관리-도구
편집 파일: apt_key.cpython-39.pyc
a �)g�E � @ s� d dl mZmZmZ eZdZdZdZd dl Z d dl m Z d dl m Z d dlmZ d d lmZ d d lmZ dadadZd d � Zd d� Zdd� Zdd� Zd)dd�Zdd� Z dd� Z dd� Z d*d d �Z d d � Z d d!� Z!d+d"d#�Z"d$d%� Z#d&d'� Z$e%d(kr�e$� dS ),� )�absolute_import�division�print_functiona� --- module: apt_key author: - Jayson Vantuyl (@jvantuyl) version_added: "1.0" short_description: Add or remove an apt key description: - Add or remove an I(apt) key, optionally downloading it. extends_documentation_fragment: action_common_attributes attributes: check_mode: support: full diff_mode: support: none platform: platforms: debian notes: - The apt-key command has been deprecated and suggests to 'manage keyring files in trusted.gpg.d instead'. See the Debian wiki for details. This module is kept for backwards compatibility for systems that still use apt-key as the main way to manage apt repository keys. - As a sanity check, downloaded key id must match the one specified. - "Use full fingerprint (40 characters) key ids to avoid key collisions. To generate a full-fingerprint imported key: C(apt-key adv --list-public-keys --with-fingerprint --with-colons)." - If you specify both the key id and the URL with C(state=present), the task can verify or add the key as needed. - Adding a new key requires an apt cache update (e.g. using the M(ansible.builtin.apt) module's update_cache option). requirements: - gpg options: id: description: - The identifier of the key. - Including this allows check mode to correctly report the changed state. - If specifying a subkey's id be aware that apt-key does not understand how to remove keys via a subkey id. Specify the primary key's id instead. - This parameter is required when C(state) is set to C(absent). type: str data: description: - The keyfile contents to add to the keyring. type: str file: description: - The path to a keyfile on the remote server to add to the keyring. type: path keyring: description: - The full path to specific keyring file in C(/etc/apt/trusted.gpg.d/). type: path version_added: "1.3" url: description: - The URL to retrieve key from. type: str keyserver: description: - The keyserver to retrieve key from. type: str version_added: "1.6" state: description: - Ensures that the key is present (added) or absent (revoked). type: str choices: [ absent, present ] default: present validate_certs: description: - If C(false), SSL certificates for the target url will not be validated. This should only be used on personally controlled sites using self-signed certificates. type: bool default: 'yes' ah - name: One way to avoid apt_key once it is removed from your distro block: - name: somerepo |no apt key ansible.builtin.get_url: url: https://download.example.com/linux/ubuntu/gpg dest: /etc/apt/trusted.gpg.d/somerepo.asc - name: somerepo | apt source ansible.builtin.apt_repository: repo: "deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/myrepo.asc] https://download.example.com/linux/ubuntu {{ ansible_distribution_release }} stable" state: present - name: Add an apt key by id from a keyserver ansible.builtin.apt_key: keyserver: keyserver.ubuntu.com id: 36A1D7869245C8950F966E92D8576A8BA88D21E9 - name: Add an Apt signing key, uses whichever key is at the URL ansible.builtin.apt_key: url: https://ftp-master.debian.org/keys/archive-key-6.0.asc state: present - name: Add an Apt signing key, will not download if present ansible.builtin.apt_key: id: 9FED2BCBDCD29CDF762678CBAED4B06F473041FA url: https://ftp-master.debian.org/keys/archive-key-6.0.asc state: present - name: Remove a Apt specific signing key, leading 0x is valid ansible.builtin.apt_key: id: 0x9FED2BCBDCD29CDF762678CBAED4B06F473041FA state: absent # Use armored file since utf-8 string is expected. Must be of "PGP PUBLIC KEY BLOCK" type. - name: Add a key from a file on the Ansible server ansible.builtin.apt_key: data: "{{ lookup('ansible.builtin.file', 'apt.asc') }}" state: present - name: Add an Apt signing key to a specific keyring file ansible.builtin.apt_key: id: 9FED2BCBDCD29CDF762678CBAED4B06F473041FA url: https://ftp-master.debian.org/keys/archive-key-6.0.asc keyring: /etc/apt/trusted.gpg.d/debian.gpg - name: Add Apt signing key on remote server to keyring ansible.builtin.apt_key: id: 9FED2BCBDCD29CDF762678CBAED4B06F473041FA file: /tmp/apt.gpg state: present a� after: description: List of apt key ids or fingerprints after any modification returned: on change type: list sample: ["D8576A8BA88D21E9", "3B4FE6ACC0B21F32", "D94AA3F0EFE21092", "871920D1991BC93C"] before: description: List of apt key ids or fingprints before any modifications returned: always type: list sample: ["3B4FE6ACC0B21F32", "D94AA3F0EFE21092", "871920D1991BC93C"] fp: description: Fingerprint of the key to import returned: always type: str sample: "D8576A8BA88D21E9" id: description: key id from source returned: always type: str sample: "36A1D7869245C8950F966E92D8576A8BA88D21E9" key_id: description: calculated key id, it should be same as 'id', but can be different returned: always type: str sample: "36A1D7869245C8950F966E92D8576A8BA88D21E9" short_id: description: calculated short key id returned: always type: str sample: "A88D21E9" N)� format_exc)� to_native)� AnsibleModule)�get_best_parsable_locale)� fetch_urlc C s( t td�s"t| �}t|||d�t_tjS )N�result)�LANG�LC_ALL� LC_MESSAGES)�hasattr�lang_envr �dictr )�module�locale� r �;/usr/lib/python3.9/site-packages/ansible/modules/apt_key.pyr � s r c C s | j ddd�a| j ddd�ad S )Nzapt-keyT)�requiredZgpg)Z get_bin_path� apt_key_bin�gpg_bin)r r r r �find_needed_binaries� s r c C s2 dD ]}t j�|�}|r q q|r.| d| 7 } | S )N)Z HTTPS_PROXYZ https_proxyZ HTTP_PROXYZ http_proxyz" --keyserver-options http-proxy=%s)�os�environ�get)�cmdZenvvar�proxyr r r �add_http_proxy� s r c C s� t t| �d� | �� } | �d�r,| dd� } t| �}|dkrT|dkrT|dkrTtd��| dd� }| }|dkrx| dd� }||| fS ) a� validate the key_id and break it into segments :arg key_id: The key_id as supplied by the user. A valid key_id will be 8, 16, or more hexadecimal chars with an optional leading ``0x``. :returns: The portion of key_id suitable for apt-key del, the portion suitable for comparisons with --list-public-keys, and the portion that can be used with --recv-key. If key_id is long enough, these will be the last 8 characters of key_id, the last 16 characters, and all of key_id. If key_id is not long enough, some of the values will be the same. * apt-key del <= 1.10 has a bug with key_id != 8 chars * apt-key adv --list-public-keys prints 16 chars * apt-key adv --recv-key can take more chars � Z0X� N� z=key_id must be 8, 16, or 16+ hexadecimal characters in length���i�)�intr �upper� startswith�len� ValueError)�key_idZ key_id_len� short_key_id� fingerprintr r r � parse_key_id� s r+ Fc C s� g }t | ��d�}|D ]�}|�d�s.