module

Krikri::PluginHelpers::JavaCertCommand

JavaCertCommand - builds the keytool/openssl command lines community.general.java_cert runs, mirroring the Ansible module's helpers (_check_cert_present, delete_cert, import_cert_path, import_pkcs12_path, _export_public_cert_from_pkcs12, _download_cert_url, _get_digest_from_x509_file, and build_proxy_options). Each builder returns the raw ARGV the real module passes to run_command - that argv is also what Ansible reports as the result's cmd (a JSON list, not a string) - and callers shell-join it with .join(' ') where a command STRING is what gets executed. Pure string plumbing so the exact argv shapes are unit-testable without a JVM (or a keystore); the plugin itself executes them.

Class methods

check_cmd(executable : String, keystore_path : String, cert_alias : String, keystore_type : String | Nil) : Array(String)

_check_cert_present: PEM dump of the alias to stdout; the password goes over keytool's stdin, never argv.

Source
delete_cmd(executable : String, keystore_path : String, cert_alias : String, keystore_type : String | Nil) : Array(String)
Source
dgst_cmd(openssl_bin : String, cert_file : String) : Array(String)
Source
export_pkcs12_cmd(executable : String, pkcs12_path : String, pkcs12_alias : String | Nil) : Array(String)

_export_public_cert_from_pkcs12 - no -noprompt (the real module's export command doesn't pass it; the password goes over stdin either way).

Source
extract_x509_cmd(openssl_bin : String, cert_file : String, out_file : String, der_fallback : Bool = false) : Array(String)

_get_digest_from_x509_file's two steps: extract the first certificate (PEM first, DER fallback), then hash it. Split into the two commands so the plugin can branch on the extract rc the way the Ansible module does.

Source
fetch_url_cmd(executable : String, url : String, port : Int32, proxy_opts : Array(String)) : Array(String)

_download_cert_url

Source
import_cert_cmd(executable : String, cert_path : String, keystore_path : String, cert_alias : String, keystore_type : String | Nil, trust_cacert : Bool) : Array(String)

import_cert_path

Source
import_pkcs12_cmd(executable : String, pkcs12_path : String, pkcs12_alias : String | Nil, keystore_path : String, cert_alias : String | Nil, keystore_type : String | Nil) : Array(String)

import_pkcs12_path

Source
keystore_type_params(keystore_type : String | Nil) : Array(String)

_get_keystore_type_keytool_parameters

Source
proxy_opts(https_proxy : String | Nil, no_proxy : String | Nil) : Array(String)

build_proxy_options: honors https_proxy/no_proxy environment variables (the Ansible module reads urllib's getproxies()); Java proxy flags go to the JVM with -J, nonProxyHosts entries are '|' separated with leading dots rewritten to '*.'.

Source
with_stdin(command : String, data : Array(String)) : String

Wraps a command with the stdin data the Ansible module's run_command(data=...) feeds it, via printf piped to the command. Each data string is one line.

The feeder's stderr is suppressed: its only possible output is bash's own "printf: write error: Broken pipe" when the consumer exits without reading stdin and the scheduler runs the feeder's pipeline subshell after that exit (reproduced under load with a keytool shim that consumes no stdin). Real Ansible feeds stdin through run_command(data=...), where CPython ignores EPIPE on the stdin write for exactly this reason - so silencing our generated printf matches the real module instead of masking real output (the consumer's own stderr is a different pipeline element and unaffected).

Source