Convert AnsibleUnsafeText to String

Question

I am using the ansible shell module to compare the chain of 2 SSL certificate with openssl (they have the same chain):

openssl x509 -issuer -noout -in Certiticate1
openssl x509 -issuer -noout -in Certiticate2

I register the output in variables chain_from_certificate1 and chain_from_certificate2 then i compares there standard output:

- name: Compare the Chain
    fail:
      msg: Error The chains aren't the same
    when: chain_from_certificate1.stdout !=  chain_from_certificate2.stdout

Ansible tell me that the chains are not similar (and it's false because they are).

I think that the issue came from the comparison operator because the type of the variable are "AnsibleUnsafeText" and not string.

My question how to compare 2 AnsibleUnsafeText ? and it's necessary to convert them to string before comparison ?

Thank you in advance.

Answer 1

I believe this is due to non existing variable attribute.
Most likely chain_from_certificate1 and chain_from_certificate2 don't have stdout

Did you try debug by printing the variables?
With stdout:
Did this throw similar failure?

    - name: print variable
      debug:
        msg: "{{ chain_from_certificate1.stdout }}"

Without stdout:
What is output of this?
Will this print same output as of manually execute openssl x509 -issuer -noout -in Certiticate1?

    - name: print variable
      debug:
        msg: "{{ chain_from_certificate1 }}"

My assumption is that the script set the value of stdout in chain_from_certificate1 and chain_from_certificate2 rather than the stdout: <value>. Therefor stdout do not exist as attribute.
Or chain_from_certificate1 and chain_from_certificate2 contain another data structure.

The key is to print them out.

Answer 2

Q: "My question how to compare AnsibleUnsafeText?"

Just as usual via ==.

Q: "Is it necessary to convert them to string before comparison?"

No.

A minimal example playbook

---
- hosts: localhost
  become: false
  gather_facts: false

  tasks:

    - shell:
        cmd: |
          openssl x509 -issuer -noout -in "/etc/pki/ca-trust/source/anchors/DC=com,DC=example,CN=immediate_one.pem"
      register: cert1

    - shell:
        cmd: |
          openssl x509 -issuer -noout -in "/etc/pki/ca-trust/source/anchors/DC=com,DC=example,CN=immediate_two.pem"
      register: cert2

    - debug:
        msg:
          - "value: '{{ cert1.stdout }}' is of type: {{ cert1.stdout | type_debug }}"
          - "value: '{{ cert2.stdout }}' is of type: {{ cert2.stdout | type_debug }}"

    - assert:
        that:
          cert1.stdout == cert2.stdout
        fail_msg: "[ERR] Different issuer"
        success_msg: "[OK] Identic issuer"

will result into an output of

TASK [debug] **************************************************************************
ok: [localhost] =>
  msg:
  - 'value: ''issuer=DC = com, DC = example, CN = root'' is of type: AnsibleUnsafeText'
  - 'value: ''issuer=DC = com, DC = example, CN = root'' is of type: AnsibleUnsafeText'

TASK [assert] *************************************************************************
ok: [localhost] => changed=false
  msg: '[OK] Identic issuer'