diff --git a/CHANGELOG.md b/CHANGELOG.md index 5e622d2d..f54352a8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,219 +1,260 @@ # Community Crypto Release Notes **Topics** -- v2\.17\.1 +- v2\.18\.0 - Release Summary - - Bugfixes -- v2\.17\.0 - - Release Summary - Minor Changes -- v2\.16\.2 - - Release Summary - - Bugfixes -- v2\.16\.1 - - Release Summary - - Bugfixes -- v2\.16\.0 - - Release Summary - - Minor Changes - - Bugfixes -- v2\.15\.1 - - Release Summary - - Bugfixes -- v2\.15\.0 - - Release Summary - - Minor Changes - Deprecated Features - - Bugfixes + - Bugfixes - New Plugins - Filter - - Lookup -- v2\.14\.1 +- v2\.17\.1 + - Release Summary + - Bugfixes +- v2\.17\.0 + - Release Summary + - Minor Changes +- v2\.16\.2 + - Release Summary + - Bugfixes +- v2\.16\.1 + - Release Summary + - Bugfixes +- v2\.16\.0 + - Release Summary + - Minor Changes + - Bugfixes +- v2\.15\.1 + - Release Summary + - Bugfixes +- v2\.15\.0 - Release Summary - - Bugfixes - - Known Issues -- v2\.14\.0 - - Release Summary - Minor Changes -- v2\.13\.1 - - Release Summary - - Bugfixes -- v2\.13\.0 - - Release Summary - - Minor Changes - Deprecated Features - - Bugfixes -- v2\.12\.0 - - Release Summary - - Minor Changes -- v2\.11\.1 - - Release Summary -- v2\.11\.0 - - Release Summary - - Minor Changes - - Bugfixes -- v2\.10\.0 - - Release Summary - - Bugfixes + - Bugfixes - New Plugins - Filter -- v2\.9\.0 - - Release Summary + - Lookup +- v2\.14\.1 + - Release Summary + - Bugfixes + - Known Issues +- v2\.14\.0 + - Release Summary + - Minor Changes +- v2\.13\.1 + - Release Summary + - Bugfixes +- v2\.13\.0 + - Release Summary + - Minor Changes + - Deprecated Features + - Bugfixes +- v2\.12\.0 + - Release Summary + - Minor Changes +- v2\.11\.1 + - Release Summary +- v2\.11\.0 + - Release Summary - Minor Changes -- v2\.8\.1 - - Release Summary -- v2\.8\.0 - - Release Summary - - Minor Changes -- v2\.7\.1 - - Release Summary + - Bugfixes +- v2\.10\.0 + - Release Summary - Bugfixes -- v2\.7\.0 - - Release Summary + - New Plugins + - Filter +- v2\.9\.0 + - Release Summary + - Minor Changes +- v2\.8\.1 + - Release Summary +- v2\.8\.0 + - Release Summary - Minor Changes +- v2\.7\.1 + - Release Summary - Bugfixes -- v2\.6\.0 +- v2\.7\.0 - Release Summary - Minor Changes -- v2\.5\.0 + - Bugfixes +- v2\.6\.0 - Release Summary - Minor Changes -- v2\.4\.0 +- v2\.5\.0 - Release Summary - - Deprecated Features - - Bugfixes -- v2\.3\.4 + - Minor Changes +- v2\.4\.0 - Release Summary -- v2\.3\.3 - - Release Summary + - Deprecated Features - Bugfixes -- v2\.3\.2 +- v2\.3\.4 + - Release Summary +- v2\.3\.3 - Release Summary - Bugfixes -- v2\.3\.1 +- v2\.3\.2 - Release Summary - Bugfixes -- v2\.3\.0 +- v2\.3\.1 - Release Summary - - Minor Changes - Bugfixes -- v2\.2\.4 +- v2\.3\.0 - Release Summary + - Minor Changes - Bugfixes -- v2\.2\.3 +- v2\.2\.4 - Release Summary - Bugfixes -- v2\.2\.2 +- v2\.2\.3 - Release Summary - Bugfixes -- v2\.2\.1 +- v2\.2\.2 - Release Summary - Bugfixes -- v2\.2\.0 +- v2\.2\.1 - Release Summary - - Minor Changes - Bugfixes -- v2\.1\.0 +- v2\.2\.0 - Release Summary - Minor Changes - Bugfixes - - New Modules -- v2\.0\.2 +- v2\.1\.0 - Release Summary -- v2\.0\.1 - - Release Summary - Minor Changes - Bugfixes -- v2\.0\.0 + - New Modules +- v2\.0\.2 + - Release Summary +- v2\.0\.1 - Release Summary - Minor Changes - - Breaking Changes / Porting Guide - - Deprecated Features - - Removed Features \(previously deprecated\) - Bugfixes -- v1\.9\.4 +- v2\.0\.0 - Release Summary + - Minor Changes + - Breaking Changes / Porting Guide + - Deprecated Features + - Removed Features \(previously deprecated\) - Bugfixes -- v1\.9\.3 +- v1\.9\.4 - Release Summary - Bugfixes -- v1\.9\.2 +- v1\.9\.3 - Release Summary -- v1\.9\.1 - - Release Summary -- v1\.9\.0 - - Release Summary - - Minor Changes - Bugfixes -- v1\.8\.0 +- v1\.9\.2 + - Release Summary +- v1\.9\.1 + - Release Summary +- v1\.9\.0 - Release Summary - Minor Changes - Bugfixes -- v1\.7\.1 +- v1\.8\.0 - Release Summary - - Bugfixes -- v1\.7\.0 - - Release Summary - Minor Changes + - Bugfixes +- v1\.7\.1 + - Release Summary - Bugfixes +- v1\.7\.0 + - Release Summary + - Minor Changes + - Bugfixes - New Modules - v1\.6\.2 - - Release Summary - - Bugfixes -- v1\.6\.1 - Release Summary - Bugfixes -- v1\.6\.0 +- v1\.6\.1 - Release Summary - - Minor Changes - - Deprecated Features - Bugfixes -- v1\.5\.0 +- v1\.6\.0 - Release Summary - Minor Changes - Deprecated Features - Bugfixes -- v1\.4\.0 +- v1\.5\.0 - Release Summary - Minor Changes + - Deprecated Features - Bugfixes -- v1\.3\.0 +- v1\.4\.0 - Release Summary - Minor Changes - Bugfixes - - New Modules -- v1\.2\.0 +- v1\.3\.0 - Release Summary - Minor Changes - - Security Fixes - Bugfixes -- v1\.1\.1 + - New Modules +- v1\.2\.0 - Release Summary - - Bugfixes -- v1\.1\.0 - - Release Summary - Minor Changes + - Security Fixes + - Bugfixes +- v1\.1\.1 + - Release Summary - Bugfixes - - New Modules -- v1\.0\.0 +- v1\.1\.0 - Release Summary - Minor Changes - - Deprecated Features - - Removed Features \(previously deprecated\) - Bugfixes + - New Modules +- v1\.0\.0 + - Release Summary + - Minor Changes + - Deprecated Features + - Removed Features \(previously deprecated\) + - Bugfixes - New Modules - -## v2\.17\.1 + +## v2\.18\.0 ### Release Summary -Bugfix release for compatibility with cryptography 42\.0\.0\. +Bugfix and feature release\. + + +### Minor Changes + +* x509\_crl \- the new option serial\_numbers allow to configure in which format serial numbers can be provided to revoked\_certificates\[\]\.serial\_number\. The default is as integers \(serial\_numbers\=integer\) for backwards compatibility\; setting serial\_numbers\=hex\-octets allows to specify colon\-separated hex octet strings like 00\:11\:22\:FF \([https\://github\.com/ansible\-collections/community\.crypto/issues/687](https\://github\.com/ansible\-collections/community\.crypto/issues/687)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/715](https\://github\.com/ansible\-collections/community\.crypto/pull/715)\)\. + + +### Deprecated Features + +* openssl\_csr\_pipe\, openssl\_privatekey\_pipe\, x509\_certificate\_pipe \- the current behavior of check mode is deprecated and will change in community\.crypto 3\.0\.0\. The current behavior is similar to the modules without \_pipe\: if the object needs to be \(re\-\)generated\, only the changed status is set\, but the object is not updated\. From community\.crypto 3\.0\.0 on\, the modules will ignore check mode and always act as if check mode is not active\. This behavior can already achieved now by adding check\_mode\: false to the task\. If you think this breaks your use\-case of this module\, please [create an issue in the community\.crypto repository](https\://github\.com/ansible\-collections/community\.crypto/issues/new/choose) \([https\://github\.com/ansible\-collections/community\.crypto/issues/712](https\://github\.com/ansible\-collections/community\.crypto/issues/712)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/714](https\://github\.com/ansible\-collections/community\.crypto/pull/714)\)\. ### Bugfixes +* luks\_device \- fixed module a bug that prevented using remove\_keyslot with the value 0 \([https\://github\.com/ansible\-collections/community\.crypto/pull/710](https\://github\.com/ansible\-collections/community\.crypto/pull/710)\)\. +* luks\_device \- fixed module falsely outputting changed\=false when