Commit graph

11163 commits

Author SHA1 Message Date
Jacob Hoffman-Andrews
dcdfdacf75
store preferred/required_profile in renewal config (#10280)
This ensures that renewals of certificates will use the same profile
settings.

Fixes #10271
2025-05-07 16:32:48 -07:00
Jacob Hoffman-Andrews
0075104805
acme.ClientNetwork: JWK becomes optional (#10275)
This results in a ClientNetwork that can .get() but not .post(). Useful
for fetching ARI, which does not require authentication.
2025-05-06 12:34:50 -07:00
Alexis
2cf6cda1fa
[REPO] Update SECURITY.md (#10253)
Add supported versions

---------

Signed-off-by: zoracon <zoracon@pm.me>
2025-05-06 10:57:50 -07:00
Brad Warren
6418ee32e5
upgrade certbot compatibility test images (#10277)
i need this for some other upgrades i'm working on. using these debian
buster images which were [EOL'd ages
ago](https://www.debian.org/releases/) is giving me problems

while i was at it, i fixed up up the following warnings docker was
printing at me:

*
https://docs.docker.com/reference/build-checks/legacy-key-value-format/
* https://docs.docker.com/reference/build-checks/maintainer-deprecated/
2025-05-06 10:57:10 -07:00
Brad Warren
cc08242abc
update pinned dependencies (#10278)
this fixes the security alerts those with access can see at
https://github.com/certbot/certbot/security/dependabot

i based what needed to be done to drop python < 3.9.2 support on
https://github.com/certbot/certbot/pull/10077 and concluded we only
really needed to update `python_requires`. we could do a deprecation
period for this, but i think it's not necessary. cryptography didn't
(it's not even in mentioned in [their
changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst))
and none of the major LTS distros use python 3.9.0 or 3.9.1
2025-05-06 10:56:19 -07:00
ohemorange
62361dac44
Catch and ignore orderNotReady response when posting a request to begin finalization and poll until ready (#10239)
Fixes #9766.
2025-05-02 12:08:46 -07:00
Brad Warren
5dcfd32a11
remove unneeded cryptography req (#10276)
since https://github.com/certbot/certbot/pull/10130, we depend on much
newer versions of cryptography so this restraint is no longer needed
2025-04-30 11:47:35 -07:00
ohemorange
6ac951e146
Deprecate TLS-ALPN support in ACME (#10268)
Fixes #10266.

See example deprecation in
https://github.com/certbot/josepy/pull/207/files

I can add stacklevel=2, though I find that usually I just look at the
whole stack anyway when debugging, myself, so it doesn't really matter.
2025-04-28 15:09:15 -07:00
ohemorange
508fba1da6
Why do we have this? It means warnings aren't filtered in acme tests (#10267)
This was added in https://github.com/certbot/certbot/pull/6091 to make
tests pass in EPEL and older ubuntus, 7 years ago. It is probably no
longer needed.

| pytest version | min. Python version |
|---------------|---------------------|
|8.0+ | 3.8+|
| 7.1+ | 3.7+ |
| 6.2 - 7.0 | 3.6+ |
| 5.0 - 6.1 | 3.5+ |
| 3.3 - 4.6 | 2.7, 3.4+ |

That version is [no longer
supported](https://docs.pytest.org/en/stable/backwards-compatibility.html).

Probably therefore we can just get rid of this.
2025-04-25 20:53:31 +00:00
ohemorange
2da39317b2
Replace pyparsing error that usually misdirects people with a more helpful message (#10265)
Addresses #10264, though I could not actually find a way to fix that
particular issue. So, fixes #10264 is not actually accurate, but I would
like github to link them.
2025-04-25 13:11:28 -07:00
ohemorange
16f858547f
Add --use-pep517 flag to pip to silence warning in tools/venv.py, and switch codebase to src-layout (#10249)
Fixes #10252.

