From eb1ed6998d8788da2c8f75ab29f26d1086ce385c Mon Sep 17 00:00:00 2001
From: Alexei Znamensky <russoz@gmail.com>
Date: Sun, 31 May 2026 18:33:40 +1200
Subject: [PATCH] test(java_cert): add idempotency test for pkcs12 import with
 password

Exercises _export_public_cert_from_pkcs12 when the alias already exists,
verifying the password is correctly read from stdin on the comparison path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../targets/java_cert/tasks/main.yml            | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/tests/integration/targets/java_cert/tasks/main.yml b/tests/integration/targets/java_cert/tasks/main.yml
index d67b65474f..002c217b9f 100644
--- a/tests/integration/targets/java_cert/tasks/main.yml
+++ b/tests/integration/targets/java_cert/tasks/main.yml
@@ -32,6 +32,23 @@
         that:
           - result_success is successful
 
+    - name: import pkcs12 again to verify idempotency (tests password via stdin in _export_public_cert_from_pkcs12)
+      community.general.java_cert:
+        pkcs12_path: "{{ remote_tmp_dir }}/{{ test_pkcs12_path }}"
+        pkcs12_password: changeit
+        pkcs12_alias: default
+        cert_alias: default
+        keystore_path: "{{ remote_tmp_dir }}/{{ test_keystore_path }}"
+        keystore_pass: changeme_keystore
+        keystore_create: true
+        state: present
+      register: result_idempotent
+
+    - name: verify idempotency
+      ansible.builtin.assert:
+        that:
+          - result_idempotent is not changed
+
     - name: import pkcs12 without alias params
       community.general.java_cert:
         pkcs12_path: "{{ remote_tmp_dir }}/{{ test_pkcs12_path }}"