trying to add a new slot with a key that is already present in another slot\. The module now rejects adding keys that are already present in another slot \([https\://github\.com/ansible\-collections/community\.crypto/pull/710](https\://github\.com/ansible\-collections/community\.crypto/pull/710)\)\. +* luks\_device \- fixed testing of LUKS passphrases in when specifying a keyslot for cryptsetup version 2\.0\.3\. The output of this cryptsetup version slightly differs from later versions \([https\://github\.com/ansible\-collections/community\.crypto/pull/710](https\://github\.com/ansible\-collections/community\.crypto/pull/710)\)\. + + +### New Plugins + + +#### Filter + +* parse\_serial \- Convert a serial number as a colon\-separated list of hex numbers to an integer +* to\_serial \- Convert an integer to a colon\-separated list of hex numbers + + +## v2\.17\.1 + + +### Release Summary + +Bugfix release for compatibility with cryptography 42\.0\.0\. + + +### Bugfixes + * openssl\_dhparam \- was using an internal function instead of the public API to load DH param files when using the cryptography backend\. The internal function was removed in cryptography 42\.0\.0\. The module now uses the public API\, which has been available since support for DH params was added to cryptography \([https\://github\.com/ansible\-collections/community\.crypto/pull/698](https\://github\.com/ansible\-collections/community\.crypto/pull/698)\)\. * openssl\_privatekey\_info \- check\_consistency\=true no longer works for RSA keys with cryptography 42\.0\.0\+ \([https\://github\.com/ansible\-collections/community\.crypto/pull/701](https\://github\.com/ansible\-collections/community\.crypto/pull/701)\)\. * openssl\_privatekey\_info \- check\_consistency\=true now reports a warning if it cannot determine consistency \([https\://github\.com/ansible\-collections/community\.crypto/pull/705](https\://github\.com/ansible\-collections/community\.crypto/pull/705)\)\. @@ -221,12 +262,12 @@ Bugfix release for compatibility with cryptography 42\.0\.0\. ## v2\.17\.0 - + ### Release Summary Feature release\. - + ### Minor Changes * luks\_device \- add allow discards option \([https\://github\.com/ansible\-collections/community\.crypto/pull/693](https\://github\.com/ansible\-collections/community\.crypto/pull/693)\)\. @@ -234,12 +275,12 @@ Feature release\. ## v2\.16\.2 - + ### Release Summary Bugfix release\. - + ### Bugfixes * acme\_\* modules \- directly react on bad return data for account creation/retrieval/updating requests \([https\://github\.com/ansible\-collections/community\.crypto/pull/682](https\://github\.com/ansible\-collections/community\.crypto/pull/682)\)\. @@ -250,12 +291,12 @@ Bugfix release\. ## v2\.16\.1 - + ### Release Summary Bugfix release\. - + ### Bugfixes * acme\_\* modules \- also retry requests in case of socket errors\, bad status lines\, and unknown connection errors\; improve error messages in these cases \([https\://github\.com/ansible\-collections/community\.crypto/issues/680](https\://github\.com/ansible\-collections/community\.crypto/issues/680)\)\. @@ -263,17 +304,17 @@ Bugfix release\. ## v2\.16\.0 - + ### Release Summary Bugfix release\. - + ### Minor Changes * luks\_devices \- add new options keyslot\, new\_keyslot\, and remove\_keyslot to allow adding/removing keys to/from specific keyslots \([https\://github\.com/ansible\-collections/community\.crypto/pull/664](https\://github\.com/ansible\-collections/community\.crypto/pull/664)\)\. - + ### Bugfixes * openssl\_pkcs12 \- modify autodetect to not detect pyOpenSSL \>\= 23\.3\.0\, which removed PKCS\#12 support \([https\://github\.com/ansible\-collections/community\.crypto/pull/666](https\://github\.com/ansible\-collections/community\.crypto/pull/666)\)\. @@ -281,12 +322,12 @@ Bugfix release\. ## v2\.15\.1 - + ### Release Summary Bugfix release\. - + ### Bugfixes * acme\_\* modules \- correctly handle error documents without type \([https\://github\.com/ansible\-collections/community\.crypto/issues/651](https\://github\.com/ansible\-collections/community\.crypto/issues/651)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/652](https\://github\.com/ansible\-collections/community\.crypto/pull/652)\)\. @@ -294,31 +335,31 @@ Bugfix release\. ## v2\.15\.0 - + ### Release Summary Bugfix and feature release\. - + ### Minor Changes * openssh\_keypair \- fail when comment cannot be updated \([https\://github\.com/ansible\-collections/community\.crypto/pull/646](https\://github\.com/ansible\-collections/community\.crypto/pull/646)\)\. - + ### Deprecated Features * get\_certificate \- the default false of the asn1\_base64 option is deprecated and will change to true in community\.crypto 3\.0\.0 \([https\://github\.com/ansible\-collections/community\.crypto/pull/600](https\://github\.com/ansible\-collections/community\.crypto/pull/600)\)\. - + ### Bugfixes * openssh\_cert\, openssh\_keypair \- the modules ignored return codes of ssh and ssh\-keygen in some cases \([https\://github\.com/ansible\-collections/community\.crypto/issues/645](https\://github\.com/ansible\-collections/community\.crypto/issues/645)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/646](https\://github\.com/ansible\-collections/community\.crypto/pull/646)\)\. * openssh\_keypair \- fix comment updating for OpenSSH before 6\.5 \([https\://github\.com/ansible\-collections/community\.crypto/pull/646](https\://github\.com/ansible\-collections/community\.crypto/pull/646)\)\. - + ### New Plugins - + #### Filter * gpg\_fingerprint \- Retrieve a GPG fingerprint from a GPG public or private key @@ -331,7 +372,7 @@ Bugfix and feature release\. ## v2\.14\.1 - + ### Release Summary Bugfix and maintenance release with updated documentation\. @@ -344,7 +385,7 @@ ansible\-core 2\.15 or later to see it as it is intended\. Alternatively you can look at [the devel docsite](https\://docs\.ansible\.com/ansible/devel/collections/community/crypto/) for the rendered HTML version of the documentation of the latest release\. - + ### Bugfixes * Fix PEM detection/identification to also accept random other lines before the line starting with \-\-\-\-\-BEGIN \([https\://github\.com/ansible\-collections/community\.crypto/issues/627](https\://github\.com/ansible\-collections/community\.crypto/issues/627)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/628](https\://github\.com/ansible\-collections/community\.crypto/pull/628)\)\. @@ -357,12 +398,12 @@ for the rendered HTML version of the documentation of the latest release\. ## v2\.14\.0 - + ### Release Summary Feature release\. - + ### Minor Changes * acme\_certificate \- allow to use no challenge by providing no challenge for the challenge option\. This is needed for ACME servers where validation is done without challenges \([https\://github\.com/ansible\-collections/community\.crypto/issues/613](https\://github\.com/ansible\-collections/community\.crypto/issues/613)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/615](https\://github\.com/ansible\-collections/community\.crypto/pull/615)\)\. @@ -372,12 +413,12 @@ Feature release\. ## v2\.13\.1 - + ### Release Summary Bugfix release\. - + ### Bugfixes * execution environment definition \- fix installation of python3\-pyOpenSSL package on CentOS and RHEL \([https\://github\.com/ansible\-collections/community\.crypto/pull/606](https\://github\.com/ansible\-collections/community\.crypto/pull/606)\)\. @@ -386,22 +427,22 @@ Bugfix