match test conf port with command line flag

.azure-pipelines/INSTALL.md

@@ -1,119 +0,0 @@
-# Configuring Azure Pipelines with Certbot
-
-Let's begin. All pipelines are defined in `.azure-pipelines`. Currently there are two:
-* `.azure-pipelines/main.yml` is the main one, executed on PRs for master, and pushes to master,
-* `.azure-pipelines/advanced.yml` add installer testing on top of the main pipeline, and is executed for `test-*` branches, release branches, and nightly run for master.
-
-Several templates are defined in `.azure-pipelines/templates`. These YAML files aggregate common jobs configuration that can be reused in several pipelines.
-
-Unlike Travis, where CodeCov is working without any action required, CodeCov supports Azure Pipelines
-using the coverage-bash utility (not python-coverage for now) only if you provide the Codecov repo token
-using the `CODECOV_TOKEN` environment variable. So `CODECOV_TOKEN` needs to be set as a secured
-environment variable to allow the main pipeline to publish coverage reports to CodeCov.
-
-This INSTALL.md file explains how to configure Azure Pipelines with Certbot in order to execute the CI/CD logic defined in `.azure-pipelines` folder with it.
-During this installation step, warnings describing user access and legal comitments will be displayed like this:
-```
-!!! ACCESS REQUIRED !!!
-```
-
-This document suppose that the Azure DevOps organization is named _certbot_, and the Azure DevOps project is also _certbot_.
-
-## Useful links
-
-* https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema?view=azure-devops&tabs=schema
-* https://www.azuredevopslabs.com/labs/azuredevops/github-integration/
-* https://docs.microsoft.com/en-us/azure/devops/pipelines/ecosystems/python?view=azure-devops
-
-## Prerequisites
-
-### Having a GitHub account
-
-Use your GitHub user for a normal GitHub account, or a user that has administrative rights to the GitHub organization if relevant.
-
-### Having an Azure DevOps account
-- Go to https://dev.azure.com/, click "Start free with GitHub"
-- Login to GitHub
-
-```
-!!! ACCESS REQUIRED !!!
-Personal user data (email + profile info, in read-only)
-```
-
-- Microsoft will create a Live account using the email referenced for the GitHub account. This account is also linked to GitHub account (meaning you can log it using GitHub authentication)
-- Proceed with account registration (birth date, country), add details about name and email contact
-
-```
-!!! ACCESS REQUIRED !!!
-Microsoft proposes to send commercial links to this mail
-Azure DevOps terms of service need to be accepted
-```
-
-_Logged to Azure DevOps, account is ready._
-
-### Installing Azure Pipelines to GitHub
-
-- On GitHub, go to Marketplace
-- Select Azure Pipeline, and "Set up a plan"
-- Select Free, then "Install it for free"
-- Click "Complete order and begin installation"
-
-```
-!!! ACCESS !!!
-Azure Pipeline needs RW on code, RO on metadata, RW on checks, commit statuses, deployments, issues, pull requests.
-RW access here is required to allow update of the pipelines YAML files from Azure DevOps interface, and to
-update the status of builds and PRs on GitHub side when Azure Pipelines are triggered.
-Note however that no admin access is defined here: this means that Azure Pipelines cannot do anything with
-protected branches, like master, and cannot modify the security context around this on GitHub.
-Access can be defined for all or only selected repositories, which is nice.
-```
-
-- Redirected to Azure DevOps, select the account created in _Having an Azure DevOps account_ section.
-- Select the organization, and click "Create a new project" (let's name it the same than the targetted github repo)
-- The Visibility is public, to profit from 10 parallel jobs
-
-```
-!!! ACCESS !!!
-Azure Pipelines needs access to the GitHub account (in term of beeing able to check it is valid), and the Resources shared between the GitHub account and Azure Pipelines.
-```
-
-_Done. We can move to pipelines configuration._
-
-## Import an existing pipelines from `.azure-pipelines` folder
-
-- On Azure DevOps, go to your organization (eg. _certbot_) then your project (eg. _certbot_)
-- Click "Pipelines" tab
-- Click "New pipeline"
-- Where is your code?: select "__Use the classic editor__"
-
-__Warning: Do not choose the GitHub option in Where is your code? section. Indeed, this option will trigger an OAuth
-grant permissions from Azure Pipelines to GitHub in order to setup a GitHub OAuth Application. The permissions asked
-then are way too large (admin level on almost everything), while the classic approach does not add any more
-permissions, and works perfectly well.__
-
-- Select GitHub in "Select your repository section", choose certbot/certbot in Repository, master in default branch.
-- Click on YAML option for "Select a template"
-- Choose a name for the pipeline (eg. test-pipeline), and browse to the actual pipeline YAML definition in the
-  "YAML file path" input (eg. `.azure-pipelines/test-pipeline.yml`)
-- Click "Save & queue", choose the master branch to build the first pipeline, and click "Save and run" button.
-
-_Done. Pipeline is operational. Repeat to add more pipelines from existing YAML files in `.azure-pipelines`._
-
-## Add a secret variable to a pipeline (like `CODECOV_TOKEN`)
-
-__NB: Following steps suppose that you already setup the YAML pipeline file to
-consume the secret variable that these steps will create as an environment variable.
-For a variable named `CODECOV_TOKEN` consuming the variable `codecov_token`,
-in the YAML file this setup would take the form of the following:
-```
-steps:
-    - script: ./do_something_that_consumes_CODECOV_TOKEN  # Eg. `codecov -F windows`
-      env:
-        CODECOV_TOKEN: $(codecov_token)
-```
-
-To set up a variable that is shared between pipelines, follow the instructions
-at
-https://docs.microsoft.com/en-us/azure/devops/pipelines/library/variable-groups.
-When adding variables to a group, don't forget to tick "Keep this value secret"
-if it shouldn't be shared publcily.

