* luks_device: add support for keyslots
* luks_device: replace python3 format strings with python2 format strings, remove print statements
* luks_device: add missing copyright information in keyslot integration test files
* luks_device: updated failing unit tests for keyslot support
* luks_device: improve detection of luks version
* luks_device: Update documentation on keyslot parameters, minor code improvements
* luks_device: improve validation of keyslot parameters, fix tests for systems that do not support luks2
* luks_device: correct spelling and errors in documentation and output, check all possible locations for LUKS2 header
* Check return code on ssh(-keygen) invocations.
* openssh_cert: only check for errors if certificate should be present and module is not in check mode.
* Handle rc check for _get_private_key().
* Add changelog fragment.
* Only pass -o for comment updating when necessary.
* Now fails if comment cannot be updated.
This was silently ignored in the past.
* Avoid failing operation.
* Add gpg_fingerprint lookup.
* Work around problems on some CI targets.
* Use get_bin_path to find the gpg executable. Document that we need it.
* Improve and test error handling.
* Refactor (potentially) common code to module_utils and plugin_utils.
This will be useful to create a filter version of this, and further lookups, filters, and modules.
* Do not create a keyring when there isn't one.
* Fixups.
* Fix description.
* More fixes for lookup.
* Also add a gpg_fingerprint filter.
* Improve formulation.
Co-authored-by: Sandra McCann <samccann@redhat.com>
---------
Co-authored-by: Sandra McCann <samccann@redhat.com>
* Adjust EE tests to ansible-builder 3.0.0.
* Remove other CI workflows.
* Use docker instead of podman...
* Support Rocky Linux 9+.
* Add CentOS Stream 9 to EE tests.
* Fix installation of PyOpenSSL on CentOS/RHEL/Rocky.
* ansible-builder only attempts to install EPEL deps on CentOS.
* Make EPEL also available on Rocky Linux 9, even though ansible-builder will ignore it.
* Make sure cryptography is already installed.
* Try ansible-runner < 2.0.0 for CentOS Stream 8 / RHEL 8.
* Show more info.
* Start restricting transitive dependencies...
* Looks like PyOpenSSL is **broken** on CentOS Stream 9 + EPEL.
* ansible-builder will NOT work with Python 3.6.
use Python 3.9 on RHEL8 / CentOS Stream 8. Manually install cryptography and PyOpenSSL for Python 3.9 as well.
* PyOpenSSL isn't available for Python 3.8 or 3.9.
* Revert "Remove other CI workflows."
This reverts commit 3a9d125f45.
* Use podman instead of docker.
* Re-order bindep entries.
* python3-pyOpenSSL does not exist on RHEL/CentOS 6 and 7.
* Always generate a new key pair if the private key doesn't exist (#597)
This commit updates `KeypairBackend._should_generate()` to first check
if the original private key named by the `path` argument exists, and
return True if it does not. This brings the code in line with
the documentation, which says that a new key will always be generated if
the key file doesn't already exist.
As an alternative to the approach implemented here, I also considered
only modifying the condition in the `fail` branch of the if statement,
but I thought that would not map as cleanly to the behavior specified in
the documentation, so doing it the way I did should make it easier to
check that the code is doing the right thing just by looking at it.
I also considered doing something to make the logic more similar to
`PrivateKeyBackend.needs_regeneration()` (the openssl version of this
functionality), because the two are supposed to be acting the same way,
but I thought that'd be going beyond the scope of just fixing this bug.
If it'd be useful to make both methods work the same way, someone can
refactor the code in a future commit.
* Test different regenerate values with nonexistent keys
This commit changes the test task that generates new keys to use each of
the different values for the `regenerate` argument, which will ensure
that the module is capable of generating a key when no previous key
exists regardless of the value of `regenerate`. Previously, the task
would always run with the `partial_idempotence` value, and that obscured
a bug (#597) that would occur when it was set to `fail`. The bug was
fixed in the previous commit.
* Do extra docs validation. Explicitly disallow semantic markup in docs.
* Forgot to add new requirement.
* Improve test.
* TEMP - make CI fail.
* Revert "TEMP - make CI fail."
This reverts commit a71b8901c1.
* Remove unnecessary import.
* Make sure ANSIBLE_COLLECTIONS_PATH is set.
* Make sure sanity tests from older Ansible versions don't complain.
* Show timings with devel, and skip everything else.
* Move to other group.
* Try smaller SSH key size (i.e. make tests run faster).
* Add implicit size that now must be explicit.
* Change group of luks_device.
* Revert "Show timings with devel, and skip everything else."
This reverts commit 7b73f7e4d7.
* Update CI scripts to be more close to the ones in ansible-core.
* Extend CI matrix.
* Mark more VMs.
* Revert "Mark more VMs."
This reverts commit 8bc79af636.
* Disable alpine VMs for get_certificate due to httptester problems.
* Improve retrieval of cryptsetup version.
* ACME 'emulator' won't work on Alpine either.
* Improve luks test setup.
* Make sure wipefs is installed on Alpine.
* dmsetup (from device-mapper) is used by the tests.
* Fix bcrypt install failure handling.
* String, not float.
* openssl_privatekey_convert is not an action module.
* Update Python info.
* Try out which VMs can be used by now.
* Enable ACME tests on all VMs but Alpine; update comment.
* Adjust acme-tiny shebang.
* Remove new entries from CI matrix.
The issuer_uri is retrieved from the Authority Information Access field the same way as the OCSP responder URI is.