release\. ## v2\.13\.0 - + ### Release Summary Bugfix and maintenance release\. - + ### Minor Changes * x509\_crl \- the crl\_mode option has been added to replace the existing mode option \([https\://github\.com/ansible\-collections/community\.crypto/issues/596](https\://github\.com/ansible\-collections/community\.crypto/issues/596)\)\. - + ### Deprecated Features * x509\_crl \- the mode option is deprecated\; use crl\_mode instead\. The mode option will change its meaning in community\.crypto 3\.0\.0\, and will refer to the CRL file\'s mode instead \([https\://github\.com/ansible\-collections/community\.crypto/issues/596](https\://github\.com/ansible\-collections/community\.crypto/issues/596)\)\. - + ### Bugfixes * openssh\_keypair \- always generate a new key pair if the private key does not exist\. Previously\, the module would fail when regenerate\=fail without an existing key\, contradicting the documentation \([https\://github\.com/ansible\-collections/community\.crypto/pull/598](https\://github\.com/ansible\-collections/community\.crypto/pull/598)\)\. @@ -410,12 +451,12 @@ Bugfix and maintenance release\. ## v2\.12\.0 - + ### Release Summary Feature release\. - + ### Minor Changes * get\_certificate \- add asn1\_base64 option to control whether the ASN\.1 included in the extensions return value is binary data or Base64 encoded \([https\://github\.com/ansible\-collections/community\.crypto/pull/592](https\://github\.com/ansible\-collections/community\.crypto/pull/592)\)\. @@ -423,7 +464,7 @@ Feature release\. ## v2\.11\.1 - + ### Release Summary Maintenance release with improved documentation\. @@ -431,17 +472,17 @@ Maintenance release with improved documentation\. ## v2\.11\.0 - + ### Release Summary Feature and bugfix release\. - + ### Minor Changes * get\_certificate \- adds ciphers option for custom cipher selection \([https\://github\.com/ansible\-collections/community\.crypto/pull/571](https\://github\.com/ansible\-collections/community\.crypto/pull/571)\)\. - + ### Bugfixes * action plugin helper \- fix handling of deprecations for ansible\-core 2\.14\.2 \([https\://github\.com/ansible\-collections/community\.crypto/pull/572](https\://github\.com/ansible\-collections/community\.crypto/pull/572)\)\. @@ -451,21 +492,21 @@ Feature and bugfix release\. ## v2\.10\.0 - + ### Release Summary Bugfix and feature release\. - + ### Bugfixes * openssl\_csr\, openssl\_csr\_pipe \- prevent invalid values for crl\_distribution\_points that do not have one of full\_name\, relative\_name\, and crl\_issuer \([https\://github\.com/ansible\-collections/community\.crypto/pull/560](https\://github\.com/ansible\-collections/community\.crypto/pull/560)\)\. * openssl\_publickey\_info \- do not crash with internal error when public key cannot be parsed \([https\://github\.com/ansible\-collections/community\.crypto/pull/551](https\://github\.com/ansible\-collections/community\.crypto/pull/551)\)\. - + ### New Plugins - + #### Filter * openssl\_csr\_info \- Retrieve information from OpenSSL Certificate Signing Requests \(CSR\) @@ -478,12 +519,12 @@ Bugfix and feature release\. ## v2\.9\.0 - + ### Release Summary Regular feature release\. - + ### Minor Changes * x509\_certificate\_info \- adds issuer\_uri field in return value based on Authority Information Access data \([https\://github\.com/ansible\-collections/community\.crypto/pull/530](https\://github\.com/ansible\-collections/community\.crypto/pull/530)\)\. @@ -491,7 +532,7 @@ Regular feature release\. ## v2\.8\.1 - + ### Release Summary Maintenance release with improved documentation\. @@ -499,12 +540,12 @@ Maintenance release with improved documentation\. ## v2\.8\.0 - + ### Release Summary Feature release\. - + ### Minor Changes * acme\_\* modules \- handle more gracefully if CA\'s new nonce call does not return a nonce \([https\://github\.com/ansible\-collections/community\.crypto/pull/525](https\://github\.com/ansible\-collections/community\.crypto/pull/525)\)\. @@ -514,12 +555,12 @@ Feature release\. ## v2\.7\.1 - + ### Release Summary Maintenance release\. - + ### Bugfixes * acme\_\* modules \- improve feedback when importing cryptography does not work \([https\://github\.com/ansible\-collections/community\.crypto/issues/518](https\://github\.com/ansible\-collections/community\.crypto/issues/518)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/519](https\://github\.com/ansible\-collections/community\.crypto/pull/519)\)\. @@ -527,24 +568,6 @@ Maintenance release\. ## v2\.7\.0 - -### Release Summary - -Feature release\. - - -### Minor Changes - -* acme\* modules \- also support the HTTP 503 Service Unavailable and 408 Request Timeout response status for automatic retries \([https\://github\.com/ansible\-collections/community\.crypto/pull/513](https\://github\.com/ansible\-collections/community\.crypto/pull/513)\)\. - - -### Bugfixes - -* openssl\_privatekey\_pipe \- ensure compatibility with newer versions of ansible\-core \([https\://github\.com/ansible\-collections/community\.crypto/pull/515](https\://github\.com/ansible\-collections/community\.crypto/pull/515)\)\. - - -## v2\.6\.0 - ### Release Summary @@ -553,18 +576,36 @@ Feature release\. ### Minor Changes +* acme\* modules \- also support the HTTP 503 Service Unavailable and 408 Request Timeout response status for automatic retries \([https\://github\.com/ansible\-collections/community\.crypto/pull/513](https\://github\.com/ansible\-collections/community\.crypto/pull/513)\)\. + + +### Bugfixes + +* openssl\_privatekey\_pipe \- ensure compatibility with newer versions of ansible\-core \([https\://github\.com/ansible\-collections/community\.crypto/pull/515](https\://github\.com/ansible\-collections/community\.crypto/pull/515)\)\. + + +## v2\.6\.0 + + +### Release Summary + +Feature release\. + + +### Minor Changes + * acme\* modules \- support the HTTP 429 Too Many Requests response status \([https\://github\.com/ansible\-collections/community\.crypto/pull/508](https\://github\.com/ansible\-collections/community\.crypto/pull/508)\)\. * openssh\_keypair \- added pkcs1\, pkcs8\, and ssh to the available choices for the private\_key\_format option \([https\://github\.com/ansible\-collections/community\.crypto/pull/511](https\://github\.com/ansible\-collections/community\.crypto/pull/511)\)\. ## v2\.5\.0 - + ### Release Summary Maintenance release with improved licensing declaration and documentation fixes\. - + ### Minor Changes * All software licenses are now in the LICENSES/ directory of the collection root\. Moreover\, SPDX\-License\-Identifier\: is used to declare the applicable license for every file that is not automatically generated \([https\://github\.com/ansible\-collections/community\.crypto/pull/491](https\://github\.com/ansible\-collections/community\.crypto/pull/491)\)\. @@ -572,17 +613,17 @@ Maintenance release with improved licensing declaration and documentation fixes\ ## v2\.4\.0 - + ### Release Summary Deprecation and bugfix release\. No new features this time\. - + ### Deprecated Features * Support for Ansible 2\.9 and ansible\-base 2\.10 is deprecated\, and will be removed in the next major release \(community\.crypto 3\.0\.0\)\. Some modules might still work with these versions afterwards\, but we will no longer keep compatibility code that was needed to support them \([https\://github\.com/ansible\-collections/community\.crypto/pull/460](https\://github\.com/ansible\-collections/community\.crypto/pull/460)\)\. - + ### Bugfixes * openssl\_pkcs12 \- when using the pyOpenSSL backend\, do not crash when trying to read non\-existing other certificates \([https\://github\.com/ansible\-collections/community\.crypto/issues/486](https\://github\.com/ansible\-collections/community\.crypto/issues/486)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/487](https\://github\.com/ansible\-collections/community\.crypto/pull/487)\)\. @@ -590,7 +631,7 @@ Deprecation and bugfix release\. No new features this time\. ## v2\.3\.4 - + ### Release Summary Re\-release of what was intended to be 2\.3\.3\. @@ -606,12 +647,12 @@ has been added\. ## v2\.3\.3 - + ### Release Summary Bugfix release\. - + ### Bugfixes * Include Apache\-2\.0\.txt file for plugins/module\_utils/crypto/\_obj2txt\.py and plugins/module\_utils/crypto/\_objects\_data\.py\. @@ -621,12 +662,12 @@ Bugfix release\. ## v2\.3\.2 - + ### Release Summary Maintenance and bugfix release\. - + ### Bugfixes * Include simplified\_bsd\.txt license file for the ECS module utils\. @@ -635,12 +676,12 @@ Maintenance and bugfix release\. ## v2\.3\.1 - + ### Release Summary Maintenance release\. - + ### Bugfixes * Include PSF\-license\.txt file for plugins/module\_utils/\_version\.py\. @@ -648,12 +689,12 @@ Maintenance release\. ## v2\.3\.0 - + ### Release Summary Feature and bugfix release\. - + ### Minor Changes * Prepare collection for inclusion in an Execution Environment by declaring its dependencies\. Please note that system packages are used for cryptography and PyOpenSSL\, which can be rather limited\. If you need features from newer cryptography versions\, you will have to manually force a newer version to be installed by pip by specifying something like cryptography \>\= 37\.0\.0 in your Execution Environment\'s Python dependencies file \([https\://github\.com/ansible\-collections/community\.crypto/pull/440](https\://github\.com/ansible\-collections/community\.crypto/pull/440)\)\. @@ -667,7 +708,7 @@ Feature and bugfix release\. * x509\_crl \- add name\_encoding option to control the encoding \(IDNA\, Unicode\) used to return domain names in general names \([https\://github\.com/ansible\-collections/community\.crypto/pull/436](https\://github\.com/ansible\-collections/community\.crypto/pull/436)\)\. * x509\_crl\_info \- add name\_encoding option to control the encoding \(IDNA\, Unicode\) used to return domain names in general names \([https\://github\.com/ansible\-collections/community\.crypto/pull/436](https\://github\.com/ansible\-collections/community\.crypto/pull/436)\)\. - + ### Bugfixes * Make collection more robust when PyOpenSSL is used with an incompatible cryptography version \([https\://github\.com/ansible\-collections/community\.crypto/pull/445](https\://github\.com/ansible\-collections/community\.crypto/pull/445)\)\. @@ -676,12 +717,12 @@ Feature and bugfix release\. ## v2\.2\.4 - + ### Release Summary Regular maintenance release\. - + ### Bugfixes * openssh\_\* modules \- fix exception handling to report traceback to users for enhanced traceability \([https\://github\.com/ansible\-collections/community\.crypto/pull/417](https\://github\.com/ansible\-collections/community\.crypto/pull/417)\)\. @@ -689,12 +730,12 @@ Regular maintenance release\. ## v2\.2\.3 - + ### Release Summary Regular bugfix release\. - + ### Bugfixes * luks\_device \- fix parsing of lsblk output when device name ends with crypt \([https\://github\.com/ansible\-collections/community\.crypto/issues/409](https\://github\.com/ansible\-collections/community\.crypto/issues/409)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/410](https\://github\.com/ansible\-collections/community\.crypto/pull/410)\)\. @@ -702,14 +743,14 @@ Regular bugfix release\. ## v2\.2\.2 - + ### Release Summary Regular bugfix release\. In this release\, we extended the test matrix to include Alpine 3\, ArchLinux\, Debian Bullseye\, and CentOS Stream 8\. CentOS 8 was removed from the test matrix\. - + ### Bugfixes * certificate\_complete\_chain \- allow multiple potential intermediate certificates to have the same subject \([https\://github\.com/ansible\-collections/community\.crypto/issues/399](https\://github\.com/ansible\-collections/community\.crypto/issues/399)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/403](https\://github\.com/ansible\-collections/community\.crypto/pull/403)\)\. @@ -721,12 +762,12 @@ In this release\, we extended the test matrix to include Alpine 3\, ArchLinux\, ## v2\.2\.1 - + ### Release Summary Bugfix release\. - + ### Bugfixes * openssh\_cert \- fixed false changed status for host certificates when using full\_idempotence \([https\://github\.com/ansible\-collections/community\.crypto/issues/395](https\://github\.com/ansible\-collections/community\.crypto/issues/395)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/396](https\://github\.com/ansible\-collections/community\.crypto/pull/396)\)\. @@ -734,17 +775,17 @@ Bugfix release\. ## v2\.2\.0 - + ### Release Summary Regular bugfix and feature release\. - + ### Minor Changes * openssh\_cert \- added ignore\_timestamps parameter so it can be used semi\-idempotent with relative timestamps in valid\_to/valid\_from \([https\://github\.com/ansible\-collections/community\.crypto/issues/379](https\://github\.com/ansible\-collections/community\.crypto/issues/379)\)\. - + ### Bugfixes * luks\_devices \- set LANG and similar environment variables to avoid translated output\, which can break some of the module\'s functionality like key management \([https\://github\.com/ansible\-collections/community\.crypto/pull/388](https\://github\.com/ansible\-collections/community\.crypto/pull/388)\, [https\://github\.com/ansible\-collections/community\.crypto/issues/385](https\://github\.com/ansible\-collections/community\.crypto/issues/385)\)\. @@ -752,17 +793,17 @@ Regular bugfix and feature release\. ## v2\.1\.0 - + ### Release Summary Feature and bugfix release\. - + ### Minor Changes * Adjust error messages that indicate cryptography is not installed from Can\'t to Cannot \([https\://github\.com/ansible\-collections/community\.crypto/pull/374](https\://github\.com/ansible\-collections/community\.crypto/pull/374)\)\. - + ### Bugfixes * Various modules and plugins \- use vendored version of distutils\.version instead of the deprecated Python standard library distutils \([https\://github\.com/ansible\-collections/community\.crypto/pull/353](https\://github\.com/ansible\-collections/community\.crypto/pull/353)\)\. @@ -778,7 +819,7 @@ Feature and bugfix release\. ## v2\.0\.2 - + ### Release Summary Documentation fix release\. No actual code changes\. @@ -786,17 +827,17 @@ Documentation fix release\. No actual code changes\. ## v2\.0\.1 - + ### Release Summary Bugfix release with extra forward compatibility for newer versions of cryptography\. - + ### Minor Changes * acme\_\* modules \- fix usage of fetch\_url with changes in latest ansible\-core devel branch \([https\://github\.com/ansible\-collections/community\.crypto/pull/339](https\://github\.com/ansible\-collections/community\.crypto/pull/339)\)\. - + ### Bugfixes * acme\_certificate \- avoid passing multiple certificates to cryptography\'s X\.509 certificate loader when fullchain\_dest is used \([https\://github\.com/ansible\-collections/community\.crypto/pull/324](https\://github\.com/ansible\-collections/community\.crypto/pull/324)\)\. @@ -807,12 +848,12 @@ Bugfix release with extra forward