Merge remote-tracking branch 'origin/master' into non-interactive

(Merge conflict due to PEP8iness)

letsencrypt/cli.py

@@ -400,7 +400,7 @@ def _auth_from_domains(le_client, config, domains):
         # TODO: Check whether it worked! <- or make sure errors are thrown (jdk)
         lineage.save_successor(
             lineage.latest_common_version(), OpenSSL.crypto.dump_certificate(
-                OpenSSL.crypto.FILETYPE_PEM, new_certr.body),
+                OpenSSL.crypto.FILETYPE_PEM, new_certr.body.wrapped),
             new_key.pem, crypto_util.dump_pyopenssl_chain(new_chain))
 
         lineage.update_all_links_to(lineage.latest_common_version())

letsencrypt/client.py

@@ -300,7 +300,7 @@ class Client(object):
 
         lineage = storage.RenewableCert.new_lineage(
             domains[0], OpenSSL.crypto.dump_certificate(
-                OpenSSL.crypto.FILETYPE_PEM, certr.body),
+                OpenSSL.crypto.FILETYPE_PEM, certr.body.wrapped),
             key.pem, crypto_util.dump_pyopenssl_chain(chain),
             params, config, cli_config)
         return lineage
@@ -330,7 +330,7 @@ class Client(object):
                 self.config.strict_permissions)
 
         cert_pem = OpenSSL.crypto.dump_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, certr.body)
+            OpenSSL.crypto.FILETYPE_PEM, certr.body.wrapped)
         cert_file, act_cert_path = le_util.unique_file(cert_path, 0o644)
         try:
             cert_file.write(cert_pem)

letsencrypt/crypto_util.py

@@ -271,7 +271,7 @@ def dump_pyopenssl_chain(chain, filetype=OpenSSL.crypto.FILETYPE_PEM):
     def _dump_cert(cert):
         if isinstance(cert, jose.ComparableX509):
             # pylint: disable=protected-access
-            cert = cert._wrapped
+            cert = cert.wrapped
         return OpenSSL.crypto.dump_certificate(filetype, cert)
 
     # assumes that OpenSSL.crypto.dump_certificate includes ending

letsencrypt/plugins/standalone.py

@@ -150,7 +150,7 @@ class Authenticator(common.Plugin):
 
         # one self-signed key for all tls-sni-01 certificates
         self.key = OpenSSL.crypto.PKey()
-        self.key.generate_key(OpenSSL.crypto.TYPE_RSA, bits=2048)
+        self.key.generate_key(OpenSSL.crypto.TYPE_RSA, 2048)
 
         self.served = collections.defaultdict(set)
 

letsencrypt/plugins/webroot.py

@@ -98,8 +98,8 @@ to serve all files under specified web root ({0})."""
     def _path_for_achall(self, achall):
         try:
             path = self.full_roots[achall.domain]
-        except IndexError:
-            raise errors.PluginError("Missing --webroot-path for domain: {1}"
+        except KeyError:
+            raise errors.PluginError("Missing --webroot-path for domain: {0}"
                                      .format(achall.domain))
         if not os.path.exists(path):
             raise errors.PluginError("Mysteriously missing path {0} for domain: {1}"

letsencrypt/plugins/webroot_test.py

@@ -111,6 +111,18 @@ class AuthenticatorTest(unittest.TestCase):
         self.assertEqual(os.stat(self.validation_path).st_gid, parent_gid)
         self.assertEqual(os.stat(self.validation_path).st_uid, parent_uid)
 
+    def test_perform_missing_path(self):
+        self.auth.prepare()
+
+        missing_achall = achallenges.KeyAuthorizationAnnotatedChallenge(
+            challb=acme_util.HTTP01_P, domain="thing2.com", account_key=KEY)
+        self.assertRaises(
+            errors.PluginError, self.auth.perform, [missing_achall])
+
+        self.auth.full_roots[self.achall.domain] = 'null'
+        self.assertRaises(
+            errors.PluginError, self.auth.perform, [self.achall])
+
     def test_perform_cleanup(self):
         self.auth.prepare()
         responses = self.auth.perform([self.achall])

letsencrypt/renewer.py

@@ -103,7 +103,7 @@ def renew(cert, old_version):
         #      already understands this distinction!)
         return cert.save_successor(
             old_version, OpenSSL.crypto.dump_certificate(
-                OpenSSL.crypto.FILETYPE_PEM, new_certr.body),
+                OpenSSL.crypto.FILETYPE_PEM, new_certr.body.wrapped),
             new_key.pem, crypto_util.dump_pyopenssl_chain(new_chain))
         # TODO: Notify results
     else:

letsencrypt/storage.py

@@ -564,8 +564,9 @@ class RenewableCert(object):  # pylint: disable=too-many-instance-attributes
                 logger.debug("Should renew, certificate is revoked.")
                 return True
 
