)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"fe3c0e9f7b5b9347d2c82045abb5bc99422fbd53","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"9f1586d9_03b0acc3","updated":"2023-08-21 12:54:09.000000000","message":"Should be backported to 2023.1","commit_id":"330b516dd53c45385e1fc433981df0d646963498"},{"author":{"_account_id":31542,"name":"Andrew Bonney","email":"andrew.bonney@bbc.co.uk","username":"andrewbonney"},"change_message_id":"4cbcb9a1b424da34cfc86150beb74c416ed4b298","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"3027ebc1_bb556238","updated":"2023-08-22 14:18:52.000000000","message":"recheck - stepca failure","commit_id":"330b516dd53c45385e1fc433981df0d646963498"}],"tasks/main_certs.yml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"a9ed2787a9037b85dcfaba48b4326aad172f5711","unresolved":true,"context_lines":[{"line_number":23,"context_line":"    path: \"{{ item.path }}\""},{"line_number":24,"context_line":"    owner: \"{{ item.owner | default(pki_owner) | default(omit) }}\""},{"line_number":25,"context_line":"    group: \"{{ item.group | default(pki_group) | default(omit) }}\""},{"line_number":26,"context_line":"    mode: \"{{ item.mode | default(pki_cert_dir_mode) }}\""},{"line_number":27,"context_line":"  with_items:"},{"line_number":28,"context_line":"    - \"{{ pki_cert_dirs }}\""},{"line_number":29,"context_line":"  when: pki_create_certificates | default(true)"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"091a65b1_1b14a8a7","line":26,"range":{"start_line":26,"start_character":4,"end_line":26,"end_character":56},"updated":"2023-08-30 09:54:06.000000000","message":"what I am slightly confused about - is what\u0027s the reason to remove mode from _pki_cert_dirs for defining `pki_cert_dir_mode`, when this dir mode is applicable only for certs, but not keys, but keys dir is also created here...\n\nWouldn\u0027t it be cleaner to use `pki_cert_dir_mode` and `pki_key_dir_mode` for _pki_cert_dirs, and here just set default to `0755`?","commit_id":"330b516dd53c45385e1fc433981df0d646963498"},{"author":{"_account_id":31542,"name":"Andrew Bonney","email":"andrew.bonney@bbc.co.uk","username":"andrewbonney"},"change_message_id":"e328dca052920055e8ca5dee01faee8c90a11ba3","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    path: \"{{ item.path }}\""},{"line_number":24,"context_line":"    owner: \"{{ item.owner | default(pki_owner) | default(omit) }}\""},{"line_number":25,"context_line":"    group: \"{{ item.group | default(pki_group) | default(omit) }}\""},{"line_number":26,"context_line":"    mode: \"{{ item.mode | default(pki_cert_dir_mode) }}\""},{"line_number":27,"context_line":"  with_items:"},{"line_number":28,"context_line":"    - \"{{ pki_cert_dirs }}\""},{"line_number":29,"context_line":"  when: pki_create_certificates | default(true)"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"eb8d9a41_263029f1","line":26,"range":{"start_line":26,"start_character":4,"end_line":26,"end_character":56},"in_reply_to":"091a65b1_1b14a8a7","updated":"2023-08-30 10:52:22.000000000","message":"That makes sense, and seems more consistent with some of the key permissions tasks.","commit_id":"330b516dd53c45385e1fc433981df0d646963498"}],"tasks/standalone/create_ca.yml":[{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"e862b0588d1fed0203a554117f636693a57f30bb","unresolved":true,"context_lines":[{"line_number":24,"context_line":"      file:"},{"line_number":25,"context_line":"        state: directory"},{"line_number":26,"context_line":"        path: \"{{ item.path }}\""},{"line_number":27,"context_line":"        owner: \"{{ item.owner | default(pki_owner) | default(omit) }}\""},{"line_number":28,"context_line":"        group: \"{{ item.group | default(pki_group) | default(omit) }}\""},{"line_number":29,"context_line":"        mode: \"{{ item.mode | default(omit) }}\""},{"line_number":30,"context_line":"      with_items:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"edc43fe0_42cb72ff","line":27,"range":{"start_line":27,"start_character":40,"end_line":27,"end_character":49},"updated":"2023-08-18 06:38:07.000000000","message":"can we make this pki_cert_dir_owner to match pki_cert_dir_mode?","commit_id":"e6ebbb1cb56870654962b42a301ac480ee1b3da5"},{"author":{"_account_id":31542,"name":"Andrew Bonney","email":"andrew.bonney@bbc.co.uk","username":"andrewbonney"},"change_message_id":"bdeca9eefd8197243e28e0475b24a2dc4f19e2ab","unresolved":true,"context_lines":[{"line_number":24,"context_line":"      