./security/py-certbot, Client for the Lets Encrypt CA

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 0.31.0, Package name: py27-certbot-0.31.0, Maintainer: fhajny

Certbot, previously the Let's Encrypt Client, is EFF's tool to
obtain certs from Let's Encrypt, and (optionally) autoenable HTTPS
on your server. It can also act as a client for any other CA that
uses the ACME protocol.


Required to run:
[devel/py-setuptools] [devel/py-ZopeInterface] [time/py-pytz] [time/py-parsedatetime] [devel/py-mock] [lang/python27] [security/py-cryptography] [devel/py-ZopeComponent] [devel/py-configobj] [devel/py-configargparse] [time/py-rfc3339] [security/py-acme] [security/py-josepy]

Required to build:
[pkgtools/cwrappers]

Master sites:

SHA1: 6569ce15dd6c89f5756d3c9016c58ff0937d3a99
RMD160: c146744df32995135830bb4e8d3da0d94415cbfd
Filesize: 328.69 KB

Version history: (Expand)


CVS history: (Expand)


   2019-02-12 13:56:32 by Adam Ciarcinski | Files touched by this commit (17) | Package updated
Log message:
py-acme,py-certbot*: updated to 0.31.0

0.31.0:

Added
Avoid reprocessing challenges that are already validated when a certificate is \ 
issued.
Support for initiating (but not solving end-to-end) TLS-ALPN-01 challenges with \ 
the acme module.

Changed
Certbot's official Docker images are now based on Alpine Linux 3.9 rather than \ 
3.7. The new version comes with OpenSSL 1.1.1.
Lexicon-based DNS plugins are now fully compatible with Lexicon 3.x (support on \ 
2.x branch is maintained).
Apache plugin now attempts to configure all VirtualHosts matching requested \ 
domain name instead of only a single one when answering the HTTP-01 challenge.

Fixed
Fixed accessing josepy contents through acme.jose when the full acme.jose path \ 
is used.
Clarify behavior for deleting certs as part of revocation.
Despite us having broken lockstep, we are continuing to release new versions of \ 
all Certbot components during releases for the time being, however, the only \ 
package with changes other than its version number was:

acme
certbot
certbot-apache
certbot-dns-cloudxns
certbot-dns-dnsimple
certbot-dns-dnsmadeeasy
certbot-dns-gehirn
certbot-dns-linode
certbot-dns-luadns
certbot-dns-nsone
certbot-dns-ovh
certbot-dns-sakuracloud
More details about these changes can be found on our GitHub repo.
   2019-01-15 13:07:25 by =?UTF-8?B?RnLDqWTDqXJpYyBGYXViZXJ0ZWF1?= | Files touched by this commit (1)
Log message:
py-certbot: add ovh, sakura cloud and nginx plugins
   2019-01-15 10:32:11 by =?UTF-8?B?RnLDqWTDqXJpYyBGYXViZXJ0ZWF1?= | Files touched by this commit (3) | Package updated
Log message:
py-certbot: update to 0.30.0

Upstream changes:
================================================================================
## 0.30.0 - 2019-01-02

### Added

* Added the `update_account` subcommand for account management commands.

### Changed

* Copied account management functionality from the `register` subcommand
  to the `update_account` subcommand.
* Marked usage `register --update-registration` for deprecation and
  removal in a future release.

### Fixed

* Older modules in the josepy library can now be accessed through acme.jose
  like it could in previous versions of acme. This is only done to preserve
  backwards compatibility and support for doing this with new modules in josepy
  will not be added. Users of the acme library should switch to using josepy
  directly if they haven't done so already.

Despite us having broken lockstep, we are continuing to release new versions of
all Certbot components during releases for the time being, however, the only
package with changes other than its version number was:

* acme

More details about these changes can be found on our GitHub repo.

## 0.29.1 - 2018-12-05

### Added

*

### Changed

*

### Fixed

* The default work and log directories have been changed back to
  /var/lib/letsencrypt and /var/log/letsencrypt respectively.

Despite us having broken lockstep, we are continuing to release new versions of
all Certbot components during releases for the time being, however, the only
package with changes other than its version number was:

* certbot

More details about these changes can be found on our GitHub repo.

## 0.29.0 - 2018-12-05

### Added

* Noninteractive renewals with `certbot renew` (those not started from a
  terminal) now randomly sleep 1-480 seconds before beginning work in
  order to spread out load spikes on the server side.
* Added External Account Binding support in cli and acme library.
  Command line arguments --eab-kid and --eab-hmac-key added.

### Changed

* Private key permissioning changes: Renewal preserves existing group mode
  & gid of previous private key material. Private keys for new
  lineages (i.e. new certs, not renewed) default to 0o600.

### Fixed

* Update code and dependencies to clean up Resource and Deprecation Warnings.
* Only depend on imgconverter extension for Sphinx >= 1.6

Despite us having broken lockstep, we are continuing to release new versions of
all Certbot components during releases for the time being, however, the only
package with changes other than its version number was:

* acme
* certbot
* certbot-apache
* certbot-dns-cloudflare
* certbot-dns-digitalocean
* certbot-dns-google
* certbot-nginx

More details about these changes can be found on our GitHub repo:
https://github.com/certbot/certbot/mile … 2?closed=1

## 0.28.0 - 2018-11-7

### Added

* `revoke` accepts `--cert-name`, and doesn't accept both `--cert-name` and \ 
`--cert-path`.
* Use the ACMEv2 newNonce endpoint when a new nonce is needed, and newNonce is \ 
available in the directory.

### Changed

* Removed documentation mentions of `#letsencrypt` IRC on Freenode.
* Write README to the base of (config-dir)/live directory
* `--manual` will explicitly warn users that earlier challenges should remain in \ 
place when setting up subsequent challenges.
* Warn when using deprecated acme.challenges.TLSSNI01
* Log warning about TLS-SNI deprecation in Certbot
* Stop preferring TLS-SNI in the Apache, Nginx, and standalone plugins
* OVH DNS plugin now relies on Lexicon>=2.7.14 to support HTTP proxies
* Default time the Linode plugin waits for DNS changes to propogate is now 1200 \ 
seconds.

### Fixed

* Match Nginx parser update in allowing variable names to start with `${`.
* Fix ranking of vhosts in Nginx so that all port-matching vhosts come first
* Correct OVH integration tests on machines without internet access.
* Stop caching the results of ipv6_info in http01.py
* Test fix for Route53 plugin to prevent boto3 making outgoing connections.
* The grammar used by Augeas parser in Apache plugin was updated to fix various \ 
parsing errors.
* The CloudXNS, DNSimple, DNS Made Easy, Gehirn, Linode, LuaDNS, NS1, OVH, and
  Sakura Cloud DNS plugins are now compatible with Lexicon 3.0+.

Despite us having broken lockstep, we are continuing to release new versions of
all Certbot components during releases for the time being, however, the only
package with changes other than its version number was:

* acme
* certbot
* certbot-apache
* certbot-dns-cloudxns
* certbot-dns-dnsimple
* certbot-dns-dnsmadeeasy
* certbot-dns-gehirn
* certbot-dns-linode
* certbot-dns-luadns
* certbot-dns-nsone
* certbot-dns-ovh
* certbot-dns-route53
* certbot-dns-sakuracloud
* certbot-nginx

More details about these changes can be found on our GitHub repo:
https://github.com/certbot/certbot/mile … 9?closed=1

## 0.27.1 - 2018-09-06

### Fixed

* Fixed parameter name in OpenSUSE overrides for default parameters in the
  Apache plugin. Certbot on OpenSUSE works again.

Despite us having broken lockstep, we are continuing to release new versions of
all Certbot components during releases for the time being, however, the only
package with changes other than its version number was:

* certbot-apache

More details about these changes can be found on our GitHub repo:
https://github.com/certbot/certbot/mile … 0?closed=1
   2018-12-15 22:12:25 by Thomas Klausner | Files touched by this commit (67) | Package updated
Log message:
*: update email for fhajny
   2018-09-06 14:25:26 by Filip Hajny | Files touched by this commit (3) | Package updated
Log message:
py-{acme,certbot}: Update to 0.27.0.

## 0.27.0 - 2018-09-05

### Added

- The Apache plugin now accepts the parameter --apache-ctl which can
  be used to configure the path to the Apache control script.

### Changed

- When using `acme.client.ClientV2` (or
 `acme.client.BackwardsCompatibleClientV2` with an ACME server that
 supports a newer version of the ACME protocol), an
 `acme.errors.ConflictError` will be raised if you try to create
 an ACME account with a key that has already been used. Previously,
 a JSON parsing error was raised in this scenario when using the
 library with Let's Encrypt's ACMEv2 endpoint.

### Fixed

- When Apache is not installed, Certbot's Apache plugin no longer
  prints messages about being unable to find apachectl to the
  terminal when the plugin is not selected.
- If you're using the Apache plugin with the --apache-vhost-root flag
  set to a directory containing a disabled virtual host for the
  domain you're requesting a certificate for, the virtual host will
  now be temporarily enabled if necessary to pass the HTTP challenge.
- The documentation for the Certbot package can now be built using
  Sphinx 1.6+.
- You can now call `query_registration` without having to first call
  `new_account` on `acme.client.ClientV2` objects.
- The requirement of `setuptools>=1.0` has been removed from
  `certbot-dns-ovh`.
- Names in certbot-dns-sakuracloud's tests have been updated to refer
  to Sakura Cloud rather than NS1 whose plugin certbot-dns-sakuracloud
  was based on.