-            # Renewals on the basis of expiry time
-            interval = self.configuration.get("renew_before_expiry", "10 days")
+            # Renews some period before expiry time
+            default_interval = constants.RENEWER_DEFAULTS["renew_before_expiry"]
+            interval = self.configuration.get("renew_before_expiry", default_interval)
             expiry = crypto_util.notAfter(self.version(
                 "cert", self.latest_common_version()))
             now = pytz.UTC.fromutc(datetime.datetime.utcnow())

letsencrypt/tests/cli_test.py

@@ -442,11 +442,11 @@ class CLITest(unittest.TestCase):  # pylint: disable=too-many-public-methods
         chain_path = '/etc/letsencrypt/live/foo.bar/fullchain.pem'
 
         mock_lineage = mock.MagicMock(cert=cert_path, fullchain=chain_path)
-        mock_cert = mock.MagicMock(body='body')
+        mock_certr = mock.MagicMock()
         mock_key = mock.MagicMock(pem='pem_key')
         mock_renewal.return_value = ("renew", mock_lineage)
         mock_client = mock.MagicMock()
-        mock_client.obtain_certificate.return_value = (mock_cert, 'chain',
+        mock_client.obtain_certificate.return_value = (mock_certr, 'chain',
                                                        mock_key, 'csr')
         mock_init.return_value = mock_client
         with mock.patch('letsencrypt.cli.OpenSSL'):

letsencrypt/tests/client_test.py

@@ -141,9 +141,9 @@ class ClientTest(unittest.TestCase):
         tmp_path = tempfile.mkdtemp()
         os.chmod(tmp_path, 0o755)  # TODO: really??
 
-        certr = mock.MagicMock(body=test_util.load_cert(certs[0]))
-        chain_cert = [test_util.load_cert(certs[1]),
-                      test_util.load_cert(certs[2])]
+        certr = mock.MagicMock(body=test_util.load_comparable_cert(certs[0]))
+        chain_cert = [test_util.load_comparable_cert(certs[1]),
+                      test_util.load_comparable_cert(certs[2])]
         candidate_cert_path = os.path.join(tmp_path, "certs", "cert.pem")
         candidate_chain_path = os.path.join(tmp_path, "chains", "chain.pem")
         candidate_fullchain_path = os.path.join(tmp_path, "chains", "fullchain.pem")

letsencrypt/tests/display/ops_test.py

@@ -407,10 +407,11 @@ class ChooseNamesTest(unittest.TestCase):
                                           "uniçodé.com")
         self.assertEqual(_choose_names_manually(), [])
         # IDN exception with previous mocks
-        with mock.patch("letsencrypt.display.util") as mock_sl:
-            uerror = UnicodeEncodeError('mock', u'',
-                                        0, 1, 'mock')
-            mock_sl.separate_list_input.side_effect = uerror
+        with mock.patch(
+                "letsencrypt.display.ops.display_util.separate_list_input"
+        ) as mock_sli:
+            unicode_error = UnicodeEncodeError('mock', u'', 0, 1, 'mock')
+            mock_sli.side_effect = unicode_error
             self.assertEqual(_choose_names_manually(), [])
         # Punycode and no retry
         mock_util().input.return_value = (display_util.OK,

letsencrypt/tests/renewer_test.py

@@ -9,6 +9,8 @@ import unittest
 import configobj
 import mock
 
+from acme import jose
+
 from letsencrypt import configuration
 from letsencrypt import errors
 from letsencrypt.storage import ALL_FOUR
@@ -379,6 +381,10 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.assertEqual(self.test_rc.names(12),
                          ["example.com", "www.example.com"])
 
+        # Trying missing cert
+        os.unlink(self.test_rc.cert)
+        self.assertRaises(errors.CertStorageError, self.test_rc.names)
+
     @mock.patch("letsencrypt.storage.datetime")
     def test_time_interval_judgments(self, mock_datetime):
         """Test should_autodeploy() and should_autorenew() on the basis
@@ -702,9 +708,10 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.test_rc.configfile["renewalparams"]["authenticator"] = "apache"
         mock_client = mock.MagicMock()
         # pylint: disable=star-args
+        comparable_cert = jose.ComparableX509(CERT)
         mock_client.obtain_certificate.return_value = (
-            mock.MagicMock(body=CERT), [CERT], mock.Mock(pem="key"),
-            mock.sentinel.csr)
+            mock.MagicMock(body=comparable_cert), [comparable_cert],
+            mock.Mock(pem="key"), mock.sentinel.csr)
         mock_c.return_value = mock_client
         self.assertEqual(2, renewer.renew(self.test_rc, 1))
         # TODO: We could also make several assertions about calls that should

letsencrypt/tests/reverter_test.py

@@ -385,6 +385,15 @@ class TestFullCheckpointsReverter(unittest.TestCase):
         self.assertRaises(
             errors.ReverterError, self.reverter.view_config_changes)
 
+    def test_view_config_changes_for_logging(self):
+        self._setup_three_checkpoints()
+
+        config_changes = self.reverter.view_config_changes(for_logging=True)
+
+        self.assertTrue("First Checkpoint" in config_changes)
+        self.assertTrue("Second Checkpoint" in config_changes)
+        self.assertTrue("Third Checkpoint" in config_changes)
+
     def _setup_three_checkpoints(self):
         """Generate some finalized checkpoints."""
         # Checkpoint1 - config1

letsencrypt/tests/test_util.py

@@ -40,16 +40,24 @@ def load_cert(*names):
     """Load certificate."""
     loader = _guess_loader(
         names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
-    return jose.ComparableX509(OpenSSL.crypto.load_certificate(
-        loader, load_vector(*names)))
+    return OpenSSL.crypto.load_certificate(loader, load_vector(*names))
+
+
+def load_comparable_cert(*names):
+    """Load ComparableX509 cert."""
+    return jose.ComparableX509(load_cert(*names))
 
 
 def load_csr(*names):
     """Load certificate request."""
     loader = _guess_loader(
         names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
-    return jose.ComparableX509(OpenSSL.crypto.load_certificate_request(
-        loader, load_vector(*names)))
+    return OpenSSL.crypto.load_certificate_request(loader, load_vector(*names))
+
+
+def load_comparable_csr(*names):
+    """Load ComparableX509 certificate request."""
+    return jose.ComparableX509(load_csr(*names))
 
 
 def load_rsa_private_key(*names):