1013 Commits
Author SHA1 Message Date
ohemorangeandGitHub 508fba1da6 Why do we have this? It means warnings aren't filtered in acme tests (#10267)
This was added in https://github.com/certbot/certbot/pull/6091 to make
tests pass in EPEL and older ubuntus, 7 years ago. It is probably no
longer needed.

| pytest version | min. Python version |
|---------------|---------------------|
|8.0+ | 3.8+|
| 7.1+ | 3.7+ |
| 6.2 - 7.0 | 3.6+ |
| 5.0 - 6.1 | 3.5+ |
| 3.3 - 4.6 | 2.7, 3.4+ |

That version is [no longer
supported](https://docs.pytest.org/en/stable/backwards-compatibility.html).

Probably therefore we can just get rid of this.
2025-04-25 20:53:31 +00:00
ohemorangeandGitHub 16f858547f Add --use-pep517 flag to pip to silence warning in tools/venv.py, and switch codebase to src-layout (#10249)
Fixes #10252.

See further discussion here: https://github.com/pypa/pip/issues/11457

We are doing option:

> Alternatively, enable the --use-pep517 pip option, possibly with
--no-build-isolation. The --use-pip517 flag will force pip to use the
modern mechanism for editable installs. --no-build-isolation may be
needed if your project has build-time requirements beyond setuptools and
wheel. By passing this flag, you are responsible for making sure your
environment already has the required dependencies to build your package.
Once the legacy mechanism is removed, --use-pep517 will have no effect
and will essentially be enabled by default in this context.

Major changes made here include:
- Add `--use-pep517` to use the modern mechanism, which will be the only
mechanism in future pip releases
- Change to `/src` layout to appease mypy, and because for editable
installs that really is the normal way these days.
  - `cd acme && mkdir src && mv acme src/` etc.
- add `where='src'` argument to `find_packages` and add
`package_dir={'': 'src'},` in `setup.py`s
  - update `MANIFEST.in` files with new path locations 
- Update our many hardcoded filepaths
- Update `importlib-metadata` requirement to fix
double-plugin-entry-point problem in oldest tests
2025-04-11 19:30:33 +00:00
Will Greenberg f822602fff Bump version to 4.1.0 2025-04-07 15:04:01 -07:00
Will Greenberg d95a389c3f Release 4.0.0 2025-04-07 15:04:00 -07:00
Jonathan VanascoandGitHub dd876a40ed Feature acme cryptography 2 (#10245)
redoing https://github.com/certbot/certbot/pull/10174 but lots of
mergecommits and ff wanted; so test in a clean environment
2025-04-02 10:53:47 -07:00
ohemorangeandGitHub 7a90cdd231 Remove custom version of CertificateIssuerPrivateKeyTypes now that cryptography version is minimum 43 (#10236)
Fixes https://github.com/certbot/certbot/issues/10233

This was a stand-in for
`cryptography.hazmat.primitives.asymmetric.types.CertificateIssuerPrivateKeyTypes`,
which we can now use directly.
2025-03-28 11:56:02 -07:00
ohemorangeandGitHub 7322e56cc7 Use updated name TLS_METHOD instead of SSLv23_METHOD (#10237)
Fixes #10231
2025-03-14 10:38:02 -07:00
Jacob Hoffman-AndrewsandGitHub 792a76569d acme: add support for profiles (#10196)
Recognizes the profiles map in the "meta" section of directory.

Allows sending a "profile" field in order objects.

Adds an optional "profile" parameter to new_order in client.py.

Related to #10194.
2025-02-24 19:18:51 -08:00
Jonathan VanascoandGitHub cda56361ad Fix deprecate pyopenssl (#10186)
Uploading for tests;

These deprecations are a precursor to #10174 

In addition to the previously discussed `acme` functions, the `certbot`
functions were deprecated as they are primarily used for testing and
support. Marking them deprecated now will allow them to be removed in
the next major release, as they will no-longer be used.
2025-02-24 10:54:17 -08:00
Will Greenberg 8a2ded2d0e psych, actually bump version to 4.0.0 2025-02-11 15:17:56 -08:00
Will Greenberg 77594d7300 Bump version to 3.3.0 2025-02-11 11:58:46 -08:00
Will Greenberg a0e8b49057 Release 3.2.0 2025-02-11 11:58:44 -08:00
ohemorangeandGitHub aafe7ba2f9 Update to latest poetry-plugin-export to fix urllib3 multiple versions issue and unpin urllib3 (#10169)
We can use modern urllib3 now! They
[fixed](https://github.com/python-poetry/poetry-plugin-export/pull/286)
the poetry
[issue](https://github.com/python-poetry/poetry-plugin-export/issues/183)
and shipped it!

