* Always generate a new key pair if the private key doesn't exist (#597)
This commit updates `KeypairBackend._should_generate()` to first check
if the original private key named by the `path` argument exists, and
return True if it does not. This brings the code in line with
the documentation, which says that a new key will always be generated if
the key file doesn't already exist.
As an alternative to the approach implemented here, I also considered
only modifying the condition in the `fail` branch of the if statement,
but I thought that would not map as cleanly to the behavior specified in
the documentation, so doing it the way I did should make it easier to
check that the code is doing the right thing just by looking at it.
I also considered doing something to make the logic more similar to
`PrivateKeyBackend.needs_regeneration()` (the openssl version of this
functionality), because the two are supposed to be acting the same way,
but I thought that'd be going beyond the scope of just fixing this bug.
If it'd be useful to make both methods work the same way, someone can
refactor the code in a future commit.
* Test different regenerate values with nonexistent keys
This commit changes the test task that generates new keys to use each of
the different values for the `regenerate` argument, which will ensure
that the module is capable of generating a key when no previous key
exists regardless of the value of `regenerate`. Previously, the task
would always run with the `partial_idempotence` value, and that obscured
a bug (#597) that would occur when it was set to `fail`. The bug was
fixed in the previous commit.
(cherry picked from commit ce3299f106)
Co-authored-by: David Zaslavsky <diazona@ellipsix.net>
* Prepare for distutils.version being removed in Python 2.12.
* Fix copy'n'paste error.
* Re-add Loose prefix.
* Fix Python version typo.
* Improve formulation.
* Move message into own line.
* Fix casing, now that the object is no longer called Version.
(cherry picked from commit a539cd6939)
* Initial commit
* Matching tests to overwritten permissions behavior with cryptography
* Ensuring key validation only occurs when state=present and accomodating CentOS6 restrictions
* Making ssh-keygen behavior explicit by version in tests
* Ensuring cyrptography not excluded in new conditions
* Adding changelog fragment
* Fixing sanity checks
* Improving readability
* Applying review suggestions
* addressing restore_on_failure conflict
* Initial commit
* Fixing unit tests
* More unit fixes
* Adding changelog fragment
* Minor refactor in Certificate.generate()
* Addressing option case-sensitivity and directive overrides
* Renaming idempotency to regenerate
* updating changelog
* Minor refactoring of default options
* Cleaning up with inline functions
* Fixing false failures when regenerate=fail and improving clarity
* Applying second round of review suggestions
* adding helper for safe atomic moves
Use of the confusingly-named _permissions_changed() on both
sides of an `or` was resulting in the second invocation not
being reached if the first invocation returned True, which it
does any time it applied custom attributes to the private key.
As a result, custom file attributes were only ever being
applied to the private key (except in one specific case)
This is fixed by explicitly updating attributes of both files
before checking if changes have been made.
Signed-off-by: Charlie Wheeler-Robinson <cwheeler@redhat.com>
* Initial commit
* Fixing units
* Adding changelog fragment
* Enhanced encapsulation of certificate data
* Avoiding failure when path is not parseable
* Diff refactor
* Applying initial review suggestions
* Initial commit
* Adding informational comments
* Adding changelog fragment
* Fixing CRLF changelog fragment
* Refactoring public number parsing and added chaining for writer methods
* Adding more descriptive error for invalid certificate data
* Fixing signature data parsing
* Correcting ed25519 signature type to binary
* Applying initial review suggestions and fixing option-list writer
* Applying review suggestions
* Making OpensshWriter private
* Refactoring openssh_keypair for multiple backends
* Fixing cryptography backend validations
* Simplifying conditionals and excess variable assignments
* Fixing docs and adding cleanup for integration tests
* Fixing docs and public key validation bugs in crypto backend
* Enhancing cryptogagraphy utils to raise OpenSSHErrors when file not found
* Adding missed copyright and cleanup for idempotency test keys
* Fixing doc style
* Readding crypto/openssh for backwards compatibility
* Adding changelog fragment and final simplifications of conditional statements
* Applied initial review suggestions
* Integrating openssh module utils with openssh_keypair
* Added explicit PEM formatting for OpenSSH < 7.8
* Adding changelog fragment
* Adding OpenSSL/cryptography dependency for integration tests
* Adding private_key_format option and removing forced cryptography update for CI
* Fixed version check for bcrypt and key_format option name
* Setting no_log=False for private_key_format
* Docs correction and simplification of control flow for private_key_format
* Adding openssh utils and unit tests
* Adding changelog fragment and correcting RSA default size
* Adding changelog fragment
* Added passphrase update, test cases, and check for SSH private key loader
* corrected ecdsa type when loading
* Resolving inital review comments
* Fixed import in unit tests
* Cleaning up validation functions
* Separating private/public key related errors; Adding verify method
* Expressed generate/load functions as classmethods and cleaned up method comments
* Added support for loading asymmetric key pairs of PEM and DER formats
* Refactored loading/generation for Asym keypairs into classmethods
* Rescoped helper functions and classmethods for OpenSSH Keypair
* Corrected docstring for OpenSSH_Keypair.generate()
* Fixed import errors for sanity tests
* Improvements to comparison, key verification, and password validation
* Added comparison tests, simplified password validation, fixed Ed25519 load bug
* Adding additional equivalence tests with passphrases
patchback[bot]
Felix Fontein
Ajpantuso
Charlie Wheeler-Robinson