189 Commits

Author SHA1 Message Date
Felix Fontein
056ae1cf69 acme_account: check for 'externalAccountRequired' error (#919)
* Check for 'externalAccountRequired' error.

* Add changelog fragment.
2025-06-12 22:41:07 +02:00
Felix Fontein
d83a923325 Ensure that *everything* is typed in community.crypto (#917)
* Ensure that *everything* is typed in community.crypto.

* Fix comment.

* Ignore type definitions/imports and AssertionErrors for code coverage.
2025-06-09 10:10:19 +02:00
Felix Fontein
e90d4d2b0f Improve type hinting. (#914) 2025-06-08 20:48:58 +02:00
Felix Fontein
f68b0d0c08 Improve type hints. (#913) 2025-06-01 21:33:20 +02:00
Felix Fontein
576a06b5b2 Remove no longer needed backend abstractions. (#912) 2025-06-01 09:07:06 +02:00
Felix Fontein
82522fc07f Improve typing (#911)
* Make type checking more strict.

* mypy: warn about unreachable code.

* Enable warn_redundant_casts.

* Enable strict_bytes.

* Look at some warn_return_any warnings.
2025-05-31 10:25:55 +02:00
Felix Fontein
6d273bc5b7 Fix invalid-name issues. (#909) 2025-05-30 23:06:24 +02:00
Felix Fontein
31933955e3 CSR: avoid access of private attributes (#910)
* Avoid access of private attributes.

* Add changelog.
2025-05-30 22:46:39 +02:00
Felix Fontein
52b21b5177 Fix/improve typing. (#905) 2025-05-29 23:10:35 +02:00
Felix Fontein
b8adc3b241 Use ruff format, and then undo most changes with black and isort. (#903) 2025-05-24 08:30:31 +02:00
Felix Fontein
43ea6148df Remove Entrust modules and certificate providers (#900)
* Remove Entrust modules and certificate providers.

* Add more information on Entrust removal.

* Remove Entrust content from ignore.txt files.

* Work around bug in ansible-test.
2025-05-22 19:08:48 +00:00
Felix Fontein
7294841a28 Replace to_native with to_text. (#897) 2025-05-18 01:31:33 +02:00
Felix Fontein
318462fa24 Work on issues found by pylint (#896)
* Look at possibly-used-before-assignment.

* Use latest beta releases of ansible-core 2.19 for mypy and pylint.

* Look at unsupported-*.

* Look at unknown-option-value.

* Look at redefined-builtin.

* Look at superfluous-parens.

* Look at unspecified-encoding.

* Adjust to new cryptography version and to ansible-core 2.17's pylint.

* Look at super-with-arguments.

* Look at no-else-*.

* Look at try-except-raise.

* Look at inconsistent-return-statements.

* Look at redefined-outer-name.

* Look at redefined-argument-from-local.

* Look at attribute-defined-outside-init.

* Look at unused-variable.

* Look at protected-access.

* Look at raise-missing-from.

* Look at arguments-differ.

* Look at useless-suppression and use-symbolic-message-instead.

* Look at consider-using-dict-items.

* Look at consider-using-in.

* Look at consider-using-set-comprehension.

* Look at consider-using-with.

* Look at use-dict-literal.
2025-05-18 00:57:28 +02:00
Felix Fontein
a3a5284f97 Add basic typing for Entrust code. (#894) 2025-05-17 17:43:50 +02:00
Felix Fontein
990b40df3e Add pylint (#892)
* Move mypy/flake8/isort config files to more 'natural' places.

* Add pylint.

* Look at no-member.

* Look at pointless-* and unnecessary-pass.

* Look at useless-*.

* Lint.
2025-05-17 16:45:37 +02:00
Felix Fontein
56f004dc63 More refactorings (#890)
* Improve typing.

* Improve version parameter validation for x509_certificate* modules.

* Use utils for parsing retry-after.
2025-05-16 21:53:18 +02:00
Felix Fontein
44bcc8cebc Code refactoring (#889)
* Add __all__ to all module and plugin utils.

* Convert quite a few positional args to keyword args.

* Avoid Python 3.8+ syntax.
2025-05-16 06:55:57 +02:00
Felix Fontein
a5a4e022ba Make all module_utils and plugin_utils private (#887)
* Add leading underscore. Remove deprecated module utils.

* Document module and plugin utils as private. Add changelog fragment.

* Convert relative to absolute imports.

* Remove unnecessary imports.
2025-05-11 19:17:58 +02:00
Felix Fontein
f758d94fba Add type hints and type checking (#885)
* Enable basic type checking.

* Fix first errors.

