Commit Graph
11412 Commits
Author SHA1 Message Date
Jacob Hoffman-AndrewsandGitHub 0075104805 acme.ClientNetwork: JWK becomes optional (#10275)
This results in a ClientNetwork that can .get() but not .post(). Useful
for fetching ARI, which does not require authentication.
2025-05-06 12:34:50 -07:00
AlexisandGitHub 2cf6cda1fa [REPO] Update SECURITY.md (#10253)
Add supported versions

---------

Signed-off-by: zoracon <zoracon@pm.me>
2025-05-06 10:57:50 -07:00
Brad WarrenandGitHub 6418ee32e5 upgrade certbot compatibility test images (#10277)
i need this for some other upgrades i'm working on. using these debian
buster images which were [EOL'd ages
ago](https://www.debian.org/releases/) is giving me problems

while i was at it, i fixed up up the following warnings docker was
printing at me:

*
https://docs.docker.com/reference/build-checks/legacy-key-value-format/
* https://docs.docker.com/reference/build-checks/maintainer-deprecated/
2025-05-06 10:57:10 -07:00
Brad WarrenandGitHub cc08242abc update pinned dependencies (#10278)
this fixes the security alerts those with access can see at
https://github.com/certbot/certbot/security/dependabot

i based what needed to be done to drop python < 3.9.2 support on
https://github.com/certbot/certbot/pull/10077 and concluded we only
really needed to update `python_requires`. we could do a deprecation
period for this, but i think it's not necessary. cryptography didn't
(it's not even in mentioned in [their
changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst))
and none of the major LTS distros use python 3.9.0 or 3.9.1
2025-05-06 10:56:19 -07:00
ohemorangeandGitHub 62361dac44 Catch and ignore orderNotReady response when posting a request to begin finalization and poll until ready (#10239)
Fixes #9766.
2025-05-02 12:08:46 -07:00
Brad WarrenandGitHub 5dcfd32a11 remove unneeded cryptography req (#10276)
since https://github.com/certbot/certbot/pull/10130, we depend on much
newer versions of cryptography so this restraint is no longer needed
2025-04-30 11:47:35 -07:00
ohemorangeandGitHub 6ac951e146 Deprecate TLS-ALPN support in ACME (#10268)
Fixes #10266.

See example deprecation in
https://github.com/certbot/josepy/pull/207/files

I can add stacklevel=2, though I find that usually I just look at the
whole stack anyway when debugging, myself, so it doesn't really matter.
2025-04-28 15:09:15 -07:00
ohemorangeandGitHub 508fba1da6 Why do we have this? It means warnings aren't filtered in acme tests (#10267)
This was added in https://github.com/certbot/certbot/pull/6091 to make
tests pass in EPEL and older ubuntus, 7 years ago. It is probably no
longer needed.

| pytest version | min. Python version |
|---------------|---------------------|
|8.0+ | 3.8+|
| 7.1+ | 3.7+ |
| 6.2 - 7.0 | 3.6+ |
| 5.0 - 6.1 | 3.5+ |
| 3.3 - 4.6 | 2.7, 3.4+ |

That version is [no longer
supported](https://docs.pytest.org/en/stable/backwards-compatibility.html).

Probably therefore we can just get rid of this.
2025-04-25 20:53:31 +00:00
ohemorangeandGitHub 2da39317b2 Replace pyparsing error that usually misdirects people with a more helpful message (#10265)
Addresses #10264, though I could not actually find a way to fix that
particular issue. So, fixes #10264 is not actually accurate, but I would
like github to link them.
2025-04-25 13:11:28 -07:00
ohemorangeandGitHub 16f858547f Add --use-pep517 flag to pip to silence warning in tools/venv.py, and switch codebase to src-layout (#10249)
Fixes #10252.

See further discussion here: https://github.com/pypa/pip/issues/11457

We are doing option:

> Alternatively, enable the --use-pep517 pip option, possibly with
--no-build-isolation. The --use-pip517 flag will force pip to use the
modern mechanism for editable installs. --no-build-isolation may be
needed if your project has build-time requirements beyond setuptools and
wheel. By passing this flag, you are responsible for making sure your
environment already has the required dependencies to build your package.
Once the legacy mechanism is removed, --use-pep517 will have no effect
and will essentially be enabled by default in this context.

