ansible/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2026-06-14 20:07:38 +00:00
Code Activity

[PR #12151/994b7560 backport][stable-13] java_cert: fix PKCS12 password not passed to keytool -list (#12243)

Browse source 
java_cert: fix PKCS12 password not passed to `keytool -list` (#12151)

* fix(java_cert): remove -noprompt from keytool -list to allow stdin password

-noprompt is not a valid option for keytool -list (only for importkeystore/
importcert). On Java 8, passing it caused keytool to skip reading the store
password from stdin, resulting in a null password and NullPointerException.

Fixes #3023



* test(java_cert): add idempotency test for pkcs12 import with password

Exercises _export_public_cert_from_pkcs12 when the alias already exists,
verifying the password is correctly read from stdin on the comparison path.



* changelog: add fragment for PR 12151



---------


(cherry picked from commit 994b756026)

Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
patchback[bot] 2026-06-13 17:33:42 +02:00 • committed by GitHub
parent 74207ab57f
commit c14620fcf6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 22 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
plugins/modules/java_cert.py
View file

@ -279,7 +279,7 @@ def _get_digest_from_x509_file(module, pem_certificate_file, openssl_bin):
def _export_public_cert_from_pkcs12(module, executable, pkcs_file, alias, password, dest):
"""Runs keytools to extract the public cert from a PKCS12 archive and write it to a file."""
export_cmd = [executable, "-list", "-noprompt", "-keystore", pkcs_file, "-storetype", "pkcs12", "-rfc"]
export_cmd = [executable, "-list", "-keystore", pkcs_file, "-storetype", "pkcs12", "-rfc"]
# Append optional alias
if alias:
export_cmd.extend(["-alias", alias])