Update dependency community.crypto to v2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
community.crypto	galaxy-collection	major	1.9.5 -> 2.2.1

---

Release Notes

ansible-collections/community.crypto

v2.2.1

Compare Source

======

Release Summary

Bugfix release.

Bugfixes

• openssh_cert - fixed false changed status for host certificates when using full_idempotence (community.crypto.openssh_cert regenerate: full_idempotence acts the same as regenerate: always ansible-collections/community.crypto#395, openssh_cert - fix full_idempotence for host certificates ansible-collections/community.crypto#396).

v2.2.0

Compare Source

======

Release Summary

Regular bugfix and feature release.

Minor Changes

• openssh_cert - added ignore_timestamps parameter so it can be used semi-idempotent with relative timestamps in valid_to/valid_from (openssh_cert: valid_at has no effect (will always be regenerated) ansible-collections/community.crypto#379).

Bugfixes

• luks_devices - set LANG and similar environment variables to avoid translated output, which can break some of the module's functionality like key management (luks_device: set LANG and similar env variables to prevent translated cryptsetup output ansible-collections/community.crypto#388, Module luks_device: adding a key not possible on other Linux locales ansible-collections/community.crypto#385).

v2.1.0

Compare Source

======

Release Summary

Feature and bugfix release.

Minor Changes

• Adjust error messages that indicate cryptography is not installed from Can't to Cannot (Small docs improvements ansible-collections/community.crypto#374).

Bugfixes

• Various modules and plugins - use vendored version of distutils.version instead of the deprecated Python standard library distutils (Prepare for distutils.version being removed in Python 3.12 ansible-collections/community.crypto#353).
• certificate_complete_chain - do not append root twice if the chain already ends with a root certificate (certificate_complete_chain: avoid infinite loops, and double roots when root certificate was already part of chain ansible-collections/community.crypto#360).
• certificate_complete_chain - do not hang when infinite loop is found (endless loop when root certificate is found in intermediate certificates set ansible-collections/community.crypto#355, certificate_complete_chain: avoid infinite loops, and double roots when root certificate was already part of chain ansible-collections/community.crypto#360).

New Modules

• crypto_info - Retrieve cryptographic capabilities
• openssl_privatekey_convert - Convert OpenSSL private keys

v2.0.2

Compare Source

======

Release Summary

Documentation fix release. No actual code changes.

v2.0.1

Compare Source

======

Release Summary

Bugfix release with extra forward compatibility for newer versions of cryptography.

Minor Changes

• acme_* modules - fix usage of fetch_url with changes in latest ansible-core devel branch (Fix compatibility to fetch_url change in ansible-core devel ansible-collections/community.crypto#339).

Bugfixes

• acme_certificate - avoid passing multiple certificates to cryptography's X.509 certificate loader when fullchain_dest is used (acme_certificate: fix crash when using fullchain_dest ansible-collections/community.crypto#324).
• get_certificate, openssl_csr_info, x509_certificate_info - add fallback code for extension parsing that works with cryptography 36.0.0 and newer. This code re-serializes de-serialized extensions and thus can return slightly different values if the extension in the original CSR resp. certificate was not canonicalized correctly. This code is currently used as a fallback if the existing code stops working, but we will switch it to be the main code in a future release (Extension parsing: add new fallback code which uses the new cryptography API ansible-collections/community.crypto#331).
• luks_device - now also runs a built-in LUKS signature cleaner on state=absent to make sure that also the secondary LUKS2 header is wiped when older versions of wipefs are used (luks_device state=absent no longer works on some RHEL 7.9 VMs in CI ansible-collections/community.crypto#326, luks_device: add built-in signature wiper to work around older wipefs versions with LUKS2 containers ansible-collections/community.crypto#327).
• openssl_pkcs12 - use new PKCS#​12 deserialization infrastructure from cryptography 36.0.0 if available (Use new PKCS#12 deserialization code from cryptography 36.0.0 if available ansible-collections/community.crypto#302).

v2.0.0

Compare Source

======

Release Summary

A new major release of the community.crypto collection. The main changes are removal of the PyOpenSSL backends for almost all modules (openssl_pkcs12 being the only exception), and removal of the assertonly provider in the x509_certificate provider. There are also some other breaking changes which should improve the user interface/experience of this collection long-term.