Major changes made here include:
- Add `--use-pep517` to use the modern mechanism, which will be the only
mechanism in future pip releases
- Change to `/src` layout to appease mypy, and because for editable
installs that really is the normal way these days.
  - `cd acme && mkdir src && mv acme src/` etc.
- add `where='src'` argument to `find_packages` and add
`package_dir={'': 'src'},` in `setup.py`s
  - update `MANIFEST.in` files with new path locations 
- Update our many hardcoded filepaths
- Update `importlib-metadata` requirement to fix
double-plugin-entry-point problem in oldest tests
2025-04-11 19:30:33 +00:00
mirchicapandGitHub 6de7570af0 Add certbot-dns-cdmon to third-party plugins list (#10258)
This PR adds `certbot-dns-cdmon` to the list of third-party plugins in
the documentation.

`certbot-dns-cdmon` enables DNS-01 challenge automation for domains
managed with cdmon's DNS.

PyPI: https://pypi.org/project/certbot-dns-cdmon/
2025-04-10 14:38:02 -07:00
Brad WarrenandGitHub 9bc9e3412e Merge pull request #10261 from certbot/candidate-4.0.0 2025-04-08 10:25:34 -07:00
Will Greenberg f822602fff Bump version to 4.1.0 2025-04-07 15:04:01 -07:00
Will Greenberg 52ad3e80bd Add contents to certbot/CHANGELOG.md for next version 2025-04-07 15:04:01 -07:00
Will Greenberg d9e3d7b2d2 Remove built packages from git 2025-04-07 15:04:01 -07:00
Will Greenberg d95a389c3f Release 4.0.0 v4.0.0 2025-04-07 15:04:00 -07:00
Will Greenberg f7a0df3461 Update changelog for 4.0.0 release 2025-04-07 15:03:33 -07:00
Jonathan VanascoandGitHub cb5d579a84 cloudtest some warnings (#10255) 2025-04-03 14:38:54 -07:00
Jacob Hoffman-AndrewsandGitHub 45626e88e2 Add --preferred-profile and --required-profile (#10230)
Fixes #10194
2025-04-03 06:48:52 +09:00
Will GreenbergandGitHub 15024aabd3 Repin dependencies for josepy 2.0 (#10254) 2025-04-02 18:17:44 +00:00
Jonathan VanascoandGitHub dd876a40ed Feature acme cryptography 2 (#10245)
redoing https://github.com/certbot/certbot/pull/10174 but lots of
mergecommits and ff wanted; so test in a clean environment
2025-04-02 10:53:47 -07:00
ohemorangeandGitHub 7a90cdd231 Remove custom version of CertificateIssuerPrivateKeyTypes now that cryptography version is minimum 43 (#10236)
Fixes https://github.com/certbot/certbot/issues/10233

This was a stand-in for
`cryptography.hazmat.primitives.asymmetric.types.CertificateIssuerPrivateKeyTypes`,
which we can now use directly.
2025-03-28 11:56:02 -07:00
ohemorangeandGitHub 7d461a8dfc Add template for code maintenance task (#10251)
We need this to create issues to track work like "update venv.py to
address upcoming pip build system deprecation" since we no longer have a
blank issue template.
2025-03-28 16:41:50 +00:00
Brad WarrenandGitHub 83510c1da5 use type feature instead of label (#10247)
not doing this breaks our triage link which currently looks for
unlabeled issues
2025-03-27 21:36:16 +00:00
AlexisandGitHub 0b51653def [REPO] Add New Feature Template (#10238)
Adding for cases when it's not a bug, but a feature request. Helping
those and us frame the initial request better.
2025-03-17 18:07:32 -07:00
ohemorangeandGitHub aa005f20fe Add RewriteEngine on directive also in post (#10232)
Fixes
https://github.com/certbot/certbot/issues/9835#issuecomment-2717096178,
where our `RewriteEngine on` directive inserted at the beginning of a
virtualhost was overridden a `RewriteEngine Off` directive later. This
PR does the easy thing of placing `RewriteEngine on` in our
post-insert.
2025-03-17 20:02:10 +00:00
ohemorangeandGitHub 8a6138856f Escape <TAG> in docker readme file (#10235)
Fixes https://github.com/certbot/certbot/issues/10229
2025-03-17 08:48:25 -07:00
ohemorangeandGitHub 7322e56cc7 Use updated name TLS_METHOD instead of SSLv23_METHOD (#10237)
Fixes #10231
2025-03-14 10:38:02 -07:00
Artur Corrêa SouzaandGitHub df9075e023 fix(route53): explanation on credentials file (#9907)
The credentials configuration file is at ~/.aws/credentials.

