)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"8752af058c94e1480e7618be782072ed1a1e2d73","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"cfcad28e_c1c155fb","updated":"2025-06-26 13:55:20.000000000","message":"I would also argue, that instead of this affecting each repo patch, we could do just that for vault provider:\n\n`ttl: \"{{ item.ttl | default(item.not_after | regex_search(\u0027^\\\\+\\\\s?(\\\\d+\\\\s?[a-z]+)$\u0027, \u0027\\\\1\u0027)) }}\"`\n\nWhich likely is way simpler then all side-effects of this change.","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"23aebe5fab604d23d13786d5029cebc049b3f18b","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"d3b49f37_26f67bec","in_reply_to":"b6224674_9dff235b","updated":"2025-07-03 10:09:55.000000000","message":"We can go with changing format to `ttl`, as you\u0027ve proposed as well, but I totally don\u0027t like the approach of slicing strings...","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"892e39f7e6c4f4faa2c2d0245605e2040fc20d84","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"b6224674_9dff235b","in_reply_to":"c10e6abf_f90c332b","updated":"2025-07-03 10:07:34.000000000","message":"\u003e What do you mean? This change affects only CA defs which are not a part of each repository.\n\nOh, wait, we don\u0027t have a configurable `not_after` for `standalone`? That is really smth that should be configurable, imo...\n\nAnd I see you\u0027ve added ability to vault backend: https://review.opendev.org/c/openstack/ansible-role-pki/+/948881/6/tasks/hashi_vault/sign_cert.yml#55\n\nSo imo, these capabilities should be aligned as well. I think we also discussed a shorter-living certs for `standalone` on PTG fwiw.\n\n\u003e So, my idea was mainly dictated by the fact that hashicorp vault API accepts both ttl and not_after, but the format of not_after in hashicorp vault API is different than not_after accepted by community.crypto.\n\nSo you prioritize confusion for way more widespread `standalone` backend over possible confusion over brand new backend we\u0027re adding?\n\nI\u0027m not sure I agree with this logic.\n\nAs for `standalone` we have to use `+\u003ctime\u003e` anyway, but for vault we can have default of `ttl` or fallback to `not_after` format of `standalone` backend with some conversion.","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"f7dc850fd9ccc7d756ec04f59ef1cdacc8c9e890","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"c10e6abf_f90c332b","in_reply_to":"cfcad28e_c1c155fb","updated":"2025-06-30 22:10:57.000000000","message":"\u003e I would also argue, that instead of this affecting each repo patch\n\nWhat do you mean? This change affects only CA defs which are not a part of each repository.\n\n\u003e we could do just that for vault provider:\n\nSo, my idea was mainly dictated by the fact that hashicorp vault API accepts both `ttl` and `not_after`, but the format of `not_after` in hashicorp vault API is different than `not_after` accepted by `community.crypto`.\n\nYour proposal will most likely work, but it means that we will stick to the format `not_after: +\u003csomething\u003e` which can be confusing because we will continue defining `not_after` in a `ttl`-like format by default, and then apply some logic in hashi_vault backend to inject the value from `not_after`(our input) to the `ttl` parameter in hashicorp API.\n\nhttps://developer.hashicorp.com/vault/api-docs/secret/pki#ttl\nhttps://developer.hashicorp.com/vault/api-docs/secret/pki#not_after","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"4f7576f9822c74bc9e42439b5b69197afd31f41a","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"08bb3884_7b11c3c5","in_reply_to":"d3b49f37_26f67bec","updated":"2025-07-03 15:27:54.000000000","message":"\u003e So you prioritize confusion for way more widespread standalone backend over possible confusion over brand new backend we\u0027re adding?\n\nI really don\u0027t want to do that, so I went through this topic once again today and wrote down some thoughts.\n\n\u003e As for standalone we have to use +\u003ctime\u003e anyway\n\nWe don\u0027t have to and that\u0027s the point(I\u0027m talking about `ttl` passed by the user, not about role internals).