v3.3.4

aartool plan failed on any host without a firewall package installed, which is the host that most needs the firewall role.

TASK [linux_firewall_ubuntu : Set UFW default incoming policy to deny]
fatal: [localhost]: FAILED! => {"msg": "Failed to find required executable \"ufw\""}

A preview installs nothing. So the package task reported "would install" and changed nothing, the binary verification was skipped because command modules do not run under --check, and the ufw module then ran against a binary that was not there.

Both firewall roles now probe with check_mode: false and gate their configuration on the result, so a preview reports what apply would do:

TASK [linux_firewall_ubuntu : Preview: ufw is not installed yet]
  "ufw is not installed. A preview installs nothing, so the rules below cannot be
   evaluated. 'aartool apply' installs ufw first, then applies them."

The reload handler needed the same guard, since handlers run at the end of the play, after every gated task has correctly skipped.

Also fixed

Five firewalld tasks already carried a when: before the module key, so the new guard was appended as a duplicate. In YAML the later key wins, so conditions including _firewalld_active | bool would have been discarded and services removed regardless of them. Found by ansible-lint while fixing the reported bug.

Reported by a user running aartool plan --target localhost on a fresh machine. Thank you.

Upgrade

sudo apt update && sudo apt upgrade aartool
sudo dnf upgrade aartool