Since this PR updates the requirements file, it pulls in the new
`josepy` release, so I've silenced those warnings here. If I should do
that in a separate PR lmk.
2025-02-05 17:14:25 -08:00
Brad WarrenandGitHub 87e5dcbc83 update ocsp api (#10181)
this does the simple and more urgent fix described in
https://github.com/certbot/certbot/issues/10053. i created
https://github.com/certbot/certbot/issues/10180 to track fixing up our
tests to generally help prevent this kind of problem in the future
2025-02-05 14:08:14 -08:00
Brad WarrenandGitHub 392467609f add python 3.13 support (#10164)
fixes https://github.com/certbot/certbot/issues/10045. this is based on
the PR that did this for 3.12 at
https://github.com/certbot/certbot/pull/9852

this PR also removes python 3.8 from our tox config which should have
been done as part of https://github.com/certbot/certbot/pull/10077
2025-01-29 12:53:56 -08:00
e050fe91a3 Allow using cryptography certs and keys in the standalone plugin (#10133)
Co-authored-by: Brad Warren <bmw@users.noreply.github.com>
2025-01-16 22:16:45 +00:00
Will GreenbergandGitHub 7e87acee3c acme: deprecate gen_ss_cert in favor of make_self_signed_cert (#10097)
gen_ss_cert()'s signature contains deprecated pyOpenSSL API, so here we
deprecate it in favor of a new function that does the same thing, except
with only cryptography types: make_self_signed_cert
2025-01-16 11:38:10 +09:00
Brad WarrenandGitHub a00e343459 update policy on minimum dependency versions (#10130)
fixes #10105

this PR updates our minimally required cryptography and pyopenssl
versions as well as updating our policy for choosing minimum dependency
versions generally

before this PR, we were trying to keep compatibility with packages
available in EPEL 9 using the python 3 version available in RHEL 9.
after the discussion in #10105 we decided not to do this anymore
because:

* EPEL 9 may not want to update to certbot 3.0+ anyway because of our
backwards incompatible changes from certbot 2.x
* RHEL 9 appstream repos now contain newer versions of many of our
dependencies for newer versions of python
* alternate installation methods for RHEL 9 based users including our
snaps and pip are available

on a call we then discussed what distro repositories we should track
instead of EPEL 9. our docs previously said Debian sid/unstable, but we
felt this as unnecessary because Debian sid can and does change very
quickly. if we wanted a new dependency there, Debian could probably
accommodate it

we also considered RHEL 10 + EPEL 10, however, these repos are not even
stable yet and certbot and many of its dependencies are not yet packaged
there at all

for these reasons, plus many of the reasons we decided to upgrade past
EPEL 9 with the default python 3 version there, we decided that at least
for now, we will remove any linux distro considerations when choosing
minimal dependency versions of certbot

as i wrote in the contributing docs, we may choose to reconsider this
plan if there are requests for us to do so, but based on the information
above, we are not sure this will ever even happen and removing this
constraint significantly simplifies development of certbot
2025-01-15 09:47:40 -08:00
Erica Portnoy 1de966d637 Bump version to 3.2.0 2025-01-07 12:54:01 -08:00
Erica Portnoy dcd52b0711 Release 3.1.0 2025-01-07 12:54:00 -08:00
Brad WarrenandGitHub d3d293299a minor acme doc & comment fixes (#10122)
this fixes two tiny things i noticed when reviewing
https://github.com/certbot/certbot/pull/10120

1. not all of our `acme` modules were generating API documentation
2. the deleted commend about a "type ignore" should have been deleted in
https://github.com/certbot/certbot/pull/9197 but will and i missed it
2025-01-07 18:17:00 +00:00
Alex GaynorandGitHub 9148acd332 Migrate verify_cert to take cryptography certificates (#10120) 2025-01-07 17:46:31 +00:00
ohemorangeandGitHub 985457e57b Add docstring for acme.crypto_util.get_names_from_subject_and_extensions (#10115)
It was my oversight to not request this when this function was made
public in https://github.com/certbot/certbot/pull/10111.
2025-01-06 14:37:29 -08:00
Alex GaynorandGitHub 6ea5da51e0 Simplify typing for a local variable (#10113)
`_DefaultCertSelection` _is_ a `Callable` of the appropriate signature.

Also fixed a mypy error I see locally, `TOKEN_SIZE` should be an
integer.
2025-01-06 13:18:28 -08:00
Alex GaynorandGitHub 1ac05ae891 Remove _pyopenssl_cert_or_req_san_ip which is unused, and migrate _pyopenssl_cert_or_req_all_names to cryptography (#10112)
Unfortunately the other helpers from this family are directly called by
(historic) versions of certbot, and so cannot be easily removed.
2025-01-06 12:46:23 -08:00
Alex GaynorandGitHub 5dd898f56b Move _get_names_from_subject_and_extensions to acme's crypto_utils (#10111)
Make use of it in more places
2025-01-03 16:21:31 -08:00
Alex Gaynor 619da0432a Introduce a Format enum to help us migrate away from pyOpenSSL's constants
Begin using it in `dump_pyopenssl_chain`
2024-12-21 11:06:43 -05:00
724be8848a Convert http01_example.py to use cryptography's APIs (#10098)
Co-authored-by: ohemorange <ebportnoy@gmail.com>
2024-12-18 23:54:44 +00:00
23245c07b2 Replace assert False with pytest.fail (#10094)
This seems to be better style. The assert False statements are
automatically removed by Python when running in the optimized mode,
which could hide test failures.