\n\n\nI\u0027m sending a summary of my thoughts. I also realized that your original suggestion won\u0027t work in some circumstances:\n\n\n\n\n## standalone backend\n### ttl\nnot supported\n\n### not_after (supported only for CA certs at the moment)\nformat(user input - old): `\\+(\\d+(s|m|h|d|w|y))+` (ex. `+90d`)\nformat(user input - new, after renaming to `ttl`): `(\\d+(s|m|h|d|w|y))+` (ex. `90d`)\nformat(accepted by community.crypto.x509_certificate): `\\+(\\d+(s|m|h|d|w|y))+` (ex. `+90d`)\n\n## hashi_vault backend\n### ttl\nformat(user input): `(\\d+(s|m|h|d|w|y))+` (ex. `90d`)\nformat(accepted by community.hashi_vault.vault_pki_generate_certificate): `^(\\d+(s|m|h|d|w|y))+` (ex. `90d`)\n\n### not_after\nformat(user input): `^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z` (ex. `2025-12-31T23:59:59Z`)\nformat(accepted by community.hashi_vault.vault_pki_generate_certificate): `^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z` (ex. `2025-12-31T23:59:59Z`)\n\n\n-------\n**Pros of abandoning `not_after` in favor of `ttl`(in a new format) in `standalone` backend:**\n- consistent `not_after` and `ttl` parameter format across all backends(from the user-input perspective)\n\n**Cons of abandoning `not_after` in favor of `ttl`(in a new format) in `standalone` backend:**\n- users will have to change `not_after` to `ttl` in pki_authorities_* (but since not_after/ttl is not supported for service cerificates, it shouldn\u0027t a big issue)\n\n**Pros of `ttl: \"{{ item.ttl | default(item.not_after | regex_search(\u0027^\\\\+\\\\s?(\\\\d+\\\\s?[a-z]+)$\u0027, \u0027\\\\1\u0027)) }}\"`:**\n- standalone backend users won\u0027t need to change anything\n\n**Cons of `ttl: \"{{ item.ttl | default(item.not_after | regex_search(\u0027^\\\\+\\\\s?(\\\\d+\\\\s?[a-z]+)$\u0027, \u0027\\\\1\u0027)) }}\"`:**\n- will not work with hashi_vault backend when user wants to define `not_after` (in a traditional `not_after` format) instead of `ttl`. `not_after` will be applied to both `ttl` and `not_after` parameters from `community.hashi_vault.vault_pki_generate_certificate`\n- may be confusing for hashi_vault backend users when `not_after` parameter(from user input) is then applied as `ttl` parameter for the `community.hashi_vault.vault_pki_generate_certificate`","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"}],"releasenotes/notes/not_after_deprecation-67d688b733e1e3f5.yaml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"f138529a2408fd16be04675fca9de820852546b3","unresolved":true,"context_lines":[{"line_number":4,"context_line":"    ``not_after`` parameter in ``pki_authorities`` was marked for"},{"line_number":5,"context_line":"    deprecation."},{"line_number":6,"context_line":"    ``ttl`` should be used instead in a format of ``\u003cduration\u003e\u003cunit\u003e``"},{"line_number":7,"context_line":"    (ex. 7d)."}],"source_content_type":"text/x-yaml","patch_set":11,"id":"3b481423_b9f9e681","line":7,"updated":"2025-07-23 18:11:40.000000000","message":"can you please add a new line at end here?","commit_id":"a8c18b342b4a5e8c613fe72a7d3eda64e3725e8c"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"87a6f4ec0e41fd2a50b3755d972bb5d7f1ff247c","unresolved":false,"context_lines":[{"line_number":4,"context_line":"    ``not_after`` parameter in ``pki_authorities`` was marked for"},{"line_number":5,"context_line":"    deprecation."},{"line_number":6,"context_line":"    ``ttl`` should be used instead in a format of ``\u003cduration\u003e\u003cunit\u003e``"},{"line_number":7,"context_line":"    (ex. 7d)."}],"source_content_type":"text/x-yaml","patch_set":11,"id":"c37d1b07_d2903108","line":7,"in_reply_to":"3b481423_b9f9e681","updated":"2025-07-23 18:22:19.000000000","message":"Done","commit_id":"a8c18b342b4a5e8c613fe72a7d3eda64e3725e8c"}],"tasks/standalone/create_ca.yml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"8752af058c94e1480e7618be782072ed1a1e2d73","unresolved":true,"context_lines":[{"line_number":120,"context_line":"        provider: \"selfsigned\""},{"line_number":121,"context_line":"        privatekey_path: \"{{ ca_privkey.filename }}\""},{"line_number":122,"context_line":"        privatekey_passphrase: \"{{ ca.key_passphrase | default(omit) }}\""},{"line_number":123,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":124,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":125,"context_line":"        selfsigned_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":126,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"681dd8eb_3f24139c","line":123,"range":{"start_line":123,"start_character":118,"end_line":123,"end_character":124},"updated":"2025-06-26 13:55:20.000000000","message":"2026.1?","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"4ff777bd76484a5d06656a95abeedf6b7bf831c1","unresolved":false,"context_lines":[{"line_number":120,"context_line":"        