1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2024-09-14 20:13:21 +02:00
community.general/tests/integration/targets/lookup_passwordstore/tasks/tests.yml

349 lines
9.4 KiB
YAML
Raw Normal View History

2020-03-09 10:11:07 +01:00
- name: Check name of gpg2 binary
command: which gpg2
register: gpg2_check
ignore_errors: true
- name: Set gpg2 binary name
set_fact:
gpg2_bin: '{{ "gpg2" if gpg2_check is successful else "gpg" }}'
- name: Stop gpg-agent so we can remove any locks on the GnuPG dir
command: gpgconf --kill gpg-agent
ignore_errors: yes
- name: Remove previous password files and directory
file:
dest: "{{ item }}"
state: absent
loop:
- "~/.gnupg"
- "~/.password-store"
- name: Get path of pass executable
command: which pass
register: result
- name: Store path of pass executable
set_fact:
passpath: "{{ result.stdout }}"
- name: Move original pass into place if there was a leftover
command:
argv:
- mv
- "{{ passpath }}.testorig"
- "{{ passpath }}"
args:
removes: "{{ passpath }}.testorig"
# having gopass is not required for this test, but we store
# its path in case it is installed, so we can restore it
- name: Try to find gopass in path
command: which gopass
register: result
ignore_errors: yes
- name: Store path of gopass executable
set_fact:
gopasspath: "{{ (result.rc == 0) |
ternary(result.stdout, (passpath | dirname, 'gopass') | path_join) }}"
- name: Move original gopass into place if there was a leftover
command:
argv:
- mv
- "{{ gopasspath }}.testorig"
- "{{ gopasspath }}"
args:
removes: "{{ gopasspath }}.testorig"
2020-03-09 10:11:07 +01:00
# How to generate a new GPG key:
# gpg2 --batch --gen-key input # See templates/input
# gpg2 --list-secret-keys --keyid-format LONG
# gpg2 --armor --export-secret-keys [key id]
# # Get the fingerprint
# gpg2 --fingerprint --keyid-format LONG | grep [key id] -A 1 | tail -1 | tr -d '[:space:]' | awk -F '=' '{print $2":6:"}'
- name: Import GPG private key
shell: echo "{{ passwordstore_privkey }}" | {{ gpg2_bin }} --import --allow-secret-key-import -
- name: Trust key
shell: echo "D3E1CC8934E97270CEB066023AF1BD3619AB496A:6:" | {{ gpg2_bin }} --import-ownertrust
- name: Initialise passwordstore
command: pass init ansible-test
- name: Create a password
set_fact:
newpass: "{{ lookup('community.general.passwordstore', 'test-pass length=8 create=yes') }}"
2020-03-09 10:11:07 +01:00
- name: Fetch password from an existing file
set_fact:
readpass: "{{ lookup('community.general.passwordstore', 'test-pass') }}"
2020-03-09 10:11:07 +01:00
- name: Verify password
assert:
that:
- readpass == newpass
- name: Create a password with equal sign
set_fact:
2020-03-29 13:02:28 +02:00
newpass: "{{ lookup('community.general.passwordstore', 'test-pass-equal userpass=SimpleSample= create=yes') }}"
- name: Fetch a password with equal sign
set_fact:
2020-03-29 13:02:28 +02:00
readpass: "{{ lookup('community.general.passwordstore', 'test-pass-equal') }}"
- name: Verify password
assert:
that:
- readpass == newpass
- name: Create a password using missing=create
set_fact:
newpass: "{{ lookup('community.general.passwordstore', 'test-missing-create missing=create length=8') }}"
- name: Fetch password from an existing file
set_fact:
readpass: "{{ lookup('community.general.passwordstore', 'test-missing-create') }}"
- name: Verify password
assert:
that:
- readpass == newpass
- name: Fetch password from existing file using missing=empty
set_fact:
readpass: "{{ lookup('community.general.passwordstore', 'test-missing-create missing=empty') }}"
- name: Verify password
assert:
that:
- readpass == newpass
- name: Fetch password from non-existing file using missing=empty
set_fact:
readpass: "{{ query('community.general.passwordstore', 'test-missing-pass missing=empty') }}"
- name: Verify password
assert:
that:
- readpass == [ none ]
