mirror of
https://github.com/certbot/certbot.git
synced 2026-07-23 14:23:53 +02:00
106d21d21d
this fixes https://github.com/certbot/certbot/issues/10176 and fixes https://github.com/certbot/certbot/issues/10257. it is based on https://github.com/certbot/certbot/pull/10017 and ohemorange said it's fine for me to cherry-pick their commit here this change accomplishes a few things: * because PYTHONPATH is no longer set to `"$SNAP/lib/python3.12/site-packages:${PYTHONPATH}"` which evaluates to `"$SNAP/lib/python3.12/site-packages:"` if PYTHONPATH wasn't previously set, Certbot no longer searches for Python modules in the current working directory which was causing #10176. i was able to reproduce this problem with our currently released snap and verify that this change fixes that problem * since we no longer set PYTHONPATH at all, it won't be set in user hooks which was causing https://github.com/certbot/certbot/issues/10257 * as an added bonus, scripts that start with `#!/usr/bin/env /snap/certbot/current/bin/python3` as suggested [here](https://github.com/certbot/certbot/issues/10257#issuecomment-2809421320) are still able to find and import certbot and its dependencies so those scripts should continue to work. i verified this is the case with manual testing finally, i created two news fragments here based on the text at https://towncrier.readthedocs.io/en/stable/tutorial.html#creating-news-fragments which says > You can associate multiple issue numbers with a news fragment by giving them the same contents. when run on this PR `towncrier --draft` outputs: ``` Loading template... Finding news fragments... Rendering news fragments... Draft only -- nothing has been written. What is seen below is what would be written. ## 4.2.0.dev0 - 2025-07-31 ### Changed - Catches and ignores errors during the directory fetch for ARI checking so that these errors do not hinder the actual certificate issuance. ([#10342](https://github.com/certbot/certbot/issues/10342)) - Removed the dependency on `pytz`. ([#10350](https://github.com/certbot/certbot/issues/10350)) ### Fixed - The Certbot snap no longer sets the environment variable PYTHONPATH stopping it from picking up Python files in the current directory and polluting the environment for Certbot hooks written in Python. ([#10176](https://github.com/certbot/certbot/issues/10176), [#10257](https://github.com/certbot/certbot/issues/10257)) - Previously, we claimed to set FAILED_DOMAINS and RENEWED_DOMAINS env variables for use by post-hooks when certificate renewals fail, but we were not actually setting them. Now, we are. ([#10259](https://github.com/certbot/certbot/issues/10259)) - Added `--eab-hmac-alg` parameter to support custom HMAC algorithm for External Account Binding. ([#10281](https://github.com/certbot/certbot/issues/10281)) - Certbot now always uses the server value from the renewal configuration file for ARI checks instead of the server value from the current invocation of Certbot. This helps prevent ARI requests from going to the wrong server if the user changes CAs. ([#10339](https://github.com/certbot/certbot/issues/10339)) ``` --------- Co-authored-by: Erica Portnoy <erica@eff.org>
150 lines
6.2 KiB
YAML
150 lines
6.2 KiB
YAML
name: certbot
|
|
summary: Automatically configure HTTPS using Let's Encrypt
|
|
description: |
|
|
The objective of Certbot, Let's Encrypt, and the ACME (Automated
|
|
Certificate Management Environment) protocol is to make it possible
|
|
to set up an HTTPS server and have it automatically obtain a
|
|
browser-trusted certificate, without any human intervention. This is
|
|
accomplished by running a certificate management agent on the web
|
|
server.
|
|
|
|
This agent is used to:
|
|
- Automatically prove to the Let's Encrypt CA that you control the website
|
|
- Obtain a browser-trusted certificate and set it up on your web server
|
|
- Keep track of when your certificate is going to expire, and renew it
|
|
- Help you revoke the certificate if that ever becomes necessary.
|
|
confinement: classic
|
|
base: core24
|
|
grade: stable
|
|
adopt-info: certbot
|
|
|
|
environment:
|
|
AUGEAS_LENS_LIB: "$SNAP/usr/share/augeas/lenses/dist"
|
|
CERTBOT_SNAPPED: "True"
|
|
# This is needed to help openssl find its legacy provider on architectures
|
|
# where we cannot use cryptography's pre-built wheels. See
|
|
# https://github.com/certbot/certbot/issues/10055.
|
|
OPENSSL_MODULES: "$SNAP/usr/lib/$CRAFT_ARCH_TRIPLET_BUILD_FOR/ossl-modules"
|
|
PATH: "$SNAP/bin:$SNAP/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"
|
|
# Disable FIPS mode detection. See
|
|
# https://git.launchpad.net/ubuntu/+source/openssl/tree/debian/patches/fips/crypto-Add-kernel-FIPS-mode-detection.patch?h=applied/ubuntu/noble
|
|
# for more on this flag, and https://github.com/certbot/certbot/issues/10044
|
|
# for more on the issue.
|
|
#
|
|
# This is needed because the Python + OpenSSL bundled in core24 don't include
|
|
# an OpenSSL FIPS provider, which causes crashes on host systems with OpenSSL
|
|
# 1.1.1f (e.g. Ubuntu Pro 20.04). For some reason, core24's OpenSSL also looks
|
|
# in a non-standard location for the provider, which also causes crashes on
|
|
# systems with OpenSSL 3.x (e.g. RHEL 9). If you need FIPS functionality in
|
|
# certbot, install via pip.
|
|
OPENSSL_FORCE_FIPS_MODE: "0"
|
|
|
|
apps:
|
|
certbot:
|
|
command: bin/python3 -s $SNAP/bin/certbot
|
|
renew:
|
|
command: bin/python3 -s $SNAP/bin/certbot -q renew
|
|
daemon: oneshot
|
|
# Run approximately twice a day with randomization
|
|
timer: 00:00~24:00/2
|
|
|
|
|
|
parts:
|
|
certbot:
|
|
plugin: python
|
|
source: .