Also, when running on root it uses the root home (so /root/.aws). This
was from my test at an ubuntu server.

## Pull Request Checklist

- [ ] The Certbot team has recently expressed interest in reviewing a PR
for this. If not, this PR may be closed due our limited resources and
need to prioritize how we spend them.
- [ ] If the change being made is to a [distributed
component](https://certbot.eff.org/docs/contributing.html#code-components-and-layout),
edit the `master` section of `certbot/CHANGELOG.md` to include a
description of the change being made.
- [ ] Add or update any documentation as needed to support the changes
in this PR.
- [ ] Include your name in `AUTHORS.md` if you like.
2025-03-13 13:23:57 -07:00
d91e552491 renewal: by default, use a fraction of lifetime (#10207)
Previously we defaulted to renewing at 30 days before expiry, and
allowed users to customize the config file to set a different value.

Instead, we should renew when 1/3 of the lifetime is left, or for
shorter certificates (<10 days), when 1/2 of the lifetime is left.

This still allows explicitly configured values to take precedence.

---------

Co-authored-by: Will Greenberg <ifnspifn@gmail.com>
2025-03-12 10:35:59 -07:00
Will GreenbergandGitHub b3bd4304f4 Merge pull request #10228 from certbot/candidate-3.3.0
Candidate 3.3.0
2025-03-11 09:54:07 -07:00
Brad Warren 37f6f8a12c Bump version to 4.0.0 2025-03-11 08:04:08 -07:00
Brad Warren be60ad5131 Add contents to certbot/CHANGELOG.md for next version 2025-03-11 08:04:08 -07:00
Brad Warren 16cbd6c00a Remove built packages from git 2025-03-11 08:04:08 -07:00
Brad Warren 3b19e18641 Release 3.3.0 v3.3.0 2025-03-11 08:04:07 -07:00
Brad Warren 259afd7458 Update changelog for 3.3.0 release 2025-03-11 08:03:28 -07:00
Brad WarrenandGitHub b7e09dd652 change changelog to 3.3.0 (#10226)
i tested it and the version numbers in setup.py files will be changed
automatically by the release script
2025-03-10 12:08:29 -07:00
8487bfeaa5 Update contributing.rst (#10203)
Give better instructions on running all unittests, and on running
specific test cases.

Replace `python` with `python3` in venv setup invocations because some
systems don't have a plain `python` command.

---------

Co-authored-by: ohemorange <ebportnoy@gmail.com>
2025-03-08 00:21:44 +00:00
Jacob Hoffman-AndrewsandGitHub c323af7be9 Remove warnings about empty email. (#10214)
We strongly encouraged providing an email address because we wanted
people to get expiration notices to ensure that even if their Certbot
install broke, they could fix it before their site goes down.

