Make Certbot find externally snapped plugins (#8054)

* Add snap plugin support

Switch to a PoC branch of certbot that supports the new
CERTBOT_PLUGIN_PATH and wrap the snap to set this variable correctly
based on the content interfaces connected.

(cherry picked from commit 7076a55fd82116d068e2aca7239209b7203917d2)

* Modify certbot.wrapper to append to PYTHONPATH instead of separate CERTBOT_PLUGIN_PATH variable

* Update certbot-wrapper to python3.6 version

* add source field

* Update changelog

* Use bash instead of sh

Co-authored-by: Brad Warren <bmw@users.noreply.github.com>

* Exit if something goes wrong

Co-authored-by: Brad Warren <bmw@users.noreply.github.com>

* No leading : when modifying empty PYTHONPATH

* Improve bash handling of PYTHONPATH manipulation

Co-authored-by: Robie Basak <robie.basak@canonical.com>
Co-authored-by: Brad Warren <bmw@eff.org>
Co-authored-by: Brad Warren <bmw@users.noreply.github.com>

certbot.wrapper

@@ -0,0 +1,19 @@
+#!/bin/bash
+set -e
+join() {
+    sep=$1
+    first=$2
+    if [ "$first" != "" ]; then
+        shift 2
+        echo -n "${first}"
+        for item in "$@"; do echo -n "${sep}${item}"; done
+        echo
+    fi
+}
+
+paths=$(for plugin_snap in $(snap connections certbot|sed -n '2,$p'|awk '$1=="content[certbot-1]"{print $3}'|cut -d: -f1); do echo /snap/$plugin_snap/current/lib/python3.6/site-packages; done)
+export PYTHONPATH=$(join : $PYTHONPATH $paths)
+if [ -z "$PYTHONPATH" ]; then
+    unset PYTHONPATH
+fi
+exec certbot "$@"

certbot/CHANGELOG.md

@@ -7,6 +7,7 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 ### Added
 
 * Add minimal code to run Nginx plugin on NetBSD.
+* Make Certbot snap find externally snapped plugins
 * Function `certbot.compat.filesystem.umask` is a drop-in replacement for `os.umask`
   implementing umask for both UNIX and Windows systems.
 

snap/snapcraft.yaml

@@ -7,7 +7,7 @@ description: |
  browser-trusted certificate, without any human intervention. This is
  accomplished by running a certificate management agent on the web
  server.
- 
+
  This agent is used to:
    - Automatically prove to the Let's Encrypt CA that you control the website
    - Obtain a browser-trusted certificate and set it up on your web server
@@ -20,7 +20,7 @@ adopt-info: certbot
 
 apps:
   certbot:
-    command: certbot
+    command: certbot.wrapper
     environment:
       PATH: "$SNAP/bin:$SNAP/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"
       AUGEAS_LENS_LIB: "$SNAP/usr/share/augeas/lenses/dist"
@@ -85,6 +85,10 @@ parts:
     # After certbot-apache to not rebuild duplicates (essentially sharing what was already staged,
     # like zope)
     after: [certbot-apache]
+  wrappers:
+    plugin: dump
+    source: .
+    stage: [certbot.wrapper]
 
 plugs:
   plugin: