Refactor certbot snap wrapper (#8313)

Partial fix for #8280

This PR refactors the bash script wrapper for snap (`/certbot.wrapper`) into certbot python codebase. Here are the keypoints of this refactoring:
* the wrapping is applied when `main` function from `certbot._internal.main` is called if environment variable `CERTBOT_SNAPPED` is `True`, which is set during the snap build
* the initial bash script wrapper  is removed, simplifying `snap/snapcraft.yaml` by removing the `certbot.wrapper` part
* the dependency to `curl` and `jq` binaries are removed
* the failure during requesting the snapd socket is correctly handled, and displays an informative message in order to correct the situation, as required by #8280

One side note about the modifications done to `app.certbot.command` in `snapcraft.yaml`. Normally calling `bin/certbot` should be sufficient and it is effectively under a normal situation (`core` snap up-to-date). However in the same situation than when the problem occurs in #8280, using `bin/certbot` makes the snap raise an exception about `certbot.main` module that cannot be found.

It seems that when `core` snap is not up-to-date (in Debian for instance with default `snapd` installation), the shebang `/usr/bin/env python3` in the `bin/certbot` wrapper is wrongly resolved to the host Python, instead of the snap Python. It is working as expected if `core` snap is up-to-date. One way to fix that is to keep a bash script wrapper, because in this case, it is the `PATH` value that matters to resolve the Python interpreter, and `PATH` is correctly set up to resolve it from the snap first.

However to keep the simplification provided by the wrapper removal, I prefered to use `bin/python3 $SNAP/bin/certbot` as `command` to explicitly target the correct Python interpreter. Again normally it is not needed because everything is working correctly with a `core` snap up-to-date, but since the root purpose of all of this is to target bad situations, well, it is better to have a snap that is effectively able to start to display the informative message...

* Refactor the bash wrapper for snap execution as Python code into certbot

* Remove wrapper, finalize the python logic

* Organize code

* Improve error handling

* Update command

* Setup basic certbot logging before running the snap prepare logic

* Improve instructions

* Use logging facility

* Handle properly an exception in snap_config

* Use the python script call approach

* Update instructions to keep sync with https://github.com/certbot/website/pull/650
This commit is contained in:
Adrien Ferrand
2020-09-30 13:24:56 -07:00
committed by GitHub
parent fca7ec896a
commit 7f0fa18c57
4 changed files with 108 additions and 47 deletions
+2 -9
View File
@@ -20,13 +20,13 @@ adopt-info: certbot
apps:
certbot:
command: certbot.wrapper
command: bin/python3 $SNAP/bin/certbot
environment:
PATH: "$SNAP/bin:$SNAP/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"
AUGEAS_LENS_LIB: "$SNAP/usr/share/augeas/lenses/dist"
CERTBOT_SNAPPED: "True"
renew:
command: certbot.wrapper -q renew
command: bin/python3 $SNAP/bin/certbot -q renew
daemon: oneshot
environment:
PATH: "$SNAP/bin:$SNAP/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"
@@ -71,9 +71,6 @@ parts:
- python3-distutils
- python3-pkg-resources
- python3.8-minimal
# added for certbot.wrapper script:
- curl
- jq
# To build cryptography and cffi if needed
build-packages: [gcc, libffi-dev, libssl-dev, git, libaugeas-dev, python3-dev]
build-environment:
@@ -84,10 +81,6 @@ parts:
cd $SNAPCRAFT_PART_SRC
python3 tools/strip_hashes.py letsencrypt-auto-source/pieces/dependency-requirements.txt | grep -v python-augeas > snap-constraints.txt
snapcraftctl set-version `git describe|sed s/^v//`
wrappers:
plugin: dump
source: .
stage: [certbot.wrapper]
shared-metadata:
plugin: dump
source: .