Merge b12095af90 into 7e4d5dd7a9

.azure-pipelines/azure-pipelines.yml

@@ -57,21 +57,6 @@ stages:
               test: units
             - name: Lint
               test: lint
-  - stage: Sanity_2_18
-    displayName: Ansible 2.18 sanity
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          nameFormat: "{0}"
-          testFormat: 2.18/{0}
-          targets:
-            - name: Sanity
-              test: sanity
-            - name: Units
-              test: units
-            - name: Lint
-              test: lint
   - stage: Sanity_2_17
     displayName: Ansible 2.17 sanity
     dependsOn: []
@@ -128,20 +113,6 @@ stages:
               test: ubuntu2204
             - name: Ubuntu 24.04
               test: ubuntu2404
-  - stage: Docker_2_18
-    displayName: Docker devel
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.18/linux/{0}/1
-          targets:
-            - name: Fedora 40
-              test: fedora40
-            - name: Ubuntu 22.04
-              test: ubuntu2204
-            - name: Ubuntu 24.04
-              test: ubuntu2404
   - stage: Docker_2_17
     displayName: Docker 2.17
     dependsOn: []
@@ -205,18 +176,6 @@ stages:
               test: rhel/9.4
             - name: FreeBSD 13.3
               test: freebsd/13.3
-  - stage: Remote_2_18
-    displayName: Remote devel
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.18/{0}/1
-          targets:
-            - name: RHEL 9.4
-              test: rhel/9.4
-            - name: FreeBSD 13.3
-              test: freebsd/13.3
   - stage: Remote_2_17
     displayName: Remote 2.17
     dependsOn: []
@@ -275,11 +234,8 @@ stages:
       - Sanity_2_17
       - Remote_2_17
       - Docker_2_17
-      - Sanity_2_18
-      - Remote_2_18
-      - Docker_2_18
       - Sanity_devel
-      # - Remote_devel # Wait for test environment release
+      - Remote_devel
-      # - Docker_devel # Wait for test environment release
+      - Docker_devel
     jobs:
       - template: templates/coverage.yml

README.md

@@ -74,14 +74,11 @@ None
 
 <!-- List the versions of Ansible the collection has been tested with. Must match what is in galaxy.yml. -->
 
-- ansible-core 2.19 (devel)
+- ansible-core 2.18 (devel)
-- ansible-core 2.18 (stable) *
 - ansible-core 2.17 (stable)
 - ansible-core 2.16 (stable)
 - ansible-core 2.15 (stable)
 
-*Note: For ansible-core 2.18, CI only covers sanity tests and no integration tests will be run until the test environment is released.*
-
 ## Roadmap
 
 <!-- Optional. Include the roadmap for this collection, and the proposed release/versioning strategy so users can anticipate the upgrade/update cycle. -->

changelogs/fragments/387_callback_output_header.yml

@@ -1,3 +0,0 @@
----
-minor_changes:
-  - callback plugins - Add recap information to timer, profile_roles and profile_tasks callback outputs (https://github.com/ansible-collections/ansible.posix/pull/387).

changelogs/fragments/568_update_authorized_key.yml

@@ -1,3 +0,0 @@
----
-minor_changes:
-  - authorized_keys - allow using absolute path to a file as a SSH key(s) source (https://github.com/ansible-collections/ansible.posix/pull/568)

changelogs/fragments/570_nfs4_acl.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - acl - Fixed to set ACLs on paths mounted with NFS version 4 correctly (https://github.com/ansible-collections/ansible.posix/issues/240).

changelogs/fragments/571_ci_bump_core_version.yml

@@ -1,3 +0,0 @@
----
-trivial:
-  - Bump ansible-core version to 2.19 of devel branch and add 2.18 to CI.

plugins/callback/profile_roles.py

@@ -128,10 +128,7 @@ class CallbackModule(CallbackBase):
         self._display_tasktime()
 
     def playbook_on_stats(self, stats):
-        # Align summary report header with other callback plugin summary
+        self._display_tasktime()
-        self._display.banner("ROLES RECAP")
-
-        self._display.display(tasktime())
         self._display.display(filled("", fchar="="))
 
         timestamp(self)

plugins/callback/profile_tasks.py

@@ -193,10 +193,7 @@ class CallbackModule(CallbackBase):
         self._display_tasktime()
 
     def playbook_on_stats(self, stats):
-        # Align summary report header with other callback plugin summary
+        self._display_tasktime()
-        self._display.banner("TASKS RECAP")
-
-        self._display.display(tasktime())
         self._display.display(filled("", fchar="="))
 
         timestamp(self)

plugins/callback/timer.py

@@ -46,6 +46,4 @@ class CallbackModule(CallbackBase):
     def v2_playbook_on_stats(self, stats):
         end_time = datetime.utcnow()
         runtime = end_time - self.start_time
-        # Align summary report header with other callback plugin summary
+        self._display.display("Playbook run took %s days, %s hours, %s minutes, %s seconds" % (self.days_hours_minutes_seconds(runtime)))
-        self._display.banner("PLAYBOOK RECAP")
-        self._display.display("Playbook run took %s days, %s hours, %s minutes, %s seconds\n\r" % (self.days_hours_minutes_seconds(runtime)))

plugins/modules/acl.py

@@ -75,10 +75,6 @@ options:
   use_nfsv4_acls:
     description:
     - Use NFSv4 ACLs instead of POSIX ACLs.
-    - This feature uses C(nfs4_setfacl) and C(nfs4_getfacl). The behavior depends on those implementation.
-      And currently it only supports C(A) in ACE, so C(D) must be replaced with the appropriate C(A).
-    - Permission is set as optimised ACLs by the system. You can check the actual ACLs that has been set using the return value.
-    - More info C(man nfs4_setfacl)
     type: bool
     default: false
   recalculate_mask:
@@ -183,7 +179,7 @@ def split_entry(entry):
 def build_entry(etype, entity, permissions=None, use_nfsv4_acls=False):
     '''Builds and returns an entry string. Does not include the permissions bit if they are not provided.'''
     if use_nfsv4_acls:
-        return ':'.join(['A', 'g' if etype == 'group' else '', entity, permissions + 'tcy'])
+        return ':'.join([etype, entity, permissions, 'allow'])
 
     if permissions:
         return etype + ':' + entity + ':' + permissions
@@ -191,27 +187,22 @@ def build_entry(etype, entity, permissions=None, use_nfsv4_acls=False):
     return etype + ':' + entity
 
 
-def build_command(module, mode, path, follow, default, recursive, recalculate_mask, use_nfsv4_acls, entry=''):
+def build_command(module, mode, path, follow, default, recursive, recalculate_mask, entry=''):
     '''Builds and returns a getfacl/setfacl command.'''
     if mode == 'set':
-        cmd = [module.get_bin_path('nfs4_setfacl' if use_nfsv4_acls else 'setfacl', True)]
+        cmd = [module.get_bin_path('setfacl', True)]
-        cmd.extend(['-a' if use_nfsv4_acls else '-m', entry])
+        cmd.extend(['-m', entry])
     elif mode == 'rm':
-        cmd = [module.get_bin_path('nfs4_setfacl' if use_nfsv4_acls else 'setfacl', True)]
+        cmd = [module.get_bin_path('setfacl', True)]
         cmd.extend(['-x', entry])
     else:  # mode == 'get'
         cmd = [module.get_bin_path('getfacl', True)]
         # prevents absolute path warnings and removes headers
         if platform.system().lower() == 'linux':
-            if use_nfsv4_acls:
-                # use nfs4_getfacl instead of getfacl if use_nfsv4_acls is True
-                cmd = [module.get_bin_path('nfs4_getfacl', True)]
-            else:
-                cmd = [module.get_bin_path('getfacl', True)]
-                cmd.append('--absolute-names')
             cmd.append('--omit-header')
+            cmd.append('--absolute-names')
 
-    if recursive and not use_nfsv4_acls:
+    if recursive:
         cmd.append('--recursive')
 
     if recalculate_mask == 'mask' and mode in ['set', 'rm']:
@@ -219,7 +210,7 @@ def build_command(module, mode, path, follow, default, recursive, recalculate_ma
     elif recalculate_mask == 'no_mask' and mode in ['set', 'rm']:
         cmd.append('--no-mask')
 
-    if not follow and not use_nfsv4_acls:
+    if not follow:
         if platform.system().lower() == 'linux':
             cmd.append('--physical')
         elif platform.system().lower() == 'freebsd':
@@ -232,34 +223,24 @@ def build_command(module, mode, path, follow, default, recursive, recalculate_ma
     return cmd
 
 
-def acl_changed(module, cmd, entry, use_nfsv4_acls=False):
+def acl_changed(module, cmd):
     '''Returns true if the provided command affects the existing ACLs, false otherwise.'''
-    # To check the ACL changes, use the output of setfacl or nfs4_setfacl with '--test'.
+    # FreeBSD do not have a --test flag, so by default, it is safer to always say "true"
-    # FreeBSD do not have a --test flag, so by default, it is safer to always say "true".
     if platform.system().lower() == 'freebsd':
         return True
 
     cmd = cmd[:]  # lists are mutables so cmd would be overwritten without this
     cmd.insert(1, '--test')
     lines = run_acl(module, cmd)
-    counter = 0
-    for line in lines:
-        if line.endswith('*,*') and not use_nfsv4_acls:
-            return False
-        # if use_nfsv4_acls and entry is listed
-        if use_nfsv4_acls and entry == line:
-            counter += 1
 
-    # The current 'nfs4_setfacl --test' lists a new entry,
+    for line in lines:
-    #  which will be added at the top of list, followed by the existing entries.
+        if not line.endswith('*,*'):
-    # So if the entry has already been registered, the entry should be find twice.
-    if counter == 2:
-        return False
             return True
+    return False
 
 
 def run_acl(module, cmd, check_rc=True):
-    '''Runs the provided command and returns the output as a list of lines.'''
+
     try:
         (rc, out, err) = module.run_command(cmd, check_rc=check_rc)
     except Exception as e:
@@ -332,7 +313,7 @@ def main():
             module.fail_json(msg="'recalculate_mask' MUST NOT be set to 'mask' or 'no_mask' when 'state=query'.")
 
     if not entry:
-        if state == 'absent' and permissions and not use_nfsv4_acls:
+        if state == 'absent' and permissions:
             module.fail_json(msg="'permissions' MUST NOT be set when 'state=absent'.")
 
         if state == 'absent' and not entity:
@@ -369,24 +350,21 @@ def main():
         entry = build_entry(etype, entity, permissions, use_nfsv4_acls)
         command = build_command(
             module, 'set', path, follow,
-            default, recursive, recalculate_mask, use_nfsv4_acls, entry
+            default, recursive, recalculate_mask, entry
         )
-        changed = acl_changed(module, command, entry, use_nfsv4_acls)
+        changed = acl_changed(module, command)
 
         if changed and not module.check_mode:
             run_acl(module, command)
         msg = "%s is present" % entry
 
     elif state == 'absent':
-        if use_nfsv4_acls:
-            entry = build_entry(etype, entity, permissions, use_nfsv4_acls)
-        else:
         entry = build_entry(etype, entity, use_nfsv4_acls)
         command = build_command(
             module, 'rm', path, follow,
-            default, recursive, recalculate_mask, use_nfsv4_acls, entry
+            default, recursive, recalculate_mask, entry
         )
-        changed = acl_changed(module, command, entry, use_nfsv4_acls)
+        changed = acl_changed(module, command)
 
         if changed and not module.check_mode:
             run_acl(module, command, False)
@@ -397,10 +375,7 @@ def main():
 
     acl = run_acl(
         module,
-        build_command(
+        build_command(module, 'get', path, follow, default, recursive, recalculate_mask)
-            module, 'get', path, follow, default, recursive,
-            recalculate_mask, use_nfsv4_acls
-        )
     )
 
     module.exit_json(changed=changed, msg=msg, acl=acl)

plugins/modules/authorized_key.py

@@ -24,7 +24,6 @@ options:
   key:
     description:
       - The SSH public key(s), as a string or (since Ansible 1.9) url (https://github.com/username.keys).
-      - You can also use V(file://) prefix to search remote for a file with SSH key(s).
     type: str
     required: true
   path:
@@ -97,12 +96,6 @@ EXAMPLES = r'''
     state: present
     key: https://github.com/charlie.keys
 
