Reformat everything with black.

I had to undo the u string prefix removals to not drop Python 2 compatibility.
That's why black isn't enabled in antsibull-nox.toml yet.

plugins/module_utils/crypto/module_backends/certificate_selfsigned.py

@@ -48,32 +48,38 @@ except ImportError:
 
 class SelfSignedCertificateBackendCryptography(CertificateBackend):
     def __init__(self, module):
-        super(SelfSignedCertificateBackendCryptography, self).__init__(module, 'cryptography')
+        super(SelfSignedCertificateBackendCryptography, self).__init__(
+            module, "cryptography"
+        )
 
-        self.create_subject_key_identifier = module.params['selfsigned_create_subject_key_identifier']
+        self.create_subject_key_identifier = module.params[
+            "selfsigned_create_subject_key_identifier"
+        ]
         self.notBefore = get_relative_time_option(
-            module.params['selfsigned_not_before'],
-            'selfsigned_not_before',
+            module.params["selfsigned_not_before"],
+            "selfsigned_not_before",
             backend=self.backend,
             with_timezone=CRYPTOGRAPHY_TIMEZONE,
         )
         self.notAfter = get_relative_time_option(
-            module.params['selfsigned_not_after'],
-            'selfsigned_not_after',
+            module.params["selfsigned_not_after"],
+            "selfsigned_not_after",
             backend=self.backend,
             with_timezone=CRYPTOGRAPHY_TIMEZONE,
         )
-        self.digest = select_message_digest(module.params['selfsigned_digest'])
-        self.version = module.params['selfsigned_version']
+        self.digest = select_message_digest(module.params["selfsigned_digest"])
+        self.version = module.params["selfsigned_version"]
         self.serial_number = x509.random_serial_number()
 
         if self.csr_path is not None and not os.path.exists(self.csr_path):
             raise CertificateError(
-                'The certificate signing request file {0} does not exist'.format(self.csr_path)
+                "The certificate signing request file {0} does not exist".format(
+                    self.csr_path
+                )
             )
         if self.privatekey_content is None and not os.path.exists(self.privatekey_path):
             raise CertificateError(
-                'The private key file {0} does not exist'.format(self.privatekey_path)
+                "The private key file {0} does not exist".format(self.privatekey_path)
             )
 
         self._module = module
@@ -89,18 +95,28 @@ class SelfSignedCertificateBackendCryptography(CertificateBackend):
             if cryptography_key_needs_digest_for_signing(self.privatekey):
                 digest = self.digest
                 if digest is None:
-                    self.module.fail_json(msg='Unsupported digest "{0}"'.format(module.params['selfsigned_digest']))
+                    self.module.fail_json(
+                        msg='Unsupported digest "{0}"'.format(
+                            module.params["selfsigned_digest"]
+                        )
+                    )
             try:
                 self.csr = csr.sign(self.privatekey, digest, default_backend())
             except TypeError as e:
-                if str(e) == 'Algorithm must be a registered hash algorithm.' and digest is None:
-                    self.module.fail_json(msg='Signing with Ed25519 and Ed448 keys requires cryptography 2.8 or newer.')
+                if (
+                    str(e) == "Algorithm must be a registered hash algorithm."
+                    and digest is None
+                ):
+                    self.module.fail_json(
+                        msg="Signing with Ed25519 and Ed448 keys requires cryptography 2.8 or newer."
+                    )
                 raise
 
         if cryptography_key_needs_digest_for_signing(self.privatekey):
             if self.digest is None:
                 raise CertificateError(
-                    'The digest %s is not supported with the cryptography backend' % module.params['selfsigned_digest']
+                    "The digest %s is not supported with the cryptography backend"
+                    % module.params["selfsigned_digest"]
                 )
         else:
             self.digest = None
@@ -118,26 +134,36 @@ class SelfSignedCertificateBackendCryptography(CertificateBackend):
             has_ski = False
             for extension in self.csr.extensions:
                 if isinstance(extension.value, x509.SubjectKeyIdentifier):
-                    if self.create_subject_key_identifier == 'always_create':
+                    if self.create_subject_key_identifier == "always_create":
                         continue
                     has_ski = True
-                cert_builder = cert_builder.add_extension(extension.value, critical=extension.critical)
-            if not has_ski and self.create_subject_key_identifier != 'never_create':
                 cert_builder = cert_builder.add_extension(
-                    x509.SubjectKeyIdentifier.from_public_key(self.privatekey.public_key()),
-                    critical=False
+                    extension.value, critical=extension.critical
+                )
+            if not has_ski and self.create_subject_key_identifier != "never_create":
+                cert_builder = cert_builder.add_extension(
+                    x509.SubjectKeyIdentifier.from_public_key(
+                        self.privatekey.public_key()
+                    ),
+                    critical=False,
                 )
         except ValueError as e:
             raise CertificateError(str(e))
 
         try:
             certificate = cert_builder.sign(
-                private_key=self.privatekey, algorithm=self.digest,
-                backend=default_backend()
+                private_key=self.privatekey,
+                algorithm=self.digest,
+                backend=default_backend(),
             )
         except TypeError as e:
-            if str(e) == 'Algorithm must be a registered hash algorithm.' and self.digest is None:
-                self.module.fail_json(msg='Signing with Ed25519 and Ed448 keys requires cryptography 2.8 or newer.')
+            if (
+                str(e) == "Algorithm must be a registered hash algorithm."
+                and self.digest is None
+            ):
+                self.module.fail_json(
+                    msg="Signing with Ed25519 and Ed448 keys requires cryptography 2.8 or newer."
+                )
             raise
 
