mirror of
https://github.com/certbot/certbot.git
synced 2026-08-01 16:19:13 +02:00
ohemorangeandGitHub
16f858547f
Fixes #10252. See further discussion here: https://github.com/pypa/pip/issues/11457 We are doing option: > Alternatively, enable the --use-pep517 pip option, possibly with --no-build-isolation. The --use-pip517 flag will force pip to use the modern mechanism for editable installs. --no-build-isolation may be needed if your project has build-time requirements beyond setuptools and wheel. By passing this flag, you are responsible for making sure your environment already has the required dependencies to build your package. Once the legacy mechanism is removed, --use-pep517 will have no effect and will essentially be enabled by default in this context. Major changes made here include: - Add `--use-pep517` to use the modern mechanism, which will be the only mechanism in future pip releases - Change to `/src` layout to appease mypy, and because for editable installs that really is the normal way these days. - `cd acme && mkdir src && mv acme src/` etc. - add `where='src'` argument to `find_packages` and add `package_dir={'': 'src'},` in `setup.py`s - update `MANIFEST.in` files with new path locations - Update our many hardcoded filepaths - Update `importlib-metadata` requirement to fix double-plugin-entry-point problem in oldest tests
143 lines
5.7 KiB
YAML
143 lines
5.7 KiB
YAML
name: certbot
|
|
summary: Automatically configure HTTPS using Let's Encrypt
|
|
description: |
|
|
The objective of Certbot, Let's Encrypt, and the ACME (Automated
|
|
Certificate Management Environment) protocol is to make it possible
|
|
to set up an HTTPS server and have it automatically obtain a
|
|
browser-trusted certificate, without any human intervention. This is
|
|
accomplished by running a certificate management agent on the web
|
|
server.
|
|
|
|
This agent is used to:
|
|
- Automatically prove to the Let's Encrypt CA that you control the website
|
|
- Obtain a browser-trusted certificate and set it up on your web server
|
|
- Keep track of when your certificate is going to expire, and renew it
|
|
- Help you revoke the certificate if that ever becomes necessary.
|
|
confinement: classic
|
|
base: core24
|
|
grade: stable
|
|
adopt-info: certbot
|
|
|
|
environment:
|
|
AUGEAS_LENS_LIB: "$SNAP/usr/share/augeas/lenses/dist"
|
|
CERTBOT_SNAPPED: "True"
|
|
# This is needed to help openssl find its legacy provider on architectures
|
|
# where we cannot use cryptography's pre-built wheels. See
|
|
# https://github.com/certbot/certbot/issues/10055.
|
|
OPENSSL_MODULES: "$SNAP/usr/lib/$CRAFT_ARCH_TRIPLET_BUILD_FOR/ossl-modules"
|
|
PATH: "$SNAP/bin:$SNAP/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"
|
|
PYTHONPATH: "$SNAP/lib/python3.12/site-packages:${PYTHONPATH}"
|
|
# Disable FIPS mode detection. See
|
|
# https://git.launchpad.net/ubuntu/+source/openssl/tree/debian/patches/fips/crypto-Add-kernel-FIPS-mode-detection.patch?h=applied/ubuntu/noble
|
|
# for more on this flag, and https://github.com/certbot/certbot/issues/10044
|
|
# for more on the issue.
|
|
#
|
|
# This is needed because the Python + OpenSSL bundled in core24 don't include
|
|
# an OpenSSL FIPS provider, which causes crashes on host systems with OpenSSL
|
|
# 1.1.1f (e.g. Ubuntu Pro 20.04). For some reason, core24's OpenSSL also looks
|
|
# in a non-standard location for the provider, which also causes crashes on
|
|
# systems with OpenSSL 3.x (e.g. RHEL 9). If you need FIPS functionality in
|
|
# certbot, install via pip.
|
|
OPENSSL_FORCE_FIPS_MODE: "0"
|
|
|
|
apps:
|
|
certbot:
|
|
command: bin/python3 -s $SNAP/bin/certbot
|
|
renew:
|
|
command: bin/python3 -s $SNAP/bin/certbot -q renew
|
|
daemon: oneshot
|
|
# Run approximately twice a day with randomization
|
|
timer: 00:00~24:00/2
|
|
|
|
|
|
parts:
|
|
certbot:
|
|
plugin: python
|
|
source: .