compatibility for newer versions of cryptograp ## v2\.0\.0 - + ### Release Summary A new major release of the community\.crypto collection\. The main changes are removal of the PyOpenSSL backends for almost all modules \(openssl\_pkcs12 being the only exception\)\, and removal of the assertonly provider in the x509\_certificate provider\. There are also some other breaking changes which should improve the user interface/experience of this collection long\-term\. - + ### Minor Changes * acme\_certificate \- the subject and issuer fields in in the select\_chain entries are now more strictly validated \([https\://github\.com/ansible\-collections/community\.crypto/pull/316](https\://github\.com/ansible\-collections/community\.crypto/pull/316)\)\. @@ -837,7 +878,7 @@ A new major release of the community\.crypto collection\. The main * openssl\_privatekey\_info \- by default consistency checks are not run\; they need to be explicitly requested by passing check\_consistency\=true \([https\://github\.com/ansible\-collections/community\.crypto/pull/309](https\://github\.com/ansible\-collections/community\.crypto/pull/309)\)\. * x509\_crl \- for idempotency checks\, the issuer order is ignored\. If order is important\, use the new issuer\_ordered option \([https\://github\.com/ansible\-collections/community\.crypto/pull/316](https\://github\.com/ansible\-collections/community\.crypto/pull/316)\)\. - + ### Deprecated Features * acme\_\* modules \- ACME version 1 is now deprecated and support for it will be removed in community\.crypto 2\.0\.0 \([https\://github\.com/ansible\-collections/community\.crypto/pull/288](https\://github\.com/ansible\-collections/community\.crypto/pull/288)\)\. @@ -869,7 +910,7 @@ A new major release of the community\.crypto collection\. The main * x509\_certificate\_info \- removed the pyopenssl backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. * x509\_certificate\_pipe \- removed the pyopenssl backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\. - + ### Bugfixes * cryptography backend \- improve Unicode handling for Python 2 \([https\://github\.com/ansible\-collections/community\.crypto/pull/313](https\://github\.com/ansible\-collections/community\.crypto/pull/313)\)\. @@ -881,20 +922,6 @@ A new major release of the community\.crypto collection\. The main ## v1\.9\.4 - -### Release Summary - -Regular bugfix release\. - - -### Bugfixes - -* acme\_\* modules \- fix commands composed for OpenSSL backend to retrieve information on CSRs and certificates from stdin to use /dev/stdin instead of \-\. This is needed for OpenSSL 1\.0\.1 and 1\.0\.2\, apparently \([https\://github\.com/ansible\-collections/community\.crypto/pull/279](https\://github\.com/ansible\-collections/community\.crypto/pull/279)\)\. -* acme\_challenge\_cert\_helper \- only return exception when cryptography is not installed\, not when a too old version of it is installed\. This prevents Ansible\'s callback to crash \([https\://github\.com/ansible\-collections/community\.crypto/pull/281](https\://github\.com/ansible\-collections/community\.crypto/pull/281)\)\. - - -## v1\.9\.3 - ### Release Summary @@ -903,12 +930,26 @@ Regular bugfix release\. ### Bugfixes +* acme\_\* modules \- fix commands composed for OpenSSL backend to retrieve information on CSRs and certificates from stdin to use /dev/stdin instead of \-\. This is needed for OpenSSL 1\.0\.1 and 1\.0\.2\, apparently \([https\://github\.com/ansible\-collections/community\.crypto/pull/279](https\://github\.com/ansible\-collections/community\.crypto/pull/279)\)\. +* acme\_challenge\_cert\_helper \- only return exception when cryptography is not installed\, not when a too old version of it is installed\. This prevents Ansible\'s callback to crash \([https\://github\.com/ansible\-collections/community\.crypto/pull/281](https\://github\.com/ansible\-collections/community\.crypto/pull/281)\)\. + + +## v1\.9\.3 + + +### Release Summary + +Regular bugfix release\. + + +### Bugfixes + * openssl\_csr and openssl\_csr\_pipe \- make sure that Unicode strings are used to compare strings with the cryptography backend\. This fixes idempotency problems with non\-ASCII letters on Python 2 \([https\://github\.com/ansible\-collections/community\.crypto/issues/270](https\://github\.com/ansible\-collections/community\.crypto/issues/270)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/271](https\://github\.com/ansible\-collections/community\.crypto/pull/271)\)\. ## v1\.9\.2 - + ### Release Summary Bugfix release to fix the changelog\. No other change compared to 1\.9\.0\. @@ -916,7 +957,7 @@ Bugfix release to fix the changelog\. No other change compared to 1\.9\.0\. ## v1\.9\.1 - + ### Release Summary Accidental 1\.9\.1 release\. Identical to 1\.9\.0\. @@ -924,18 +965,18 @@ Accidental 1\.9\.1 release\. Identical to 1\.9\.0\. ## v1\.9\.0 - + ### Release Summary Regular feature release\. - + ### Minor Changes * get\_certificate \- added starttls option to retrieve certificates from servers which require clients to request an encrypted connection \([https\://github\.com/ansible\-collections/community\.crypto/pull/264](https\://github\.com/ansible\-collections/community\.crypto/pull/264)\)\. * openssh\_keypair \- added diff support \([https\://github\.com/ansible\-collections/community\.crypto/pull/260](https\://github\.com/ansible\-collections/community\.crypto/pull/260)\)\. - + ### Bugfixes * keypair\_backend module utils \- simplify code to pass sanity tests \([https\://github\.com/ansible\-collections/community\.crypto/pull/263](https\://github\.com/ansible\-collections/community\.crypto/pull/263)\)\. @@ -946,12 +987,12 @@ Regular feature release\. ## v1\.8\.0 - + ### Release Summary Regular bugfix and feature release\. - + ### Minor Changes * Avoid internal ansible\-core module\_utils in favor of equivalent public API available since at least Ansible 2\.9 \([https\://github\.com/ansible\-collections/community\.crypto/pull/253](https\://github\.com/ansible\-collections/community\.crypto/pull/253)\)\. @@ -959,7 +1000,7 @@ Regular bugfix and feature release\. * openssh\_cert \- added regenerate option to validate additional certificate parameters which trigger regeneration of an existing certificate \([https\://github\.com/ansible\-collections/community\.crypto/pull/256](https\://github\.com/ansible\-collections/community\.crypto/pull/256)\)\. * openssh\_cert \- adding diff support \([https\://github\.com/ansible\-collections/community\.crypto/pull/255](https\://github\.com/ansible\-collections/community\.crypto/pull/255)\)\. - + ### Bugfixes * openssh\_cert \- fixed certificate generation to restore original certificate if an error is encountered \([https\://github\.com/ansible\-collections/community\.crypto/pull/255](https\://github\.com/ansible\-collections/community\.crypto/pull/255)\)\. @@ -968,12 +1009,12 @@ Regular bugfix and feature release\. ## v1\.7\.1 - + ### Release Summary Bugfix release\. - + ### Bugfixes * openssl\_pkcs12 \- fix crash when loading passphrase\-protected PKCS\#12 files with cryptography backend \([https\://github\.com/ansible\-collections/community\.crypto/issues/247](https\://github\.com/ansible\-collections/community\.crypto/issues/247)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/248](https\://github\.com/ansible\-collections/community\.crypto/pull/248)\)\. @@ -981,12 +1022,12 @@ Bugfix release\. ## v1\.7\.0 - + ### Release Summary Regular feature