Commit Graph
301 Commits
Author SHA1 Message Date
ohemorangeandGitHub 00cdb6f22a Don't build epubs in readthedocs (#10671)
There's no way anyone is using these...

https://github.com/certbot/certbot/pull/9762 was just basing off of
readthedocs' defaults.https://github.com/certbot/certbot/pull/9762 was
just basing off of readthedocs' defaults.

Probably no one is using pdf either, but definitely no one is using
epubs. This is the more cautious version of
https://github.com/certbot/certbot/pull/10670

```
$ git grep epub
acme/docs/Makefile:.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest coverage gettext
acme/docs/Makefile:     @echo "  epub       to make an epub"
acme/docs/Makefile:epub:
acme/docs/Makefile:     $(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
acme/docs/Makefile:     @echo "Build finished. The epub file is in $(BUILDDIR)/epub."
acme/docs/make.bat:     echo.  epub       to make an epub
acme/docs/make.bat:if "%1" == "epub" (
acme/docs/make.bat:     %SPHINXBUILD% -b epub %ALLSPHINXOPTS% %BUILDDIR%/epub
acme/docs/make.bat:     echo.Build finished. The epub file is in %BUILDDIR%/epub.
certbot/docs/Makefile:.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest coverage gettext
certbot/docs/Makefile:  @echo "  epub       to make an epub"
certbot/docs/Makefile:epub:
certbot/docs/Makefile:  $(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
certbot/docs/Makefile:  @echo "Build finished. The epub file is in $(BUILDDIR)/epub."
certbot/docs/make.bat:  echo.  epub       to make an epub
certbot/docs/make.bat:if "%1" == "epub" (
certbot/docs/make.bat:  %SPHINXBUILD% -b epub %ALLSPHINXOPTS% %BUILDDIR%/epub
certbot/docs/make.bat:  echo.Build finished. The epub file is in %BUILDDIR%/epub.
```
2026-06-10 14:04:18 -07:00
Brad Warren b7024352cc Bump version to 5.7.0 2026-05-11 08:57:00 -07:00
Brad Warren 03b5cf3cb0 Release 5.6.0 2026-05-11 08:56:58 -07:00
Brad WarrenandGitHub 208ff18405 remove readthedocs requirements files (#10639)
as those with access can see
[here](https://github.com/certbot/certbot/security/dependabot),
dependabot recently got confused by our readthedocs.org.requirements.txt
files

my read of the situation looking at output like
[this](https://github.com/certbot/certbot/actions/runs/25448194392/job/74658002711#step:3:72)
is dependabot expects paths to local packages to be relative to the
requirements file while readthedocs wants them to relative to the root
of the repo. (i tested changing the paths to be relative to the
requirements file and [readthedocs was not
happy](https://app.readthedocs.org/projects/eff-certbot/builds/32592654/))

to deal with this, we could create a .github/dependabot.yaml file and
set
[exclude-paths](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#exclude-paths-),
but it strikes me as even simpler and cleaner to just remove these files
if possible

our use of these readthedocs.org.requirements.txt files dates back to
https://github.com/certbot/certbot/pull/261, long before readthedocs
added its .readthedocs.yaml files which we much more recently adopted in
https://github.com/certbot/certbot/pull/9762. inspired by the
suggestions at
https://github.com/readthedocs/readthedocs.org/issues/7258 to workaround
the lack of support for constraints files, i took the approach of
[customizing the build
process](https://docs.readthedocs.com/platform/stable/build-customization.html)

we luckily don't have to override any of the existing readthedocs build
steps. for reference, the build process is described
[here](https://docs.readthedocs.com/platform/stable/builds.html),
however, if you compare the readthedocs build logs from
[main](https://app.readthedocs.org/projects/eff-certbot/builds/32568259/)
and [this
branch](https://app.readthedocs.org/projects/eff-certbot/builds/32597332/),
you'll see they are essentially identical

in addition to the certbot build, i also triggered
[acme](https://app.readthedocs.org/projects/acme-python/builds/32597344/)
and
[dns-cloudflare](https://app.readthedocs.org/projects/certbot-dns-cloudflare/builds/32597347/)
builds from this branch which passed as well

i personally think we can get away with just one review on this PR, but
if the reviewer disagrees, by all means request a second one
2026-05-08 13:59:22 -07:00
Erica Portnoy fc91823888 Bump version to 5.6.0 2026-04-07 09:38:18 -07:00
Erica Portnoy 82dda45352 Release 5.5.0 2026-04-07 09:38:17 -07:00
Will Greenberg 8ebbe24190 Bump version to 5.5.0 2026-03-10 10:47:29 -07:00
Will Greenberg 95c004cb96 Release 5.4.0 2026-03-10 10:47:28 -07:00
Erica Portnoy 1ee73eed10 Bump version to 5.4.0 2026-02-03 09:52:18 -08:00
Erica Portnoy 54a3078305 Release 5.3.0 2026-02-03 09:52:16 -08:00
Mike LimandGitHub 88af129315 Granular permissions (#9922)
Set granular permissions to TXT DNS records with names starting with
`_acme-challenge.` only
This replaces original policy that is too permissive