Handling is exactly the same since they reside in the same OID space and have the same data type.
Tests have also been added based on the integration test certificates.
Signed-off-by: benaryorg <binary@benary.org>
Signed-off-by: benaryorg <binary@benary.org>
* tests.unit.compat.mock: Remove legacy compat code
This removes old Python 3.4 compatibility code that is no longer needed.
* Prefer unitest.mock by universally using compat.mock
`mock` is a backport of the `unittest.mock` module from the stdlib, and
there's no reason to use it on newer Python versions.
* Extend tests to check for privatekey_content together with privatekey_passphrase.
* Also test privatekey_content for private keys without passphrases.
* ci: enable rhel9.0 tests for openssh_cert
* ci: allow openssh_cert second signature algorithm test for versions >8.7
* ci: narrowing condition to not attempt RSA1 signing exclusively on RHEL >=9
* ci: grouping and documenting condition
* Add RHEL 9.0 and FreeBSD 13.1 to CI.
* Add Ubuntu 22.04 and Fedora 36 to CI.
* Switch orders so that root doesn't have a SHA1 signature.
* Skip openssh_cert test on RHEL 9.0.
* Make it possible that pyOpenSSL isn't installed *at all*.
* Work with default.
* Prepare IDNA/Unicode conversion code. Use to normalize input.
* Use IDNA library first (IDNA2008) and Python's IDNA2003 implementation as a fallback.
* Make sure idna is installed.
* Add changelog fragment.
* 'punycode' → 'idna'.
* Add name_encoding options and tests.
* Avoid invalid character for IDNA2008.
* Linting.
* Forgot to upate value.
* Work around cryptography bug. Fix port handling for URIs.
* Forgot other place sensitive to cryptography bug.
* Forgot one. (Will likely still fail.)
* Decode IDNA in _compress_entry() to avoid comparison screw-ups.
* Work around Python 3.5 problem in Ansible 2.9's default test container.
* Update changelog fragment.
* Fix error, add tests.
* Python 2 compatibility.
* Update requirements.
* Add EE files.
* Install cryptography and PyOpenSSL from PyPi.
* Revert "Install cryptography and PyOpenSSL from PyPi."
This reverts commit 6b90a1efae.
* Only run test when cryptography has a new enough version.
* And another one.
* Extend changelog.
* Fix empty check for openssl_pkcs12 tests.
* Remove unnecessary imports.
* Prevent crash if PyOpenSSL cannot be imported because of an AttributeError.
* Add changelog fragment.
* Fix constraints file.
* Use Python 2.7 instead of 3.5 for 2.9 cloud tests (pip module is broken).
* Prevent upgrading cryptography on ansible-core 2.12's default container with Python 3.9.
Read and write work queue significantly degrades performance on
SSD/NVME devices[1].
In Debian 11 crypttab does not support no-read-workqueue and
no-write-workqueue flags, so the persistent flag is workaround: once
opened with perf parameters persists forever.
[1] https://blog.cloudflare.com/speeding-up-linux-disk-encryption/
Signed-off-by: Yauhen Artsiukhou <jsirex@gmail.com>
* Use community ansible-test images.
* Adjust tests for new operating systems, and pass on Python version as well.
* Fix Python version.
Co-authored-by: David Moreau Simard <moi@dmsimard.com>
* Fix package name.
Co-authored-by: David Moreau Simard <moi@dmsimard.com>
* Allow multiple intermediate CAs to have same subject.
* Add tests.
* Fix test name.
* Don't use CN for SAN.
* Make a bit more compatible.
* Include jinja2 compat for CentOS 6.
* Add basic crypto_info module.
* Improve check.
* Actually test capabilities.
* Also output EC curve list.
* Fix detections.
* Ed25519 and Ed448 are not supported on FreeBSD 12.1.
* Refactor.
* Also retrieve information on the OpenSSL binary.
* Improve splitting.
* Update plugins/modules/crypto_info.py
Co-authored-by: Andrew Pantuso <ajpantuso@gmail.com>
* Replace list by tuple.
Co-authored-by: Andrew Pantuso <ajpantuso@gmail.com>
* Name test tasks in a more explicite manner
* Space test + verification blocks apart
* Apply suggestions from code review
Co-authored-by: Jens Heinrich <github.com/JensHeinrich>
Co-authored-by: Felix Fontein <felix@fontein.de>
* Add new code as fallback which re-serializes de-serialized extensions using the new cryptography API.
* Forgot Base64 encoding.
* Add extension by OID tests.
* There's one value which is different with the new code.
* Differences in CI.
* Working around older Jinjas.
* Value depends on which SAN was included.
* Force complete CI run now since cryptography 36.0.0 is out.
ci_complete
* Remove assertonly backend.
* Remove assertonly tests.
* The expired test is basically a test of assertonly.
* Replace assertonly verification by _info + assert.
* Remove vendored copy of ipaddress.
* Forgot an import.
* Remove sanity ignores and checks related to ipaddress.
* Remove octal IPv4 address.
Such IPs are no longer accepted by ipaddress in Python's standard library (CVE-2021-29921).
* Remove unused import.
Co-authored-by: Sviatoslav Sydorenko <wk.cvs.github@sydorenko.org.ua>
Co-authored-by: Sviatoslav Sydorenko <wk.cvs.github@sydorenko.org.ua>
Felix Fontein
Steffen Gufler
David Zaslavsky
Katze
Andrew Pantuso
Maxwell G
Andrew Pantuso
Yauhen
JochenKorge
Jens Heinrich