Commit Graph

270 Commits (a8aa05ac4e370fe7e7c30c1d85cb4ec0ea40eac7)

Author SHA1 Message Date
Felix Fontein a8aa05ac4e Avoid reserved variable name 'order'. 2025-01-19 10:59:55 +01:00
Felix Fontein 0e122e5f56 Improve ACME profile support. 2025-01-19 10:55:26 +01:00
Felix Fontein 47ea1af180 Forgot to adjust warnings. 2025-01-19 10:47:24 +01:00
Felix Fontein 214794d056
acme_certificate and acme_certificate_create_order: add order_creation_error_strategy and order_creation_max_retries options (#842)
* Provide error information.

* Add helper function for order creation retrying.

* Improve existing documentation.

* Document 'replaces' return value.

* Add order_creation_error_strategy and order_creation_max_retries options.

* Add changelog fragment.

* Fix authz deactivation for finalizing step.

* Fix profile handling on order creation.

* Improve existing tests.

* Add ARI and profile tests.

* Warn when 'replaces' is removed when retrying to create an order.
2025-01-18 10:51:10 +01:00
Felix Fontein 5366b9e5ba
Improve ACME tests; add acme_ari_info tests; use ARI and profiles features in acme_certificate tests (#841)
* Fix description.

* Add basic acme_ari_info test.

* Refactoring.

* Extend acme_certificate tests.
2025-01-14 23:49:24 +01:00
Felix Fontein ae35be3437
Adjust ARI tests to new Pebble (#837)
* Adjust ARI tests to new Pebble.

* Fix key size for certificates to 2048 on all systems.
2025-01-13 21:43:29 +01:00
Felix Fontein 01e7bf1f33
acme_certificate_renewal_info: add treat_parsing_error_as_non_existing option and existing and parsable return values (#838)
* Fix error reporting for OpenSSL backend: raise BackendExceptions instead of directly failing the module.

* Add treat_parsing_error_as_non_existing option and existing and parsable return values.
2025-01-12 21:42:24 +01:00
Felix Fontein 49354f2121
Add new ACME modules for working with orders. (#757) 2025-01-12 17:10:58 +01:00
Felix Fontein 072318466e
Update ACME tests (#836)
* Restrict remaining days to also work with short-lived profiles.

* Adjust boolean cases.

* Fix spelling error.

* Use larger key size for TLS-ALPN test certificate.
2025-01-12 13:59:08 +01:00
Felix Fontein 029e009db1
CI: Add Fedora 41, Alpine 3.21, RHEL 9.5, FreeBSD 14.2 to CI for devel (#834)
* Add Fedora 41, Alpine 3.21, RHEL 9.5, FreeBSD 14.2 to CI for devel.

* Fedora 41 also doesn't allow SHA-1 apparently.

Ref: https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer

* Work around broken cryptography in Fedora 41.
2025-01-08 22:08:18 +01:00
Felix Fontein 355480601d Make 2.9, 2.10, and 2.11 sanity tests shut up. 2025-01-03 15:26:19 +01:00
Felix Fontein f956ddcc77 Add extra sanity test for acme action group. 2025-01-03 14:56:36 +01:00
Felix Fontein abb0d67774
Add validation option. (#830) 2024-12-30 10:09:51 +01:00
Felix Fontein 05c442ab5e
luks_device: allow to provide passphrases base64-encoded (#829)
* Allow to provide passphrases base64-encoded.

* Add note on binary passphrases.
2024-12-30 10:09:32 +01:00
Felix Fontein 32047dccc5
Add test with device name starting with 'crypt'. (#821) 2024-11-21 21:46:26 +01:00
Felix Fontein 0f7c5f0de1
CI: Fix cryptsetup version for RHEL 9.1/9.2/9.3/9.4 (#819)
* Fix cryptsetup version for RHEL 9.1/9.2/9.3.

* Also fix version for RHEL 9.4.

* Trigger change in openssh_cert.

* Use lower-case names.

* Actually install the right version.
2024-11-18 21:36:53 +01:00
Felix Fontein 6731b38baa
Explicitly use UTC timezone in ACME OpenSSL backend (#811)
* Allow abstract backend class to handle both with and without timezone.

* Explicitly use UTC timezone in OpenSSL backend code.
2024-10-27 08:13:05 +01:00
Felix Fontein feee571bc8
Fix time code to work in timezones other than UTC, and add tests in multiple timezones (#810)
* Add tests in multiple timezones.

* Fix get_epoch_seconds() for timestamps without timezones.

* Add changelog fragment.