and bugfix release\. - + ### Minor Changes * cryptography\_openssh module utils \- new module\_utils for managing asymmetric keypairs and OpenSSH formatted/encoded asymmetric keypairs \([https\://github\.com/ansible\-collections/community\.crypto/pull/213](https\://github\.com/ansible\-collections/community\.crypto/pull/213)\)\. @@ -1009,7 +1050,7 @@ Regular feature and bugfix release\. * x509\_crl\_info \- add list\_revoked\_certificates option to avoid enumerating all revoked certificates \([https\://github\.com/ansible\-collections/community\.crypto/pull/232](https\://github\.com/ansible\-collections/community\.crypto/pull/232)\)\. * x509\_crl\_info \- refactor module to allow code reuse for diff mode \([https\://github\.com/ansible\-collections/community\.crypto/pull/203](https\://github\.com/ansible\-collections/community\.crypto/pull/203)\)\. - + ### Bugfixes * openssh\_keypair \- fix check\_mode to populate return values for existing keypairs \([https\://github\.com/ansible\-collections/community\.crypto/issues/113](https\://github\.com/ansible\-collections/community\.crypto/issues/113)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/230](https\://github\.com/ansible\-collections/community\.crypto/pull/230)\)\. @@ -1024,12 +1065,12 @@ Regular feature and bugfix release\. ## v1\.6\.2 - + ### Release Summary Bugfix release\. Fixes compatibility issue of ACME modules with step\-ca\. - + ### Bugfixes * acme\_\* modules \- avoid crashing for ACME servers where the meta directory key is not present \([https\://github\.com/ansible\-collections/community\.crypto/issues/220](https\://github\.com/ansible\-collections/community\.crypto/issues/220)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/221](https\://github\.com/ansible\-collections/community\.crypto/pull/221)\)\. @@ -1037,12 +1078,12 @@ Bugfix release\. Fixes compatibility issue of ACME modules with step\-ca\. ## v1\.6\.1 - + ### Release Summary Bugfix release\. - + ### Bugfixes * acme\_\* modules \- fix wrong usages of ACMEProtocolException \([https\://github\.com/ansible\-collections/community\.crypto/pull/216](https\://github\.com/ansible\-collections/community\.crypto/pull/216)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/217](https\://github\.com/ansible\-collections/community\.crypto/pull/217)\)\. @@ -1050,12 +1091,12 @@ Bugfix release\. ## v1\.6\.0 - + ### Release Summary Fixes compatibility issues with the latest ansible\-core 2\.11 beta\, and contains a lot of internal refactoring for the ACME modules and support for private key passphrases for them\. - + ### Minor Changes * acme module\_utils \- the acme module\_utils has been split up into several Python modules \([https\://github\.com/ansible\-collections/community\.crypto/pull/184](https\://github\.com/ansible\-collections/community\.crypto/pull/184)\)\. @@ -1064,12 +1105,12 @@ Fixes compatibility issues with the latest ansible\-core 2\.11 beta\, and contai * acme\_certificate\_revoke \- support revoking by private keys that are passphrase protected for cryptography backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/207](https\://github\.com/ansible\-collections/community\.crypto/pull/207)\)\. * acme\_challenge\_cert\_helper \- add private\_key\_passphrase parameter \([https\://github\.com/ansible\-collections/community\.crypto/pull/207](https\://github\.com/ansible\-collections/community\.crypto/pull/207)\)\. - + ### Deprecated Features * acme module\_utils \- the acme module\_utils \(ansible\_collections\.community\.crypto\.plugins\.module\_utils\.acme\) is deprecated and will be removed in community\.crypto 2\.0\.0\. Use the new Python modules in the acme package instead \(ansible\_collections\.community\.crypto\.plugins\.module\_utils\.acme\.xxx\) \([https\://github\.com/ansible\-collections/community\.crypto/pull/184](https\://github\.com/ansible\-collections/community\.crypto/pull/184)\)\. - + ### Bugfixes * action\_module plugin helper \- make compatible with latest changes in ansible\-core 2\.11\.0b3 \([https\://github\.com/ansible\-collections/community\.crypto/pull/202](https\://github\.com/ansible\-collections/community\.crypto/pull/202)\)\. @@ -1078,23 +1119,23 @@ Fixes compatibility issues with the latest ansible\-core 2\.11 beta\, and contai ## v1\.5\.0 - + ### Release Summary Regular feature and bugfix release\. Deprecates a return value\. - + ### Minor Changes * acme\_account\_info \- when retrieve\_orders is not ignore and the ACME server allows to query orders\, the new return value order\_uris is always populated with a list of URIs \([https\://github\.com/ansible\-collections/community\.crypto/pull/178](https\://github\.com/ansible\-collections/community\.crypto/pull/178)\)\. * luks\_device \- allow to specify sector size for LUKS2 containers with new sector\_size parameter \([https\://github\.com/ansible\-collections/community\.crypto/pull/193](https\://github\.com/ansible\-collections/community\.crypto/pull/193)\)\. - + ### Deprecated Features * acme\_account\_info \- when retrieve\_orders\=url\_list\, orders will no longer be returned in community\.crypto 2\.0\.0\. Use order\_uris instead \([https\://github\.com/ansible\-collections/community\.crypto/pull/178](https\://github\.com/ansible\-collections/community\.crypto/pull/178)\)\. - + ### Bugfixes * openssl\_csr \- no longer fails when comparing CSR without basic constraint when basic\_constraints is specified \([https\://github\.com/ansible\-collections/community\.crypto/issues/179](https\://github\.com/ansible\-collections/community\.crypto/issues/179)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/180](https\://github\.com/ansible\-collections/community\.crypto/pull/180)\)\. @@ -1102,12 +1143,12 @@ Regular feature and bugfix release\. Deprecates a return value\. ## v1\.4\.0 - + ### Release Summary Release with several new features and bugfixes\. - + ### Minor Changes * The ACME module\_utils has been relicensed back from the Simplified BSD License \([https\://opensource\.org/licenses/BSD\-2\-Clause](https\://opensource\.org/licenses/BSD\-2\-Clause)\) to the GPLv3\+ \(same license used by most other code in this collection\)\. This undoes a licensing change when the original GPLv3\+ licensed code was moved to module\_utils in [https\://github\.com/ansible/ansible/pull/40697](https\://github\.com/ansible/ansible/pull/40697) \([https\://github\.com/ansible\-collections/community\.crypto/pull/165](https\://github\.com/ansible\-collections/community\.crypto/pull/165)\)\. @@ -1117,7 +1158,7 @@ Release with several new features and bugfixes\. * openssl\_csr\, openssl\_csr\_pipe \- allow to specify CRL distribution endpoints with crl\_distribution\_points \([https\://github\.com/ansible\-collections/community\.crypto/issues/147](https\://github\.com/ansible\-collections/community\.crypto/issues/147)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/167](https\://github\.com/ansible\-collections/community\.crypto/pull/167)\)\. * openssl\_pkcs12 \- allow to specify certificate bundles in other\_certificates by using new option other\_certificates\_parse\_all \([https\://github\.com/ansible\-collections/community\.crypto/issues/149](https\://github\.com/ansible\-collections/community\.crypto/issues/149)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/166](https\://github\.com/ansible\-collections/community\.crypto/pull/166)\)\. - + ### Bugfixes * acme\_certificate \- error when requested challenge