The `Condition` clause uses [Route 53 resource record set
permission](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-permissions.html)

Policy tested with Certbot 2.9.0
2026-02-02 11:18:05 -08:00
58724f68ec Add CLI flag --ip-address (#10495)
Co-authored-by: ohemorange <ebportnoy@gmail.com>
Co-authored-by: Brad Warren <bmw@users.noreply.github.com>
2026-01-16 13:23:41 -08:00
Brad WarrenandGitHub 28abca467b remove email address (#10533)
this is the followup from https://github.com/certbot/josepy/pull/254
doing the same thing on this repo

i personally don't think this PR needs two reviews
2026-01-07 19:03:03 +00:00
b1cf53ff6b Add identifier field to AnnotatedChallenge subclasses (#10491)
This field is optional to maintain backwards compatibility. Note that
`AnnotatedChallenge` inherits from `jose.ImmutableMap`, which has a
[check in
__init__](https://github.com/certbot/josepy/blob/4b747476703fe4fff1aaccd76ebe570698bbf4f0/src/josepy/util.py#L125-L131)
that all slots are provided. That check would not allow us to do a
backwards-compatible addition, so I implemented an `__init__` for each
of these subclasses that fills the fields without calling the parent
`__init__`, and so doesn't hit an error when `identifier` is absent.

I chose to use `acme.messages.Identifier` rather than
`certbot._internal.san.SAN` here because these are wrapped ACME types,
so they should use the ACME representation. Also, `AnnotatedChallenge`
is passed to plugins, so we need to pass a type that the plugins can
understand.

Additionally, `domain` is marked as deprecated.

Part of #10346

/cc @bmw, who noticed the issue with `AnnotatedChallenge`
[here](https://github.com/certbot/certbot/pull/10468#issuecomment-3403294394)
and provided additional feedback
[here](https://github.com/jsha/certbot/pull/2#issuecomment-3534895793).
Note that there's still some work to do to finish excising `domain`
assumptions from this portion of the code.

---------

Co-authored-by: ohemorange <ebportnoy@gmail.com>
2025-12-05 13:44:04 -08:00
Brad Warren 9a2e508348 Bump version to 5.3.0 2025-12-03 11:48:10 -08:00
Brad Warren 1127ac1cd7 Release 5.2.1 2025-12-03 11:48:09 -08:00
ohemorangeandGitHub 2ec8320763 Add python 3.14 support (#10481)
fixes https://github.com/certbot/certbot/issues/10477. this is based on
the PR that did this for 3.13 at
https://github.com/certbot/certbot/pull/10164
2025-11-04 10:49:51 -08:00
Erica Portnoy 3683eb6cf4 Bump version to 5.2.0 2025-10-07 09:42:29 -07:00
Erica Portnoy d97f2aefc3 Release 5.1.0 2025-10-07 09:42:28 -07:00
Brad Warren 8ecd7fc23d Bump version to 5.1.0 2025-09-02 08:47:05 -07:00
Brad Warren c307f62114 Release 5.0.0 2025-09-02 08:47:04 -07:00
ohemorangeandGitHub 56da12207b Mock time.sleep for more modules to speed up tests (#10427)
The extra 8 seconds isn't really relevant in the test farm, but is nice
to have for local runs. This is based on what was done in
https://github.com/certbot/certbot/pull/10419/.
2025-08-18 09:59:55 -07:00
ohemorangeandGitHub 407dc158f6 Set up dns plugins to use pyproject.toml (#10425)
Final part of https://github.com/certbot/certbot/issues/10403

I tested running `tools/snap/generate_dnsplugins_snapcraft.sh
certbot-dns-dnsimple` and it put the correct description in to the
`snapcraft.yaml` file.
2025-08-15 09:17:15 -07:00
49900b27d3 Update pinned oldest dependencies (#10420)
This is not necessarily the absolute minimum versions/pins we could use,
but it does get tests working. Fixes
https://github.com/certbot/certbot/issues/10418.