* Pin version for Python 2.6.
2024-10-24 20:24:55 +02:00
Felix Fontein 6d4a8435c7
Add test for mixed-case DNS name. (#807) 2024-10-15 20:10:00 +02:00
Felix Fontein 2d82f49adc
Make sure idna is installed. (#800) 2024-09-25 23:10:44 +03:00
Felix Fontein 1095c0be41
Add stable-2.18 to CI (#798)
* Add stable-2.18 to CI.

* get_certificate: always use asn1_base64=true for ansible-core 2.18+.
2024-09-24 14:19:42 +03:00
Felix Fontein a49711d383
openssl_privatekey*: add default value for cipher option (#794)
* Add default value for 'cipher' option.
* Adjust tests.
* Add changelog fragment.
* Clarify that cipher is used only when passphrase is provided.
2024-08-30 08:49:20 +01:00
Felix Fontein e1e60892a8
Fix PKCS#12 tests. (#787) 2024-07-21 13:02:04 +02:00
Felix Fontein d509af540d
Disable unit tests that fail with cryptography 43.0.0. (#786) 2024-07-21 12:11:34 +02:00
Felix Fontein d50c3cc944
get_certificate: add get_certificate_chain option (#784)
* Implement get_certificate_chain option.

* Implement basic tests.

* Add compatibility for current Python 3.13 pre-releases.
2024-07-10 21:51:30 +02:00
Felix Fontein 518847a92c
CI: DSA SSH keys are no longer supported with OpenSSH 9.8p1 (#776)
* DSA SSH keys are no longer supported with OpenSSH 9.8p1.

* Add more compatibility tests.
2024-07-04 10:15:22 +02:00
Felix Fontein aa30b4c803
Fix CI for CentOS 7. (#774) 2024-07-01 13:56:23 +02:00
Felix Fontein 5e60bee9c0
Adjust CI matrix for ansible-core devel's ansible-test (#771)
* Adjust CI matrix for ansible-core devel's ansible-test.

* Don't install cryptography via pip on Ubuntu 24.04.

* Don't force-enable on Fedora.
2024-06-18 08:20:43 +02:00
Felix Fontein 5f6e0095b0
Fix unit tests. (#767) 2024-06-13 21:33:36 +02:00
Felix Fontein 7810e2c3bf
Remove usage of old ACME test container. (#760) 2024-05-20 16:11:35 +02:00
Felix Fontein 7fc3ad0263
Make sure the ACME inspect tests run with both backends. (#758) 2024-05-12 15:29:07 +02:00
Felix Fontein 00d23753ca Revert "Revert all non-bugfixes merged since the last release."
This reverts commit 82251c2d80.
2024-05-11 17:05:03 +02:00
Felix Fontein 82251c2d80 Revert all non-bugfixes merged since the last release.
Revert "Fix documentation. (#751)"
Revert "ACME modules: simplify code, refactor argspec handling code, move csr/csr_content to own docs fragment (#750)"
Revert "Refactor and extend argument spec helper, use for ACME modules (#749)"
Revert "Avoid exception if certificate has no AKI in acme_certificate. (#748)"
Revert "ACME: improve acme_certificate docs, include cert_id in acme_certificate_renewal_info return value (#747)"
Revert "Add acme_certificate_renewal_info module (#746)"
Revert "Refactor time code, add tests, fix bug when parsing absolute timestamps that omit seconds (#745)"
Revert "Add tests for acme_certificate_deactivate_authz module. (#744)"
Revert "Create acme_certificate_deactivate_authz module (#741)"
Revert "acme_certificate: allow to request renewal of a certificate according to ARI (#739)"
Revert "Implement basic acme_ari_info module. (#732)"
Revert "Add function for retrieval of ARI information. (#738)"
Revert "acme module utils: add functions for parsing Retry-After header values and computation of ARI certificate IDs (#737)"
Revert "Implement certificate information retrieval code in the ACME backends. (#736)"
Revert "Split up the default acme docs fragment to allow modules ot not need account data. (#735)"

This reverts commits 5e59c5261e, aa82575a78,
f3c9cb7a8a, f82b335916, 553ab45f46,
59606d48ad, 0a15be1017, 9501a28a93,
d906914737, 33d278ad8f, 6d4fc589ae,
9614b09f7a, af5f4b57f8, c6fbe58382,
and afe7f7522c.
2024-05-11 16:07:53 +02:00
Felix Fontein f43fa94549
x509_certificate: fix time idempotence (#754)
* Fix time idempotence.

* Lint and add changelog fragment.

* Add tests.

* Make sure 'ignore_timestamps: false' is passed for time idempotence tests; pass right private key for OwnCA tests
2024-05-11 16:04:41 +02:00
Felix Fontein 553ab45f46
ACME: improve acme_certificate docs, include cert_id in acme_certificate_renewal_info return value (#747)
* Use community.dns.quote_txt filter instead of regex replace to quote TXT entry value.