provider: \"selfsigned\""},{"line_number":121,"context_line":"        privatekey_path: \"{{ ca_privkey.filename }}\""},{"line_number":122,"context_line":"        privatekey_passphrase: \"{{ ca.key_passphrase | default(omit) }}\""},{"line_number":123,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":124,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":125,"context_line":"        selfsigned_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":126,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"8d49684e_c851efc4","line":123,"range":{"start_line":123,"start_character":118,"end_line":123,"end_character":124},"in_reply_to":"1500c858_3638a4dc","updated":"2025-07-17 22:34:04.000000000","message":"Done","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"892e39f7e6c4f4faa2c2d0245605e2040fc20d84","unresolved":true,"context_lines":[{"line_number":120,"context_line":"        provider: \"selfsigned\""},{"line_number":121,"context_line":"        privatekey_path: \"{{ ca_privkey.filename }}\""},{"line_number":122,"context_line":"        privatekey_passphrase: \"{{ ca.key_passphrase | default(omit) }}\""},{"line_number":123,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":124,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":125,"context_line":"        selfsigned_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":126,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"a80d14d1_daa389ea","line":123,"range":{"start_line":123,"start_character":118,"end_line":123,"end_character":124},"in_reply_to":"15d581b1_471f9fce","updated":"2025-07-03 10:07:34.000000000","message":"If we even land it for `2026.1` - we can drop it `after 2026.1` release. As we need to keep upgrade path only between SLUPR (2025.1 -\u003e 2026.1 or 2025.2-\u003e2026.1). Then, we can expect people to adopt their vars to go over 2026.1.","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"f7dc850fd9ccc7d756ec04f59ef1cdacc8c9e890","unresolved":true,"context_lines":[{"line_number":120,"context_line":"        provider: \"selfsigned\""},{"line_number":121,"context_line":"        privatekey_path: \"{{ ca_privkey.filename }}\""},{"line_number":122,"context_line":"        privatekey_passphrase: \"{{ ca.key_passphrase | default(omit) }}\""},{"line_number":123,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":124,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":125,"context_line":"        selfsigned_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":126,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"15d581b1_471f9fce","line":123,"range":{"start_line":123,"start_character":118,"end_line":123,"end_character":124},"in_reply_to":"681dd8eb_3f24139c","updated":"2025-06-30 22:10:57.000000000","message":"if we will be lucky enough, we will manage to merge this patch in 2025.2.\n\nIs it acceptable to drop backward compatibility in 2026.1? If so, I will update it.\n\nI just thought it\u0027s a bit too early.","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"4f7576f9822c74bc9e42439b5b69197afd31f41a","unresolved":true,"context_lines":[{"line_number":120,"context_line":"        provider: \"selfsigned\""},{"line_number":121,"context_line":"        privatekey_path: \"{{ ca_privkey.filename }}\""},{"line_number":122,"context_line":"        privatekey_passphrase: \"{{ ca.key_passphrase | default(omit) }}\""},{"line_number":123,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":124,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":125,"context_line":"        selfsigned_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":126,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"1500c858_3638a4dc","line":123,"range":{"start_line":123,"start_character":118,"end_line":123,"end_character":124},"in_reply_to":"a80d14d1_daa389ea","updated":"2025-07-03 15:27:54.000000000","message":"ah yes, you\u0027re totally right. Ack, I\u0027ll change the comment.","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"8752af058c94e1480e7618be782072ed1a1e2d73","unresolved":true,"context_lines":[{"line_number":122,"context_line":"        privatekey_passphrase: \"{{ ca.key_passphrase | default(omit) }}\""},{"line_number":123,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":124,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":125,"context_line":"        selfsigned_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":126,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""},{"line_number":127,"context_line":"      register: ca_selfsigned_crt"},{"line_number":128,"context_line":"      when:"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"b755f857_d148c5d7","line":125,"range":{"start_line":125,"start_character":59,"end_line":125,"end_character":89},"updated":"2025-06-26 13:55:20.000000000","message":"wouldn\u0027t it be better to use regexp here?