snap: disable the "user site-packages directory" (#8509)

Although Certbot is a classic snap, it shouldn't load Python code from
the host system. This change prevents packages being loaded from the
"user site-packages directory" (PEP-370). i.e. Certbot will no longer
load DNS plugins installed via `pip install --user certbot-dns-*`.
This commit is contained in:
alexzorin
2020-12-06 09:10:03 +01:00
committed by GitHub
parent 5871de0c07
commit dc3ac13750
2 changed files with 4 additions and 3 deletions
+2 -1
View File
@@ -14,7 +14,8 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
### Fixed ### Fixed
* * The Certbot snap no longer loads packages installed via `pip install --user`. This
was unintended and DNS plugins should be installed via `snap` instead.
More details about these changes can be found on our GitHub repo. More details about these changes can be found on our GitHub repo.
+2 -2
View File
@@ -20,13 +20,13 @@ adopt-info: certbot
apps: apps:
certbot: certbot:
command: bin/python3 $SNAP/bin/certbot command: bin/python3 -s $SNAP/bin/certbot
environment: environment:
PATH: "$SNAP/bin:$SNAP/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games" PATH: "$SNAP/bin:$SNAP/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"
AUGEAS_LENS_LIB: "$SNAP/usr/share/augeas/lenses/dist" AUGEAS_LENS_LIB: "$SNAP/usr/share/augeas/lenses/dist"
CERTBOT_SNAPPED: "True" CERTBOT_SNAPPED: "True"
renew: renew:
command: bin/python3 $SNAP/bin/certbot -q renew command: bin/python3 -s $SNAP/bin/certbot -q renew
daemon: oneshot daemon: oneshot
environment: environment:
PATH: "$SNAP/bin:$SNAP/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games" PATH: "$SNAP/bin:$SNAP/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"