See further discussion here: https://github.com/pypa/pip/issues/11457

We are doing option:

> Alternatively, enable the --use-pep517 pip option, possibly with
--no-build-isolation. The --use-pip517 flag will force pip to use the
modern mechanism for editable installs. --no-build-isolation may be
needed if your project has build-time requirements beyond setuptools and
wheel. By passing this flag, you are responsible for making sure your
environment already has the required dependencies to build your package.
Once the legacy mechanism is removed, --use-pep517 will have no effect
and will essentially be enabled by default in this context.

Major changes made here include:
- Add `--use-pep517` to use the modern mechanism, which will be the only
mechanism in future pip releases
- Change to `/src` layout to appease mypy, and because for editable
installs that really is the normal way these days.
  - `cd acme && mkdir src && mv acme src/` etc.
- add `where='src'` argument to `find_packages` and add
`package_dir={'': 'src'},` in `setup.py`s
  - update `MANIFEST.in` files with new path locations 
- Update our many hardcoded filepaths
- Update `importlib-metadata` requirement to fix
double-plugin-entry-point problem in oldest tests
2025-04-11 19:30:33 +00:00
mirchicap
6de7570af0
Add certbot-dns-cdmon to third-party plugins list (#10258)
This PR adds `certbot-dns-cdmon` to the list of third-party plugins in
the documentation.

`certbot-dns-cdmon` enables DNS-01 challenge automation for domains
managed with cdmon's DNS.

PyPI: https://pypi.org/project/certbot-dns-cdmon/
2025-04-10 14:38:02 -07:00
Brad Warren
9bc9e3412e
Merge pull request #10261 from certbot/candidate-4.0.0 2025-04-08 10:25:34 -07:00
Will Greenberg
f822602fff Bump version to 4.1.0 2025-04-07 15:04:01 -07:00
Will Greenberg
52ad3e80bd Add contents to certbot/CHANGELOG.md for next version 2025-04-07 15:04:01 -07:00
Will Greenberg
d9e3d7b2d2 Remove built packages from git 2025-04-07 15:04:01 -07:00
Will Greenberg
d95a389c3f
Release 4.0.0 2025-04-07 15:04:00 -07:00
Will Greenberg
f7a0df3461 Update changelog for 4.0.0 release 2025-04-07 15:03:33 -07:00
Jonathan Vanasco
cb5d579a84
cloudtest some warnings (#10255) 2025-04-03 14:38:54 -07:00
Jacob Hoffman-Andrews
45626e88e2
Add --preferred-profile and --required-profile (#10230)
Fixes #10194
2025-04-03 06:48:52 +09:00
Will Greenberg
15024aabd3
Repin dependencies for josepy 2.0 (#10254) 2025-04-02 18:17:44 +00:00
Jonathan Vanasco
dd876a40ed
Feature acme cryptography 2 (#10245)
redoing https://github.com/certbot/certbot/pull/10174 but lots of
mergecommits and ff wanted; so test in a clean environment
2025-04-02 10:53:47 -07:00
ohemorange
7a90cdd231
Remove custom version of CertificateIssuerPrivateKeyTypes now that cryptography version is minimum 43 (#10236)
Fixes https://github.com/certbot/certbot/issues/10233