file:"},{"line_number":25,"context_line":"        state: directory"},{"line_number":26,"context_line":"        path: \"{{ item.path }}\""},{"line_number":27,"context_line":"        owner: \"{{ item.owner | default(pki_owner) | default(omit) }}\""},{"line_number":28,"context_line":"        group: \"{{ item.group | default(pki_group) | default(omit) }}\""},{"line_number":29,"context_line":"        mode: \"{{ item.mode | default(omit) }}\""},{"line_number":30,"context_line":"      with_items:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"58f0b337_5c4f74ad","line":27,"range":{"start_line":27,"start_character":40,"end_line":27,"end_character":49},"in_reply_to":"edc43fe0_42cb72ff","updated":"2023-08-18 09:56:59.000000000","message":"Yes if that\u0027s preferred, I was just trying to minimise variables where I thought they were unlikely to differ. I think this means we\u0027ll need 8 new variables for the matrix of owner/group with keys/certs and key/cert directories.","commit_id":"e6ebbb1cb56870654962b42a301ac480ee1b3da5"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"e862b0588d1fed0203a554117f636693a57f30bb","unresolved":true,"context_lines":[{"line_number":25,"context_line":"        state: directory"},{"line_number":26,"context_line":"        path: \"{{ item.path }}\""},{"line_number":27,"context_line":"        owner: \"{{ item.owner | default(pki_owner) | default(omit) }}\""},{"line_number":28,"context_line":"        group: \"{{ item.group | default(pki_group) | default(omit) }}\""},{"line_number":29,"context_line":"        mode: \"{{ item.mode | default(omit) }}\""},{"line_number":30,"context_line":"      with_items:"},{"line_number":31,"context_line":"        - path: \"{{ ca_dir }}\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"317c2b8b_04dc1978","line":28,"range":{"start_line":28,"start_character":40,"end_line":28,"end_character":49},"updated":"2023-08-18 06:38:07.000000000","message":"ditto","commit_id":"e6ebbb1cb56870654962b42a301ac480ee1b3da5"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"e862b0588d1fed0203a554117f636693a57f30bb","unresolved":true,"context_lines":[{"line_number":26,"context_line":"        path: \"{{ item.path }}\""},{"line_number":27,"context_line":"        owner: \"{{ item.owner | default(pki_owner) | default(omit) }}\""},{"line_number":28,"context_line":"        group: \"{{ item.group | default(pki_group) | default(omit) }}\""},{"line_number":29,"context_line":"        mode: \"{{ item.mode | default(omit) }}\""},{"line_number":30,"context_line":"      with_items:"},{"line_number":31,"context_line":"        - path: \"{{ ca_dir }}\""},{"line_number":32,"context_line":"          mode: \"{{ pki_cert_dir_mode }}\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"8d3e9c0c_725923f2","line":29,"range":{"start_line":29,"start_character":8,"end_line":29,"end_character":47},"updated":"2023-08-18 06:38:07.000000000","message":"is there a good reason why we don\u0027t enforce the mode to pki_cert_dir_mode and move the setting out from the list of items below?","commit_id":"e6ebbb1cb56870654962b42a301ac480ee1b3da5"},{"author":{"_account_id":31542,"name":"Andrew Bonney","email":"andrew.bonney@bbc.co.uk","username":"andrewbonney"},"change_message_id":"3d13dd5d2d07ca804ac2330117e81d41ac271c5b","unresolved":true,"context_lines":[{"line_number":26,"context_line":"        path: \"{{ item.path }}\""},{"line_number":27,"context_line":"        owner: \"{{ item.owner | default(pki_owner) | default(omit) }}\""},{"line_number":28,"context_line":"        group: \"{{ item.group | default(pki_group) | default(omit) }}\""},{"line_number":29,"context_line":"        mode: \"{{ item.mode | default(omit) }}\""},{"line_number":30,"context_line":"      with_items:"},{"line_number":31,"context_line":"        - path: \"{{ ca_dir }}\""},{"line_number":32,"context_line":"          mode: \"{{ pki_cert_dir_mode }}\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"d8be4026_02b34b36","line":29,"range":{"start_line":29,"start_character":8,"end_line":29,"end_character":47},"in_reply_to":"7f2b57a2_e659f96e","updated":"2023-08-18 10:12:58.000000000","message":"I could always use pki_cert_dir_mode as the default if preferred and just override where necessary in the list. I had tried to maintain some option to use \u0027omit\u0027 with mode setting, but if we\u0027re not concerned about that I could