.azure-pipelines/advanced.yml

@@ -1,20 +0,0 @@
-# Advanced pipeline for isolated checks and release purpose
-trigger:
-  - test-*
-  - '*.x'
-pr:
-  - test-*
-# This pipeline is also nightly run on master
-schedules:
-  - cron: "0 4 * * *"
-    displayName: Nightly build
-    branches:
-      include:
-      - master
-    always: true
-
-jobs:
-  # Any addition here should be reflected in the release pipeline.
-  # It is advised to declare all jobs here as templates to improve maintainability.
-  - template: templates/tests-suite.yml
-  - template: templates/installer-tests.yml

.azure-pipelines/main.yml

@@ -1,12 +0,0 @@
-trigger:
-  # apache-parser-v2 is a temporary branch for doing work related to
-  # rewriting the parser in the Apache plugin.
-  - apache-parser-v2
-  - master
-pr:
-  - apache-parser-v2
-  - master
-  - '*.x'
-
-jobs:
-  - template: templates/tests-suite.yml

.azure-pipelines/release.yml

@@ -1,13 +0,0 @@
-# Release pipeline to build and deploy Certbot for Windows for GitHub release tags
-trigger:
-  tags:
-    include:
-      - v*
-pr: none
-
-jobs:
-  # Any addition here should be reflected in the advanced pipeline.
-  # It is advised to declare all jobs here as templates to improve maintainability.
-  - template: templates/tests-suite.yml
-  - template: templates/installer-tests.yml
-  - template: templates/changelog.yml

.azure-pipelines/templates/changelog.yml

@@ -1,14 +0,0 @@
-jobs:
-  - job: changelog
-    pool:
-      vmImage: vs2017-win2016
-    steps:
-      - bash: |
-          CERTBOT_VERSION="$(cd certbot && python -c "import certbot; print(certbot.__version__)" && cd ~-)"
-          "${BUILD_REPOSITORY_LOCALPATH}\tools\extract_changelog.py" "${CERTBOT_VERSION}" >> "${BUILD_ARTIFACTSTAGINGDIRECTORY}/release_notes.md"
-        displayName: Prepare changelog
-      - task: PublishPipelineArtifact@1
-        inputs:
-          path: $(Build.ArtifactStagingDirectory)
-          artifact: changelog
-        displayName: Publish changelog

