- name: Download test key
  get_url:
    url: "{{ test_key_url }}"
    dest: "{{ test_key_path }}"

- name: Download test RPM
  get_url:
    url: "{{ test_rpm_url }}"
    dest: "{{ test_rpm_path }}"

- name: Remove test key from keyring
  rpm_key:
    state: absent
    key: "{{ test_key_path }}"

- name: Verify checking signature of RPM fails
  shell: rpm --checksig {{ test_rpm_path | quote }}
  register: checksig
  ignore_errors: yes

- name: Confirm that signature check failed
  assert:
    that:
      - checksig.stdout is contains 'SIGNATURES NOT OK'
      - checksig.failed

- name: Remove test key from keyring (idempotent)
  rpm_key:
    state: absent
    key: "{{ test_key_path }}"
  register: idempotent_test

- name: Check idempotence
  assert:
    that: idempotent_test is not changed

- name: Add test key to key ring
  rpm_key:
    state: present
    key: "{{ test_key_path }}"

- name: Add test key to key ring (idempotent)
  rpm_key:
    state: present
    key: "{{ test_key_path }}"
  register: key_idempotence

- name: Verify idempotence
  assert:
    that: key_idempotence is not changed

- name: Check signature of RPM
  shell: rpm --checksig {{ test_rpm_path | quote }}
  register: checksig

- name: Confirm that signature check succeeded
  assert:
    that: checksig.stdout is contains 'digests signatures OK'

- name: Remove test key via url
  rpm_key:
    state: absent
    key: "{{ test_key_url }}"

- name: Confirm key is missing
  shell: rpm --checksig {{ test_rpm_path | quote }}
  register: checksig
  ignore_errors: yes

- name: Confirm that signature check failed
  assert:
    that:
      - checksig.stdout is contains 'SIGNATURES NOT OK'
      - checksig.failed

- name: Add test key from url
  rpm_key:
    state: present
    key: "{{ test_key_url }}"

- name: Check signature of RPM
  shell: rpm --checksig {{ test_rpm_path | quote }}
  register: checksig

- name: Confirm that signature check succeeded
  assert:
    that: checksig.stdout is contains 'digests signatures OK'

- name: Remove all keys from key ring
  shell: rpm -q gpg-pubkey | xargs rpm -e

- name: Add very first key on system
  rpm_key:
    state: present
    key: "{{ test_key_url }}"

- name: Check GPG signature of RPM
  shell: rpm --checksig {{ test_rpm_path | quote }}
  register: checksig

- name: Confirm that signature check succeeded
  assert:
    that: checksig.stdout is contains 'digests signatures OK'

- name: Get keyid
  shell: rpm -q gpg-pubkey | head -n 1 | xargs rpm -q --qf %{version}
  register: key_id

- name: Remove test key using keyid
  rpm_key:
    state: absent
    key: "{{ key_id.stdout }}"
  register: remove_keyid
  failed_when: not remove_keyid.changed

- name: Remove test key using keyid (idempotent)
  rpm_key:
    state: absent
    key: "{{ key_id.stdout }}"
  register: key_id_idempotence

- name: Verify idempotent (key_id)
  assert:
    that: key_id_idempotence is not changed

- name: Add key to test deleting by fingerprint
  rpm_key:
    state: present
    key: "{{ test_key_url }}"

- name: Remove key by using fingerprint
  rpm_key:
    state: absent
    key: "{{ primary_fingerprint }}"

- name: Add very first key on system again
  rpm_key:
    state: present
    key: "{{ test_key_url }}"

- name: Issue 20325 - Verify fingerprint of key, invalid fingerprint - EXPECTED FAILURE
  rpm_key:
    key: "{{ sub_key_url }}"
    fingerprint: "{{ invalid_fingerprint }}"
  register: result
  failed_when: result is success

- name: Issue 20325 - Assert Verify fingerprint of key, invalid fingerprint
  assert:
    that:
       - result is success
       - result is not changed
       - result.msg is contains 'does not match any key fingerprints'

- name: Issue 20325 - Verify fingerprint of key, valid fingerprint
  rpm_key:
    key: "{{ sub_key_url }}"
    fingerprint: "{{ primary_fingerprint }}"
  register: result

- name: Issue 20325 - Assert Verify fingerprint of key, valid fingerprint
  assert:
    that:
      - result is success
      - result is changed