         self.cert = certificate
@@ -147,34 +173,48 @@ class SelfSignedCertificateBackendCryptography(CertificateBackend):
         return self.cert.public_bytes(Encoding.PEM)
 
     def needs_regeneration(self):
-        if super(SelfSignedCertificateBackendCryptography, self).needs_regeneration(not_before=self.notBefore, not_after=self.notAfter):
+        if super(SelfSignedCertificateBackendCryptography, self).needs_regeneration(
+            not_before=self.notBefore, not_after=self.notAfter
+        ):
             return True
 
         self._ensure_existing_certificate_loaded()
 
         # Check whether certificate is signed by private key
-        if not cryptography_verify_certificate_signature(self.existing_certificate, self.privatekey.public_key()):
+        if not cryptography_verify_certificate_signature(
+            self.existing_certificate, self.privatekey.public_key()
+        ):
             return True
 
         return False
 
     def dump(self, include_certificate):
-        result = super(SelfSignedCertificateBackendCryptography, self).dump(include_certificate)
+        result = super(SelfSignedCertificateBackendCryptography, self).dump(
+            include_certificate
+        )
 
         if self.module.check_mode:
-            result.update({
-                'notBefore': self.notBefore.strftime("%Y%m%d%H%M%SZ"),
-                'notAfter': self.notAfter.strftime("%Y%m%d%H%M%SZ"),
-                'serial_number': self.serial_number,
-            })
+            result.update(
+                {
+                    "notBefore": self.notBefore.strftime("%Y%m%d%H%M%SZ"),
+                    "notAfter": self.notAfter.strftime("%Y%m%d%H%M%SZ"),
+                    "serial_number": self.serial_number,
+                }
+            )
         else:
             if self.cert is None:
                 self.cert = self.existing_certificate
-            result.update({
-                'notBefore': get_not_valid_before(self.cert).strftime("%Y%m%d%H%M%SZ"),
-                'notAfter': get_not_valid_after(self.cert).strftime("%Y%m%d%H%M%SZ"),
-                'serial_number': cryptography_serial_number_of_cert(self.cert),
-            })
+            result.update(
+                {
+                    "notBefore": get_not_valid_before(self.cert).strftime(
+                        "%Y%m%d%H%M%SZ"
+                    ),
+                    "notAfter": get_not_valid_after(self.cert).strftime(
+                        "%Y%m%d%H%M%SZ"
+                    ),
+                    "serial_number": cryptography_serial_number_of_cert(self.cert),
+                }
+            )
 
         return result
 
@@ -189,27 +229,38 @@ def generate_serial_number():
 
 class SelfSignedCertificateProvider(CertificateProvider):
     def validate_module_args(self, module):
-        if module.params['privatekey_path'] is None and module.params['privatekey_content'] is None:
-            module.fail_json(msg='One of privatekey_path and privatekey_content must be specified for the selfsigned provider.')
+        if (
+            module.params["privatekey_path"] is None
+            and module.params["privatekey_content"] is None
+        ):
+            module.fail_json(
+                msg="One of privatekey_path and privatekey_content must be specified for the selfsigned provider."
+            )
 
     def needs_version_two_certs(self, module):
-        return module.params['selfsigned_version'] == 2
+        return module.params["selfsigned_version"] == 2
 
     def create_backend(self, module, backend):
-        if backend == 'cryptography':
+        if backend == "cryptography":
             return SelfSignedCertificateBackendCryptography(module)
 
 
 def add_selfsigned_provider_to_argument_spec(argument_spec):
-    argument_spec.argument_spec['provider']['choices'].append('selfsigned')
-    argument_spec.argument_spec.update(dict(
-        selfsigned_version=dict(type='int', default=3),
-        selfsigned_digest=dict(type='str', default='sha256'),
-        selfsigned_not_before=dict(type='str', default='+0s', aliases=['selfsigned_notBefore']),
-        selfsigned_not_after=dict(type='str', default='+3650d', aliases=['selfsigned_notAfter']),
-        selfsigned_create_subject_key_identifier=dict(
-            type='str',
-            default='create_if_not_provided',
-            choices=['create_if_not_provided', 'always_create', 'never_create']
-        ),
-    ))
+    argument_spec.argument_spec["provider"]["choices"].append("selfsigned")
+    argument_spec.argument_spec.update(
+        dict(
+            selfsigned_version=dict(type="int", default=3),
+            selfsigned_digest=dict(type="str", default="sha256"),
+            selfsigned_not_before=dict(
+                type="str", default="+0s", aliases=["selfsigned_notBefore"]
+            ),
+            selfsigned_not_after=dict(
+                type="str", default="+3650d", aliases=["selfsigned_notAfter"]
+            ),
+            selfsigned_create_subject_key_identifier=dict(
+                type="str",
+                default="create_if_not_provided",
+                choices=["create_if_not_provided", "always_create", "never_create"],
+            ),
+        )
+    )