use sensible role defaults in all mode cases.","commit_id":"e6ebbb1cb56870654962b42a301ac480ee1b3da5"},{"author":{"_account_id":31542,"name":"Andrew Bonney","email":"andrew.bonney@bbc.co.uk","username":"andrewbonney"},"change_message_id":"bdeca9eefd8197243e28e0475b24a2dc4f19e2ab","unresolved":true,"context_lines":[{"line_number":26,"context_line":"        path: \"{{ item.path }}\""},{"line_number":27,"context_line":"        owner: \"{{ item.owner | default(pki_owner) | default(omit) }}\""},{"line_number":28,"context_line":"        group: \"{{ item.group | default(pki_group) | default(omit) }}\""},{"line_number":29,"context_line":"        mode: \"{{ item.mode | default(omit) }}\""},{"line_number":30,"context_line":"      with_items:"},{"line_number":31,"context_line":"        - path: \"{{ ca_dir }}\""},{"line_number":32,"context_line":"          mode: \"{{ pki_cert_dir_mode }}\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"7f2b57a2_e659f96e","line":29,"range":{"start_line":29,"start_character":8,"end_line":29,"end_character":47},"in_reply_to":"8d3e9c0c_725923f2","updated":"2023-08-18 09:56:59.000000000","message":"The list includes pki_cert_dir_mode and pki_key_dir_mode entries so I couldn\u0027t standardise on just one.","commit_id":"e6ebbb1cb56870654962b42a301ac480ee1b3da5"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"e862b0588d1fed0203a554117f636693a57f30bb","unresolved":true,"context_lines":[{"line_number":44,"context_line":"        state: file"},{"line_number":45,"context_line":"        path: \"{{ ca_dir ~ \u0027/private/\u0027 ~ ca.name ~ \u0027.key.pem\u0027 }}\""},{"line_number":46,"context_line":"        mode: \"{{ ca.key_mode | default(pki_key_mode) }}\""},{"line_number":47,"context_line":"        owner: \"{{ ca.key_owner | default(pki_owner) | default(omit) }}\""},{"line_number":48,"context_line":"        group: \"{{ ca.key_group | default(pki_group) | default(omit) }}\""},{"line_number":49,"context_line":"      failed_when: false"},{"line_number":50,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"60919875_be745287","line":47,"range":{"start_line":47,"start_character":42,"end_line":47,"end_character":51},"updated":"2023-08-18 06:38:07.000000000","message":"can we make the name of this match the style of `pki_key_mode`, i.e `pki_key_owner`?","commit_id":"e6ebbb1cb56870654962b42a301ac480ee1b3da5"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"e862b0588d1fed0203a554117f636693a57f30bb","unresolved":true,"context_lines":[{"line_number":45,"context_line":"        path: \"{{ ca_dir ~ \u0027/private/\u0027 ~ ca.name ~ \u0027.key.pem\u0027 }}\""},{"line_number":46,"context_line":"        mode: \"{{ ca.key_mode | default(pki_key_mode) }}\""},{"line_number":47,"context_line":"        owner: \"{{ ca.key_owner | default(pki_owner) | default(omit) }}\""},{"line_number":48,"context_line":"        group: \"{{ ca.key_group | default(pki_group) | default(omit) }}\""},{"line_number":49,"context_line":"      failed_when: false"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"    - name: Initialise the serial number for {{ ca.name }}"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"b8b93920_ac14a8f8","line":48,"range":{"start_line":48,"start_character":42,"end_line":48,"end_character":51},"updated":"2023-08-18 06:38:07.000000000","message":"ditto","commit_id":"e6ebbb1cb56870654962b42a301ac480ee1b3da5"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"e862b0588d1fed0203a554117f636693a57f30bb","unresolved":true,"context_lines":[{"line_number":61,"context_line":"        cipher: \"{{ (\u0027key_passphrase\u0027 in ca and ca.key_passphrase) | ternary(\u0027auto\u0027, omit) }}\""},{"line_number":62,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""},{"line_number":63,"context_line":"        mode: \"{{ ca.key_mode | default(pki_key_mode) }}\""},{"line_number":64,"context_line":"        owner: \"{{ ca.key_owner | default(pki_owner) | default(omit) }}\""},{"line_number":65,"context_line":"        group: \"{{ ca.key_group | default(pki_group) | default(omit) }}\""},{"line_number":66,"context_line":"      register: ca_privkey"},{"line_number":67,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"fcb0d201_cdab65af","line":64,"range":{"start_line":64,"start_character":42,"end_line":64,"end_character":51},"updated":"2023-08-18 06:38:07.000000000","message":"similar naming issue here?","commit_id":"e6ebbb1cb56870654962b42a301ac480ee1b3da5"}]}