\n`| regex_search(\u0027^\\\\+\\\\s?\\\\d+\\\\s?[a-z]+$\u0027)`","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"568ecc974ea9969f41224c968988279e212eab84","unresolved":true,"context_lines":[{"line_number":122,"context_line":"        privatekey_passphrase: \"{{ ca.key_passphrase | default(omit) }}\""},{"line_number":123,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":124,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":125,"context_line":"        selfsigned_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":126,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""},{"line_number":127,"context_line":"      register: ca_selfsigned_crt"},{"line_number":128,"context_line":"      when:"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"fd42c2b6_6c6360a2","line":125,"range":{"start_line":125,"start_character":59,"end_line":125,"end_character":89},"in_reply_to":"22eeb4d0_5019ef79","updated":"2025-07-23 09:00:21.000000000","message":"I just disagree with that.\n\n* Slicing of strings is *always* way less reliable then regexp. What will be the result of your slicing if user passes `not_after: \" +365\"`?\n* Regex always can be really easily verified against the value. Slicing can not. So while both are not readable, regexp at least can be debugged.","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"5057b8a394391ed5a3d544719a57278708048a58","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        privatekey_passphrase: \"{{ ca.key_passphrase | default(omit) }}\""},{"line_number":123,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":124,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":125,"context_line":"        selfsigned_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":126,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""},{"line_number":127,"context_line":"      register: ca_selfsigned_crt"},{"line_number":128,"context_line":"      when:"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"aad433bf_dca05545","line":125,"range":{"start_line":125,"start_character":59,"end_line":125,"end_character":89},"in_reply_to":"43e0a18a_3fa0fc4d","updated":"2025-07-23 18:07:59.000000000","message":"looks like we have a different opinion here :D \n\nanyway, it\u0027s not a big deal, I changed it to regex.","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"271978654375ca534827b1dc67feb512d67e0f70","unresolved":true,"context_lines":[{"line_number":122,"context_line":"        privatekey_passphrase: \"{{ ca.key_passphrase | default(omit) }}\""},{"line_number":123,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":124,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":125,"context_line":"        selfsigned_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":126,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""},{"line_number":127,"context_line":"      register: ca_selfsigned_crt"},{"line_number":128,"context_line":"      when:"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"43e0a18a_3fa0fc4d","line":125,"range":{"start_line":125,"start_character":59,"end_line":125,"end_character":89},"in_reply_to":"9698a36a_79e01bbd","updated":"2025-07-23 09:10:03.000000000","message":"Ok, and for `+32w1d2h` it would be `^\\\\s*\\\\+\\\\s?\\\\d+\\\\s?[\\\\w,\\\\d]+$`\nSo it literally takes a minute to fix it if/when needed. While some cases you just can\u0027t deal with slicing","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"4f7576f9822c74bc9e42439b5b69197afd31f41a","unresolved":true,"context_lines":[{"line_number":122,"context_line":"        privatekey_passphrase: \"{{ ca.key_passphrase | default(omit) }}\""},{"line_number":123,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":124,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":125,"context_line":"        selfsigned_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":126,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""},{"line_number":127,"context_line":"      register: ca_selfsigned_crt"},{"line_number":128,"context_line":"      when:"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"22eeb4d0_5019ef79","line":125,"range":{"start_line":125,"start_character":59,"end_line":125,"end_character":89},"in_reply_to":"b755f857_d148c5d7","updated":"2025-07-03 15:27:54.000000000","message":"For me, my version is just easier to read and understand for a human. It also minimizes the chance of mistakes. For example, your regex doesn\u0027t match formats like `+32w1d2h` which are accepted by `community.crypto.x509_certificate`.