Commit Graph

374 Commits

Author SHA1 Message Date
Felix Fontein
31933955e3 CSR: avoid access of private attributes (#910)
* Avoid access of private attributes.

* Add changelog.
2025-05-30 22:46:39 +02:00
Felix Fontein
f3db4eeea5 Release 3.0.0-a2. 2025-05-22 22:06:10 +02:00
Felix Fontein
1b05480354 Prepare 3.0.0-a2. 2025-05-22 21:20:41 +02:00
Felix Fontein
43ea6148df Remove Entrust modules and certificate providers (#900)
* Remove Entrust modules and certificate providers.

* Add more information on Entrust removal.

* Remove Entrust content from ignore.txt files.

* Work around bug in ansible-test.
2025-05-22 19:08:48 +00:00
Felix Fontein
94416989a8 Release 3.0.0-a1. 2025-05-18 14:33:13 +02:00
Felix Fontein
b08afe4237 Make all doc_fragments private. (#898) 2025-05-18 01:42:18 +02:00
Felix Fontein
9b8e4e81a9 Forgot to mention cryptography. 2025-05-18 01:31:21 +02:00
Felix Fontein
efda8596a5 Prepare 3.0.0-a1 release. 2025-05-18 01:09:30 +02:00
Felix Fontein
5fbf35df86 Deprecate no longer used options. (#891) 2025-05-16 22:23:05 +02:00
Felix Fontein
56f004dc63 More refactorings (#890)
* Improve typing.

* Improve version parameter validation for x509_certificate* modules.

* Use utils for parsing retry-after.
2025-05-16 21:53:18 +02:00
Felix Fontein
a5a4e022ba Make all module_utils and plugin_utils private (#887)
* Add leading underscore. Remove deprecated module utils.

* Document module and plugin utils as private. Add changelog fragment.

* Convert relative to absolute imports.

* Remove unnecessary imports.
2025-05-11 19:17:58 +02:00
Felix Fontein
f758d94fba Add type hints and type checking (#885)
* Enable basic type checking.

* Fix first errors.

* Add changelog fragment.

* Add types to module_utils and plugin_utils (without module backends).

* Add typing hints for acme_* modules.

* Add typing to X.509 certificate modules, and add more helpers.

* Add typing to remaining module backends.

* Add typing for action, filter, and lookup plugins.

* Bump ansible-core 2.19 beta requirement for typing.

* Add more typing definitions.

* Add typing to some unit tests.
2025-05-11 18:00:11 +02:00
Felix Fontein
83beb7148c Remove six usages. (#884) 2025-05-03 11:12:29 +02:00
Felix Fontein
645b7bf9ed Get rid of backend parameter whenever possible (#883)
* Get rid of backend parameter whenever possible.

* Always auto-detect if backend choices are 'cryptography' and 'auto', resp. always check cryptography version.

* Improve error message.

* Update documentation.
2025-05-03 10:46:53 +02:00
Felix Fontein
fbcb89f092 Support cryptography 3.3 (#882)
* Re-add Debian Bullseye to CI.

* Support cryptography 3.3 as well.
2025-05-02 21:42:06 +02:00
Felix Fontein
86db561193 Get rid of some to_native and to_text calls. (#880) 2025-05-02 15:58:39 +02:00
Felix Fontein
0b8f3306c7 Use unittest.mock. (#881) 2025-05-02 15:39:03 +02:00
Felix Fontein
5231ac8f3f Remove support for cryptography < 3.4 (#878)
* Stop passing backend to cryptography.

* Make public_bytes() fallback the default.

* Remove compatibility code for older cryptography versions.

* Require cryptography 3.4+.

* Restrict to cryptography >= 3.4 in integration tests.

* Remove Debian Bullseye from CI.

It only supports cryptography 3.3.

* Improve imports.

* Remove no longer existing conditional.
2025-05-02 15:27:18 +02:00
Felix Fontein
65872e884f Remove Python 2 specific code (#877)
* Get rid of Python 2 special handling.

