)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"11497bf95ee4d7a00312eae0cfb8b1cedada8eef","unresolved":true,"context_lines":[{"line_number":25,"context_line":"For example, hashi_vault requires to define dns/ip/uri and other sans in"},{"line_number":26,"context_line":"completely different variables, while in standalone plugin we need to"},{"line_number":27,"context_line":"combine all of them in a string."},{"line_number":28,"context_line":"But generating a string in required format from the above dict is way"},{"line_number":29,"context_line":"easier than generating a dict in an expected format based on a string."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Change-Id: I2716e06207e31d34cd250e77ed7b555418b99492"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"d0f40455_c75e6d99","line":29,"range":{"start_line":28,"start_character":0,"end_line":29,"end_character":70},"updated":"2025-07-01 16:09:44.000000000","message":"this is probably very trivial with a python filter","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"}],"releasenotes/notes/change_san_format-bc67fffcfb4cd5ab.yaml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"78ad70ebaf350758c36fdf892228fa5c004a604e","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"other:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The format of `san` parameter in a ``pki_certificates`` variable was"},{"line_number":5,"context_line":"    changed from a string to the dictonary of lists. New dict can"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"8125ac72_ed089d37","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":5},"updated":"2025-06-26 13:12:11.000000000","message":"I\u0027d guess it should be `upgrade`?","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"1e08b99908e9b782f7dc873d05ccacbede1ebbc3","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"other:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The format of `san` parameter in a ``pki_certificates`` variable was"},{"line_number":5,"context_line":"    changed from a string to the dictonary of lists. New dict can"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ae293da4_bf416c3c","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":5},"in_reply_to":"8125ac72_ed089d37","updated":"2025-06-30 21:38:34.000000000","message":"Acknowledged","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"4a2c6cd30e54073798963b42d3daac12af39ee5d","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"other:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The format of `san` parameter in a ``pki_certificates`` variable was"},{"line_number":5,"context_line":"    changed from a string to the dictonary of lists. New dict can"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"b21a7020_b9b95e6e","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":5},"in_reply_to":"ae293da4_bf416c3c","updated":"2025-07-17 22:28:09.000000000","message":"Done","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"}],"tasks/standalone/sign_cert.yml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"78ad70ebaf350758c36fdf892228fa5c004a604e","unresolved":true,"context_lines":[{"line_number":30,"context_line":"        format: \"{{ cert.key_format | default(omit) }}\""},{"line_number":31,"context_line":"      register: cert_privkey"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    # NOTE(damiandabrowski): Only for reverse compatibility, remove after 2026.1"},{"line_number":34,"context_line":"    - name: Generate SAN in an expected format"},{"line_number":35,"context_line":"      ansible.builtin.set_fact:"},{"line_number":36,"context_line":"        generated_san: \u003e-"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1cce9539_afb27a05","line":33,"range":{"start_line":33,"start_character":29,"end_line":33,"end_character":59},"updated":"2025-06-26 13:12:11.000000000","message":"are you sure about that? As `is not string` means it will be done for new (dict) format only.","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"1e08b99908e9b782f7dc873d05ccacbede1ebbc3","unresolved":true,"context_lines":[{"line_number":30,"context_line":"        format: \"{{ cert.key_format | default(omit) }}\""},{"line_number":31,"context_line":"      register: cert_privkey"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    # NOTE(damiandabrowski): Only for reverse compatibility, remove after 2026.1"},{"line_number":34,"context_line":"    - name: Generate SAN in an expected format"},{"line_number":35,"context_line":"      ansible.builtin.set_fact:"},{"line_number":36,"context_line":"        generated_san: \u003e-"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"2e0ca163_a01de769","line":33,"range":{"start_line":33,"start_character":29,"end_line":33,"end_character":59},"in_reply_to":"1cce9539_afb27a05","updated":"2025-06-30 21:38:34.000000000","message":"yes, that\u0027s exactly what we need to. Here\u0027s a brief explanation why:\n\nstandalone backend uses `community.crypto.openssl_csr` which accepts `subject_alt_name` in a format like `\u0027DNS:www.ansible.com,DNS:m.ansible.com\u0027`\n\nhashi_vault backend uses `community.hashi_vault.vault_pki_generate_certificate` which accepts parameters `alt_names`, `ip_sans`, `uri_sans` and `other_sans`. The format of these arguments is a list.\n\nSo, these modules expect SANs to be provided in a completely different format, but from our side, we want to define SAN for a certificate in the backend-agnostic format.\n\nIt means that we need to implement a conversion somewhere, either:\n\nConvert standalone format(string) to backend format(list/dict) or the other way around.\n\nSince it\u0027s much easier to convert SAN from hashi_vault format to the format expected by standalone backend, we picked the latter.","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"ab9ba5a6a56916e61d01074f53f6e8d414ba0445","unresolved":true,"context_lines":[{"line_number":30,"context_line":"        format: \"{{ cert.key_format | default(omit) }}\""},{"line_number":31,"context_line":"      register: cert_privkey"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    # NOTE(damiandabrowski): Only for reverse compatibility, remove after 2026.1"},{"line_number":34,"context_line":"    - name: Generate SAN in an expected format"},{"line_number":35,"context_line":"      ansible.builtin.set_fact:"},{"line_number":36,"context_line":"        generated_san: \u003e-"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"e37bfa6f_8bcc5193","line":33,"range":{"start_line":33,"start_character":29,"end_line":33,"end_character":59},"in_reply_to":"2e0ca163_a01de769","updated":"2025-07-02 19:36:20.000000000","message":"Um. This does not change the fact that comment is wrong. As based on what you are saying - we are leaving `dict` format and removing the string from passed one.\n\nSo this conversion task would stay for the time being and will not go anywhere after 2026.1?","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"4a2c6cd30e54073798963b42d3daac12af39ee5d","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        format: \"{{ cert.key_format | default(omit) }}\""},{"line_number":31,"context_line":"      register: cert_privkey"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    # NOTE(damiandabrowski): Only for reverse compatibility, remove after 2026.1"},{"line_number":34,"context_line":"    - name: Generate SAN in an expected format"},{"line_number":35,"context_line":"      ansible.builtin.set_fact:"},{"line_number":36,"context_line":"        generated_san: \u003e-"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1b462d29_017505fe","line":33,"range":{"start_line":33,"start_character":29,"end_line":33,"end_character":59},"in_reply_to":"ce3a813c_fc8e8086","updated":"2025-07-17 22:28:09.000000000","message":"Done","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"92f35fc319ef18da26bd5afccd5ac4620dbbc915","unresolved":true,"context_lines":[{"line_number":30,"context_line":"        format: \"{{ cert.key_format | default(omit) }}\""},{"line_number":31,"context_line":"      register: cert_privkey"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    # NOTE(damiandabrowski): Only for reverse compatibility, remove after 2026.1"},{"line_number":34,"context_line":"    - name: Generate SAN in an expected format"},{"line_number":35,"context_line":"      ansible.builtin.set_fact:"},{"line_number":36,"context_line":"        generated_san: \u003e-"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ce3a813c_fc8e8086","line":33,"range":{"start_line":33,"start_character":29,"end_line":33,"end_character":59},"in_reply_to":"e37bfa6f_8bcc5193","updated":"2025-07-03 17:00:57.000000000","message":"you are right, the comment is wrong. I\u0027m sorry.