\n\nBut that\u0027s probably just a matter of preference.","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"e25e602d7bb4eb28a9d672c47d1f8b794aa64550","unresolved":true,"context_lines":[{"line_number":122,"context_line":"        privatekey_passphrase: \"{{ ca.key_passphrase | default(omit) }}\""},{"line_number":123,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":124,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":125,"context_line":"        selfsigned_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":126,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""},{"line_number":127,"context_line":"      register: ca_selfsigned_crt"},{"line_number":128,"context_line":"      when:"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9698a36a_79e01bbd","line":125,"range":{"start_line":125,"start_character":59,"end_line":125,"end_character":89},"in_reply_to":"fd42c2b6_6c6360a2","updated":"2025-07-23 09:05:40.000000000","message":"btw yes, my regexp also does not catch this situation. But `^\\\\s?\\\\+\\\\s?\\\\d+\\\\s?[a-z]+$` would :)","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"8752af058c94e1480e7618be782072ed1a1e2d73","unresolved":true,"context_lines":[{"line_number":141,"context_line":"        ownca_path: \"{{ pki_dir ~ \u0027/roots/\u0027 ~ ca.signed_by ~ \u0027/certs/\u0027 ~ ca.signed_by ~ \u0027.crt\u0027 }}\""},{"line_number":142,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":143,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":144,"context_line":"        ownca_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":145,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""},{"line_number":146,"context_line":"      register: ca_ownca_crt"},{"line_number":147,"context_line":"      when:"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"cbf0e36d_afaa549d","line":144,"range":{"start_line":144,"start_character":56,"end_line":144,"end_character":84},"updated":"2025-06-26 13:55:20.000000000","message":"ditto","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"5057b8a394391ed5a3d544719a57278708048a58","unresolved":false,"context_lines":[{"line_number":141,"context_line":"        ownca_path: \"{{ pki_dir ~ \u0027/roots/\u0027 ~ ca.signed_by ~ \u0027/certs/\u0027 ~ ca.signed_by ~ \u0027.crt\u0027 }}\""},{"line_number":142,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":143,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":144,"context_line":"        ownca_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":145,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""},{"line_number":146,"context_line":"      register: ca_ownca_crt"},{"line_number":147,"context_line":"      when:"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"349cf41f_9a33670f","line":144,"range":{"start_line":144,"start_character":56,"end_line":144,"end_character":84},"in_reply_to":"c8cabf2d_38cb4445","updated":"2025-07-23 18:07:59.000000000","message":"Done","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"4f7576f9822c74bc9e42439b5b69197afd31f41a","unresolved":true,"context_lines":[{"line_number":141,"context_line":"        ownca_path: \"{{ pki_dir ~ \u0027/roots/\u0027 ~ ca.signed_by ~ \u0027/certs/\u0027 ~ ca.signed_by ~ \u0027.crt\u0027 }}\""},{"line_number":142,"context_line":"        # NOTE(damiandabrowski): not_after support is kept only for backward compatbility and should be removed after 2027.1"},{"line_number":143,"context_line":"        # NOTE(damiandabrowski): ensures that \u0027+\u0027 is added at the beginning"},{"line_number":144,"context_line":"        ownca_not_after: \"{{ (\u0027+\u0027 if not (ca.not_after | default(ca.ttl))[:1] \u003d\u003d \u0027+\u0027 else \u0027\u0027) + (ca.not_after | default(ca.ttl)) }}\""},{"line_number":145,"context_line":"        backup: \"{{ ca.backup | default(True) }}\""},{"line_number":146,"context_line":"      register: ca_ownca_crt"},{"line_number":147,"context_line":"      when:"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"c8cabf2d_38cb4445","line":144,"range":{"start_line":144,"start_character":56,"end_line":144,"end_character":84},"in_reply_to":"cbf0e36d_afaa549d","updated":"2025-07-03 15:27:54.000000000","message":"Acknowledged","commit_id":"9b340807d0e71c6bc782cbb42f0156a07494cfed"}]}