## Pull Request Checklist

- [ ] The Certbot team has recently expressed interest in reviewing a PR
for this. If not, this PR may be closed due our limited resources and
need to prioritize how we spend them.
- [ ] If the change being made is to a [distributed
component](https://certbot.eff.org/docs/contributing.html#code-components-and-layout),
edit the `main` section of `certbot/CHANGELOG.md` to include a
description of the change being made.
- [ ] Add or update any documentation as needed to support the changes
in this PR.
- [ ] Include your name in `AUTHORS.md` if you like.

Co-authored-by: Mads Jensen <atombrella@users.noreply.github.com>
2024-12-18 14:44:05 -08:00
Will GreenbergandGitHub 5fca4a14ab Merge pull request #10084 from atombrella/pyupgrade/up024_oserror
Replace aliased OSError.
2024-12-17 14:34:10 -08:00
Alex GaynorandGitHub b16c64a05b Convert make_csr to use cryptography instead of pyOpenSSL (#10086)
These pyOpenSSL APIs are deprecated and we'd like to remove them.
2024-12-16 11:00:52 -08:00
Mads Jensen 57b5942fc3 Replace aliased OSError.
As of Python 3.3, various errors were merged into OSError.
https://docs.python.org/3/library/exceptions.html#OSError
2024-12-14 11:15:26 +01:00
Brad WarrenandGitHub 7a48c235a9 remove importlib_resources (#10076)
this is part of my work on
https://github.com/certbot/certbot/issues/10035 based on erica's comment
at
https://github.com/certbot/certbot/issues/10035#issuecomment-2452212686
2024-12-06 12:37:17 -08:00
Brad WarrenandGitHub 087cb4d1f4 remove python 3.8 support (#10077)
fixes https://github.com/certbot/certbot/issues/10035. you can compare
this to the PR that did this for python 3.7 at
https://github.com/certbot/certbot/pull/9792

i agree with erica's comment at
https://github.com/certbot/certbot/issues/10035#issuecomment-2452212686,
but felt this PR was already getting pretty large so i did that in a
second PR at https://github.com/certbot/certbot/pull/10076
2024-12-04 14:55:20 -08:00
Harlan Lieberman-BergandBrad Warren b0e389aad7 Drop setuptools as a runtime dependency
Because of the change from using setuptools.pkg_resources to using
importlib, we no longer need a runtime dependency on setuptools. It is
still required, however, for running setup.py.
2024-12-03 11:17:27 -08:00
Brad Warren 2b57c5f03c Bump version to 3.1.0 2024-11-14 09:22:05 -08:00
Brad Warren 93294fc989 Release 3.0.1 2024-11-14 09:22:03 -08:00
Will Greenberg c5a5d6f9a1 Release 3.0.0 2024-11-05 10:55:19 -08:00
Brad WarrenandGitHub 320cf92944 depecate py38 support (#10034) 2024-10-31 15:48:57 -07:00
80e68bec26 Update dependencies (27-08-2024) (#9993)
Update dependencies & proactively defends against major bump to Josepy 2+

Co-authored-by: Brad Warren <bmw@users.noreply.github.com>
2024-08-28 07:22:22 -07:00
Will Greenberg 9213154e44 Bump version to 2.12.0 2024-06-05 14:34:41 -07:00
Will Greenberg 8db8fcf26c Release 2.11.0 2024-06-05 14:34:40 -07:00
Will Greenberg 9412ce9f05 Bump version to 2.11.0 2024-04-02 14:20:25 -07:00
Will Greenberg 4d7d0d6d04 Release 2.10.0 2024-04-02 14:20:24 -07:00
Erica Portnoy 3b183961a9 Bump version to 2.10.0 2024-02-08 11:46:08 -08:00
Erica Portnoy 725c64d581 Release 2.9.0 2024-02-08 11:46:07 -08:00
AlexisandGitHub 0a565815f9 Docs: Reset requirements.txt path (#9877)
* Reset requirements.txt path

* Add requirements.txt path

* Test config path

* Change docs path

* Amend paths for successful builds

* Place copyright for epub

- Will amend copyright parameter at a later date
2024-02-01 08:27:45 -08:00
zoracon 01cf4bae75 Amend YAML error on reeadthedocs yaml files 2024-01-17 14:46:12 -08:00
Brad WarrenandGitHub 9d8eb6ccfd Add Python 3.12 support (#9852)
* add py312 support

* sed -i "s/\( *'Pro.*3\.1\)1\(',\)/\11\2\n\12\2/" */setup.py

* update pytest.ini comment

* upgrade macos version

* fixup changelog
2023-12-13 10:02:38 -08:00
Will Greenberg dccb92d57f Bump version to 2.9.0 2023-12-05 11:14:39 -08:00