* Fix documentation of acme_certificate's challenge_data return value.

* Also return cert_id from acme_certificate_renewal_info module.

* The cert ID cannot be computed if the certificate has no AKI.

This happens with older Pebble versions, which are used when
testing against older ansible-core/-base/Ansible versions.

* Fix AKI extraction for older OpenSSL versions.
2024-05-04 23:38:57 +02:00
Felix Fontein 59606d48ad
Add acme_certificate_renewal_info module (#746)
* Allow to provide cert_info object to get_renewal_info().

* Add acme_certificate_renewal_info module.

* Allow to provide value for 'now'.

* Actually append msg_append.

* Fix bug in module timestamp param parsing, and add tests.
2024-05-04 15:47:42 +02:00
Felix Fontein 0a15be1017
Refactor time code, add tests, fix bug when parsing absolute timestamps that omit seconds (#745)
* Add time module utils.

* Add time helpers to ACME backend.

* Add changelog fragment.

* ACME timestamp parser: do not choke on nanoseconds.
2024-05-03 22:25:39 +02:00
Felix Fontein 9501a28a93
Add tests for acme_certificate_deactivate_authz module. (#744) 2024-05-01 11:30:07 +02:00
Felix Fontein af5f4b57f8
acme module utils: add functions for parsing Retry-After header values and computation of ARI certificate IDs (#737)
* Implement Retry-After value parse.

* Add cert ID computation function.

* Add tests and links to MDN.
2024-04-29 23:06:35 +02:00
Felix Fontein c6fbe58382
Implement certificate information retrieval code in the ACME backends. (#736) 2024-04-29 22:29:43 +02:00
Felix Fontein 0c62837296
crypto.math module utils: add some tests, fix quick_is_not_prime() for small primes (#733)
* Fix quick_is_not_prime() for small primes. Add some tests.

* Fix return value of convert_int_to_bytes(0, 0) on Python 2.

* Add some more test cases.

* Simplify the changelog and point out that these errors only happen for cases not happening in regular use.
2024-04-29 08:50:28 +02:00
Felix Fontein 27a9ff14fb
Add x509_certificate_convert module. (#728) 2024-04-18 05:50:36 +00:00
Felix Fontein 50c2c4db29
CI: Add stable-2.17; copy ignore.txt files from 2.17 to 2.18; move stable-2.14 from AZP to GHA (#721)
* Add stable-2.17 to CI; copy ignore files from 2.17 to 2.18.

* Move stable-2.14 from AZP to GHA.
2024-04-03 08:32:16 +02:00
Felix Fontein 1736602ce7
Allow to configure how serial numbers are provided to x509_crl. (#715) 2024-02-19 21:05:13 +01:00
Felix Fontein 6b1a3d6e68
Add conversion filters for serial numbers (#713)
* Refactoring.

* Add parse_filter and to_filter plugins.

* Mention filters when serial numbers are accepted or returned.
2024-02-18 21:27:48 +01:00
Steffen Gufler 51591891d3
luks_device: fix remove_keyslot not working when set to 0 and duplicate keys (#710)
* luks_device: fix remove_keyslot not working when set to 0

* luks_device: fix module outputting 'ok' when trying to add a key that is already present in another keyslot

* luks_device: fix breaking unit tests

* luks_device: Duplicate key test case code cleanup

* luks_device: Fix testing of LUKS passphrases when only testing one key slot

* luks_device: Fix testing of LUKS passphrases when only testing one key slot

* luks_device: Add changelog fragment for PR #710

* luks_device: Update changlog fragment
2024-02-11 12:23:21 +01:00
0x00ace a4edf22a9c
add allow discard option for luks devices (#693)
* add allow discard option for luks devices

* Add allow_discards to perfomance tests

* Fix version for luks devices doc

* Update plugins/modules/luks_device.py

Co-authored-by: Felix Fontein <felix@fontein.de>

* add changelog fragment

* Update changelogs/fragments/693-allow-discards.yaml

Co-authored-by: Felix Fontein <felix@fontein.de>

* added allow_discards to the persistently stored option list

* allow_discards works with not only luks2 containers

* Update plugins/modules/luks_device.py

Co-authored-by: Felix Fontein <felix@fontein.de>

---------

Co-authored-by: Felix Fontein <felix@fontein.de>
2024-01-13 09:34:07 +01:00
Felix Fontein 97e44c4ba5
Remove some Shippable specific code that trips latest shellcheck. (#692) 2024-01-04 22:46:46 +01:00
Felix Fontein 033b456b7a
Add new error message. (#688) 2023-12-20 13:37:19 +01:00
Felix Fontein 29cd0b3bde
Fix bad expressions in tests. (#677)
ci_complete
2023-11-28 22:57:45 +01:00