a9618efdbe5059f2b7899192c1099e8654873f41c3912b063c1", + "chksum_sha256": "9bd01b5a28bbeff9fb6badf9006c3e18515d44a9e248a8cc1747377939dd3dbb", "format": 1 }, { @@ -2727,14 +2958,14 @@ "name": "tests/integration/targets/openssh_keypair/tests/options.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "032dff93f47779f1c50c7b0570cb7b900eacf9f9b26197fd71c248b7ff8cf769", + "chksum_sha256": "d9c5bd87af8a49eae1dde8e5b8370bd47ecce72aecaecdda5c4d664dbe620855", "format": 1 }, { "name": "tests/integration/targets/openssh_keypair/tests/regenerate.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "6d8981862fb6b79ac8d4001629a59e4e10098b6b8478d4368d1c2cf167eb2d86", + "chksum_sha256": "55471f24cda0074ddccaaf1f9db8fe5eacbbd66b5e5887cbb35c2950b4952127", "format": 1 }, { @@ -3028,7 +3259,7 @@ "name": "tests/integration/targets/openssl_pkcs12/tasks/main.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "6fec81beb0862bed86a0eaabf9438438f201f0049c93b3a216dae9a359aef073", + "chksum_sha256": "7ac93b621d179ab77bf68b989018e07729545515e8febbac49d653d400be8b87", "format": 1 }, { @@ -3105,7 +3336,7 @@ "name": "tests/integration/targets/openssl_privatekey/tests/validate.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "5a7c406b6e524b94b182bd5954cd1b5c259a92491beb740216de7db34d955614", + "chksum_sha256": "b315a5e9496428293ed207368010f3fc25be01fa50442401cf85ea029772589d", "format": 1 }, { @@ -3329,7 +3560,7 @@ "name": "tests/integration/targets/openssl_publickey/tests/validate.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "e0ed98881fe8a218db8e9f24f3c0b32ac85b59a1cff84212a18d96cf8e499c75", + "chksum_sha256": "ef4df69c9e95f323b8dbf209e61e968237b75dd1d2934ef14b1a502143ab512a", "format": 1 }, { @@ -3522,10 +3753,17 @@ "format": 1 }, { + "name": "tests/integration/targets/prepare_jinja2_compat/filter_plugins/ansible_compatibility.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "86994c6072fb9111abea280a48690aba324d60ab2640676f83b1f0c8148076b0", + "format": 1 + }, + { "name": "tests/integration/targets/prepare_jinja2_compat/filter_plugins/jinja_compatibility.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "30fcb05d83e11b370c30e2e84d8fd9f3661369200ade7dd02df9c002a2309a23", + "chksum_sha256": "48994f065f9887094a301feff969996dabf7769d05404d79591a4f18d7394295", "format": 1 }, { @@ -3655,6 +3893,83 @@ "format": 1 }, { + "name": "tests/integration/targets/setup_gnupg", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/setup_gnupg/meta", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/setup_gnupg/meta/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "e11ca6edae518cc531ab425daa9eb93f78f89b9ddd515deabd239e8c7925323d", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_gnupg/tasks", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/setup_gnupg/tasks/main.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "daa9649eed21befb6174ab36e613568cc2641d7c48520093263f99ba11002a30", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_gnupg/vars", + "ftype": "dir", + "chksum_type": null, + "chksum_sha256": null, + "format": 1 + }, + { + "name": "tests/integration/targets/setup_gnupg/vars/Alpine.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "89420396444257a72a6dd183efce163ed601703b327287dbd2208e1140a38d5f", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_gnupg/vars/CentOS-6.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "17c1b35607bab5e2c9bc4a95c9712148b9773e0f9428c65f5faa7e59182d97df", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_gnupg/vars/Darwin.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "503c6a541bd64e1996b427d9344653a611d1c789d7dac063523d6b8bacf77e87", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_gnupg/vars/RedHat.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "9cc668ae5828d118b63873ea4dd42f0053006cd31e6e4ef495c55f35fcaa066d", + "format": 1 + }, + { + "name": "tests/integration/targets/setup_gnupg/vars/default.yml", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "bc3f1d38f5f88d2cf8f06e67383e4f884dcedfd2ff2d7265b7ec420e58aa949b", + "format": 1 + }, + { "name": "tests/integration/targets/setup_openssl", "ftype": "dir", "chksum_type": null, @@ -3917,7 +4232,7 @@ "name": "tests/integration/targets/setup_python_info/vars/main.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "a2ac53510da02da97af29c837c144f05d9a6f3b5863156917fc704d9f6d3434a", + "chksum_sha256": "00299748a38e036412bdf638f2d8093cc2c555fb50fffd8ed119dee7cee52397", "format": 1 }, { @@ -4246,14 +4561,14 @@ "name": "tests/integration/targets/x509_certificate/tests/validate_ownca.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "9c45d8284903fb862aa9cbb242bdddb6173cc4ed7b03ca55e0241793dfd63b54", + "chksum_sha256": "af825159e41199c2d1f1db026d1440dd6b84b14e6b684de12b76971812d10ec5", "format": 1 }, { "name": "tests/integration/targets/x509_certificate/tests/validate_selfsigned.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "749ff8a1ce325c0c9b406ec5cc58b21e4c1e66cb1d26c950a88b90140aa11c47", + "chksum_sha256": "fea7c0daa838f7449053a70b563857991d919c281980ca1d4323123b4ae39862", "format": 1 }, { @@ -4407,7 +4722,7 @@ "name": "tests/integration/targets/x509_crl/tasks/impl.yml", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "3a4100f786b8a06953a0fc3c8d7344670a9da7ba7aaeda0e7d65903966f2697c", + "chksum_sha256": "45382b300e70987a5dab1cd4fe3a9339d86655cb2c8e74b3c5a6623692ecdfab", "format": 1 }, { @@ -4477,7 +4792,7 @@ "name": "tests/sanity/extra/extra-docs.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "0fbd87476e9c35e4c5feb31be4aa1e8fc6aebf0de13058e5a267879f741ec0bf", + "chksum_sha256": "c52e316daf1292bbb063be19429fd1f06e02bce3c9d4622a8dfc61fa3af06688", "format": 1 }, { @@ -4533,7 +4848,7 @@ "name": "tests/sanity/ignore-2.10.txt", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "e90b8ed0470d877e85848af2108f06b47aef9c8a7e25cae6762ccb8a32ae2214", + "chksum_sha256": "9c564907d4db67b2eab6b7387740cbf6146bb2f236db4eac52fc320fa2e0eefb", "format": 1 }, { @@ -4547,7 +4862,7 @@ "name": "tests/sanity/ignore-2.11.txt", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "e90b8ed0470d877e85848af2108f06b47aef9c8a7e25cae6762ccb8a32ae2214", + "chksum_sha256": "1b44914e1e87736a09ebfdabf48dae543323720b6864fb9064052e874d96847d", "format": 1 }, { @@ -4561,7 +4876,7 @@ "name": "tests/sanity/ignore-2.12.txt", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "9bdf1ce59dadc7d5e17b1d3b114fe08cebb91648ce3ec46d5c2b69c4d965ce69", + "chksum_sha256": "a4c87a60391639fdf51e7be2088785d7d1950580d27cbc348d45c2bad0887a4a", "format": 1 }, { @@ -4575,7 +4890,7 @@ "name": "tests/sanity/ignore-2.13.txt", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "7e2345994ac361630efde6d1dcb5657a36a0376d7489731c6fe9d584289402cc", + "chksum_sha256": "38df4b447aa4f0fa4b168df195dff78362f955ed3c4117266c320045be6d00a7", "format": 1 }, { @@ -4589,7 +4904,7 @@ "name": "tests/sanity/ignore-2.14.txt", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "7e2345994ac361630efde6d1dcb5657a36a0376d7489731c6fe9d584289402cc", + "chksum_sha256": "38df4b447aa4f0fa4b168df195dff78362f955ed3c4117266c320045be6d00a7", "format": 1 }, { @@ -4617,7 +4932,7 @@ "name": "tests/sanity/ignore-2.16.txt", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "7e2345994ac361630efde6d1dcb5657a36a0376d7489731c6fe9d584289402cc", + "chksum_sha256": "88f167104e425a472b8fd111b8b2e9d7b2e1135ace2d5130cef81ca38aeba161", "format": 1 }, { @@ -4628,10 +4943,24 @@ "format": 1 }, { + "name": "tests/sanity/ignore-2.17.txt", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "88f167104e425a472b8fd111b8b2e9d7b2e1135ace2d5130cef81ca38aeba161", + "format": 1 + }, + { + "name": "tests/sanity/ignore-2.17.txt.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { "name": "tests/sanity/ignore-2.9.txt", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "79b8db85358ed8f96c4cb0159e502a560e52635341a8cc9ee906d46503f8b37d", + "chksum_sha256": "dad1b754c46149195a1a26af8e56bb1aa449d4acec41532bfaf45a8254b11050", "format": 1 }, { @@ -4901,6 +5230,13 @@ "format": 1 }, { + "name": "tests/unit/plugins/module_utils/crypto/test_pem.py", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "1f9c39460cfcf7f8c993d2465f4fec1c8690c58413b456aba9d59e91cc043108", + "format": 1 + }, + { "name": "tests/unit/plugins/module_utils/openssh", "ftype": "dir", "chksum_type": null, @@ -4939,7 +5275,7 @@ "name": "tests/unit/plugins/modules/test_luks_device.py", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "359d84e2d64b7c73b30248eded2104aa5121344533354ff453ae506bc4c609ce", + "chksum_sha256": "ab827f30acfcd6a3d7a753889fc8a32a4d007359753c0b5549ccb12d515c4dab", "format": 1 }, { @@ -5058,7 +5394,7 @@ "name": "tests/utils/shippable/shippable.sh", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "471b1d343b88039ef089ab494312320d6cdd94fb7b2492b5eee340154ab20027", + "chksum_sha256": "999e81cec05b7670654928f1b638667dfd2124fcd33ad97b55d7729782803a0b", "format": 1 }, { @@ -5090,10 +5426,24 @@ "format": 1 }, { + "name": "CHANGELOG.md", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "5430eaa014f0f010ed69848fea7d36d8dbb9fe9a8d7612887dd52c73389dfef1", + "format": 1 + }, + { + "name": "CHANGELOG.md.license", + "ftype": "file", + "chksum_type": "sha256", + "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1", + "format": 1 + }, + { "name": "CHANGELOG.rst", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "ab26b4a0179855ed65910b80d42b79ba234d9b44a3a5ad445100fac7c9454dae", + "chksum_sha256": "124c1a02abb35f4b3e98c6449bd07d7a606a80e34f297b60be1ed43673955bba", "format": 1 }, { @@ -5114,7 +5464,7 @@ "name": "README.md", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "31f412268cabb2a6b8f80cbce3b2e30acf973905af3c672155a1b4b6cfef1b0e", + "chksum_sha256": "dd847490669a8106ad134aa8c1d21e9620891badee9173763ca0643187e7e735", "format": 1 } ], diff --git a/ansible_collections/community/crypto/MANIFEST.json b/ansible_collections/community/crypto/MANIFEST.json index cd7e04ed8..2e16020a1 100644 --- a/ansible_collections/community/crypto/MANIFEST.json +++ b/ansible_collections/community/crypto/MANIFEST.json @@ -2,7 +2,7 @@ "collection_info": { "namespace": "community", "name": "crypto", - "version": "2.14.0", + "version": "2.18.0", "authors": [ "Ansible (github.com/ansible)" ], @@ -41,7 +41,7 @@ "name": "FILES.json", "ftype": "file", "chksum_type": "sha256", - "chksum_sha256": "b1f04aa94c0ac2a75ae7c56654a6e2bfb418a3660a310d3468f119d988ed04f9", + "chksum_sha256": "fc4c33abc854162fe45421f98db891d66b0d614f3c5ddfcb8d14f308db7e9df2", "format": 1 }, "format": 1 diff --git a/ansible_collections/community/crypto/README.md b/ansible_collections/community/crypto/README.md index d0ae6489f..64ffd4eae 100644 --- a/ansible_collections/community/crypto/README.md +++ b/ansible_collections/community/crypto/README.md @@ -18,7 +18,7 @@ Please note that this collection does **not** support Windows targets. ## Tested with Ansible -Tested with the current Ansible 2.9, ansible-base 2.10, ansible-core 2.11, ansible-core 2.12, ansible-core 2.13, and ansible-core 2.14 releases and the current development version of ansible-core. Ansible versions before 2.9.10 are not supported. +Tested with the current Ansible 2.9, ansible-base 2.10, ansible-core 2.11, ansible-core 2.12, ansible-core 2.13, ansible-core 2.14, ansible-core 2.15, and ansible-core-2.16 releases and the current development version of ansible-core. Ansible versions before 2.9.10 are not supported. ## External requirements @@ -38,39 +38,49 @@ If you use the Ansible package and do not update collections independently, use ## Included content -- OpenSSL / PKI modules: - - openssl_csr_info - - openssl_csr - - openssl_dhparam - - openssl_pkcs12 - - openssl_privatekey_info - - openssl_privatekey - - openssl_publickey - - openssl_signature_info - - openssl_signature - - x509_certificate_info - - x509_certificate - - x509_crl_info - - x509_crl - - certificate_complete_chain -- OpenSSH modules: - - openssh_cert - - openssh_keypair -- ACME modules: - - acme_account_info - - acme_account - - acme_certificate - - acme_certificate_revoke - - acme_challenge_cert_helper - - acme_inspect -- ECS modules: - - ecs_certificate - - ecs_domain -- Miscellaneous modules: - - get_certificate - - luks_device - -You can also find a list of all modules with documentation on the [Ansible docs site](https://docs.ansible.com/ansible/latest/collections/community/crypto/). +- OpenSSL / PKI modules and plugins: + - certificate_complete_chain module + - openssl_csr_info module and filter + - openssl_csr_pipe module + - openssl_csr module + - openssl_dhparam module + - openssl_pkcs12 module + - openssl_privatekey_convert module + - openssl_privatekey_info module and filter + - openssl_privatekey_pipe module + - openssl_privatekey module + - openssl_publickey_info module and filter + - openssl_publickey module + - openssl_signature_info module + - openssl_signature module + - split_pem filter + - x509_certificate_info module and filter + - x509_certificate_pipe module + - x509_certificate module + - x509_crl_info module and filter + - x509_crl module +- OpenSSH modules and plugins: + - openssh_cert module + - openssh_keypair module +- ACME modules and plugins: + - acme_account_info module + - acme_account module + - acme_certificate module + - acme_certificate_revoke module + - acme_challenge_cert_helper module + - acme_inspect module +- ECS modules and plugins: + - ecs_certificate module + - ecs_domain module +- GnuPG modules and plugins: + - gpg_fingerprint lookup and filter +- Miscellaneous modules and plugins: + - crypto_info module + - get_certificate module + - luks_device module + - parse_serial and to_serial filters + +You can also find a list of all modules and plugins with documentation on the [Ansible docs site](https://docs.ansible.com/ansible/latest/collections/community/crypto/), or the [latest commit collection documentation](https://ansible-collections.github.io/community.crypto/branch/main/). ## Using this collection @@ -102,7 +112,7 @@ See [Ansible's dev guide](https://docs.ansible.com/ansible/devel/dev_guide/devel ## Release notes -See the [changelog](https://github.com/ansible-collections/community.crypto/blob/main/CHANGELOG.rst). +See the [changelog](https://github.com/ansible-collections/community.crypto/blob/main/CHANGELOG.md). ## Roadmap @@ -129,6 +139,6 @@ This collection is primarily licensed and distributed as a whole under the GNU G See [LICENSES/GPL-3.0-or-later.txt](https://github.com/ansible-collections/community.crypto/blob/main/COPYING) for the full text. -Parts of the collection are licensed under the [Apache 2.0 license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/Apache-2.0.txt) (`plugins/module_utils/crypto/_obj2txt.py` and `plugins/module_utils/crypto/_objects_data.py`), the [BSD 2-Clause license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/BSD-2-Clause.txt) (`plugins/module_utils/ecs/api.py`), the [BSD 3-Clause license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/BSD-3-Clause.txt) (`plugins/module_utils/crypto/_obj2txt.py`), and the [PSF 2.0 license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/PSF-2.0.txt) (`plugins/module_utils/_version.py`). This only applies to vendored files in ``plugins/module_utils/`` and to the ECS module utils. +Parts of the collection are licensed under the [Apache 2.0 license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/Apache-2.0.txt) (`plugins/module_utils/crypto/_obj2txt.py` and `plugins/module_utils/crypto/_objects_data.py`), the [BSD 2-Clause license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/BSD-2-Clause.txt) (`plugins/module_utils/ecs/api.py`), the [BSD 3-Clause license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/BSD-3-Clause.txt) (`plugins/module_utils/crypto/_obj2txt.py`, `tests/integration/targets/prepare_jinja2_compat/filter_plugins/jinja_compatibility.py`), and the [PSF 2.0 license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/PSF-2.0.txt) (`plugins/module_utils/_version.py`). This only applies to vendored files in ``plugins/module_utils/`` and to the ECS module utils. Almost all files have a machine readable `SDPX-License-Identifier:` comment denoting its respective license(s) or an equivalent entry in an accompanying `.license` file. Only changelog fragments (which will not be part of a release) are covered by a blanket statement in `.reuse/dep5`. Right now a few vendored PEM files do not have licensing information as well. This conforms to the [REUSE specification](https://reuse.software/spec/) up to the aforementioned PEM files. diff --git a/ansible_collections/community/crypto/changelogs/changelog.yaml b/ansible_collections/community/crypto/changelogs/changelog.yaml index ca735b395..044bd81a8 100644 --- a/ansible_collections/community/crypto/changelogs/changelog.yaml +++ b/ansible_collections/community/crypto/changelogs/changelog.yaml @@ -56,7 +56,7 @@ releases: - openssl_certificate - Add option for changing which ACME directory to use with acme-tiny. Set the default ACME directory to Let's Encrypt instead of using acme-tiny's default. (acme-tiny also uses Let's Encrypt at the time - being, so no action should be neccessary.) + being, so no action should be necessary.) - openssl_certificate - Change the required version of acme-tiny to >= 4.0.0 - openssl_certificate - allow to provide content of some input files via the ``csr_content``, ``privatekey_content``, ``ownca_privatekey_content`` and @@ -247,8 +247,8 @@ releases: minor_changes: - openssh_cert - add module parameter ``use_agent`` to enable using signing keys stored in ssh-agent (https://github.com/ansible-collections/community.crypto/issues/116). - - openssl_csr - refactor module to allow code re-use by openssl_csr_pipe (https://github.com/ansible-collections/community.crypto/pull/123). - - openssl_privatekey - refactor module to allow code re-use by openssl_privatekey_pipe + - openssl_csr - refactor module to allow code reuse by openssl_csr_pipe (https://github.com/ansible-collections/community.crypto/pull/123). + - openssl_privatekey - refactor module to allow code reuse by openssl_privatekey_pipe (https://github.com/ansible-collections/community.crypto/pull/119). - openssl_privatekey - the elliptic curve ``secp192r1`` now triggers a security warning. Elliptic curves of at least 224 bits should be used for new keys; @@ -258,7 +258,7 @@ releases: anymore. If no CSR is provided, the module behaves as if a minimal CSR which only contains the public key has been provided (https://github.com/ansible-collections/community.crypto/issues/32, https://github.com/ansible-collections/community.crypto/pull/129). - - x509_certificate - refactor module to allow code re-use by x509_certificate_pipe + - x509_certificate - refactor module to allow code reuse by x509_certificate_pipe (https://github.com/ansible-collections/community.crypto/pull/135). release_summary: 'Contains new modules ``openssl_privatekey_pipe``, ``openssl_csr_pipe`` and ``x509_certificate_pipe`` which allow to create or update private keys, @@ -419,7 +419,7 @@ releases: https://github.com/ansible-collections/community.crypto/pull/150). - openssl_csr_info - now returns ``public_key_type`` and ``public_key_data`` (https://github.com/ansible-collections/community.crypto/pull/233). - - openssl_csr_info - refactor module to allow code re-use for diff mode (https://github.com/ansible-collections/community.crypto/pull/204). + - openssl_csr_info - refactor module to allow code reuse for diff mode (https://github.com/ansible-collections/community.crypto/pull/204). - openssl_csr_pipe - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). - openssl_pkcs12 - added option ``select_crypto_backend`` and a ``cryptography`` @@ -427,7 +427,7 @@ releases: ``iter_size`` and ``maciter_size`` options (https://github.com/ansible-collections/community.crypto/pull/234). - openssl_privatekey - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). - - openssl_privatekey_info - refactor module to allow code re-use for diff mode + - openssl_privatekey_info - refactor module to allow code reuse for diff mode (https://github.com/ansible-collections/community.crypto/pull/205). - openssl_privatekey_pipe - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). @@ -437,7 +437,7 @@ releases: https://github.com/ansible-collections/community.crypto/pull/150). - x509_certificate_info - now returns ``public_key_type`` and ``public_key_data`` (https://github.com/ansible-collections/community.crypto/pull/233). - - x509_certificate_info - refactor module to allow code re-use for diff mode + - x509_certificate_info - refactor module to allow code reuse for diff mode (https://github.com/ansible-collections/community.crypto/pull/206). - x509_certificate_pipe - add diff mode (https://github.com/ansible-collections/community.crypto/issues/38, https://github.com/ansible-collections/community.crypto/pull/150). @@ -445,7 +445,7 @@ releases: https://github.com/ansible-collections/community.crypto/pull/150). - x509_crl_info - add ``list_revoked_certificates`` option to avoid enumerating all revoked certificates (https://github.com/ansible-collections/community.crypto/pull/232). - - x509_crl_info - refactor module to allow code re-use for diff mode (https://github.com/ansible-collections/community.crypto/pull/203). + - x509_crl_info - refactor module to allow code reuse for diff mode (https://github.com/ansible-collections/community.crypto/pull/203). release_summary: Regular feature and bugfix release. fragments: - 1.7.0.yml @@ -858,6 +858,200 @@ releases: - 617-acme_certificate-parallel.yml - 622-der-format-support.yml release_date: '2023-06-15' + 2.14.1: + changes: + bugfixes: + - Fix PEM detection/identification to also accept random other lines before + the line starting with ``-----BEGIN`` (https://github.com/ansible-collections/community.crypto/issues/627, + https://github.com/ansible-collections/community.crypto/pull/628). + known_issues: + - Ansible markup will show up in raw form on ansible-doc text output for ansible-core + before 2.15. If you have trouble deciphering the documentation markup, please + upgrade to ansible-core 2.15 (or newer), or read the HTML documentation on + https://docs.ansible.com/ansible/devel/collections/community/crypto/. + release_summary: 'Bugfix and maintenance release with updated documentation. + + + From this version on, community.crypto is using the new `Ansible semantic + markup + + <https://docs.ansible.com/ansible/devel/dev_guide/developing_modules_documenting.html#semantic-markup-within-module-documentation>`__ + + in its documentation. If you look at documentation with the ansible-doc CLI + tool + + from ansible-core before 2.15, please note that it does not render the markup + + correctly. You should be still able to read it in most cases, but you need + + ansible-core 2.15 or later to see it as it is intended. Alternatively you + can + + look at `the devel docsite <https://docs.ansible.com/ansible/devel/collections/community/crypto/>`__ + + for the rendered HTML version of the documentation of the latest release. + + ' + fragments: + - 2.14.1.yml + - 628-pem-detection.yml + - semantic-markup.yml + release_date: '2023-06-27' + 2.15.0: + changes: + bugfixes: + - openssh_cert, openssh_keypair - the modules ignored return codes of ``ssh`` + and ``ssh-keygen`` in some cases (https://github.com/ansible-collections/community.crypto/issues/645, + https://github.com/ansible-collections/community.crypto/pull/646). + - openssh_keypair - fix comment updating for OpenSSH before 6.5 (https://github.com/ansible-collections/community.crypto/pull/646). + deprecated_features: + - get_certificate - the default ``false`` of the ``asn1_base64`` option is deprecated + and will change to ``true`` in community.crypto 3.0.0 (https://github.com/ansible-collections/community.crypto/pull/600). + minor_changes: + - openssh_keypair - fail when comment cannot be updated (https://github.com/ansible-collections/community.crypto/pull/646). + release_summary: Bugfix and feature release. + fragments: + - 2.15.0.yml + - 600-get_certificate-asn1_base64.yml + - 646-openssh-rc.yml + plugins: + filter: + - description: Retrieve a GPG fingerprint from a GPG public or private key + name: gpg_fingerprint + namespace: null + lookup: + - description: Retrieve a GPG fingerprint from a GPG public or private key file + name: gpg_fingerprint + namespace: null + release_date: '2023-08-12' + 2.15.1: + changes: + bugfixes: + - acme_* modules - correctly handle error documents without ``type`` (https://github.com/ansible-collections/community.crypto/issues/651, + https://github.com/ansible-collections/community.crypto/pull/652). + release_summary: Bugfix release. + fragments: + - 2.15.1.yml + - 652-problem-type.yml + release_date: '2023-08-22' + 2.16.0: + changes: + bugfixes: + - openssl_pkcs12 - modify autodetect to not detect pyOpenSSL >= 23.3.0, which + removed PKCS#12 support (https://github.com/ansible-collections/community.crypto/pull/666). + minor_changes: + - luks_devices - add new options ``keyslot``, ``new_keyslot``, and ``remove_keyslot`` + to allow adding/removing keys to/from specific keyslots (https://github.com/ansible-collections/community.crypto/pull/664). + release_summary: Bugfix release. + fragments: + - 2.16.0.yml + - 664-luks_device-keyslot.yml + - pkcs12.yml + release_date: '2023-10-29' + 2.16.1: + changes: + bugfixes: + - acme_* modules - also retry requests in case of socket errors, bad status + lines, and unknown connection errors; improve error messages in these cases + (https://github.com/ansible-collections/community.crypto/issues/680). + release_summary: Bugfix release. + fragments: + - 2.16.1.yml + - 680-acme-retry.yml + release_date: '2023-12-04' + 2.16.2: + changes: + bugfixes: + - acme_* modules - directly react on bad return data for account creation/retrieval/updating + requests (https://github.com/ansible-collections/community.crypto/pull/682). + - acme_* modules - fix improved error reporting in case of socket errors, bad + status lines, and unknown connection errors (https://github.com/ansible-collections/community.crypto/pull/684). + - acme_* modules - increase number of retries from 5 to 10 to increase stability + with unstable ACME endpoints (https://github.com/ansible-collections/community.crypto/pull/685). + - acme_* modules - make account registration handling more flexible to accept + 404 instead of 400 send by DigiCert's ACME endpoint when an account does not + exist (https://github.com/ansible-collections/community.crypto/pull/681). + release_summary: Bugfix release. + fragments: + - 2.16.2.yml + - 681-acme-account.yml + - 682-acme-errors.yml + - 684-info-code.yml + - 685-acme-retry.yml + release_date: '2023-12-08' + 2.17.0: + changes: + minor_changes: + - luks_device - add allow discards option (https://github.com/ansible-collections/community.crypto/pull/693). + release_summary: Feature release. + fragments: + - 2.17.0.yml + - 693-allow-discards.yaml + release_date: '2024-01-21' + 2.17.1: + changes: + bugfixes: + - openssl_dhparam - was using an internal function instead of the public API + to load DH param files when using the ``cryptography`` backend. The internal + function was removed in cryptography 42.0.0. The module now uses the public + API, which has been available since support for DH params was added to cryptography + (https://github.com/ansible-collections/community.crypto/pull/698). + - openssl_privatekey_info - ``check_consistency=true`` no longer works for RSA + keys with cryptography 42.0.0+ (https://github.com/ansible-collections/community.crypto/pull/701). + - openssl_privatekey_info - ``check_consistency=true`` now reports a warning + if it cannot determine consistency (https://github.com/ansible-collections/community.crypto/pull/705). + release_summary: Bugfix release for compatibility with cryptography 42.0.0. + fragments: + - 2.17.1.yml + - 698-openssl_dhparam-cryptography.yml + - 701-private_key_info-consistency.yml + - 705-openssl_privatekey_info-consistency.yml + release_date: '2024-01-27' + 2.18.0: + changes: + bugfixes: + - luks_device - fixed module a bug that prevented using ``remove_keyslot`` with + the value ``0`` (https://github.com/ansible-collections/community.crypto/pull/710). + - luks_device - fixed module falsely outputting ``changed=false`` when trying + to add a new slot with a key that is already present in another slot. The + module now rejects adding keys that are already present in another slot (https://github.com/ansible-collections/community.crypto/pull/710). + - luks_device - fixed testing of LUKS passphrases in when specifying a keyslot + for cryptsetup version 2.0.3. The output of this cryptsetup version slightly + differs from later versions (https://github.com/ansible-collections/community.crypto/pull/710). + deprecated_features: + - 'openssl_csr_pipe, openssl_privatekey_pipe, x509_certificate_pipe - the current + behavior of check mode is deprecated and will change in community.crypto 3.0.0. + The current behavior is similar to the modules without ``_pipe``: if the object + needs to be (re-)generated, only the ``changed`` status is set, but the object + is not updated. From community.crypto 3.0.0 on, the modules will ignore check + mode and always act as if check mode is not active. This behavior can already + achieved now by adding ``check_mode: false`` to the task. If you think this + breaks your use-case of this module, please `create an issue in the community.crypto + repository <https://github.com/ansible-collections/community.crypto/issues/new/choose>`__ + (https://github.com/ansible-collections/community.crypto/issues/712, https://github.com/ansible-collections/community.crypto/pull/714).' + minor_changes: + - x509_crl - the new option ``serial_numbers`` allow to configure in which format + serial numbers can be provided to ``revoked_certificates[].serial_number``. + The default is as integers (``serial_numbers=integer``) for backwards compatibility; + setting ``serial_numbers=hex-octets`` allows to specify colon-separated hex + octet strings like ``00:11:22:FF`` (https://github.com/ansible-collections/community.crypto/issues/687, + https://github.com/ansible-collections/community.crypto/pull/715). + release_summary: Bugfix and feature release. + fragments: + - 2.18.0.yml + - 710-luks_device-keyslot-fixes.yml + - 714-pipe-check-mode-deprecation.yml + - 715-x509_crl-serial.yml + plugins: + filter: + - description: Convert a serial number as a colon-separated list of hex numbers + to an integer + name: parse_serial + namespace: null + - description: Convert an integer to a colon-separated list of hex numbers + name: to_serial + namespace: null + release_date: '2024-02-25' 2.2.0: changes: bugfixes: @@ -947,7 +1141,7 @@ releases: be installed by pip by specifying something like ``cryptography >= 37.0.0`` in your Execution Environment's Python dependencies file (https://github.com/ansible-collections/community.crypto/pull/440). - Support automatic conversion for Internalionalized Domain Names (IDNs). When - passing general names, for example Subject Altenative Names to ``community.crypto.openssl_csr``, + passing general names, for example Subject Alternative Names to ``community.crypto.openssl_csr``, these will automatically be converted to IDNA. Conversion will be done per label to IDNA2008 if possible, and IDNA2003 if IDNA2008 conversion fails for that label. Note that IDNA conversion requires `the Python idna library <https://pypi.org/project/idna/>`_ diff --git a/ansible_collections/community/crypto/changelogs/config.yaml b/ansible_collections/community/crypto/changelogs/config.yaml index f2767048a..93ceb6472 100644 --- a/ansible_collections/community/crypto/changelogs/config.yaml +++ b/ansible_collections/community/crypto/changelogs/config.yaml @@ -11,6 +11,9 @@ keep_fragments: false mention_ancestor: true new_plugins_after_name: removed_features notesdir: fragments +output_formats: + - md + - rst prelude_section_name: release_summary prelude_section_title: Release Summary sections: diff --git a/ansible_collections/community/crypto/docs/docsite/rst/guide_ownca.rst b/ansible_collections/community/crypto/docs/docsite/rst/guide_ownca.rst index 0e8a46da8..79c224a46 100644 --- a/ansible_collections/community/crypto/docs/docsite/rst/guide_ownca.rst +++ b/ansible_collections/community/crypto/docs/docsite/rst/guide_ownca.rst @@ -8,7 +8,7 @@ How to create a small CA ======================== -The `community.crypto collection <https://galaxy.ansible.com/community/crypto>`_ offers multiple modules that create private keys, certificate signing requests, and certificates. This guide shows how to create your own small CA and how to use it to sign certificates. +The `community.crypto collection <https://galaxy.ansible.com/ui/repo/published/community/crypto/>`_ offers multiple modules that create private keys, certificate signing requests, and certificates. This guide shows how to create your own small CA and how to use it to sign certificates. In all examples, we assume that the CA's private key is password protected, where the password is provided in the ``secret_ca_passphrase`` variable. diff --git a/ansible_collections/community/crypto/docs/docsite/rst/guide_selfsigned.rst b/ansible_collections/community/crypto/docs/docsite/rst/guide_selfsigned.rst index dc208d5c7..fda4911d6 100644 --- a/ansible_collections/community/crypto/docs/docsite/rst/guide_selfsigned.rst +++ b/ansible_collections/community/crypto/docs/docsite/rst/guide_selfsigned.rst @@ -8,9 +8,9 @@ How to create self-signed certificates ====================================== -The `community.crypto collection <https://galaxy.ansible.com/community/crypto>`_ offers multiple modules that create private keys, certificate signing requests, and certificates. This guide shows how to create self-signed certificates. +The `community.crypto collection <https://galaxy.ansible.com/ui/repo/published/community/crypto/>`_ offers multiple modules that create private keys, certificate signing requests, and certificates. This guide shows how to create self-signed certificates. -For creating any kind of certificate, you always have to start with a private key. You can use the :ref:`community.crypto.openssl_privatekey module <ansible_collections.community.crypto.openssl_privatekey_module>` to create a private key. If you only specify ``path``, the default parameters will be used. This will result in a 4096 bit RSA private key: +For creating any kind of certificate, you always have to start with a private key. You can use the :ref:`community.crypto.openssl_privatekey module <ansible_collections.community.crypto.openssl_privatekey_module>` to create a private key. If you only specify :ansopt:`community.crypto.openssl_privatekey#module:path`, the default parameters will be used. This will result in a 4096 bit RSA private key: .. code-block:: yaml+jinja @@ -18,7 +18,7 @@ For creating any kind of certificate, you always have to start with a private ke community.crypto.openssl_privatekey: path: /path/to/certificate.key -You can specify ``type`` to select another key type, ``size`` to select a different key size (only available for RSA and DSA keys), or ``passphrase`` if you want to store the key password-protected: +You can specify :ansopt:`community.crypto.openssl_privatekey#module:type` to select another key type, :ansopt:`community.crypto.openssl_privatekey#module:size` to select a different key size (only available for RSA and DSA keys), or :ansopt:`community.crypto.openssl_privatekey#module:passphrase` if you want to store the key password-protected: .. code-block:: yaml+jinja @@ -38,9 +38,9 @@ To create a very simple self-signed certificate with no specific information, yo privatekey_path: /path/to/certificate.key provider: selfsigned -(If you used ``passphrase`` for the private key, you have to provide ``privatekey_passphrase``.) +(If you used :ansopt:`community.crypto.openssl_privatekey#module:passphrase` for the private key, you have to provide :ansopt:`community.crypto.x509_certificate#module:privatekey_passphrase`.) -You can use ``selfsigned_not_after`` to define when the certificate expires (default: in roughly 10 years), and ``selfsigned_not_before`` to define from when the certificate is valid (default: now). +You can use :ansopt:`community.crypto.x509_certificate#module:selfsigned_not_after` to define when the certificate expires (default: in roughly 10 years), and :ansopt:`community.crypto.x509_certificate#module:selfsigned_not_before` to define from when the certificate is valid (default: now). To define further properties of the certificate, like the subject, Subject Alternative Names (SANs), key usages, name constraints, etc., you need to first create a Certificate Signing Request (CSR) and provide it to the :ref:`community.crypto.x509_certificate module <ansible_collections.community.crypto.x509_certificate_module>`. If you do not need the CSR file, you can use the :ref:`community.crypto.openssl_csr_pipe module <ansible_collections.community.crypto.openssl_csr_pipe_module>` as in the example below. (To store it to disk, use the :ref:`community.crypto.openssl_csr module <ansible_collections.community.crypto.openssl_csr_module>` instead.) diff --git a/ansible_collections/community/crypto/plugins/action/openssl_privatekey_pipe.py b/ansible_collections/community/crypto/plugins/action/openssl_privatekey_pipe.py index dc1a16979..dc864ab01 100644 --- a/ansible_collections/community/crypto/plugins/action/openssl_privatekey_pipe.py +++ b/ansible_collections/community/crypto/plugins/action/openssl_privatekey_pipe.py @@ -51,6 +51,16 @@ class PrivateKeyModule(object): self.module_backend.generate_private_key() privatekey_data = self.module_backend.get_private_key_data() self.privatekey_bytes = privatekey_data + else: + self.module.deprecate( + 'Check mode support for openssl_privatekey_pipe will change in community.crypto 3.0.0' + ' to behave the same as without check mode. You can get that behavior right now' + ' by adding `check_mode: false` to the openssl_privatekey_pipe task. If you think this' + ' breaks your use-case of this module, please create an issue in the' + ' community.crypto repository', + version='3.0.0', + collection_name='community.crypto', + ) self.changed = True elif self.module_backend.needs_conversion(): # Convert @@ -58,6 +68,16 @@ class PrivateKeyModule(object): self.module_backend.convert_private_key() privatekey_data = self.module_backend.get_private_key_data() self.privatekey_bytes = privatekey_data + else: + self.module.deprecate( + 'Check mode support for openssl_privatekey_pipe will change in community.crypto 3.0.0' + ' to behave the same as without check mode. You can get that behavior right now' + ' by adding `check_mode: false` to the openssl_privatekey_pipe task. If you think this' + ' breaks your use-case of this module, please create an issue in the' + ' community.crypto repository', + version='3.0.0', + collection_name='community.crypto', + ) self.changed = True def dump(self): diff --git a/ansible_collections/community/crypto/plugins/doc_fragments/acme.py b/ansible_collections/community/crypto/plugins/doc_fragments/acme.py index a50cedd69..2b5bfc231 100644 --- a/ansible_collections/community/crypto/plugins/doc_fragments/acme.py +++ b/ansible_collections/community/crypto/plugins/doc_fragments/acme.py @@ -16,10 +16,10 @@ notes: - "If a new enough version of the C(cryptography) library is available (see Requirements for details), it will be used instead of the C(openssl) binary. This can be explicitly disabled - or enabled with the C(select_crypto_backend) option. Note that using + or enabled with the O(select_crypto_backend) option. Note that using the C(openssl) binary will be slower and less secure, as private key contents always have to be stored on disk (see - C(account_key_content))." + O(account_key_content))." - "Although the defaults are chosen so that the module can be used with the L(Let's Encrypt,https://letsencrypt.org/) CA, the module can in principle be used with any CA providing an ACME endpoint, such as @@ -47,15 +47,15 @@ options: RSA keys can be created with C(openssl genrsa ...). Elliptic curve keys can be created with C(openssl ecparam -genkey ...). Any other tool creating private keys in PEM format can be used as well." - - "Mutually exclusive with C(account_key_content)." - - "Required if C(account_key_content) is not used." + - "Mutually exclusive with O(account_key_content)." + - "Required if O(account_key_content) is not used." type: path aliases: [ account_key ] account_key_content: description: - "Content of the ACME account RSA or Elliptic Curve key." - - "Mutually exclusive with C(account_key_src)." - - "Required if C(account_key_src) is not used." + - "Mutually exclusive with O(account_key_src)." + - "Required if O(account_key_src) is not used." - "B(Warning:) the content will be written into a temporary file, which will be deleted by Ansible when the module completes. Since this is an important private key — it can be used to change the account key, @@ -81,9 +81,9 @@ options: acme_version: description: - "The ACME version of the endpoint." - - "Must be C(1) for the classic Let's Encrypt and Buypass ACME endpoints, - or C(2) for standardized ACME v2 endpoints." - - "The value C(1) is deprecated since community.crypto 2.0.0 and will be + - "Must be V(1) for the classic Let's Encrypt and Buypass ACME endpoints, + or V(2) for standardized ACME v2 endpoints." + - "The value V(1) is deprecated since community.crypto 2.0.0 and will be removed from community.crypto 3.0.0." required: true type: int @@ -114,17 +114,17 @@ options: validate_certs: description: - Whether calls to the ACME directory will validate TLS certificates. - - "B(Warning:) Should B(only ever) be set to C(false) for testing purposes, + - "B(Warning:) Should B(only ever) be set to V(false) for testing purposes, for example when testing against a local Pebble server." type: bool default: true select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available, and falls back to + - The default choice is V(auto), which tries to use C(cryptography) if available, and falls back to C(openssl). - - If set to C(openssl), will try to use the C(openssl) binary. - - If set to C(cryptography), will try to use the + - If set to V(openssl), will try to use the C(openssl) binary. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto diff --git a/ansible_collections/community/crypto/plugins/doc_fragments/module_certificate.py b/ansible_collections/community/crypto/plugins/doc_fragments/module_certificate.py index 648d4ce91..5691e7bbf 100644 --- a/ansible_collections/community/crypto/plugins/doc_fragments/module_certificate.py +++ b/ansible_collections/community/crypto/plugins/doc_fragments/module_certificate.py @@ -17,7 +17,7 @@ description: - This module allows one to (re)generate OpenSSL certificates. - It uses the cryptography python library to interact with OpenSSL. requirements: - - cryptography >= 1.6 (if using C(selfsigned) or C(ownca) provider) + - cryptography >= 1.6 (if using V(selfsigned) or V(ownca) provider) options: force: description: @@ -28,35 +28,35 @@ options: csr_path: description: - Path to the Certificate Signing Request (CSR) used to generate this certificate. - - This is mutually exclusive with I(csr_content). + - This is mutually exclusive with O(csr_content). type: path csr_content: description: - Content of the Certificate Signing Request (CSR) used to generate this certificate. - - This is mutually exclusive with I(csr_path). + - This is mutually exclusive with O(csr_path). type: str privatekey_path: description: - Path to the private key to use when signing the certificate. - - This is mutually exclusive with I(privatekey_content). + - This is mutually exclusive with O(privatekey_content). type: path privatekey_content: description: - Content of the private key to use when signing the certificate. - - This is mutually exclusive with I(privatekey_path). + - This is mutually exclusive with O(privatekey_path). type: str privatekey_passphrase: description: - - The passphrase for the I(privatekey_path) resp. I(privatekey_content). + - The passphrase for the O(privatekey_path) resp. O(privatekey_content). - This is required if the private key is password protected. type: str ignore_timestamps: description: - Whether the "not before" and "not after" timestamps should be ignored for idempotency checks. - - It is better to keep the default value C(true) when using relative timestamps (like C(+0s) for now). + - It is better to keep the default value V(true) when using relative timestamps (like V(+0s) for now). type: bool default: true version_added: 2.0.0 @@ -64,8 +64,8 @@ options: select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography ] @@ -73,7 +73,7 @@ options: notes: - All ASN.1 TIME values should be specified following the YYYYMMDDHHMMSSZ pattern. - Date specified should be UTC. Minutes and seconds are mandatory. - - For security reason, when you use C(ownca) provider, you should NOT run + - For security reason, when you use V(ownca) provider, you should NOT run M(community.crypto.x509_certificate) on a target machine, but on a dedicated CA machine. It is recommended not to store the CA private key on the target machine. Once signed, the certificate can be moved to the target machine. @@ -91,26 +91,26 @@ seealso: description: - This module allows one to (re)generate OpenSSL certificates. requirements: - - acme-tiny >= 4.0.0 (if using the C(acme) provider) + - acme-tiny >= 4.0.0 (if using the V(acme) provider) options: acme_accountkey_path: description: - - The path to the accountkey for the C(acme) provider. - - This is only used by the C(acme) provider. + - The path to the accountkey for the V(acme) provider. + - This is only used by the V(acme) provider. type: path acme_challenge_path: description: - The path to the ACME challenge directory that is served on U(http://<HOST>:80/.well-known/acme-challenge/) - - This is only used by the C(acme) provider. + - This is only used by the V(acme) provider. type: path acme_chain: description: - Include the intermediate certificate to the generated certificate - - This is only used by the C(acme) provider. + - This is only used by the V(acme) provider. - Note that this is only available for older versions of C(acme-tiny). - New versions include the chain automatically, and setting I(acme_chain) to C(true) results in an error. + New versions include the chain automatically, and setting O(acme_chain) to V(true) results in an error. type: bool default: false @@ -127,7 +127,7 @@ options: entrust_cert_type: description: - Specify the type of certificate requested. - - This is only used by the C(entrust) provider. + - This is only used by the V(entrust) provider. type: str default: STANDARD_SSL choices: [ 'STANDARD_SSL', 'ADVANTAGE_SSL', 'UC_SSL', 'EV_SSL', 'WILDCARD_SSL', 'PRIVATE_SSL', 'PD_SSL', 'CDS_ENT_LITE', 'CDS_ENT_PRO', 'SMIME_ENT' ] @@ -135,66 +135,66 @@ options: entrust_requester_email: description: - The email of the requester of the certificate (for tracking purposes). - - This is only used by the C(entrust) provider. - - This is required if the provider is C(entrust). + - This is only used by the V(entrust) provider. + - This is required if the provider is V(entrust). type: str entrust_requester_name: description: - The name of the requester of the certificate (for tracking purposes). - - This is only used by the C(entrust) provider. - - This is required if the provider is C(entrust). + - This is only used by the V(entrust) provider. + - This is required if the provider is V(entrust). type: str entrust_requester_phone: description: - The phone number of the requester of the certificate (for tracking purposes). - - This is only used by the C(entrust) provider. - - This is required if the provider is C(entrust). + - This is only used by the V(entrust) provider. + - This is required if the provider is V(entrust). type: str entrust_api_user: description: - The username for authentication to the Entrust Certificate Services (ECS) API. - - This is only used by the C(entrust) provider. - - This is required if the provider is C(entrust). + - This is only used by the V(entrust) provider. + - This is required if the provider is V(entrust). type: str entrust_api_key: description: - The key (password) for authentication to the Entrust Certificate Services (ECS) API. - - This is only used by the C(entrust) provider. - - This is required if the provider is C(entrust). + - This is only used by the V(entrust) provider. + - This is required if the provider is V(entrust). type: str entrust_api_client_cert_path: description: - The path to the client certificate used to authenticate to the Entrust Certificate Services (ECS) API. - - This is only used by the C(entrust) provider. - - This is required if the provider is C(entrust). + - This is only used by the V(entrust) provider. + - This is required if the provider is V(entrust). type: path entrust_api_client_cert_key_path: description: - The path to the private key of the client certificate used to authenticate to the Entrust Certificate Services (ECS) API. - - This is only used by the C(entrust) provider. - - This is required if the provider is C(entrust). + - This is only used by the V(entrust) provider. + - This is required if the provider is V(entrust). type: path entrust_not_after: description: - The point in time at which the certificate stops being valid. - Time can be specified either as relative time or as an absolute timestamp. - - A valid absolute time format is C(ASN.1 TIME) such as C(2019-06-18). - - A valid relative time format is C([+-]timespec) where timespec can be an integer + C([w | d | h | m | s]), such as C(+365d) or C(+32w1d2h)). + - A valid absolute time format is C(ASN.1 TIME) such as V(2019-06-18). + - A valid relative time format is V([+-]timespec) where timespec can be an integer + C([w | d | h | m | s]), such as V(+365d) or V(+32w1d2h)). - Time will always be interpreted as UTC. - Note that only the date (day, month, year) is supported for specifying the expiry date of the issued certificate. - The full date-time is adjusted to EST (GMT -5:00) before issuance, which may result in a certificate with an expiration date one day earlier than expected if a relative time is used. - The minimum certificate lifetime is 90 days, and maximum is