This was a stand-in for
`cryptography.hazmat.primitives.asymmetric.types.CertificateIssuerPrivateKeyTypes`,
which we can now use directly.
2025-03-28 11:56:02 -07:00
ohemorange
7d461a8dfc
Add template for code maintenance task (#10251)
We need this to create issues to track work like "update venv.py to
address upcoming pip build system deprecation" since we no longer have a
blank issue template.
2025-03-28 16:41:50 +00:00
Brad Warren
83510c1da5
use type feature instead of label (#10247)
not doing this breaks our triage link which currently looks for
unlabeled issues
2025-03-27 21:36:16 +00:00
Alexis
0b51653def
[REPO] Add New Feature Template (#10238)
Adding for cases when it's not a bug, but a feature request. Helping
those and us frame the initial request better.
2025-03-17 18:07:32 -07:00
ohemorange
aa005f20fe
Add RewriteEngine on directive also in post (#10232)
Fixes
https://github.com/certbot/certbot/issues/9835#issuecomment-2717096178,
where our `RewriteEngine on` directive inserted at the beginning of a
virtualhost was overridden a `RewriteEngine Off` directive later. This
PR does the easy thing of placing `RewriteEngine on` in our
post-insert.
2025-03-17 20:02:10 +00:00
ohemorange
8a6138856f
Escape <TAG> in docker readme file (#10235)
Fixes https://github.com/certbot/certbot/issues/10229
2025-03-17 08:48:25 -07:00
ohemorange
7322e56cc7
Use updated name TLS_METHOD instead of SSLv23_METHOD (#10237)
Fixes #10231
2025-03-14 10:38:02 -07:00
Artur Corrêa Souza
df9075e023
fix(route53): explanation on credentials file (#9907)
The credentials configuration file is at ~/.aws/credentials.

Also, when running on root it uses the root home (so /root/.aws). This
was from my test at an ubuntu server.

## Pull Request Checklist

- [ ] The Certbot team has recently expressed interest in reviewing a PR
for this. If not, this PR may be closed due our limited resources and
need to prioritize how we spend them.
- [ ] If the change being made is to a [distributed
component](https://certbot.eff.org/docs/contributing.html#code-components-and-layout),
edit the `master` section of `certbot/CHANGELOG.md` to include a
description of the change being made.
- [ ] Add or update any documentation as needed to support the changes
in this PR.
- [ ] Include your name in `AUTHORS.md` if you like.
2025-03-13 13:23:57 -07:00
Jacob Hoffman-Andrews
d91e552491
renewal: by default, use a fraction of lifetime (#10207)
Previously we defaulted to renewing at 30 days before expiry, and
allowed users to customize the config file to set a different value.

Instead, we should renew when 1/3 of the lifetime is left, or for
shorter certificates (<10 days), when 1/2 of the lifetime is left.

This still allows explicitly configured values to take precedence.

---------

Co-authored-by: Will Greenberg <ifnspifn@gmail.com>
2025-03-12 10:35:59 -07:00
Will Greenberg
b3bd4304f4
Merge pull request #10228 from certbot/candidate-3.3.0
Candidate 3.3.0
2025-03-11 09:54:07 -07:00
Brad Warren
37f6f8a12c Bump version to 4.0.0 2025-03-11 08:04:08 -07:00
Brad Warren
be60ad5131 Add contents to certbot/CHANGELOG.md for next version 2025-03-11 08:04:08 -07:00
Brad Warren
16cbd6c00a Remove built packages from git 2025-03-11 08:04:08 -07:00
Brad Warren
3b19e18641
Release 3.3.0 2025-03-11 08:04:07 -07:00
Brad Warren
259afd7458 Update changelog for 3.3.0 release 2025-03-11 08:03:28 -07:00
Brad Warren
b7e09dd652
change changelog to 3.3.0 (#10226)
i tested it and the version numbers in setup.py files will be changed
automatically by the release script
2025-03-10 12:08:29 -07:00
Jacob Hoffman-Andrews
8487bfeaa5
Update contributing.rst (#10203)
Give better instructions on running all unittests, and on running
specific test cases.

Replace `python` with `python3` in venv setup invocations because some
systems don't have a plain `python` command.

---------

Co-authored-by: ohemorange <ebportnoy@gmail.com>
2025-03-08 00:21:44 +00:00
Jacob Hoffman-Andrews
c323af7be9
Remove warnings about empty email. (#10214)
We strongly encouraged providing an email address because we wanted
people to get expiration notices to ensure that even if their Certbot
install broke, they could fix it before their site goes down.