* Get rid of more Python 2 specific handling.

* Stop using six.

* ipaddress is part of the standard library since Python 3.

* Add changelog.

* Fix import.

* Remove unneeded imports.
2025-05-01 16:21:13 +02:00
Felix Fontein
266082db72 Remove more traces of PyOpenSSL, including from EE dependencies (#874)
* Remove PyOpenSSL backends.

* Remove EOL ansible-core's from EE builds.

* Update Pythons in EEs.

* Remove pyopenssl tests.
2025-04-29 09:33:21 +02:00
Felix Fontein
d368d1943d Bump version to 3.0.0-dev0, remove deprecated functionality and implement announced breaking changes (#873)
* Bump verison to 3.0.0-dev0.

* Change check mode behavior for *_pipe modules.

* Remove PyOpenSSL backend.

* Remove PyOpenSSL setup.

* Change default of asn1_base64.

* Remove deprecated common module utils.

* Remove get_default_argspec().

* Mark two methods as abstract.

* Remove ACME v1 support.

* Remove retrieve_acme_v1_certificate().

* Remove deprecated docs fragment.

* Change meaning of mode parameter.

* Mark no longer used option as 'to deprecate'.
2025-04-29 08:12:44 +02:00
Felix Fontein
f73a1ce590 Drop compatibility with older versions. (#872) 2025-04-28 21:45:42 +02:00
Felix Fontein
23de865563 Unvendor distutils.version (#371)
* Unvendor distutils.version.

* Fix version.

* Assume the collection requires ansible-core 2.12+.

This is valid since this only get merged for 3.0.0, which
will drop support for quite a few more ansible-core versions.

* Mark for re-export.
2025-04-28 14:30:37 +02:00
Felix Fontein
4e8a0e456b Prepare basic 3.0.0 setup (#870)
* Drop support for ansible-core < 2.17.

* Galaxy can show included content nowadays. (Not perfect, but a lot better than before.)

* This should have been removed a long time ago.
2025-04-28 12:39:28 +02:00
Felix Fontein
278dcc5dda Release 2.26.1. 2025-04-28 11:51:52 +02:00
Felix Fontein
04a0d38e3b Do not supply passphrase when killing keyslot. (#868) 2025-04-27 22:19:12 +02:00
Felix Fontein
ac134ee5f5 Prepare 2.26.1. 2025-04-27 12:37:24 +02:00
Felix Fontein
154f3c6cd7 Add no_log=False to passphrase_encoding. 2025-04-26 14:12:19 +02:00
Felix Fontein
e58fe63dde Release 2.26.0. 2025-03-11 20:09:02 +01:00
Felix Fontein
0d1f260328 Prepare 2.26.0. 2025-03-10 21:53:06 +01:00
Florian Apolloner
ba55ba7381 openssl_pkcs12: Add support for certificate_content and other_certificates_content (#848)
* openssl_pkcs12: Add support for `certificate_content` and `other_certificates_content`

Co-authored-by: Felix Fontein <felix@fontein.de>

* Added minimal tests.

The tests are minimal because internally it always ends up with the
_content variants, so even when supplying a file most of the internal
code paths then use the content.

---------

Co-authored-by: Felix Fontein <felix@fontein.de>
2025-03-10 21:44:31 +01:00
Felix Fontein
2a99218162 Release 2.25.0. 2025-02-09 19:29:41 +01:00
Felix Fontein
e1763e22ae Prepare 2.25.0 release. 2025-02-09 14:25:42 +01:00
ilia-kats
2433fdab98 luks_device: allow passphrases to contain newlines (#844)
* luks_device: allow passphrases to contain newlines

This is useful when passing binary keyfiles from an ansible vault, as
it removes the restriction that the binary data cannot contain newlines.
The only exception is adding a new key to an existing container, as in
that case the two passphrases are separated by a new line.