three years. - If this value is not specified, the certificate will stop being valid 365 days the date of issue. - - This is only used by the C(entrust) provider. - - Please note that this value is B(not) covered by the I(ignore_timestamps) option. + - This is only used by the V(entrust) provider. + - Please note that this value is B(not) covered by the O(ignore_timestamps) option. type: str default: +365d @@ -202,60 +202,60 @@ options: description: - The path to the specification file defining the Entrust Certificate Services (ECS) API configuration. - You can use this to keep a local copy of the specification to avoid downloading it every time the module is used. - - This is only used by the C(entrust) provider. + - This is only used by the V(entrust) provider. type: path default: https://cloud.entrust.net/EntrustCloud/documentation/cms-api-2.1.0.yaml ''' BACKEND_OWNCA_DOCUMENTATION = r''' description: - - The C(ownca) provider is intended for generating an OpenSSL certificate signed with your own + - The V(ownca) provider is intended for generating an OpenSSL certificate signed with your own CA (Certificate Authority) certificate (self-signed certificate). options: ownca_path: description: - Remote absolute path of the CA (Certificate Authority) certificate. - - This is only used by the C(ownca) provider. - - This is mutually exclusive with I(ownca_content). + - This is only used by the V(ownca) provider. + - This is mutually exclusive with O(ownca_content). type: path ownca_content: description: - Content of the CA (Certificate Authority) certificate. - - This is only used by the C(ownca) provider. - - This is mutually exclusive with I(ownca_path). + - This is only used by the V(ownca) provider. + - This is mutually exclusive with O(ownca_path). type: str ownca_privatekey_path: description: - Path to the CA (Certificate Authority) private key to use when signing the certificate. - - This is only used by the C(ownca) provider. - - This is mutually exclusive with I(ownca_privatekey_content). + - This is only used by the V(ownca) provider. + - This is mutually exclusive with O(ownca_privatekey_content). type: path ownca_privatekey_content: description: - Content of the CA (Certificate Authority) private key to use when signing the certificate. - - This is only used by the C(ownca) provider. - - This is mutually exclusive with I(ownca_privatekey_path). + - This is only used by the V(ownca) provider. + - This is mutually exclusive with O(ownca_privatekey_path). type: str ownca_privatekey_passphrase: description: - - The passphrase for the I(ownca_privatekey_path) resp. I(ownca_privatekey_content). - - This is only used by the C(ownca) provider. + - The passphrase for the O(ownca_privatekey_path) resp. O(ownca_privatekey_content). + - This is only used by the V(ownca) provider. type: str ownca_digest: description: - - The digest algorithm to be used for the C(ownca) certificate. - - This is only used by the C(ownca) provider. + - The digest algorithm to be used for the V(ownca) certificate. + - This is only used by the V(ownca) provider. type: str default: sha256 ownca_version: description: - - The version of the C(ownca) certificate. - - Nowadays it should almost always be C(3). - - This is only used by the C(ownca) provider. + - The version of the V(ownca) certificate. + - Nowadays it should almost always be V(3). + - This is only used by the V(ownca) provider. type: int default: 3 @@ -265,12 +265,12 @@ options: - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer - + C([w | d | h | m | s]) (for example C(+32w1d2h)). + + C([w | d | h | m | s]) (for example V(+32w1d2h)). - If this value is not specified, the certificate will start being valid from now. - Note that this value is B(not used to determine whether an existing certificate should be regenerated). - This can be changed by setting the I(ignore_timestamps) option to C(false). Please note that you should - avoid relative timestamps when setting I(ignore_timestamps=false). - - This is only used by the C(ownca) provider. + This can be changed by setting the O(ignore_timestamps) option to V(false). Please note that you should + avoid relative timestamps when setting O(ignore_timestamps=false). + - This is only used by the V(ownca) provider. type: str default: +0s @@ -280,12 +280,12 @@ options: - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer - + C([w | d | h | m | s]) (for example C(+32w1d2h)). + + C([w | d | h | m | s]) (for example V(+32w1d2h)). - If this value is not specified, the certificate will stop being valid 10 years from now. - Note that this value is B(not used to determine whether an existing certificate should be regenerated). - This can be changed by setting the I(ignore_timestamps) option to C(false). Please note that you should - avoid relative timestamps when setting I(ignore_timestamps=false). - - This is only used by the C(ownca) provider. + This can be changed by setting the O(ignore_timestamps) option to V(false). Please note that you should + avoid relative timestamps when setting O(ignore_timestamps=false). + - This is only used by the V(ownca) provider. - On macOS 10.15 and onwards, TLS server certificates must have a validity period of 825 days or fewer. Please see U(https://support.apple.com/en-us/HT210176) for more details. type: str @@ -294,12 +294,12 @@ options: ownca_create_subject_key_identifier: description: - Whether to create the Subject Key Identifier (SKI) from the public key. - - A value of C(create_if_not_provided) (default) only creates a SKI when the CSR does not + - A value of V(create_if_not_provided) (default) only creates a SKI when the CSR does not provide one. - - A value of C(always_create) always creates a SKI. If the CSR provides one, that one is + - A value of V(always_create) always creates a SKI. If the CSR provides one, that one is ignored. - - A value of C(never_create) never creates a SKI. If the CSR provides one, that one is used. - - This is only used by the C(ownca) provider. + - A value of V(never_create) never creates a SKI. If the CSR provides one, that one is used. + - This is only used by the V(ownca) provider. - Note that this is only supported if the C(cryptography) backend is used! type: str choices: [create_if_not_provided, always_create, never_create] @@ -311,7 +311,7 @@ options: a authority key identifier, it is ignored. - The Authority Key Identifier is generated from the CA certificate's Subject Key Identifier, if available. If it is not available, the CA certificate's public key will be used. - - This is only used by the C(ownca) provider. + - This is only used by the V(ownca) provider. - Note that this is only supported if the C(cryptography) backend is used! type: bool default: true @@ -319,7 +319,7 @@ options: BACKEND_SELFSIGNED_DOCUMENTATION = r''' notes: - - For the C(selfsigned) provider, I(csr_path) and I(csr_content) are optional. If not provided, a + - For the V(selfsigned) provider, O(csr_path) and O(csr_content) are optional. If not provided, a certificate without any information (Subject, Subject Alternative Names, Key Usage, etc.) is created. options: @@ -329,28 +329,28 @@ options: # csr_path: # description: - # - This is optional for the C(selfsigned) provider. If not provided, a certificate + # - This is optional for the V(selfsigned) provider. If not provided, a certificate # without any information (Subject, Subject Alternative Names, Key Usage, etc.) is # created. # csr_content: # description: - # - This is optional for the C(selfsigned) provider. If not provided, a certificate + # - This is optional for the V(selfsigned) provider. If not provided, a certificate # without any information (Subject, Subject Alternative Names, Key Usage, etc.) is # created. selfsigned_version: description: - - Version of the C(selfsigned) certificate. - - Nowadays it should almost always be C(3). - - This is only used by the C(selfsigned) provider. + - Version of the V(selfsigned) certificate. + - Nowadays it should almost always be V(3). + - This is only used by the V(selfsigned) provider. type: int default: 3 selfsigned_digest: description: - Digest algorithm to be used when self-signing the certificate. - - This is only used by the C(selfsigned) provider. + - This is only used by the V(selfsigned) provider. type: str default: sha256 @@ -360,12 +360,12 @@ options: - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer - + C([w | d | h | m | s]) (for example C(+32w1d2h)). + + C([w | d | h | m | s]) (for example V(+32w1d2h)). - If this value is not specified, the certificate will start being valid from now. - Note that this value is B(not used to determine whether an existing certificate should be regenerated). - This can be changed by setting the I(ignore_timestamps) option to C(false). Please note that you should - avoid relative timestamps when setting I(ignore_timestamps=false). - - This is only used by the C(selfsigned) provider. + This can be changed by setting the O(ignore_timestamps) option to V(false). Please note that you should + avoid relative timestamps when setting O(ignore_timestamps=false). + - This is only used by the V(selfsigned) provider. type: str default: +0s aliases: [ selfsigned_notBefore ] @@ -376,12 +376,12 @@ options: - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer - + C([w | d | h | m | s]) (for example C(+32w1d2h)). + + C([w | d | h | m | s]) (for example V(+32w1d2h)). - If this value is not specified, the certificate will stop being valid 10 years from now. - Note that this value is B(not used to determine whether an existing certificate should be regenerated). - This can be changed by setting the I(ignore_timestamps) option to C(false). Please note that you should - avoid relative timestamps when setting I(ignore_timestamps=false). - - This is only used by the C(selfsigned) provider. + This can be changed by setting the O(ignore_timestamps) option to V(false). Please note that you should + avoid relative timestamps when setting O(ignore_timestamps=false). + - This is only used by the V(selfsigned) provider. - On macOS 10.15 and onwards, TLS server certificates must have a validity period of 825 days or fewer. Please see U(https://support.apple.com/en-us/HT210176) for more details. type: str @@ -391,12 +391,12 @@ options: selfsigned_create_subject_key_identifier: description: - Whether to create the Subject Key Identifier (SKI) from the public key. - - A value of C(create_if_not_provided) (default) only creates a SKI when the CSR does not + - A value of V(create_if_not_provided) (default) only creates a SKI when the CSR does not provide one. - - A value of C(always_create) always creates a SKI. If the CSR provides one, that one is + - A value of V(always_create) always creates a SKI. If the CSR provides one, that one is ignored. - - A value of C(never_create) never creates a SKI. If the CSR provides one, that one is used. - - This is only used by the C(selfsigned) provider. + - A value of V(never_create) never creates a SKI. If the CSR provides one, that one is used. + - This is only used by the V(selfsigned) provider. - Note that this is only supported if the C(cryptography) backend is used! type: str choices: [create_if_not_provided, always_create, never_create] diff --git a/ansible_collections/community/crypto/plugins/doc_fragments/module_csr.py b/ansible_collections/community/crypto/plugins/doc_fragments/module_csr.py index 81c4318a4..e2a0bdd94 100644 --- a/ansible_collections/community/crypto/plugins/doc_fragments/module_csr.py +++ b/ansible_collections/community/crypto/plugins/doc_fragments/module_csr.py @@ -27,12 +27,12 @@ options: privatekey_path: description: - The path to the private key to use when signing the certificate signing request. - - Either I(privatekey_path) or I(privatekey_content) must be specified if I(state) is C(present), but not both. + - Either O(privatekey_path) or O(privatekey_content) must be specified if O(state) is V(present), but not both. type: path privatekey_content: description: - The content of the private key to use when signing the certificate signing request. - - Either I(privatekey_path) or I(privatekey_content) must be specified if I(state) is C(present), but not both. + - Either O(privatekey_path) or O(privatekey_content) must be specified if O(state) is V(present), but not both. type: str privatekey_passphrase: description: @@ -53,17 +53,17 @@ options: description: - Key/value pairs that will be present in the subject name field of the certificate signing request. - If you need to specify more than one value with the same key, use a list as value. - - If the order of the components is important, use I(subject_ordered). - - Mutually exclusive with I(subject_ordered). + - If the order of the components is important, use O(subject_ordered). + - Mutually exclusive with O(subject_ordered). type: dict subject_ordered: description: - A list of dictionaries, where every dictionary must contain one key/value pair. This key/value pair will be present in the subject name field of the certificate signing request. - If you want to specify more than one value with the same key in a row, you can use a list as value. - - Mutually exclusive with I(subject), and any other subject field option, such as I(country_name), - I(state_or_province_name), I(locality_name), I(organization_name), I(organizational_unit_name), - I(common_name), or I(email_address). + - Mutually exclusive with O(subject), and any other subject field option, such as O(country_name), + O(state_or_province_name), O(locality_name), O(organization_name), O(organizational_unit_name), + O(common_name), or O(email_address). type: list elements: dict version_added: 2.0.0 @@ -108,8 +108,8 @@ options: - Values must be prefixed by their options. (These are C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName), C(otherName), and the ones specific to your CA). - Note that if no SAN is specified, but a common name, the common - name will be added as a SAN except if C(useCommonNameForSAN) is - set to I(false). + name will be added as a SAN except if O(use_common_name_for_san) is + set to V(false). - More at U(https://tools.ietf.org/html/rfc5280#section-4.2.1.6). type: list elements: str @@ -122,8 +122,8 @@ options: aliases: [ subjectAltName_critical ] use_common_name_for_san: description: - - If set to C(true), the module will fill the common name in for - C(subject_alt_name) with C(DNS:) prefix if no SAN is specified. + - If set to V(true), the module will fill the common name in for + O(subject_alt_name) with C(DNS:) prefix if no SAN is specified. type: bool default: true aliases: [ useCommonNameForSAN ] @@ -186,16 +186,16 @@ options: description: - For CA certificates, this specifies a list of identifiers which describe subtrees of names that this CA is allowed to issue certificates for. - - Values must be prefixed by their options. (i.e., C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName), - C(otherName) and the ones specific to your CA). + - Values must be prefixed by their options. (That is, C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName), + C(otherName), and the ones specific to your CA). type: list elements: str name_constraints_excluded: description: - For CA certificates, this specifies a list of identifiers which describe subtrees of names that this CA is B(not) allowed to issue certificates for. - - Values must be prefixed by their options. (i.e., C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName), - C(otherName) and the ones specific to your CA). + - Values must be prefixed by their options. (That is, C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName), + C(otherName), and the ones specific to your CA). type: list elements: str name_constraints_critical: @@ -206,8 +206,8 @@ options: select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography ] @@ -223,49 +223,51 @@ options: subject_key_identifier: description: - The subject key identifier as a hex string, where two bytes are separated by colons. - - "Example: C(00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33)" + - "Example: V(00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33)" - "Please note that commercial CAs ignore this value, respectively use a value of their own choice. Specifying this option is mostly useful for self-signed certificates or for own CAs." - - Note that this option can only be used if I(create_subject_key_identifier) is C(false). + - Note that this option can only be used if O(create_subject_key_identifier) is V(false). - Note that this is only supported if the C(cryptography) backend is used! type: str authority_key_identifier: description: - The authority key identifier as a hex string, where two bytes are separated by colons. - - "Example: C(00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33)" + - "Example: V(00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33)" - "Please note that commercial CAs ignore this value, respectively use a value of their own choice. Specifying this option is mostly useful for self-signed certificates or for own CAs." - Note that this is only supported if the C(cryptography) backend is used! - - The C(AuthorityKeyIdentifier) extension will only be added if at least one of I(authority_key_identifier), - I(authority_cert_issuer) and I(authority_cert_serial_number) is specified. + - The C(AuthorityKeyIdentifier) extension will only be added if at least one of O(authority_key_identifier), + O(authority_cert_issuer) and O(authority_cert_serial_number) is specified. type: str authority_cert_issuer: description: - Names that will be present in the authority cert issuer field of the certificate signing request. - - Values must be prefixed by their options. (i.e., C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName), - C(otherName) and the ones specific to your CA) - - "Example: C(DNS:ca.example.org)" - - If specified, I(authority_cert_serial_number) must also be specified. + - Values must be prefixed by their options. (That is, C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName), + C(otherName), and the ones specific to your CA) + - "Example: V(DNS:ca.example.org)" + - If specified, O(authority_cert_serial_number) must also be specified. - "Please note that commercial CAs ignore this value, respectively use a value of their own choice. Specifying this option is mostly useful for self-signed certificates or for own CAs." - Note that this is only supported if the C(cryptography) backend is used! - - The C(AuthorityKeyIdentifier) extension will only be added if at least one of I(authority_key_identifier), - I(authority_cert_issuer) and I(authority_cert_serial_number) is specified. + - The C(AuthorityKeyIdentifier) extension will only be added if at least one of O(authority_key_identifier), + O(authority_cert_issuer) and O(authority_cert_serial_number) is specified. type: list elements: str authority_cert_serial_number: description: - The authority cert serial number. - - If specified, I(authority_cert_issuer) must also be specified. + - If specified, O(authority_cert_issuer) must also be specified. - Note that this is only supported if the C(cryptography) backend is used! - "Please note that commercial CAs ignore this value, respectively use a value of their own choice. Specifying this option is mostly useful for self-signed certificates or for own CAs." - - The C(AuthorityKeyIdentifier) extension will only be added if at least one of I(authority_key_identifier), - I(authority_cert_issuer) and I(authority_cert_serial_number) is specified. + - The C(AuthorityKeyIdentifier) extension will only be added if at least one of O(authority_key_identifier), + O(authority_cert_issuer) and O(authority_cert_serial_number) is specified. + - This option accepts an B(integer). If you want to provide serial numbers as colon-separated hex strings, + such as C(11:22:33), you need to convert them to an integer with P(community.crypto.parse_serial#filter). type: int crl_distribution_points: description: @@ -277,15 +279,15 @@ options: full_name: description: - Describes how the CRL can be retrieved. - - Mutually exclusive with I(relative_name). - - "Example: C(URI:https://ca.example.com/revocations.crl)." + - Mutually exclusive with O(crl_distribution_points[].relative_name). + - "Example: V(URI:https://ca.example.com/revocations.crl)." type: list elements: str relative_name: description: - Describes how the CRL can be retrieved relative to the CRL issuer. - - Mutually exclusive with I(full_name). - - "Example: C(/CN=example.com)." + - Mutually exclusive with O(crl_distribution_points[].full_name). + - "Example: V(/CN=example.com)." - Can only be used when cryptography >= 1.6 is installed. type: list elements: str @@ -322,4 +324,6 @@ seealso: - module: community.crypto.openssl_privatekey_pipe - module: community.crypto.openssl_publickey - module: community.crypto.openssl_csr_info +- plugin: community.crypto.parse_serial + plugin_type: filter ''' diff --git a/ansible_collections/community/crypto/plugins/doc_fragments/module_privatekey.py b/ansible_collections/community/crypto/plugins/doc_fragments/module_privatekey.py index a27b26c7d..d039cf1c0 100644 --- a/ansible_collections/community/crypto/plugins/doc_fragments/module_privatekey.py +++ b/ansible_collections/community/crypto/plugins/doc_fragments/module_privatekey.py @@ -18,11 +18,6 @@ description: L(ECC,https://en.wikipedia.org/wiki/Elliptic-curve_cryptography) or L(EdDSA,https://en.wikipedia.org/wiki/EdDSA) private keys. - Keys are generated in PEM format. - - "Please note that the module regenerates private keys if they do not match - the module's options. In particular, if you provide another passphrase - (or specify none), change the keysize, etc., the private key will be - regenerated. If you are concerned that this could B(overwrite your private key), - consider using the I(backup) option." requirements: - cryptography >= 1.2.3 (older versions might work as well) options: @@ -34,20 +29,20 @@ options: type: description: - The algorithm used to generate the TLS/SSL private key. - - Note that C(ECC), C(X25519), C(X448), C(Ed25519) and C(Ed448) require the C(cryptography) backend. - C(X25519) needs cryptography 2.5 or newer, while C(X448), C(Ed25519) and C(Ed448) require - cryptography 2.6 or newer. For C(ECC), the minimal cryptography version required depends on the - I(curve) option. + - Note that V(ECC), V(X25519), V(X448), V(Ed25519), and V(Ed448) require the C(cryptography) backend. + V(X25519) needs cryptography 2.5 or newer, while V(X448), V(Ed25519), and V(Ed448) require + cryptography 2.6 or newer. For V(ECC), the minimal cryptography version required depends on the + O(curve) option. type: str default: RSA choices: [ DSA, ECC, Ed25519, Ed448, RSA, X25519, X448 ] curve: description: - Note that not all curves are supported by all versions of C(cryptography). - - For maximal interoperability, C(secp384r1) or C(secp256r1) should be used. + - For maximal interoperability, V(secp384r1) or V(secp256r1) should be used. - We use the curve names as defined in the L(IANA registry for TLS,https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8). - - Please note that all curves except C(secp224r1), C(secp256k1), C(secp256r1), C(secp384r1) and C(secp521r1) + - Please note that all curves except V(secp224r1), V(secp256k1), V(secp256r1), V(secp384r1), and V(secp521r1) are discouraged for new private keys. type: str choices: @@ -76,13 +71,13 @@ options: type: str cipher: description: - - The cipher to encrypt the private key. Must be C(auto). + - The cipher to encrypt the private key. Must be V(auto). type: str select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography ] @@ -90,11 +85,11 @@ options: description: - Determines which format the private key is written in. By default, PKCS1 (traditional OpenSSL format) is used for all keys which support it. Please note that not every key can be exported in any format. - - The value C(auto) selects a format based on the key format. The value C(auto_ignore) does the same, + - The value V(auto) selects a format based on the key format. The value V(auto_ignore) does the same, but for existing private key files, it will not force a regenerate when its format is not the automatically selected one for generation. - Note that if the format for an existing private key mismatches, the key is B(regenerated) by default. - To change this behavior, use the I(format_mismatch) option. + To change this behavior, use the O(format_mismatch) option. type: str default: auto_ignore choices: [ pkcs1, pkcs8, raw, auto, auto_ignore ] @@ -102,8 +97,8 @@ options: description: - Determines behavior of the module if the format of a private key does not match the expected format, but all other parameters are as expected. - - If set to C(regenerate) (default), generates a new private key. - - If set to C(convert), the key will be converted to the new format instead. + - If set to V(regenerate) (default), generates a new private key. + - If set to V(convert), the key will be converted to the new format instead. - Only supported by the C(cryptography) backend. type: str default: regenerate @@ -114,24 +109,24 @@ options: The module will always generate a new key if the destination file does not exist. - By default, the key will be regenerated when it does not match the module's options, except when the key cannot be read or the passphrase does not match. Please note that - this B(changed) for Ansible 2.10. For Ansible 2.9, the behavior was as if C(full_idempotence) + this B(changed) for Ansible 2.10. For Ansible 2.9, the behavior was as if V(full_idempotence) is specified. - - If set to C(never), the module will fail if the key cannot be read or the passphrase + - If set to V(never), the module will fail if the key cannot be read or the passphrase is not matching, and will never regenerate an existing key. - - If set to C(fail), the module will fail if the key does not correspond to the module's + - If set to V(fail), the module will fail if the key does not correspond to the module's options. - - If set to C(partial_idempotence), the key will be regenerated if it does not conform to + - If set to V(partial_idempotence), the key will be regenerated if it does not conform to the module's options. The key is B(not) regenerated if it cannot be read (broken file), the key is protected by an unknown passphrase, or when they key is not protected by a passphrase, but a passphrase is specified. - - If set to C(full_idempotence), the key will be regenerated if it does not conform to the + - If set to V(full_idempotence), the key will be regenerated if it does not conform to the module's options. This is also the case if the key cannot be read (broken file), the key is protected by an unknown passphrase, or when they key is not protected by a passphrase, but a passphrase is specified. Make sure you have a B(backup) when using this option! - - If set to C(always), the module will always regenerate the key. This is equivalent to - setting I(force) to C(true). - - Note that if I(format_mismatch) is set to C(convert) and everything matches except the - format, the key will always be converted, except if I(regenerate) is set to C(always). + - If set to V(always), the module will always regenerate the key. This is equivalent to + setting O(force) to V(true). + - Note that if O(format_mismatch) is set to V(convert) and everything matches except the + format, the key will always be converted, except if O(regenerate) is set to V(always). type: str choices: - never diff --git a/ansible_collections/community/crypto/plugins/doc_fragments/module_privatekey_convert.py b/ansible_collections/community/crypto/plugins/doc_fragments/module_privatekey_convert.py index f1c6f70ec..973d1fe00 100644 --- a/ansible_collections/community/crypto/plugins/doc_fragments/module_privatekey_convert.py +++ b/ansible_collections/community/crypto/plugins/doc_fragments/module_privatekey_convert.py @@ -18,12 +18,12 @@ options: src_path: description: - Name of the file containing the OpenSSL private key to convert. - - Exactly one of I(src_path) or I(src_content) must be specified. + - Exactly one of O(src_path) or O(src_content) must be specified. type: path src_content: description: - The content of the file containing the OpenSSL private key to convert. - - Exactly one of I(src_path) or I(src_content) must be specified. + - Exactly one of O(src_path) or O(src_content) must be specified. type: str src_passphrase: description: diff --git a/ansible_collections/community/crypto/plugins/doc_fragments/name_encoding.py b/ansible_collections/community/crypto/plugins/doc_fragments/name_encoding.py index fec94380d..b51408530 100644 --- a/ansible_collections/community/crypto/plugins/doc_fragments/name_encoding.py +++ b/ansible_collections/community/crypto/plugins/doc_fragments/name_encoding.py @@ -14,12 +14,12 @@ options: name_encoding: description: - How to encode names (DNS names, URIs, email addresses) in return values. - - C(ignore) will use the encoding returned by the backend. - - C(idna) will convert all labels of domain names to IDNA encoding. + - V(ignore) will use the encoding returned by the backend. + - V(idna) will convert all labels of domain names to IDNA encoding. IDNA2008 will be preferred, and IDNA2003 will be used if IDNA2008 encoding fails. - - C(unicode) will convert all labels of domain names to Unicode. + - V(unicode) will convert all labels of domain names to Unicode. IDNA2008 will be preferred, and IDNA2003 will be used if IDNA2008 decoding fails. - - B(Note) that C(idna) and C(unicode) require the L(idna Python library,https://pypi.org/project/idna/) to be installed. + - B(Note) that V(idna) and V(unicode) require the L(idna Python library,https://pypi.org/project/idna/) to be installed. type: str default: ignore choices: @@ -27,5 +27,5 @@ options: - idna - unicode requirements: - - If I(name_encoding) is set to another value than C(ignore), the L(idna Python library,https://pypi.org/project/idna/) needs to be installed. + - If O(name_encoding) is set to another value than V(ignore), the L(idna Python library,https://pypi.org/project/idna/) needs to be installed. ''' diff --git a/ansible_collections/community/crypto/plugins/filter/gpg_fingerprint.py b/ansible_collections/community/crypto/plugins/filter/gpg_fingerprint.py new file mode 100644 index 000000000..bd9d21ecb --- /dev/null +++ b/ansible_collections/community/crypto/plugins/filter/gpg_fingerprint.py @@ -0,0 +1,68 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2023, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +DOCUMENTATION = """ +name: gpg_fingerprint +short_description: Retrieve a GPG fingerprint from a GPG public or private key +author: Felix Fontein (@felixfontein) +version_added: 2.15.0 +description: + - "Takes the content of a private or public GPG key as input and returns its fingerprint." +options: + _input: + description: + - The content of a GPG public or private key. + type: string + required: true +requirements: + - GnuPG (C(gpg) executable) +seealso: + - plugin: community.crypto.gpg_fingerprint + plugin_type: lookup +""" + +EXAMPLES = """ +- name: Show fingerprint of GPG public key + ansible.builtin.debug: + msg: "{{ lookup('file', '/path/to/public_key.gpg') | community.crypto.gpg_fingerprint }}" +""" + +RETURN = """ + _value: + description: + - The fingerprint of the provided public or private GPG key. + type: string +""" + +from ansible.errors import AnsibleFilterError +from ansible.module_utils.common.text.converters import to_bytes, to_native +from ansible.module_utils.six import string_types + +from ansible_collections.community.crypto.plugins.module_utils.gnupg.cli import GPGError, get_fingerprint_from_bytes +from ansible_collections.community.crypto.plugins.plugin_utils.gnupg import PluginGPGRunner + + +def gpg_fingerprint(input): + if not isinstance(input, string_types): + raise AnsibleFilterError( + 'The input for the community.crypto.gpg_fingerprint filter must be a string; got {type} instead'.format(type=type(input)) + ) + try: + gpg = PluginGPGRunner() + return get_fingerprint_from_bytes(gpg, to_bytes(input)) + except GPGError as exc: + raise AnsibleFilterError(to_native(exc)) + + +class FilterModule(object): + '''Ansible jinja2 filters''' + + def filters(self): + return { + 'gpg_fingerprint': gpg_fingerprint, + } diff --git a/ansible_collections/community/crypto/plugins/filter/openssl_csr_info.py b/ansible_collections/community/crypto/plugins/filter/openssl_csr_info.py index 851dfe2a4..c66f44b32 100644 --- a/ansible_collections/community/crypto/plugins/filter/openssl_csr_info.py +++ b/ansible_collections/community/crypto/plugins/filter/openssl_csr_info.py @@ -26,6 +26,8 @@ extends_documentation_fragment: - community.crypto.name_encoding seealso: - module: community.crypto.openssl_csr_info + - plugin: community.crypto.to_serial + plugin_type: filter ''' EXAMPLES = ''' @@ -49,11 +51,11 @@ _value: signature_valid: description: - Whether the CSR's signature is valid. - - In case the check returns C(false), the module will fail. + - In case the check returns V(false), the module will fail. returned: success type: bool basic_constraints: - description: Entries in the C(basic_constraints) extension, or C(none) if extension is not present. + description: Entries in the C(basic_constraints) extension, or V(none) if extension is not present. returned: success type: list elements: str @@ -63,7 +65,7 @@ _value: returned: success type: bool extended_key_usage: - description: Entries in the C(extended_key_usage) extension, or C(none) if extension is not present. + description: Entries in the C(extended_key_usage) extension, or V(none) if extension is not present. returned: success type: list elements: str @@ -94,7 +96,7 @@ _value: sample: "MAMCAQU=" sample: {"1.3.6.1.5.5.7.1.24": { "critical": false, "value": "MAMCAQU="}} key_usage: - description: Entries in the C(key_usage) extension, or C(none) if extension is not present. + description: Entries in the C(key_usage) extension, or V(none) if extension is not present. returned: success type: str sample: [Key Agreement, Data Encipherment] @@ -104,8 +106,8 @@ _value: type: bool subject_alt_name: description: - - Entries in the C(subject_alt_name) extension, or C(none) if extension is not present. - - See I(name_encoding) for how IDNs are handled. + - Entries in the C(subject_alt_name) extension, or V(none) if extension is not present. + - See O(name_encoding) for how IDNs are handled. returned: success type: list elements: str @@ -115,7 +117,7 @@ _value: returned: success type: bool ocsp_must_staple: - description: C(true) if the OCSP Must Staple extension is present, C(none) otherwise. + description: V(true) if the OCSP Must Staple extension is present, V(none) otherwise. returned: success type: bool ocsp_must_staple_critical: @@ -131,8 +133,8 @@ _value: name_constraints_excluded: description: - List of excluded subtrees the CA cannot sign certificates for. - - Is C(none) if extension is not present. - - See I(name_encoding) for how IDNs are handled. + - Is V(none) if extension is not present. + - See O(name_encoding) for how IDNs are handled. returned: success type: list elements: str @@ -140,7 +142,7 @@ _value: name_constraints_critical: description: - Whether the C(name_constraints) extension is critical. - - Is C(none) if extension is not present. + - Is V(none) if extension is not present. returned: success type: bool subject: @@ -164,7 +166,7 @@ _value: public_key_type: description: - The CSR's public key's type. - - One of C(RSA), C(DSA), C(ECC), C(Ed25519), C(X25519), C(Ed448), or C(X448). + - One of V(RSA), V(DSA), V(ECC), V(Ed25519), V(X25519), V(Ed448), or V(X448). - Will start with C(unknown) if the key type cannot be determined. returned: success type: str @@ -179,57 +181,58 @@ _value: description: - Bit size of modulus (RSA) or prime number (DSA). type: int - returned: When C(public_key_type=RSA) or C(public_key_type=DSA) + returned: When RV(_value.public_key_type=RSA) or RV(_value.public_key_type=DSA) modulus: description: - The RSA key's modulus. type: int - returned: When C(public_key_type=RSA) + returned: When RV(_value.public_key_type=RSA) exponent: description: - The RSA key's public exponent. type: int - returned: When C(public_key_type=RSA) + returned: When RV(_value.public_key_type=RSA) p: description: - The C(p) value for DSA. - This is the prime modulus upon which arithmetic takes place. type: int - returned: When C(public_key_type=DSA) + returned: When RV(_value.public_key_type=DSA) q: description: - The C(q) value for DSA. - This is a prime that divides C(p - 1), and at the same time the order of the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(public_key_type=DSA) + returned: When RV(_value.public_key_type=DSA) g: description: - The C(g) value for DSA. - This is the element spanning the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(public_key_type=DSA) + returned: When RV(_value.public_key_type=DSA) curve: description: - The curve's name for ECC. type: str - returned: When C(public_key_type=ECC) + returned: When RV(_value.public_key_type=ECC) exponent_size: description: - The maximum number of bits of a private key. This is basically the bit size of the subgroup used. type: int - returned: When C(public_key_type=ECC) + returned: When RV(_value.public_key_type=ECC) x: description: - The C(x) coordinate for the public point on the elliptic curve. type: int - returned: When C(public_key_type=ECC) + returned: When RV(_value.public_key_type=ECC) y: description: - - For C(public_key_type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. - - For C(public_key_type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. + - For RV(_value.public_key_type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. + - For RV(_value.public_key_type=DSA), this is the publicly known group element whose discrete logarithm with + respect to C(g) is the private key. type: int - returned: When C(public_key_type=DSA) or C(public_key_type=ECC) + returned: When RV(_value.public_key_type=DSA) or RV(_value.public_key_type=ECC) public_key_fingerprints: description: - Fingerprints of CSR's public key. @@ -241,24 +244,24 @@ _value: subject_key_identifier: description: - The CSR's subject key identifier. - - The identifier is returned in hexadecimal, with C(:) used to separate bytes. - - Is C(none) if the C(SubjectKeyIdentifier) extension is not present. + - The identifier is returned in hexadecimal, with V(:) used to separate bytes. + - Is V(none) if the C(SubjectKeyIdentifier) extension is not present. returned: success type: str sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33' authority_key_identifier: description: - The CSR's authority key identifier. - - The identifier is returned in hexadecimal, with C(:) used to separate bytes. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. + - The identifier is returned in hexadecimal, with V(:) used to separate bytes. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. returned: success type: str sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33' authority_cert_issuer: description: - The CSR's authority cert issuer as a list of general names. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. - - See I(name_encoding) for how IDNs are handled. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. + - See O(name_encoding) for how IDNs are handled. returned: success type: list elements: str @@ -266,7 +269,9 @@ _value: authority_cert_serial_number: description: - The CSR's authority cert serial number. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. + - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, + such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). returned: success type: int sample: 12345 diff --git a/ansible_collections/community/crypto/plugins/filter/openssl_privatekey_info.py b/ansible_collections/community/crypto/plugins/filter/openssl_privatekey_info.py index 16dfd8597..5ad928e2b 100644 --- a/ansible_collections/community/crypto/plugins/filter/openssl_privatekey_info.py +++ b/ansible_collections/community/crypto/plugins/filter/openssl_privatekey_info.py @@ -29,7 +29,7 @@ options: return_private_key_data: description: - Whether to return private key data. - - Only set this to C(true) when you want private information about this key to + - Only set this to V(true) when you want private information about this key to be extracted. - "B(WARNING:) you have to make sure that private key data is not accidentally logged!" type: bool @@ -74,8 +74,8 @@ _value: type: description: - The key's type. - - One of C(RSA), C(DSA), C(ECC), C(Ed25519), C(X25519), C(Ed448), or C(X448). - - Will start with C(unknown) if the key type cannot be determined. + - One of V(RSA), V(DSA), V(ECC), V(Ed25519), V(X25519), V(Ed448), or V(X448). + - Will start with V(unknown) if the key type cannot be determined. returned: success type: str sample: RSA @@ -89,61 +89,62 @@ _value: description: - Bit size of modulus (RSA) or prime number (DSA). type: int - returned: When C(type=RSA) or C(type=DSA) + returned: When RV(_value.type=RSA) or RV(_value.type=DSA) modulus: description: - The RSA key's modulus. type: int - returned: When C(type=RSA) + returned: When RV(_value.type=RSA) exponent: description: - The RSA key's public exponent. type: int - returned: When C(type=RSA) + returned: When RV(_value.type=RSA) p: description: - The C(p) value for DSA. - This is the prime modulus upon which arithmetic takes place. type: int - returned: When C(type=DSA) + returned: When RV(_value.type=DSA) q: description: - The C(q) value for DSA. - This is a prime that divides C(p - 1), and at the same time the order of the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(type=DSA) + returned: When RV(_value.type=DSA) g: description: - The C(g) value for DSA. - This is the element spanning the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(type=DSA) + returned: When RV(_value.type=DSA) curve: description: - The curve's name for ECC. type: str - returned: When C(type=ECC) + returned: When RV(_value.type=ECC) exponent_size: description: - The maximum number of bits of a private key. This is basically the bit size of the subgroup used. type: int - returned: When C(type=ECC) + returned: When RV(_value.type=ECC) x: description: - The C(x) coordinate for the public point on the elliptic curve. type: int - returned: When C(type=ECC) + returned: When RV(_value.type=ECC) y: description: - - For C(type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. - - For C(type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. + - For RV(_value.type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. + - For RV(_value.type=DSA), this is the publicly known group element whose discrete logarithm with + respect to C(g) is the private key. type: int - returned: When C(type=DSA) or C(type=ECC) + returned: When RV(_value.type=DSA) or RV(_value.type=ECC) private_data: description: - Private key data. Depends on key type. - returned: success and when I(return_private_key_data) is set to C(true) + returned: success and when O(return_private_key_data) is set to V(true) type: dict ''' diff --git a/ansible_collections/community/crypto/plugins/filter/openssl_publickey_info.py b/ansible_collections/community/crypto/plugins/filter/openssl_publickey_info.py index f41af1c79..c9994e867 100644 --- a/ansible_collections/community/crypto/plugins/filter/openssl_publickey_info.py +++ b/ansible_collections/community/crypto/plugins/filter/openssl_publickey_info.py @@ -55,8 +55,8 @@ _value: type: description: - The key's type. - - One of C(RSA), C(DSA), C(ECC), C(Ed25519), C(X25519), C(Ed448), or C(X448). - - Will start with C(unknown) if the key type cannot be determined. + - One of V(RSA), V(DSA), V(ECC), V(Ed25519), V(X25519), V(Ed448), or V(X448). + - Will start with V(unknown) if the key type cannot be determined. returned: success type: str sample: RSA @@ -70,57 +70,58 @@ _value: description: - Bit size of modulus (RSA) or prime number (DSA). type: int - returned: When C(type=RSA) or C(type=DSA) + returned: When RV(_value.type=RSA) or RV(_value.type=DSA) modulus: description: - The RSA key's modulus. type: int - returned: When C(type=RSA) + returned: When RV(_value.type=RSA) exponent: description: - The RSA key's public exponent. type: int - returned: When C(type=RSA) + returned: When RV(_value.type=RSA) p: description: - The C(p) value for DSA. - This is the prime modulus upon which arithmetic takes place. type: int - returned: When C(type=DSA) + returned: When RV(_value.type=DSA) q: description: - The C(q) value for DSA. - This is a prime that divides C(p - 1), and at the same time the order of the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(type=DSA) + returned: When RV(_value.type=DSA) g: description: - The C(g) value for DSA. - This is the element spanning the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(type=DSA) + returned: When RV(_value.type=DSA) curve: description: - The curve's name for ECC. type: str - returned: When C(type=ECC) + returned: When RV(_value.type=ECC) exponent_size: description: - The maximum number of bits of a private key. This is basically the bit size of the subgroup used. type: int - returned: When C(type=ECC) + returned: When RV(_value.type=ECC) x: description: - The C(x) coordinate for the public point on the elliptic curve. type: int - returned: When C(type=ECC) + returned: When RV(_value.type=ECC) y: description: - - For C(type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. - - For C(type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. + - For RV(_value.type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. + - For RV(_value.type=DSA), this is the publicly known group element whose discrete logarithm with + respect to C(g) is the private key. type: int - returned: When C(type=DSA) or C(type=ECC) + returned: When RV(_value.type=DSA) or RV(_value.type=ECC) ''' from ansible.errors import AnsibleFilterError diff --git a/ansible_collections/community/crypto/plugins/filter/parse_serial.py b/ansible_collections/community/crypto/plugins/filter/parse_serial.py new file mode 100644 index 000000000..f78dc45d9 --- /dev/null +++ b/ansible_collections/community/crypto/plugins/filter/parse_serial.py @@ -0,0 +1,66 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2024, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +DOCUMENTATION = """ +name: parse_serial +short_description: Convert a serial number as a colon-separated list of hex numbers to an integer +author: Felix Fontein (@felixfontein) +version_added: 2.18.0 +description: + - "Parses a colon-separated list of hex numbers of the form C(00:11:22:33) and returns the corresponding integer." +options: + _input: + description: + - A serial number represented as a colon-separated list of hex numbers between 0 and 255. + - These numbers are interpreted as the byte presentation of an unsigned integer in network byte order. + That is, C(01:00) is interpreted as the integer 256. + type: string + required: true +seealso: + - plugin: community.crypto.to_serial + plugin_type: filter +""" + +EXAMPLES = """ +- name: Parse serial number + ansible.builtin.debug: + msg: "{{ '11:22:33' | community.crypto.parse_serial }}" +""" + +RETURN = """ + _value: + description: + - The serial number as an integer. + type: int +""" + +from ansible.errors import AnsibleFilterError +from ansible.module_utils.common.text.converters import to_native +from ansible.module_utils.six import string_types + +from ansible_collections.community.crypto.plugins.module_utils.serial import parse_serial + + +def parse_serial_filter(input): + if not isinstance(input, string_types): + raise AnsibleFilterError( + 'The input for the community.crypto.parse_serial filter must be a string; got {type} instead'.format(type=type(input)) + ) + try: + return parse_serial(to_native(input)) + except ValueError as exc: + raise AnsibleFilterError(to_native(exc)) + + +class FilterModule(object): + '''Ansible jinja2 filters''' + + def filters(self): + return { + 'parse_serial': parse_serial_filter, + } diff --git a/ansible_collections/community/crypto/plugins/filter/to_serial.py b/ansible_collections/community/crypto/plugins/filter/to_serial.py new file mode 100644 index 000000000..78f337fdd --- /dev/null +++ b/ansible_collections/community/crypto/plugins/filter/to_serial.py @@ -0,0 +1,68 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2024, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +DOCUMENTATION = """ +name: to_serial +short_description: Convert an integer to a colon-separated list of hex numbers +author: Felix Fontein (@felixfontein) +version_added: 2.18.0 +description: + - "Converts an integer to a colon-separated list of hex numbers of the form C(00:11:22:33)." +options: + _input: + description: + - The non-negative integer to convert. + type: int + required: true +seealso: + - plugin: community.crypto.to_serial + plugin_type: filter +""" + +EXAMPLES = """ +- name: Convert integer to serial number + ansible.builtin.debug: + msg: "{{ 1234567 | community.crypto.to_serial }}" +""" + +RETURN = """ + _value: + description: + - A colon-separated list of hexadecimal numbers. + - Letters are upper-case, and all numbers have exactly two digits. + - The string is never empty. The representation of C(0) is C("00"). + type: string +""" + +from ansible.errors import AnsibleFilterError +from ansible.module_utils.common.text.converters import to_native +from ansible.module_utils.six import integer_types + +from ansible_collections.community.crypto.plugins.module_utils.serial import to_serial + + +def to_serial_filter(input): + if not isinstance(input, integer_types): + raise AnsibleFilterError( + 'The input for the community.crypto.to_serial filter must be an integer; got {type} instead'.format(type=type(input)) + ) + if input < 0: + raise AnsibleFilterError('The input for the community.crypto.to_serial filter must not be negative') + try: + return to_serial(input) + except ValueError as exc: + raise AnsibleFilterError(to_native(exc)) + + +class FilterModule(object): + '''Ansible jinja2 filters''' + + def filters(self): + return { + 'to_serial': to_serial_filter, + } diff --git a/ansible_collections/community/crypto/plugins/filter/x509_certificate_info.py b/ansible_collections/community/crypto/plugins/filter/x509_certificate_info.py index 21aee98a9..7a18c2c0b 100644 --- a/ansible_collections/community/crypto/plugins/filter/x509_certificate_info.py +++ b/ansible_collections/community/crypto/plugins/filter/x509_certificate_info.py @@ -26,6 +26,8 @@ extends_documentation_fragment: - community.crypto.name_encoding seealso: - module: community.crypto.x509_certificate_info + - plugin: community.crypto.to_serial + plugin_type: filter ''' EXAMPLES = ''' @@ -51,7 +53,7 @@ _value: returned: success type: bool basic_constraints: - description: Entries in the C(basic_constraints) extension, or C(none) if extension is not present. + description: Entries in the C(basic_constraints) extension, or V(none) if extension is not present. returned: success type: list elements: str @@ -61,7 +63,7 @@ _value: returned: success type: bool extended_key_usage: - description: Entries in the C(extended_key_usage) extension, or C(none) if extension is not present. + description: Entries in the C(extended_key_usage) extension, or V(none) if extension is not present. returned: success type: list elements: str @@ -92,7 +94,7 @@ _value: sample: "MAMCAQU=" sample: {"1.3.6.1.5.5.7.1.24": { "critical": false, "value": "MAMCAQU="}} key_usage: - description: Entries in the C(key_usage) extension, or C(none) if extension is not present. + description: Entries in the C(key_usage) extension, or V(none) if extension is not present. returned: success type: str sample: [Key Agreement, Data Encipherment] @@ -102,8 +104,8 @@ _value: type: bool subject_alt_name: description: - - Entries in the C(subject_alt_name) extension, or C(none) if extension is not present. - - See I(name_encoding) for how IDNs are handled. + - Entries in the C(subject_alt_name) extension, or V(none) if extension is not present. + - See O(name_encoding) for how IDNs are handled. returned: success type: list elements: str @@ -113,7 +115,7 @@ _value: returned: success type: bool ocsp_must_staple: - description: C(true) if the OCSP Must Staple extension is present, C(none) otherwise. + description: V(true) if the OCSP Must Staple extension is present, V(none) otherwise. returned: success type: bool ocsp_must_staple_critical: @@ -164,8 +166,8 @@ _value: public_key_type: description: - The certificate's public key's type. - - One of C(RSA), C(DSA), C(ECC), C(Ed25519), C(X25519), C(Ed448), or C(X448). - - Will start with C(unknown) if the key type cannot be determined. + - One of V(RSA), V(DSA), V(ECC), V(Ed25519), V(X25519), V(Ed448), or V(X448). + - Will start with V(unknown) if the key type cannot be determined. returned: success type: str sample: RSA @@ -179,57 +181,58 @@ _value: description: - Bit size of modulus (RSA) or prime number (DSA). type: int - returned: When C(public_key_type=RSA) or C(public_key_type=DSA) + returned: When RV(_value.public_key_type=RSA) or RV(_value.public_key_type=DSA) modulus: description: - The RSA key's modulus. type: int - returned: When C(public_key_type=RSA) + returned: When RV(_value.public_key_type=RSA) exponent: description: - The RSA key's public exponent. type: int - returned: When C(public_key_type=RSA) + returned: When RV(_value.public_key_type=RSA) p: description: - The C(p) value for DSA. - This is the prime modulus upon which arithmetic takes place. type: int - returned: When C(public_key_type=DSA) + returned: When RV(_value.public_key_type=DSA) q: description: - The C(q) value for DSA. - This is a prime that divides C(p - 1), and at the same time the order of the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(public_key_type=DSA) + returned: When RV(_value.public_key_type=DSA) g: description: - The C(g) value for DSA. - This is the element spanning the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(public_key_type=DSA) + returned: When RV(_value.public_key_type=DSA) curve: description: - The curve's name for ECC. type: str - returned: When C(public_key_type=ECC) + returned: When RV(_value.public_key_type=ECC) exponent_size: description: - The maximum number of bits of a private key. This is basically the bit size of the subgroup used. type: int - returned: When C(public_key_type=ECC) + returned: When RV(_value.public_key_type=ECC) x: description: - The C(x) coordinate for the public point on the elliptic curve. type: int - returned: When C(public_key_type=ECC) + returned: When RV(_value.public_key_type=ECC) y: description: - - For C(public_key_type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. - - For C(public_key_type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. + - For RV(_value.public_key_type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. + - For RV(_value.public_key_type=DSA), this is the publicly known group element whose discrete logarithm with + respect to C(g) is the private key. type: int - returned: When C(public_key_type=DSA) or C(public_key_type=ECC) + returned: When RV(_value.public_key_type=DSA) or RV(_value.public_key_type=ECC) public_key_fingerprints: description: - Fingerprints of certificate's public key. @@ -252,7 +255,10 @@ _value: type: str sample: sha256WithRSAEncryption serial_number: - description: The certificate's serial number. + description: + - The certificate's serial number. + - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, + such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). returned: success type: int sample: 1234 @@ -264,24 +270,24 @@ _value: subject_key_identifier: description: - The certificate's subject key identifier. - - The identifier is returned in hexadecimal, with C(:) used to separate bytes. - - Is C(none) if the C(SubjectKeyIdentifier) extension is not present. + - The identifier is returned in hexadecimal, with V(:) used to separate bytes. + - Is V(none) if the C(SubjectKeyIdentifier) extension is not present. returned: success type: str sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33' authority_key_identifier: description: - The certificate's authority key identifier. - - The identifier is returned in hexadecimal, with C(:) used to separate bytes. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. + - The identifier is returned in hexadecimal, with V(:) used to separate bytes. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. returned: success type: str sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33' authority_cert_issuer: description: - The certificate's authority cert issuer as a list of general names. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. - - See I(name_encoding) for how IDNs are handled. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. + - See O(name_encoding) for how IDNs are handled. returned: success type: list elements: str @@ -289,18 +295,20 @@ _value: authority_cert_serial_number: description: - The certificate's authority cert serial number. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. + - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, + such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). returned: success type: int sample: 12345 ocsp_uri: description: The OCSP responder URI, if included in the certificate. Will be - C(none) if no OCSP responder URI is included. + V(none) if no OCSP responder URI is included. returned: success type: str issuer_uri: description: The Issuer URI, if included in the certificate. Will be - C(none) if no issuer URI is included. + V(none) if no issuer URI is included. returned: success type: str ''' diff --git a/ansible_collections/community/crypto/plugins/filter/x509_crl_info.py b/ansible_collections/community/crypto/plugins/filter/x509_crl_info.py index 11f61fd8a..db1dc5369 100644 --- a/ansible_collections/community/crypto/plugins/filter/x509_crl_info.py +++ b/ansible_collections/community/crypto/plugins/filter/x509_crl_info.py @@ -24,7 +24,7 @@ options: required: true list_revoked_certificates: description: - - If set to C(false), the list of revoked certificates is not included in the result. + - If set to V(false), the list of revoked certificates is not included in the result. - This is useful when retrieving information on large CRL files. Enumerating all revoked certificates can take some time, including serializing the result as JSON, sending it to the Ansible controller, and decoding it again. @@ -35,6 +35,8 @@ extends_documentation_fragment: - community.crypto.name_encoding seealso: - module: community.crypto.x509_crl_info + - plugin: community.crypto.to_serial + plugin_type: filter ''' EXAMPLES = ''' @@ -57,15 +59,18 @@ _value: contains: format: description: - - Whether the CRL is in PEM format (C(pem)) or in DER format (C(der)). + - Whether the CRL is in PEM format (V(pem)) or in DER format (V(der)). returned: success type: str sample: pem + choices: + - pem + - der issuer: description: - The CRL's issuer. - Note that for repeated values, only the last one will be returned. - - See I(name_encoding) for how IDNs are handled. + - See O(name_encoding) for how IDNs are handled. returned: success type: dict sample: {"organizationName": "Ansible", "commonName": "ca.example.com"} @@ -92,12 +97,15 @@ _value: sample: sha256WithRSAEncryption revoked_certificates: description: List of certificates to be revoked. - returned: success if I(list_revoked_certificates=true) + returned: success if O(list_revoked_certificates=true) type: list elements: dict contains: serial_number: - description: Serial number of the certificate. + description: + - Serial number of the certificate. + - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, + such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). type: int sample: 1234 revocation_date: @@ -107,7 +115,7 @@ _value: issuer: description: - The certificate's issuer. - - See I(name_encoding) for how IDNs are handled. + - See O(name_encoding) for how IDNs are handled. type: list elements: str sample: ["DNS:ca.example.org"] @@ -118,11 +126,19 @@ _value: reason: description: - The value for the revocation reason extension. - - One of C(unspecified), C(key_compromise), C(ca_compromise), C(affiliation_changed), C(superseded), - C(cessation_of_operation), C(certificate_hold), C(privilege_withdrawn), C(aa_compromise), and - C(remove_from_crl). type: str sample: key_compromise + choices: + - unspecified + - key_compromise + - ca_compromise + - affiliation_changed + - superseded + - cessation_of_operation + - certificate_hold + - privilege_withdrawn + - aa_compromise + - remove_from_crl reason_critical: description: Whether the revocation reason extension is critical. type: bool diff --git a/ansible_collections/community/crypto/plugins/lookup/gpg_fingerprint.py b/ansible_collections/community/crypto/plugins/lookup/gpg_fingerprint.py new file mode 100644 index 000000000..c562faed8 --- /dev/null +++ b/ansible_collections/community/crypto/plugins/lookup/gpg_fingerprint.py @@ -0,0 +1,64 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2023, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +DOCUMENTATION = """ +name: gpg_fingerprint +short_description: Retrieve a GPG fingerprint from a GPG public or private key file +author: Felix Fontein (@felixfontein) +version_added: 2.15.0 +description: + - "Takes a list of filenames pointing to GPG public or private key files. Returns the fingerprints for each of these keys." +options: + _terms: + description: + - A path to a GPG public or private key. + type: list + elements: path + required: true +requirements: + - GnuPG (C(gpg) executable) +seealso: + - plugin: community.crypto.gpg_fingerprint + plugin_type: filter +""" + +EXAMPLES = """ +- name: Show fingerprint of GPG public key + ansible.builtin.debug: + msg: "{{ lookup('community.crypto.gpg_fingerprint', '/path/to/public_key.gpg') }}" +""" + +RETURN = """ + _value: + description: + - The fingerprints of the provided public or private GPG keys. + - The list has one entry for every path provided. + type: list + elements: string +""" + +from ansible.plugins.lookup import LookupBase +from ansible.errors import AnsibleLookupError +from ansible.module_utils.common.text.converters import to_native + +from ansible_collections.community.crypto.plugins.module_utils.gnupg.cli import GPGError, get_fingerprint_from_file +from ansible_collections.community.crypto.plugins.plugin_utils.gnupg import PluginGPGRunner + + +class LookupModule(LookupBase): + def run(self, terms, variables=None, **kwargs): + self.set_options(direct=kwargs) + + try: + gpg = PluginGPGRunner(cwd=self._loader.get_basedir()) + result = [] + for path in terms: + result.append(get_fingerprint_from_file(gpg, path)) + return result + except GPGError as exc: + raise AnsibleLookupError(to_native(exc)) diff --git a/ansible_collections/community/crypto/plugins/module_utils/acme/account.py b/ansible_collections/community/crypto/plugins/module_utils/acme/account.py index de5eb171d..0ad58e920 100644 --- a/ansible_collections/community/crypto/plugins/module_utils/acme/account.py +++ b/ansible_collections/community/crypto/plugins/module_utils/acme/account.py @@ -9,6 +9,8 @@ from __future__ import absolute_import, division, print_function __metaclass__ = type +from ansible.module_utils.common._collections_compat import Mapping + from ansible_collections.community.crypto.plugins.module_utils.acme.errors import ( ACMEProtocolException, ModuleFailException, @@ -96,6 +98,9 @@ class ACMEAccount(object): ) result, info = self.client.send_signed_request(url, new_reg, fail_on_error=False) + if not isinstance(result, Mapping): + raise ACMEProtocolException( + self.client.module, msg='Invalid account creation reply from ACME server', info=info, content=result) if info['status'] in ([200, 201] if self.client.version == 1 else [201]): # Account did not exist @@ -118,8 +123,10 @@ class ACMEAccount(object): if 'location' in info: self.client.set_account_uri(info['location']) return False, result - elif info['status'] == 400 and result['type'] == 'urn:ietf:params:acme:error:accountDoesNotExist' and not allow_creation: + elif info['status'] in (400, 404) and result['type'] == 'urn:ietf:params:acme:error:accountDoesNotExist' and not allow_creation: # Account does not exist (and we did not try to create it) + # (According to RFC 8555, Section 7.3.1, the HTTP status code MUST be 400. + # Unfortunately Digicert does not care and sends 404 instead.) return False, None elif info['status'] == 403 and result['type'] == 'urn:ietf:params:acme:error:unauthorized' and 'deactivated' in (result.get('detail') or ''): # Account has been deactivated; currently works for Pebble; has not been @@ -154,6 +161,9 @@ class ACMEAccount(object): # retry as a regular POST (with no changed data) for pre-draft-15 ACME servers data = {} result, info = self.client.send_signed_request(self.client.account_uri, data, fail_on_error=False) + if not isinstance(result, Mapping): + raise ACMEProtocolException( + self.client.module, msg='Invalid account data retrieved from ACME server', info=info, content=result) if info['status'] in (400, 403) and result.get('type') == 'urn:ietf:params:acme:error:unauthorized': # Returned when account is deactivated return None @@ -248,5 +258,9 @@ class ACMEAccount(object): else: if self.client.version == 1: update_request['resource'] = 'reg' - account_data, dummy = self.client.send_signed_request(self.client.account_uri, update_request) + account_data, info = self.client.send_signed_request(self.client.account_uri, update_request) + if not isinstance(account_data, Mapping): + raise ACMEProtocolException( + self.client.module, msg='Invalid account updating reply from ACME server', info=info, content=account_data) + return True, account_data diff --git a/ansible_collections/community/crypto/plugins/module_utils/acme/acme.py b/ansible_collections/community/crypto/plugins/module_utils/acme/acme.py index c054a52f6..74d0bc1ea 100644 --- a/ansible_collections/community/crypto/plugins/module_utils/acme/acme.py +++ b/ansible_collections/community/crypto/plugins/module_utils/acme/acme.py @@ -55,15 +55,19 @@ else: IPADDRESS_IMPORT_ERROR = None -RETRY_STATUS_CODES = (408, 429, 503) +# -1 usually means connection problems +RETRY_STATUS_CODES = (-1, 408, 429, 503) + +RETRY_COUNT = 10 def _decode_retry(module, response, info, retry_count): if info['status'] not in RETRY_STATUS_CODES: return False - if retry_count >= 5: - raise ACMEProtocolException(module, msg='Giving up after 5 retries', info=info, response=response) + if retry_count >= RETRY_COUNT: + raise ACMEProtocolException( + module, msg='Giving up after {retry} retries'.format(retry=RETRY_COUNT), info=info, response=response) # 429 and 503 should have a Retry-After header (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Retry-After) try: diff --git a/ansible_collections/community/crypto/plugins/module_utils/acme/backend_cryptography.py b/ansible_collections/community/crypto/plugins/module_utils/acme/backend_cryptography.py index 207f743f1..2e388980a 100644 --- a/ansible_collections/community/crypto/plugins/module_utils/acme/backend_cryptography.py +++ b/ansible_collections/community/crypto/plugins/module_utils/acme/backend_cryptography.py @@ -13,7 +13,6 @@ import base64 import binascii import datetime import os -import sys import traceback from ansible.module_utils.common.text.converters import to_bytes, to_native, to_text @@ -37,6 +36,11 @@ from ansible_collections.community.crypto.plugins.module_utils.acme.io import re from ansible_collections.community.crypto.plugins.module_utils.acme.utils import nopad_b64 +from ansible_collections.community.crypto.plugins.module_utils.crypto.math import ( + convert_int_to_bytes, + convert_int_to_hex, +) + from ansible_collections.community.crypto.plugins.module_utils.crypto.support import ( parse_name_field, ) @@ -78,40 +82,6 @@ else: CRYPTOGRAPHY_ERROR = traceback.format_exc() -if sys.version_info[0] >= 3: - # Python 3 (and newer) - def _count_bytes(n): - return (n.bit_length() + 7) // 8 if n > 0 else 0 - - def _convert_int_to_bytes(count, no): - return no.to_bytes(count, byteorder='big') - - def _pad_hex(n, digits): - res = hex(n)[2:] - if len(res) < digits: - res = '0' * (digits - len(res)) + res - return res -else: - # Python 2 - def _count_bytes(n): - if n <= 0: - return 0 - h = '%x' % n - return (len(h) + 1) // 2 - - def _convert_int_to_bytes(count, n): - h = '%x' % n - if len(h) > 2 * count: - raise Exception('Number {1} needs more than {0} bytes!'.format(count, n)) - return ('0' * (2 * count - len(h)) + h).decode('hex') - - def _pad_hex(n, digits): - h = '%x' % n - if len(h) < digits: - h = '0' * (digits - len(h)) + h - return h - - class CryptographyChainMatcher(ChainMatcher): @staticmethod def _parse_key_identifier(key_identifier, name, criterium_idx, module): @@ -223,8 +193,8 @@ class CryptographyBackend(CryptoBackend): 'alg': 'RS256', 'jwk': { "kty": "RSA", - "e": nopad_b64(_convert_int_to_bytes(_count_bytes(pk.e), pk.e)), - "n": nopad_b64(_convert_int_to_bytes(_count_bytes(pk.n), pk.n)), + "e": nopad_b64(convert_int_to_bytes(pk.e)), + "n": nopad_b64(convert_int_to_bytes(pk.n)), }, 'hash': 'sha256', } @@ -260,8 +230,8 @@ class CryptographyBackend(CryptoBackend): 'jwk': { "kty": "EC", "crv": curve, - "x": nopad_b64(_convert_int_to_bytes(num_bytes, pk.x)), - "y": nopad_b64(_convert_int_to_bytes(num_bytes, pk.y)), + "x": nopad_b64(convert_int_to_bytes(pk.x, count=num_bytes)), + "y": nopad_b64(convert_int_to_bytes(pk.y, count=num_bytes)), }, 'hash': hashalg, 'point_size': point_size, @@ -288,8 +258,8 @@ class CryptographyBackend(CryptoBackend): hashalg = cryptography.hazmat.primitives.hashes.SHA512 ecdsa = cryptography.hazmat.primitives.asymmetric.ec.ECDSA(hashalg()) r, s = cryptography.hazmat.primitives.asymmetric.utils.decode_dss_signature(key_data['key_obj'].sign(sign_payload, ecdsa)) - rr = _pad_hex(r, 2 * key_data['point_size']) - ss = _pad_hex(s, 2 * key_data['point_size']) + rr = convert_int_to_hex(r, 2 * key_data['point_size']) + ss = convert_int_to_hex(s, 2 * key_data['point_size']) signature = binascii.unhexlify(rr) + binascii.unhexlify(ss) return { diff --git a/ansible_collections/community/crypto/plugins/module_utils/acme/errors.py b/ansible_collections/community/crypto/plugins/module_utils/acme/errors.py index 208a1ae4f..c29831be2 100644 --- a/ansible_collections/community/crypto/plugins/module_utils/acme/errors.py +++ b/ansible_collections/community/crypto/plugins/module_utils/acme/errors.py @@ -21,13 +21,14 @@ def format_http_status(status_code): def format_error_problem(problem, subproblem_prefix=''): + error_type = problem.get('type', 'about:blank') # https://www.rfc-editor.org/rfc/rfc7807#section-3.1 if 'title' in problem: msg = 'Error "{title}" ({type})'.format( - type=problem['type'], + type=error_type, title=problem['title'], ) else: - msg = 'Error {type}'.format(type=problem['type']) + msg = 'Error {type}'.format(type=error_type) if 'detail' in problem: msg += ': "{detail}"'.format(detail=problem['detail']) subproblems = problem.get('subproblems') @@ -95,10 +96,12 @@ class ACMEProtocolException(ModuleFailException): extras['http_status'] = code if code is not None and code >= 400 and content_json is not None and 'type' in content_json: if 'status' in content_json and content_json['status'] != code: - code = 'status {problem_code} (HTTP status: {http_code})'.format( + code_msg = 'status {problem_code} (HTTP status: {http_code})'.format( http_code=format_http_status(code), problem_code=content_json['status']) else: - code = 'status {problem_code}'.format(problem_code=format_http_status(code)) + code_msg = 'status {problem_code}'.format(problem_code=format_http_status(code)) + if code == -1 and info.get('msg'): + code_msg = 'error: {msg}'.format(msg=info['msg']) subproblems = content_json.pop('subproblems', None) add_msg = ' {problem}.'.format(problem=format_error_problem(content_json)) extras['problem'] = content_json @@ -112,12 +115,14 @@ class ACMEProtocolException(ModuleFailException): problem=format_error_problem(problem, subproblem_prefix='{0}.'.format(index)), ) else: - code = 'HTTP status {code}'.format(code=format_http_status(code)) + code_msg = 'HTTP status {code}'.format(code=format_http_status(code)) + if code == -1 and info.get('msg'): + code_msg = 'error: {msg}'.format(msg=info['msg']) if content_json is not None: add_msg = ' The JSON error result: {content}'.format(content=content_json) elif content is not None: add_msg = ' The raw error result: {content}'.format(content=to_text(content)) - msg = '{msg} for {url} with {code}'.format(msg=msg, url=url, code=format_http_status(code)) + msg = '{msg} for {url} with {code}'.format(msg=msg, url=url, code=code_msg) elif content_json is not None: add_msg = ' The JSON result: {content}'.format(content=content_json) elif content is not None: diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_support.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_support.py index fde691997..b767d3417 100644 --- a/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_support.py +++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_support.py @@ -114,7 +114,7 @@ def cryptography_get_extensions_from_cert(cert): try: # Since cryptography will not give us the DER value for an extension # (that is only stored for unrecognized extensions), we have to re-do - # the extension parsing outselves. + # the extension parsing ourselves. backend = default_backend() try: # For certain old versions of cryptography, backend is a MultiBackend object, @@ -166,7 +166,7 @@ def cryptography_get_extensions_from_csr(csr): try: # Since cryptography will not give us the DER value for an extension # (that is only stored for unrecognized extensions), we have to re-do - # the extension parsing outselves. + # the extension parsing ourselves. backend = default_backend() try: # For certain old versions of cryptography, backend is a MultiBackend object, diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/math.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/math.py index 1cfe38b99..f56f22d33 100644 --- a/ansible_collections/community/crypto/plugins/module_utils/crypto/math.py +++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/math.py @@ -54,17 +54,93 @@ def quick_is_not_prime(n): python_version = (sys.version_info[0], sys.version_info[1]) if python_version >= (2, 7) or python_version >= (3, 1): # Ansible still supports Python 2.6 on remote nodes + + def count_bytes(no): + """ + Given an integer, compute the number of bytes necessary to store its absolute value. + """ + no = abs(no) + if no == 0: + return 0 + return (no.bit_length() + 7) // 8 + def count_bits(no): + """ + Given an integer, compute the number of bits necessary to store its absolute value. + """ no = abs(no) if no == 0: return 0 return no.bit_length() else: # Slow, but works + def count_bytes(no): + """ + Given an integer, compute the number of bytes necessary to store its absolute value. + """ + no = abs(no) + count = 0 + while no > 0: + no >>= 8 + count += 1 + return count + def count_bits(no): + """ + Given an integer, compute the number of bits necessary to store its absolute value. + """ no = abs(no) count = 0 while no > 0: no >>= 1 count += 1 return count + +if sys.version_info[0] >= 3: + # Python 3 (and newer) + def _convert_int_to_bytes(count, no): + return no.to_bytes(count, byteorder='big') + + def _to_hex(no): + return hex(no)[2:] +else: + # Python 2 + def _convert_int_to_bytes(count, n): + h = '%x' % n + if len(h) > 2 * count: + raise Exception('Number {1} needs more than {0} bytes!'.format(count, n)) + return ('0' * (2 * count - len(h)) + h).decode('hex') + + def _to_hex(no): + return '%x' % no + + +def convert_int_to_bytes(no, count=None): + """ + Convert the absolute value of an integer to a byte string in network byte order. + + If ``count`` is provided, it must be sufficiently large so that the integer's + absolute value can be represented with these number of bytes. The resulting byte + string will have length exactly ``count``. + + The value zero will be converted to an empty byte string if ``count`` is provided. + """ + no = abs(no) + if count is None: + count = count_bytes(no) + return _convert_int_to_bytes(count, no) + + +def convert_int_to_hex(no, digits=None): + """ + Convert the absolute value of an integer to a string of hexadecimal digits. + + If ``digits`` is provided, the string will be padded on the left with ``0``s so + that the returned value has length ``digits``. If ``digits`` is not sufficient, + the string will be longer. + """ + no = abs(no) + value = _to_hex(no) + if digits is not None and len(value) < digits: + value = '0' * (digits - len(value)) + value + return value diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/privatekey_convert.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/privatekey_convert.py index 905ca70fe..fdcc901e0 100644 --- a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/privatekey_convert.py +++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/privatekey_convert.py @@ -106,7 +106,7 @@ class PrivateKeyConvertBackend: @abc.abstractmethod def _load_private_key(self, data, passphrase, current_hint=None): - """Check whether data cna be loaded as a private key with the provided passphrase. Return tuple (type, private_key).""" + """Check whether data can be loaded as a private key with the provided passphrase. Return tuple (type, private_key).""" pass def needs_conversion(self): diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/privatekey_info.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/privatekey_info.py index d87b9c2be..f44caaa78 100644 --- a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/privatekey_info.py +++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/privatekey_info.py @@ -105,9 +105,12 @@ def _check_dsa_consistency(key_public_data, key_private_data): return True -def _is_cryptography_key_consistent(key, key_public_data, key_private_data): +def _is_cryptography_key_consistent(key, key_public_data, key_private_data, warn_func=None): if isinstance(key, cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey): - return bool(key._backend._lib.RSA_check_key(key._rsa_cdata)) + # key._backend was removed in cryptography 42.0.0 + backend = getattr(key, '_backend', None) + if backend is not None: + return bool(backend._lib.RSA_check_key(key._rsa_cdata)) if isinstance(key, cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey): result = _check_dsa_consistency(key_public_data, key_private_data) if result is not None: @@ -157,6 +160,8 @@ def _is_cryptography_key_consistent(key, key_public_data, key_private_data): except cryptography.exceptions.InvalidSignature: return False # For X25519 and X448, there's no test yet. + if warn_func is not None: + warn_func('Cannot determine consistency for key of type %s' % type(key)) return None @@ -253,7 +258,7 @@ class PrivateKeyInfoRetrievalCryptography(PrivateKeyInfoRetrieval): return _get_cryptography_private_key_info(self.key, need_private_key_data=need_private_key_data) def _is_key_consistent(self, key_public_data, key_private_data): - return _is_cryptography_key_consistent(self.key, key_public_data, key_private_data) + return _is_cryptography_key_consistent(self.key, key_public_data, key_private_data, warn_func=self.module.warn) def get_privatekey_info(module, backend, content, passphrase=None, return_private_key_data=False, prefer_one_fingerprint=False): diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/pem.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/pem.py index 4dc9745fe..da46548c7 100644 --- a/ansible_collections/community/crypto/plugins/module_utils/crypto/pem.py +++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/pem.py @@ -14,10 +14,13 @@ PKCS8_PRIVATEKEY_NAMES = ('PRIVATE KEY', 'ENCRYPTED PRIVATE KEY') PKCS1_PRIVATEKEY_SUFFIX = ' PRIVATE KEY' -def identify_pem_format(content): +def identify_pem_format(content, encoding='utf-8'): '''Given the contents of a binary file, tests whether this could be a PEM file.''' try: - lines = content.decode('utf-8').splitlines(False) + first_pem = extract_first_pem(content.decode(encoding)) + if first_pem is None: + return False + lines = first_pem.splitlines(False) if lines[0].startswith(PEM_START) and lines[0].endswith(PEM_END) and len(lines[0]) > len(PEM_START) + len(PEM_END): return True except UnicodeDecodeError: @@ -25,14 +28,17 @@ def identify_pem_format(content): return False -def identify_private_key_format(content): +def identify_private_key_format(content, encoding='utf-8'): '''Given the contents of a private key file, identifies its format.''' # See https://github.com/openssl/openssl/blob/master/crypto/pem/pem_pkey.c#L40-L85 # (PEM_read_bio_PrivateKey) # and https://github.com/openssl/openssl/blob/master/include/openssl/pem.h#L46-L47 # (PEM_STRING_PKCS8, PEM_STRING_PKCS8INF) try: - lines = content.decode('utf-8').splitlines(False) + first_pem = extract_first_pem(content.decode(encoding)) + if first_pem is None: + return 'raw' + lines = first_pem.splitlines(False) if lines[0].startswith(PEM_START) and lines[0].endswith(PEM_END) and len(lines[0]) > len(PEM_START) + len(PEM_END): name = lines[0][len(PEM_START):-len(PEM_END)] if name in PKCS8_PRIVATEKEY_NAMES: diff --git a/ansible_collections/community/crypto/plugins/module_utils/gnupg/cli.py b/ansible_collections/community/crypto/plugins/module_utils/gnupg/cli.py new file mode 100644 index 000000000..caf0de25f --- /dev/null +++ b/ansible_collections/community/crypto/plugins/module_utils/gnupg/cli.py @@ -0,0 +1,64 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2023, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +import abc +import os + +from ansible.module_utils import six + + +class GPGError(Exception): + pass + + +@six.add_metaclass(abc.ABCMeta) +class GPGRunner(object): + @abc.abstractmethod + def run_command(self, command, check_rc=True, data=None): + """ + Run ``[gpg] + command`` and return ``(rc, stdout, stderr)``. + + If ``data`` is not ``None``, it will be provided as stdin. + The code assumes it is a bytes string. + + Returned stdout and stderr are native Python strings. + Pass ``check_rc=False`` to allow return codes != 0. + + Raises a ``GPGError`` in case of errors. + """ + pass + + +def get_fingerprint_from_stdout(stdout): + lines = stdout.splitlines(False) + for line in lines: + if line.startswith('fpr:'): + parts = line.split(':') + if len(parts) <= 9 or not parts[9]: + raise GPGError('Result line "{line}" does not have fingerprint as 10th component'.format(line=line)) + return parts[9] + raise GPGError('Cannot extract fingerprint from stdout "{stdout}"'.format(stdout=stdout)) + + +def get_fingerprint_from_file(gpg_runner, path): + if not os.path.exists(path): + raise GPGError('{path} does not exist'.format(path=path)) + stdout = gpg_runner.run_command( + ['--no-keyring', '--with-colons', '--import-options', 'show-only', '--import', path], + check_rc=True, + )[1] + return get_fingerprint_from_stdout(stdout) + + +def get_fingerprint_from_bytes(gpg_runner, content): + stdout = gpg_runner.run_command( + ['--no-keyring', '--with-colons', '--import-options', 'show-only', '--import', '/dev/stdin'], + data=content, + check_rc=True, + )[1] + return get_fingerprint_from_stdout(stdout) diff --git a/ansible_collections/community/crypto/plugins/module_utils/openssh/backends/common.py b/ansible_collections/community/crypto/plugins/module_utils/openssh/backends/common.py index 6e274a6de..46ee1c913 100644 --- a/ansible_collections/community/crypto/plugins/module_utils/openssh/backends/common.py +++ b/ansible_collections/community/crypto/plugins/module_utils/openssh/backends/common.py @@ -127,7 +127,7 @@ class OpensshModule(object): ssh_bin = self.module.get_bin_path('ssh') if not ssh_bin: return "" - return parse_openssh_version(self.module.run_command([ssh_bin, '-V', '-q'])[2].strip()) + return parse_openssh_version(self.module.run_command([ssh_bin, '-V', '-q'], check_rc=True)[2].strip()) @_restore_all_on_failure def _safe_secure_move(self, sources_and_destinations): @@ -208,14 +208,18 @@ class KeygenCommand(object): def get_private_key(self, private_key_path, **kwargs): return self._run_command([self._bin_path, '-l', '-f', private_key_path], **kwargs) - def update_comment(self, private_key_path, comment, **kwargs): + def update_comment(self, private_key_path, comment, force_new_format=True, **kwargs): if os.path.exists(private_key_path) and not os.access(private_key_path, os.W_OK): try: os.chmod(private_key_path, stat.S_IWUSR + stat.S_IRUSR) except (IOError, OSError) as e: raise e("The private key at %s is not writeable preventing a comment update" % private_key_path) - return self._run_command([self._bin_path, '-q', '-o', '-c', '-C', comment, '-f', private_key_path], **kwargs) + command = [self._bin_path, '-q'] + if force_new_format: + command.append('-o') + command.extend(['-c', '-C', comment, '-f', private_key_path]) + return self._run_command(command, **kwargs) class PrivateKey(object): diff --git a/ansible_collections/community/crypto/plugins/module_utils/openssh/backends/keypair_backend.py b/ansible_collections/community/crypto/plugins/module_utils/openssh/backends/keypair_backend.py index e3bc3535b..5f54903ef 100644 --- a/ansible_collections/community/crypto/plugins/module_utils/openssh/backends/keypair_backend.py +++ b/ansible_collections/community/crypto/plugins/module_utils/openssh/backends/keypair_backend.py @@ -323,23 +323,27 @@ class KeypairBackendOpensshBin(KeypairBackend): self.ssh_keygen = KeygenCommand(self.module) def _generate_keypair(self, private_key_path): - self.ssh_keygen.generate_keypair(private_key_path, self.size, self.type, self.comment) + self.ssh_keygen.generate_keypair(private_key_path, self.size, self.type, self.comment, check_rc=True) def _get_private_key(self): - private_key_content = self.ssh_keygen.get_private_key(self.private_key_path)[1] + rc, private_key_content, err = self.ssh_keygen.get_private_key(self.private_key_path, check_rc=False) + if rc != 0: + raise ValueError(err) return PrivateKey.from_string(private_key_content) def _get_public_key(self): - public_key_content = self.ssh_keygen.get_matching_public_key(self.private_key_path)[1] + public_key_content = self.ssh_keygen.get_matching_public_key(self.private_key_path, check_rc=True)[1] return PublicKey.from_string(public_key_content) def _private_key_readable(self): - rc, stdout, stderr = self.ssh_keygen.get_matching_public_key(self.private_key_path) + rc, stdout, stderr = self.ssh_keygen.get_matching_public_key(self.private_key_path, check_rc=False) return not (rc == 255 or any_in(stderr, 'is not a public key file', 'incorrect passphrase', 'load failed')) def _update_comment(self): try: - self.ssh_keygen.update_comment(self.private_key_path, self.comment) + ssh_version = self._get_ssh_version() or "7.8" + force_new_format = LooseVersion('6.5') <= LooseVersion(ssh_version) < LooseVersion('7.8') + self.ssh_keygen.update_comment(self.private_key_path, self.comment, force_new_format=force_new_format, check_rc=True) except (IOError, OSError) as e: self.module.fail_json(msg=to_native(e)) diff --git a/ansible_collections/community/crypto/plugins/module_utils/serial.py b/ansible_collections/community/crypto/plugins/module_utils/serial.py new file mode 100644 index 000000000..dac554e32 --- /dev/null +++ b/ansible_collections/community/crypto/plugins/module_utils/serial.py @@ -0,0 +1,56 @@ +# -*- coding: utf-8 -*- +# +# Copyright (c) 2024, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import absolute_import, division, print_function +__metaclass__ = type + +from ansible.module_utils.common.text.converters import to_native + +from ansible_collections.community.crypto.plugins.module_utils.crypto.math import ( + convert_int_to_hex, +) + + +def th(number): + abs_number = abs(number) + mod_10 = abs_number % 10 + mod_100 = abs_number % 100 + if mod_100 not in (11, 12, 13): + if mod_10 == 1: + return 'st' + if mod_10 == 2: + return 'nd' + if mod_10 == 3: + return 'rd' + return 'th' + + +def parse_serial(value): + """ + Given a colon-separated string of hexadecimal byte values, converts it to an integer. + """ + value = to_native(value) + result = 0 + for i, part in enumerate(value.split(':')): + try: + part_value = int(part, 16) + if part_value < 0 or part_value > 255: + raise ValueError('the value is not in range [0, 255]') + except ValueError as exc: + raise ValueError("The {idx}{th} part {part!r} is not a hexadecimal number in range [0, 255]: {exc}".format( + idx=i + 1, th=th(i + 1), part=part, exc=exc)) + result = (result << 8) | part_value + return result + + +def to_serial(value): + """ + Given an integer, converts its absolute value to a colon-separated string of hexadecimal byte values. + """ + value = convert_int_to_hex(value).upper() + if len(value) % 2 != 0: + value = '0' + value + return ':'.join(value[i:i + 2] for i in range(0, len(value), 2)) diff --git a/ansible_collections/community/crypto/plugins/modules/acme_account.py b/ansible_collections/community/crypto/plugins/modules/acme_account.py index 13de49ab0..1e8d64a57 100644 --- a/ansible_collections/community/crypto/plugins/modules/acme_account.py +++ b/ansible_collections/community/crypto/plugins/modules/acme_account.py @@ -22,7 +22,7 @@ description: notes: - "The M(community.crypto.acme_certificate) module also allows to do basic account management. When using both modules, it is recommended to disable account management - for M(community.crypto.acme_certificate). For that, use the C(modify_account) option of + for M(community.crypto.acme_certificate). For that, use the O(community.crypto.acme_certificate#module:modify_account) option of M(community.crypto.acme_certificate)." seealso: - name: Automatic Certificate Management Environment (ACME) @@ -49,9 +49,9 @@ options: state: description: - "The state of the account, to be identified by its account key." - - "If the state is C(absent), the account will either not exist or be + - "If the state is V(absent), the account will either not exist or be deactivated." - - "If the state is C(changed_key), the account must exist. The account + - "If the state is V(changed_key), the account must exist. The account key will be changed; no other information will be touched." type: str required: true @@ -61,7 +61,7 @@ options: - changed_key allow_creation: description: - - "Whether account creation is allowed (when state is C(present))." + - "Whether account creation is allowed (when state is V(present))." type: bool default: true contact: @@ -70,30 +70,30 @@ options: - "Email addresses must be prefixed with C(mailto:)." - "See U(https://tools.ietf.org/html/rfc8555#section-7.3) for what is allowed." - - "Must be specified when state is C(present). Will be ignored - if state is C(absent) or C(changed_key)." + - "Must be specified when state is V(present). Will be ignored + if state is V(absent) or V(changed_key)." type: list elements: str default: [] terms_agreed: description: - "Boolean indicating whether you agree to the terms of service document." - - "ACME servers can require this to be true." + - "ACME servers can require this to be V(true)." type: bool default: false new_account_key_src: description: - "Path to a file containing the ACME account RSA or Elliptic Curve key to change to." - - "Same restrictions apply as to C(account_key_src)." - - "Mutually exclusive with C(new_account_key_content)." - - "Required if C(new_account_key_content) is not used and state is C(changed_key)." + - "Same restrictions apply as to O(account_key_src)." + - "Mutually exclusive with O(new_account_key_content)." + - "Required if O(new_account_key_content) is not used and O(state) is V(changed_key)." type: path new_account_key_content: description: - "Content of the ACME account RSA or Elliptic Curve key to change to." - - "Same restrictions apply as to C(account_key_content)." - - "Mutually exclusive with C(new_account_key_src)." - - "Required if C(new_account_key_src) is not used and state is C(changed_key)." + - "Same restrictions apply as to O(account_key_content)." + - "Mutually exclusive with O(new_account_key_src)." + - "Required if O(new_account_key_src) is not used and O(state) is V(changed_key)." type: str new_account_key_passphrase: description: @@ -117,14 +117,14 @@ options: alg: description: - The MAC algorithm provided by the CA. - - If not specified by the CA, this is probably C(HS256). + - If not specified by the CA, this is probably V(HS256). type: str required: true choices: [ HS256, HS384, HS512 ] key: description: - Base64 URL encoded value of the MAC key provided by the CA. - - Padding (C(=) symbols at the end) can be omitted. + - Padding (V(=) symbols at the end) can be omitted. type: str required: true version_added: 1.1.0 diff --git a/ansible_collections/community/crypto/plugins/modules/acme_account_info.py b/ansible_collections/community/crypto/plugins/modules/acme_account_info.py index 4e1a3c7b7..ac4617c90 100644 --- a/ansible_collections/community/crypto/plugins/modules/acme_account_info.py +++ b/ansible_collections/community/crypto/plugins/modules/acme_account_info.py @@ -34,11 +34,11 @@ options: description: - "Whether to retrieve the list of order URLs or order objects, if provided by the ACME server." - - "A value of C(ignore) will not fetch the list of orders." - - "If the value is not C(ignore) and the ACME server supports orders, the C(order_uris) - return value is always populated. The C(orders) return value is only returned - if this option is set to C(object_list)." - - "Currently, Let's Encrypt does not return orders, so the C(orders) result + - "A value of V(ignore) will not fetch the list of orders." + - "If the value is not V(ignore) and the ACME server supports orders, the RV(order_uris) + return value is always populated. The RV(orders) return value is only returned + if this option is set to V(object_list)." + - "Currently, Let's Encrypt does not return orders, so the RV(orders) result will always be empty." type: str choices: @@ -113,7 +113,7 @@ account: orders: description: - A URL where a list of orders can be retrieved for this account. - - Use the I(retrieve_orders) option to query this URL and retrieve the + - Use the O(retrieve_orders) option to query this URL and retrieve the complete list of orders. returned: always type: str @@ -129,7 +129,7 @@ orders: - "The list of orders." type: list elements: dict - returned: if account exists, I(retrieve_orders) is C(object_list), and server supports order listing + returned: if account exists, O(retrieve_orders) is V(object_list), and server supports order listing contains: status: description: The order's status. @@ -144,7 +144,7 @@ orders: description: - When the order expires. - Timestamp should be formatted as described in RFC3339. - - Only required to be included in result when I(status) is C(pending) or C(valid). + - Only required to be included in result when RV(orders[].status) is V(pending) or V(valid). type: str returned: when server gives expiry date identifiers: @@ -154,14 +154,17 @@ orders: elements: dict contains: type: - description: Type of identifier. C(dns) or C(ip). + description: Type of identifier. type: str + choices: + - dns + - ip value: description: Name of identifier. Hostname or IP address. type: str wildcard: - description: "Whether I(value) is actually a wildcard. The wildcard - prefix C(*.) is not included in I(value) if this is C(true)." + description: "Whether RV(orders[].identifiers[].value) is actually a wildcard. The wildcard + prefix C(*.) is not included in RV(orders[].identifiers[].value) if this is V(true)." type: bool returned: required to be included if the identifier is wildcarded notBefore: @@ -202,11 +205,11 @@ orders: order_uris: description: - "The list of orders." - - "If I(retrieve_orders) is C(url_list), this will be a list of URLs." - - "If I(retrieve_orders) is C(object_list), this will be a list of objects." + - "If O(retrieve_orders) is V(url_list), this will be a list of URLs." + - "If O(retrieve_orders) is V(object_list), this will be a list of objects." type: list elements: str - returned: if account exists, I(retrieve_orders) is not C(ignore), and server supports order listing + returned: if account exists, O(retrieve_orders) is not V(ignore), and server supports order listing version_added: 1.5.0 ''' diff --git a/ansible_collections/community/crypto/plugins/modules/acme_certificate.py b/ansible_collections/community/crypto/plugins/modules/acme_certificate.py index 6aec44e08..9c0b349c4 100644 --- a/ansible_collections/community/crypto/plugins/modules/acme_certificate.py +++ b/ansible_collections/community/crypto/plugins/modules/acme_certificate.py @@ -19,15 +19,15 @@ description: L(ACME protocol,https://tools.ietf.org/html/rfc8555), such as L(Let's Encrypt,https://letsencrypt.org/) or L(Buypass,https://www.buypass.com/). The current implementation - supports the C(http-01), C(dns-01) and C(tls-alpn-01) challenges." + supports the V(http-01), V(dns-01) and V(tls-alpn-01) challenges." - "To use this module, it has to be executed twice. Either as two different tasks in the same run or during two runs. Note that the output of the first run needs to be recorded and passed to the second run as the - module argument C(data)." + module argument O(data)." - "Between these two tasks you have to fulfill the required steps for the - chosen challenge by whatever means necessary. For C(http-01) that means + chosen challenge by whatever means necessary. For V(http-01) that means creating the necessary challenge file on the destination webserver. For - C(dns-01) the necessary dns record has to be created. For C(tls-alpn-01) + V(dns-01) the necessary dns record has to be created. For V(tls-alpn-01) the necessary certificate has to be created and served. It is I(not) the responsibility of this module to perform these steps." - "For details on how to fulfill these challenges, you might have to read through @@ -37,11 +37,11 @@ description: - "The module includes experimental support for IP identifiers according to the L(RFC 8738,https://www.rfc-editor.org/rfc/rfc8738.html)." notes: - - "At least one of C(dest) and C(fullchain_dest) must be specified." + - "At least one of O(dest) and O(fullchain_dest) must be specified." - "This module includes basic account management functionality. If you want to have more control over your ACME account, use the M(community.crypto.acme_account) module and disable account management - for this module using the C(modify_account) option." + for this module using the O(modify_account) option." - "This module was called C(letsencrypt) before Ansible 2.6. The usage did not change." seealso: @@ -57,10 +57,10 @@ seealso: description: The specification of the ACME protocol (RFC 8555). link: https://tools.ietf.org/html/rfc8555 - name: ACME TLS ALPN Challenge Extension - description: The specification of the C(tls-alpn-01) challenge (RFC 8737). + description: The specification of the V(tls-alpn-01) challenge (RFC 8737). link: https://www.rfc-editor.org/rfc/rfc8737.html-05 - module: community.crypto.acme_challenge_cert_helper - description: Helps preparing C(tls-alpn-01) challenges. + description: Helps preparing V(tls-alpn-01) challenges. - module: community.crypto.openssl_privatekey description: Can be used to create private keys (both for certificates and accounts). - module: community.crypto.openssl_privatekey_pipe @@ -94,7 +94,7 @@ options: description: - "The email address associated with this account." - "It will be used for certificate expiration warnings." - - "Note that when C(modify_account) is not set to C(false) and you also + - "Note that when O(modify_account) is not set to V(false) and you also used the M(community.crypto.acme_account) module to specify more than one contact for your account, this module will update your account and restrict it to the (at most one) contact email address specified here." @@ -102,31 +102,31 @@ options: agreement: description: - "URI to a terms of service document you agree to when using the - ACME v1 service at C(acme_directory)." - - Default is latest gathered from C(acme_directory) URL. - - This option will only be used when C(acme_version) is 1. + ACME v1 service at O(acme_directory)." + - Default is latest gathered from O(acme_directory) URL. + - This option will only be used when O(acme_version) is 1. type: str terms_agreed: description: - "Boolean indicating whether you agree to the terms of service document." - "ACME servers can require this to be true." - - This option will only be used when C(acme_version) is