|
|
python-packages:
|
|
- git+https://github.com/certbot/python-augeas.git@certbot-patched
|
|
- ./acme
|
|
- ./certbot
|
|
- ./certbot-apache
|
|
- ./certbot-nginx
|
|
stage:
|
|
- -usr/lib/python3.12/sitecustomize.py # maybe unnecessary
|
|
- -pyvenv.cfg
|
|
# Old versions of this file used to unstage
|
|
# lib/python3.8/site-packages/augeas.py to avoid conflicts between
|
|
# python-augeas 0.5.0 which was pinned in snap-constraints.txt and
|
|
# our python-augeas fork which creates an auto-generated cffi file at
|
|
# the same path. Since we've combined things in one part and removed the
|
|
# python-augeas pinning, unstaging this file had a different, unintended
|
|
# effect so we now stage the file to keep the auto-generated cffi file.
|
|
stage-packages:
|
|
- libaugeas0
|
|
- libpython3.12-dev
|
|
# This library included so openssl has a legacy provider available at
|
|
# runtime when we are unable to use cryptography's pre-built wheels. See
|
|
# https://github.com/certbot/certbot/issues/10055.
|
|
- libssl3t64
|
|
# added to stage python:
|
|
- libpython3-stdlib
|
|
- libpython3.12-stdlib
|
|
- libpython3.12-minimal
|
|
- python3-pip
|
|
- python3-wheel
|
|
- python3-venv
|
|
- python3-minimal
|
|
- python3-pkg-resources
|
|
- python3.12-minimal
|
|
# To build cryptography and cffi if needed
|
|
build-packages:
|
|
- gcc
|
|
- git
|
|
- libaugeas-dev
|
|
- build-essential
|
|
- libssl-dev
|
|
- libffi-dev
|
|
- python3-dev
|
|
- cargo
|
|
- pkg-config
|
|
build-environment:
|
|
# We set this environment variable while building to try and increase the
|
|
# stability of fetching the rust crates needed to build the cryptography
|
|
# library.
|
|
- CARGO_NET_GIT_FETCH_WITH_CLI: "true"
|
|
- PARTS_PYTHON_VENV_ARGS: --upgrade
|
|
# Constraints are passed through the environment variable PIP_CONSTRAINTS instead of using the
|
|
# parts.[part_name].constraints option available in snapcraft.yaml when the Python plugin is
|
|
# used. This is done to let these constraints be applied not only on the certbot package
|
|
# build, but also on any isolated build that pip could trigger when building wheels for
|
|
# dependencies. See https://github.com/certbot/certbot/pull/8443 for more info.
|
|
- PIP_CONSTRAINT: $CRAFT_PART_SRC/snap-constraints.txt
|
|
override-build: |
|
|
python3 -m venv "${CRAFT_PART_INSTALL}"
|
|
"${CRAFT_PART_INSTALL}/bin/python3" "${CRAFT_PART_SRC}/tools/pipstrap.py"
|
|
craftctl default
|
|
override-pull: |
|
|
craftctl default
|
|
grep -v python-augeas "${CRAFT_PART_SRC}/tools/requirements.txt" >> "${CRAFT_PART_SRC}/snap-constraints.txt"
|
|
craftctl set version=$(grep -oP "__version__ = '\K.*(?=')" "${CRAFT_PART_SRC}/certbot/src/certbot/__init__.py")
|
|
build-attributes:
|
|
- enable-patchelf
|
|
shared-metadata:
|
|
plugin: dump
|
|
source: .
|
|
override-pull: |
|
|
craftctl default
|
|
mkdir -p certbot-metadata
|
|
grep -oP "__version__ = '\K.*(?=')" $CRAFT_PART_SRC/certbot/src/certbot/__init__.py > certbot-metadata/certbot-version.txt
|
|
stage: [certbot-metadata/certbot-version.txt]
|
|
|
|
plugs:
|
|
plugin:
|
|
interface: content
|
|
content: certbot-1
|
|
target: $SNAP/certbot-plugin
|
|
|
|
slots:
|
|
certbot-metadata:
|
|
interface: content
|
|
content: metadata-1
|
|
read: [$SNAP/certbot-metadata]
|