f2cfa6c356
If a key is in our existing keyring has an expiry date (or, has expired), always import the provided value again as it may be refreshing the value. Add an expiring key to test the matching; although on an ephemeral node we're importing always anyway. Also update the file test to a stat -- this is better than a weird error from gpg later. Change-Id: I8e7bc38c68c224795630b90a1b989098a7661491
43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
- name: Stat input file
|
|
stat:
|
|
path: '{{ encrypt_file }}'
|
|
register: _stat_result
|
|
|
|
- name: Validate input file
|
|
fail:
|
|
msg: '{{ encrypt_file }} : file does not exist'
|
|
when: not _stat_result.stat.exists
|
|
|
|
- name: Ensure gpg2 installed
|
|
package:
|
|
name: gnupg2
|
|
state: present
|
|
|
|
- name: Check for required keys
|
|
fail:
|
|
msg: 'Name {{ zj_recipient_name }} not in encrypt_file_keys'
|
|
when: zj_recipient_name not in encrypt_file_keys | map(attribute="name")
|
|
loop: '{{ encrypt_file_recipients }}'
|
|
loop_control:
|
|
loop_var: zj_recipient_name
|
|
|
|
- name: Build recipient list
|
|
set_fact:
|
|
_recipients: '{{ encrypt_file_keys | selectattr("name", "in", encrypt_file_recipients) | list }}'
|
|
|
|
- name: Install keys
|
|
include_tasks: import-key.yaml
|
|
loop: '{{ _recipients }}'
|
|
loop_control:
|
|
loop_var: zj_encrypt_file
|
|
|
|
- name: Build recipient list
|
|
set_fact:
|
|
_recipients_cmd: '--recipient={{ _recipients | map(attribute="key_id") | join(" --recipient=") }}'
|
|
|
|
- name: Encrypt file
|
|
command: 'gpg2 --encrypt --output {{ zj_encrypt_file }}.gpg {{ _recipients_cmd }} {{ zj_encrypt_file }}'
|
|
loop: '{{ [ encrypt_file ] if encrypt_file is string else encrypt_file }}'
|
|
loop_control:
|
|
loop_var: zj_encrypt_file
|