-- name: Set authorized keys taken from path on controller node
-  ansible.posix.authorized_key:
-    user: charlie
-    state: present
-    key: file:///home/charlie/.ssh/id_rsa.pub
-
 - name: Set authorized keys taken from url using lookup
   ansible.posix.authorized_key:
     user: charlie
@@ -230,7 +223,6 @@ from operator import itemgetter
 from ansible.module_utils._text import to_native
 from ansible.module_utils.basic import AnsibleModule
 from ansible.module_utils.urls import fetch_url
-from ansible.module_utils.six.moves.urllib.parse import urlparse
 
 
 class keydict(dict):
@@ -564,7 +556,7 @@ def enforce_state(module, params):
     follow = params.get('follow', False)
     error_msg = "Error getting key from: %s"
 
-    # if the key is a url or file, request it and use it as key source
+    # if the key is a url, request it and use it as key source
     if key.startswith("http"):
         try:
             resp, info = fetch_url(module, key)
@@ -578,19 +570,6 @@ def enforce_state(module, params):
         # resp.read gives bytes on python3, convert to native string type
         key = to_native(key, errors='surrogate_or_strict')
 
-    if key.startswith("file"):
-        # if the key is an absolute path, check for existense and use it as a key source
-        key_path = urlparse(key).path
-        if not os.path.exists(key_path):
-            module.fail_json(msg="Path to a key file not found: %s" % key_path)
-        if not os.path.isfile(key_path):
-            module.fail_json(msg="Path to a key is a directory and must be a file: %s" % key_path)
-        try:
-            with open(key_path, 'r') as source_fh:
-                key = source_fh.read()
-        except OSError as e:
-            module.fail_json(msg="Failed to read key file %s : %s" % (key_path, to_native(e)))
-
     # extract individual keys into an array, skipping blank lines and comments
     new_keys = [s for s in key.splitlines() if s and not s.startswith('#')]
 

tests/integration/targets/authorized_key/defaults/main.yml

@@ -35,5 +35,3 @@ multiple_keys_comments: |
   ssh-rsa DATA_BASIC 1@testing
   # I like adding comments yo-dude-this-is-not-a-key INVALID_DATA 2@testing
   ecdsa-sha2-nistp521 ECDSA_DATA 4@testing
-
-key_path: /tmp/id_rsa.pub

tests/integration/targets/authorized_key/tasks/check_path.yml

@@ -1,32 +0,0 @@
----
-- name: Create key file for test
-  ansible.builtin.copy:
-    dest: "{{ key_path }}"
-    content: "{{ rsa_key_basic }}"
-    mode: "0600"
-
-- name: Add key using path
-  ansible.posix.authorized_key:
-    user: root
-    key: file://{{ key_path }}
-    state: present
-    path: "{{ output_dir | expanduser }}/authorized_keys"
-  register: result
-
-- name: Assert that the key was added
-  ansible.builtin.assert:
-    that:
-      - result.changed == true
-
-- name: Add key using path again
-  ansible.posix.authorized_key:
-    user: root
-    key: file://{{ key_path }}
-    state: present
-    path: "{{ output_dir | expanduser }}/authorized_keys"
-  register: result
-
-- name: Assert that no changes were applied
-  ansible.builtin.assert:
-    that:
-      - result.changed == false

tests/integration/targets/authorized_key/tasks/main.yml

@@ -31,6 +31,3 @@
 
 - name: Test for the management of comments with key
   ansible.builtin.import_tasks: comments.yml
-
-- name: Test for specifying key as a path
-  ansible.builtin.import_tasks: check_path.yml

tests/sanity/ignore-2.19.txt

@@ -1 +0,0 @@
-tests/utils/shippable/timing.py shebang