not 1. + - This option will only be used when O(acme_version) is not 1. type: bool default: false modify_account: description: - "Boolean indicating whether the module should create the account if necessary, and update its contact data." - - "Set to C(false) if you want to use the M(community.crypto.acme_account) module to manage + - "Set to V(false) if you want to use the M(community.crypto.acme_account) module to manage your account instead, and to avoid accidental creation of a new account using an old key if you changed the account key with M(community.crypto.acme_account)." - - "If set to C(false), C(terms_agreed) and C(account_email) are ignored." + - "If set to V(false), O(terms_agreed) and O(account_email) are ignored." type: bool default: true challenge: description: - The challenge to be performed. - - If set to C(no challenge), no challenge will be used. This is necessary for some private + - If set to V(no challenge), no challenge will be used. This is necessary for some private CAs which use External Account Binding and other means of validating certificate assurance. For example, an account could be allowed to issue certificates for C(foo.example.com) without any further validation for a certain period of time. @@ -148,7 +148,7 @@ options: account key. This is a bad idea from a security point of view, and the CA should not accept the CSR. The ACME server should return an error in this case." - - Precisely one of I(csr) or I(csr_content) must be specified. + - Precisely one of O(csr) or O(csr_content) must be specified. type: path aliases: ['src'] csr_content: @@ -162,7 +162,7 @@ options: account key. This is a bad idea from a security point of view, and the CA should not accept the CSR. The ACME server should return an error in this case." - - Precisely one of I(csr) or I(csr_content) must be specified. + - Precisely one of O(csr) or O(csr_content) must be specified. type: str version_added: 1.2.0 data: @@ -171,27 +171,27 @@ options: the second run of the module only." - "The value that must be used here will be provided by a previous use of this module. See the examples for more details." - - "Note that for ACME v2, only the C(order_uri) entry of C(data) will - be used. For ACME v1, C(data) must be non-empty to indicate the + - "Note that for ACME v2, only the C(order_uri) entry of O(data) will + be used. For ACME v1, O(data) must be non-empty to indicate the second stage is active; all needed data will be taken from the CSR." - - "I(Note): the C(data) option was marked as C(no_log) up to + - "I(Note): the O(data) option was marked as C(no_log) up to Ansible 2.5. From Ansible 2.6 on, it is no longer marked this way - as it causes error messages to be come unusable, and C(data) does + as it causes error messages to be come unusable, and O(data) does not contain any information which can be used without having access to the account key or which are not public anyway." type: dict dest: description: - "The destination file for the certificate." - - "Required if C(fullchain_dest) is not specified." + - "Required if O(fullchain_dest) is not specified." type: path aliases: ['cert'] fullchain_dest: description: - "The destination file for the full chain (that is, a certificate followed by chain of intermediate certificates)." - - "Required if C(dest) is not specified." + - "Required if O(dest) is not specified." type: path aliases: ['fullchain'] chain_dest: @@ -202,11 +202,11 @@ options: remaining_days: description: - "The number of days the certificate must have left being valid. - If C(cert_days < remaining_days), then it will be renewed. + If RV(cert_days) < O(remaining_days), then it will be renewed. If the certificate is not renewed, module return values will not - include C(challenge_data)." + include RV(challenge_data)." - "To make sure that the certificate is renewed in any case, you can - use the C(force) option." + use the O(force) option." type: int default: 10 deactivate_authzs: @@ -222,16 +222,16 @@ options: force: description: - Enforces the execution of the challenge and validation, even if an - existing certificate is still valid for more than C(remaining_days). + existing certificate is still valid for more than O(remaining_days). - This is especially helpful when having an updated CSR, for example with additional domains for which a new certificate is desired. type: bool default: false retrieve_all_alternates: description: - - "When set to C(true), will retrieve all alternate trust chains offered by the ACME CA. + - "When set to V(true), will retrieve all alternate trust chains offered by the ACME CA. These will not be written to disk, but will be returned together with the main - chain as C(all_chains). See the documentation for the C(all_chains) return + chain as RV(all_chains). See the documentation for the RV(all_chains) return value for details." type: bool default: false @@ -244,8 +244,8 @@ options: - "If a criterium matches multiple chains, the first one matching will be returned. The order is determined by the ordering of the C(Link) headers returned by the ACME server and might not be deterministic." - - "Every criterium can consist of multiple different conditions, like I(issuer) - and I(subject). For the criterium to match a chain, all conditions must apply + - "Every criterium can consist of multiple different conditions, like O(select_chain[].issuer) + and O(select_chain[].subject). For the criterium to match a chain, all conditions must apply to the same certificate in the chain." - "This option can only be used with the C(cryptography) backend." type: list @@ -255,11 +255,11 @@ options: test_certificates: description: - "Determines which certificates in the chain will be tested." - - "I(all) tests all certificates in the chain (excluding the leaf, which is + - "V(all) tests all certificates in the chain (excluding the leaf, which is identical in all chains)." - - "I(first) only tests the first certificate in the chain, that is the one which + - "V(first) only tests the first certificate in the chain, that is the one which signed the leaf." - - "I(last) only tests the last certificate in the chain, that is the one furthest + - "V(last) only tests the last certificate in the chain, that is the one furthest away from the leaf. Its issuer is the root certificate of this chain." type: str default: all @@ -268,29 +268,29 @@ options: description: - "Allows to specify parts of the issuer of a certificate in the chain must have to be selected." - - "If I(issuer) is empty, any certificate will match." - - 'An example value would be C({"commonName": "My Preferred CA Root"}).' + - "If O(select_chain[].issuer) is empty, any certificate will match." + - 'An example value would be V({"commonName": "My Preferred CA Root"}).' type: dict subject: description: - "Allows to specify parts of the subject of a certificate in the chain must have to be selected." - - "If I(subject) is empty, any certificate will match." - - 'An example value would be C({"CN": "My Preferred CA Intermediate"})' + - "If O(select_chain[].subject) is empty, any certificate will match." + - 'An example value would be V({"CN": "My Preferred CA Intermediate"})' type: dict subject_key_identifier: description: - "Checks for the SubjectKeyIdentifier extension. This is an identifier based on the private key of the intermediate certificate." - "The identifier must be of the form - C(A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1)." + V(A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1)." type: str authority_key_identifier: description: - "Checks for the AuthorityKeyIdentifier extension. This is an identifier based on the private key of the issuer of the intermediate certificate." - "The identifier must be of the form - C(C4:A7:B1:A4:7B:2C:71:FA:DB:E1:4B:90:75:FF:C4:15:60:85:89:10)." + V(C4:A7:B1:A4:7B:2C:71:FA:DB:E1:4B:90:75:FF:C4:15:60:85:89:10)." type: str ''' @@ -305,9 +305,10 @@ EXAMPLES = r''' register: sample_com_challenge # Alternative first step: -- name: Create a challenge for sample.com using a account key from hashi vault. +- name: Create a challenge for sample.com using a account key from Hashi Vault. community.crypto.acme_certificate: - account_key_content: "{{ lookup('hashi_vault', 'secret=secret/account_private_key:value') }}" + account_key_content: >- + {{ lookup('community.hashi_vault.hashi_vault', 'secret=secret/account_private_key:value') }} csr: /etc/pki/cert/csr/sample.com.csr fullchain_dest: /etc/httpd/ssl/sample.com-fullchain.crt register: sample_com_challenge @@ -455,32 +456,32 @@ challenge_data: sample: .well-known/acme-challenge/evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA resource_original: description: - - The original challenge resource including type identifier for C(tls-alpn-01) + - The original challenge resource including type identifier for V(tls-alpn-01) challenges. - returned: changed and challenge is C(tls-alpn-01) + returned: changed and O(challenge) is V(tls-alpn-01) type: str sample: DNS:example.com resource_value: description: - The value the resource has to produce for the validation. - - For C(http-01) and C(dns-01) challenges, the value can be used as-is. - - "For C(tls-alpn-01) challenges, note that this return value contains a + - For V(http-01) and V(dns-01) challenges, the value can be used as-is. + - "For V(tls-alpn-01) challenges, note that this return value contains a Base64 encoded version of the correct binary blob which has to be put into the acmeValidation x509 extension; see U(https://www.rfc-editor.org/rfc/rfc8737.html#section-3) - for details. To do this, you might need the C(b64decode) Jinja filter + for details. To do this, you might need the P(ansible.builtin.b64decode#filter) Jinja filter to extract the binary blob from this return value." returned: changed type: str sample: IlirfxKKXA...17Dt3juxGJ-PCt92wr-oA record: description: The full DNS record's name for the challenge. - returned: changed and challenge is C(dns-01) + returned: changed and challenge is V(dns-01) type: str sample: _acme-challenge.example.com challenge_data_dns: description: - - List of TXT values per DNS record, in case challenge is C(dns-01). + - List of TXT values per DNS record, in case challenge is V(dns-01). - Since Ansible 2.8.5, only challenges which are not yet valid are returned. returned: changed type: dict @@ -518,11 +519,11 @@ account_uri: type: str all_chains: description: - - When I(retrieve_all_alternates) is set to C(true), the module will query the ACME server + - When O(retrieve_all_alternates) is set to V(true), the module will query the ACME server for alternate chains. This return value will contain a list of all chains returned, the first entry being the main chain returned by the server. - See L(Section 7.4.2 of RFC8555,https://tools.ietf.org/html/rfc8555#section-7.4.2) for details. - returned: when certificate was retrieved and I(retrieve_all_alternates) is set to C(true) + returned: when certificate was retrieved and O(retrieve_all_alternates) is set to V(true) type: list elements: dict contains: diff --git a/ansible_collections/community/crypto/plugins/modules/acme_certificate_revoke.py b/ansible_collections/community/crypto/plugins/modules/acme_certificate_revoke.py index f1922384a..022862e60 100644 --- a/ansible_collections/community/crypto/plugins/modules/acme_certificate_revoke.py +++ b/ansible_collections/community/crypto/plugins/modules/acme_certificate_revoke.py @@ -19,8 +19,8 @@ description: L(ACME protocol,https://tools.ietf.org/html/rfc8555), such as L(Let's Encrypt,https://letsencrypt.org/)." notes: - - "Exactly one of C(account_key_src), C(account_key_content), - C(private_key_src) or C(private_key_content) must be specified." + - "Exactly one of O(account_key_src), O(account_key_content), + O(private_key_src), or O(private_key_content) must be specified." - "Trying to revoke an already revoked certificate should result in an unchanged status, even if the revocation reason was different than the one specified here. Also, depending on the @@ -58,13 +58,13 @@ options: - "RSA keys can be created with C(openssl rsa ...). Elliptic curve keys can be created with C(openssl ecparam -genkey ...). Any other tool creating private keys in PEM format can be used as well." - - "Mutually exclusive with C(account_key_content)." - - "Required if C(account_key_content) is not used." + - "Mutually exclusive with O(account_key_content)." + - "Required if O(account_key_content) is not used." account_key_content: description: - "Content of the ACME account RSA or Elliptic Curve key." - - "Note that exactly one of C(account_key_src), C(account_key_content), - C(private_key_src) or C(private_key_content) must be specified." + - "Note that exactly one of O(account_key_src), O(account_key_content), + O(private_key_src), or O(private_key_content) must be specified." - "I(Warning): the content will be written into a temporary file, which will be deleted by Ansible when the module completes. Since this is an important private key — it can be used to change the account key, @@ -77,14 +77,14 @@ options: private_key_src: description: - "Path to the certificate's private key." - - "Note that exactly one of C(account_key_src), C(account_key_content), - C(private_key_src) or C(private_key_content) must be specified." + - "Note that exactly one of O(account_key_src), O(account_key_content), + O(private_key_src), or O(private_key_content) must be specified." type: path private_key_content: description: - "Content of the certificate's private key." - - "Note that exactly one of C(account_key_src), C(account_key_content), - C(private_key_src) or C(private_key_content) must be specified." + - "Note that exactly one of O(account_key_src), O(account_key_content), + O(private_key_src), or O(private_key_content) must be specified." - "I(Warning): the content will be written into a temporary file, which will be deleted by Ansible when the module completes. Since this is an important private key — it can be used to change the account key, @@ -105,11 +105,11 @@ options: description: - "One of the revocation reasonCodes defined in L(Section 5.3.1 of RFC5280,https://tools.ietf.org/html/rfc5280#section-5.3.1)." - - "Possible values are C(0) (unspecified), C(1) (keyCompromise), - C(2) (cACompromise), C(3) (affiliationChanged), C(4) (superseded), - C(5) (cessationOfOperation), C(6) (certificateHold), - C(8) (removeFromCRL), C(9) (privilegeWithdrawn), - C(10) (aACompromise)." + - "Possible values are V(0) (unspecified), V(1) (keyCompromise), + V(2) (cACompromise), V(3) (affiliationChanged), V(4) (superseded), + V(5) (cessationOfOperation), V(6) (certificateHold), + V(8) (removeFromCRL), V(9) (privilegeWithdrawn), + V(10) (aACompromise)." type: int ''' diff --git a/ansible_collections/community/crypto/plugins/modules/acme_challenge_cert_helper.py b/ansible_collections/community/crypto/plugins/modules/acme_challenge_cert_helper.py index 1b963e8cc..9740cd16d 100644 --- a/ansible_collections/community/crypto/plugins/modules/acme_challenge_cert_helper.py +++ b/ansible_collections/community/crypto/plugins/modules/acme_challenge_cert_helper.py @@ -49,7 +49,7 @@ options: - tls-alpn-01 challenge_data: description: - - "The C(challenge_data) entry provided by M(community.crypto.acme_certificate) for the + - "The RV(community.crypto.acme_certificate#module:challenge_data) entry provided by M(community.crypto.acme_certificate) for the challenge." type: dict required: true @@ -57,12 +57,12 @@ options: description: - "Path to a file containing the private key file to use for this challenge certificate." - - "Mutually exclusive with C(private_key_content)." + - "Mutually exclusive with O(private_key_content)." type: path private_key_content: description: - "Content of the private key to use for this challenge certificate." - - "Mutually exclusive with C(private_key_src)." + - "Mutually exclusive with O(private_key_src)." type: str private_key_passphrase: description: @@ -122,14 +122,16 @@ domain: type: str identifier_type: description: - - "The identifier type for the actual resource identifier. Will be C(dns) - or C(ip)." + - "The identifier type for the actual resource identifier." returned: always type: str + choices: + - dns + - ip identifier: description: - - "The identifier for the actual resource. Will be a domain name if the - type is C(dns), or an IP address if the type is C(ip)." + - "The identifier for the actual resource. Will be a domain name if + RV(identifier_type=dns), or an IP address if RV(identifier_type=ip)." returned: always type: str challenge_certificate: diff --git a/ansible_collections/community/crypto/plugins/modules/acme_inspect.py b/ansible_collections/community/crypto/plugins/modules/acme_inspect.py index d5c96b722..a2c76507e 100644 --- a/ansible_collections/community/crypto/plugins/modules/acme_inspect.py +++ b/ansible_collections/community/crypto/plugins/modules/acme_inspect.py @@ -24,7 +24,7 @@ description: - "The module can also be used to directly access features of an ACME servers which are not yet supported by the Ansible ACME modules." notes: - - "The I(account_uri) option must be specified for properly authenticated + - "The O(account_uri) option must be specified for properly authenticated ACME v2 requests (except a C(new-account) request)." - "Using the C(ansible) tool, M(community.crypto.acme_inspect) can be used to directly execute ACME requests without the need of writing a playbook. For example, the @@ -54,16 +54,16 @@ options: url: description: - "The URL to send the request to." - - "Must be specified if I(method) is not C(directory-only)." + - "Must be specified if O(method) is not V(directory-only)." type: str method: description: - "The method to use to access the given URL on the ACME server." - - "The value C(post) executes an authenticated POST request. The content - must be specified in the I(content) option." - - "The value C(get) executes an authenticated POST-as-GET request for ACME v2, + - "The value V(post) executes an authenticated POST request. The content + must be specified in the O(content) option." + - "The value V(get) executes an authenticated POST-as-GET request for ACME v2, and a regular GET request for ACME v1." - - "The value C(directory-only) only retrieves the directory, without doing + - "The value V(directory-only) only retrieves the directory, without doing a request." type: str default: get @@ -73,13 +73,13 @@ options: - directory-only content: description: - - "An encoded JSON object which will be sent as the content if I(method) - is C(post)." - - "Required when I(method) is C(post), and not allowed otherwise." + - "An encoded JSON object which will be sent as the content if O(method) + is V(post)." + - "Required when O(method) is V(post), and not allowed otherwise." type: str fail_on_acme_error: description: - - "If I(method) is C(post) or C(get), make the module fail in case an ACME + - "If O(method) is V(post) or V(get), make the module fail in case an ACME error is returned." type: bool default: true diff --git a/ansible_collections/community/crypto/plugins/modules/certificate_complete_chain.py b/ansible_collections/community/crypto/plugins/modules/certificate_complete_chain.py index b1862d2ce..357d2f668 100644 --- a/ansible_collections/community/crypto/plugins/modules/certificate_complete_chain.py +++ b/ansible_collections/community/crypto/plugins/modules/certificate_complete_chain.py @@ -78,7 +78,7 @@ EXAMPLES = ''' # certificates, finds the associated root certificate. - name: Find root certificate community.crypto.certificate_complete_chain: - input_chain: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com-fullchain.pem') }}" + input_chain: "{{ lookup('ansible.builtin.file', '/etc/ssl/csr/www.ansible.com-fullchain.pem') }}" root_certificates: - /etc/ca-certificates/ register: www_ansible_com @@ -91,7 +91,7 @@ EXAMPLES = ''' # certificates, finds the associated root certificate. - name: Find root certificate community.crypto.certificate_complete_chain: - input_chain: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.pem') }}" + input_chain: "{{ lookup('ansible.builtin.file', '/etc/ssl/csr/www.ansible.com.pem') }}" intermediate_certificates: - /etc/ssl/csr/www.ansible.com-chain.pem root_certificates: diff --git a/ansible_collections/community/crypto/plugins/modules/crypto_info.py b/ansible_collections/community/crypto/plugins/modules/crypto_info.py index 1988eb32d..d776ac52c 100644 --- a/ansible_collections/community/crypto/plugins/modules/crypto_info.py +++ b/ansible_collections/community/crypto/plugins/modules/crypto_info.py @@ -45,12 +45,12 @@ python_cryptography_installed: python_cryptography_import_error: description: Import error when trying to import the L(Python cryptography library, https://cryptography.io/). - returned: when I(python_cryptography_installed=false) + returned: when RV(python_cryptography_installed=false) type: str python_cryptography_capabilities: description: Information on the installed L(Python cryptography library, https://cryptography.io/). - returned: when I(python_cryptography_installed=true) + returned: when RV(python_cryptography_installed=true) type: dict contains: version: @@ -136,7 +136,7 @@ openssl_present: openssl: description: Information on the installed OpenSSL binary. - returned: when I(openssl_present=true) + returned: when RV(openssl_present=true) type: dict contains: path: diff --git a/ansible_collections/community/crypto/plugins/modules/ecs_certificate.py b/ansible_collections/community/crypto/plugins/modules/ecs_certificate.py index b19b86f56..2c1238d48 100644 --- a/ansible_collections/community/crypto/plugins/modules/ecs_certificate.py +++ b/ansible_collections/community/crypto/plugins/modules/ecs_certificate.py @@ -21,7 +21,7 @@ description: - In order to request a certificate, the domain and organization used in the certificate signing request must be already validated in the ECS system. It is I(not) the responsibility of this module to perform those steps. notes: - - C(path) must be specified as the output location of the certificate. + - O(path) must be specified as the output location of the certificate. requirements: - cryptography >= 1.6 extends_documentation_fragment: @@ -32,7 +32,7 @@ attributes: check_mode: support: partial details: - - Check mode is only supported if I(request_type=new). + - Check mode is only supported if O(request_type=new). diff_mode: support: none safe_file_operations: @@ -40,14 +40,14 @@ attributes: options: backup: description: - - Whether a backup should be made for the certificate in I(path). + - Whether a backup should be made for the certificate in O(path). type: bool default: false force: description: - - If force is used, a certificate is requested regardless of whether I(path) points to an existing valid certificate. - - If C(request_type=renew), a forced renew will fail if the certificate being renewed has been issued within the past 30 days, regardless of the - value of I(remaining_days) or the return value of I(cert_days) - the ECS API does not support the "renew" operation for certificates that are not + - If force is used, a certificate is requested regardless of whether O(path) points to an existing valid certificate. + - If O(request_type=renew), a forced renew will fail if the certificate being renewed has been issued within the past 30 days, regardless of the + value of O(remaining_days) or the return value of RV(cert_days) - the ECS API does not support the "renew" operation for certificates that are not at least 30 days old. type: bool default: false @@ -56,9 +56,9 @@ options: - The destination path for the generated certificate as a PEM encoded cert. - If the certificate at this location is not an Entrust issued certificate, a new certificate will always be requested even if the current certificate is technically valid. - - If there is already an Entrust certificate at this location, whether it is replaced is depends on the I(remaining_days) calculation. - - If an existing certificate is being replaced (see I(remaining_days), I(force), and I(tracking_id)), whether a new certificate is requested - or the existing certificate is renewed or reissued is based on I(request_type). + - If there is already an Entrust certificate at this location, whether it is replaced is depends on the O(remaining_days) calculation. + - If an existing certificate is being replaced (see O(remaining_days), O(force), and O(tracking_id)), whether a new certificate is requested + or the existing certificate is renewed or reissued is based on O(request_type). type: path required: true full_chain_path: @@ -67,54 +67,54 @@ options: type: path csr: description: - - Base-64 encoded Certificate Signing Request (CSR). I(csr) is accepted with or without PEM formatting around the Base-64 string. - - If no I(csr) is provided when C(request_type=reissue) or C(request_type=renew), the certificate will be generated with the same public key as + - Base-64 encoded Certificate Signing Request (CSR). O(csr) is accepted with or without PEM formatting around the Base-64 string. + - If no O(csr) is provided when O(request_type=reissue) or O(request_type=renew), the certificate will be generated with the same public key as the certificate being renewed or reissued. - - If I(subject_alt_name) is specified, it will override the subject alternate names in the CSR. - - If I(eku) is specified, it will override the extended key usage in the CSR. - - If I(ou) is specified, it will override the organizational units "ou=" present in the subject distinguished name of the CSR, if any. - - The organization "O=" field from the CSR will not be used. It will be replaced in the issued certificate by I(org) if present, and if not present, - the organization tied to I(client_id). + - If O(subject_alt_name) is specified, it will override the subject alternate names in the CSR. + - If O(eku) is specified, it will override the extended key usage in the CSR. + - If O(ou) is specified, it will override the organizational units "ou=" present in the subject distinguished name of the CSR, if any. + - The organization "O=" field from the CSR will not be used. It will be replaced in the issued certificate by O(org) if present, and if not present, + the organization tied to O(client_id). type: str tracking_id: description: - The tracking ID of the certificate to reissue or renew. - - I(tracking_id) is invalid if C(request_type=new) or C(request_type=validate_only). - - If there is a certificate present in I(path) and it is an ECS certificate, I(tracking_id) will be ignored. - - If there is no certificate present in I(path) or there is but it is from another provider, the certificate represented by I(tracking_id) will - be renewed or reissued and saved to I(path). - - If there is no certificate present in I(path) and the I(force) and I(remaining_days) parameters do not indicate a new certificate is needed, - the certificate referenced by I(tracking_id) certificate will be saved to I(path). + - O(tracking_id) is invalid if O(request_type=new) or O(request_type=validate_only). + - If there is a certificate present in O(path) and it is an ECS certificate, O(tracking_id) will be ignored. + - If there is no certificate present in O(path) or there is but it is from another provider, the certificate represented by O(tracking_id) will + be renewed or reissued and saved to O(path). + - If there is no certificate present in O(path) and the O(force) and O(remaining_days) parameters do not indicate a new certificate is needed, + the certificate referenced by O(tracking_id) certificate will be saved to O(path). - This can be used when a known certificate is not currently present on a server, but you want to renew or reissue it to be managed by an ansible - playbook. For example, if you specify C(request_type=renew), I(tracking_id) of an issued certificate, and I(path) to a file that does not exist, - the first run of a task will download the certificate specified by I(tracking_id) (assuming it is still valid). Future runs of the task will - (if applicable - see I(force) and I(remaining_days)) renew the certificate now present in I(path). + playbook. For example, if you specify O(request_type=renew), O(tracking_id) of an issued certificate, and O(path) to a file that does not exist, + the first run of a task will download the certificate specified by O(tracking_id) (assuming it is still valid). Future runs of the task will + (if applicable - see O(force) and O(remaining_days)) renew the certificate now present in O(path). type: int remaining_days: description: - - The number of days the certificate must have left being valid. If C(cert_days < remaining_days) then a new certificate will be - obtained using I(request_type). - - If C(request_type=renew), a renewal will fail if the certificate being renewed has been issued within the past 30 days, so do not set a - I(remaining_days) value that is within 30 days of the full lifetime of the certificate being acted upon. - - For exmaple, if you are requesting Certificates with a 90 day lifetime, do not set I(remaining_days) to a value C(60) or higher). - - The I(force) option may be used to ensure that a new certificate is always obtained. + - The number of days the certificate must have left being valid. If RV(cert_days) < O(remaining_days) then a new certificate will be + obtained using O(request_type). + - If O(request_type=renew), a renewal will fail if the certificate being renewed has been issued within the past 30 days, so do not set a + O(remaining_days) value that is within 30 days of the full lifetime of the certificate being acted upon. + - For example, if you are requesting Certificates with a 90 day lifetime, do not set O(remaining_days) to a value V(60) or higher). + - The O(force) option may be used to ensure that a new certificate is always obtained. type: int default: 30 request_type: description: - - The operation performed if I(tracking_id) references a valid certificate to reissue, or there is already a certificate present in I(path) but - either I(force) is specified or C(cert_days < remaining_days). - - Specifying C(request_type=validate_only) means the request will be validated against the ECS API, but no certificate will be issued. - - Specifying C(request_type=new) means a certificate request will always be submitted and a new certificate issued. - - Specifying C(request_type=renew) means that an existing certificate (specified by I(tracking_id) if present, otherwise I(path)) will be renewed. + - The operation performed if O(tracking_id) references a valid certificate to reissue, or there is already a certificate present in O(path) but + either O(force) is specified or RV(cert_days) < O(remaining_days). + - Specifying O(request_type=validate_only) means the request will be validated against the ECS API, but no certificate will be issued. + - Specifying O(request_type=new) means a certificate request will always be submitted and a new certificate issued. + - Specifying O(request_type=renew) means that an existing certificate (specified by O(tracking_id) if present, otherwise O(path)) will be renewed. If there is no certificate to renew, a new certificate is requested. - - Specifying C(request_type=reissue) means that an existing certificate (specified by I(tracking_id) if present, otherwise I(path)) will be + - Specifying O(request_type=reissue) means that an existing certificate (specified by O(tracking_id) if present, otherwise O(path)) will be reissued. If there is no certificate to reissue, a new certificate is requested. - - If a certificate was issued within the past 30 days, the C(renew) operation is not a valid operation and will fail. - - Note that C(reissue) is an operation that will result in the revocation of the certificate that is reissued, be cautious with its use. - - I(check_mode) is only supported if C(request_type=new) - - For example, setting C(request_type=renew) and C(remaining_days=30) and pointing to the same certificate on multiple playbook runs means that on + - If a certificate was issued within the past 30 days, the V(renew) operation is not a valid operation and will fail. + - Note that V(reissue) is an operation that will result in the revocation of the certificate that is reissued, be cautious with its use. + - I(check_mode) is only supported if O(request_type=new) + - For example, setting O(request_type=renew) and O(remaining_days=30) and pointing to the same certificate on multiple playbook runs means that on the first run new certificate will be requested. It will then be left along on future runs until it is within 30 days of expiry, then the ECS "renew" operation will be performed. type: str @@ -123,57 +123,57 @@ options: cert_type: description: - Specify the type of certificate requested. - - If a certificate is being reissued or renewed, this parameter is ignored, and the C(cert_type) of the initial certificate is used. + - If a certificate is being reissued or renewed, this parameter is ignored, and the O(cert_type) of the initial certificate is used. type: str choices: [ 'STANDARD_SSL', 'ADVANTAGE_SSL', 'UC_SSL', 'EV_SSL', 'WILDCARD_SSL', 'PRIVATE_SSL', 'PD_SSL', 'CODE_SIGNING', 'EV_CODE_SIGNING', 'CDS_INDIVIDUAL', 'CDS_GROUP', 'CDS_ENT_LITE', 'CDS_ENT_PRO', 'SMIME_ENT' ] subject_alt_name: description: - - The subject alternative name identifiers, as an array of values (applies to I(cert_type) with a value of C(STANDARD_SSL), C(ADVANTAGE_SSL), - C(UC_SSL), C(EV_SSL), C(WILDCARD_SSL), C(PRIVATE_SSL), and C(PD_SSL)). - - If you are requesting a new SSL certificate, and you pass a I(subject_alt_name) parameter, any SAN names in the CSR are ignored. + - The subject alternative name identifiers, as an array of values (applies to O(cert_type) with a value of V(STANDARD_SSL), V(ADVANTAGE_SSL), + V(UC_SSL), V(EV_SSL), V(WILDCARD_SSL), V(PRIVATE_SSL), and V(PD_SSL)). + - If you are requesting a new SSL certificate, and you pass a O(subject_alt_name) parameter, any SAN names in the CSR are ignored. If no subjectAltName parameter is passed, the SAN names in the CSR are used. - - See I(request_type) to understand more about SANs during reissues and renewals. - - In the case of certificates of type C(STANDARD_SSL) certificates, if the CN of the certificate is <domain>.<tld> only the www.<domain>.<tld> value + - See O(request_type) to understand more about SANs during reissues and renewals. + - In the case of certificates of type V(STANDARD_SSL) certificates, if the CN of the certificate is <domain>.<tld> only the www.<domain>.<tld> value is accepted. If the CN of the certificate is www.<domain>.<tld> only the <domain>.<tld> value is accepted. type: list elements: str eku: description: - - If specified, overrides the key usage in the I(csr). + - If specified, overrides the key usage in the O(csr). type: str choices: [ SERVER_AUTH, CLIENT_AUTH, SERVER_AND_CLIENT_AUTH ] ct_log: description: - In compliance with browser requirements, this certificate may be posted to the Certificate Transparency (CT) logs. This is a best practice technique that helps domain owners monitor certificates issued to their domains. Note that not all certificates are eligible for CT logging. - - If I(ct_log) is not specified, the certificate uses the account default. - - If I(ct_log) is specified and the account settings allow it, I(ct_log) overrides the account default. - - If I(ct_log) is set to C(false), but the account settings are set to "always log", the certificate generation will fail. + - If O(ct_log) is not specified, the certificate uses the account default. + - If O(ct_log) is specified and the account settings allow it, O(ct_log) overrides the account default. + - If O(ct_log) is set to V(false), but the account settings are set to "always log", the certificate generation will fail. type: bool client_id: description: - The client ID to submit the Certificate Signing Request under. - If no client ID is specified, the certificate will be submitted under the primary client with ID of 1. - - When using a client other than the primary client, the I(org) parameter cannot be specified. + - When using a client other than the primary client, the O(org) parameter cannot be specified. - The issued certificate will have an organization value in the subject distinguished name represented by the client. type: int default: 1 org: description: - Organization "O=" to include in the certificate. - - If I(org) is not specified, the organization from the client represented by I(client_id) is used. - - Unless the I(cert_type) is C(PD_SSL), this field may not be specified if the value of I(client_id) is not "1" (the primary client). + - If O(org) is not specified, the organization from the client represented by O(client_id) is used. + - Unless the O(cert_type) is V(PD_SSL), this field may not be specified if the value of O(client_id) is not "1" (the primary client). non-primary clients, certificates may only be issued with the organization of that client. type: str ou: description: - Organizational unit "OU=" to include in the certificate. - - I(ou) behavior is dependent on whether organizational units are enabled for your account. If organizational unit support is disabled for your - account, organizational units from the I(csr) and the I(ou) parameter are ignored. - - If both I(csr) and I(ou) are specified, the value in I(ou) will override the OU fields present in the subject distinguished name in the I(csr) - - If neither I(csr) nor I(ou) are specified for a renew or reissue operation, the OU fields in the initial certificate are reused. - - An invalid OU from I(csr) is ignored, but any invalid organizational units in I(ou) will result in an error indicating "Unapproved OU". The I(ou) + - O(ou) behavior is dependent on whether organizational units are enabled for your account. If organizational unit support is disabled for your + account, organizational units from the O(csr) and the O(ou) parameter are ignored. + - If both O(csr) and O(ou) are specified, the value in O(ou) will override the OU fields present in the subject distinguished name in the O(csr) + - If neither O(csr) nor O(ou) are specified for a renew or reissue operation, the OU fields in the initial certificate are reused. + - An invalid OU from O(csr) is ignored, but any invalid organizational units in O(ou) will result in an error indicating "Unapproved OU". The O(ou) parameter can be used to force failure if an unapproved organizational unit is provided. - A maximum of one OU may be specified for current products. Multiple OUs are reserved for future products. type: list @@ -181,10 +181,10 @@ options: end_user_key_storage_agreement: description: - The end user of the Code Signing certificate must generate and store the private key for this request on cryptographically secure - hardware to be compliant with the Entrust CSP and Subscription agreement. If requesting a certificate of type C(CODE_SIGNING) or - C(EV_CODE_SIGNING), you must set I(end_user_key_storage_agreement) to true if and only if you acknowledge that you will inform the user of this + hardware to be compliant with the Entrust CSP and Subscription agreement. If requesting a certificate of type V(CODE_SIGNING) or + V(EV_CODE_SIGNING), you must set O(end_user_key_storage_agreement) to true if and only if you acknowledge that you will inform the user of this requirement. - - Applicable only to I(cert_type) of values C(CODE_SIGNING) and C(EV_CODE_SIGNING). + - Applicable only to O(cert_type) of values V(CODE_SIGNING) and V(EV_CODE_SIGNING). type: bool tracking_info: description: Free form tracking information to attach to the record for the certificate. @@ -320,29 +320,29 @@ options: cert_expiry: description: - The date the certificate should be set to expire, in RFC3339 compliant date or date-time format. For example, - C(2020-02-23), C(2020-02-23T15:00:00.05Z). - - I(cert_expiry) is only supported for requests of C(request_type=new) or C(request_type=renew). If C(request_type=reissue), - I(cert_expiry) will be used for the first certificate issuance, but subsequent issuances will have the same expiry as the initial + V(2020-02-23), V(2020-02-23T15:00:00.05Z). + - O(cert_expiry) is only supported for requests of O(request_type=new) or O(request_type=renew). If O(request_type=reissue), + O(cert_expiry) will be used for the first certificate issuance, but subsequent issuances will have the same expiry as the initial certificate. - A reissued certificate will always have the same expiry as the original certificate. - Note that only the date (day, month, year) is supported for specifying the expiry date. If you choose to specify an expiry time with the expiry date, the time will be adjusted to Eastern Standard Time (EST). This could have the unintended effect of moving your expiry date to the previous day. - Applies only to accounts with a pooling inventory model. - - Only one of I(cert_expiry) or I(cert_lifetime) may be specified. + - Only one of O(cert_expiry) or O(cert_lifetime) may be specified. type: str cert_lifetime: description: - The lifetime of the certificate. - Applies to all certificates for accounts with a non-pooling inventory model. - - I(cert_lifetime) is only supported for requests of C(request_type=new) or C(request_type=renew). If C(request_type=reissue), I(cert_lifetime) will + - O(cert_lifetime) is only supported for requests of O(request_type=new) or O(request_type=renew). If O(request_type=reissue), O(cert_lifetime) will be used for the first certificate issuance, but subsequent issuances will have the same expiry as the initial certificate. - - Applies to certificates of I(cert_type)=C(CDS_INDIVIDUAL, CDS_GROUP, CDS_ENT_LITE, CDS_ENT_PRO, SMIME_ENT) for accounts with a pooling inventory - model. - - C(P1Y) is a certificate with a 1 year lifetime. - - C(P2Y) is a certificate with a 2 year lifetime. - - C(P3Y) is a certificate with a 3 year lifetime. - - Only one of I(cert_expiry) or I(cert_lifetime) may be specified. + - Applies to certificates of O(cert_type=CDS_INDIVIDUAL), V(CDS_GROUP), V(CDS_ENT_LITE), V(CDS_ENT_PRO), or V(SMIME_ENT) + for accounts with a pooling inventory model. + - V(P1Y) is a certificate with a 1 year lifetime. + - V(P2Y) is a certificate with a 2 year lifetime. + - V(P3Y) is a certificate with a 3 year lifetime. + - Only one of O(cert_expiry) or O(cert_lifetime) may be specified. type: str choices: [ P1Y, P2Y, P3Y ] seealso: @@ -350,6 +350,8 @@ seealso: description: Can be used to create private keys (both for certificates and accounts). - module: community.crypto.openssl_csr description: Can be used to create a Certificate Signing Request (CSR). + - plugin: community.crypto.to_serial + plugin_type: filter ''' EXAMPLES = r''' @@ -476,12 +478,12 @@ filename: sample: /etc/ssl/crt/www.ansible.com.crt backup_file: description: Name of backup file created for the certificate. - returned: changed and if I(backup) is C(true) + returned: changed and if O(backup) is V(true) type: str sample: /path/to/www.ansible.com.crt.2019-03-09@11:22~ backup_full_chain_file: description: Name of the backup file created for the certificate chain. - returned: changed and if I(backup) is C(true) and I(full_chain_path) is set. + returned: changed and if O(backup) is V(true) and O(full_chain_path) is set. type: str sample: /path/to/ca.chain.crt.2019-03-09@11:22~ tracking_id: @@ -490,7 +492,10 @@ tracking_id: type: int sample: 380079 serial_number: - description: The serial number of the issued certificate. + description: + - The serial number of the issued certificate. + - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, + such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). returned: success type: int sample: 1235262234164342 @@ -502,8 +507,8 @@ cert_days: cert_status: description: - The certificate status in ECS. - - 'Current possible values (which may be expanded in the future) are: C(ACTIVE), C(APPROVED), C(DEACTIVATED), C(DECLINED), C(EXPIRED), C(NA), - C(PENDING), C(PENDING_QUORUM), C(READY), C(REISSUED), C(REISSUING), C(RENEWED), C(RENEWING), C(REVOKED), C(SUSPENDED)' + - 'Current possible values (which may be expanded in the future) are: V(ACTIVE), V(APPROVED), V(DEACTIVATED), V(DECLINED), V(EXPIRED), V(NA), + V(PENDING), V(PENDING_QUORUM), V(READY), V(REISSUED), V(REISSUING), V(RENEWED), V(RENEWING), V(REVOKED), V(SUSPENDED)' returned: success type: str sample: ACTIVE diff --git a/ansible_collections/community/crypto/plugins/modules/ecs_domain.py b/ansible_collections/community/crypto/plugins/modules/ecs_domain.py index ec7ad98b0..0ee9380f1 100644 --- a/ansible_collections/community/crypto/plugins/modules/ecs_domain.py +++ b/ansible_collections/community/crypto/plugins/modules/ecs_domain.py @@ -20,19 +20,19 @@ description: - Request validation or re-validation of a domain with the Entrust Certificate Services (ECS) API. - Requires credentials for the L(Entrust Certificate Services,https://www.entrustdatacard.com/products/categories/ssl-certificates) (ECS) API. - If the domain is already in the validation process, no new validation will be requested, but the validation data (if applicable) will be returned. - - If the domain is already in the validation process but the I(verification_method) specified is different than the current I(verification_method), - the I(verification_method) will be updated and validation data (if applicable) will be returned. - - If the domain is an active, validated domain, the return value of I(changed) will be false, unless C(domain_status=EXPIRED), in which case a re-validation - will be performed. - - If C(verification_method=dns), details about the required DNS entry will be specified in the return parameters I(dns_contents), I(dns_location), and - I(dns_resource_type). - - If C(verification_method=web_server), details about the required file details will be specified in the return parameters I(file_contents) and - I(file_location). - - If C(verification_method=email), the email address(es) that the validation email(s) were sent to will be in the return parameter I(emails). This is + - If the domain is already in the validation process but the O(verification_method) specified is different than the current O(verification_method), + the O(verification_method) will be updated and validation data (if applicable) will be returned. + - If the domain is an active, validated domain, the return value of C(changed) will be false, unless RV(domain_status=EXPIRED), in which case a + re-validation will be performed. + - If O(verification_method=dns), details about the required DNS entry will be specified in the return parameters RV(dns_contents), RV(dns_location), and + RV(dns_resource_type). + - If O(verification_method=web_server), details about the required file details will be specified in the return parameters RV(file_contents) and + RV(file_location). + - If O(verification_method=email), the email address(es) that the validation email(s) were sent to will be in the return parameter RV(emails). This is purely informational. For domains requested using this module, this will always be a list of size 1. notes: - There is a small delay (typically about 5 seconds, but can be as long as 60 seconds) before obtaining the random values when requesting a validation - while C(verification_method=dns) or C(verification_method=web_server). Be aware of that if doing many domain validation requests. + while O(verification_method=dns) or O(verification_method=web_server). Be aware of that if doing many domain validation requests. extends_documentation_fragment: - community.crypto.attributes - community.crypto.ecs_credential @@ -56,35 +56,35 @@ options: verification_method: description: - The verification method to be used to prove control of the domain. - - If C(verification_method=email) and the value I(verification_email) is specified, that value is used for the email validation. If - I(verification_email) is not provided, the first value present in WHOIS data will be used. An email will be sent to the address in - I(verification_email) with instructions on how to verify control of the domain. - - If C(verification_method=dns), the value I(dns_contents) must be stored in location I(dns_location), with a DNS record type of - I(verification_dns_record_type). To prove domain ownership, update your DNS records so the text string returned by I(dns_contents) is available at - I(dns_location). - - If C(verification_method=web_server), the contents of return value I(file_contents) must be made available on a web server accessible at location - I(file_location). - - If C(verification_method=manual), the domain will be validated with a manual process. This is not recommended. + - If O(verification_method=email) and the value O(verification_email) is specified, that value is used for the email validation. If + O(verification_email) is not provided, the first value present in WHOIS data will be used. An email will be sent to the address in + O(verification_email) with instructions on how to verify control of the domain. + - If O(verification_method=dns), the value RV(dns_contents) must be stored in location RV(dns_location), with a DNS record type of + RV(dns_resource_type). To prove domain ownership, update your DNS records so the text string returned by RV(dns_contents) is available at + RV(dns_location). + - If O(verification_method=web_server), the contents of return value RV(file_contents) must be made available on a web server accessible at location + RV(file_location). + - If O(verification_method=manual), the domain will be validated with a manual process. This is not recommended. type: str choices: [ 'dns', 'email', 'manual', 'web_server'] required: true verification_email: description: - Email address to be used to verify domain ownership. - - 'Email address must be either an email address present in the WHOIS data for I(domain_name), or one of the following constructed emails: - admin@I(domain_name), administrator@I(domain_name), webmaster@I(domain_name), hostmaster@I(domain_name), postmaster@I(domain_name).' - - 'Note that if I(domain_name) includes subdomains, the top level domain should be used. For example, if requesting validation of + - 'Email address must be either an email address present in the WHOIS data for O(domain_name), or one of the following constructed emails: + admin@O(domain_name), administrator@O(domain_name), webmaster@O(domain_name), hostmaster@O(domain_name), postmaster@O(domain_name).' + - 'Note that if O(domain_name) includes subdomains, the top level domain should be used. For example, if requesting validation of example1.ansible.com, or test.example2.ansible.com, and you want to use the "admin" preconstructed name, the email address should be admin@ansible.com.' - If using the email values from the WHOIS data for the domain or its top level namespace, they must be exact matches. - - If C(verification_method=email) but I(verification_email) is not provided, the first email address found in WHOIS data for the domain will be + - If O(verification_method=email) but O(verification_email) is not provided, the first email address found in WHOIS data for the domain will be used. - To verify domain ownership, domain owner must follow the instructions in the email they receive. - - Only allowed if C(verification_method=email) + - Only allowed if O(verification_method=email) type: str seealso: - module: community.crypto.x509_certificate - description: Can be used to request certificates from ECS, with C(provider=entrust). + description: Can be used to request certificates from ECS, with O(community.crypto.x509_certificate#module:provider=entrust). - module: community.crypto.ecs_certificate description: Can be used to request a Certificate from ECS using a verified domain. ''' @@ -133,72 +133,72 @@ EXAMPLES = r''' RETURN = ''' domain_status: - description: Status of the current domain. Will be one of C(APPROVED), C(DECLINED), C(CANCELLED), C(INITIAL_VERIFICATION), C(DECLINED), C(CANCELLED), - C(RE_VERIFICATION), C(EXPIRED), C(EXPIRING) + description: Status of the current domain. Will be one of V(APPROVED), V(DECLINED), V(CANCELLED), V(INITIAL_VERIFICATION), V(DECLINED), V(CANCELLED), + V(RE_VERIFICATION), V(EXPIRED), V(EXPIRING) returned: changed or success type: str sample: APPROVED verification_method: - description: Verification method used to request the domain validation. If C(changed) will be the same as I(verification_method) input parameter. + description: Verification method used to request the domain validation. If C(changed) will be the same as O(verification_method) input parameter. returned: changed or success type: str sample: dns file_location: - description: The location that ECS will be expecting to be able to find the file for domain verification, containing the contents of I(file_contents). - returned: I(verification_method) is C(web_server) + description: The location that ECS will be expecting to be able to find the file for domain verification, containing the contents of RV(file_contents). + returned: O(verification_method) is V(web_server) type: str sample: http://ansible.com/.well-known/pki-validation/abcd.txt file_contents: - description: The contents of the file that ECS will be expecting to find at C(file_location). - returned: I(verification_method) is C(web_server) + description: The contents of the file that ECS will be expecting to find at RV(file_location). + returned: O(verification_method) is V(web_server) type: str sample: AB23CD41432522FF2526920393982FAB emails: description: - The list of emails used to request validation of this domain. - Domains requested using this module will only have a list of size 1. - returned: I(verification_method) is C(email) + returned: O(verification_method) is V(email) type: list sample: [ admin@ansible.com, administrator@ansible.com ] dns_location: - description: The location that ECS will be expecting to be able to find the DNS entry for domain verification, containing the contents of I(dns_contents). - returned: changed and if I(verification_method) is C(dns) + description: The location that ECS will be expecting to be able to find the DNS entry for domain verification, containing the contents of RV(dns_contents). + returned: changed and if O(verification_method) is V(dns) type: str sample: _pki-validation.ansible.com dns_contents: - description: The value that ECS will be expecting to find in the DNS record located at I(dns_location). - returned: changed and if I(verification_method) is C(dns) + description: The value that ECS will be expecting to find in the DNS record located at RV(dns_location). + returned: changed and if O(verification_method) is V(dns) type: str sample: AB23CD41432522FF2526920393982FAB dns_resource_type: - description: The type of resource record that ECS will be expecting for the DNS record located at I(dns_location). - returned: changed and if I(verification_method) is C(dns) + description: The type of resource record that ECS will be expecting for the DNS record located at RV(dns_location). + returned: changed and if O(verification_method) is V(dns) type: str sample: TXT client_id: - description: Client ID that the domain belongs to. If the input value I(client_id) is specified, this will always be the same as I(client_id) + description: Client ID that the domain belongs to. If the input value O(client_id) is specified, this will always be the same as O(client_id) returned: changed or success type: int sample: 1 ov_eligible: - description: Whether the domain is eligible for submission of "OV" certificates. Will never be C(false) if I(ov_eligible) is C(true) - returned: success and I(domain_status) is C(APPROVED), C(RE_VERIFICATION), C(EXPIRING), or C(EXPIRED). + description: Whether the domain is eligible for submission of "OV" certificates. Will never be V(false) if RV(ev_eligible) is V(true) + returned: success and RV(domain_status) is V(APPROVED), V(RE_VERIFICATION), V(EXPIRING), or V(EXPIRED). type: bool sample: true ov_days_remaining: - description: The number of days the domain remains eligible for submission of "OV" certificates. Will never be less than the value of I(ev_days_remaining) - returned: success and I(ov_eligible) is C(true) and I(domain_status) is C(APPROVED), C(RE_VERIFICATION) or C(EXPIRING). + description: The number of days the domain remains eligible for submission of "OV" certificates. Will never be less than the value of RV(ev_days_remaining) + returned: success and RV(ov_eligible) is V(true) and RV(domain_status) is V(APPROVED), V(RE_VERIFICATION) or V(EXPIRING). type: int sample: 129 ev_eligible: - description: Whether the domain is eligible for submission of "EV" certificates. Will never be C(true) if I(ov_eligible) is C(false) - returned: success and I(domain_status) is C(APPROVED), C(RE_VERIFICATION) or C(EXPIRING), or C(EXPIRED). + description: Whether the domain is eligible for submission of "EV" certificates. Will never be V(true) if RV(ov_eligible) is V(false) + returned: success and RV(domain_status) is V(APPROVED), V(RE_VERIFICATION) or V(EXPIRING), or V(EXPIRED). type: bool sample: true ev_days_remaining: description: The number of days the domain remains eligible for submission of "EV" certificates. Will never be greater than the value of - I(ov_days_remaining) - returned: success and I(ev_eligible) is C(true) and I(domain_status) is C(APPROVED), C(RE_VERIFICATION) or C(EXPIRING). + RV(ov_days_remaining) + returned: success and RV(ev_eligible) is V(true) and RV(domain_status) is V(APPROVED), V(RE_VERIFICATION) or V(EXPIRING). type: int sample: 94 diff --git a/ansible_collections/community/crypto/plugins/modules/get_certificate.py b/ansible_collections/community/crypto/plugins/modules/get_certificate.py index 4b2eeaed8..0f8abc90a 100644 --- a/ansible_collections/community/crypto/plugins/modules/get_certificate.py +++ b/ansible_collections/community/crypto/plugins/modules/get_certificate.py @@ -63,7 +63,7 @@ options: starttls: description: - Requests a secure connection for protocols which require clients to initiate encryption. - - Only available for C(mysql) currently. + - Only available for V(mysql) currently. type: str choices: - mysql @@ -76,15 +76,15 @@ options: select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography ] ciphers: description: - SSL/TLS Ciphers to use for the request. - - 'When a list is provided, all ciphers are joined in order with C(:).' + - 'When a list is provided, all ciphers are joined in order with V(:).' - See the L(OpenSSL Cipher List Format,https://www.openssl.org/docs/manmaster/man1/openssl-ciphers.html#CIPHER-LIST-FORMAT) for more details. - The available ciphers is dependent on the Python and OpenSSL/LibreSSL versions. @@ -93,20 +93,23 @@ options: version_added: 2.11.0 asn1_base64: description: - - Whether to encode the ASN.1 values in the C(extensions) return value with Base64 or not. + - Whether to encode the ASN.1 values in the RV(extensions) return value with Base64 or not. - The documentation claimed for a long time that the values are Base64 encoded, but they - never were. For compatibility this option is set to C(false), but that value will eventually - be deprecated and changed to C(true). + never were. For compatibility this option is set to V(false). + - The default value V(false) is B(deprecated) and will change to V(true) in community.crypto 3.0.0. type: bool - default: false version_added: 2.12.0 notes: - When using ca_cert on OS X it has been reported that in some conditions the validate will always succeed. requirements: - - "python >= 2.7 when using C(proxy_host)" + - "python >= 2.7 when using O(proxy_host)" - "cryptography >= 1.6" + +seealso: + - plugin: community.crypto.to_serial + plugin_type: filter ''' RETURN = ''' @@ -133,7 +136,7 @@ extensions: type: str description: - The ASN.1 content of the extension. - - If I(asn1_base64=true) this will be Base64 encoded, otherwise the raw + - If O(asn1_base64=true) this will be Base64 encoded, otherwise the raw binary value will be returned. - Please note that the raw binary value might not survive JSON serialization to the Ansible controller, and also might cause failures when displaying it. @@ -148,31 +151,34 @@ extensions: type: str description: The extension's name. issuer: - description: Information about the issuer of the cert + description: Information about the issuer of the cert. returned: success type: dict not_after: - description: Expiration date of the cert + description: Expiration date of the cert. returned: success type: str not_before: - description: Issue date of the cert + description: Issue date of the cert. returned: success type: str serial_number: - description: The serial number of the cert + description: + - The serial number of the cert. + - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, + such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). returned: success - type: str + type: int signature_algorithm: - description: The algorithm used to sign the cert + description: The algorithm used to sign the cert. returned: success type: str subject: - description: Information about the subject of the cert (OU, CN, etc) + description: Information about the subject of the cert (C(OU), C(CN), etc). returned: success type: dict version: - description: The version number of the certificate + description: The version number of the certificate. returned: success type: str ''' @@ -272,7 +278,7 @@ def main(): select_crypto_backend=dict(type='str', choices=['auto', 'cryptography'], default='auto'), starttls=dict(type='str', choices=['mysql']), ciphers=dict(type='list', elements='str'), - asn1_base64=dict(type='bool', default=False), + asn1_base64=dict(type='bool'), ), ) @@ -286,6 +292,15 @@ def main(): start_tls_server_type = module.params.get('starttls') ciphers = module.params.get('ciphers') asn1_base64 = module.params['asn1_base64'] + if asn1_base64 is None: + module.deprecate( + 'The default value `false` for asn1_base64 is deprecated and will change to `true` in ' + 'community.crypto 3.0.0. If you need this value, it is best to set the value explicitly ' + 'and adjust your roles/playbooks to use `asn1_base64=true` as soon as possible', + version='3.0.0', + collection_name='community.crypto', + ) + asn1_base64 = False backend = module.params.get('select_crypto_backend') if backend == 'auto': diff --git a/ansible_collections/community/crypto/plugins/modules/luks_device.py b/ansible_collections/community/crypto/plugins/modules/luks_device.py index d8b70e748..5c41eddd3 100644 --- a/ansible_collections/community/crypto/plugins/modules/luks_device.py +++ b/ansible_collections/community/crypto/plugins/modules/luks_device.py @@ -30,55 +30,66 @@ attributes: options: device: description: - - "Device to work with (for example C(/dev/sda1)). Needed in most cases. - Can be omitted only when I(state=closed) together with I(name) + - "Device to work with (for example V(/dev/sda1)). Needed in most cases. + Can be omitted only when O(state=closed) together with O(name) is provided." type: str state: description: - "Desired state of the LUKS container. Based on its value creates, destroys, opens or closes the LUKS container on a given device." - - "I(present) will create LUKS container unless already present. - Requires I(device) and either I(keyfile) or I(passphrase) options + - "V(present) will create LUKS container unless already present. + Requires O(device) and either O(keyfile) or O(passphrase) options to be provided." - - "I(absent) will remove existing LUKS container if it exists. - Requires I(device) or I(name) to be specified." - - "I(opened) will unlock the LUKS container. If it does not exist + - "V(absent) will remove existing LUKS container if it exists. + Requires O(device) or O(name) to be specified." + - "V(opened) will unlock the LUKS container. If it does not exist it will be created first. - Requires I(device) and either I(keyfile) or I(passphrase) - to be specified. Use the I(name) option to set the name of + Requires O(device) and either O(keyfile) or O(passphrase) + to be specified. Use the O(name) option to set the name of the opened container. Otherwise the name will be generated automatically and returned as a part of the result." - - "I(closed) will lock the LUKS container. However if the container + - "V(closed) will lock the LUKS container. However if the container does not exist it will be created. - Requires I(device) and either I(keyfile) or I(passphrase) + Requires O(device) and either O(keyfile) or O(passphrase) options to be provided. If container does already exist - I(device) or I(name) will suffice." + O(device) or O(name) will suffice." type: str default: present choices: [present, absent, opened, closed] name: description: - - "Sets container name when I(state=opened). Can be used - instead of I(device) when closing the existing container - (that is, when I(state=closed))." + - "Sets container name when O(state=opened). Can be used + instead of O(device) when closing the existing container + (that is, when O(state=closed))." type: str keyfile: description: - - "Used to unlock the container. Either a I(keyfile) or a - I(passphrase) is needed for most of the operations. Parameter + - "Used to unlock the container. Either a O(keyfile) or a + O(passphrase) is needed for most of the operations. Parameter value is the path to the keyfile with the passphrase." - "BEWARE that working with keyfiles in plaintext is dangerous. Make sure that they are protected." type: path passphrase: description: - - "Used to unlock the container. Either a I(passphrase) or a - I(keyfile) is needed for most of the operations. Parameter + - "Used to unlock the container. Either a O(passphrase) or a + O(keyfile) is needed for most of the operations. Parameter value is a string with the passphrase." type: str version_added: '1.0.0' + keyslot: + description: + - "Adds the O(keyfile) or O(passphrase) to a specific keyslot when + creating a new container on O(device). Parameter value is the + number of the keyslot." + - "B(Note) that a device of O(type=luks1) supports the keyslot numbers + V(0)-V(7) and a device of O(type=luks2) supports the keyslot numbers + V(0)-V(31). In order to use the keyslots V(8)-V(31) when creating a new + container, setting O(type) to V(luks2) is required." + type: int + version_added: '2.16.0' keysize: description: - "Sets the key size only if LUKS container does not exist." @@ -86,8 +97,8 @@ options: version_added: '1.0.0' new_keyfile: description: - - "Adds additional key to given container on I(device). - Needs I(keyfile) or I(passphrase) option for authorization. + - "Adds additional key to given container on O(device). + Needs O(keyfile) or O(passphrase) option for authorization. LUKS container supports up to 8 keyslots. Parameter value is the path to the keyfile with the passphrase." - "NOTE that adding additional keys is idempotent only since @@ -99,8 +110,8 @@ options: type: path new_passphrase: description: - - "Adds additional passphrase to given container on I(device). - Needs I(keyfile) or I(passphrase) option for authorization. LUKS + - "Adds additional passphrase to given container on O(device). + Needs O(keyfile) or O(passphrase) option for authorization. LUKS container supports up to 8 keyslots. Parameter value is a string with the new passphrase." - "NOTE that adding additional passphrase is idempotent only since @@ -108,34 +119,55 @@ options: be used even if another keyslot already exists for this passphrase." type: str version_added: '1.0.0' + new_keyslot: + description: + - "Adds the additional O(new_keyfile) or O(new_passphrase) to a + specific keyslot on the given O(device). Parameter value is the number + of the keyslot." + - "B(Note) that a device of O(type=luks1) supports the keyslot numbers + V(0)-V(7) and a device of O(type=luks2) supports the keyslot numbers + V(0)-V(31)." + type: int + version_added: '2.16.0' remove_keyfile: description: - - "Removes given key from the container on I(device). Does not + - "Removes given key from the container on O(device). Does not remove the keyfile from filesystem. Parameter value is the path to the keyfile with the passphrase." - "NOTE that removing keys is idempotent only since community.crypto 1.4.0. For older versions, trying to remove a key which no longer exists results in an error." - "NOTE that to remove the last key from a LUKS container, the - I(force_remove_last_key) option must be set to C(true)." + O(force_remove_last_key) option must be set to V(true)." - "BEWARE that working with keyfiles in plaintext is dangerous. Make sure that they are protected." type: path remove_passphrase: description: - - "Removes given passphrase from the container on I(device). + - "Removes given passphrase from the container on O(device). Parameter value is a string with the passphrase to remove." - "NOTE that removing passphrases is idempotent only since community.crypto 1.4.0. For older versions, trying to remove a passphrase which no longer exists results in an error." - "NOTE that to remove the last keyslot from a LUKS - container, the I(force_remove_last_key) option must be set - to C(true)." + container, the O(force_remove_last_key) option must be set + to V(true)." type: str version_added: '1.0.0' + remove_keyslot: + description: + - "Removes the key in the given slot on O(device). Needs + O(keyfile) or O(passphrase) for authorization." + - "B(Note) that a device of O(type=luks1) supports the keyslot numbers + V(0)-V(7) and a device of O(type=luks2) supports the keyslot numbers + V(0)-V(31)." + - "B(Note) that the given O(keyfile) or O(passphrase) must not be + in the slot to be removed." + type: int + version_added: '2.16.0' force_remove_last_key: description: - - "If set to C(true), allows removing the last key from a container." + - "If set to V(true), allows removing the last key from a container." - "BEWARE that when the last key has been removed from a container, the container can no longer be opened!" type: bool @@ -145,21 +177,21 @@ options: - "This option allow the user to create a LUKS2 format container with label support, respectively to identify the container by label on later usages." - - "Will only be used on container creation, or when I(device) is + - "Will only be used on container creation, or when O(device) is not specified." - - "This cannot be specified if I(type) is set to C(luks1)." + - "This cannot be specified if O(type) is set to V(luks1)." type: str version_added: '1.0.0' uuid: description: - "With this option user can identify the LUKS container by UUID." - - "Will only be used when I(device) and I(label) are not specified." + - "Will only be used when O(device) and O(label) are not specified." type: str version_added: '1.0.0' type: description: - "This option allow the user explicit define the format of LUKS - container that wants to work with. Options are C(luks1) or C(luks2)" + container that wants to work with. Options are V(luks1) or V(luks2)" type: str choices: [luks1, luks2] version_added: '1.0.0' @@ -168,8 +200,8 @@ options: - "This option allows the user to define the cipher specification string for the LUKS container." - "Will only be used on container creation." - - "For pre-2.6.10 kernels, use C(aes-plain) as they do not understand - the new cipher spec strings. To use ESSIV, use C(aes-cbc-essiv:sha256)." + - "For pre-2.6.10 kernels, use V(aes-plain) as they do not understand + the new cipher spec strings. To use ESSIV, use V(aes-cbc-essiv:sha256)." type: str version_added: '1.1.0' hash: @@ -193,12 +225,12 @@ options: - Specify the iteration time used for the PBKDF. - Note that this is in B(seconds), not in milliseconds as on the command line. - - Mutually exclusive with I(iteration_count). + - Mutually exclusive with O(pbkdf.iteration_count). type: float iteration_count: description: - Specify the iteration count used for the PBKDF. - - Mutually exclusive with I(iteration_time). + - Mutually exclusive with O(pbkdf.iteration_time). type: int algorithm: description: @@ -261,19 +293,26 @@ options: persistent: description: - "Allows the user to store options into container's metadata persistently and automatically use them next time. - Only I(perf_same_cpu_crypt), I(perf_submit_from_crypt_cpus), I(perf_no_read_workqueue), and I(perf_no_write_workqueue) - can be stored persistently." + Only O(perf_same_cpu_crypt), O(perf_submit_from_crypt_cpus), O(perf_no_read_workqueue), O(perf_no_write_workqueue), + and O(allow_discards) can be stored persistently." - "Will only work with LUKS2 containers." - "Will only be used when opening containers." type: bool default: false version_added: '2.3.0' + allow_discards: + description: + - "Allow discards (also known as TRIM) requests for device." + - "Will only be used when opening containers." + type: bool + default: false + version_added: '2.17.0' requirements: - "cryptsetup" - - "wipefs (when I(state) is C(absent))" + - "wipefs (when O(state) is V(absent))" - "lsblk" - - "blkid (when I(label) or I(uuid) options are used)" + - "blkid (when O(label) or O(uuid) options are used)" author: Jan Pokorny (@japokorn) ''' @@ -377,12 +416,32 @@ EXAMPLES = ''' state: "present" keyfile: "/vault/keyfile" type: luks2 + +- name: Create a container with key in slot 4 + community.crypto.luks_device: + device: "/dev/loop0" + state: "present" + keyfile: "/vault/keyfile" + keyslot: 4 + +- name: Add a new key in slot 5 + community.crypto.luks_device: + device: "/dev/loop0" + keyfile: "/vault/keyfile" + new_keyfile: "/vault/keyfile" + new_keyslot: 5 + +- name: Remove the key from slot 4 (given keyfile must not be slot 4) + community.crypto.luks_device: + device: "/dev/loop0" + keyfile: "/vault/keyfile" + remove_keyslot: 4 ''' RETURN = ''' name: description: - When I(state=opened) returns (generated or given) name + When O(state=opened) returns (generated or given) name of LUKS container. Returns None if no name is supplied. returned: success type: str @@ -523,6 +582,29 @@ class CryptHandler(Handler): result = self._run_command([self._cryptsetup_bin, 'isLuks', device]) return result[RETURN_CODE] == 0 + def get_luks_type(self, device): + ''' get the luks type of a device + ''' + if self.is_luks(device): + with open(device, 'rb') as f: + for offset in LUKS2_HEADER_OFFSETS: + f.seek(offset) + data = f.read(LUKS_HEADER_L) + if data == LUKS2_HEADER2: + return 'luks2' + return 'luks1' + return None + + def is_luks_slot_set(self, device, keyslot): + ''' check if a keyslot is set + ''' + result = self._run_command([self._cryptsetup_bin, 'luksDump', device]) + if result[RETURN_CODE] != 0: + raise ValueError('Error while dumping LUKS header from %s' % (device, )) + result_luks1 = 'Key Slot %d: ENABLED' % (keyslot) in result[STDOUT] + result_luks2 = ' %d: luks2' % (keyslot) in result[STDOUT] + return result_luks1 or result_luks2 + def _add_pbkdf_options(self, options, pbkdf): if pbkdf['iteration_time'] is not None: options.extend(['--iter-time', str(int(pbkdf['iteration_time'] * 1000))]) @@ -535,7 +617,7 @@ class CryptHandler(Handler): if pbkdf['parallel'] is not None: options.extend(['--pbkdf-parallel', str(pbkdf['parallel'])]) - def run_luks_create(self, device, keyfile, passphrase, keysize, cipher, hash_, sector_size, pbkdf): + def run_luks_create(self, device, keyfile, passphrase, keyslot, keysize, cipher, hash_, sector_size, pbkdf): # create a new luks container; use batch mode to auto confirm luks_type = self._module.params['type'] label = self._module.params['label'] @@ -556,6 +638,8 @@ class CryptHandler(Handler): self._add_pbkdf_options(options, pbkdf) if sector_size is not None: options.extend(['--sector-size', str(sector_size)]) + if keyslot is not None: + options.extend(['--key-slot', str(keyslot)]) args = [self._cryptsetup_bin, 'luksFormat'] args.extend(options) @@ -569,7 +653,7 @@ class CryptHandler(Handler): % (device, result[STDERR])) def run_luks_open(self, device, keyfile, passphrase, perf_same_cpu_crypt, perf_submit_from_crypt_cpus, - perf_no_read_workqueue, perf_no_write_workqueue, persistent, name): + perf_no_read_workqueue, perf_no_write_workqueue, persistent, allow_discards, name): args = [self._cryptsetup_bin] if keyfile: args.extend(['--key-file', keyfile]) @@ -583,6 +667,8 @@ class CryptHandler(Handler): args.extend(['--perf-no_write_workqueue']) if persistent: args.extend(['--persistent']) + if allow_discards: + args.extend(['--allow-discards']) args.extend(['open', '--type', 'luks', device, name]) result = self._run_command(args, data=passphrase) @@ -615,7 +701,7 @@ class CryptHandler(Handler): raise ValueError('Error while wiping LUKS container signatures for %s: %s' % (device, exc)) def run_luks_add_key(self, device, keyfile, passphrase, new_keyfile, - new_passphrase, pbkdf): + new_passphrase, new_keyslot, pbkdf): ''' Add new key from a keyfile or passphrase to given 'device'; authentication done using 'keyfile' or 'passphrase'. Raises ValueError when command fails. @@ -625,6 +711,9 @@ class CryptHandler(Handler): if pbkdf is not None: self._add_pbkdf_options(args, pbkdf) + if new_keyslot is not None: + args.extend(['--key-slot', str(new_keyslot)]) + if keyfile: args.extend(['--key-file', keyfile]) else: @@ -640,7 +729,7 @@ class CryptHandler(Handler): raise ValueError('Error while adding new LUKS keyslot to %s: %s' % (device, result[STDERR])) - def run_luks_remove_key(self, device, keyfile, passphrase, + def run_luks_remove_key(self, device, keyfile, passphrase, keyslot, force_remove_last_key=False): ''' Remove key from given device Raises ValueError when command fails @@ -675,7 +764,10 @@ class CryptHandler(Handler): "To be able to remove a key, please set " "`force_remove_last_key` to `true`." % device) - args = [self._cryptsetup_bin, 'luksRemoveKey', device, '-q'] + if keyslot is None: + args = [self._cryptsetup_bin, 'luksRemoveKey', device, '-q'] + else: + args = [self._cryptsetup_bin, 'luksKillSlot', device, '-q', str(keyslot)] if keyfile: args.extend(['--key-file', keyfile]) result = self._run_command(args, data=passphrase) @@ -683,7 +775,7 @@ class CryptHandler(Handler): raise ValueError('Error while removing LUKS key from %s: %s' % (device, result[STDERR])) - def luks_test_key(self, device, keyfile, passphrase): + def luks_test_key(self, device, keyfile, passphrase, keyslot=None): ''' Check whether the keyfile or passphrase works. Raises ValueError when command fails. ''' @@ -695,12 +787,22 @@ class CryptHandler(Handler): else: data = passphrase + if keyslot is not None: + args.extend(['--key-slot', str(keyslot)]) + result = self._run_command(args, data=data) if result[RETURN_CODE] == 0: return True for output in (STDOUT, STDERR): if 'No key available with this passphrase' in result[output]: return False + if 'No usable keyslot is available.' in result[output]: + return False + + # This check is necessary due to cryptsetup in version 2.0.3 not printing 'No usable keyslot is available' + # when using the --key-slot parameter in combination with --test-passphrase + if result[RETURN_CODE] == 1 and keyslot is not None and result[STDOUT] == '' and result[STDERR] == '': + return False raise ValueError('Error while testing whether keyslot exists on %s: %s' % (device, result[STDERR])) @@ -812,12 +914,20 @@ class ConditionsHandler(Handler): self._module.fail_json(msg="Contradiction in setup: Asking to " "add a key to absent LUKS.") - return not self._crypthandler.luks_test_key(self.device, self._module.params['new_keyfile'], self._module.params['new_passphrase']) + key_present = self._crypthandler.luks_test_key(self.device, self._module.params['new_keyfile'], self._module.params['new_passphrase']) + if self._module.params['new_keyslot'] is not None: + key_present_slot = self._crypthandler.luks_test_key(self.device, self._module.params['new_keyfile'], self._module.params['new_passphrase'], + self._module.params['new_keyslot']) + if key_present and not key_present_slot: + self._module.fail_json(msg="Trying to add key that is already present in another slot") + + return not key_present def luks_remove_key(self): if (self.device is None or (self._module.params['remove_keyfile'] is None and - self._module.params['remove_passphrase'] is None)): + self._module.params['remove_passphrase'] is None and + self._module.params['remove_keyslot'] is None)): # conditions for removing a key not fulfilled return False @@ -825,6 +935,15 @@ class ConditionsHandler(Handler): self._module.fail_json(msg="Contradiction in setup: Asking to " "remove a key from absent LUKS.") + if self._module.params['remove_keyslot'] is not None: + if not self._crypthandler.is_luks_slot_set(self.device, self._module.params['remove_keyslot']): + return False + result = self._crypthandler.luks_test_key(self.device, self._module.params['keyfile'], self._module.params['passphrase']) + if self._crypthandler.luks_test_key(self.device, self._module.params['keyfile'], self._module.params['passphrase'], + self._module.params['remove_keyslot']): + self._module.fail_json(msg='Cannot remove keyslot with keyfile or passphrase in same slot.') + return result + return self._crypthandler.luks_test_key(self.device, self._module.params['remove_keyfile'], self._module.params['remove_passphrase']) def luks_remove(self): @@ -832,6 +951,19 @@ class ConditionsHandler(Handler): self._module.params['state'] == 'absent' and self._crypthandler.is_luks(self.device)) + def validate_keyslot(self, param, luks_type): + if self._module.params[param] is not None: + if luks_type is None and param == 'keyslot': + if 8 <= self._module.params[param] <= 31: + self._module.fail_json(msg="You must specify type=luks2 when creating a new LUKS device to use keyslots 8-31.") + elif not (0 <= self._module.params[param] <= 7): + self._module.fail_json(msg="When not specifying a type, only the keyslots 0-7 are allowed.") + + if luks_type == 'luks1' and not 0 <= self._module.params[param] <= 7: + self._module.fail_json(msg="%s must be between 0 and 7 when using LUKS1." % self._module.params[param]) + elif luks_type == 'luks2' and not 0 <= self._module.params[param] <= 31: + self._module.fail_json(msg="%s must be between 0 and 31 when using LUKS2." % self._module.params[param]) + def run_module(): # available arguments/parameters that a user can pass @@ -845,6 +977,9 @@ def run_module(): passphrase=dict(type='str', no_log=True), new_passphrase=dict(type='str', no_log=True), remove_passphrase=dict(type='str', no_log=True), + keyslot=dict(type='int', no_log=False), + new_keyslot=dict(type='int', no_log=False), + remove_keyslot=dict(type='int', no_log=False), force_remove_last_key=dict(type='bool', default=False), keysize=dict(type='int'), label=dict(type='str'), @@ -869,12 +1004,13 @@ def run_module(): perf_no_read_workqueue=dict(type='bool', default=False), perf_no_write_workqueue=dict(type='bool', default=False), persistent=dict(type='bool', default=False), + allow_discards=dict(type='bool', default=False), ) mutually_exclusive = [ ('keyfile', 'passphrase'), ('new_keyfile', 'new_passphrase'), - ('remove_keyfile', 'remove_passphrase') + ('remove_keyfile', 'remove_passphrase', 'remove_keyslot') ] # seed the result dict in the object @@ -904,6 +1040,17 @@ def run_module(): if module.params['label'] is not None and module.params['type'] == 'luks1': module.fail_json(msg='You cannot combine type luks1 with the label option.') + if module.params['keyslot'] is not None or module.params['new_keyslot'] is not None or module.params['remove_keyslot'] is not None: + luks_type = crypt.get_luks_type(conditions.get_device_name()) + if luks_type is None and module.params['type'] is not None: + luks_type = module.params['type'] + for param in ['keyslot', 'new_keyslot', 'remove_keyslot']: + conditions.validate_keyslot(param, luks_type) + + for param in ['new_keyslot', 'remove_keyslot']: + if module.params[param] is not None and module.params['keyfile'] is None and module.params['passphrase'] is None: + module.fail_json(msg="Removing a keyslot requires the passphrase or keyfile of another slot.") + # The conditions are in order to allow more operations in one run. # (e.g. create luks and add a key to it) @@ -914,6 +1061,7 @@ def run_module(): crypt.run_luks_create(conditions.device, module.params['keyfile'], module.params['passphrase'], + module.params['keyslot'], module.params['keysize'], module.params['cipher'], module.params['hash'], @@ -949,6 +1097,7 @@ def run_module(): module.params['perf_no_read_workqueue'], module.params['perf_no_write_workqueue'], module.params['persistent'], + module.params['allow_discards'], name) except ValueError as e: module.fail_json(msg="luks_device error: %s" % e) @@ -986,6 +1135,7 @@ def run_module(): module.params['passphrase'], module.params['new_keyfile'], module.params['new_passphrase'], + module.params['new_keyslot'], module.params['pbkdf']) except ValueError as e: module.fail_json(msg="luks_device error: %s" % e) @@ -1001,6 +1151,7 @@ def run_module(): crypt.run_luks_remove_key(conditions.device, module.params['remove_keyfile'], module.params['remove_passphrase'], + module.params['remove_keyslot'], force_remove_last_key=last_key) except ValueError as e: module.fail_json(msg="luks_device error: %s" % e) diff --git a/ansible_collections/community/crypto/plugins/modules/openssh_cert.py b/ansible_collections/community/crypto/plugins/modules/openssh_cert.py index 8f428107a..8e864cd7d 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssh_cert.py +++ b/ansible_collections/community/crypto/plugins/modules/openssh_cert.py @@ -40,13 +40,13 @@ options: type: description: - Whether the module should generate a host or a user certificate. - - Required if I(state) is C(present). + - Required if O(state) is V(present). type: str choices: ['host', 'user'] force: description: - Should the certificate be regenerated even if it already exists and is valid. - - Equivalent to I(regenerate=always). + - Equivalent to O(regenerate=always). type: bool default: false path: @@ -56,16 +56,16 @@ options: required: true regenerate: description: - - When C(never) the task will fail if a certificate already exists at I(path) and is unreadable + - When V(never) the task will fail if a certificate already exists at O(path) and is unreadable otherwise a new certificate will only be generated if there is no existing certificate. - - When C(fail) the task will fail if a certificate already exists at I(path) and does not + - When V(fail) the task will fail if a certificate already exists at O(path) and does not match the module's options. - - When C(partial_idempotence) an existing certificate will be regenerated based on - I(serial), I(signature_algorithm), I(type), I(valid_from), I(valid_to), I(valid_at), and I(principals). - I(valid_from) and I(valid_to) can be excluded by I(ignore_timestamps=true). - - When C(full_idempotence) I(identifier), I(options), I(public_key), and I(signing_key) + - When V(partial_idempotence) an existing certificate will be regenerated based on + O(serial_number), O(signature_algorithm), O(type), O(valid_from), O(valid_to), O(valid_at), and O(principals). + O(valid_from) and O(valid_to) can be excluded by O(ignore_timestamps=true). + - When V(full_idempotence) O(identifier), O(options), O(public_key), and O(signing_key) are also considered when compared against an existing certificate. - - C(always) is equivalent to I(force=true). + - V(always) is equivalent to O(force=true). type: str choices: - never @@ -78,14 +78,14 @@ options: signature_algorithm: description: - As of OpenSSH 8.2 the SHA-1 signature algorithm for RSA keys has been disabled and C(ssh) will refuse - host certificates signed with the SHA-1 algorithm. OpenSSH 8.1 made C(rsa-sha2-512) the default algorithm + host certificates signed with the SHA-1 algorithm. OpenSSH 8.1 made V(rsa-sha2-512) the default algorithm when acting as a CA and signing certificates with a RSA key. However, for OpenSSH versions less than 8.1 - the SHA-2 signature algorithms, C(rsa-sha2-256) or C(rsa-sha2-512), must be specified using this option + the SHA-2 signature algorithms, V(rsa-sha2-256) or V(rsa-sha2-512), must be specified using this option if compatibility with newer C(ssh) clients is required. Conversely if hosts using OpenSSH version 8.2 - or greater must remain compatible with C(ssh) clients using OpenSSH less than 7.2, then C(ssh-rsa) - can be used when generating host certificates (a corresponding change to the sshd_config to add C(ssh-rsa) + or greater must remain compatible with C(ssh) clients using OpenSSH less than 7.2, then V(ssh-rsa) + can be used when generating host certificates (a corresponding change to the sshd_config to add V(ssh-rsa) to the C(CASignatureAlgorithms) keyword is also required). - - Using any value for this option with a non-RSA I(signing_key) will cause this module to fail. + - Using any value for this option with a non-RSA O(signing_key) will cause this module to fail. - "Note: OpenSSH versions prior to 7.2 do not support SHA-2 signature algorithms for RSA keys and OpenSSH versions prior to 7.3 do not support SHA-2 signature algorithms for certificates." - See U(https://www.openssh.com/txt/release-8.2) for more information. @@ -98,14 +98,14 @@ options: signing_key: description: - The path to the private openssh key that is used for signing the public key in order to generate the certificate. - - If the private key is on a PKCS#11 token (I(pkcs11_provider)), set this to the path to the public key instead. - - Required if I(state) is C(present). + - If the private key is on a PKCS#11 token (O(pkcs11_provider)), set this to the path to the public key instead. + - Required if O(state) is V(present). type: path pkcs11_provider: description: - To use a signing key that resides on a PKCS#11 token, set this to the name (or full path) of the shared library to use with the token. Usually C(libpkcs11.so). - - If this is set, I(signing_key) needs to point to a file containing the public key of the CA. + - If this is set, O(signing_key) needs to point to a file containing the public key of the CA. type: str version_added: 1.1.0 use_agent: @@ -117,37 +117,37 @@ options: public_key: description: - The path to the public key that will be signed with the signing key in order to generate the certificate. - - Required if I(state) is C(present). + - Required if O(state) is V(present). type: path valid_from: description: - "The point in time the certificate is valid from. Time can be specified either as relative time or as absolute timestamp. Time will always be interpreted as UTC. Valid formats are: C([+-]timespec | YYYY-MM-DD | YYYY-MM-DDTHH:MM:SS | YYYY-MM-DD HH:MM:SS | always) - where timespec can be an integer + C([w | d | h | m | s]) (for example C(+32w1d2h)). + where timespec can be an integer + C([w | d | h | m | s]) (for example V(+32w1d2h)). Note that if using relative time this module is NOT idempotent." - - "The value C(always) is only supported for OpenSSH 7.7 and greater, however, the value C(1970-01-01T00:00:01) + - "The value V(always) is only supported for OpenSSH 7.7 and greater, however, the value V(1970-01-01T00:00:01) can be used with earlier versions as an equivalent expression." - - "To ignore this value during comparison with an existing certificate set I(ignore_timestamps=true)." - - Required if I(state) is C(present). + - "To ignore this value during comparison with an existing certificate set O(ignore_timestamps=true)." + - Required if O(state) is V(present). type: str valid_to: description: - "The point in time the certificate is valid to. Time can be specified either as relative time or as absolute timestamp. Time will always be interpreted as UTC. Valid formats are: C([+-]timespec | YYYY-MM-DD | YYYY-MM-DDTHH:MM:SS | YYYY-MM-DD HH:MM:SS | forever) - where timespec can be an integer + C([w | d | h | m | s]) (for example C(+32w1d2h)). + where timespec can be an integer + C([w | d | h | m | s]) (for example V(+32w1d2h)). Note that if using relative time this module is NOT idempotent." - - "To ignore this value during comparison with an existing certificate set I(ignore_timestamps=true)." - - Required if I(state) is C(present). + - "To ignore this value during comparison with an existing certificate set O(ignore_timestamps=true)." + - Required if O(state) is V(present). type: str valid_at: description: - "Check if the certificate is valid at a certain point in time. If it is not the certificate will be regenerated. - Time will always be interpreted as UTC. Mainly to be used with relative timespec for I(valid_from) and / or I(valid_to). + Time will always be interpreted as UTC. Mainly to be used with relative timespec for O(valid_from) and / or O(valid_to). Note that if using relative time this module is NOT idempotent." type: str ignore_timestamps: description: - - "Whether the I(valid_from) and I(valid_to) timestamps should be ignored for idempotency checks." + - "Whether the O(valid_from) and O(valid_to) timestamps should be ignored for idempotency checks." - "However, the values will still be applied to a new certificate if it meets any other necessary conditions for generation/regeneration." type: bool default: false @@ -161,20 +161,20 @@ options: options: description: - "Specify certificate options when signing a key. The option that are valid for user certificates are:" - - "C(clear): Clear all enabled permissions. This is useful for clearing the default set of permissions so permissions may be added individually." - - "C(force-command=command): Forces the execution of command instead of any shell or + - "V(clear): Clear all enabled permissions. This is useful for clearing the default set of permissions so permissions may be added individually." + - "V(force-command=command): Forces the execution of command instead of any shell or command specified by the user when the certificate is used for authentication." - - "C(no-agent-forwarding): Disable ssh-agent forwarding (permitted by default)." - - "C(no-port-forwarding): Disable port forwarding (permitted by default)." - - "C(no-pty): Disable PTY allocation (permitted by default)." - - "C(no-user-rc): Disable execution of C(~/.ssh/rc) by sshd (permitted by default)." - - "C(no-x11-forwarding): Disable X11 forwarding (permitted by default)" - - "C(permit-agent-forwarding): Allows ssh-agent forwarding." - - "C(permit-port-forwarding): Allows port forwarding." - - "C(permit-pty): Allows PTY allocation." - - "C(permit-user-rc): Allows execution of C(~/.ssh/rc) by sshd." - - "C(permit-x11-forwarding): Allows X11 forwarding." - - "C(source-address=address_list): Restrict the source addresses from which the certificate is considered valid. + - "V(no-agent-forwarding): Disable ssh-agent forwarding (permitted by default)." + - "V(no-port-forwarding): Disable port forwarding (permitted by default)." + - "V(no-pty): Disable PTY allocation (permitted by default)." + - "V(no-user-rc): Disable execution of C(~/.ssh/rc) by sshd (permitted by default)." + - "V(no-x11-forwarding): Disable X11 forwarding (permitted by default)" + - "V(permit-agent-forwarding): Allows ssh-agent forwarding." + - "V(permit-port-forwarding): Allows port forwarding." + - "V(permit-pty): Allows PTY allocation." + - "V(permit-user-rc): Allows execution of C(~/.ssh/rc) by sshd." + - "V(permit-x11-forwarding): Allows X11 forwarding." + - "V(source-address=address_list): Restrict the source addresses from which the certificate is considered valid. The C(address_list) is a comma-separated list of one or more address/netmask pairs in CIDR format." - "At present, no options are valid for host keys." type: list @@ -190,7 +190,13 @@ options: The certificate serial number may be used in a KeyRevocationList. The serial number may be omitted for checks, but must be specified again for a new certificate. Note: The default value set by ssh-keygen is 0." + - This option accepts an B(integer). If you want to provide serial numbers as colon-separated hex strings, + such as C(11:22:33), you need to convert them to an integer with P(community.crypto.parse_serial#filter). type: int + +seealso: + - plugin: community.crypto.parse_serial + plugin_type: filter ''' EXAMPLES = ''' @@ -497,7 +503,10 @@ class Certificate(OpensshModule): if self.state != 'present': return {} - certificate_info = self.ssh_keygen.get_certificate_info(self.path)[1] + certificate_info = self.ssh_keygen.get_certificate_info( + self.path, + check_rc=self.state == 'present' and not self.module.check_mode, + )[1] return { 'type': self.type, diff --git a/ansible_collections/community/crypto/plugins/modules/openssh_keypair.py b/ansible_collections/community/crypto/plugins/modules/openssh_keypair.py index 35ee6d631..7bb35b27f 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssh_keypair.py +++ b/ansible_collections/community/crypto/plugins/modules/openssh_keypair.py @@ -15,12 +15,12 @@ author: "David Kainz (@lolcube)" short_description: Generate OpenSSH private and public keys description: - "This module allows one to (re)generate OpenSSH private and public keys. It uses - ssh-keygen to generate keys. One can generate C(rsa), C(dsa), C(rsa1), C(ed25519) - or C(ecdsa) private keys." + ssh-keygen to generate keys. One can generate V(rsa), V(dsa), V(rsa1), V(ed25519) + or V(ecdsa) private keys." requirements: - - ssh-keygen (if I(backend=openssh)) - - cryptography >= 2.6 (if I(backend=cryptography) and OpenSSH < 7.8 is installed) - - cryptography >= 3.0 (if I(backend=cryptography) and OpenSSH >= 7.8 is installed) + - ssh-keygen (if O(backend=openssh)) + - cryptography >= 2.6 (if O(backend=cryptography) and OpenSSH < 7.8 is installed) + - cryptography >= 3.0 (if O(backend=cryptography) and OpenSSH >= 7.8 is installed) extends_documentation_fragment: - ansible.builtin.files - community.crypto.attributes @@ -49,8 +49,8 @@ options: type: int type: description: - - "The algorithm used to generate the SSH private key. C(rsa1) is for protocol version 1. - C(rsa1) is deprecated and may not be supported by every version of ssh-keygen." + - "The algorithm used to generate the SSH private key. V(rsa1) is for protocol version 1. + V(rsa1) is deprecated and may not be supported by every version of ssh-keygen." type: str default: rsa choices: ['rsa', 'dsa', 'rsa1', 'ecdsa', 'ed25519'] @@ -71,18 +71,18 @@ options: passphrase: description: - Passphrase used to decrypt an existing private key or encrypt a newly generated private key. - - Passphrases are not supported for I(type=rsa1). - - Can only be used when I(backend=cryptography), or when I(backend=auto) and a required C(cryptography) version is installed. + - Passphrases are not supported for O(type=rsa1). + - Can only be used when O(backend=cryptography), or when O(backend=auto) and a required C(cryptography) version is installed. type: str version_added: 1.7.0 private_key_format: description: - - Used when I(backend=cryptography) to select a format for the private key at the provided I(path). - - When set to C(auto) this module will match the key format of the installed OpenSSH version. + - Used when O(backend=cryptography) to select a format for the private key at the provided O(path). + - When set to V(auto) this module will match the key format of the installed OpenSSH version. - For OpenSSH < 7.8 private keys will be in PKCS1 format except ed25519 keys which will be in OpenSSH format. - For OpenSSH >= 7.8 all private key types will be in the OpenSSH format. - - Using this option when I(regenerate=partial_idempotence) or I(regenerate=full_idempotence) will cause - a new keypair to be generated if the private key's format does not match the value of I(private_key_format). + - Using this option when O(regenerate=partial_idempotence) or O(regenerate=full_idempotence) will cause + a new keypair to be generated if the private key's format does not match the value of O(private_key_format). This module will not however convert existing private keys between formats. type: str default: auto @@ -94,8 +94,8 @@ options: version_added: 1.7.0 backend: description: - - Selects between the C(cryptography) library or the OpenSSH binary C(opensshbin). - - C(auto) will default to C(opensshbin) unless the OpenSSH binary is not installed or when using I(passphrase). + - Selects between the V(cryptography) library or the OpenSSH binary V(opensshbin). + - V(auto) will default to V(opensshbin) unless the OpenSSH binary is not installed or when using O(passphrase). type: str default: auto choices: @@ -109,24 +109,24 @@ options: The module will always generate a new key if the destination file does not exist. - By default, the key will be regenerated when it does not match the module's options, except when the key cannot be read or the passphrase does not match. Please note that - this B(changed) for Ansible 2.10. For Ansible 2.9, the behavior was as if C(full_idempotence) + this B(changed) for Ansible 2.10. For Ansible 2.9, the behavior was as if V(full_idempotence) is specified. - - If set to C(never), the module will fail if the key cannot be read or the passphrase + - If set to V(never), the module will fail if the key cannot be read or the passphrase is not matching, and will never regenerate an existing key. - - If set to C(fail), the module will fail if the key does not correspond to the module's + - If set to V(fail), the module will fail if the key does not correspond to the module's options. - - If set to C(partial_idempotence), the key will be regenerated if it does not conform to + - If set to V(partial_idempotence), the key will be regenerated if it does not conform to the module's options. The key is B(not) regenerated if it cannot be read (broken file), the key is protected by an unknown passphrase, or when they key is not protected by a passphrase, but a passphrase is specified. - - If set to C(full_idempotence), the key will be regenerated if it does not conform to the + - If set to V(full_idempotence), the key will be regenerated if it does not conform to the module's options. This is also the case if the key cannot be read (broken file), the key is protected by an unknown passphrase, or when they key is not protected by a passphrase, but a passphrase is specified. Make sure you have a B(backup) when using this option! - - If set to C(always), the module will always regenerate the key. This is equivalent to - setting I(force) to C(true). + - If set to V(always), the module will always regenerate the key. This is equivalent to + setting O(force) to V(true). - Note that adjusting the comment and the permissions can be changed without regeneration. - Therefore, even for C(never), the task can result in changed. + Therefore, even for V(never), the task can result in changed. type: str choices: - never @@ -138,8 +138,8 @@ options: version_added: '1.0.0' notes: - In case the ssh key is broken or password protected, the module will fail. - Set the I(force) option to C(true) if you want to regenerate the keypair. - - In the case a custom C(mode), C(group), C(owner), or other file attribute is provided it will be applied to both key files. + Set the O(force) option to V(true) if you want to regenerate the keypair. + - In the case a custom O(mode), O(group), O(owner), or other file attribute is provided it will be applied to both key files. ''' EXAMPLES = ''' diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_csr.py b/ansible_collections/community/crypto/plugins/modules/openssl_csr.py index 69b663b23..01a748e79 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_csr.