Now that Let's Encrypt is getting rid of expiration notices
(https://letsencrypt.org/2025/01/22/ending-expiration-emails/), we can
remove some of the encouragement, providing a smoother user experience.
2025-03-06 14:38:52 -08:00
Brad Warren
2a92e22332
make integration tests crossplatform (#10217)
i wanted this for testing
https://github.com/certbot/certbot/issues/10190

alex started working on this in
https://github.com/certbot/certbot/pull/9207 years ago, but pebble
didn't end up doing a release containing his work while he was still
regularly contributing to certbot. this has now changed though

before this PR, our integration tests only worked on amd64 linux
systems. with this PR, i've successfully run our integration tests on
all combinations of the architectures amd64 and arm64 and the OSes linux
and macos

---------

Co-authored-by: ohemorange <erica@eff.org>
2025-03-06 14:13:26 -08:00
Brad Warren
48ffe02ce3
fix openssl env vars (#10223)
this should fix https://github.com/certbot/certbot/issues/10190

i unfortunately wasn't able to reproduce the nginx problem, but i did
audit all subprocess calls in certbot and all of its plugins and
confirmed that they use this `env_no_snap_for_external_calls` function.
with `OPENSSL_MODULES` no longer pointing inside the snap, this problem
should go away

i also cleared `OPENSSL_FORCE_FIPS_MODE` because of the report
[here](https://community.letsencrypt.org/t/certbot-snap-error-while-renewing-openssl-init-ssl/232145/16)
2025-03-06 13:21:33 -08:00
Will Greenberg
a43fdedd12
Merge pull request #10224 from certbot/bmw-patch-1
use pull_request_target
2025-03-05 11:13:47 -08:00
Brad Warren
4cffcbffaa
use-pr-target 2025-03-05 08:19:10 -08:00
Alexis
65c33488dd
[DOCS] Update CONTRIBUTING.md (#10220)
Just adding consistent language for the contributing guide.
2025-03-04 19:01:39 -08:00
Jacob Hoffman-Andrews
487dd53103
tests: remove RSA-256 key. (#10208)
This is ludicrously short and was only used by some key-mismatch tests.
We have plenty of other mismatched keys.
2025-02-25 18:03:16 -08:00
Brad Warren
d3d0b76f9f
update centos9 ami (#10210)
tests on this passed at
https://dev.azure.com/certbot/certbot/_build/results?buildId=8790&view=results
2025-02-25 15:46:28 -08:00
ohemorange
52ee2a5e8b
Improve instructions for updating github releases token (#10201)
The token is now owned by the team account and can simply be
regenerated, so we don't need the info about perhaps doing that. Plus,
there are now more clear instructions on the wiki. And the date was
updated.
2025-02-25 14:27:40 -08:00
ohemorange
a6bed18f0b
Use ubuntu 24 to build docker (#10202)
Maybe addresses https://github.com/certbot/certbot/issues/10020

#10020 claims that without the verbose settings, build fail almost every
time. In my one (1) test removing verbosity, it passed, so idk. BUT! It
took [56
minutes](https://dev.azure.com/certbot/certbot/_build/results?buildId=8766&view=logs&j=fdd3565a-f3c6-5154-eca9-9ae03666f7bd&t=5dbd9851-46a4-524f-73a8-4028241afcde)
instead of [37 on ubuntu
24](https://dev.azure.com/certbot/certbot/_build/results?buildId=8768&view=logs&j=fdd3565a-f3c6-5154-eca9-9ae03666f7bd&t=5dbd9851-46a4-524f-73a8-4028241afcde).
Whether or not this actually fixes the underlying problem (still looking
into that), that seems worthwhile to speed up.
2025-02-24 19:22:07 -08:00
Jacob Hoffman-Andrews
792a76569d
acme: add support for profiles (#10196)
Recognizes the profiles map in the "meta" section of directory.

Allows sending a "profile" field in order objects.

Adds an optional "profile" parameter to new_order in client.py.

Related to #10194.
2025-02-24 19:18:51 -08:00