# As inserting multiline passwords on the commandline would require something
# like expect, simply create it by using default gpg on a file with the correct
# structure.
- name: Create the YAML password content
copy:
dest: "~/.password-store/test-yaml-pass"
content: |
testpassword
key: |
multi
line
- name: Read .gpg-id from .password-store
set_fact:
gpgid: "{{ lookup('file', '~/.password-store/.gpg-id') }}"
- name: Encrypt the file using the gpg key
command: "{{ gpg2_bin }} --batch --encrypt -r {{ gpgid }} ~/.password-store/test-yaml-pass"
- name: Fetch a password with YAML subkey
set_fact:
readyamlpass: "{{ lookup('community.general.passwordstore', 'test-yaml-pass subkey=key') }}"
- name: Read a yaml subkey
assert:
that:
- readyamlpass == 'multi\nline'
- name: Create a non-YAML multiline file
copy:
dest: "~/.password-store/test-multiline-pass"
content: |
testpassword
random additional line
- name: Read .gpg-id from .password-store
set_fact:
gpgid: "{{ lookup('file', '~/.password-store/.gpg-id') }}"
- name: Encrypt the file using the gpg key
command: "{{ gpg2_bin }} --batch --encrypt -r {{ gpgid }} ~/.password-store/test-multiline-pass"
- name: Fetch password from multiline file
set_fact:
readyamlpass: "{{ lookup('community.general.passwordstore', 'test-multiline-pass') }}"
- name: Multiline pass only returns first line
assert:
that:
- readyamlpass == 'testpassword'
- name: Fetch all from multiline file
set_fact:
readyamlpass: "{{ lookup('community.general.passwordstore', 'test-multiline-pass returnall=yes') }}"
- name: Multiline pass returnall returns everything in the file
assert:
that:
- readyamlpass == 'testpassword\nrandom additional line'
- name: Create a password in a folder
set_fact:
newpass: "{{ lookup('community.general.passwordstore', 'folder/test-pass length=8 create=yes') }}"
- name: Fetch password from folder
set_fact:
readpass: "{{ lookup('community.general.passwordstore', 'folder/test-pass') }}"
- name: Verify password from folder
assert:
that:
- readpass == newpass
- name: Try to read folder as passname
set_fact:
newpass: "{{ lookup('community.general.passwordstore', 'folder') }}"
ignore_errors: true
register: eval_error
- name: Make sure reading folder as passname failed
assert:
that:
- eval_error is failed
- '"passname folder not found" in eval_error.msg'
- name: Change passwordstore location explicitly
set_fact:
passwordstore: "{{ lookup('env','HOME') }}/.password-store"
- name: Make sure password store still works with explicit location set
set_fact:
newpass: "{{ lookup('community.general.passwordstore', 'test-pass') }}"
- name: Change passwordstore location to a non-existent place
set_fact:
passwordstore: "somenonexistentplace"
- name: Try reading from non-existent passwordstore location
set_fact:
newpass: "{{ lookup('community.general.passwordstore', 'test-pass') }}"
ignore_errors: true
register: eval_error
- name: Make sure reading from non-existent passwordstore location failed
assert:
that:
- eval_error is failed
- >-
"Passwordstore directory 'somenonexistentplace' does not exist" in eval_error.msg
- name: Test pass compatibility shim detection
block:
- name: Move original pass out of the way
command:
argv:
- mv
- "{{ passpath }}"
- "{{ passpath }}.testorig"
args:
creates: "{{ passpath }}.testorig"
- name: Create dummy pass script
ansible.builtin.copy:
content: |
#!/bin/sh
echo "shim_ok"
dest: "{{ passpath }}"
mode: '0755'
- name: Try reading from non-existent passwordstore location with different pass utility
set_fact:
newpass: "{{ lookup('community.general.passwordstore', 'test-pass') }}"
environment:
PATH: "/tmp"
- name: Verify password received from shim
assert:
that:
- newpass == "shim_ok"
- name: Try to read folder as passname with a different pass utility
set_fact:
newpass: "{{ lookup('community.general.passwordstore', 'folder') }}"
- name: Verify password received from shim
assert:
that:
- newpass == "shim_ok"
always:
- name: Move original pass back into place
command:
argv:
- mv
- "{{ passpath }}.testorig"
- "{{ passpath }}"
args:
removes: "{{ passpath }}.testorig"
- name: Very basic gopass compatibility test
vars:
passwordstore_backend: "gopass"
block:
- name: check if gopass executable exists
stat:
path: "{{ gopasspath }}"
register: gopass_check
- name: Move original gopass out of the way
command:
argv:
- mv
- "{{ gopasspath }}"
- "{{ gopasspath }}.testorig"
args:
creates: "{{ gopasspath }}.testorig"
when: gopass_check.stat.exists == true
- name: Create mocked gopass script
ansible.builtin.copy:
content: |
#!/bin/sh
if [ "$GOPASS_NO_REMINDER" != "YES" ]; then
exit 1
fi
if [ "$1" = "--version" ]; then
exit 2
fi
echo "gopass_ok"
dest: "{{ gopasspath }}"
mode: '0755'
- name: Try to read folder as passname using gopass
set_fact:
newpass: "{{ lookup('community.general.passwordstore', 'folder') }}"
- name: Verify password received from gopass
assert:
that:
- newpass == "gopass_ok"
always:
- name: Remove mocked gopass
ansible.builtin.file:
path: "{{ gopasspath }}"
state: absent
- name: Move original gopass back into place
command:
argv:
- mv
- "{{ gopasspath }}.testorig"
- "{{ gopasspath }}"
args:
removes: "{{ gopasspath }}.testorig"
when: gopass_check.stat.exists == true