- name: Issue 20325 - Verify fingerprint of key, valid fingerprint - Idempotent check
  rpm_key:
    key: "{{ sub_key_url }}"
    fingerprint: "{{ primary_fingerprint }}"
  register: result

- name: Issue 20325 - Assert Verify fingerprint of key, valid fingerprint - Idempotent check
  assert:
    that:
      - result is success
      - result is not changed

# Reset to test subkey validation

- name: Remove all keys from key ring
  shell: rpm -q gpg-pubkey | xargs rpm -e

- name: Verify fingerprint of subkey, valid fingerprint
  rpm_key:
    key: "{{ sub_key_url }}"
    fingerprint: "{{ sub_key_fingerprint }}"
  register: result

- name: Assert Verify fingerprint of key, valid fingerprint
  assert:
    that:
      - result is success
      - result is changed

- name: Verify fingerprint of subkey, valid fingerprint - Idempotent check
  rpm_key:
    key: "{{ sub_key_url }}"
    fingerprint: "{{ sub_key_fingerprint }}"
  register: result

- name: Assert Verify fingerprint of subkey, valid fingerprint - Idempotent check
  assert:
    that:
      - result is success
      - result is not changed

# Reset to test multi-key validation

- name: Remove all keys from key ring
  shell: rpm -q gpg-pubkey | xargs rpm -e

- name: Verify fingerprint of primary and subkey, valid fingerprint
  rpm_key:
    key: "{{ sub_key_url }}"
    fingerprint:
      - "{{ primary_fingerprint }}"
      - "{{ sub_key_fingerprint }}"
  register: result

- name: Assert Verify fingerprint of primary and subkey, valid fingerprint
  assert:
    that:
      - result is success
      - result is changed

- name: Verify fingerprint of primary and subkey, valid fingerprint - Idempotent check
  rpm_key:
    key: "{{ sub_key_url }}"
    fingerprint:
      - "{{ primary_fingerprint }}"
      - "{{ sub_key_fingerprint }}"
  register: result

- name: Assert Verify fingerprint of primary and subkey, valid fingerprint - Idempotent check
  assert:
    that:
      - result is success
      - result is not changed

# Test PGPv6 keys
- name: Test PGPv6 Keys
  block:

    # Reset to test PGPv6 keys validation
    - name: Remove all keys from key ring
      shell: rpm -q gpg-pubkey | xargs rpm -e

    - name: Copy v6 key to remote
      copy:
        src: "files/{{ test_v6_key_file }}"
        dest: "{{ remote_tmp_dir }}/{{ test_v6_key_file }}"
        mode: "0644"

    - name: Import v6 key
      rpm_key:
        state: present
        key: "{{ remote_tmp_dir }}/{{ test_v6_key_file }}"
        fingerprint: "{{ invalid_fingerprint }}"
      register: result
      failed_when: result is success

    - name: Verify invalid fingerprint failure
      assert:
        that:
           - result is success
           - result is not changed
           - result.msg is contains 'does not match any key fingerprints'

    - name: Import v6 key
      rpm_key:
        state: present
        key: "{{ remote_tmp_dir }}/{{ test_v6_key_file }}"
        fingerprint: "{{ test_v6_key_fingerprint }}"

    - name: Import v6 key (idempotent)
      rpm_key:
        state: present
        key: "{{ remote_tmp_dir }}/{{ test_v6_key_file }}"
        fingerprint: "{{ test_v6_key_fingerprint }}"
      register: key_idempotence

    - name: Verify idempotence
      assert:
        that: key_idempotence is not changed

    - name: Delete v6 key
      rpm_key:
        state: absent
        key: "{{ test_v6_key_keyid }}"

    - name: Import v6 key again
      rpm_key:
        state: present
        key: "{{ remote_tmp_dir }}/{{ test_v6_key_file }}"
        fingerprint: "{{ test_v6_key_fingerprint }}"

    - name: Delete v6 key by fingerprint
      rpm_key:
        state: absent
        key: "{{ test_v6_key_fingerprint }}"

  when: (ansible_facts['distribution'] == "RedHat" and ansible_facts['distribution_version'] is version('10.1', '>='))
        or (ansible_facts['distribution'] == "Fedora" and ansible_facts['distribution_version'] is version('43', '>='))