Minor Changes

• acme_certificate - the subject and issuer fields in in the select_chain entries are now more strictly validated (Allow to specify subject (for CSRs) and issuer (for CRLs) ordered ansible-collections/community.crypto#316).
• openssl_csr, openssl_csr_pipe - provide a new subject_ordered option if the order of the components in the subject is of importance (Problems with CRL issuer matching Cert issuer. ansible-collections/community.crypto#291, Allow to specify subject (for CSRs) and issuer (for CRLs) ordered ansible-collections/community.crypto#316).
• openssl_csr, openssl_csr_pipe - there is now stricter validation of the values of the subject option (Allow to specify subject (for CSRs) and issuer (for CRLs) ordered ansible-collections/community.crypto#316).
• openssl_privatekey_info - add check_consistency option to request private key consistency checks to be done (openssl_privatekey_info: disable private key consistency checks by default ansible-collections/community.crypto#309).
• x509_certificate, x509_certificate_pipe - add ignore_timestamps option which allows to enable idempotency for 'not before' and 'not after' options (x509_certificate does not recreate certificate if ownca_not_after was changed ansible-collections/community.crypto#295, x509_certificate: add ignore_timestamps option ansible-collections/community.crypto#317).
• x509_crl - provide a new issuer_ordered option if the order of the components in the issuer is of importance (Problems with CRL issuer matching Cert issuer. ansible-collections/community.crypto#291, Allow to specify subject (for CSRs) and issuer (for CRLs) ordered ansible-collections/community.crypto#316).
• x509_crl - there is now stricter validation of the values of the issuer option (Allow to specify subject (for CSRs) and issuer (for CRLs) ordered ansible-collections/community.crypto#316).

Breaking Changes / Porting Guide

• Adjust dirName text parsing and to text converting code to conform to Sections 2 and 3 of RFC 4514 <https://datatracker.ietf.org/doc/html/rfc4514.html>. This is similar to how cryptography handles this <https://cryptography.io/en/latest/x509/reference/#cryptography.x509.Name.rfc4514_string> (Make Dirname (de)serialization conformant to RFC 4514 ansible-collections/community.crypto#274).
• acme module utils - removing compatibility code (Remove other deprecations ansible-collections/community.crypto#290).
• acme_* modules - removed vendored copy of the Python library ipaddress. If you are using Python 2.x, please make sure to install the library (Remove vendored copy of ipaddress ansible-collections/community.crypto#287).
• compatibility module_utils - removed vendored copy of the Python library ipaddress (Remove vendored copy of ipaddress ansible-collections/community.crypto#287).
• crypto module utils - removing compatibility code (Remove other deprecations ansible-collections/community.crypto#290).
• get_certificate, openssl_csr_info, x509_certificate_info - depending on the cryptography version used, the modules might not return the ASN.1 value for an extension as contained in the certificate respectively CSR, but a re-encoded version of it. This should usually be identical to the value contained in the source file, unless the value was malformed. For extensions not handled by C(cryptography) the value contained in the source file is always returned unaltered (Add warning for ASN.1 encoded extension values returned by some modules ansible-collections/community.crypto#318).
• module_utils - removed various PyOpenSSL support functions and default backend values that are not needed for the openssl_pkcs12 module (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• openssl_csr, openssl_csr_pipe, x509_crl - the subject respectively issuer fields no longer ignore empty values, but instead fail when encountering them (Allow to specify subject (for CSRs) and issuer (for CRLs) ordered ansible-collections/community.crypto#316).
• openssl_privatekey_info - by default consistency checks are not run; they need to be explicitly requested by passing check_consistency=true (openssl_privatekey_info: disable private key consistency checks by default ansible-collections/community.crypto#309).
• x509_crl - for idempotency checks, the issuer order is ignored. If order is important, use the new issuer_ordered option (Allow to specify subject (for CSRs) and issuer (for CRLs) ordered ansible-collections/community.crypto#316).

