mirror of
https://github.com/ansible/ansible.git
synced 2026-08-03 08:03:05 +02:00
David ShrewsburyandGitHub
2341354ffa
* Replace gpg in rpm_key with librpm * Manually compute primary key ID and fingerprint for older librpm * Code cleanup * Add some v6 tests * Add rhel 10.1 to CI matrix and changelog * Remove RHEL 10.0 * consolidate common code and rename unused vars * remove unnecessary exception raise * Fix return type * review comments: change import and use of Optional * ci_complete ci_coverage * address review comments * When checking for existing keys, account for short from key ID and revert test change that hid this * Support RPM version 6+. Allow 'key' to be fingerprint. * Replace v6 test key with non-PQC algo version and enable Fedora v6 tests * modify changelog, mod doc, and del 10.1 test req * Code refactor and new tests Refactor code to not need to use librpm API to get list of installed keys. Also add new tests to verify deleting by fingerprint. * Refactor drop_key() by rpm version, fully type hint code * use hexdigest()
37 lines
1.0 KiB
YAML
37 lines
1.0 KiB
YAML
- when: ansible_os_family == "RedHat"
|
|
block:
|
|
|
|
- name: List the installed GPG keys
|
|
shell: rpm -q gpg-pubkey | sort
|
|
register: list_of_pubkeys
|
|
|
|
- name: Retrieve the installed GPG keys
|
|
command: rpm -q --qf %{description} gpg-pubkey
|
|
register: pubkeys
|
|
|
|
- name: Save the retrieved GPG keys to a file
|
|
copy:
|
|
content: "{{ pubkeys['stdout'] }}"
|
|
dest: "{{ remote_tmp_dir + '/pubkeys' }}"
|
|
mode: 0600
|
|
|
|
- include_tasks: rpm_key.yaml
|
|
|
|
always:
|
|
|
|
# This will fail if the tests leave no keys in the key store
|
|
- name: Remove all GPG keys from key ring
|
|
shell: rpm -q gpg-pubkey | xargs rpm -e
|
|
ignore_errors: yes
|
|
|
|
- name: Restore the previously installed GPG keys
|
|
command: rpm --import {{ (remote_tmp_dir + '/pubkeys') | quote }}
|
|
|
|
- name: List the installed GPG keys
|
|
shell: rpm -q gpg-pubkey | sort
|
|
register: new_list_of_pubkeys
|
|
|
|
- name: Verify the GPG keys have been restored
|
|
assert:
|
|
that: list_of_pubkeys["stdout"] == new_list_of_pubkeys["stdout"]
|