* Add changelog fragment.

* Add types to module_utils and plugin_utils (without module backends).

* Add typing hints for acme_* modules.

* Add typing to X.509 certificate modules, and add more helpers.

* Add typing to remaining module backends.

* Add typing for action, filter, and lookup plugins.

* Bump ansible-core 2.19 beta requirement for typing.

* Add more typing definitions.

* Add typing to some unit tests.
2025-05-11 18:00:11 +02:00
Felix Fontein
12f958c955 Fix assert_required_cryptography_version() calls. 2025-05-03 12:55:50 +02:00
Felix Fontein
83beb7148c Remove six usages. (#884) 2025-05-03 11:12:29 +02:00
Felix Fontein
645b7bf9ed Get rid of backend parameter whenever possible (#883)
* Get rid of backend parameter whenever possible.

* Always auto-detect if backend choices are 'cryptography' and 'auto', resp. always check cryptography version.

* Improve error message.

* Update documentation.
2025-05-03 10:46:53 +02:00
Felix Fontein
fbcb89f092 Support cryptography 3.3 (#882)
* Re-add Debian Bullseye to CI.

* Support cryptography 3.3 as well.
2025-05-02 21:42:06 +02:00
Felix Fontein
86db561193 Get rid of some to_native and to_text calls. (#880) 2025-05-02 15:58:39 +02:00
Felix Fontein
5231ac8f3f Remove support for cryptography < 3.4 (#878)
* Stop passing backend to cryptography.

* Make public_bytes() fallback the default.

* Remove compatibility code for older cryptography versions.

* Require cryptography 3.4+.

* Restrict to cryptography >= 3.4 in integration tests.

* Remove Debian Bullseye from CI.

It only supports cryptography 3.3.

* Improve imports.

* Remove no longer existing conditional.
2025-05-02 15:27:18 +02:00
Felix Fontein
65872e884f Remove Python 2 specific code (#877)
* Get rid of Python 2 special handling.

* Get rid of more Python 2 specific handling.

* Stop using six.

* ipaddress is part of the standard library since Python 3.

* Add changelog.

* Fix import.

* Remove unneeded imports.
2025-05-01 16:21:13 +02:00
Felix Fontein
641e63b08c Replace % and str.format() with f-strings (#875)
* Replace % and str.format() with f-strings.

* Apply suggestions from review.
2025-05-01 11:50:10 +02:00
Felix Fontein
d8f838c365 Modernize some Python constructs (#876)
* Update __future__ import, remove __metaclass__ assignment.

* Removing obsolete encoding comment.

* Remove unneccessary object inheritance.
2025-05-01 10:36:59 +02:00
Felix Fontein
266082db72 Remove more traces of PyOpenSSL, including from EE dependencies (#874)
* Remove PyOpenSSL backends.

* Remove EOL ansible-core's from EE builds.

* Update Pythons in EEs.

* Remove pyopenssl tests.
2025-04-29 09:33:21 +02:00
Felix Fontein
d368d1943d Bump version to 3.0.0-dev0, remove deprecated functionality and implement announced breaking changes (#873)
* Bump verison to 3.0.0-dev0.

* Change check mode behavior for *_pipe modules.

* Remove PyOpenSSL backend.

* Remove PyOpenSSL setup.

* Change default of asn1_base64.

* Remove deprecated common module utils.

* Remove get_default_argspec().

* Mark two methods as abstract.

* Remove ACME v1 support.

* Remove retrieve_acme_v1_certificate().

* Remove deprecated docs fragment.

* Change meaning of mode parameter.

* Mark no longer used option as 'to deprecate'.
2025-04-29 08:12:44 +02:00
Felix Fontein
797bd8a6e2 Reformat again with black, this time without Python 2 workarounds. 2025-04-28 20:34:38 +02:00
Felix Fontein
23de865563 Unvendor distutils.version (#371)
* Unvendor distutils.version.

* Fix version.

* Assume the collection requires ansible-core 2.12+.

This is valid since this only get merged for 3.0.0, which
will drop support for quite a few more ansible-core versions.

* Mark for re-export.
2025-04-28 14:30:37 +02:00
Felix Fontein
aec1826c34 Reformat everything with black.
I had to undo the u string prefix removals to not drop Python 2 compatibility.
That's why black isn't enabled in antsibull-nox.toml yet.
2025-04-28 10:48:00 +02:00
Felix Fontein
aa9e7b6dfb Add isort and flake8 to CI (#869)
* Run isort.

* Clean up unused assignments.