## 0.26.1 - 2018-07-17

### Fixed

- Fix a bug that was triggered when users who had previously manually
  set `--server` to get ACMEv2 certs tried to renew ACMEv1 certs.
   2018-07-24 11:24:11 by =?UTF-8?B?RnLDqWTDqXJpYyBGYXViZXJ0ZWF1?= | Files touched by this commit (1)
Log message:
Add used by comment for py-certbot-dns-rfc2136.
   2018-07-17 18:32:16 by Filip Hajny | Files touched by this commit (4) | Package updated
Log message:
net/py-{acme,certbot}: Update to 0.26.0.

### Added

- A new security enhancement which we're calling AutoHSTS has been
  added to Certbot's Apache plugin. This enhancement configures your
  webserver to send a HTTP Strict Transport Security header with a low
  max-age value that is slowly increased over time. The max-age value is
  not increased to a large value until you've successfully managed to
  renew your certificate. This enhancement can be requested with the
  --auto-hsts flag.
- New official DNS plugins have been created for Gehirn Infrastracture
  Service, Linode, OVH, and Sakura Cloud. These plugins can be found
  on our Docker Hub page at https://hub.docker.com/u/certbot and on
  PyPI.
- The ability to reuse ACME accounts from Let's Encrypt's ACMEv1
  endpoint on Let's Encrypt's ACMEv2 endpoint has been added.
- Certbot and its components now support Python 3.7.
- Certbot's install subcommand now allows you to interactively choose
  which certificate to install from the list of certificates managed
  by Certbot.
- Certbot now accepts the flag `--no-autorenew` which causes any
  obtained certificates to not be automatically renewed when it
  approaches expiration.
- Support for parsing the TLS-ALPN-01 challenge has been added back to
  the acme library.

### Changed

- Certbot's default ACME server has been changed to Let's Encrypt's
  ACMEv2 endpoint. By default, this server will now be used for both
  new certificate lineages and renewals.
- The Nginx plugin is no longer marked labeled as an "Alpha" version.
- The `prepare` method of Certbot's plugins is no longer called before
  running "Updater" enhancements that are run on every invocation of
  `certbot renew`.
   2018-06-12 11:22:35 by Filip Hajny | Files touched by this commit (4) | Package updated
Log message:
security/py-{acme,certbot}: Update to 0.25.0.

### Added

- Support for the ready status type was added to acme. Without this change,
  Certbot and acme users will begin encountering errors when using Let's
  Encrypt's ACMEv2 API starting on June 19th for the staging environment and
  July 5th for production. See
  https://community.letsencrypt.org/t/acm … atus/62866 for more
  information.
- Certbot now accepts the flag --reuse-key which will cause the same key to be
  used in the certificate when the lineage is renewed rather than generating a
  new key.
- You can now add multiple email addresses to your ACME account with Certbot by
  providing a comma separated list of emails to the --email flag.
- Support for Let's Encrypt's upcoming TLS-ALPN-01 challenge was added to acme.
  For more information, see
  https://community.letsencrypt.org/t/tls … d/63814/1.
- acme now supports specifying the source address to bind to when sending
  outgoing connections. You still cannot specify this address using Certbot.
- If you run Certbot against Let's Encrypt's ACMEv2 staging server but don't
  already have an account registered at that server URL, Certbot will
  automatically reuse your staging account from Let's Encrypt's ACMEv1 endpoint
  if it exists.
- Interfaces were added to Certbot allowing plugins to be called at additional
  points. The `GenericUpdater` interface allows plugins to perform actions
  every time `certbot renew` is run, regardless of whether any certificates are
  due for renewal, and the `RenewDeployer` interface allows plugins to perform
  actions when a certificate is renewed. See `certbot.interfaces` for more
  information.

### Changed

- When running Certbot with --dry-run and you don't already have a staging
  account, the created account does not contain an email address even if one
  was provided to avoid expiration emails from Let's Encrypt's staging server.
- certbot-nginx does a better job of automatically detecting the location of
  Nginx's configuration files when run on BSD based systems.
- acme now requires and uses pytest when running tests with setuptools with
  `python setup.py test`.
- `certbot config_changes` no longer waits for user input before exiting.

### Fixed

- Misleading log output that caused users to think that Certbot's standalone
  plugin failed to bind to a port when performing a challenge has been
  corrected.
- An issue where certbot-nginx would fail to enable HSTS if the server block
  already had an `add_header` directive has been resolved.
- certbot-nginx now does a better job detecting the server block to base the
  configuration for TLS-SNI challenges on.