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_csr.py @@ -17,7 +17,7 @@ short_description: Generate OpenSSL Certificate Signing Request (CSR) description: - "Please note that the module regenerates an existing CSR if it does not match the module's options, or if it seems to be corrupt. If you are concerned that this could overwrite - your existing CSR, consider using the I(backup) option." + your existing CSR, consider using the O(backup) option." author: - Yanis Guenane (@Spredzy) - Felix Fontein (@felixfontein) @@ -58,7 +58,7 @@ options: default: false return_content: description: - - If set to C(true), will return the (current or generated) CSR's content as I(csr). + - If set to V(true), will return the (current or generated) CSR's content as RV(csr). type: bool default: false version_added: "1.0.0" @@ -173,7 +173,7 @@ RETURN = r''' privatekey: description: - Path to the TLS/SSL private key the CSR was generated for - - Will be C(none) if the private key has been provided in I(privatekey_content). + - Will be V(none) if the private key has been provided in O(privatekey_content). returned: changed or success type: str sample: /etc/ssl/private/ansible.com.pem @@ -234,12 +234,12 @@ name_constraints_excluded: version_added: 1.1.0 backup_file: description: Name of backup file created. - returned: changed and if I(backup) is C(true) + returned: changed and if O(backup) is V(true) type: str sample: /path/to/www.ansible.com.csr.2019-03-09@11:22~ csr: description: The (current or generated) CSR's content. - returned: if I(state) is C(present) and I(return_content) is C(true) + returned: if O(state) is V(present) and O(return_content) is V(true) type: str version_added: "1.0.0" ''' diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_csr_info.py b/ansible_collections/community/crypto/plugins/modules/openssl_csr_info.py index 1ef07e733..fc7eaf18e 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_csr_info.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_csr_info.py @@ -32,19 +32,19 @@ options: path: description: - Remote absolute path where the CSR file is loaded from. - - Either I(path) or I(content) must be specified, but not both. + - Either O(path) or O(content) must be specified, but not both. type: path content: description: - Content of the CSR file. - - Either I(path) or I(content) must be specified, but not both. + - Either O(path) or O(content) must be specified, but not both. type: str version_added: "1.0.0" select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography ] @@ -52,10 +52,11 @@ options: seealso: - module: community.crypto.openssl_csr - module: community.crypto.openssl_csr_pipe - - ref: community.crypto.openssl_csr_info filter <ansible_collections.community.crypto.openssl_csr_info_filter> - # - plugin: community.crypto.openssl_csr_info - # plugin_type: filter + - plugin: community.crypto.openssl_csr_info + plugin_type: filter description: A filter variant of this module. + - plugin: community.crypto.to_serial + plugin_type: filter ''' EXAMPLES = r''' @@ -79,11 +80,11 @@ RETURN = r''' signature_valid: description: - Whether the CSR's signature is valid. - - In case the check returns C(false), the module will fail. + - In case the check returns V(false), the module will fail. returned: success type: bool basic_constraints: - description: Entries in the C(basic_constraints) extension, or C(none) if extension is not present. + description: Entries in the C(basic_constraints) extension, or V(none) if extension is not present. returned: success type: list elements: str @@ -93,7 +94,7 @@ basic_constraints_critical: returned: success type: bool extended_key_usage: - description: Entries in the C(extended_key_usage) extension, or C(none) if extension is not present. + description: Entries in the C(extended_key_usage) extension, or V(none) if extension is not present. returned: success type: list elements: str @@ -124,7 +125,7 @@ extensions_by_oid: sample: "MAMCAQU=" sample: {"1.3.6.1.5.5.7.1.24": { "critical": false, "value": "MAMCAQU="}} key_usage: - description: Entries in the C(key_usage) extension, or C(none) if extension is not present. + description: Entries in the C(key_usage) extension, or V(none) if extension is not present. returned: success type: str sample: [Key Agreement, Data Encipherment] @@ -134,8 +135,8 @@ key_usage_critical: type: bool subject_alt_name: description: - - Entries in the C(subject_alt_name) extension, or C(none) if extension is not present. - - See I(name_encoding) for how IDNs are handled. + - Entries in the C(subject_alt_name) extension, or V(none) if extension is not present. + - See O(name_encoding) for how IDNs are handled. returned: success type: list elements: str @@ -145,7 +146,7 @@ subject_alt_name_critical: returned: success type: bool ocsp_must_staple: - description: C(true) if the OCSP Must Staple extension is present, C(none) otherwise. + description: V(true) if the OCSP Must Staple extension is present, V(none) otherwise. returned: success type: bool ocsp_must_staple_critical: @@ -162,8 +163,8 @@ name_constraints_permitted: name_constraints_excluded: description: - List of excluded subtrees the CA cannot sign certificates for. - - Is C(none) if extension is not present. - - See I(name_encoding) for how IDNs are handled. + - Is V(none) if extension is not present. + - See O(name_encoding) for how IDNs are handled. returned: success type: list elements: str @@ -172,7 +173,7 @@ name_constraints_excluded: name_constraints_critical: description: - Whether the C(name_constraints) extension is critical. - - Is C(none) if extension is not present. + - Is V(none) if extension is not present. returned: success type: bool version_added: 1.1.0 @@ -197,8 +198,8 @@ public_key: public_key_type: description: - The CSR's public key's type. - - One of C(RSA), C(DSA), C(ECC), C(Ed25519), C(X25519), C(Ed448), or C(X448). - - Will start with C(unknown) if the key type cannot be determined. + - One of V(RSA), V(DSA), V(ECC), V(Ed25519), V(X25519), V(Ed448), or V(X448). + - Will start with V(unknown) if the key type cannot be determined. returned: success type: str version_added: 1.7.0 @@ -214,57 +215,57 @@ public_key_data: description: - Bit size of modulus (RSA) or prime number (DSA). type: int - returned: When C(public_key_type=RSA) or C(public_key_type=DSA) + returned: When RV(public_key_type=RSA) or RV(public_key_type=DSA) modulus: description: - The RSA key's modulus. type: int - returned: When C(public_key_type=RSA) + returned: When RV(public_key_type=RSA) exponent: description: - The RSA key's public exponent. type: int - returned: When C(public_key_type=RSA) + returned: When RV(public_key_type=RSA) p: description: - The C(p) value for DSA. - This is the prime modulus upon which arithmetic takes place. type: int - returned: When C(public_key_type=DSA) + returned: When RV(public_key_type=DSA) q: description: - The C(q) value for DSA. - This is a prime that divides C(p - 1), and at the same time the order of the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(public_key_type=DSA) + returned: When RV(public_key_type=DSA) g: description: - The C(g) value for DSA. - This is the element spanning the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(public_key_type=DSA) + returned: When RV(public_key_type=DSA) curve: description: - The curve's name for ECC. type: str - returned: When C(public_key_type=ECC) + returned: When RV(public_key_type=ECC) exponent_size: description: - The maximum number of bits of a private key. This is basically the bit size of the subgroup used. type: int - returned: When C(public_key_type=ECC) + returned: When RV(public_key_type=ECC) x: description: - The C(x) coordinate for the public point on the elliptic curve. type: int - returned: When C(public_key_type=ECC) + returned: When RV(public_key_type=ECC) y: description: - - For C(public_key_type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. - - For C(public_key_type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. + - For RV(public_key_type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. + - For RV(public_key_type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. type: int - returned: When C(public_key_type=DSA) or C(public_key_type=ECC) + returned: When RV(public_key_type=DSA) or RV(public_key_type=ECC) public_key_fingerprints: description: - Fingerprints of CSR's public key. @@ -276,24 +277,24 @@ public_key_fingerprints: subject_key_identifier: description: - The CSR's subject key identifier. - - The identifier is returned in hexadecimal, with C(:) used to separate bytes. - - Is C(none) if the C(SubjectKeyIdentifier) extension is not present. + - The identifier is returned in hexadecimal, with V(:) used to separate bytes. + - Is V(none) if the C(SubjectKeyIdentifier) extension is not present. returned: success type: str sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33' authority_key_identifier: description: - The CSR's authority key identifier. - - The identifier is returned in hexadecimal, with C(:) used to separate bytes. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. + - The identifier is returned in hexadecimal, with V(:) used to separate bytes. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. returned: success type: str sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33' authority_cert_issuer: description: - The CSR's authority cert issuer as a list of general names. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. - - See I(name_encoding) for how IDNs are handled. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. + - See O(name_encoding) for how IDNs are handled. returned: success type: list elements: str @@ -301,7 +302,9 @@ authority_cert_issuer: authority_cert_serial_number: description: - The CSR's authority cert serial number. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. + - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, + such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). returned: success type: int sample: 12345 diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_csr_pipe.py b/ansible_collections/community/crypto/plugins/modules/openssl_csr_pipe.py index 66cc67354..0c42d5e78 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_csr_pipe.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_csr_pipe.py @@ -27,6 +27,12 @@ extends_documentation_fragment: attributes: check_mode: support: full + details: + - Currently in check mode, private keys will not be (re-)generated, only the changed status is + set. This will change in community.crypto 3.0.0. + - From community.crypto 3.0.0 on, the module will ignore check mode and always behave as if + check mode is not active. If you think this breaks your use-case of this module, please + create an issue in the community.crypto repository. diff_mode: support: full options: @@ -34,6 +40,14 @@ options: description: - The existing CSR. type: str + privatekey_path: + description: + - The path to the private key to use when signing the certificate signing request. + - Either O(privatekey_path) or O(privatekey_content) must be specified, but not both. + privatekey_content: + description: + - The content of the private key to use when signing the certificate signing request. + - Either O(privatekey_path) or O(privatekey_content) must be specified, but not both. seealso: - module: community.crypto.openssl_csr ''' @@ -50,7 +64,7 @@ EXAMPLES = r''' - name: Generate an OpenSSL Certificate Signing Request with an inline CSR community.crypto.openssl_csr: - content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.csr') }}" + content: "{{ lookup('ansible.builtin.file', '/etc/ssl/csr/www.ansible.com.csr') }}" privatekey_content: "{{ private_key_content }}" common_name: www.ansible.com register: result @@ -65,7 +79,7 @@ RETURN = r''' privatekey: description: - Path to the TLS/SSL private key the CSR was generated for - - Will be C(none) if the private key has been provided in I(privatekey_content). + - Will be V(none) if the private key has been provided in O(privatekey_content). returned: changed or success type: str sample: /etc/ssl/private/ansible.com.pem @@ -138,6 +152,7 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.basic impo class CertificateSigningRequestModule(object): def __init__(self, module, module_backend): self.check_mode = module.check_mode + self.module = module self.module_backend = module_backend self.changed = False if module.params['content'] is not None: @@ -148,6 +163,16 @@ class CertificateSigningRequestModule(object): if self.module_backend.needs_regeneration(): if not self.check_mode: self.module_backend.generate_csr() + else: + self.module.deprecate( + 'Check mode support for openssl_csr_pipe will change in community.crypto 3.0.0' + ' to behave the same as without check mode. You can get that behavior right now' + ' by adding `check_mode: false` to the openssl_csr_pipe task. If you think this' + ' breaks your use-case of this module, please create an issue in the' + ' community.crypto repository', + version='3.0.0', + collection_name='community.crypto', + ) self.changed = True def dump(self): diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_dhparam.py b/ansible_collections/community/crypto/plugins/modules/openssl_dhparam.py index d9e1e982e..2c7d93541 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_dhparam.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_dhparam.py @@ -18,10 +18,10 @@ description: - This module uses file common arguments to specify generated file permissions. - "Please note that the module regenerates existing DH params if they do not match the module's options. If you are concerned that this could overwrite - your existing DH params, consider using the I(backup) option." + your existing DH params, consider using the O(backup) option." - The module can use the cryptography Python library, or the C(openssl) executable. By default, it tries to detect which one is available. This can be overridden - with the I(select_crypto_backend) option. + with the O(select_crypto_backend) option. requirements: - Either cryptography >= 2.0 - Or OpenSSL binary C(openssl) @@ -70,16 +70,16 @@ options: select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available, and falls back to C(openssl). - - If set to C(openssl), will try to use the OpenSSL C(openssl) executable. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available, and falls back to C(openssl). + - If set to V(openssl), will try to use the OpenSSL C(openssl) executable. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography, openssl ] version_added: "1.0.0" return_content: description: - - If set to C(true), will return the (current or generated) DH parameter's content as I(dhparams). + - If set to V(true), will return the (current or generated) DH parameter's content as RV(dhparams). type: bool default: false version_added: "1.0.0" @@ -120,12 +120,12 @@ filename: sample: /etc/ssl/dhparams.pem backup_file: description: Name of backup file created. - returned: changed and if I(backup) is C(true) + returned: changed and if O(backup) is V(true) type: str sample: /path/to/dhparams.pem.2019-03-09@11:22~ dhparams: description: The (current or generated) DH params' content. - returned: if I(state) is C(present) and I(return_content) is C(true) + returned: if O(state) is V(present) and O(return_content) is V(true) type: str version_added: "1.0.0" ''' @@ -193,7 +193,7 @@ class DHParameterBase(object): """Generate DH params.""" changed = False - # ony generate when necessary + # only generate when necessary if self.force or not self._check_params_valid(module): self._do_generate(module) changed = True @@ -341,7 +341,7 @@ class DHParameterCryptography(DHParameterBase): try: with open(self.path, 'rb') as f: data = f.read() - params = self.crypto_backend.load_pem_parameters(data) + params = cryptography.hazmat.primitives.serialization.load_pem_parameters(data, backend=self.crypto_backend) except Exception as dummy: return False # Check parameters diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_pkcs12.py b/ansible_collections/community/crypto/plugins/modules/openssl_pkcs12.py index e74553b58..e3b993083 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_pkcs12.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_pkcs12.py @@ -19,12 +19,12 @@ description: - This module allows one to (re-)generate PKCS#12. - The module can use the cryptography Python library, or the pyOpenSSL Python library. By default, it tries to detect which one is available, assuming none of the - I(iter_size) and I(maciter_size) options are used. This can be overridden with the - I(select_crypto_backend) option. + O(iter_size) and O(maciter_size) options are used. This can be overridden with the + O(select_crypto_backend) option. # Please note that the C(pyopenssl) backend has been deprecated in community.crypto x.y.0, # and will be removed in community.crypto (x+1).0.0. requirements: - - PyOpenSSL >= 0.15 or cryptography >= 3.0 + - PyOpenSSL >= 0.15, < 23.3.0 or cryptography >= 3.0 extends_documentation_fragment: - ansible.builtin.files - community.crypto.attributes @@ -39,21 +39,21 @@ attributes: options: action: description: - - C(export) or C(parse) a PKCS#12. + - V(export) or V(parse) a PKCS#12. type: str default: export choices: [ export, parse ] other_certificates: description: - - List of other certificates to include. Pre Ansible 2.8 this parameter was called I(ca_certificates). + - List of other certificates to include. Pre Ansible 2.8 this parameter was called O(ca_certificates). - Assumes there is one PEM-encoded certificate per file. If a file contains multiple PEM certificates, - set I(other_certificates_parse_all) to C(true). + set O(other_certificates_parse_all) to V(true). type: list elements: path aliases: [ ca_certificates ] other_certificates_parse_all: description: - - If set to C(true), assumes that the files mentioned in I(other_certificates) can contain more than one + - If set to V(true), assumes that the files mentioned in O(other_certificates) can contain more than one certificate per file (or even none per file). type: bool default: false @@ -77,21 +77,21 @@ options: description: - Number of times to repeat the encryption step. - This is B(not considered during idempotency checks). - - This is only used by the C(pyopenssl) backend, or when I(encryption_level=compatibility2022). - - When using it, the default is C(2048) for C(pyopenssl) and C(50000) for C(cryptography). + - This is only used by the C(pyopenssl) backend, or when O(encryption_level=compatibility2022). + - When using it, the default is V(2048) for C(pyopenssl) and V(50000) for C(cryptography). type: int maciter_size: description: - Number of times to repeat the MAC step. - This is B(not considered during idempotency checks). - - This is only used by the C(pyopenssl) backend. When using it, the default is C(1). + - This is only used by the C(pyopenssl) backend. When using it, the default is V(1). type: int encryption_level: description: - Determines the encryption level used. - - C(auto) uses the default of the selected backend. For C(cryptography), this is what the + - V(auto) uses the default of the selected backend. For C(cryptography), this is what the cryptography library's specific version considers the best available encryption. - - C(compatibility2022) uses compatibility settings for older software in 2022. + - V(compatibility2022) uses compatibility settings for older software in 2022. This is only supported by the C(cryptography) backend if cryptography >= 38.0.0 is available. - B(Note) that this option is B(not used for idempotency). choices: @@ -119,18 +119,18 @@ options: privatekey_path: description: - File to read private key from. - - Mutually exclusive with I(privatekey_content). + - Mutually exclusive with O(privatekey_content). type: path privatekey_content: description: - Content of the private key file. - - Mutually exclusive with I(privatekey_path). + - Mutually exclusive with O(privatekey_path). type: str version_added: "2.3.0" state: description: - Whether the file should exist or not. - All parameters except C(path) are ignored when state is C(absent). + All parameters except O(path) are ignored when state is V(absent). choices: [ absent, present ] default: present type: str @@ -146,18 +146,18 @@ options: default: false return_content: description: - - If set to C(true), will return the (current or generated) PKCS#12's content as I(pkcs12). + - If set to V(true), will return the (current or generated) PKCS#12's content as RV(pkcs12). type: bool default: false version_added: "1.0.0" select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available, and falls back to C(pyopenssl). - If I(iter_size) is used together with I(encryption_level != compatibility2022), or if I(maciter_size) is used, - C(auto) will always result in C(pyopenssl) to be chosen for backwards compatibility. - - If set to C(pyopenssl), will try to use the L(pyOpenSSL,https://pypi.org/project/pyOpenSSL/) library. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available, and falls back to C(pyopenssl). + If O(iter_size) is used together with O(encryption_level) is not V(compatibility2022), or if O(maciter_size) is used, + V(auto) will always result in C(pyopenssl) to be chosen for backwards compatibility. + - If set to V(pyopenssl), will try to use the L(pyOpenSSL,https://pypi.org/project/pyOpenSSL/) library. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. # - Please note that the C(pyopenssl) backend has been deprecated in community.crypto x.y.0, and will be # removed in community.crypto (x+1).0.0. # From that point on, only the C(cryptography) backend will be available. @@ -255,12 +255,12 @@ privatekey: sample: /etc/ssl/private/ansible.com.pem backup_file: description: Name of backup file created. - returned: changed and if I(backup) is C(true) + returned: changed and if O(backup) is V(true) type: str sample: /path/to/ansible.com.pem.2019-03-09@11:22~ pkcs12: description: The (current or generated) PKCS#12's content Base64 encoded. - returned: if I(state) is C(present) and I(return_content) is C(true) + returned: if O(state) is V(present) and O(return_content) is V(true) type: str version_added: "1.0.0" ''' @@ -302,11 +302,13 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import MINIMAL_CRYPTOGRAPHY_VERSION = '3.0' MINIMAL_PYOPENSSL_VERSION = '0.15' +MAXIMAL_PYOPENSSL_VERSION = '23.3.0' PYOPENSSL_IMP_ERR = None try: import OpenSSL from OpenSSL import crypto + from OpenSSL.crypto import load_pkcs12 as _load_pkcs12 # this got removed in pyOpenSSL 23.3.0 PYOPENSSL_VERSION = LooseVersion(OpenSSL.__version__) except (ImportError, AttributeError): PYOPENSSL_IMP_ERR = traceback.format_exc() @@ -711,7 +713,11 @@ def select_backend(module, backend): if backend == 'auto': # Detection what is possible can_use_cryptography = CRYPTOGRAPHY_FOUND and CRYPTOGRAPHY_VERSION >= LooseVersion(MINIMAL_CRYPTOGRAPHY_VERSION) - can_use_pyopenssl = PYOPENSSL_FOUND and PYOPENSSL_VERSION >= LooseVersion(MINIMAL_PYOPENSSL_VERSION) + can_use_pyopenssl = ( + PYOPENSSL_FOUND and + PYOPENSSL_VERSION >= LooseVersion(MINIMAL_PYOPENSSL_VERSION) and + PYOPENSSL_VERSION < LooseVersion(MAXIMAL_PYOPENSSL_VERSION) + ) # If no restrictions are provided, first try cryptography, then pyOpenSSL if ( @@ -728,14 +734,17 @@ def select_backend(module, backend): # Success? if backend == 'auto': module.fail_json(msg=("Cannot detect any of the required Python libraries " - "cryptography (>= {0}) or PyOpenSSL (>= {1})").format( + "cryptography (>= {0}) or PyOpenSSL (>= {1}, < {2})").format( MINIMAL_CRYPTOGRAPHY_VERSION, - MINIMAL_PYOPENSSL_VERSION)) + MINIMAL_PYOPENSSL_VERSION, + MAXIMAL_PYOPENSSL_VERSION)) if backend == 'pyopenssl': if not PYOPENSSL_FOUND: - module.fail_json(msg=missing_required_lib('pyOpenSSL >= {0}'.format(MINIMAL_PYOPENSSL_VERSION)), - exception=PYOPENSSL_IMP_ERR) + msg = missing_required_lib( + 'pyOpenSSL >= {0}, < {1}'.format(MINIMAL_PYOPENSSL_VERSION, MAXIMAL_PYOPENSSL_VERSION) + ) + module.fail_json(msg=msg, exception=PYOPENSSL_IMP_ERR) # module.deprecate('The module is using the PyOpenSSL backend. This backend has been deprecated', # version='x.0.0', collection_name='community.crypto') return backend, PkcsPyOpenSSL(module) diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_privatekey.py b/ansible_collections/community/crypto/plugins/modules/openssl_privatekey.py index 7b50caff7..a55395d3f 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_privatekey.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_privatekey.py @@ -15,7 +15,12 @@ module: openssl_privatekey short_description: Generate OpenSSL private keys description: - This module allows one to (re)generate OpenSSL private keys. - - The default mode for the private key file will be C(0600) if I(mode) is not explicitly set. + - The default mode for the private key file will be V(0600) if O(mode) is not explicitly set. + - "Please note that the module regenerates private keys if they do not match + the module's options. In particular, if you provide another passphrase + (or specify none), change the keysize, etc., the private key will be + regenerated. If you are concerned that this could B(overwrite your private key), + consider using the O(backup) option." author: - Yanis Guenane (@Spredzy) - Felix Fontein (@felixfontein) @@ -45,8 +50,8 @@ options: default: false path: description: - - Name of the file in which the generated TLS/SSL private key will be written. It will have C(0600) mode - if I(mode) is not explicitly set. + - Name of the file in which the generated TLS/SSL private key will be written. It will have V(0600) mode + if O(mode) is not explicitly set. type: path required: true format: @@ -61,10 +66,10 @@ options: default: false return_content: description: - - If set to C(true), will return the (current or generated) private key's content as I(privatekey). + - If set to V(true), will return the (current or generated) private key's content as RV(privatekey). - Note that especially if the private key is not encrypted, you have to make sure that the returned value is treated appropriately and not accidentally written to logs etc.! Use with care! - - Use Ansible's I(no_log) task option to avoid the output being shown. See also + - Use Ansible's C(no_log) task option to avoid the output being shown. See also U(https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-keep-secret-data-in-my-playbook). type: bool default: false @@ -101,6 +106,12 @@ EXAMPLES = r''' community.crypto.openssl_privatekey: path: /etc/ssl/private/ansible.com.pem type: DSA + +- name: Generate an OpenSSL private key with elliptic curve cryptography (ECC) + community.crypto.openssl_privatekey: + path: /etc/ssl/private/ansible.com.pem + type: ECC + curve: secp256r1 ''' RETURN = r''' @@ -116,7 +127,7 @@ type: sample: RSA curve: description: Elliptic curve used to generate the TLS/SSL private key. - returned: changed or success, and I(type) is C(ECC) + returned: changed or success, and O(type) is V(ECC) type: str sample: secp256r1 filename: @@ -138,14 +149,14 @@ fingerprint: sha512: "fd:ed:5e:39:48:5f:9f:fe:7f:25:06:3f:79:08:cd:ee:a5:e7:b3:3d:13:82:87:1f:84:e1:f5:c7:28:77:53:94:86:56:38:69:f0:d9:35:22:01:1e:a6:60:...:0f:9b" backup_file: description: Name of backup file created. - returned: changed and if I(backup) is C(true) + returned: changed and if O(backup) is V(true) type: str sample: /path/to/privatekey.pem.2019-03-09@11:22~ privatekey: description: - The (current or generated) private key's content. - Will be Base64-encoded if the key is in raw format. - returned: if I(state) is C(present) and I(return_content) is C(true) + returned: if O(state) is V(present) and O(return_content) is V(true) type: str version_added: '1.0.0' ''' diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_convert.py b/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_convert.py index 5aec5cbe8..a09e3e10d 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_convert.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_convert.py @@ -16,7 +16,7 @@ short_description: Convert OpenSSL private keys version_added: 2.1.0 description: - This module allows one to convert OpenSSL private keys. - - The default mode for the private key file will be C(0600) if I(mode) is not explicitly set. + - The default mode for the private key file will be V(0600) if O(mode) is not explicitly set. author: - Felix Fontein (@felixfontein) extends_documentation_fragment: @@ -34,8 +34,8 @@ attributes: options: dest_path: description: - - Name of the file in which the generated TLS/SSL private key will be written. It will have C(0600) mode - if I(mode) is not explicitly set. + - Name of the file in which the generated TLS/SSL private key will be written. It will have V(0600) mode + if O(mode) is not explicitly set. type: path required: true backup: @@ -59,7 +59,7 @@ EXAMPLES = r''' RETURN = r''' backup_file: description: Name of backup file created. - returned: changed and if I(backup) is C(true) + returned: changed and if O(backup) is V(true) type: str sample: /path/to/privatekey.pem.2019-03-09@11:22~ ''' diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_info.py b/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_info.py index 7eaec2348..220bf988e 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_info.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_info.py @@ -18,8 +18,8 @@ description: - This module allows one to query information on OpenSSL private keys. - In case the key consistency checks fail, the module will fail as this indicates a faked private key. In this case, all return variables are still returned. Note that key consistency - checks are not available all key types; if none is available, C(none) is returned for - C(key_is_consistent). + checks are not available all key types; if none is available, V(none) is returned for + RV(key_is_consistent). - It uses the cryptography python library to interact with OpenSSL. requirements: - cryptography >= 1.2.3 @@ -37,7 +37,7 @@ options: content: description: - Content of the private key file. - - Either I(path) or I(content) must be specified, but not both. + - Either O(path) or O(content) must be specified, but not both. type: str version_added: '1.0.0' passphrase: @@ -47,7 +47,7 @@ options: return_private_key_data: description: - Whether to return private key data. - - Only set this to C(true) when you want private information about this key to + - Only set this to V(true) when you want private information about this key to leave the remote machine. - "B(WARNING:) you have to make sure that private key data is not accidentally logged!" type: bool @@ -60,6 +60,9 @@ options: avoid private key material to be transported around and computed with, and only do so when requested explicitly. This can potentially prevent L(side-channel attacks,https://en.wikipedia.org/wiki/Side-channel_attack). + - Note that consistency checks only work for certain key types, and might depend on the + version of the cryptography library. For example, with cryptography 42.0.0 and newer + consistency of RSA keys can no longer be checked. type: bool default: false version_added: 2.0.0 @@ -67,8 +70,8 @@ options: select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography ] @@ -76,9 +79,8 @@ options: seealso: - module: community.crypto.openssl_privatekey - module: community.crypto.openssl_privatekey_pipe - - ref: community.crypto.openssl_privatekey_info filter <ansible_collections.community.crypto.openssl_privatekey_info_filter> - # - plugin: community.crypto.openssl_privatekey_info - # plugin_type: filter + - plugin: community.crypto.openssl_privatekey_info + plugin_type: filter description: A filter variant of this module. ''' @@ -108,10 +110,10 @@ can_parse_key: type: bool key_is_consistent: description: - - Whether the key is consistent. Can also return C(none) next to C(true) and - C(false), to indicate that consistency could not be checked. - - In case the check returns C(false), the module will fail. - returned: when I(check_consistency=true) + - Whether the key is consistent. Can also return V(none) next to V(true) and + V(false), to indicate that consistency could not be checked. + - In case the check returns V(false), the module will fail. + returned: when O(check_consistency=true) type: bool public_key: description: Private key's public key in PEM format. @@ -129,8 +131,8 @@ public_key_fingerprints: type: description: - The key's type. - - One of C(RSA), C(DSA), C(ECC), C(Ed25519), C(X25519), C(Ed448), or C(X448). - - Will start with C(unknown) if the key type cannot be determined. + - One of V(RSA), V(DSA), V(ECC), V(Ed25519), V(X25519), V(Ed448), or V(X448). + - Will start with V(unknown) if the key type cannot be determined. returned: success type: str sample: RSA @@ -144,61 +146,61 @@ public_data: description: - Bit size of modulus (RSA) or prime number (DSA). type: int - returned: When C(type=RSA) or C(type=DSA) + returned: When RV(type=RSA) or RV(type=DSA) modulus: description: - The RSA key's modulus. type: int - returned: When C(type=RSA) + returned: When RV(type=RSA) exponent: description: - The RSA key's public exponent. type: int - returned: When C(type=RSA) + returned: When RV(type=RSA) p: description: - The C(p) value for DSA. - This is the prime modulus upon which arithmetic takes place. type: int - returned: When C(type=DSA) + returned: When RV(type=DSA) q: description: - The C(q) value for DSA. - This is a prime that divides C(p - 1), and at the same time the order of the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(type=DSA) + returned: When RV(type=DSA) g: description: - The C(g) value for DSA. - This is the element spanning the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(type=DSA) + returned: When RV(type=DSA) curve: description: - The curve's name for ECC. type: str - returned: When C(type=ECC) + returned: When RV(type=ECC) exponent_size: description: - The maximum number of bits of a private key. This is basically the bit size of the subgroup used. type: int - returned: When C(type=ECC) + returned: When RV(type=ECC) x: description: - The C(x) coordinate for the public point on the elliptic curve. type: int - returned: When C(type=ECC) + returned: When RV(type=ECC) y: description: - - For C(type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. - - For C(type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. + - For RV(type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. + - For RV(type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. type: int - returned: When C(type=DSA) or C(type=ECC) + returned: When RV(type=DSA) or RV(type=ECC) private_data: description: - Private key data. Depends on key type. - returned: success and when I(return_private_key_data) is set to C(true) + returned: success and when O(return_private_key_data) is set to V(true) type: dict ''' diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_pipe.py b/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_pipe.py index 41432840d..6c921a306 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_pipe.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_privatekey_pipe.py @@ -17,7 +17,7 @@ version_added: 1.3.0 description: - This module allows one to (re)generate OpenSSL private keys without disk access. - This allows to read and write keys to vaults without having to write intermediate versions to disk. - - Make sure to not write the result of this module into logs or to the console, as it contains private key data! Use the I(no_log) task option to be sure. + - Make sure to not write the result of this module into logs or to the console, as it contains private key data! Use the C(no_log) task option to be sure. - Note that this module is implemented as an L(action plugin,https://docs.ansible.com/ansible/latest/plugins/action.html) and will always be executed on the controller. author: @@ -36,6 +36,12 @@ attributes: - This action runs completely on the controller. check_mode: support: full + details: + - Currently in check mode, private keys will not be (re-)generated, only the changed status is + set. This will change in community.crypto 3.0.0. + - From community.crypto 3.0.0 on, the module will ignore check mode and always behave as if + check mode is not active. If you think this breaks your use-case of this module, please + create an issue in the community.crypto repository. diff_mode: support: full options: @@ -47,16 +53,39 @@ options: type: str content_base64: description: - - Set to C(true) if the content is base64 encoded. + - Set to V(true) if the content is base64 encoded. type: bool default: false return_current_key: description: - - Set to C(true) to return the current private key when the module did not generate a new one. - - Note that in case of check mode, when this option is not set to C(true), the module always returns the + - Set to V(true) to return the current private key when the module did not generate a new one. + - Note that in case of check mode, when this option is not set to V(true), the module always returns the current key (if it was provided) and Ansible will replace it by C(VALUE_SPECIFIED_IN_NO_LOG_PARAMETER). type: bool default: false + regenerate: + description: + - Allows to configure in which situations the module is allowed to regenerate private keys. + The module will always generate a new key if the destination file does not exist. + - By default, the key will be regenerated when it does not match the module's options, + except when the key cannot be read or the passphrase does not match. Please note that + this B(changed) for Ansible 2.10. For Ansible 2.9, the behavior was as if V(full_idempotence) + is specified. + - If set to V(never), the module will fail if the key cannot be read or the passphrase + is not matching, and will never regenerate an existing key. + - If set to V(fail), the module will fail if the key does not correspond to the module's + options. + - If set to V(partial_idempotence), the key will be regenerated if it does not conform to + the module's options. The key is B(not) regenerated if it cannot be read (broken file), + the key is protected by an unknown passphrase, or when they key is not protected by a + passphrase, but a passphrase is specified. + - If set to V(full_idempotence), the key will be regenerated if it does not conform to the + module's options. This is also the case if the key cannot be read (broken file), the key + is protected by an unknown passphrase, or when they key is not protected by a passphrase, + but a passphrase is specified. Make sure you have a B(backup) when using this option! + - If set to V(always), the module will always regenerate the key. + - Note that if O(format_mismatch) is set to V(convert) and everything matches except the + format, the key will always be converted, except if O(regenerate) is set to V(always). seealso: - module: community.crypto.openssl_privatekey - module: community.crypto.openssl_privatekey_info @@ -106,7 +135,7 @@ type: sample: RSA curve: description: Elliptic curve used to generate the TLS/SSL private key. - returned: changed or success, and I(type) is C(ECC) + returned: changed or success, and O(type) is V(ECC) type: str sample: secp256r1 fingerprint: @@ -125,8 +154,8 @@ privatekey: description: - The generated private key's content. - Please note that if the result is not changed, the current private key will only be returned - if the I(return_current_key) option is set to C(true). + if the O(return_current_key) option is set to V(true). - Will be Base64-encoded if the key is in raw format. - returned: changed, or I(return_current_key) is C(true) + returned: changed, or O(return_current_key) is V(true) type: str ''' diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_publickey.py b/ansible_collections/community/crypto/plugins/modules/openssl_publickey.py index da01d1fb4..98eca22ac 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_publickey.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_publickey.py @@ -16,11 +16,11 @@ short_description: Generate an OpenSSL public key from its private key. description: - This module allows one to (re)generate public keys from their private keys. - Public keys are generated in PEM or OpenSSH format. Private keys must be OpenSSL PEM keys. - OpenSSH private keys are not supported, use the M(community.crypto.openssh_keypair) module to manage these. + B(OpenSSH private keys are not supported), use the M(community.crypto.openssh_keypair) module to manage these. - The module uses the cryptography Python library. requirements: - cryptography >= 1.2.3 (older versions might work as well) - - Needs cryptography >= 1.4 if I(format) is C(OpenSSH) + - Needs cryptography >= 1.4 if O(format) is C(OpenSSH) author: - Yanis Guenane (@Spredzy) - Felix Fontein (@felixfontein) @@ -61,14 +61,14 @@ options: privatekey_path: description: - Path to the TLS/SSL private key from which to generate the public key. - - Either I(privatekey_path) or I(privatekey_content) must be specified, but not both. - If I(state) is C(present), one of them is required. + - Either O(privatekey_path) or O(privatekey_content) must be specified, but not both. + If O(state) is V(present), one of them is required. type: path privatekey_content: description: - The content of the TLS/SSL private key from which to generate the public key. - - Either I(privatekey_path) or I(privatekey_content) must be specified, but not both. - If I(state) is C(present), one of them is required. + - Either O(privatekey_path) or O(privatekey_content) must be specified, but not both. + If O(state) is V(present), one of them is required. type: str version_added: '1.0.0' privatekey_passphrase: @@ -84,14 +84,14 @@ options: select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography ] return_content: description: - - If set to C(true), will return the (current or generated) public key's content as I(publickey). + - If set to V(true), will return the (current or generated) public key's content as RV(publickey). type: bool default: false version_added: '1.0.0' @@ -145,7 +145,7 @@ RETURN = r''' privatekey: description: - Path to the TLS/SSL private key the public key was generated from. - - Will be C(none) if the private key has been provided in I(privatekey_content). + - Will be V(none) if the private key has been provided in O(privatekey_content). returned: changed or success type: str sample: /etc/ssl/private/ansible.com.pem @@ -173,12 +173,12 @@ fingerprint: sha512: "fd:ed:5e:39:48:5f:9f:fe:7f:25:06:3f:79:08:cd:ee:a5:e7:b3:3d:13:82:87:1f:84:e1:f5:c7:28:77:53:94:86:56:38:69:f0:d9:35:22:01:1e:a6:60:...:0f:9b" backup_file: description: Name of backup file created. - returned: changed and if I(backup) is C(true) + returned: changed and if O(backup) is V(true) type: str sample: /path/to/publickey.pem.2019-03-09@11:22~ publickey: description: The (current or generated) public key's content. - returned: if I(state) is C(present) and I(return_content) is C(true) + returned: if O(state) is V(present) and O(return_content) is V(true) type: str version_added: '1.0.0' ''' diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_publickey_info.py b/ansible_collections/community/crypto/plugins/modules/openssl_publickey_info.py index 7b0610065..d6e28fdd0 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_publickey_info.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_publickey_info.py @@ -32,14 +32,14 @@ options: content: description: - Content of the public key file. - - Either I(path) or I(content) must be specified, but not both. + - Either O(path) or O(content) must be specified, but not both. type: str select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography ] @@ -47,9 +47,8 @@ options: seealso: - module: community.crypto.openssl_publickey - module: community.crypto.openssl_privatekey_info - - ref: community.crypto.openssl_publickey_info filter <ansible_collections.community.crypto.openssl_publickey_info_filter> - # - plugin: community.crypto.openssl_publickey_info - # plugin_type: filter + - plugin: community.crypto.openssl_publickey_info + plugin_type: filter description: A filter variant of this module. ''' @@ -85,8 +84,8 @@ fingerprints: type: description: - The key's type. - - One of C(RSA), C(DSA), C(ECC), C(Ed25519), C(X25519), C(Ed448), or C(X448). - - Will start with C(unknown) if the key type cannot be determined. + - One of V(RSA), V(DSA), V(ECC), V(Ed25519), V(X25519), V(Ed448), or V(X448). + - Will start with V(unknown) if the key type cannot be determined. returned: success type: str sample: RSA @@ -100,57 +99,57 @@ public_data: description: - Bit size of modulus (RSA) or prime number (DSA). type: int - returned: When C(type=RSA) or C(type=DSA) + returned: When RV(type=RSA) or RV(type=DSA) modulus: description: - The RSA key's modulus. type: int - returned: When C(type=RSA) + returned: When RV(type=RSA) exponent: description: - The RSA key's public exponent. type: int - returned: When C(type=RSA) + returned: When RV(type=RSA) p: description: - The C(p) value for DSA. - This is the prime modulus upon which arithmetic takes place. type: int - returned: When C(type=DSA) + returned: When RV(type=DSA) q: description: - The C(q) value for DSA. - This is a prime that divides C(p - 1), and at the same time the order of the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(type=DSA) + returned: When RV(type=DSA) g: description: - The C(g) value for DSA. - This is the element spanning the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(type=DSA) + returned: When RV(type=DSA) curve: description: - The curve's name for ECC. type: str - returned: When C(type=ECC) + returned: When RV(type=ECC) exponent_size: description: - The maximum number of bits of a private key. This is basically the bit size of the subgroup used. type: int - returned: When C(type=ECC) + returned: When RV(type=ECC) x: description: - The C(x) coordinate for the public point on the elliptic curve. type: int - returned: When C(type=ECC) + returned: When RV(type=ECC) y: description: - - For C(type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. - - For C(type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. + - For RV(type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. + - For RV(type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. type: int - returned: When C(type=DSA) or C(type=ECC) + returned: When RV(type=DSA) or RV(type=ECC) ''' diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_signature.py b/ansible_collections/community/crypto/plugins/modules/openssl_signature.py index 43503bd1d..8236839c2 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_signature.