Now that Let's Encrypt is getting rid of expiration notices
(https://letsencrypt.org/2025/01/22/ending-expiration-emails/), we can
remove some of the encouragement, providing a smoother user experience.
2025-03-06 14:38:52 -08:00
2a92e22332 make integration tests crossplatform (#10217)
i wanted this for testing
https://github.com/certbot/certbot/issues/10190

alex started working on this in
https://github.com/certbot/certbot/pull/9207 years ago, but pebble
didn't end up doing a release containing his work while he was still
regularly contributing to certbot. this has now changed though

before this PR, our integration tests only worked on amd64 linux
systems. with this PR, i've successfully run our integration tests on
all combinations of the architectures amd64 and arm64 and the OSes linux
and macos

---------

Co-authored-by: ohemorange <erica@eff.org>
2025-03-06 14:13:26 -08:00
Brad WarrenandGitHub 48ffe02ce3 fix openssl env vars (#10223)
this should fix https://github.com/certbot/certbot/issues/10190

i unfortunately wasn't able to reproduce the nginx problem, but i did
audit all subprocess calls in certbot and all of its plugins and
confirmed that they use this `env_no_snap_for_external_calls` function.
with `OPENSSL_MODULES` no longer pointing inside the snap, this problem
should go away

i also cleared `OPENSSL_FORCE_FIPS_MODE` because of the report
[here](https://community.letsencrypt.org/t/certbot-snap-error-while-renewing-openssl-init-ssl/232145/16)
2025-03-06 13:21:33 -08:00
Will GreenbergandGitHub a43fdedd12 Merge pull request #10224 from certbot/bmw-patch-1
use pull_request_target
2025-03-05 11:13:47 -08:00
Brad WarrenandGitHub 4cffcbffaa use-pr-target 2025-03-05 08:19:10 -08:00
AlexisandGitHub 65c33488dd [DOCS] Update CONTRIBUTING.md (#10220)
Just adding consistent language for the contributing guide.
2025-03-04 19:01:39 -08:00
Jacob Hoffman-AndrewsandGitHub 487dd53103 tests: remove RSA-256 key. (#10208)
This is ludicrously short and was only used by some key-mismatch tests.
We have plenty of other mismatched keys.
2025-02-25 18:03:16 -08:00
Brad WarrenandGitHub d3d0b76f9f update centos9 ami (#10210)
tests on this passed at
https://dev.azure.com/certbot/certbot/_build/results?buildId=8790&view=results
2025-02-25 15:46:28 -08:00
ohemorangeandGitHub 52ee2a5e8b Improve instructions for updating github releases token (#10201)
The token is now owned by the team account and can simply be
regenerated, so we don't need the info about perhaps doing that. Plus,
there are now more clear instructions on the wiki. And the date was
updated.
2025-02-25 14:27:40 -08:00
ohemorangeandGitHub a6bed18f0b Use ubuntu 24 to build docker (#10202)
Maybe addresses https://github.com/certbot/certbot/issues/10020

#10020 claims that without the verbose settings, build fail almost every
time. In my one (1) test removing verbosity, it passed, so idk. BUT! It
took [56
minutes](https://dev.azure.com/certbot/certbot/_build/results?buildId=8766&view=logs&j=fdd3565a-f3c6-5154-eca9-9ae03666f7bd&t=5dbd9851-46a4-524f-73a8-4028241afcde)
instead of [37 on ubuntu
24](https://dev.azure.com/certbot/certbot/_build/results?buildId=8768&view=logs&j=fdd3565a-f3c6-5154-eca9-9ae03666f7bd&t=5dbd9851-46a4-524f-73a8-4028241afcde).
Whether or not this actually fixes the underlying problem (still looking
into that), that seems worthwhile to speed up.
2025-02-24 19:22:07 -08:00
Jacob Hoffman-AndrewsandGitHub 792a76569d acme: add support for profiles (#10196)
Recognizes the profiles map in the "meta" section of directory.

Allows sending a "profile" field in order objects.

Adds an optional "profile" parameter to new_order in client.py.

Related to #10194.
2025-02-24 19:18:51 -08:00
ohemorangeandGitHub 9105cd21ba Update url for moved image to fix readthedocs build (#10200)
https://readthedocs.org/projects/eff-certbot/builds/27298576/ was
failing with `WARNING: Could not fetch remote image:
https://raw.githubusercontent.com/EFForg/design/master/logos/eff-certbot-lockup.png
[404]`

This is because the file was moved to
https://raw.githubusercontent.com/EFForg/design/master/logos/certbot/eff-certbot-lockup.png
as you can see here:
https://github.com/EFForg/design/tree/master/logos/certbot
2025-02-24 11:17:03 -08:00