Log message:
py-acme py-certbot*: updated to 1.29.0

Certbot 1.29.0

Added

Updated Windows installer to be signed and trusted in Windows

Changed

--allow-subset-of-names will now additionally retry in cases where domains are \ 
rejected while creating or finalizing orders. This requires subproblem support \ 
from the ACME server.

Fixed

The show_account subcommand now uses the "newAccount" ACME endpoint to \ 
fetch the account
data, so it doesn't rely on the locally stored account URL. This fixes \ 
situations where Certbot
would use old ACMEv1 registration info with non-functional account URLs.

The generated Certificate Signing Requests are now generated as version 1 \ 
instead of version 3. This resolves situations in where strict enforcement of \ 
PKCS#10 meant that CSRs that were generated as version 3 were rejected.

Log message:
py-acme py-certbot*: updated to 1.28.0

1.28.0

Added

Updated Apache/NGINX TLS configs to document contents are based on \ 
ssl-config.mozilla.org

Changed

A change to order finalization has been made to the acme module and Certbot:
An order's certificate field will only be processed if the order's status is valid.
An order's error field will only be processed if the order's status is invalid.

Log message:
py-acme py-certbot: updated to 1.27.0

Certbot 1.27.0

Added

Added support for RFC8555 subproblems to our acme library.

Changed

The PGP key F2871B4152AE13C49519111F447BF683AA3B26C3 was added as an
additional trusted key to sign our PyPI packages
When certonly is run with an installer specified (e.g. --nginx),
certonly will now also run restart for that installer

Log message:
py-acme py-certbot*: updated to 1.26.0

Certbot 1.26.0

Added

Added --new-key. When renewing or replacing a certificate that has --reuse-key
set, it will force a new private key to be generated, one time.

As before, --reuse-key and --no-reuse-key can be used to enable and disable key
reuse.

Changed

The default propagation timeout for the OVH DNS plugin \ 
(--dns-ovh-propagation-seconds)
has been increased from 30 seconds to 120 seconds, based on user feedback.

Fixed

Certbot for Windows has been upgraded to use Python 3.9.11, in response to
https://www.openssl.org/news/secadv/20220315.txt.
Previously, when Certbot was in the process of registering a new ACME account
and the ACME server did not present any Terms of Service, the user was asked to
agree with a non-existent Terms of Service ("None"). This bug is now \ 
fixed, so
that if an ACME server does not provide any Terms of Service to agree with, the
user is not asked to agree to a non-existent Terms of Service any longer.
If account registration fails, Certbot did not relay the error from the ACME server
back to the user. This is now fixed: the error message from the ACME server is now
presented to the user when account registration fails.

Log message:
py-acme py-certbot: updated to 1.25.0

Certbot 1.25.0

Changed

Dropped 32 bit support for the Windows beta installer
Windows beta installer is now distributed as \ 
"certbot-beta-installer-win_amd64.exe".
Users of the Windows beta should uninstall the old version before running this.
Added a check whether OCSP stapling is supported by the installer when requesting a
certificate with the run subcommand in combination with the --must-staple option.
If the installer does not support OCSP and the --must-staple option is used, Certbot
will raise an error and quit.
Certbot and its acme module now depend on josepy>=1.13.0 due to better type \ 
annotation
support.

Fixed

Updated dependencies to use new version of cryptography that uses OpenSSL 1.1.1n, in
response to https://www.openssl.org/news/secadv/20220315.txt.

Certbot 1.24.0

Added

When the --debug-challenges option is used in combination with -v, Certbot
now displays the challenge URLs (for http-01 challenges) or FQDNs (for
dns-01 challenges) and their expected return values.

Changed

Support for Python 3.6 was removed.
All Certbot components now require setuptools>=41.6.0.
The acme library now requires requests>=2.20.0.
Certbot and its acme library now require pytz>=2019.3.
certbot-nginx now requires pyparsing>=2.2.1.
certbot-dns-route53 now requires boto3>=1.15.15.

Fixed

Nginx plugin now checks included files for the singleton \ 
server_names_hash_bucket_size directive.

Log message:
py-acme py-certbot*: updated to 1.23.0

Certbot 1.23.0

Added

Added show_account subcommand, which will fetch the account information
from the ACME server and show the account details (account URL and, if
applicable, email address or addresses)
We deprecated support for Python 3.6 in Certbot and its ACME library.
Support for Python 3.6 will be removed in the next major release of Certbot.

Fixed

GCP Permission list for certbot-dns-google in plugin documentation
dns-digitalocean used the SOA TTL for newly created records, rather than 30 seconds.
Revoking a certificate based on an ECDSA key can now be done with --key-path.

Log message:
*: bump PKGREVISION for egg.mk users

They now have a tool dependency on py-setuptools instead of a DEPENDS

Log message:
py-acme py-certbot*: updated to 1.22.0

Certbot 1.22.0

Added

Support for Python 3.10 was added to Certbot and all of its components.
The function certbot.util.parse_loose_version was added to parse version
strings in the same way as the now deprecated distutils.version.LooseVersion
class from the Python standard library.
Added --issuance-timeout. This option specifies how long (in seconds) Certbot \ 
will wait
for the server to issue a certificate.

Changed

The function certbot.util.get_strict_version was deprecated and will be
removed in a future release.

Fixed

Fixed an issue on Windows where the web.config created by Certbot would sometimes
conflict with preexisting configurations.
Fixed an issue on Windows where the webroot plugin would crash when multiple domains
had the same webroot. This affected Certbot 1.21.0.

Log message:
py-acme py-certbot*: updated to 1.21.0

Certbot 1.21.0

Added

Certbot will generate a web.config file on Windows in the challenge path
when the webroot plugin is used, if one does not exist. This web.config file
lets IIS serve challenge files while they do not have an extension.

Changed

We changed the PGP key used to sign the packages we upload to PyPI. Going
forward, releases will be signed with one of three different keys. All of
these keys are available on major key servers and signed by our previous PGP
key. The fingerprints of these new keys are:
BF6BCFC89E90747B9A680FD7B6029E8500F7DB16
86379B4F0AF371B50CD9E5FF3402831161D1D280
20F201346BF8F3F455A73F9A780CC99432A28621

Fixed

More details about these changes can be found on our GitHub repo.

Log message:
security: Replace RMD160 checksums with BLAKE2s checksums

All checksums have been double-checked against existing RMD160 and
SHA512 hashes

Unfetchable distfiles (fetched conditionally?):
./security/cyrus-sasl/distinfo \ 
cyrus-sasl-dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d.patch.v2