We're going to keep the built artifact in the tree as per https://github.com/letsencrypt/letsencrypt/issues/1572#issuecomment-161379131 so that...
1. People's current behavior of cloning from git and running the le-auto script still works.
2. We don't have a deprecation timeline and process to babysit.
We'll enforce its up-to-dateness with a test.
To run it, cd letsencrypt_auto && ./build.py && docker build -t lea . && docker run --rm -t -i lea
So as not to depend on the state of the host machine, the test runs within an Ubuntu Docker image. This lets us sidestep interaction challenges by setting up passwordless sudo. It also lets us insert our own local CA for the mock HTTPS server. (openssl's SSL_CERT_FILE env var replaces rather than adds to the accepted CAs, meaning later connections to PyPI within the same process chain fail. SSL_CERT_DIR seems not to work at all on OS X.) This also demonstrates a way to test across various Linux distros, even within Travis if we like,
Also...
* Switch to an official release of ConfigArgParse.
* Don't redundantly re-bootstrap on --no-self-upgrade (that is, phase 2).
Previously this code would show the user a hardcoded message based on the error
type, but it's much more useful to show the error detail field, which often
helps debug the problem.
Raise MisconfigurationError on restart failure, so we don't attempt to continue
with an authorization we know will fail.
Log at debug level the config files that are about to be written out, so it's
easier to debug restart failures.
Fix https://github.com/letsencrypt/letsencrypt/issues/942:
Error out if adding a conflicting directive.
Remove unnecessarily-inserted access_log and error_log directives. These were
added to make integration testing easier but are no longer needed. Incidentally
this makes the plugin work with some configs where it wouldn't have worked
previously.
Change the semantics of add_server_directives with replace=True so only the
first instance of a given directive is replaced, not all of them. This works
fine with the one place in the code that calls add_server_directives with
replace=True, because all of the involved directives aren't allowed to be
duplicated in a given block.
Make add_http_directives do inserts into the structure itself, since its needs
were significantly different than the more general add_server_directives. This
also allows us to narrow the scope of the `block.insert(0, directive)` hack that
we inserted to work around https://trac.nginx.org/nginx/ticket/810, since it's
only necessary for http blocks.
Erik Rose