|�d�rd|vrz"|�� }|d }|�d�\}}W nJ ttfy� z|�d�}|d }W n ttfy� Y Y qY n0 Y n0 |�|� q|r�|r�t|�}|S ) N� Zpub�subZexpired� �/�:� )r �splitr% � IndexErrorr' �append�shorten_key_ids) �output� short_format�found�lines�line�tokens�codeZlen_typeZ real_coder r r �parse_output_for_keys� s$ r= c C sT |d urdt |f }ndt }| �|�\}}}|dkrJ| jd||||d� t||�S )Nz:%s --keyring %s adv --list-public-keys --keyid-format=longz-%s adv --list-public-keys --keyid-format=longr zUnable to list public keys��msgr �rc�stdout�stderr)r � run_command� fail_jsonr= )r �keyringr7 r r@ �out�errr r r �all_keys s rH c C s$ g }| D ]}|� |dd� � q|S )z| Takes a list of key ids, and converts them to the 'short' format, by reducing them to their last 8 characters. r" N)r4 )Z key_id_listZshort�keyr r r r5 " s r5 c C sl z@t | |dd�\}}|d dkr8| jd||d f d� |�� W S tyf | jd| t� d � Y n0 d S ) NT)Z use_proxy�status�� z Failed to download key at %s: %sr? �r? z!error getting key id from url: %s)r? � traceback)r rD �read� Exceptionr )r �urlZrsp�infor r r � download_key- s rR c C s� t |�}|�d�dk}d }td|g}| j|t| �|r8|n|| d�\}}} |dkrr| jd|d urddn| || d� t|�} | r�| d }|S )Nz$-----BEGIN PGP PUBLIC KEY BLOCK-----r z --with-colons)�environ_update�data� binary_dataz Unable to extract key from '%s'z inline data)r? rA rB )r �findr rC r rD r= ) r �filenamerT Z native_dataZ is_armoredrI r r@ rF rG �keysr r r �get_key_id_from_file: s & rY c C s t | d|�S )N�-)rY )r rT r r r �get_key_id_from_dataO s r[ c C s� |rdt ||f }n dt |f }t|�}d||f }td�D ](}| j|t| �d�\}}}|dkr< q�q<|dkr�d|v r�d ||f } | j|| t| �d � n&d ||f } | j|| t| �|||d � d S )Nz+%s --keyring %s adv --no-tty --keyserver %sz %s adv --no-tty --keyserver %sz %s --recv %s� )rS r r znot found on keyserverz Key %s not found on keyserver %s)r r? �forced_environmentz(Error fetching key %s from keyserver: %s)r r? r] r@ rA rB T)r r �rangerC r rD ) r rE � keyserverr( r Zretryr@ rF rG r? r r r � import_keyS s r` c C s� |d urV|rdt |f }ndt }| j||dd�\}}}|dkr�| jd||||d� nR|rjdt ||f }n d t |f }| �|�\}}}|dkr�| jd | |||||d � dS ) Nz%s --keyring %s add -z%s add -T)rT rU r z$Unable to add a key from binary datar> z%s --keyring %s add %sz %s add %sz Unable to add a key from file %s)r? r r@ �keyfilerA rB �r rC rD )r ra rE rT r r@ rF rG r r r �add_keyo s6 � �rc c C sV |rdt ||f }n dt |f }| �|�\}}}|dkrR| jd| |||||d� dS )Nz%s --keyring %s del %sz %s del %sr z!Unable to remove a key with id %s)r? r r@ r( rA rB Trb )r r( rE r r@ rF rG r r r � remove_key� s �rd c C sX t ttdd�tdd�tdd�tdd�tdd�tddd�tdd�tddddgd �d �dd d �} | jd }| jd }| jd }| jd }| jd }| jd }| jd }d}d } d } d} t| � ddi} |�s|r�| jdd� |r�t| |�}|r�t| |�}n|�rt| |�}|| d < z*t|�\} } }| | d< | | d< || d< W n( t �y` | jf d d i| �� Y n0 | �s|| jf d d i| �� t |�d k�r�d}t | ||� | d < } g }|dk�r�|�r�| | v�s�|�sD| | v�rDd| d< | j �sD|�r�t | ||� n`|�r t| |||� nJ|�r t | d!||� n4|�r@t| |�}t | d!||� n| jf d d"i| �� t | ||� | d#< }|�rx| |v�s�|�sD| |v�rD| jf d | d$ i| �� n�|dk�rD|�s�| jf d d%i| �� | | v �rDd| d< | j �sD| d u�r0t| | |��r0t | ||� | d#< }| |v �rD| jf d | d& i| �� n| jf d d'i| �� | jf i | �� d S )(N�str)�type�path�boolT)rf �defaultZpresentZabsent)rf ri �choices)�idrP rT �filerE Zvalidate_certsr_ �state))rT rl r_ rP )Z argument_specZsupports_check_modeZmutually_exclusiverk rP rT rl rE rm r_ FzYapt-key did not return an error, but %s (check that the id is correct and *not* a subkey)Zchangedz(Missing key_id, required with keyserver.rL Zshort_id�fpr( r? zInvalid key_idz`Unable to continue as we could not extract a valid fingerprint to compare against existing keys.r! �beforerZ z(No key to add ... how did i get here?!?!Zafterzfailed to add the keyz key is required to remove a keyzthe key was not removedzerror removing key_id)r r �paramsr rD rR rY r[ r+ r' r& rH Z check_moderc r` rd Z exit_json)r r( rP rT rW rE rm r_ r7 r) r* Zerror_no_error�rrX Zkeys2r r r �main� s� � � rr �__main__)F)N)N)&Z __future__r r r rf Z __metaclass__Z DOCUMENTATIONZEXAMPLESZRETURNr rM r Zansible.module_utils._textr Zansible.module_utils.basicr Z"ansible.module_utils.common.localer Zansible.module_utils.urlsr r r r r r r r+ r= rH r5 rR rY r[ r` rc rd rr �__name__r r r r �<module> s: G5! % !o