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_signature.py @@ -35,12 +35,12 @@ options: privatekey_path: description: - The path to the private key to use when signing. - - Either I(privatekey_path) or I(privatekey_content) must be specified, but not both. + - Either O(privatekey_path) or O(privatekey_content) must be specified, but not both. type: path privatekey_content: description: - The content of the private key to use when signing the certificate signing request. - - Either I(privatekey_path) or I(privatekey_content) must be specified, but not both. + - Either O(privatekey_path) or O(privatekey_content) must be specified, but not both. type: str privatekey_passphrase: description: @@ -56,8 +56,8 @@ options: select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography ] diff --git a/ansible_collections/community/crypto/plugins/modules/openssl_signature_info.py b/ansible_collections/community/crypto/plugins/modules/openssl_signature_info.py index b83f3e693..2a5d3b3d9 100644 --- a/ansible_collections/community/crypto/plugins/modules/openssl_signature_info.py +++ b/ansible_collections/community/crypto/plugins/modules/openssl_signature_info.py @@ -35,12 +35,12 @@ options: certificate_path: description: - The path to the certificate used to verify the signature. - - Either I(certificate_path) or I(certificate_content) must be specified, but not both. + - Either O(certificate_path) or O(certificate_content) must be specified, but not both. type: path certificate_content: description: - The content of the certificate used to verify the signature. - - Either I(certificate_path) or I(certificate_content) must be specified, but not both. + - Either O(certificate_path) or O(certificate_content) must be specified, but not both. type: str signature: description: Base64 encoded signature. @@ -49,8 +49,8 @@ options: select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography ] @@ -87,7 +87,7 @@ EXAMPLES = r''' RETURN = r''' valid: - description: C(true) means the signature was valid for the given file, C(false) means it was not. + description: V(true) means the signature was valid for the given file, V(false) means it was not. returned: success type: bool ''' diff --git a/ansible_collections/community/crypto/plugins/modules/x509_certificate.py b/ansible_collections/community/crypto/plugins/modules/x509_certificate.py index 1b4ece5cb..f1c7d6b00 100644 --- a/ansible_collections/community/crypto/plugins/modules/x509_certificate.py +++ b/ansible_collections/community/crypto/plugins/modules/x509_certificate.py @@ -15,16 +15,16 @@ DOCUMENTATION = r''' module: x509_certificate short_description: Generate and/or check OpenSSL certificates description: - - It implements a notion of provider (one of C(selfsigned), C(ownca), C(acme), and C(entrust)) + - It implements a notion of provider (one of V(selfsigned), V(ownca), V(acme), and V(entrust)) for your certificate. - "Please note that the module regenerates existing certificate if it does not match the module's options, or if it seems to be corrupt. If you are concerned that this could overwrite - your existing certificate, consider using the I(backup) option." + your existing certificate, consider using the O(backup) option." - Note that this module was called C(openssl_certificate) when included directly in Ansible up to version 2.9. When moved to the collection C(community.crypto), it was renamed to M(community.crypto.x509_certificate). From Ansible 2.10 on, it can still be used by the old short name (or by C(ansible.builtin.openssl_certificate)), which redirects to - C(community.crypto.x509_certificate). When using FQCNs or when using the + M(community.crypto.x509_certificate). When using FQCNs or when using the L(collections,https://docs.ansible.com/ansible/latest/user_guide/collections_using.html#using-collections-in-a-playbook) keyword, the new name M(community.crypto.x509_certificate) should be used to avoid a deprecation warning. @@ -67,15 +67,15 @@ options: Please see the examples on how to emulate it with M(community.crypto.x509_certificate_info), M(community.crypto.openssl_csr_info), M(community.crypto.openssl_privatekey_info) and M(ansible.builtin.assert). - - "The C(entrust) provider was added for Ansible 2.9 and requires credentials for the + - "The V(entrust) provider was added for Ansible 2.9 and requires credentials for the L(Entrust Certificate Services,https://www.entrustdatacard.com/products/categories/ssl-certificates) (ECS) API." - - Required if I(state) is C(present). + - Required if O(state) is V(present). type: str choices: [ acme, entrust, ownca, selfsigned ] return_content: description: - - If set to C(true), will return the (current or generated) certificate's content as I(certificate). + - If set to V(true), will return the (current or generated) certificate's content as RV(certificate). type: bool default: false version_added: '1.0.0' @@ -222,12 +222,12 @@ filename: sample: /etc/ssl/crt/www.ansible.com.crt backup_file: description: Name of backup file created. - returned: changed and if I(backup) is C(true) + returned: changed and if O(backup) is V(true) type: str sample: /path/to/www.ansible.com.crt.2019-03-09@11:22~ certificate: description: The (current or generated) certificate's content. - returned: if I(state) is C(present) and I(return_content) is C(true) + returned: if O(state) is V(present) and O(return_content) is V(true) type: str version_added: '1.0.0' ''' diff --git a/ansible_collections/community/crypto/plugins/modules/x509_certificate_info.py b/ansible_collections/community/crypto/plugins/modules/x509_certificate_info.py index 145cd2195..d89f610c5 100644 --- a/ansible_collections/community/crypto/plugins/modules/x509_certificate_info.py +++ b/ansible_collections/community/crypto/plugins/modules/x509_certificate_info.py @@ -21,7 +21,7 @@ description: up to version 2.9. When moved to the collection C(community.crypto), it was renamed to M(community.crypto.x509_certificate_info). From Ansible 2.10 on, it can still be used by the old short name (or by C(ansible.builtin.openssl_certificate_info)), which redirects to - C(community.crypto.x509_certificate_info). When using FQCNs or when using the + M(community.crypto.x509_certificate_info). When using FQCNs or when using the L(collections,https://docs.ansible.com/ansible/latest/user_guide/collections_using.html#using-collections-in-a-playbook) keyword, the new name M(community.crypto.x509_certificate_info) should be used to avoid a deprecation warning. @@ -39,31 +39,31 @@ options: path: description: - Remote absolute path where the certificate file is loaded from. - - Either I(path) or I(content) must be specified, but not both. + - Either O(path) or O(content) must be specified, but not both. - PEM and DER formats are supported. type: path content: description: - Content of the X.509 certificate in PEM format. - - Either I(path) or I(content) must be specified, but not both. + - Either O(path) or O(content) must be specified, but not both. type: str version_added: '1.0.0' valid_at: description: - A dict of names mapping to time specifications. Every time specified here will be checked whether the certificate is valid at this point. See the - C(valid_at) return value for informations on the result. + RV(valid_at) return value for information on the result. - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer - + C([w | d | h | m | s]) (for example C(+32w1d2h)), and ASN.1 TIME (in other words, pattern C(YYYYMMDDHHMMSSZ)). + + C([w | d | h | m | s]) (for example V(+32w1d2h)), and ASN.1 TIME (in other words, pattern C(YYYYMMDDHHMMSSZ)). Note that all timestamps will be treated as being in UTC. type: dict select_crypto_backend: description: - Determines which crypto backend to use. - - The default choice is C(auto), which tries to use C(cryptography) if available. - - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. + - The default choice is V(auto), which tries to use C(cryptography) if available. + - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library. type: str default: auto choices: [ auto, cryptography ] @@ -74,10 +74,11 @@ notes: seealso: - module: community.crypto.x509_certificate - module: community.crypto.x509_certificate_pipe - - ref: community.crypto.x509_certificate_info filter <ansible_collections.community.crypto.x509_certificate_info_filter> - # - plugin: community.crypto.x509_certificate_info - # plugin_type: filter + - plugin: community.crypto.x509_certificate_info + plugin_type: filter description: A filter variant of this module. + - plugin: community.crypto.to_serial + plugin_type: filter ''' EXAMPLES = r''' @@ -127,7 +128,7 @@ expired: returned: success type: bool basic_constraints: - description: Entries in the C(basic_constraints) extension, or C(none) if extension is not present. + description: Entries in the C(basic_constraints) extension, or V(none) if extension is not present. returned: success type: list elements: str @@ -137,7 +138,7 @@ basic_constraints_critical: returned: success type: bool extended_key_usage: - description: Entries in the C(extended_key_usage) extension, or C(none) if extension is not present. + description: Entries in the C(extended_key_usage) extension, or V(none) if extension is not present. returned: success type: list elements: str @@ -168,7 +169,7 @@ extensions_by_oid: sample: "MAMCAQU=" sample: {"1.3.6.1.5.5.7.1.24": { "critical": false, "value": "MAMCAQU="}} key_usage: - description: Entries in the C(key_usage) extension, or C(none) if extension is not present. + description: Entries in the C(key_usage) extension, or V(none) if extension is not present. returned: success type: str sample: [Key Agreement, Data Encipherment] @@ -178,8 +179,8 @@ key_usage_critical: type: bool subject_alt_name: description: - - Entries in the C(subject_alt_name) extension, or C(none) if extension is not present. - - See I(name_encoding) for how IDNs are handled. + - Entries in the C(subject_alt_name) extension, or V(none) if extension is not present. + - See O(name_encoding) for how IDNs are handled. returned: success type: list elements: str @@ -189,7 +190,7 @@ subject_alt_name_critical: returned: success type: bool ocsp_must_staple: - description: C(true) if the OCSP Must Staple extension is present, C(none) otherwise. + description: V(true) if the OCSP Must Staple extension is present, V(none) otherwise. returned: success type: bool ocsp_must_staple_critical: @@ -240,8 +241,8 @@ public_key: public_key_type: description: - The certificate's public key's type. - - One of C(RSA), C(DSA), C(ECC), C(Ed25519), C(X25519), C(Ed448), or C(X448). - - Will start with C(unknown) if the key type cannot be determined. + - One of V(RSA), V(DSA), V(ECC), V(Ed25519), V(X25519), V(Ed448), or V(X448). + - Will start with V(unknown) if the key type cannot be determined. returned: success type: str version_added: 1.7.0 @@ -257,57 +258,57 @@ public_key_data: description: - Bit size of modulus (RSA) or prime number (DSA). type: int - returned: When C(public_key_type=RSA) or C(public_key_type=DSA) + returned: When RV(public_key_type=RSA) or RV(public_key_type=DSA) modulus: description: - The RSA key's modulus. type: int - returned: When C(public_key_type=RSA) + returned: When RV(public_key_type=RSA) exponent: description: - The RSA key's public exponent. type: int - returned: When C(public_key_type=RSA) + returned: When RV(public_key_type=RSA) p: description: - The C(p) value for DSA. - This is the prime modulus upon which arithmetic takes place. type: int - returned: When C(public_key_type=DSA) + returned: When RV(public_key_type=DSA) q: description: - The C(q) value for DSA. - This is a prime that divides C(p - 1), and at the same time the order of the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(public_key_type=DSA) + returned: When RV(public_key_type=DSA) g: description: - The C(g) value for DSA. - This is the element spanning the subgroup of the multiplicative group of the prime field used. type: int - returned: When C(public_key_type=DSA) + returned: When RV(public_key_type=DSA) curve: description: - The curve's name for ECC. type: str - returned: When C(public_key_type=ECC) + returned: When RV(public_key_type=ECC) exponent_size: description: - The maximum number of bits of a private key. This is basically the bit size of the subgroup used. type: int - returned: When C(public_key_type=ECC) + returned: When RV(public_key_type=ECC) x: description: - The C(x) coordinate for the public point on the elliptic curve. type: int - returned: When C(public_key_type=ECC) + returned: When RV(public_key_type=ECC) y: description: - - For C(public_key_type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. - - For C(public_key_type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. + - For RV(public_key_type=ECC), this is the C(y) coordinate for the public point on the elliptic curve. + - For RV(public_key_type=DSA), this is the publicly known group element whose discrete logarithm w.r.t. C(g) is the private key. type: int - returned: When C(public_key_type=DSA) or C(public_key_type=ECC) + returned: When RV(public_key_type=DSA) or RV(public_key_type=ECC) public_key_fingerprints: description: - Fingerprints of certificate's public key. @@ -331,7 +332,10 @@ signature_algorithm: type: str sample: sha256WithRSAEncryption serial_number: - description: The certificate's serial number. + description: + - The certificate's serial number. + - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, + such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). returned: success type: int sample: 1234 @@ -341,7 +345,7 @@ version: type: int sample: 3 valid_at: - description: For every time stamp provided in the I(valid_at) option, a + description: For every time stamp provided in the O(valid_at) option, a boolean whether the certificate is valid at that point in time or not. returned: success @@ -349,24 +353,24 @@ valid_at: subject_key_identifier: description: - The certificate's subject key identifier. - - The identifier is returned in hexadecimal, with C(:) used to separate bytes. - - Is C(none) if the C(SubjectKeyIdentifier) extension is not present. + - The identifier is returned in hexadecimal, with V(:) used to separate bytes. + - Is V(none) if the C(SubjectKeyIdentifier) extension is not present. returned: success type: str sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33' authority_key_identifier: description: - The certificate's authority key identifier. - - The identifier is returned in hexadecimal, with C(:) used to separate bytes. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. + - The identifier is returned in hexadecimal, with V(:) used to separate bytes. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. returned: success type: str sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33' authority_cert_issuer: description: - The certificate's authority cert issuer as a list of general names. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. - - See I(name_encoding) for how IDNs are handled. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. + - See O(name_encoding) for how IDNs are handled. returned: success type: list elements: str @@ -374,18 +378,20 @@ authority_cert_issuer: authority_cert_serial_number: description: - The certificate's authority cert serial number. - - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present. + - Is V(none) if the C(AuthorityKeyIdentifier) extension is not present. + - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, + such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). returned: success type: int sample: 12345 ocsp_uri: description: The OCSP responder URI, if included in the certificate. Will be - C(none) if no OCSP responder URI is included. + V(none) if no OCSP responder URI is included. returned: success type: str issuer_uri: description: The Issuer URI, if included in the certificate. Will be - C(none) if no issuer URI is included. + V(none) if no issuer URI is included. returned: success type: str version_added: 2.9.0 diff --git a/ansible_collections/community/crypto/plugins/modules/x509_certificate_pipe.py b/ansible_collections/community/crypto/plugins/modules/x509_certificate_pipe.py index 440a2cdf1..a968ef4c3 100644 --- a/ansible_collections/community/crypto/plugins/modules/x509_certificate_pipe.py +++ b/ansible_collections/community/crypto/plugins/modules/x509_certificate_pipe.py @@ -17,11 +17,8 @@ module: x509_certificate_pipe short_description: Generate and/or check OpenSSL certificates version_added: 1.3.0 description: - - It implements a notion of provider (ie. C(selfsigned), C(ownca), C(entrust)) + - It implements a notion of provider (one of V(selfsigned), V(ownca), V(entrust)) for your certificate. - - "Please note that the module regenerates an existing certificate if it does not match the module's - options, or if it seems to be corrupt. If you are concerned that this could overwrite - your existing certificate, consider using the I(backup) option." author: - Yanis Guenane (@Spredzy) - Markus Teufelberger (@MarkusTeufelberger) @@ -35,13 +32,19 @@ extends_documentation_fragment: attributes: check_mode: support: full + details: + - Currently in check mode, private keys will not be (re-)generated, only the changed status is + set. This will change in community.crypto 3.0.0. + - From community.crypto 3.0.0 on, the module will ignore check mode and always behave as if + check mode is not active. If you think this breaks your use-case of this module, please + create an issue in the community.crypto repository. diff_mode: support: full options: provider: description: - Name of the provider to use to generate/retrieve the OpenSSL certificate. - - "The C(entrust) provider requires credentials for the + - "The V(entrust) provider requires credentials for the L(Entrust Certificate Services,https://www.entrustdatacard.com/products/categories/ssl-certificates) (ECS) API." type: str choices: [ entrust, ownca, selfsigned ] @@ -74,8 +77,8 @@ EXAMPLES = r''' - name: (1/2) Generate an OpenSSL Certificate with the CSR provided inline community.crypto.x509_certificate_pipe: provider: ownca - content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.crt') }}" - csr_content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.csr') }}" + content: "{{ lookup('ansible.builtin.file', '/etc/ssl/csr/www.ansible.com.crt') }}" + csr_content: "{{ lookup('ansible.builtin.file', '/etc/ssl/csr/www.ansible.com.csr') }}" ownca_cert: /path/to/ca_cert.crt ownca_privatekey: /path/to/ca_cert.key ownca_privatekey_passphrase: hunter2 @@ -157,6 +160,7 @@ class GenericCertificate(object): """Retrieve a certificate using the given module backend.""" def __init__(self, module, module_backend): self.check_mode = module.check_mode + self.module = module self.module_backend = module_backend self.changed = False if module.params['content'] is not None: @@ -166,6 +170,16 @@ class GenericCertificate(object): if self.module_backend.needs_regeneration(): if not self.check_mode: self.module_backend.generate_certificate() + else: + self.module.deprecate( + 'Check mode support for x509_certificate_pipe will change in community.crypto 3.0.0' + ' to behave the same as without check mode. You can get that behavior right now' + ' by adding `check_mode: false` to the x509_certificate_pipe task. If you think this' + ' breaks your use-case of this module, please create an issue in the' + ' community.crypto repository', + version='3.0.0', + collection_name='community.crypto', + ) self.changed = True def dump(self, check_mode=False): diff --git a/ansible_collections/community/crypto/plugins/modules/x509_crl.py b/ansible_collections/community/crypto/plugins/modules/x509_crl.py index 824ed8310..1ac97005a 100644 --- a/ansible_collections/community/crypto/plugins/modules/x509_crl.py +++ b/ansible_collections/community/crypto/plugins/modules/x509_crl.py @@ -45,24 +45,24 @@ options: crl_mode: description: - Defines how to process entries of existing CRLs. - - If set to C(generate), makes sure that the CRL has the exact set of revoked certificates - as specified in I(revoked_certificates). - - If set to C(update), makes sure that the CRL contains the revoked certificates from - I(revoked_certificates), but can also contain other revoked certificates. If the CRL file + - If set to V(generate), makes sure that the CRL has the exact set of revoked certificates + as specified in O(revoked_certificates). + - If set to V(update), makes sure that the CRL contains the revoked certificates from + O(revoked_certificates), but can also contain other revoked certificates. If the CRL file already exists, all entries from the existing CRL will also be included in the new CRL. - When using C(update), you might be interested in setting I(ignore_timestamps) to C(true). - - The default value is C(generate). - - This parameter was called I(mode) before community.crypto 2.13.0. It has been renamed to avoid - a collision with the common I(mode) parameter for setting the CRL file's access mode. + When using V(update), you might be interested in setting O(ignore_timestamps) to V(true). + - The default value is V(generate). + - This parameter was called O(mode) before community.crypto 2.13.0. It has been renamed to avoid + a collision with the common O(mode) parameter for setting the CRL file's access mode. type: str # default: generate choices: [ generate, update ] version_added: 2.13.0 mode: description: - - This parameter has been renamed to I(crl_mode). The old name I(mode) is now deprecated and will - be removed in community.crypto 3.0.0. Replace usage of this parameter with I(crl_mode). - - Note that from community.crypto 3.0.0 on, I(mode) will be used for the CRL file's mode. + - This parameter has been renamed to O(crl_mode). The old name O(mode) is now deprecated and will + be removed in community.crypto 3.0.0. Replace usage of this parameter with O(crl_mode). + - Note that from community.crypto 3.0.0 on, O(mode) will be used for the CRL file's mode. type: str # default: generate choices: [ generate, update ] @@ -89,7 +89,7 @@ options: format: description: - Whether the CRL file should be in PEM or DER format. - - If an existing CRL file does match everything but I(format), it will be converted to the correct format + - If an existing CRL file does match everything but O(format), it will be converted to the correct format instead of regenerated. type: str choices: [pem, der] @@ -98,18 +98,18 @@ options: privatekey_path: description: - Path to the CA's private key to use when signing the CRL. - - Either I(privatekey_path) or I(privatekey_content) must be specified if I(state) is C(present), but not both. + - Either O(privatekey_path) or O(privatekey_content) must be specified if O(state) is V(present), but not both. type: path privatekey_content: description: - The content of the CA's private key to use when signing the CRL. - - Either I(privatekey_path) or I(privatekey_content) must be specified if I(state) is C(present), but not both. + - Either O(privatekey_path) or O(privatekey_content) must be specified if O(state) is V(present), but not both. type: str privatekey_passphrase: description: - - The passphrase for the I(privatekey_path). + - The passphrase for the O(privatekey_path). - This is required if the private key is password protected. type: str @@ -117,9 +117,9 @@ options: description: - Key/value pairs that will be present in the issuer name field of the CRL. - If you need to specify more than one value with the same key, use a list as value. - - If the order of the components is important, use I(issuer_ordered). - - One of I(issuer) and I(issuer_ordered) is required if I(state) is C(present). - - Mutually exclusive with I(issuer_ordered). + - If the order of the components is important, use O(issuer_ordered). + - One of O(issuer) and O(issuer_ordered) is required if O(state) is V(present). + - Mutually exclusive with O(issuer_ordered). type: dict issuer_ordered: description: @@ -127,8 +127,8 @@ options: This key/value pair will be present in the issuer name field of the CRL. - If you want to specify more than one value with the same key in a row, you can use a list as value. - - One of I(issuer) and I(issuer_ordered) is required if I(state) is C(present). - - Mutually exclusive with I(issuer). + - One of O(issuer) and O(issuer_ordered) is required if O(state) is V(present). + - Mutually exclusive with O(issuer). type: list elements: dict version_added: 2.0.0 @@ -139,23 +139,23 @@ options: - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer - + C([w | d | h | m | s]) (for example C(+32w1d2h)). + + C([w | d | h | m | s]) (for example V(+32w1d2h)). - Note that if using relative time this module is NOT idempotent, except when - I(ignore_timestamps) is set to C(true). + O(ignore_timestamps) is set to V(true). type: str default: "+0s" next_update: description: - - "The absolute latest point in time by which this I(issuer) is expected to have issued - another CRL. Many clients will treat a CRL as expired once I(next_update) occurs." + - "The absolute latest point in time by which this O(issuer) is expected to have issued + another CRL. Many clients will treat a CRL as expired once O(next_update) occurs." - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer - + C([w | d | h | m | s]) (for example C(+32w1d2h)). + + C([w | d | h | m | s]) (for example V(+32w1d2h)). - Note that if using relative time this module is NOT idempotent, except when - I(ignore_timestamps) is set to C(true). - - Required if I(state) is C(present). + O(ignore_timestamps) is set to V(true). + - Required if O(state) is V(present). type: str digest: @@ -164,10 +164,25 @@ options: type: str default: sha256 + serial_numbers: + description: + - This option determines which values will be accepted for O(revoked_certificates[].serial_number). + - If set to V(integer) (default), serial numbers are assumed to be integers, for example V(66223). + (This example value is equivalent to the hex octet string V(01:02:AF).) + - If set to V(hex-octets), serial numbers are assumed to be colon-separated hex octet strings, + for example V(01:02:AF). + (This example value is equivalent to the integer V(66223).) + type: str + choices: + - integer + - hex-octets + default: integer + version_added: 2.18.0 + revoked_certificates: description: - List of certificates to be revoked. - - Required if I(state) is C(present). + - Required if O(state) is V(present). type: list elements: dict suboptions: @@ -175,37 +190,46 @@ options: description: - Path to a certificate in PEM format. - The serial number and issuer will be extracted from the certificate. - - Mutually exclusive with I(content) and I(serial_number). One of these three options + - Mutually exclusive with O(revoked_certificates[].content) and + O(revoked_certificates[].serial_number). One of these three options must be specified. type: path content: description: - Content of a certificate in PEM format. - The serial number and issuer will be extracted from the certificate. - - Mutually exclusive with I(path) and I(serial_number). One of these three options + - Mutually exclusive with O(revoked_certificates[].path) and + O(revoked_certificates[].serial_number). One of these three options must be specified. type: str serial_number: description: - Serial number of the certificate. - - Mutually exclusive with I(path) and I(content). One of these three options must + - Mutually exclusive with O(revoked_certificates[].path) and + O(revoked_certificates[].content). One of these three options must be specified. - type: int + - This option accepts integers or hex octet strings, depending on the value + of O(serial_numbers). + - If O(serial_numbers=integer), integers such as V(66223) must be provided. + - If O(serial_numbers=hex-octets), strings such as V(01:02:AF) must be provided. + - You can use the filters P(community.crypto.parse_serial#filter) and + P(community.crypto.to_serial#filter) to convert these two representations. + type: raw revocation_date: description: - The point in time the certificate was revoked. - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer - + C([w | d | h | m | s]) (for example C(+32w1d2h)). + + C([w | d | h | m | s]) (for example V(+32w1d2h)). - Note that if using relative time this module is NOT idempotent, except when - I(ignore_timestamps) is set to C(true). + O(ignore_timestamps) is set to V(true). type: str default: "+0s" issuer: description: - The certificate's issuer. - - "Example: C(DNS:ca.example.org)" + - "Example: V(DNS:ca.example.org)" type: list elements: str issuer_critical: @@ -240,9 +264,9 @@ options: - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer - + C([w | d | h | m | s]) (for example C(+32w1d2h)). + + C([w | d | h | m | s]) (for example V(+32w1d2h)). - Note that if using relative time this module is NOT idempotent. This will NOT - change when I(ignore_timestamps) is set to C(true). + change when O(ignore_timestamps) is set to V(true). type: str invalidity_date_critical: description: @@ -252,22 +276,28 @@ options: ignore_timestamps: description: - - Whether the timestamps I(last_update), I(next_update) and I(revocation_date) (in - I(revoked_certificates)) should be ignored for idempotency checks. The timestamp - I(invalidity_date) in I(revoked_certificates) will never be ignored. + - Whether the timestamps O(last_update), O(next_update) and + O(revoked_certificates[].revocation_date) should be ignored for idempotency checks. + The timestamp O(revoked_certificates[].invalidity_date) will never be ignored. - Use this in combination with relative timestamps for these values to get idempotency. type: bool default: false return_content: description: - - If set to C(true), will return the (current or generated) CRL's content as I(crl). + - If set to V(true), will return the (current or generated) CRL's content as RV(crl). type: bool default: false notes: - All ASN.1 TIME values should be specified following the YYYYMMDDHHMMSSZ pattern. - Date specified should be UTC. Minutes and seconds are mandatory. + +seealso: + - plugin: community.crypto.parse_serial + plugin_type: filter + - plugin: community.crypto.to_serial + plugin_type: filter ''' EXAMPLES = r''' @@ -300,7 +330,7 @@ filename: sample: /path/to/my-ca.crl backup_file: description: Name of backup file created. - returned: changed and if I(backup) is C(true) + returned: changed and if O(backup) is V(true) type: str sample: /path/to/my-ca.crl.2019-03-09@11:22~ privatekey: @@ -310,15 +340,18 @@ privatekey: sample: /path/to/my-ca.pem format: description: - - Whether the CRL is in PEM format (C(pem)) or in DER format (C(der)). + - Whether the CRL is in PEM format (V(pem)) or in DER format (V(der)). returned: success type: str sample: pem + choices: + - pem + - der issuer: description: - The CRL's issuer. - Note that for repeated values, only the last one will be returned. - - See I(name_encoding) for how IDNs are handled. + - See O(name_encoding) for how IDNs are handled. returned: success type: dict sample: {"organizationName": "Ansible", "commonName": "ca.example.com"} @@ -350,7 +383,10 @@ revoked_certificates: elements: dict contains: serial_number: - description: Serial number of the certificate. + description: + - Serial number of the certificate. + - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, + such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). type: int sample: 1234 revocation_date: @@ -360,7 +396,7 @@ revoked_certificates: issuer: description: - The certificate's issuer. - - See I(name_encoding) for how IDNs are handled. + - See O(name_encoding) for how IDNs are handled. type: list elements: str sample: ["DNS:ca.example.org"] @@ -371,11 +407,19 @@ revoked_certificates: reason: description: - The value for the revocation reason extension. - - One of C(unspecified), C(key_compromise), C(ca_compromise), C(affiliation_changed), C(superseded), - C(cessation_of_operation), C(certificate_hold), C(privilege_withdrawn), C(aa_compromise), and - C(remove_from_crl). type: str sample: key_compromise + choices: + - unspecified + - key_compromise + - ca_compromise + - affiliation_changed + - superseded + - cessation_of_operation + - certificate_hold + - privilege_withdrawn + - aa_compromise + - remove_from_crl reason_critical: description: Whether the revocation reason extension is critical. type: bool @@ -393,9 +437,9 @@ revoked_certificates: crl: description: - The (current or generated) CRL's content. - - Will be the CRL itself if I(format) is C(pem), and Base64 of the - CRL if I(format) is C(der). - returned: if I(state) is C(present) and I(return_content) is C(true) + - Will be the CRL itself if O(format) is V(pem), and Base64 of the + CRL if O(format) is V(der). + returned: if O(state) is V(present) and O(return_content) is V(true) type: str ''' @@ -406,7 +450,9 @@ import traceback from ansible.module_utils.basic import AnsibleModule, missing_required_lib from ansible.module_utils.common.text.converters import to_native, to_text +from ansible.module_utils.common.validation import check_type_int, check_type_str +from ansible_collections.community.crypto.plugins.module_utils.serial import parse_serial from ansible_collections.community.crypto.plugins.module_utils.version import LooseVersion from ansible_collections.community.crypto.plugins.module_utils.io import ( @@ -495,6 +541,7 @@ class CRL(OpenSSLObject): self.ignore_timestamps = module.params['ignore_timestamps'] self.return_content = module.params['return_content'] self.name_encoding = module.params['name_encoding'] + self.serial_numbers_format = module.params['serial_numbers'] self.crl_content = None self.privatekey_path = module.params['privatekey_path'] @@ -520,6 +567,8 @@ class CRL(OpenSSLObject): if self.digest is None: raise CRLError('The digest "{0}" is not supported'.format(module.params['digest'])) + self.module = module + self.revoked_certificates = [] for i, rc in enumerate(module.params['revoked_certificates']): result = { @@ -551,7 +600,7 @@ class CRL(OpenSSLObject): ) else: # Specify serial_number (and potentially issuer) directly - result['serial_number'] = rc['serial_number'] + result['serial_number'] = self._parse_serial_number(rc['serial_number'], i) # All other options if rc['issuer']: result['issuer'] = [cryptography_get_name(issuer, 'issuer') for issuer in rc['issuer']] @@ -571,8 +620,6 @@ class CRL(OpenSSLObject): result['invalidity_date_critical'] = rc['invalidity_date_critical'] self.revoked_certificates.append(result) - self.module = module - self.backup = module.params['backup'] self.backup_file = None @@ -606,6 +653,25 @@ class CRL(OpenSSLObject): self.diff_after = self.diff_before = self._get_info(data) + def _parse_serial_number(self, value, index): + if self.serial_numbers_format == 'integer': + try: + return check_type_int(value) + except TypeError as exc: + self.module.fail_json(msg='Error while parsing revoked_certificates[{idx}].serial_number as an integer: {exc}'.format( + idx=index + 1, + exc=to_native(exc), + )) + if self.serial_numbers_format == 'hex-octets': + try: + return parse_serial(check_type_str(value)) + except (TypeError, ValueError) as exc: + self.module.fail_json(msg='Error while parsing revoked_certificates[{idx}].serial_number as an colon-separated hex octet string: {exc}'.format( + idx=index + 1, + exc=to_native(exc), + )) + raise RuntimeError('Unexpected value %s of serial_numbers' % (self.serial_numbers_format, )) + def _get_info(self, data): if data is None: return dict() @@ -871,7 +937,7 @@ def main(): options=dict( path=dict(type='path'), content=dict(type='str'), - serial_number=dict(type='int'), + serial_number=dict(type='raw'), revocation_date=dict(type='str', default='+0s'), issuer=dict(type='list', elements='str'), issuer_critical=dict(type='bool', default=False), @@ -891,6 +957,7 @@ def main(): mutually_exclusive=[['path', 'content', 'serial_number']], ), name_encoding=dict(type='str', default='ignore', choices=['ignore', 'idna', 'unicode']), + serial_numbers=dict(type='str', default='integer', choices=['integer', 'hex-octets']), ), required_if=[ ('state', 'present', ['privatekey_path', 'privatekey_content'], True), diff --git a/ansible_collections/community/crypto/plugins/modules/x509_crl_info.py b/ansible_collections/community/crypto/plugins/modules/x509_crl_info.py index 7b0ebcac9..2cf25f530 100644 --- a/ansible_collections/community/crypto/plugins/modules/x509_crl_info.py +++ b/ansible_collections/community/crypto/plugins/modules/x509_crl_info.py @@ -28,16 +28,16 @@ options: path: description: - Remote absolute path where the generated CRL file should be created or is already located. - - Either I(path) or I(content) must be specified, but not both. + - Either O(path) or O(content) must be specified, but not both. type: path content: description: - Content of the X.509 CRL in PEM format, or Base64-encoded X.509 CRL. - - Either I(path) or I(content) must be specified, but not both. + - Either O(path) or O(content) must be specified, but not both. type: str list_revoked_certificates: description: - - If set to C(false), the list of revoked certificates is not included in the result. + - If set to V(false), the list of revoked certificates is not included in the result. - This is useful when retrieving information on large CRL files. Enumerating all revoked certificates can take some time, including serializing the result as JSON, sending it to the Ansible controller, and decoding it again. @@ -50,10 +50,11 @@ notes: They are all in UTC. seealso: - module: community.crypto.x509_crl - - ref: community.crypto.x509_crl_info filter <ansible_collections.community.crypto.x509_crl_info_filter> - # - plugin: community.crypto.x509_crl_info - # plugin_type: filter + - plugin: community.crypto.x509_crl_info + plugin_type: filter description: A filter variant of this module. + - plugin: community.crypto.to_serial + plugin_type: filter ''' EXAMPLES = r''' @@ -76,15 +77,18 @@ EXAMPLES = r''' RETURN = r''' format: description: - - Whether the CRL is in PEM format (C(pem)) or in DER format (C(der)). + - Whether the CRL is in PEM format (V(pem)) or in DER format (V(der)). returned: success type: str sample: pem + choices: + - pem + - der issuer: description: - The CRL's issuer. - Note that for repeated values, only the last one will be returned. - - See I(name_encoding) for how IDNs are handled. + - See O(name_encoding) for how IDNs are handled. returned: success type: dict sample: {"organizationName": "Ansible", "commonName": "ca.example.com"} @@ -111,12 +115,15 @@ digest: sample: sha256WithRSAEncryption revoked_certificates: description: List of certificates to be revoked. - returned: success if I(list_revoked_certificates=true) + returned: success if O(list_revoked_certificates=true) type: list elements: dict contains: serial_number: - description: Serial number of the certificate. + description: + - Serial number of the certificate. + - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, + such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). type: int sample: 1234 revocation_date: @@ -126,7 +133,7 @@ revoked_certificates: issuer: description: - The certificate's issuer. - - See I(name_encoding) for how IDNs are handled. + - See O(name_encoding) for how IDNs are handled. type: list elements: str sample: ["DNS:ca.example.org"] @@ -137,11 +144,19 @@ revoked_certificates: reason: description: - The value for the revocation reason extension. - - One of C(unspecified), C(key_compromise), C(ca_compromise), C(affiliation_changed), C(superseded), - C(cessation_of_operation), C(certificate_hold), C(privilege_withdrawn), C(aa_compromise), and - C(remove_from_crl). type: str sample: key_compromise + choices: + - unspecified + - key_compromise + - ca_compromise + - affiliation_changed + - superseded + - cessation_of_operation + - certificate_hold + - privilege_withdrawn + - aa_compromise + - remove_from_crl reason_critical: description: Whether the revocation reason extension is critical. type: bool diff --git a/ansible_collections/community/crypto/plugins/plugin_utils/gnupg.py b/ansible_collections/community/crypto/plugins/plugin_utils/gnupg.py new file mode 100644 index 000000000..0cd715bf0 --- /dev/null +++ b/ansible_collections/community/crypto/plugins/plugin_utils/gnupg.py @@ -0,0 +1,51 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2023, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +from subprocess import Popen, PIPE + +from ansible.module_utils.common.process import get_bin_path +from ansible.module_utils.common.text.converters import to_native + +from ansible_collections.community.crypto.plugins.module_utils.gnupg.cli import GPGError, GPGRunner + + +class PluginGPGRunner(GPGRunner): + def __init__(self, executable=None, cwd=None): + if executable is None: + try: + executable = get_bin_path('gpg') + except ValueError as e: + raise GPGError('Cannot find the `gpg` executable on the controller') + self.executable = executable + self.cwd = cwd + + def run_command(self, command, check_rc=True, data=None): + """ + Run ``[gpg] + command`` and return ``(rc, stdout, stderr)``. + + If ``data`` is not ``None``, it will be provided as stdin. + The code assumes it is a bytes string. + + Returned stdout and stderr are native Python strings. + Pass ``check_rc=False`` to allow return codes != 0. + + Raises a ``GPGError`` in case of errors. + """ + command = [self.executable] + command + p = Popen(command, shell=False, cwd=self.cwd, stdin=PIPE, stdout=PIPE, stderr=PIPE) + stdout, stderr = p.communicate(input=data) + stdout = to_native(stdout, errors='surrogate_or_replace') + stderr = to_native(stderr, errors='surrogate_or_replace') + if check_rc and p.returncode != 0: + raise GPGError('Running {cmd} yielded return code {rc} with stdout: "{stdout}" and stderr: "{stderr}")'.format( + cmd=' '.join(command), + rc=p.returncode, + stdout=to_native(stdout, errors='surrogate_or_replace'), + stderr=to_native(stderr, errors='surrogate_or_replace'), + )) + return p.returncode, stdout, stderr diff --git a/ansible_collections/community/crypto/tests/integration/targets/acme_challenge_cert_helper/tasks/main.yml b/ansible_collections/community/crypto/tests/integration/targets/acme_challenge_cert_helper/tasks/main.yml index ef40ec601..c4b138572 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/acme_challenge_cert_helper/tasks/main.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/acme_challenge_cert_helper/tasks/main.yml @@ -9,7 +9,7 @@ #################################################################### - block: - - name: Generate ECC256 accoun keys + - name: Generate ECC256 account keys openssl_privatekey: path: "{{ remote_tmp_dir }}/account-ec256.pem" type: ECC diff --git a/ansible_collections/community/crypto/tests/integration/targets/filter_gpg_fingerprint/aliases b/ansible_collections/community/crypto/tests/integration/targets/filter_gpg_fingerprint/aliases new file mode 100644 index 000000000..326a499c3 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/filter_gpg_fingerprint/aliases @@ -0,0 +1,6 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +azp/posix/2 +destructive diff --git a/ansible_collections/community/crypto/tests/integration/targets/filter_gpg_fingerprint/meta/main.yml b/ansible_collections/community/crypto/tests/integration/targets/filter_gpg_fingerprint/meta/main.yml new file mode 100644 index 000000000..398d0cf6c --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/filter_gpg_fingerprint/meta/main.yml @@ -0,0 +1,9 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +dependencies: + - prepare_jinja2_compat + - setup_remote_tmp_dir + - setup_gnupg diff --git a/ansible_collections/community/crypto/tests/integration/targets/filter_gpg_fingerprint/tasks/main.yml b/ansible_collections/community/crypto/tests/integration/targets/filter_gpg_fingerprint/tasks/main.yml new file mode 100644 index 000000000..071b490fd --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/filter_gpg_fingerprint/tasks/main.yml @@ -0,0 +1,80 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Run tests if GPG is available + when: has_gnupg + block: + - name: Create GPG key + ansible.builtin.command: + cmd: gpg --homedir "{{ remote_tmp_dir }}" --batch --generate-key + stdin: | + %echo Generating a basic OpenPGP key + %no-ask-passphrase + %no-protection + Key-Type: RSA + Key-Length: 4096 + Name-Real: Foo Bar + Name-Email: foo@bar.com + Expire-Date: 0 + %commit + %echo done + register: result + + - name: Extract fingerprint + ansible.builtin.shell: gpg --homedir "{{ remote_tmp_dir }}" --with-colons --fingerprint foo@bar.com | grep '^fpr:' + register: fingerprints + + - name: Show fingerprints + ansible.builtin.debug: + msg: "{{ fingerprints.stdout_lines | map('split', ':') | list }}" + + - name: Export public key + ansible.builtin.command: gpg --homedir "{{ remote_tmp_dir }}" --export --armor foo@bar.com + register: public_key + + - name: Export private key + ansible.builtin.command: gpg --homedir "{{ remote_tmp_dir }}" --export-secret-key --armor foo@bar.com + register: private_key + + - name: Gather fingerprints + ansible.builtin.set_fact: + public_key_fingerprint: "{{ public_key.stdout | community.crypto.gpg_fingerprint }}" + private_key_fingerprint: "{{ private_key.stdout | community.crypto.gpg_fingerprint }}" + + - name: Check whether fingerprints match + ansible.builtin.assert: + that: + - public_key_fingerprint == (fingerprints.stdout_lines[0] | split(':'))[9] + - private_key_fingerprint == (fingerprints.stdout_lines[0] | split(':'))[9] + + - name: Error scenario - wrong input type + ansible.builtin.set_fact: + failing_result: "{{ 42 | community.crypto.gpg_fingerprint }}" + register: result + ignore_errors: true + + - name: Check result + ansible.builtin.assert: + that: + - result is failed + - >- + 'The input for the community.crypto.gpg_fingerprint filter must be a string; got ' in result.msg + - >- + 'int' in result.msg + + - name: Error scenario - garbage input + ansible.builtin.set_fact: + failing_result: "{{ 'garbage' | community.crypto.gpg_fingerprint }}" + register: result + ignore_errors: true + + - name: Check result + ansible.builtin.assert: + that: + - result is failed + - >- + 'Running ' in result.msg + - >- + ('/gpg --no-keyring --with-colons --import-options show-only --import /dev/stdin yielded return code ') in result.msg diff --git a/ansible_collections/community/crypto/tests/integration/targets/filter_parse_serial/aliases b/ansible_collections/community/crypto/tests/integration/targets/filter_parse_serial/aliases new file mode 100644 index 000000000..12d1d6617 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/filter_parse_serial/aliases @@ -0,0 +1,5 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +azp/posix/2 diff --git a/ansible_collections/community/crypto/tests/integration/targets/filter_parse_serial/tasks/main.yml b/ansible_collections/community/crypto/tests/integration/targets/filter_parse_serial/tasks/main.yml new file mode 100644 index 000000000..67175ac07 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/filter_parse_serial/tasks/main.yml @@ -0,0 +1,62 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Test parse_serial filter + assert: + that: + - >- + '0' | community.crypto.parse_serial == 0 + - >- + '00' | community.crypto.parse_serial == 0 + - >- + '000' | community.crypto.parse_serial == 0 + - >- + 'ff' | community.crypto.parse_serial == 255 + - >- + '0ff' | community.crypto.parse_serial == 255 + - >- + '1:0' | community.crypto.parse_serial == 256 + - >- + '1:2:3' | community.crypto.parse_serial == 66051 + +- name: "Test error 1: empty string" + debug: + msg: >- + {{ '' | community.crypto.parse_serial }} + ignore_errors: true + register: error_1 + +- name: "Test error 2: invalid type" + debug: + msg: >- + {{ [] | community.crypto.parse_serial }} + ignore_errors: true + register: error_2 + +- name: "Test error 3: invalid values (range)" + debug: + msg: >- + {{ '100' | community.crypto.parse_serial }} + ignore_errors: true + register: error_3 + +- name: "Test error 4: invalid values (digits)" + debug: + msg: >- + {{ 'abcdefg' | community.crypto.parse_serial }} + ignore_errors: true + register: error_4 + +- name: Validate errors + assert: + that: + - >- + error_1 is failed and "The 1st part '' is not a hexadecimal number in range [0, 255]: invalid literal" in error_1.msg + - >- + error_2 is failed and "The input for the community.crypto.parse_serial filter must be a string; got " in error_2.msg + - >- + error_3 is failed and "The 1st part '100' is not a hexadecimal number in range [0, 255]: the value is not in range [0, 255]" in error_3.msg + - >- + error_4 is failed and "The 1st part 'abcdefg' is not a hexadecimal number in range [0, 255]: invalid literal" in error_4.msg diff --git a/ansible_collections/community/crypto/tests/integration/targets/filter_to_serial/aliases b/ansible_collections/community/crypto/tests/integration/targets/filter_to_serial/aliases new file mode 100644 index 000000000..12d1d6617 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/filter_to_serial/aliases @@ -0,0 +1,5 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +azp/posix/2 diff --git a/ansible_collections/community/crypto/tests/integration/targets/filter_to_serial/tasks/main.yml b/ansible_collections/community/crypto/tests/integration/targets/filter_to_serial/tasks/main.yml new file mode 100644 index 000000000..1b1f4385f --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/filter_to_serial/tasks/main.yml @@ -0,0 +1,35 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Test to_serial filter + assert: + that: + - 0 | community.crypto.to_serial == '00' + - 1 | community.crypto.to_serial == '01' + - 255 | community.crypto.to_serial == 'FF' + - 256 | community.crypto.to_serial == '01:00' + - 65536 | community.crypto.to_serial == '01:00:00' + +- name: "Test error 1: negative number" + debug: + msg: >- + {{ (-1) | community.crypto.to_serial }} + ignore_errors: true + register: error_1 + +- name: "Test error 2: invalid type" + debug: + msg: >- + {{ [] | community.crypto.to_serial }} + ignore_errors: true + register: error_2 + +- name: Validate error + assert: + that: + - >- + error_1 is failed and "The input for the community.crypto.to_serial filter must not be negative" in error_1.msg + - >- + error_2 is failed and "The input for the community.crypto.to_serial filter must be an integer; got " in error_2.msg diff --git a/ansible_collections/community/crypto/tests/integration/targets/get_certificate/tests/validate.yml b/ansible_collections/community/crypto/tests/integration/targets/get_certificate/tests/validate.yml index 810a66f85..29ca26873 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/get_certificate/tests/validate.