---------

Co-authored-by: Brad Warren <bmw@users.noreply.github.com>
2025-08-14 16:37:10 -07:00
Brad WarrenandGitHub d5a2e9227c use pep585 types everywhere and add a test (#10414)
this is the final part of
https://github.com/certbot/certbot/issues/10195. this fixes
https://github.com/certbot/certbot/issues/10195

the changes in the first commit were done automatically with the
command:
```
ruff check --fix --extend-select UP006 --unsafe-fixes
```
the second commit configures ruff to check for this to avoid regressions

thanks for bearing with me thru these somewhat large automatically
generated PRs ohemorange 🙏
2025-08-12 16:56:45 -07:00
5d05984dd9 remove python 3.9 support (#10406)
Fixes https://github.com/certbot/certbot/issues/10389. you can compare
this to the PR that did this for python 3.8 at
https://github.com/certbot/certbot/pull/10077

additional changes:
- linux-py310 test is removed from extended tests, since it's now run in
standard tests. additionally, openssl will never be < 1.1.1 now, due to
https://peps.python.org/pep-0644/.
- `letstest/scripts/test_openssl_version.py` was testing functionality
that was removed in https://github.com/certbot/certbot/pull/10373 so it
was deleted

---------

Co-authored-by: Brad Warren <bmw@users.noreply.github.com>
2025-08-12 17:49:02 +00:00
ohemorangeandGitHub dea3e5f1c4 Set up ruff so that test files have at least some linting (#10399)
Alternative implementation for #7908.

In this PR:
- set up ruff in CI (add to `tox.ini`, mark dep in `certbot/setup.py`)
- add a `ruff.toml` that ignores particularly annoying errors. I think
line length isn't actually necessary to set with this workflow since
we're not checking it but putting it there for future usage.
- either fix or ignore the rest of the errors that come with the default
linting configuration. fixed errors are mostly unused variables. ignored
are usually where we're doing weird import things for a specific reason.
2025-08-08 08:48:43 -07:00
ohemorangeandGitHub 5859e50e44 Run ruff to fix test errors (#10398)
This is mostly removing unused imports, plus one unused `import as`. Had
to put back imports being used with `eval` -- see the second commit.
2025-08-07 22:10:02 +00:00
Erica Portnoy ffb2196e21 Bump version to 5.0.0 2025-08-05 08:58:17 -07:00
Erica Portnoy 832d11a63f Release 4.2.0 2025-08-05 08:58:16 -07:00
Brad WarrenandGitHub ae2a00bbad prep for 4.2.0 and fix changelog (#10375)
something weird happened to the changelog in
https://github.com/certbot/certbot/pull/10319. a 4.2.0 entry was added
below the entry for `5.0.0 - main` despite 4.2.0 not having been
released. since it's sounding like we're expecting our next release to
be 4.2.0 and not 5.0, i merged these two changelog entries into one for
4.2.0

i also modified our setup.py files to use 4.2.0.dev0 instead of
5.0.0.dev0 altho this isn't strictly necessary because our release
script will automatically set all version numbers to whatever version we
give it on the command line before building the release
2025-07-29 14:44:39 -07:00
Yaroslav HalchenkoandGitHub 86f76cd3df Add codespell support (CI to check, not to fix) and make it fix a few typos (#10297)
Another token of gratitude for a super useful tool and service.

More about codespell: https://github.com/codespell-project/codespell .

I personally introduced it to dozens if not hundreds of projects already
and so far only positive feedback.

CI workflow has 'permissions' set only to 'read' so also should be safe.

---------

Signed-off-by: Yaroslav O. Halchenko <debian@onerussian.com>
2025-06-24 13:14:31 +09:00
Erica Portnoy 4a1a136fcb Bump version to 5.0.0 2025-06-10 14:43:36 -07:00
Erica Portnoy 6a72811a39 Release 4.1.0 2025-06-10 14:43:35 -07:00
Brad WarrenandGitHub cc08242abc update pinned dependencies (#10278)
this fixes the security alerts those with access can see at
https://github.com/certbot/certbot/security/dependabot

i based what needed to be done to drop python < 3.9.2 support on
https://github.com/certbot/certbot/pull/10077 and concluded we only
really needed to update `python_requires`. we could do a deprecation
period for this, but i think it's not necessary. cryptography didn't
(it's not even in mentioned in [their
changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst))
and none of the major LTS distros use python 3.9.0 or 3.9.1
2025-05-06 10:56:19 -07:00
ohemorangeandGitHub 16f858547f Add --use-pep517 flag to pip to silence warning in tools/venv.py, and switch codebase to src-layout (#10249)
Fixes #10252.

See further discussion here: https://github.com/pypa/pip/issues/11457

We are doing option:

> Alternatively, enable the --use-pep517 pip option, possibly with
--no-build-isolation. The --use-pip517 flag will force pip to use the
modern mechanism for editable installs. --no-build-isolation may be
needed if your project has build-time requirements beyond setuptools and
wheel. By passing this flag, you are responsible for making sure your
environment already has the required dependencies to build your package.
Once the legacy mechanism is removed, --use-pep517 will have no effect
and will essentially be enabled by default in this context.