\n\nConversion task will not go anywhere after 2026.1.\nBut we should drop this part of the condition: `and cert.san is not string` after 2026.1(when we drop support for \u0027string\u0027 format of cert.san).","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"78ad70ebaf350758c36fdf892228fa5c004a604e","unresolved":true,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    # NOTE(damiandabrowski): Only for reverse compatibility, remove after 2026.1"},{"line_number":34,"context_line":"    - name: Generate SAN in an expected format"},{"line_number":35,"context_line":"      ansible.builtin.set_fact:"},{"line_number":36,"context_line":"        generated_san: \u003e-"},{"line_number":37,"context_line":"          {{"},{"line_number":38,"context_line":"            [\u0027DNS:\u0027 + (cert.san.dns | unique | join(\u0027,DNS:\u0027)) if cert.san.dns | default([]) else \u0027\u0027,"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"d91229e9_68bc1b59","line":35,"range":{"start_line":35,"start_character":6,"end_line":35,"end_character":30},"updated":"2025-06-26 13:12:11.000000000","message":"can you move that to the `vars` section of next task rather then do it via `set_fact`?","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"f3ee3e60f8e046902032c600a66e16e68896a79e","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    # NOTE(damiandabrowski): Only for reverse compatibility, remove after 2026.1"},{"line_number":34,"context_line":"    - name: Generate SAN in an expected format"},{"line_number":35,"context_line":"      ansible.builtin.set_fact:"},{"line_number":36,"context_line":"        generated_san: \u003e-"},{"line_number":37,"context_line":"          {{"},{"line_number":38,"context_line":"            [\u0027DNS:\u0027 + (cert.san.dns | unique | join(\u0027,DNS:\u0027)) if cert.san.dns | default([]) else \u0027\u0027,"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ef614b39_70357faf","line":35,"range":{"start_line":35,"start_character":6,"end_line":35,"end_character":30},"in_reply_to":"2a895c57_7b7c0cc9","updated":"2025-07-23 16:52:29.000000000","message":"that\u0027s actually a good idea. Change applied.","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"23a9e37ecd235a5d3aef4117353d104277aa9b1a","unresolved":true,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    # NOTE(damiandabrowski): Only for reverse compatibility, remove after 2026.1"},{"line_number":34,"context_line":"    - name: Generate SAN in an expected format"},{"line_number":35,"context_line":"      ansible.builtin.set_fact:"},{"line_number":36,"context_line":"        generated_san: \u003e-"},{"line_number":37,"context_line":"          {{"},{"line_number":38,"context_line":"            [\u0027DNS:\u0027 + (cert.san.dns | unique | join(\u0027,DNS:\u0027)) if cert.san.dns | default([]) else \u0027\u0027,"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"2a895c57_7b7c0cc9","line":35,"range":{"start_line":35,"start_character":6,"end_line":35,"end_character":30},"in_reply_to":"3c4a2968_06fe851f","updated":"2025-07-23 08:55:27.000000000","message":"Given I get the logic here:\n\n```\n- name: Create the CSR for {{ cert.name }}\n  vars:\n    generated_san: \u003e-\n      {{\n         [\u0027DNS:\u0027 + (cert.san.dns | unique | join(\u0027,DNS:\u0027)) if cert.san.dns | default([]) else \u0027\u0027,\n          \u0027IP:\u0027 + (cert.san.ip | unique | join(\u0027,IP:\u0027)) if cert.san.ip | default([]) else \u0027\u0027]\n            | reject(\u0027equalto\u0027, \u0027\u0027) | join(\u0027,\u0027)\n      }}\n   community.crypto.openssl_csr:\n     subject_alt_name: \"{{ (cert.san is defined and cert.san is not string) | ternary(generated_san, cert.san | default(omit)) }}\"\n     ...\n     ...