# platform = multi_platform_al
# reboot = false
# strategy = restrict
# complexity = medium
# disruption = medium
- name: "Read permission of GPG key directory"
  ansible.builtin.stat:
    path: /etc/pki/rpm-gpg/
  register: gpg_key_directory_permission
  check_mode: no

# It should fail if it doesn't find any fingerprints in file - maybe file was not parsed well.

- name: Read signatures in GPG key
  # According to /usr/share/doc/gnupg2/DETAILS fingerprints are in "fpr" record in field 10
  ansible.builtin.command: gpg --show-keys --with-fingerprint --with-colons "/etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2023"
  changed_when: False
  register: gpg_fingerprints
  check_mode: no

- name: Set Fact - Installed GPG Fingerprints
  ansible.builtin.set_fact:
    gpg_installed_fingerprints: "{{ gpg_fingerprints.stdout | regex_findall('^pub.*\n(?:^fpr[:]*)([0-9A-Fa-f]*)', '\\1') | list }}"

- name: Set Fact - Valid fingerprints
  ansible.builtin.set_fact:
    gpg_valid_fingerprints:
    - "{{{ release_key_fingerprint }}}"

- name: Import Amazon GPG key
  ansible.builtin.rpm_key:
    state: present
    key: /etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2023
  when:
   - gpg_key_directory_permission.stat.mode <= '0755'
   - (gpg_installed_fingerprints | difference(gpg_valid_fingerprints)) | length == 0
   - gpg_installed_fingerprints | length > 0
   - ansible_distribution == "Amazon" and ansible_distribution_version == "2023"
