o nnh!@sddlmZdZdZdZddlZddlZddlZddl m Z ddl m Z ddl mZd d ZGd d d eZd dZedkrCedSdS)) annotationsa --- module: rpm_key author: - Hector Acosta (@hacosta) short_description: Adds or removes a gpg key from the rpm db description: - Adds or removes (rpm --import) a gpg key to your rpm database. version_added: "1.3" options: key: description: - Key that will be modified. Can be a url, a file on the managed node, or a keyid if the key already exists in the database. type: str required: true state: description: - If the key will be imported or removed from the rpm db. type: str default: present choices: [ absent, present ] validate_certs: description: - If V(false) and the O(key) is a url starting with V(https), SSL certificates will not be validated. - This should only be used on personally controlled sites using self-signed certificates. type: bool default: 'yes' fingerprint: description: - The long-form fingerprint of the key being imported. - This will be used to verify the specified key. type: str version_added: 2.9 extends_documentation_fragment: - action_common_attributes attributes: check_mode: support: full diff_mode: support: none platform: platforms: rhel a - name: Import a key from a url ansible.builtin.rpm_key: state: present key: http://apt.sw.be/RPM-GPG-KEY.dag.txt - name: Import a key from a file ansible.builtin.rpm_key: state: present key: /path/to/key.gpg - name: Ensure a key is not present in the db ansible.builtin.rpm_key: state: absent key: DEADB33F - name: Verify the key, using a fingerprint, before import ansible.builtin.rpm_key: key: /path/to/RPM-GPG-KEY.dag.txt fingerprint: EBC6 E12C 62B1 C734 026B 2122 A20E 5214 6B8D 79E6 #N) AnsibleModule) fetch_url) to_nativecCs d}tt|t|ddtjS)zVerifies if string is a pubkeyzP.*?(-----BEGIN PGP PUBLIC KEY BLOCK-----.*?-----END PGP PUBLIC KEY BLOCK-----).*surrogate_or_strict)errors)boolrematchrDOTALL)string pgp_regexrB/usr/local/lib/python3.10/dist-packages/ansible/modules/rpm_key.py is_pubkeyZsrc@s\eZdZddZddZddZddZd d Zd d Zd dZ ddZ ddZ ddZ dS)RpmKeyc Csd}d}||_|jdd|_|jd}|jd}|jd}|r(|dd}|jd |_|js;|jjd dd |_d |vrL||}||}d}n| |rT|}nt j |rb|}||}n |jj d |d||}|dkr||r|jdddS|s|jj dd|r||}||kr|jj d||fd|||r|j||jdddS||r|||jdddS|jdddS)NFrpmTstatekey fingerprint gpggpg2)requiredz://zNot a valid key %smsgpresent)changedz0When importing a key, a valid file must be givenzHThe specified fingerprint, '%s', does not match the key fingerprint '%s')module get_bin_pathrparamsreplaceupperr fetch_keygetkeyidis_keyidospathisfile fail_jsonnormalize_keyidis_key_imported exit_jsongetfingerprint import_keycleanupdrop_key) selfr keyfileshould_cleanup_keyfilerrrkeyidhas_fingerprintrrr__init__bsT                zRpmKey.__init__cCst|j|\}}|ddkr|jjd||dfd|}t|s,|jjd|dt\}}|j|t |d}| || |S)z;Downloads a key from url, returns a valid path to a gpg keystatusz)failed to fetch key at %s , error was: %srrzNot a public key: %szw+b) rr r+readrtempfilemkstempadd_cleanup_filer(fdopenwriteclose)r3urlrspinfortmpfdtmpnametmpfilerrrr%s     zRpmKey.fetch_keycCs<|}|dr|ddS|dr|ddS|S)zhEnsure a keyid doesn't have a leading 0x, has leading or trailing whitespace, and make sure is uppercase0xN0X)stripr$ startswith)r3r6retrrrr,s     zRpmKey.normalize_keyidcCs`||jdddd|g\}}|D]}|}|dr&|ddSq|jjdd dS) N--no-tty--batch --with-colons--fixed-list-modezpub::Unexpected gpg outputrexecute_commandr splitlinesrKrLsplitr r+r3r4stdoutstderrlinerrrr&s  zRpmKey.getkeyidc Csb||jddddd|g\}}|D]}|}|dr'|ddSq|jjd d dS) NrNrOrPrQz--with-fingerprintzfpr:rR rTrrUrYrrrr/s     zRpmKey.getfingerprintcCstjd|tjdS)z5Verifies if a key, as provided by the user is a keyidz(0x)?[0-9a-f]{8})flags)r r IGNORECASE)r3keystrrrrr'szRpmKey.is_keyidcCs4|jj|dd\}}}|dkr|jj|d||fS)NT)use_unsafe_shellrr)r run_commandr+)r3cmdrcrZr[rrrrVszRpmKey.execute_commandcCsr|jd}|j|\}}}|dkrdS|d|jd7}||\}}|D]}||ddvr6dSq(dS) Nz -q gpg-pubkeyrFz --qf "%{description}" | z3 --no-tty --batch --with-colons --fixed-list-mode -rRrST)rr rbrrVrWrX)r3r6rcrdrZr[r\rrrr-s  zRpmKey.is_key_importedcCs"|jjs||jd|gdSdS)Nz--import)r check_moderVr)r3r4rrrr0szRpmKey.import_keyc Cs4|jjs||jddd|ddgdSdS)Nz--erasez --allmatchesz gpg-pubkey-%si)r rerVrlower)r3r6rrrr2s(zRpmKey.drop_keyN) __name__ __module__ __qualname__r8r%r,r&r/r'rVr-r0r2rrrrr`s5   rc CsJtttddddgdtddddtddtd dd d dd }t|dS) Nstrrabsent)typedefaultchoicesTF)rlrno_log)rlr )rlrm)rrrvalidate_certs) argument_specsupports_check_mode)rdictr)r rrrmains   rt__main__) __future__r DOCUMENTATIONEXAMPLESRETURNr os.pathr(r<ansible.module_utils.basicransible.module_utils.urlsr+ansible.module_utils.common.text.convertersrrobjectrrtrgrrrrs" -