\n```","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"1e08b99908e9b782f7dc873d05ccacbede1ebbc3","unresolved":true,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    # NOTE(damiandabrowski): Only for reverse compatibility, remove after 2026.1"},{"line_number":34,"context_line":"    - name: Generate SAN in an expected format"},{"line_number":35,"context_line":"      ansible.builtin.set_fact:"},{"line_number":36,"context_line":"        generated_san: \u003e-"},{"line_number":37,"context_line":"          {{"},{"line_number":38,"context_line":"            [\u0027DNS:\u0027 + (cert.san.dns | unique | join(\u0027,DNS:\u0027)) if cert.san.dns | default([]) else \u0027\u0027,"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"3c4a2968_06fe851f","line":35,"range":{"start_line":35,"start_character":6,"end_line":35,"end_character":30},"in_reply_to":"d91229e9_68bc1b59","updated":"2025-06-30 21:38:34.000000000","message":"but I defined a separate task because of the condition: `when: cert.san is defined and cert.san is not string`.\n\nDo you think it would really be easier to implement this logic in a task vars? If so, how?","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"78ad70ebaf350758c36fdf892228fa5c004a604e","unresolved":true,"context_lines":[{"line_number":37,"context_line":"          {{"},{"line_number":38,"context_line":"            [\u0027DNS:\u0027 + (cert.san.dns | unique | join(\u0027,DNS:\u0027)) if cert.san.dns | default([]) else \u0027\u0027,"},{"line_number":39,"context_line":"             \u0027IP:\u0027 + (cert.san.ip | unique | join(\u0027,IP:\u0027)) if cert.san.ip | default([]) else \u0027\u0027]"},{"line_number":40,"context_line":"            | reject(\u0027equalto\u0027, \u0027\u0027) | join(\u0027,\u0027)"},{"line_number":41,"context_line":"          }}"},{"line_number":42,"context_line":"      when: cert.san is defined and cert.san is not string"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"e7e884f4_416a6770","line":40,"range":{"start_line":40,"start_character":14,"end_line":40,"end_character":35},"updated":"2025-06-26 13:12:11.000000000","message":"I think you could do just `select()` here, but not a big deal","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"4a2c6cd30e54073798963b42d3daac12af39ee5d","unresolved":false,"context_lines":[{"line_number":37,"context_line":"          {{"},{"line_number":38,"context_line":"            [\u0027DNS:\u0027 + (cert.san.dns | unique | join(\u0027,DNS:\u0027)) if cert.san.dns | default([]) else \u0027\u0027,"},{"line_number":39,"context_line":"             \u0027IP:\u0027 + (cert.san.ip | unique | join(\u0027,IP:\u0027)) if cert.san.ip | default([]) else \u0027\u0027]"},{"line_number":40,"context_line":"            | reject(\u0027equalto\u0027, \u0027\u0027) | join(\u0027,\u0027)"},{"line_number":41,"context_line":"          }}"},{"line_number":42,"context_line":"      when: cert.san is defined and cert.san is not string"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"f3aa10ef_067de62f","line":40,"range":{"start_line":40,"start_character":14,"end_line":40,"end_character":35},"in_reply_to":"75be7c06_b1829d3c","updated":"2025-07-17 22:28:09.000000000","message":"Done","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"1e08b99908e9b782f7dc873d05ccacbede1ebbc3","unresolved":true,"context_lines":[{"line_number":37,"context_line":"          {{"},{"line_number":38,"context_line":"            [\u0027DNS:\u0027 + (cert.san.dns | unique | join(\u0027,DNS:\u0027)) if cert.san.dns | default([]) else \u0027\u0027,"},{"line_number":39,"context_line":"             \u0027IP:\u0027 + (cert.san.ip | unique | join(\u0027,IP:\u0027)) if cert.san.ip | default([]) else \u0027\u0027]"},{"line_number":40,"context_line":"            | reject(\u0027equalto\u0027, \u0027\u0027) | join(\u0027,\u0027)"},{"line_number":41,"context_line":"          }}"},{"line_number":42,"context_line":"      when: cert.san is defined and cert.san is not string"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"75be7c06_b1829d3c","line":40,"range":{"start_line":40,"start_character":14,"end_line":40,"end_character":35},"in_reply_to":"e7e884f4_416a6770","updated":"2025-06-30 21:38:34.000000000","message":"Acknowledged","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"11497bf95ee4d7a00312eae0cfb8b1cedada8eef","unresolved":true,"context_lines":[{"line_number":51,"context_line":"        basic_constraints: \"{{ cert.basic_constraints | default(omit) }}\""},{"line_number":52,"context_line":"        key_usage: \"{{ cert.key_usage | default(omit) }}\""},{"line_number":53,"context_line":"        extended_key_usage: \"{{ cert.extended_key_usage | default(omit) }}\""},{"line_number":54,"context_line":"        # NOTE(damiandabrowski): generated_san is used only to keep reverse compatibility, remove after 2026.1"},{"line_number":55,"context_line":"        subject_alt_name: \"{{ (generated_san | default(cert.san)) | default(omit) }}\""},{"line_number":56,"context_line":"        country_name: \"{{ cert.country_name | default(omit) }}\""},{"line_number":57,"context_line":"        state_or_province_name: \"{{ cert.state_or_province_name | default(omit) }}\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"810f4407_766dcde4","line":54,"range":{"start_line":54,"start_character":8,"end_line":54,"end_character":110},"updated":"2025-07-01 16:09:44.000000000","message":"Don\u0027t we always need to keep the backward compatibility as thats what the openssl_csr module needs as input?","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"78ad70ebaf350758c36fdf892228fa5c004a604e","unresolved":true,"context_lines":[{"line_number":51,"context_line":"        basic_constraints: \"{{ cert.basic_constraints | default(omit) }}\""},{"line_number":52,"context_line":"        key_usage: \"{{ cert.key_usage | default(omit) }}\""},{"line_number":53,"context_line":"        extended_key_usage: \"{{ cert.extended_key_usage | default(omit) }}\""},{"line_number":54,"context_line":"        # NOTE(damiandabrowski): generated_san is used only to keep reverse compatibility, remove after 2026.1"},{"line_number":55,"context_line":"        subject_alt_name: \"{{ (generated_san | default(cert.san)) | default(omit) }}\""},{"line_number":56,"context_line":"        country_name: \"{{ cert.country_name | default(omit) }}\""},{"line_number":57,"context_line":"        state_or_province_name: \"{{ cert.state_or_province_name | default(omit) }}\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"f583b44a_81b6352c","line":54,"range":{"start_line":54,"start_character":33,"end_line":54,"end_character":89},"updated":"2025-06-26 13:12:11.000000000","message":"again, not sure if that is true?","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"92f35fc319ef18da26bd5afccd5ac4620dbbc915","unresolved":true,"context_lines":[{"line_number":51,"context_line":"        basic_constraints: \"{{ cert.basic_constraints | default(omit) }}\""},{"line_number":52,"context_line":"        key_usage: \"{{ cert.key_usage | default(omit) }}\""},{"line_number":53,"context_line":"        extended_key_usage: \"{{ cert.extended_key_usage | default(omit) }}\""},{"line_number":54,"context_line":"        # NOTE(damiandabrowski): generated_san is used only to keep reverse compatibility, remove after 2026.1"},{"line_number":55,"context_line":"        subject_alt_name: \"{{ (generated_san | default(cert.san)) | default(omit) }}\""},{"line_number":56,"context_line":"        country_name: \"{{ cert.country_name | default(omit) }}\""},{"line_number":57,"context_line":"        state_or_province_name: \"{{ cert.state_or_province_name | default(omit) }}\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"dd2cbac0_ee749b7e","line":54,"range":{"start_line":54,"start_character":8,"end_line":54,"end_character":110},"in_reply_to":"1928d682_07570058","updated":"2025-07-03 17:00:57.000000000","message":"that\u0027s my bad, sorry for the confusion.\n\n`generated_san` should stay there forever.\n\nThe only thing that should be dropped after 2026.1(when we drop support for the old \u0027string\u0027 format of `cert.san` is a ` | default(cert.san)` fallback.","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"ab9ba5a6a56916e61d01074f53f6e8d414ba0445","unresolved":true,"context_lines":[{"line_number":51,"context_line":"        basic_constraints: \"{{ cert.basic_constraints | default(omit) }}\""},{"line_number":52,"context_line":"        key_usage: \"{{ cert.key_usage | default(omit) }}\""},{"line_number":53,"context_line":"        extended_key_usage: \"{{ cert.extended_key_usage | default(omit) }}\""},{"line_number":54,"context_line":"        # NOTE(damiandabrowski): generated_san is used only to keep reverse compatibility, remove after 2026.1"},{"line_number":55,"context_line":"        subject_alt_name: \"{{ (generated_san | default(cert.san)) | default(omit) }}\""},{"line_number":56,"context_line":"        country_name: \"{{ cert.country_name | default(omit) }}\""},{"line_number":57,"context_line":"        state_or_province_name: \"{{ cert.state_or_province_name | default(omit) }}\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1928d682_07570058","line":54,"range":{"start_line":54,"start_character":8,"end_line":54,"end_character":110},"in_reply_to":"810f4407_766dcde4","updated":"2025-07-02 19:36:20.000000000","message":"exactly my point above","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"4a2c6cd30e54073798963b42d3daac12af39ee5d","unresolved":false,"context_lines":[{"line_number":51,"context_line":"        basic_constraints: \"{{ cert.basic_constraints | default(omit) }}\""},{"line_number":52,"context_line":"        key_usage: \"{{ cert.key_usage | default(omit) }}\""},{"line_number":53,"context_line":"        extended_key_usage: \"{{ cert.extended_key_usage | default(omit) }}\""},{"line_number":54,"context_line":"        # NOTE(damiandabrowski): generated_san is used only to keep reverse compatibility, remove after 2026.1"},{"line_number":55,"context_line":"        subject_alt_name: \"{{ (generated_san | default(cert.san)) | default(omit) }}\""},{"line_number":56,"context_line":"        country_name: \"{{ cert.country_name | default(omit) }}\""},{"line_number":57,"context_line":"        state_or_province_name: \"{{ cert.state_or_province_name | default(omit) }}\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"119e5da4_39070bb5","line":54,"range":{"start_line":54,"start_character":8,"end_line":54,"end_character":110},"in_reply_to":"dd2cbac0_ee749b7e","updated":"2025-07-17 22:28:09.000000000","message":"Done","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"1e08b99908e9b782f7dc873d05ccacbede1ebbc3","unresolved":false,"context_lines":[{"line_number":51,"context_line":"        basic_constraints: \"{{ cert.basic_constraints | default(omit) }}\""},{"line_number":52,"context_line":"        key_usage: \"{{ cert.key_usage | default(omit) }}\""},{"line_number":53,"context_line":"        extended_key_usage: \"{{ cert.extended_key_usage | default(omit) }}\""},{"line_number":54,"context_line":"        # NOTE(damiandabrowski): generated_san is used only to keep reverse compatibility, remove after 2026.1"},{"line_number":55,"context_line":"        subject_alt_name: \"{{ (generated_san | default(cert.san)) | default(omit) }}\""},{"line_number":56,"context_line":"        country_name: \"{{ cert.country_name | default(omit) }}\""},{"line_number":57,"context_line":"        state_or_province_name: \"{{ cert.state_or_province_name | default(omit) }}\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"15b206d8_67c62715","line":54,"range":{"start_line":54,"start_character":33,"end_line":54,"end_character":89},"in_reply_to":"f583b44a_81b6352c","updated":"2025-06-30 21:38:34.000000000","message":"Done","commit_id":"9faba07fc4f1b701f5a98d4b037613e4d1b922a3"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"7f0acd85c362cac1ff8da9cc38a2170b7f2bca4a","unresolved":true,"context_lines":[{"line_number":51,"context_line":"        extended_key_usage: \"{{ cert.extended_key_usage | default(omit) }}\""},{"line_number":52,"context_line":"        # NOTE(damiandabrowski) After 2026.1 switch to just:"},{"line_number":53,"context_line":"        #                       subject_alt_name: \"{{ generated_san | default(omit) }}\""},{"line_number":54,"context_line":"        subject_alt_name: \"{{ (cert.san is defined and cert.san is not string) | ternary(generated_san, cert.san | default(omit)) }}\""},{"line_number":55,"context_line":"        country_name: \"{{ cert.country_name | default(omit) }}\""},{"line_number":56,"context_line":"        state_or_province_name: \"{{ cert.state_or_province_name | default(omit) }}\""},{"line_number":57,"context_line":"        locality_name: \"{{ cert.locality_name | default(omit) }}\""}],"source_content_type":"text/x-yaml","patch_set":12,"id":"ada81b83_bacf3b16","line":54,"range":{"start_line":54,"start_character":0,"end_line":54,"end_character":133},"updated":"2025-09-12 07:48:40.000000000","message":"I can recall smth that ternary does resolve both variables before checking for condition. It could be solved in ansible ofc, and I\u0027d guess we were failing tests if it wasn\u0027t the case?","commit_id":"8e02b531960b2566f633c2115ce8bcb7b3bd90a1"}]}