There's no particular reason this *should* fix#2499, but it changes how pycparser gets installed (to a more modern way: pip vs. setuptools), so it may.
I prefer to err toward simplicity here. Yes, there's an assumption necessary for this to work--that the shell doesn't do multiple open() calls to the script path throughout the life of the interpreter--but I think it's reasonable. The alternative of exec-ing out to a dedicated update script which then execs back to le-auto has more moving parts (like extra files that we have to clean up) and is longer.
Executed as root
git clone https://github.com/letsencrypt/letsencrypt
cd letsencrypt/
./letsencrypt-auto --help
failed with message
./letsencrypt-auto: 171: ./letsencrypt-auto: sudo: not found
Ported from #1751.
* It's more lines but fewer tokens, less room for quote errors, and more idiomatic (see any init.d script).
* Also, fix a bug in which any option containing "-v", e.g. --eat-vertical-pizza, would be construed as --verbose.
Ported from #1751.
* Make sure any Python passed in as $LE_PYTHON actually exists.
* Dodge a word-splitting bug: `a='a b'; export a=${a:-c}; echo $a` gives `a` instead of `a b` under shells that respect POSIX.1, like dash.
Otherwise, we sometimes end up using the system Python, for which we'd need to use sudo to install virtualenv. Brew complicates this by yelling at you if you do use sudo. So let's simplify things by always using the homebrew python, which is more up to date anyway.
...except for $SUDO, which is always either "sudo", "su_sudo", or "", never having a quote-needing char in it.
It's unlikely that $PYVER would have a space in it, but it doesn't hurt.
Python 2.4 doesn't support --version, and we want to be able to at least complain that it's too old without crashing.
Also, bring built le-auto up to date.
--no-self-upgrade metamorphosed from a private flag to a public one, so add a new private flag, --le-auto-phase2 to take its original role of marking the division between phases. This flag must come first and, consequently, can be stripped off the arg list before calling through to letsencrypt, which means the client doesn't need to know about it.
The downside is that anyone still (deprecatedly) running le-auto out of the root of a (recently updated) master checkout will get a "Hey, the current release version le-auto I just self-upgraded to doesn't understand the --le-auto-phase2 flag" error from when we merge this until the next release is made, but that's better than a documented option not working right.
Also, remove a needless folder creation from the Dockerfile.
Leaving broken venvs around can, if it got as far as installing the venv/bin/letsencrypt script, wreck future le-auto runs, since the presence of that script means "a working LE is installed" to it. Waiting until a new version of le-auto comes out and running it would recover, but this lets re-running the same version recover as well.
Brad Warren