* Add flake8 linting step.
2025-04-27 22:18:29 +02:00
Felix Fontein
a1669d490f CI: Remove usage of ubuntu-20.04, add FreeBSD 13.5 (#853)
* Switch from ubuntu-20.04 to ubuntu-latest for old Ansible versions.

* [TEMP] Change to trigger full CI.

* Add FreeBSD 13.5.
2025-03-12 07:24:02 +01:00
Felix Fontein
3951e6ceb4 Include cert ID in warning.
This prevents the warning to be not shown for different certificates
in the same playbook due to warning de-duplication.
2025-01-19 08:58:49 +01:00
Felix Fontein
214794d056 acme_certificate and acme_certificate_create_order: add order_creation_error_strategy and order_creation_max_retries options (#842)
* Provide error information.

* Add helper function for order creation retrying.

* Improve existing documentation.

* Document 'replaces' return value.

* Add order_creation_error_strategy and order_creation_max_retries options.

* Add changelog fragment.

* Fix authz deactivation for finalizing step.

* Fix profile handling on order creation.

* Improve existing tests.

* Add ARI and profile tests.

* Warn when 'replaces' is removed when retrying to create an order.
2025-01-18 10:51:10 +01:00
Felix Fontein
01e7bf1f33 acme_certificate_renewal_info: add treat_parsing_error_as_non_existing option and existing and parsable return values (#838)
* Fix error reporting for OpenSSL backend: raise BackendExceptions instead of directly failing the module.

* Add treat_parsing_error_as_non_existing option and existing and parsable return values.
2025-01-12 21:42:24 +01:00
Felix Fontein
49354f2121 Add new ACME modules for working with orders. (#757) 2025-01-12 17:10:58 +01:00
Felix Fontein
248250514f Fix profile implementation. 2025-01-12 13:57:17 +01:00
Felix Fontein
2419e6c6ad Implement profile option. (#835) 2025-01-12 10:24:24 +01:00
Felix Fontein
0d4b16aadb acme_certificate: be nicer to non-compliant CAs (#832)
* Be nicer to non-compliant CAs.

* Mark as a feature, not a bugfix.
2024-12-30 10:30:33 +00:00
Felix Fontein
2ed7f69b83 Improve language. 2024-12-28 14:30:08 +01:00
Felix Fontein
6731b38baa Explicitly use UTC timezone in ACME OpenSSL backend (#811)
* Allow abstract backend class to handle both with and without timezone.

* Explicitly use UTC timezone in OpenSSL backend code.
2024-10-27 08:13:05 +01:00
Felix Fontein
feee571bc8 Fix time code to work in timezones other than UTC, and add tests in multiple timezones (#810)
* Add tests in multiple timezones.

* Fix get_epoch_seconds() for timestamps without timezones.

* Add changelog fragment.

* Pin version for Python 2.6.
2024-10-24 20:24:55 +02:00
Lyas Spiehler
a39b3bc882 lookup lowercase domain names when verifying authorizations to preven… (#803)
* lookup lowercase domain names when verifying authorizations to prevent failure when CSR has mixed-case names

Signed-off-by: Lyas Spiehler <lspiehler@gmail.com>

* remove .lower() method

* make authorizations keys lowercase

Signed-off-by: Lyas Spiehler <lspiehler@gmail.com>

* use lowercase keys for authorizations dict

Signed-off-by: Lyas Spiehler <lspiehler@gmail.com>

* use new normalize_combined_identifier function to normalize identifiers

* include two blank lines after functions to pass tests

* Update plugins/module_utils/acme/challenges.py

Co-authored-by: Felix Fontein <felix@fontein.de>

* add changelog fragment

Signed-off-by: Lyas Spiehler <lspiehler@gmail.com>

* Update changelogs/fragments/803-fix-authorization-failure-with-mixed-case-sans.yml

Co-authored-by: Felix Fontein <felix@fontein.de>

---------

Signed-off-by: Lyas Spiehler <lspiehler@gmail.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
2024-10-15 19:48:47 +02:00
Felix Fontein
db871c2686 Pass absolute paths to atmoic_move(). (#799) 2024-10-01 21:55:00 +03:00
Felix Fontein
5a2dff7b74 Make sure that the required slash is present. (#802) 2024-09-29 21:26:31 +03:00
Felix Fontein
a49711d383 openssl_privatekey*: add default value for cipher option (#794)
* Add default value for 'cipher' option.
* Adjust tests.
* Add changelog fragment.
* Clarify that cipher is used only when passphrase is provided.
2024-08-30 08:49:20 +01:00
Felix Fontein
cb3f55076e Support InvalidityDate.invalidity_date_utc. (#730) 2024-07-21 13:04:13 +02:00