Major changes made here include:
- Add `--use-pep517` to use the modern mechanism, which will be the only
mechanism in future pip releases
- Change to `/src` layout to appease mypy, and because for editable
installs that really is the normal way these days.
  - `cd acme && mkdir src && mv acme src/` etc.
- add `where='src'` argument to `find_packages` and add
`package_dir={'': 'src'},` in `setup.py`s
  - update `MANIFEST.in` files with new path locations 
- Update our many hardcoded filepaths
- Update `importlib-metadata` requirement to fix
double-plugin-entry-point problem in oldest tests
2025-04-11 19:30:33 +00:00
Will Greenberg f822602fff Bump version to 4.1.0 2025-04-07 15:04:01 -07:00
Will Greenberg d95a389c3f Release 4.0.0 2025-04-07 15:04:00 -07:00
Artur Corrêa SouzaandGitHub df9075e023 fix(route53): explanation on credentials file (#9907)
The credentials configuration file is at ~/.aws/credentials.

Also, when running on root it uses the root home (so /root/.aws). This
was from my test at an ubuntu server.

## Pull Request Checklist

- [ ] The Certbot team has recently expressed interest in reviewing a PR
for this. If not, this PR may be closed due our limited resources and
need to prioritize how we spend them.
- [ ] If the change being made is to a [distributed
component](https://certbot.eff.org/docs/contributing.html#code-components-and-layout),
edit the `master` section of `certbot/CHANGELOG.md` to include a
description of the change being made.
- [ ] Add or update any documentation as needed to support the changes
in this PR.
- [ ] Include your name in `AUTHORS.md` if you like.
2025-03-13 13:23:57 -07:00
Will Greenberg 8a2ded2d0e psych, actually bump version to 4.0.0 2025-02-11 15:17:56 -08:00
Will Greenberg 77594d7300 Bump version to 3.3.0 2025-02-11 11:58:46 -08:00
Will Greenberg a0e8b49057 Release 3.2.0 2025-02-11 11:58:44 -08:00
Brad WarrenandGitHub 392467609f add python 3.13 support (#10164)
fixes https://github.com/certbot/certbot/issues/10045. this is based on
the PR that did this for 3.12 at
https://github.com/certbot/certbot/pull/9852

this PR also removes python 3.8 from our tox config which should have
been done as part of https://github.com/certbot/certbot/pull/10077
2025-01-29 12:53:56 -08:00
ohemorangeandGitHub a46db66371 Enable strict typing in certbot-dns-route53 (#10161)
Using the `ignore` syntax this time!

```
$ mypy --strict certbot-dns-route53/certbot_dns_route53
Success: no issues found in 5 source files
```
2025-01-28 10:53:27 -08:00
Erica Portnoy 1de966d637 Bump version to 3.2.0 2025-01-07 12:54:01 -08:00
Erica Portnoy dcd52b0711 Release 3.1.0 2025-01-07 12:54:00 -08:00
Brad WarrenandGitHub 087cb4d1f4 remove python 3.8 support (#10077)
fixes https://github.com/certbot/certbot/issues/10035. you can compare
this to the PR that did this for python 3.7 at
https://github.com/certbot/certbot/pull/9792

i agree with erica's comment at
https://github.com/certbot/certbot/issues/10035#issuecomment-2452212686,
but felt this PR was already getting pretty large so i did that in a
second PR at https://github.com/certbot/certbot/pull/10076
2024-12-04 14:55:20 -08:00
Harlan Lieberman-BergandBrad Warren b0e389aad7 Drop setuptools as a runtime dependency
Because of the change from using setuptools.pkg_resources to using
importlib, we no longer need a runtime dependency on setuptools. It is
still required, however, for running setup.py.
2024-12-03 11:17:27 -08:00
Brad WarrenandGitHub 9f5451d16b update intersphinx mapping (#10074)
this hopefully fixes our nightly failures

readthedocs seems to redirect users to its .io site so
https://acme-python.readthedocs.org/en/latest/objects.inv is supposed to
redirect people to
https://acme-python.readthedocs.io/en/latest/objects.inv, but that
doesn't always seem to work and instead [sometimes serves a
403](https://dev.azure.com/certbot/certbot/_build/results?buildId=8237&view=logs&j=d74e04fe-9740-597d-e9fa-1d0400037dfd&t=dde413a4-f24c-59a0-9684-e33d79f9aa02&l=800)

removing the need for this redirect seems to fix things based on some
quick testing and certainly shouldn't hurt
2024-12-03 11:16:13 -08:00
Will Greenberg 798a61622c Bump version to 3.1.0 2024-11-05 10:55:20 -08:00