Fixed linter issue in ssh_host_signer role and reduced allowed linter…

… errors 2 -> 1.

.circleci/config.yml

@@ -29,5 +29,5 @@ jobs:
             echo '###############################################'
             printf 'Counted %d ansible-lint errors.\n' ${errors:-0}
             echo '###############################################'
-            if (( errors > 2 )); then /bin/false; fi
+            if (( errors > 1 )); then /bin/false; fi
 ...

roles/ssh_host_signer/tasks/main.yml

@@ -37,7 +37,7 @@
     mode: '0600'
   delegate_to: localhost
 
-- name: 'Sign SSH keys.'
+- name: 'Sign SSH host keys.'
   command: >
     ssh-keygen -h
       -s {{ ssh_host_signer_ca_private_key | quote }}
@@ -50,27 +50,29 @@
   delegate_to: localhost
   no_log: true
 
-- name: 'Find certificates.'
+- name: 'Find generated certificates (== signed host keys).'
   find:
     path: "{{ temporary_directory.path }}/public_keys/{{ inventory_hostname }}{{ ssh_host_signer_key_directory }}"
     pattern: 'ssh_host_*_key-cert.pub'
   delegate_to: localhost
   register: certificates
 
-- name: 'Compare certificates.'
+- name: 'Compare generated certificates to existing certificates from servers.'
   shell: |
     set -o pipefail
     diff <(ssh-keygen -L -f {{ item.path | quote }} | tail -n +2) \
-         <(ssh-keygen -L -f {{ temporary_directory.path | quote }}/existing_certificates/{{ inventory_hostname | quote }}{{ ssh_host_signer_key_directory }}/{{ item.path | basename | quote }} | tail -n +2)
+         <(ssh-keygen -L -f {{ existing_certificates_dir }}/{{ item.path | basename | quote }} | tail -n +2)
   args:
     executable: '/bin/bash'
+  vars:
+    existing_certificates_dir: "{{ temporary_directory.path | quote }}/existing_certificates/{{ inventory_hostname | quote }}{{ ssh_host_signer_key_directory }}"
   with_items: "{{ certificates.files }}"
   changed_when: false
   failed_when: false
   delegate_to: localhost
   register: certificate_comparison
 
-- name: 'Copy certificates back to server.'
+- name: 'Copy certificates back to server if the generated ones are different from the existing ones.'
   copy:
     src: "{{ item.item.path }}"
     dest: "{{ ssh_host_signer_key_directory }}"