|
|
python-packages:
|
|
- git+https://github.com/certbot/python-augeas.git@certbot-patched
|
|
- ./acme
|
|
- ./certbot
|
|
- ./certbot-apache
|
|
- ./certbot-nginx
|
|
stage:
|
|
- -usr/lib/python3.12/sitecustomize.py # maybe unnecessary
|
|
# Old versions of this file used to unstage
|
|
# lib/python3.8/site-packages/augeas.py to avoid conflicts between
|
|
# python-augeas 0.5.0 which was pinned in snap-constraints.txt and
|
|
# our python-augeas fork which creates an auto-generated cffi file at
|
|
# the same path. Since we've combined things in one part and removed the
|
|
# python-augeas pinning, unstaging this file had a different, unintended
|
|
# effect so we now stage the file to keep the auto-generated cffi file.
|
|
stage-packages:
|
|
- libaugeas0
|
|
- libpython3.12-dev
|
|
# This library included so openssl has a legacy provider available at
|
|
# runtime when we are unable to use cryptography's pre-built wheels. See
|
|
# https://github.com/certbot/certbot/issues/10055.
|
|
- libssl3t64
|
|
# added to stage python:
|
|
- libpython3-stdlib
|
|
- libpython3.12-stdlib
|
|
- libpython3.12-minimal
|
|
- python3-pip
|
|
- python3-wheel
|
|
- python3-venv
|
|
- python3-minimal
|
|
- python3-pkg-resources
|
|
- python3.12-minimal
|
|
# To build cryptography and cffi if needed
|
|
build-packages:
|
|
- gcc
|
|
- git
|
|
- libaugeas-dev
|
|
- build-essential
|
|
- libssl-dev
|
|
- libffi-dev
|
|
- python3-dev
|
|
- cargo
|
|
- pkg-config
|
|
build-environment:
|
|
# We set this environment variable while building to try and increase the
|
|
# stability of fetching the rust crates needed to build the cryptography
|
|
# library.
|
|
- CARGO_NET_GIT_FETCH_WITH_CLI: "true"
|
|
- PARTS_PYTHON_VENV_ARGS: --upgrade
|
|
# Constraints are passed through the environment variable PIP_CONSTRAINTS instead of using the
|
|
# parts.[part_name].constraints option available in snapcraft.yaml when the Python plugin is
|
|
# used. This is done to let these constraints be applied not only on the certbot package
|
|
# build, but also on any isolated build that pip could trigger when building wheels for
|
|
# dependencies. See https://github.com/certbot/certbot/pull/8443 for more info.
|
|
- PIP_CONSTRAINT: $CRAFT_PART_SRC/snap-constraints.txt
|
|
# This is a workaround for
|
|
# https://github.com/pypa/setuptools/issues/5039 forcing pip to use
|
|
# modern build conventions even in the absence of pyproject.toml files.
|
|
- PIP_USE_PEP517: "true"
|
|
override-build: |
|
|
python3 -m venv "${CRAFT_PART_INSTALL}"
|
|
"${CRAFT_PART_INSTALL}/bin/python3" "${CRAFT_PART_SRC}/tools/pipstrap.py"
|
|
craftctl default
|
|
# Workaround for misconfigured pyvenv.cfg; see discussion on snapcraft forum for more info
|
|
# https://forum.snapcraft.io/t/upgrading-classic-snap-to-core24-using-snapcraft-8-3-causes-python-3-12-errors-at-runtime/
|
|
sed -i "${CRAFT_PART_INSTALL}/pyvenv.cfg" \
|
|
-e 's@^home = '"${CRAFT_PART_INSTALL}"'/usr/bin$@home = /snap/certbot/current/usr/bin@g'
|
|
override-pull: |
|
|
craftctl default
|
|
grep -v python-augeas "${CRAFT_PART_SRC}/tools/requirements.txt" >> "${CRAFT_PART_SRC}/snap-constraints.txt"
|
|
craftctl set version=$(grep -oP "__version__ = '\K.*(?=')" "${CRAFT_PART_SRC}/certbot/src/certbot/__init__.py")
|
|
build-attributes:
|
|
# https://snapcraft.io/docs/how-to-classic#fix-linter-warnings-by-patching-elf-binaries
|
|
- enable-patchelf
|
|
shared-metadata:
|
|
plugin: dump
|
|
source: .
|
|
override-pull: |
|
|
craftctl default
|
|
mkdir -p certbot-metadata
|
|
grep -oP "__version__ = '\K.*(?=')" $CRAFT_PART_SRC/certbot/src/certbot/__init__.py > certbot-metadata/certbot-version.txt
|
|
stage: [certbot-metadata/certbot-version.txt]
|
|
|
|
plugs:
|
|
plugin:
|
|
interface: content
|
|
content: certbot-1
|
|
target: $SNAP/certbot-plugin
|
|
|
|
slots:
|
|
certbot-metadata:
|
|
interface: content
|
|
content: metadata-1
|
|
read: [$SNAP/certbot-metadata]
|