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/get_certificate/tests/validate.yml @@ -71,7 +71,11 @@ - result is not changed - result is failed # We got the expected error message - - "'The handshake operation timed out' in result.msg or 'unknown protocol' in result.msg or 'wrong version number' in result.msg" + - >- + 'The handshake operation timed out' in result.msg + or 'unknown protocol' in result.msg + or 'wrong version number' in result.msg + or 'record layer failure' in result.msg - name: Test timeout option get_certificate: diff --git a/ansible_collections/community/crypto/tests/integration/targets/lookup_gpg_fingerprint/aliases b/ansible_collections/community/crypto/tests/integration/targets/lookup_gpg_fingerprint/aliases new file mode 100644 index 000000000..326a499c3 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/lookup_gpg_fingerprint/aliases @@ -0,0 +1,6 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +azp/posix/2 +destructive diff --git a/ansible_collections/community/crypto/tests/integration/targets/lookup_gpg_fingerprint/meta/main.yml b/ansible_collections/community/crypto/tests/integration/targets/lookup_gpg_fingerprint/meta/main.yml new file mode 100644 index 000000000..398d0cf6c --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/lookup_gpg_fingerprint/meta/main.yml @@ -0,0 +1,9 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +dependencies: + - prepare_jinja2_compat + - setup_remote_tmp_dir + - setup_gnupg diff --git a/ansible_collections/community/crypto/tests/integration/targets/lookup_gpg_fingerprint/tasks/main.yml b/ansible_collections/community/crypto/tests/integration/targets/lookup_gpg_fingerprint/tasks/main.yml new file mode 100644 index 000000000..860cbce97 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/lookup_gpg_fingerprint/tasks/main.yml @@ -0,0 +1,93 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Run tests if GPG is available + when: has_gnupg + block: + - name: Create GPG key + ansible.builtin.command: + cmd: gpg --homedir "{{ remote_tmp_dir }}" --batch --generate-key + stdin: | + %echo Generating a basic OpenPGP key + %no-ask-passphrase + %no-protection + Key-Type: RSA + Key-Length: 4096 + Name-Real: Foo Bar + Name-Email: foo@bar.com + Expire-Date: 0 + %commit + %echo done + register: result + + - name: Extract fingerprint + ansible.builtin.shell: gpg --homedir "{{ remote_tmp_dir }}" --with-colons --fingerprint foo@bar.com | grep '^fpr:' + register: fingerprints + + - name: Show fingerprints + ansible.builtin.debug: + msg: "{{ fingerprints.stdout_lines | map('split', ':') | list }}" + + - name: Export public key + ansible.builtin.command: gpg --homedir "{{ remote_tmp_dir }}" --export --armor foo@bar.com + register: public_key + + - name: Export private key + ansible.builtin.command: gpg --homedir "{{ remote_tmp_dir }}" --export-secret-key --armor foo@bar.com + register: private_key + + - name: Write public key to disk + ansible.builtin.copy: + dest: "{{ remote_tmp_dir }}/public-key" + content: "{{ public_key.stdout }}" + + - name: Write private key to disk + ansible.builtin.copy: + dest: "{{ remote_tmp_dir }}/private-key" + content: "{{ private_key.stdout }}" + + - name: Gather fingerprints + ansible.builtin.set_fact: + public_key_fingerprint: "{{ lookup('community.crypto.gpg_fingerprint', remote_tmp_dir ~ '/public-key') }}" + private_key_fingerprint: "{{ lookup('community.crypto.gpg_fingerprint', remote_tmp_dir ~ '/private-key') }}" + + - name: Check whether fingerprints match + ansible.builtin.assert: + that: + - public_key_fingerprint == (fingerprints.stdout_lines[0] | split(':'))[9] + - private_key_fingerprint == (fingerprints.stdout_lines[0] | split(':'))[9] + + - name: Error scenario - file does not exist + ansible.builtin.set_fact: + failing_result: "{{ lookup('community.crypto.gpg_fingerprint', remote_tmp_dir ~ '/does-not-exist') }}" + register: result + ignore_errors: true + + - name: Check result + ansible.builtin.assert: + that: + - result is failed + - >- + (remote_tmp_dir ~ '/does-not-exist does not exist') in result.msg + + - name: Write garbage to disk + ansible.builtin.copy: + dest: "{{ remote_tmp_dir }}/garbage" + content: gargabe + + - name: Error scenario - file contains garbage + ansible.builtin.set_fact: + failing_result: "{{ lookup('community.crypto.gpg_fingerprint', remote_tmp_dir ~ '/garbage') }}" + register: result + ignore_errors: true + + - name: Check result + ansible.builtin.assert: + that: + - result is failed + - >- + 'Running ' in result.msg + - >- + ('/gpg --no-keyring --with-colons --import-options show-only --import ' ~ remote_tmp_dir ~ '/garbage yielded return code ') in result.msg diff --git a/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/keyslot-create-destroy.yml b/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/keyslot-create-destroy.yml new file mode 100644 index 000000000..51a3db362 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/keyslot-create-destroy.yml @@ -0,0 +1,206 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Create luks with keyslot 4 (check) + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile1" + keyslot: 4 + pbkdf: + iteration_time: 0.1 + check_mode: true + become: true + register: create_luks_slot4_check +- name: Create luks with keyslot 4 + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile1" + keyslot: 4 + pbkdf: + iteration_time: 0.1 + become: true + register: create_luks_slot4 +- name: Create luks with keyslot 4 (idempotent) + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile1" + keyslot: 4 + pbkdf: + iteration_time: 0.1 + become: true + register: create_luks_slot4_idem +- name: Create luks with keyslot 4 (idempotent, check) + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile1" + keyslot: 4 + pbkdf: + iteration_time: 0.1 + check_mode: true + become: true + register: create_luks_slot4_idem_check +- name: Dump luks header + command: "cryptsetup luksDump {{ cryptfile_device }}" + become: true + register: luks_header_slot4 +- assert: + that: + - create_luks_slot4_check is changed + - create_luks_slot4 is changed + - create_luks_slot4_idem is not changed + - create_luks_slot4_idem_check is not changed + - "'Key Slot 4: ENABLED' in luks_header_slot4.stdout or '4: luks2' in luks_header_slot4.stdout" + +- name: Add key in slot 2 (check) + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile1" + new_keyfile: "{{ remote_tmp_dir }}/keyfile2" + new_keyslot: 2 + pbkdf: + iteration_time: 0.1 + check_mode: true + become: true + register: add_luks_slot2_check +- name: Add key in slot 2 + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile1" + new_keyfile: "{{ remote_tmp_dir }}/keyfile2" + new_keyslot: 2 + pbkdf: + iteration_time: 0.1 + become: true + register: add_luks_slot2 +- name: Add key in slot 2 (idempotent) + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile1" + new_keyfile: "{{ remote_tmp_dir }}/keyfile2" + new_keyslot: 2 + pbkdf: + iteration_time: 0.1 + become: true + register: add_luks_slot2_idem +- name: Add key in slot 2 (idempotent, check) + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile1" + new_keyfile: "{{ remote_tmp_dir }}/keyfile2" + new_keyslot: 2 + pbkdf: + iteration_time: 0.1 + check_mode: true + become: true + register: add_luks_slot2_idem_check +- name: Dump luks header + command: "cryptsetup luksDump {{ cryptfile_device }}" + become: true + register: luks_header_slot2 +- assert: + that: + - add_luks_slot2_check is changed + - add_luks_slot2 is changed + - add_luks_slot2_idem is not changed + - add_luks_slot2_idem_check is not changed + - "'Key Slot 2: ENABLED' in luks_header_slot2.stdout or '2: luks2' in luks_header_slot2.stdout" + +- name: Check remove slot 4 without key + luks_device: + device: "{{ cryptfile_device }}" + remove_keyslot: 4 + ignore_errors: true + become: true + register: kill_slot4_nokey +- name: Check remove slot 4 with slot 4 key + luks_device: + device: "{{ cryptfile_device }}" + remove_keyslot: 4 + keyfile: "{{ remote_tmp_dir }}/keyfile1" + ignore_errors: true + become: true + register: kill_slot4_key_slot4 +- assert: + that: + - kill_slot4_nokey is failed + - kill_slot4_key_slot4 is failed + +- name: Remove key in slot 4 (check) + luks_device: + device: "{{ cryptfile_device }}" + keyfile: "{{ remote_tmp_dir }}/keyfile2" + remove_keyslot: 4 + check_mode: true + become: true + register: kill_luks_slot4_check +- name: Remove key in slot 4 + luks_device: + device: "{{ cryptfile_device }}" + keyfile: "{{ remote_tmp_dir }}/keyfile2" + remove_keyslot: 4 + become: true + register: kill_luks_slot4 +- name: Remove key in slot 4 (idempotent) + luks_device: + device: "{{ cryptfile_device }}" + keyfile: "{{ remote_tmp_dir }}/keyfile2" + remove_keyslot: 4 + become: true + register: kill_luks_slot4_idem +- name: Remove key in slot 4 (idempotent) + luks_device: + device: "{{ cryptfile_device }}" + keyfile: "{{ remote_tmp_dir }}/keyfile2" + remove_keyslot: 4 + check_mode: true + become: true + register: kill_luks_slot4_idem_check +- name: Dump luks header + command: "cryptsetup luksDump {{ cryptfile_device }}" + become: true + register: luks_header_slot4_removed +- assert: + that: + - kill_luks_slot4_check is changed + - kill_luks_slot4 is changed + - kill_luks_slot4_idem is not changed + - kill_luks_slot4_idem_check is not changed + - "'Key Slot 4: DISABLED' in luks_header_slot4_removed.stdout or not '4: luks' in luks_header_slot4_removed.stdout" + +- name: Add key in slot 0 + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile2" + new_keyfile: "{{ remote_tmp_dir }}/keyfile1" + new_keyslot: 0 + pbkdf: + iteration_time: 0.1 + become: true + register: add_luks_slot0 +- name: Remove key in slot 0 + luks_device: + device: "{{ cryptfile_device }}" + keyfile: "{{ remote_tmp_dir }}/keyfile2" + remove_keyslot: 0 + become: true + register: kill_luks_slot0 +- name: Dump luks header + command: "cryptsetup luksDump {{ cryptfile_device }}" + become: true + register: luks_header_slot0_removed +- assert: + that: + - add_luks_slot0 is changed + - kill_luks_slot0 is changed + - "'Key Slot 0: DISABLED' in luks_header_slot0_removed.stdout or not '0: luks' in luks_header_slot0_removed.stdout" diff --git a/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/keyslot-duplicate.yml b/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/keyslot-duplicate.yml new file mode 100644 index 000000000..cb9e559a1 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/keyslot-duplicate.yml @@ -0,0 +1,40 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Create new luks + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile1" + pbkdf: + iteration_time: 0.1 + become: true +- name: Add new keyslot with same keyfile (check) + luks_device: + device: "{{ cryptfile_device }}" + state: present + new_keyslot: 1 + keyfile: "{{ remote_tmp_dir }}/keyfile1" + new_keyfile: "{{ remote_tmp_dir }}/keyfile1" + become: true + ignore_errors: true + check_mode: true + register: keyslot_duplicate_check +- name: Add new keyslot with same keyfile + luks_device: + device: "{{ cryptfile_device }}" + state: present + new_keyslot: 1 + keyfile: "{{ remote_tmp_dir }}/keyfile1" + new_keyfile: "{{ remote_tmp_dir }}/keyfile1" + become: true + ignore_errors: true + register: keyslot_duplicate +- assert: + that: + - keyslot_duplicate_check is failed + - "'Trying to add key that is already present in another slot' in keyslot_duplicate_check.msg" + - keyslot_duplicate is failed + - "'Trying to add key that is already present in another slot' in keyslot_duplicate.msg" diff --git a/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/keyslot-options.yml b/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/keyslot-options.yml new file mode 100644 index 000000000..8a1ca14b3 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/keyslot-options.yml @@ -0,0 +1,79 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Check invalid slot (luks1, 8) + luks_device: + device: "{{ cryptfile_device }}" + state: present + type: luks1 + keyfile: "{{ remote_tmp_dir }}/keyfile1" + keyslot: 8 + pbkdf: + iteration_time: 0.1 + ignore_errors: true + become: true + register: create_luks1_slot8 +- name: Check invalid slot (luks2, 32) + luks_device: + device: "{{ cryptfile_device }}" + state: present + type: luks2 + keyfile: "{{ remote_tmp_dir }}/keyfile1" + keyslot: 32 + pbkdf: + iteration_time: 0.1 + ignore_errors: true + become: true + register: create_luks2_slot32 +- name: Check invalid slot (no luks type, 8) + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile1" + keyslot: 8 + pbkdf: + iteration_time: 0.1 + ignore_errors: true + become: true + register: create_luks_slot8 +- assert: + that: + - create_luks1_slot8 is failed + - create_luks2_slot32 is failed + - create_luks_slot8 is failed + +- name: Check valid slot (luks2, 8) + luks_device: + device: "{{ cryptfile_device }}" + state: present + type: luks2 + keyfile: "{{ remote_tmp_dir }}/keyfile1" + keyslot: 8 + pbkdf: + iteration_time: 0.1 + become: true + ignore_errors: true + register: create_luks2_slot8 +- name: Make sure that the previous task only fails if LUKS2 is not supported + assert: + that: + - "'Unknown option --type' in create_luks2_slot8.msg" + when: create_luks2_slot8 is failed +- name: Check add valid slot (no luks type, 10) + luks_device: + device: "{{ cryptfile_device }}" + state: present + keyfile: "{{ remote_tmp_dir }}/keyfile1" + new_keyfile: "{{ remote_tmp_dir }}/keyfile2" + new_keyslot: 10 + pbkdf: + iteration_time: 0.1 + become: true + register: create_luks_slot10 + when: create_luks2_slot8 is changed +- assert: + that: + - create_luks_slot10 is changed + when: create_luks2_slot8 is changed
\ No newline at end of file diff --git a/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/performance.yml b/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/performance.yml index 572625517..85f28ae4f 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/performance.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/luks_device/tasks/tests/performance.yml @@ -15,6 +15,7 @@ perf_no_read_workqueue: true perf_no_write_workqueue: true persistent: true + allow_discards: true pbkdf: iteration_time: 0.1 check_mode: true @@ -32,6 +33,7 @@ perf_no_read_workqueue: true perf_no_write_workqueue: true persistent: true + allow_discards: true become: true register: create_open - name: Create and open (idempotent) @@ -46,6 +48,7 @@ perf_no_read_workqueue: true perf_no_write_workqueue: true persistent: true + allow_discards: true become: true register: create_open_idem - name: Create and open (idempotent, check) @@ -60,6 +63,7 @@ perf_no_read_workqueue: true perf_no_write_workqueue: true persistent: true + allow_discards: true check_mode: true become: true register: create_open_idem_check @@ -80,6 +84,7 @@ - "'no-write-workqueue' in luks_header.stdout" - "'same-cpu-crypt' in luks_header.stdout" - "'submit-from-crypt-cpus' in luks_header.stdout" + - "'allow-discards' in luks_header.stdout" - name: Dump device mapper table command: "dmsetup table {{ create_open.name }}" @@ -91,6 +96,7 @@ - "'no_write_workqueue' in dm_table.stdout" - "'same_cpu_crypt' in dm_table.stdout" - "'submit_from_crypt_cpus' in dm_table.stdout" + - "'allow_discards' in dm_table.stdout" - name: Closed and Removed luks_device: diff --git a/ansible_collections/community/crypto/tests/integration/targets/luks_device/vars/Alpine.yml b/ansible_collections/community/crypto/tests/integration/targets/luks_device/vars/Alpine.yml index c0d230abf..e7e1f184a 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/luks_device/vars/Alpine.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/luks_device/vars/Alpine.yml @@ -7,4 +7,5 @@ cryptsetup_package: cryptsetup luks_extra_packages: - device-mapper + - lsblk - wipefs diff --git a/ansible_collections/community/crypto/tests/integration/targets/openssh_cert/tests/idempotency.yml b/ansible_collections/community/crypto/tests/integration/targets/openssh_cert/tests/idempotency.yml index c83596997..b1dd4a650 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/openssh_cert/tests/idempotency.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/openssh_cert/tests/idempotency.yml @@ -31,7 +31,7 @@ valid_to: forever check_mode: true changed: true - - test_name: Generate cert - force option (idemopotent, check mode) + - test_name: Generate cert - force option (idempotent, check mode) force: true type: user valid_from: always diff --git a/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/cryptography_backend.yml b/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/cryptography_backend.yml index b72c0be68..cf09dc20f 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/cryptography_backend.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/cryptography_backend.yml @@ -75,7 +75,7 @@ state: absent - name: Generate PEM encoded key with passphrase - command: 'ssh-keygen -b 1280 -f {{ remote_tmp_dir }}/pem_encoded -N {{ passphrase }} -m PEM' + command: 'ssh-keygen -t rsa -b 1280 -f {{ remote_tmp_dir }}/pem_encoded -N {{ passphrase }} -m PEM' - name: Try to verify a PEM encoded key openssh_keypair: diff --git a/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/options.yml b/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/options.yml index fdabd7614..0d324939c 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/options.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/options.yml @@ -100,8 +100,10 @@ comment: "test_modified@comment" backend: "{{ backend }}" register: modified_comment_output + ignore_errors: true - name: "({{ backend }}) Assert comment preserved public key - comment" + when: modified_comment_output is succeeded assert: that: - comment_output.public_key == modified_comment_output.public_key @@ -111,9 +113,17 @@ assert: that: - modified_comment_output.comment == 'test_modified@comment' + - modified_comment_output is succeeded # Support for updating comments for key types other than rsa1 was added in OpenSSH 7.2 when: not (backend == 'opensshbin' and openssh_version is version('7.2', '<')) +- name: "({{ backend }}) Assert comment not changed - comment" + assert: + that: + - modified_comment_output is failed + # Support for updating comments for key types other than rsa1 was added in OpenSSH 7.2 + when: backend == 'opensshbin' and openssh_version is version('7.2', '<') + - name: "({{ backend }}) Remove key - comment" openssh_keypair: path: "{{ remote_tmp_dir }}/comment" diff --git a/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/regenerate.yml b/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/regenerate.yml index d10096044..f9e2f43b3 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/regenerate.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/openssh_keypair/tests/regenerate.yml @@ -329,22 +329,25 @@ that: - result is changed -- name: "({{ backend }}) Regenerate - adjust comment" - openssh_keypair: - path: '{{ remote_tmp_dir }}/regenerate-a-{{ item }}' - type: dsa - size: 1024 - comment: test comment - regenerate: '{{ item }}' - backend: "{{ backend }}" - loop: "{{ regenerate_values }}" - register: result -- assert: - that: - - result is changed - # for all values but 'always', the key should not be regenerated. - # verify this by comparing fingerprints: - - result.results[0].fingerprint == result.results[1].fingerprint - - result.results[0].fingerprint == result.results[2].fingerprint - - result.results[0].fingerprint == result.results[3].fingerprint - - result.results[0].fingerprint != result.results[4].fingerprint +# Support for updating comments for key types other than rsa1 was added in OpenSSH 7.2 +- when: not (backend == 'opensshbin' and openssh_version is version('7.2', '<')) + block: + - name: "({{ backend }}) Regenerate - adjust comment" + openssh_keypair: + path: '{{ remote_tmp_dir }}/regenerate-a-{{ item }}' + type: dsa + size: 1024 + comment: test comment + regenerate: '{{ item }}' + backend: "{{ backend }}" + loop: "{{ regenerate_values }}" + register: result + - assert: + that: + - result is changed + # for all values but 'always', the key should not be regenerated. + # verify this by comparing fingerprints: + - result.results[0].fingerprint == result.results[1].fingerprint + - result.results[0].fingerprint == result.results[2].fingerprint + - result.results[0].fingerprint == result.results[3].fingerprint + - result.results[0].fingerprint != result.results[4].fingerprint diff --git a/ansible_collections/community/crypto/tests/integration/targets/openssl_pkcs12/tasks/main.yml b/ansible_collections/community/crypto/tests/integration/targets/openssl_pkcs12/tasks/main.yml index 7116c8674..cad051c6c 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/openssl_pkcs12/tasks/main.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/openssl_pkcs12/tasks/main.yml @@ -69,7 +69,10 @@ vars: select_crypto_backend: pyopenssl - when: (pyopenssl_version.stdout | default('0.0')) is version('0.15', '>=') + when: >- + (pyopenssl_version.stdout | default('0.0')) is version('0.15', '>=') + and + (pyopenssl_version.stdout | default('0.0')) is version('23.3.0', '<') - block: - name: Running tests with cryptography backend @@ -79,4 +82,11 @@ when: cryptography_version.stdout is version('3.0', '>=') - when: (pyopenssl_version.stdout | default('0.0')) is version('0.15', '>=') or cryptography_version.stdout is version('3.0', '>=') + when: >- + ( + (pyopenssl_version.stdout | default('0.0')) is version('0.15', '>=') + and + (pyopenssl_version.stdout | default('0.0')) is version('23.3.0', '<') + ) + or + cryptography_version.stdout is version('3.0', '>=') diff --git a/ansible_collections/community/crypto/tests/integration/targets/openssl_privatekey/tests/validate.yml b/ansible_collections/community/crypto/tests/integration/targets/openssl_privatekey/tests/validate.yml index 8f134dddf..4d92c2546 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/openssl_privatekey/tests/validate.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/openssl_privatekey/tests/validate.yml @@ -74,7 +74,7 @@ shell: "{{ openssl_binary }} rsa -noout -text -in {{ remote_tmp_dir }}/privatekey5.pem -passin pass:ansible | grep Private | sed 's/\\(RSA *\\)*Private-Key: (\\(.*\\) bit.*)/\\2/'" register: privatekey5 # Current version of OS/X that runs in the CI (10.11) does not have an up to date version of the OpenSSL library - # leading to this test to fail when run in the CI. However, this test has been run for 10.12 and has returned succesfully. + # leading to this test to fail when run in the CI. However, this test has been run for 10.12 and has returned successfully. when: openssl_version.stdout is version('0.9.8zh', '>=') - name: "({{ select_crypto_backend }}) Validate privatekey5 (assert - Passphrase protected key + idempotence)" diff --git a/ansible_collections/community/crypto/tests/integration/targets/openssl_publickey/tests/validate.yml b/ansible_collections/community/crypto/tests/integration/targets/openssl_publickey/tests/validate.yml index 8a1ab86e3..8c8a7292c 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/openssl_publickey/tests/validate.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/openssl_publickey/tests/validate.yml @@ -43,7 +43,7 @@ - name: "({{ select_crypto_backend }}) Validate public key - OpenSSH format (assert)" assert: that: - - privatekey_publickey.stdout == '{{ publickey.content|b64decode }}' + - privatekey_publickey.stdout == publickey.content | b64decode when: select_crypto_backend == 'cryptography' and cryptography_version.stdout is version('1.4.0', '>=') - name: "({{ select_crypto_backend }}) Validate public key - OpenSSH format - test idempotence (issue 33256)" diff --git a/ansible_collections/community/crypto/tests/integration/targets/prepare_jinja2_compat/filter_plugins/ansible_compatibility.py b/ansible_collections/community/crypto/tests/integration/targets/prepare_jinja2_compat/filter_plugins/ansible_compatibility.py new file mode 100644 index 000000000..c14af4ccb --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/prepare_jinja2_compat/filter_plugins/ansible_compatibility.py @@ -0,0 +1,20 @@ +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + + +# Added in ansible-core 2.11 +def compatibility_split_filter(text, by_what): + return text.split(by_what) + + +class FilterModule: + ''' Jinja2 compat filters ''' + + def filters(self): + return { + 'split': compatibility_split_filter, + } diff --git a/ansible_collections/community/crypto/tests/integration/targets/prepare_jinja2_compat/filter_plugins/jinja_compatibility.py b/ansible_collections/community/crypto/tests/integration/targets/prepare_jinja2_compat/filter_plugins/jinja_compatibility.py index 87ce01dce..98180a177 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/prepare_jinja2_compat/filter_plugins/jinja_compatibility.py +++ b/ansible_collections/community/crypto/tests/integration/targets/prepare_jinja2_compat/filter_plugins/jinja_compatibility.py @@ -1,6 +1,11 @@ -# Copyright (c) Ansible Project -# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) -# SPDX-License-Identifier: GPL-3.0-or-later +# This code is part of Ansible, but is an independent component. +# This particular file snippet, and this file snippet only, is licensed under the +# BSD-3-Clause License. Modules you write using this snippet, which is embedded +# dynamically by Ansible, still belong to the author of the module, and may assign +# their own license to the complete work. + +# The BSD License license has been included as LICENSES/BSD-3-Clause.txt in this collection. +# SPDX-License-Identifier: BSD-3-Clause # Copyright 2007 Pallets # diff --git a/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/meta/main.yml b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/meta/main.yml new file mode 100644 index 000000000..2fcd152f9 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/meta/main.yml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +dependencies: + - setup_pkg_mgr diff --git a/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/tasks/main.yml b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/tasks/main.yml new file mode 100644 index 000000000..9e02356fc --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/tasks/main.yml @@ -0,0 +1,30 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +- name: Print distribution specific data + ansible.builtin.debug: + msg: | + Distribution: {{ ansible_facts.distribution }} + Distribution version: {{ ansible_facts.distribution_version }} + Distribution major version: {{ ansible_facts.distribution_major_version }} + OS family: {{ ansible_facts.os_family }} + +- name: Include distribution specific variables + ansible.builtin.include_vars: '{{ lookup("ansible.builtin.first_found", params) }}' + vars: + params: + files: + - '{{ ansible_facts.distribution }}-{{ ansible_facts.distribution_version }}.yml' + - '{{ ansible_facts.distribution }}-{{ ansible_facts.distribution_major_version }}.yml' + - '{{ ansible_facts.distribution }}.yml' + - '{{ ansible_facts.os_family }}.yml' + - default.yml + paths: + - '{{ role_path }}/vars' + +- name: Install GnuPG + ansible.builtin.package: + name: '{{ gnupg_package_name }}' + when: has_gnupg diff --git a/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/Alpine.yml b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/Alpine.yml new file mode 100644 index 000000000..99bd64412 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/Alpine.yml @@ -0,0 +1,8 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +# Alpine 3.12 should have GnuPG, but for some reason installing it fails... +has_gnupg: "{{ ansible_facts.distribution_version is version('3.13', '>=') }}" +gnupg_package_name: gpg diff --git a/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/CentOS-6.yml b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/CentOS-6.yml new file mode 100644 index 000000000..fd09e9142 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/CentOS-6.yml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +has_gnupg: false +# The GnuPG version included with CentOS 6 is too old, it doesn't understand --generate-key diff --git a/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/Darwin.yml b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/Darwin.yml new file mode 100644 index 000000000..a7d999db8 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/Darwin.yml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +# TODO Homebrew currently isn't happy when running as root, so assume we don't have GnuPG +has_gnupg: false diff --git a/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/RedHat.yml b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/RedHat.yml new file mode 100644 index 000000000..3e82c4f98 --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/RedHat.yml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +has_gnupg: true +gnupg_package_name: gnupg2 diff --git a/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/default.yml b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/default.yml new file mode 100644 index 000000000..6059ed80e --- /dev/null +++ b/ansible_collections/community/crypto/tests/integration/targets/setup_gnupg/vars/default.yml @@ -0,0 +1,7 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +has_gnupg: true +gnupg_package_name: gnupg diff --git a/ansible_collections/community/crypto/tests/integration/targets/setup_python_info/vars/main.yml b/ansible_collections/community/crypto/tests/integration/targets/setup_python_info/vars/main.yml index ec2170aed..8bbf9f670 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/setup_python_info/vars/main.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/setup_python_info/vars/main.yml @@ -72,6 +72,8 @@ system_python_version_data: Debian: '11': - '3.9' + '12': + - '3.11' Alpine: '3.16': - '3.10' diff --git a/ansible_collections/community/crypto/tests/integration/targets/x509_certificate/tests/validate_ownca.yml b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate/tests/validate_ownca.yml index b1569a94c..ac25b6295 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/x509_certificate/tests/validate_ownca.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate/tests/validate_ownca.yml @@ -15,7 +15,7 @@ shell: '{{ openssl_binary }} x509 -noout -in {{ remote_tmp_dir}}/ownca_cert.pem -text | grep "Issuer" | sed "s/.*: \(.*\)/\1/g"' register: ownca_cert_issuer -- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (test - ownca certficate version == default == 3) +- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (test - ownca certificate version == default == 3) shell: '{{ openssl_binary }} x509 -noout -in {{ remote_tmp_dir}}/ownca_cert.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"' register: ownca_cert_version diff --git a/ansible_collections/community/crypto/tests/integration/targets/x509_certificate/tests/validate_selfsigned.yml b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate/tests/validate_selfsigned.yml index dfb1d8713..c76310437 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/x509_certificate/tests/validate_selfsigned.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate/tests/validate_selfsigned.yml @@ -18,7 +18,7 @@ shell: '{{ openssl_binary }} x509 -noout -modulus -in {{ remote_tmp_dir }}/cert_no_csr.pem' register: cert_modulus -- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate with no CSR (test - certficate version == default == 3) +- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate with no CSR (test - certificate version == default == 3) shell: '{{ openssl_binary }} x509 -noout -in {{ remote_tmp_dir}}/cert_no_csr.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"' register: cert_version @@ -55,7 +55,7 @@ register: cert_issuer -- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (test - certficate version == default == 3) +- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (test - certificate version == default == 3) shell: '{{ openssl_binary }} x509 -noout -in {{ remote_tmp_dir}}/cert.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"' register: cert_version diff --git a/ansible_collections/community/crypto/tests/integration/targets/x509_crl/tasks/impl.yml b/ansible_collections/community/crypto/tests/integration/targets/x509_crl/tasks/impl.yml index 11fa7dcca..29f2c473d 100644 --- a/ansible_collections/community/crypto/tests/integration/targets/x509_crl/tasks/impl.yml +++ b/ansible_collections/community/crypto/tests/integration/targets/x509_crl/tasks/impl.yml @@ -119,7 +119,7 @@ - cert-2.pem register: slurp -- name: Create CRL 1 (idempotent with content, check mode) +- name: Create CRL 1 (idempotent with content and octet string serial, check mode) x509_crl: path: '{{ remote_tmp_dir }}/ca-crl1.crl' privatekey_content: "{{ slurp.results[0].content | b64decode }}" @@ -127,6 +127,7 @@ CN: Ansible last_update: 20191013000000Z next_update: 20191113000000Z + serial_numbers: hex-octets revoked_certificates: - content: "{{ slurp.results[1].content | b64decode }}" revocation_date: 20191013000000Z @@ -135,12 +136,12 @@ reason: key_compromise reason_critical: true invalidity_date: 20191012000000Z - - serial_number: 1234 + - serial_number: 04:D2 revocation_date: 20191001000000Z check_mode: true register: crl_1_idem_content_check -- name: Create CRL 1 (idempotent with content) +- name: Create CRL 1 (idempotent with content and octet string serial) x509_crl: path: '{{ remote_tmp_dir }}/ca-crl1.crl' privatekey_content: "{{ slurp.results[0].content | b64decode }}" @@ -148,6 +149,7 @@ CN: Ansible last_update: 20191013000000Z next_update: 20191113000000Z + serial_numbers: hex-octets revoked_certificates: - content: "{{ slurp.results[1].content | b64decode }}" revocation_date: 20191013000000Z @@ -156,7 +158,7 @@ reason: key_compromise reason_critical: true invalidity_date: 20191012000000Z - - serial_number: 1234 + - serial_number: 04:D2 revocation_date: 20191001000000Z register: crl_1_idem_content @@ -220,7 +222,7 @@ reason: key_compromise reason_critical: true invalidity_date: 20191012000000Z - - serial_number: 1234 + - serial_number: "1234" revocation_date: 20191001000000Z check_mode: true register: crl_1_format_idem_check @@ -242,7 +244,7 @@ reason: key_compromise reason_critical: true invalidity_date: 20191012000000Z - - serial_number: 1234 + - serial_number: "1234" revocation_date: 20191001000000Z return_content: true register: crl_1_format_idem diff --git a/ansible_collections/community/crypto/tests/sanity/extra/extra-docs.py b/ansible_collections/community/crypto/tests/sanity/extra/extra-docs.py index c636beb08..251e6d70f 100755 --- a/ansible_collections/community/crypto/tests/sanity/extra/extra-docs.py +++ b/ansible_collections/community/crypto/tests/sanity/extra/extra-docs.py @@ -17,7 +17,7 @@ def main(): suffix = ':{env}'.format(env=env["ANSIBLE_COLLECTIONS_PATH"]) if 'ANSIBLE_COLLECTIONS_PATH' in env else '' env['ANSIBLE_COLLECTIONS_PATH'] = '{root}{suffix}'.format(root=os.path.dirname(os.path.dirname(os.path.dirname(os.getcwd()))), suffix=suffix) p = subprocess.run( - ['antsibull-docs', 'lint-collection-docs', '--plugin-docs', '--disallow-semantic-markup', '--skip-rstcheck', '.'], + ['antsibull-docs', 'lint-collection-docs', '--plugin-docs', '--skip-rstcheck', '.'], env=env, check=False, ) diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.10.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.10.txt index 56340b5b3..81d34f186 100644 --- a/ansible_collections/community/crypto/tests/sanity/ignore-2.10.txt +++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.10.txt @@ -4,6 +4,21 @@ .azure-pipelines/scripts/publish-codecov.py compile-3.5!skip # Uses Python 3.6+ syntax .azure-pipelines/scripts/publish-codecov.py future-import-boilerplate .azure-pipelines/scripts/publish-codecov.py metaclass-boilerplate +docs/docsite/rst/guide_selfsigned.rst rstcheck plugins/modules/acme_account_info.py validate-modules:return-syntax-error +plugins/modules/acme_challenge_cert_helper.py validate-modules:return-syntax-error +plugins/modules/ecs_certificate.py validate-modules:invalid-documentation +plugins/modules/get_certificate.py validate-modules:invalid-documentation +plugins/modules/openssh_cert.py validate-modules:invalid-documentation +plugins/modules/openssl_csr.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation +plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation +plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation +plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation +plugins/modules/x509_crl.py validate-modules:invalid-documentation +plugins/modules/x509_crl.py validate-modules:return-syntax-error +plugins/modules/x509_crl_info.py validate-modules:invalid-documentation +plugins/modules/x509_crl_info.py validate-modules:return-syntax-error tests/ee/roles/smoke/library/smoke_ipaddress.py shebang tests/ee/roles/smoke/library/smoke_pyyaml.py shebang diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.11.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.11.txt index 56340b5b3..2677551db 100644 --- a/ansible_collections/community/crypto/tests/sanity/ignore-2.11.txt +++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.11.txt @@ -5,5 +5,19 @@ .azure-pipelines/scripts/publish-codecov.py future-import-boilerplate .azure-pipelines/scripts/publish-codecov.py metaclass-boilerplate plugins/modules/acme_account_info.py validate-modules:return-syntax-error +plugins/modules/acme_challenge_cert_helper.py validate-modules:return-syntax-error +plugins/modules/ecs_certificate.py validate-modules:invalid-documentation +plugins/modules/get_certificate.py validate-modules:invalid-documentation +plugins/modules/openssh_cert.py validate-modules:invalid-documentation +plugins/modules/openssl_csr.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation +plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation +plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation +plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation +plugins/modules/x509_crl.py validate-modules:invalid-documentation +plugins/modules/x509_crl.py validate-modules:return-syntax-error +plugins/modules/x509_crl_info.py validate-modules:invalid-documentation +plugins/modules/x509_crl_info.py validate-modules:return-syntax-error tests/ee/roles/smoke/library/smoke_ipaddress.py shebang tests/ee/roles/smoke/library/smoke_pyyaml.py shebang diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.12.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.12.txt index c9b09ca4e..26e5b6864 100644 --- a/ansible_collections/community/crypto/tests/sanity/ignore-2.12.txt +++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.12.txt @@ -1,4 +1,18 @@ .azure-pipelines/scripts/publish-codecov.py replace-urlopen plugins/modules/acme_account_info.py validate-modules:return-syntax-error +plugins/modules/acme_challenge_cert_helper.py validate-modules:return-syntax-error +plugins/modules/ecs_certificate.py validate-modules:invalid-documentation +plugins/modules/get_certificate.py validate-modules:invalid-documentation +plugins/modules/openssh_cert.py validate-modules:invalid-documentation +plugins/modules/openssl_csr.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation +plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation +plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation +plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation +plugins/modules/x509_crl.py validate-modules:invalid-documentation +plugins/modules/x509_crl.py validate-modules:return-syntax-error +plugins/modules/x509_crl_info.py validate-modules:invalid-documentation +plugins/modules/x509_crl_info.py validate-modules:return-syntax-error tests/ee/roles/smoke/library/smoke_ipaddress.py shebang tests/ee/roles/smoke/library/smoke_pyyaml.py shebang diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.13.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.13.txt index ca127b4fd..74ca94712 100644 --- a/ansible_collections/community/crypto/tests/sanity/ignore-2.13.txt +++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.13.txt @@ -1,3 +1,15 @@ .azure-pipelines/scripts/publish-codecov.py replace-urlopen +plugins/lookup/gpg_fingerprint.py validate-modules:invalid-documentation +plugins/modules/ecs_certificate.py validate-modules:invalid-documentation +plugins/modules/get_certificate.py validate-modules:invalid-documentation +plugins/modules/openssh_cert.py validate-modules:invalid-documentation +plugins/modules/openssl_csr.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation +plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation +plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation +plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation +plugins/modules/x509_crl.py validate-modules:invalid-documentation +plugins/modules/x509_crl_info.py validate-modules:invalid-documentation tests/ee/roles/smoke/library/smoke_ipaddress.py shebang tests/ee/roles/smoke/library/smoke_pyyaml.py shebang diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.14.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.14.txt index ca127b4fd..74ca94712 100644 --- a/ansible_collections/community/crypto/tests/sanity/ignore-2.14.txt +++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.14.txt @@ -1,3 +1,15 @@ .azure-pipelines/scripts/publish-codecov.py replace-urlopen +plugins/lookup/gpg_fingerprint.py validate-modules:invalid-documentation +plugins/modules/ecs_certificate.py validate-modules:invalid-documentation +plugins/modules/get_certificate.py validate-modules:invalid-documentation +plugins/modules/openssh_cert.py validate-modules:invalid-documentation +plugins/modules/openssl_csr.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation +plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation +plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation +plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation +plugins/modules/x509_crl.py validate-modules:invalid-documentation +plugins/modules/x509_crl_info.py validate-modules:invalid-documentation tests/ee/roles/smoke/library/smoke_ipaddress.py shebang tests/ee/roles/smoke/library/smoke_pyyaml.py shebang diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.16.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.16.txt index ca127b4fd..9ffe1e998 100644 --- a/ansible_collections/community/crypto/tests/sanity/ignore-2.16.txt +++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.16.txt @@ -1,3 +1,2 @@ -.azure-pipelines/scripts/publish-codecov.py replace-urlopen tests/ee/roles/smoke/library/smoke_ipaddress.py shebang tests/ee/roles/smoke/library/smoke_pyyaml.py shebang diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.17.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.17.txt new file mode 100644 index 000000000..9ffe1e998 --- /dev/null +++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.17.txt @@ -0,0 +1,2 @@ +tests/ee/roles/smoke/library/smoke_ipaddress.py shebang +tests/ee/roles/smoke/library/smoke_pyyaml.py shebang diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.17.txt.license b/ansible_collections/community/crypto/tests/sanity/ignore-2.17.txt.license new file mode 100644 index 000000000..edff8c768 --- /dev/null +++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.17.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.9.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.9.txt index ce2f4b667..e20c4e5f3 100644 --- a/ansible_collections/community/crypto/tests/sanity/ignore-2.9.txt +++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.9.txt @@ -4,5 +4,20 @@ .azure-pipelines/scripts/publish-codecov.py compile-3.5!skip # Uses Python 3.6+ syntax .azure-pipelines/scripts/publish-codecov.py future-import-boilerplate .azure-pipelines/scripts/publish-codecov.py metaclass-boilerplate +docs/docsite/rst/guide_selfsigned.rst rstcheck +plugins/modules/acme_challenge_cert_helper.py validate-modules:return-syntax-error +plugins/modules/ecs_certificate.py validate-modules:invalid-documentation +plugins/modules/get_certificate.py validate-modules:invalid-documentation +plugins/modules/openssh_cert.py validate-modules:invalid-documentation +plugins/modules/openssl_csr.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation +plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation +plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation +plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation +plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation +plugins/modules/x509_crl.py validate-modules:invalid-documentation +plugins/modules/x509_crl.py validate-modules:return-syntax-error +plugins/modules/x509_crl_info.py validate-modules:invalid-documentation +plugins/modules/x509_crl_info.py validate-modules:return-syntax-error tests/ee/roles/smoke/library/smoke_ipaddress.py shebang tests/ee/roles/smoke/library/smoke_pyyaml.py shebang diff --git a/ansible_collections/community/crypto/tests/unit/plugins/module_utils/crypto/test_pem.py b/ansible_collections/community/crypto/tests/unit/plugins/module_utils/crypto/test_pem.py new file mode 100644 index 000000000..183d81b92 --- /dev/null +++ b/ansible_collections/community/crypto/tests/unit/plugins/module_utils/crypto/test_pem.py @@ -0,0 +1,67 @@ +# -*- coding: utf-8 -*- + +# Copyright (c) 2023, Felix Fontein <felix@fontein.de> +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +from __future__ import absolute_import, division, print_function +__metaclass__ = type + +import pytest + +from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import ( + identify_pem_format, + identify_private_key_format, + split_pem_list, + extract_first_pem, +) + + +PEM_TEST_CASES = [ + (b'', [], False, 'raw'), + (b'random stuff\nblabla', [], False, 'raw'), + (b'-----BEGIN PRIVATE KEY-----', [], False, 'raw'), + ( + b'-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----', + ['-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----'], + True, + 'pkcs8', + ), + ( + b'foo=bar\n# random stuff\n-----BEGIN RSA PRIVATE KEY-----\nblabla\n-----END RSA PRIVATE KEY-----\nmore stuff\n', + ['-----BEGIN RSA PRIVATE KEY-----\nblabla\n-----END RSA PRIVATE KEY-----\n'], + True, + 'pkcs1', + ), + ( + b'foo=bar\n# random stuff\n-----BEGIN CERTIFICATE-----\nblabla\n-----END CERTIFICATE-----\nmore stuff\n' + b'\n-----BEGIN CERTIFICATE-----\nfoobar\n-----END CERTIFICATE-----', + [ + '-----BEGIN CERTIFICATE-----\nblabla\n-----END CERTIFICATE-----\n', + '-----BEGIN CERTIFICATE-----\nfoobar\n-----END CERTIFICATE-----', + ], + True, + 'unknown-pem', + ), + ( + b'-----BEGINCERTIFICATE-----\n-----BEGIN CERTIFICATE-----\n-----BEGINCERTIFICATE-----\n-----END CERTIFICATE-----\n-----BEGINCERTIFICATE-----\n', + [ + '-----BEGIN CERTIFICATE-----\n-----BEGINCERTIFICATE-----\n-----END CERTIFICATE-----\n', + ], + True, + 'unknown-pem', + ), +] + + +@pytest.mark.parametrize('data, pems, is_pem, private_key_type', PEM_TEST_CASES) +def test_pem_handling(data, pems, is_pem, private_key_type): + assert identify_pem_format(data) == is_pem + assert identify_private_key_format(data) == private_key_type + try: + text = data.decode('utf-8') + assert split_pem_list(text) == pems + first_pem = pems[0] if pems else None + assert extract_first_pem(text) == first_pem + except UnicodeDecodeError: + pass diff --git a/ansible_collections/community/crypto/tests/unit/plugins/modules/test_luks_device.py b/ansible_collections/community/crypto/tests/unit/plugins/modules/test_luks_device.py index c773640c6..371001827 100644 --- a/ansible_collections/community/crypto/tests/unit/plugins/modules/test_luks_device.py +++ b/ansible_collections/community/crypto/tests/unit/plugins/modules/test_luks_device.py @@ -148,16 +148,16 @@ LUKS_ADD_KEY_DATA = ( # device, remove_key, remove_passphrase, state, label, expected LUKS_REMOVE_KEY_DATA = ( - ("dummy", "key", None, "present", None, True), - (None, "key", None, "present", None, False), - (None, "key", None, "present", "labelName", True), - ("dummy", None, None, "present", None, False), - ("dummy", "key", None, "absent", None, "exception"), - ("dummy", None, "foo", "present", None, True), - (None, None, "foo", "present", None, False), - (None, None, "foo", "present", "labelName", True), - ("dummy", None, None, "present", None, False), - ("dummy", None, "foo", "absent", None, "exception")) + ("dummy", "key", None, None, "present", None, True), + (None, "key", None, None, "present", None, False), + (None, "key", None, None, "present", "labelName", True), + ("dummy", None, None, None, "present", None, False), + ("dummy", "key", None, None, "absent", None, "exception"), + ("dummy", None, "foo", None, "present", None, True), + (None, None, "foo", None, "present", None, False), + (None, None, "foo", None, "present", "labelName", True), + ("dummy", None, None, None, "present", None, False), + ("dummy", None, "foo", None, "absent", None, "exception")) @pytest.mark.parametrize("device, keyfile, passphrase, state, is_luks, " + @@ -275,6 +275,7 @@ def test_luks_add_key(device, keyfile, passphrase, new_keyfile, new_passphrase, module.params["passphrase"] = passphrase module.params["new_keyfile"] = new_keyfile module.params["new_passphrase"] = new_passphrase + module.params["new_keyslot"] = None module.params["state"] = state module.params["label"] = label @@ -291,17 +292,18 @@ def test_luks_add_key(device, keyfile, passphrase, new_keyfile, new_passphrase, assert expected == "exception" -@pytest.mark.parametrize("device, remove_keyfile, remove_passphrase, state, " + - "label, expected", - ((d[0], d[1], d[2], d[3], d[4], d[5]) +@pytest.mark.parametrize("device, remove_keyfile, remove_passphrase, remove_keyslot, " + + "state, label, expected", + ((d[0], d[1], d[2], d[3], d[4], d[5], d[6]) for d in LUKS_REMOVE_KEY_DATA)) -def test_luks_remove_key(device, remove_keyfile, remove_passphrase, state, +def test_luks_remove_key(device, remove_keyfile, remove_passphrase, remove_keyslot, state, label, expected, monkeypatch): module = DummyModule() module.params["device"] = device module.params["remove_keyfile"] = remove_keyfile module.params["remove_passphrase"] = remove_passphrase + module.params["remove_keyslot"] = remove_keyslot module.params["state"] = state module.params["label"] = label diff --git a/ansible_collections/community/crypto/tests/utils/shippable/shippable.sh b/ansible_collections/community/crypto/tests/utils/shippable/shippable.sh index 526137698..2ef1d2f3b 100755 --- a/ansible_collections/community/crypto/tests/utils/shippable/shippable.sh +++ b/ansible_collections/community/crypto/tests/utils/shippable/shippable.sh @@ -75,17 +75,8 @@ fi # END: HACK -if [ "${SHIPPABLE_BUILD_ID:-}" ]; then - export ANSIBLE_COLLECTIONS_PATHS="${HOME}/.ansible" - SHIPPABLE_RESULT_DIR="$(pwd)/shippable" - TEST_DIR="${ANSIBLE_COLLECTIONS_PATHS}/ansible_collections/community/crypto" - mkdir -p "${TEST_DIR}" - cp -aT "${SHIPPABLE_BUILD_DIR}" "${TEST_DIR}" - cd "${TEST_DIR}" -else - # AZP - export ANSIBLE_COLLECTIONS_PATHS="$PWD/../../../" -fi +# AZP +export ANSIBLE_COLLECTIONS_PATHS="$PWD/../../../" if [ "${test}" == "sanity/extra" ]; then retry pip install junit-xml --disable-pip-version-check |