Deprecated Features

• acme_* modules - ACME version 1 is now deprecated and support for it will be removed in community.crypto 2.0.0 (Deprecate ACME v1 ansible-collections/community.crypto#288).

Removed Features (previously deprecated)

• acme_* modules - the acme_directory option is now required (Remove other deprecations ansible-collections/community.crypto#290).
• acme_* modules - the acme_version option is now required (Remove other deprecations ansible-collections/community.crypto#290).
• acme_account_facts - the deprecated redirect has been removed. Use community.crypto.acme_account_info instead (Remove other deprecations ansible-collections/community.crypto#290).
• acme_account_info - retrieve_orders=url_list no longer returns the return value orders. Use the order_uris return value instead (Remove other deprecations ansible-collections/community.crypto#290).
• crypto.info module utils - the deprecated redirect has been removed. Use crypto.pem instead (Remove other deprecations ansible-collections/community.crypto#290).
• get_certificate - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• openssl_certificate - the deprecated redirect has been removed. Use community.crypto.x509_certificate instead (Remove other deprecations ansible-collections/community.crypto#290).
• openssl_certificate_info - the deprecated redirect has been removed. Use community.crypto.x509_certificate_info instead (Remove other deprecations ansible-collections/community.crypto#290).
• openssl_csr - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• openssl_csr and openssl_csr_pipe - version now only accepts the (default) value 1 (Remove other deprecations ansible-collections/community.crypto#290).
• openssl_csr_info - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• openssl_csr_pipe - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• openssl_privatekey - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• openssl_privatekey_info - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• openssl_privatekey_pipe - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• openssl_publickey - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• openssl_publickey_info - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• openssl_signature - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• openssl_signature_info - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• x509_certificate - remove assertonly provider (Remove assertonly ansible-collections/community.crypto#289).
• x509_certificate - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• x509_certificate_info - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).
• x509_certificate_pipe - removed the pyopenssl backend (Remove PyOpenSSL backends (except for openssl_pkcs12) ansible-collections/community.crypto#273).

Bugfixes

• cryptography backend - improve Unicode handling for Python 2 (cryptography support: improve Python 2 Unicode handling ansible-collections/community.crypto#313).
• get_certificate - fix compatibility with the cryptography 35.0.0 release (Support cryptography 35.0.0 for all modules except openssl_pkcs12 ansible-collections/community.crypto#294).
• openssl_csr_info - fix compatibility with the cryptography 35.0.0 release (Support cryptography 35.0.0 for all modules except openssl_pkcs12 ansible-collections/community.crypto#294).
• openssl_pkcs12 - fix compatibility with the cryptography 35.0.0 release (Support cryptography 35.0.0 for the openssl_pkcs12 module ansible-collections/community.crypto#296).
• x509_certificate_info - fix compatibility with the cryptography 35.0.0 release (Support cryptography 35.0.0 for all modules except openssl_pkcs12 ansible-collections/community.crypto#294).

v1.9.11

Compare Source

See https://github.com/ansible-collections/community.crypto/blob/stable-1/CHANGELOG.rst for all changes.

v1.9.10

Compare Source

See https://github.com/ansible-collections/community.crypto/blob/stable-1/CHANGELOG.rst for all changes.

v1.9.9

Compare Source

See https://github.com/ansible-collections/community.crypto/blob/stable-1/CHANGELOG.rst for all changes.

---

Configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by WhiteSource Renovate. View repository job log here.