type is not found for non\-valid challenges\, instead of hanging on step 2 \([https\://github\.com/ansible\-collections/community\.crypto/issues/171](https\://github\.com/ansible\-collections/community\.crypto/issues/171)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/173](https\://github\.com/ansible\-collections/community\.crypto/pull/173)\)\. @@ -1125,12 +1166,12 @@ Release with several new features and bugfixes\. ## v1\.3\.0 - + ### Release Summary Contains new modules openssl\_privatekey\_pipe\, openssl\_csr\_pipe and x509\_certificate\_pipe which allow to create or update private keys\, CSRs and X\.509 certificates without having to write them to disk\. - + ### Minor Changes * openssh\_cert \- add module parameter use\_agent to enable using signing keys stored in ssh\-agent \([https\://github\.com/ansible\-collections/community\.crypto/issues/116](https\://github\.com/ansible\-collections/community\.crypto/issues/116)\)\. @@ -1140,7 +1181,7 @@ Contains new modules openssl\_privatekey\_pipe\, openssl\_csr * x509\_certificate \- for the selfsigned provider\, a CSR is not required anymore\. If no CSR is provided\, the module behaves as if a minimal CSR which only contains the public key has been provided \([https\://github\.com/ansible\-collections/community\.crypto/issues/32](https\://github\.com/ansible\-collections/community\.crypto/issues/32)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/129](https\://github\.com/ansible\-collections/community\.crypto/pull/129)\)\. * x509\_certificate \- refactor module to allow code reuse by x509\_certificate\_pipe \([https\://github\.com/ansible\-collections/community\.crypto/pull/135](https\://github\.com/ansible\-collections/community\.crypto/pull/135)\)\. - + ### Bugfixes * openssl\_pkcs12 \- report the correct state when action is parse \([https\://github\.com/ansible\-collections/community\.crypto/issues/143](https\://github\.com/ansible\-collections/community\.crypto/issues/143)\)\. @@ -1157,12 +1198,12 @@ Contains new modules openssl\_privatekey\_pipe\, openssl\_csr ## v1\.2\.0 - + ### Release Summary Please note that this release fixes a security issue \(CVE\-2020\-25646\)\. - + ### Minor Changes * acme\_certificate \- allow to pass CSR file as content with new option csr\_content \([https\://github\.com/ansible\-collections/community\.crypto/pull/115](https\://github\.com/ansible\-collections/community\.crypto/pull/115)\)\. @@ -1178,7 +1219,7 @@ Please note that this release fixes a security issue \(CVE\-2020\-25646\)\. * x509\_certificate \- the options privatekey\_content and ownca\_privatekey\_content were not marked as no\_log\, resulting in it being dumped into the system log by default\, and returned in the registered results in the invocation field \(CVE\-2020\-25646\, [https\://github\.com/ansible\-collections/community\.crypto/pull/125](https\://github\.com/ansible\-collections/community\.crypto/pull/125)\)\. * x509\_crl \- the option privatekey\_content was not marked as no\_log\, resulting in it being dumped into the system log by default\, and returned in the registered results in the invocation field \(CVE\-2020\-25646\, [https\://github\.com/ansible\-collections/community\.crypto/pull/125](https\://github\.com/ansible\-collections/community\.crypto/pull/125)\)\. - + ### Bugfixes * openssl\_pkcs12 \- do not crash when reading PKCS\#12 file which has no private key and/or no main certificate \([https\://github\.com/ansible\-collections/community\.crypto/issues/103](https\://github\.com/ansible\-collections/community\.crypto/issues/103)\)\. @@ -1186,12 +1227,12 @@ Please note that this release fixes a security issue \(CVE\-2020\-25646\)\. ## v1\.1\.1 - + ### Release Summary Bugfixes for Ansible 2\.10\.0\. - + ### Bugfixes * meta/runtime\.yml \- convert Ansible version numbers for old names of modules to collection version numbers \([https\://github\.com/ansible\-collections/community\.crypto/pull/108](https\://github\.com/ansible\-collections/community\.crypto/pull/108)\)\. @@ -1200,12 +1241,12 @@ Bugfixes for Ansible 2\.10\.0\. ## v1\.1\.0 - + ### Release Summary Release for Ansible 2\.10\.0\. - + ### Minor Changes * acme\_account \- add external\_account\_binding option to allow creation of ACME accounts with External Account Binding \([https\://github\.com/ansible\-collections/community\.crypto/issues/89](https\://github\.com/ansible\-collections/community\.crypto/issues/89)\)\. @@ -1218,7 +1259,7 @@ Release for Ansible 2\.10\.0\. * openssl\_csr \- add support for name constraints extension \([https\://github\.com/ansible\-collections/community\.crypto/issues/46](https\://github\.com/ansible\-collections/community\.crypto/issues/46)\)\. * openssl\_csr\_info \- add support for name constraints extension \([https\://github\.com/ansible\-collections/community\.crypto/issues/46](https\://github\.com/ansible\-collections/community\.crypto/issues/46)\)\. - + ### Bugfixes * acme\_inspect \- fix problem with Python 3\.5 that JSON was not decoded \([https\://github\.com/ansible\-collections/community\.crypto/issues/86](https\://github\.com/ansible\-collections/community\.crypto/issues/86)\)\. @@ -1234,12 +1275,12 @@ Release for Ansible 2\.10\.0\. ## v1\.0\.0 - + ### Release Summary This is the first proper release of the community\.crypto collection\. This changelog contains all changes to the modules in this collection that were added after the release of Ansible 2\.9\.0\. - + ### Minor Changes * luks\_device \- accept passphrase\, new\_passphrase and remove\_passphrase\. @@ -1268,7 +1309,7 @@ This is the first proper release of the community\.crypto collectio * openssl\_publickey \- allow to provide private key content via private\_key\_content option\. * openssl\_publickey \- allow to return the existing/generated public key directly as publickey by setting return\_content to yes\. - + ### Deprecated Features * openssl\_csr \- all values for the version option except 1 are deprecated\. The value 1 denotes the current only standardized CSR version\. @@ -1278,7 +1319,7 @@ This is the first proper release of the community\.crypto collectio * The letsencrypt module has been removed\. Use acme\_certificate instead\. - + ### Bugfixes * ACME modules\: fix bug in ACME v1 account update code diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 3a4a477f..32016971 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -4,6 +4,40 @@ Community Crypto Release Notes .. contents:: Topics +v2.18.0 +======= + +Release Summary +--------------- + +Bugfix and feature release. + +Minor Changes +------------- + +- x509_crl - the new option ``serial_numbers`` allow to configure in which format serial numbers can be provided to ``revoked_certificates[].serial_number``. The default is as integers (``serial_numbers=integer``) for backwards compatibility; setting ``serial_numbers=hex-octets`` allows to specify colon-separated hex octet strings like ``00:11:22:FF`` (https://github.com/ansible-collections/community.crypto/issues/687, https://github.com/ansible-collections/community.crypto/pull/715). + +Deprecated Features +------------------- + +- openssl_csr_pipe, openssl_privatekey_pipe, x509_certificate_pipe - the current behavior of check mode is deprecated and will change in community.crypto 3.0.0. The current behavior is similar to the modules without ``_pipe``: if the object needs to be (re-)generated, only the ``changed`` status is set, but the object is not updated. From