* add integration tests and a changelog fragment

* attempt to also make luks_add_key work with passphrases containing
newlines

* use a deterministic method to generate keyfile 3, improve changelog
formatting

* add licence and copyright to keyfile3.txt to satisfy CI
2025-02-09 14:24:16 +01:00
Felix Fontein
3d4c5346c6 Release 2.24.0. 2025-01-19 13:03:31 +01:00
Felix Fontein
bf70f8d717 Prepare 2.24.0. 2025-01-18 11:25:37 +01:00
Felix Fontein
214794d056 acme_certificate and acme_certificate_create_order: add order_creation_error_strategy and order_creation_max_retries options (#842)
* Provide error information.

* Add helper function for order creation retrying.

* Improve existing documentation.

* Document 'replaces' return value.

* Add order_creation_error_strategy and order_creation_max_retries options.

* Add changelog fragment.

* Fix authz deactivation for finalizing step.

* Fix profile handling on order creation.

* Improve existing tests.

* Add ARI and profile tests.

* Warn when 'replaces' is removed when retrying to create an order.
2025-01-18 10:51:10 +01:00
Felix Fontein
b9fa5b5193 Deprecate ansible-core < 2.17 and cryptography < 3.4. (#839) 2025-01-17 21:27:01 +00:00
Felix Fontein
01e7bf1f33 acme_certificate_renewal_info: add treat_parsing_error_as_non_existing option and existing and parsable return values (#838)
* Fix error reporting for OpenSSL backend: raise BackendExceptions instead of directly failing the module.

* Add treat_parsing_error_as_non_existing option and existing and parsable return values.
2025-01-12 21:42:24 +01:00
Felix Fontein
2419e6c6ad Implement profile option. (#835) 2025-01-12 10:24:24 +01:00
Felix Fontein
029e009db1 CI: Add Fedora 41, Alpine 3.21, RHEL 9.5, FreeBSD 14.2 to CI for devel (#834)
* Add Fedora 41, Alpine 3.21, RHEL 9.5, FreeBSD 14.2 to CI for devel.

* Fedora 41 also doesn't allow SHA-1 apparently.

Ref: https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer

* Work around broken cryptography in Fedora 41.
2025-01-08 22:08:18 +01:00
Felix Fontein
95886d1cf9 Release 2.23.0. 2024-12-30 22:04:25 +01:00
Felix Fontein
9b53f4b382 Prepare 2.23.0 release. 2024-12-30 21:17:40 +01:00
Felix Fontein
0d4b16aadb acme_certificate: be nicer to non-compliant CAs (#832)
* Be nicer to non-compliant CAs.

* Mark as a feature, not a bugfix.
2024-12-30 10:30:33 +00:00
Felix Fontein
db04914ab6 Deprecate PyOpenSSL. (#831) 2024-12-30 10:10:10 +01:00
Felix Fontein
abb0d67774 Add validation option. (#830) 2024-12-30 10:09:51 +01:00
Felix Fontein
05c442ab5e luks_device: allow to provide passphrases base64-encoded (#829)
* Allow to provide passphrases base64-encoded.

* Add note on binary passphrases.
2024-12-30 10:09:32 +01:00
Felix Fontein
7adca3efff Release 2.22.3. 2024-10-27 08:49:30 +01:00
Felix Fontein
6731b38baa Explicitly use UTC timezone in ACME OpenSSL backend (#811)
* Allow abstract backend class to handle both with and without timezone.

* Explicitly use UTC timezone in OpenSSL backend code.
2024-10-27 08:13:05 +01:00
Felix Fontein
feee571bc8 Fix time code to work in timezones other than UTC, and add tests in multiple timezones (#810)
* Add tests in multiple timezones.

* Fix get_epoch_seconds() for timestamps without timezones.

* Add changelog fragment.

* Pin version for Python 2.6.
2024-10-24 20:24:55 +02:00