community.crypto 3.0.0 on, the modules will ignore check mode and always act as if check mode is not active. This behavior can already achieved now by adding ``check_mode: false`` to the task. If you think this breaks your use-case of this module, please `create an issue in the community.crypto repository `__ (https://github.com/ansible-collections/community.crypto/issues/712, https://github.com/ansible-collections/community.crypto/pull/714). + +Bugfixes +-------- + +- luks_device - fixed module a bug that prevented using ``remove_keyslot`` with the value ``0`` (https://github.com/ansible-collections/community.crypto/pull/710). +- luks_device - fixed module falsely outputting ``changed=false`` when trying to add a new slot with a key that is already present in another slot. The module now rejects adding keys that are already present in another slot (https://github.com/ansible-collections/community.crypto/pull/710). +- luks_device - fixed testing of LUKS passphrases in when specifying a keyslot for cryptsetup version 2.0.3. The output of this cryptsetup version slightly differs from later versions (https://github.com/ansible-collections/community.crypto/pull/710). + +New Plugins +----------- + +Filter +~~~~~~ + +- parse_serial - Convert a serial number as a colon-separated list of hex numbers to an integer +- to_serial - Convert an integer to a colon-separated list of hex numbers + v2.17.1 ======= diff --git a/changelogs/changelog.yaml b/changelogs/changelog.yaml index 813bb8e2..044bd81a 100644 --- a/changelogs/changelog.yaml +++ b/changelogs/changelog.yaml @@ -1007,6 +1007,51 @@ releases: - 701-private_key_info-consistency.yml - 705-openssl_privatekey_info-consistency.yml release_date: '2024-01-27' + 2.18.0: + changes: + bugfixes: + - luks_device - fixed module a bug that prevented using ``remove_keyslot`` with + the value ``0`` (https://github.com/ansible-collections/community.crypto/pull/710). + - luks_device - fixed module falsely outputting ``changed=false`` when trying + to add a new slot with a key that is already present in another slot. The + module now rejects adding keys that are already present in another slot (https://github.com/ansible-collections/community.crypto/pull/710). + - luks_device - fixed testing of LUKS passphrases in when specifying a keyslot + for cryptsetup version 2.0.3. The output of this cryptsetup version slightly + differs from later versions (https://github.com/ansible-collections/community.crypto/pull/710). + deprecated_features: + - 'openssl_csr_pipe, openssl_privatekey_pipe, x509_certificate_pipe - the current + behavior of check mode is deprecated and will change in community.crypto 3.0.0. + The current behavior is similar to the modules without ``_pipe``: if the object + needs to be (re-)generated, only the ``changed`` status is set, but the object + is not updated. From community.crypto 3.0.0 on, the modules will ignore check + mode and always act as if check mode is not active. This behavior can already + achieved now by adding ``check_mode: false`` to the task. If you think this + breaks your use-case of this module, please `create an issue in the community.crypto + repository `__ + (https://github.com/ansible-collections/community.crypto/issues/712, https://github.com/ansible-collections/community.crypto/pull/714).' + minor_changes: + - x509_crl - the new option ``serial_numbers`` allow to configure in which format + serial numbers can be provided to ``revoked_certificates[].serial_number``. + The default is as integers (``serial_numbers=integer``) for backwards compatibility; + setting ``serial_numbers=hex-octets`` allows to specify colon-separated hex + octet strings like ``00:11:22:FF`` (https://github.com/ansible-collections/community.crypto/issues/687, + https://github.com/ansible-collections/community.crypto/pull/715). + release_summary: Bugfix and feature release. + fragments: + - 2.18.0.yml + - 710-luks_device-keyslot-fixes.yml + - 714-pipe-check-mode-deprecation.yml + - 715-x509_crl-serial.yml + plugins: + filter: + - description: Convert a serial number as a colon-separated list of hex numbers + to an integer + name: parse_serial + namespace: null + - description: Convert an integer to a colon-separated list of hex numbers + name: to_serial + namespace: null + release_date: '2024-02-25' 2.2.0: changes: bugfixes: diff --git a/changelogs/fragments/2.18.0.yml b/changelogs/fragments/2.18.0.yml deleted file mode 100644 index 56de6d9e..00000000 --- a/changelogs/fragments/2.18.0.yml +++ /dev/null @@ -1 +0,0 @@ -release_summary: Bugfix and feature release. diff --git a/changelogs/fragments/710-luks_device-keyslot-fixes.yml b/changelogs/fragments/710-luks_device-keyslot-fixes.yml deleted file mode 100644 index 323922c0..00000000 --- a/changelogs/fragments/710-luks_device-keyslot-fixes.yml +++ /dev/null @@ -1,4 +0,0 @@ -bugfixes: - - "luks_device - fixed module a bug that prevented using ``remove_keyslot`` with the value ``0`` (https://github.com/ansible-collections/community.crypto/pull/710)." - - "luks_device - fixed module falsely outputting ``changed=false`` when trying to add a new slot with a key that is already present in another slot. The module now rejects adding keys that are already present in another slot (https://github.com/ansible-collections/community.crypto/pull/710)." - - "luks_device - fixed testing of LUKS passphrases in when specifying a keyslot for cryptsetup version 2.0.3. The output of this cryptsetup version slightly differs from later versions (https://github.com/ansible-collections/community.crypto/pull/710)." \ No newline at end of file diff --git a/changelogs/fragments/714-pipe-check-mode-deprecation.yml b/changelogs/fragments/714-pipe-check-mode-deprecation.yml deleted file mode 100644 index bb13a040..00000000 --- a/changelogs/fragments/714-pipe-check-mode-deprecation.yml +++ /dev/null @@ -1,7 +0,0 @@ -deprecated_features: - - "openssl_csr_pipe, openssl_privatekey_pipe, x509_certificate_pipe - the current behavior of check mode is deprecated and will change in community.crypto 3.0.0. - The current behavior is similar to the modules without ``_pipe``: if the object needs to be (re-)generated, only the ``changed`` status is set, but the object - is not updated. From community.crypto 3.0.0 on, the modules will ignore check mode and always act as if check mode is not active. This behavior can already - achieved now by adding ``check_mode: false`` to the task. If you think this breaks your use-case of this module, please - `create an issue in the community.crypto repository `__ - (https://github.com/ansible-collections/community.crypto/issues/712, https://github.com/ansible-collections/community.crypto/pull/714)." diff --git a/changelogs/fragments/715-x509_crl-serial.yml b/changelogs/fragments/715-x509_crl-serial.yml deleted file mode 100644 index c745e10c..00000000 --- a/changelogs/fragments/715-x509_crl-serial.yml +++ /dev/null @@ -1,5 +0,0 @@ -minor_changes: - - "x509_crl - the new option ``serial_numbers`` allow to configure in which format serial numbers can be provided - to ``revoked_certificates[].serial_number``. The default is as integers (``serial_numbers=integer``) for backwards compatibility; - setting ``serial_numbers=hex-octets`` allows to specify colon-separated hex octet strings like ``00:11:22:FF`` - (https://github.com/ansible-collections/community.crypto/issues/687, https://github.com/ansible-collections/community.crypto/pull/715)."