.azure-pipelines/templates/installer-tests.yml

@@ -1,54 +0,0 @@
-jobs:
-  - job: installer_build
-    pool:
-      vmImage: vs2017-win2016
-    steps:
-      - task: UsePythonVersion@0
-        inputs:
-          versionSpec: 3.7
-          architecture: x86
-          addToPath: true
-      - script: python windows-installer/construct.py
-        displayName: Build Certbot installer
-      - task: CopyFiles@2
-        inputs:
-          sourceFolder: $(System.DefaultWorkingDirectory)/windows-installer/build/nsis
-          contents: '*.exe'
-          targetFolder: $(Build.ArtifactStagingDirectory)
-      - task: PublishPipelineArtifact@1
-        inputs:
-          path: $(Build.ArtifactStagingDirectory)
-          artifact: windows-installer
-        displayName: Publish Windows installer
-  - job: installer_run
-    dependsOn: installer_build
-    strategy:
-      matrix:
-        win2019:
-          imageName: windows-2019
-        win2016:
-          imageName: vs2017-win2016
-        win2012r2:
-          imageName: vs2015-win2012r2
-    pool:
-      vmImage: $(imageName)
-    steps:
-      - task: DownloadPipelineArtifact@2
-        inputs:
-          artifact: windows-installer
-          path: $(Build.SourcesDirectory)/bin
-        displayName: Retrieve Windows installer
-      - script: $(Build.SourcesDirectory)\bin\certbot-beta-installer-win32.exe /S
-        displayName: Install Certbot
-      - powershell: Invoke-WebRequest https://www.python.org/ftp/python/3.8.0/python-3.8.0-amd64-webinstall.exe -OutFile C:\py3-setup.exe
-        displayName: Get Python
-      - script: C:\py3-setup.exe /quiet PrependPath=1 InstallAllUsers=1 Include_launcher=1 InstallLauncherAllUsers=1 Include_test=0 Include_doc=0 Include_dev=1 Include_debug=0 Include_tcltk=0 TargetDir=C:\py3
-        displayName: Install Python
-      - script: |
-          py -3 -m venv venv
-          venv\Scripts\python tools\pip_install.py -e certbot-ci
-        displayName: Prepare Certbot-CI
-      - script: |
-          set PATH=%ProgramFiles(x86)%\Certbot\bin;%PATH%
-          venv\Scripts\python -m pytest certbot-ci\certbot_integration_tests\certbot_tests -n 4
-        displayName: Run integration tests

.azure-pipelines/templates/tests-suite.yml

@@ -1,38 +0,0 @@
-jobs:
-  - job: test
-    pool:
-      vmImage: vs2017-win2016
-    strategy:
-      matrix:
-        py35:
-          PYTHON_VERSION: 3.5
-          TOXENV: py35
-        py37-cover:
-          PYTHON_VERSION: 3.7
-          TOXENV: py37-cover
-        integration-certbot:
-          PYTHON_VERSION: 3.7
-          TOXENV: integration-certbot
-          PYTEST_ADDOPTS: --numprocesses 4
-    variables:
-    - group: certbot-common
-    steps:
-    - task: UsePythonVersion@0
-      inputs:
-        versionSpec: $(PYTHON_VERSION)
-        addToPath: true
-    - script: python tools/pip_install.py -U tox coverage
-      displayName: Install dependencies
-    - script: python -m tox
-      displayName: Run tox
-    # We do not require codecov report upload to succeed. So to avoid to break the pipeline if
-    # something goes wrong, each command is suffixed with a command that hides any non zero exit
-    # codes and echoes an informative message instead.
-    - bash: |
-        curl -s https://codecov.io/bash -o codecov-bash || echo "Failed to download codecov-bash"
-        chmod +x codecov-bash || echo "Failed to apply execute permissions on codecov-bash"
-        ./codecov-bash -F windows  || echo "Codecov did not collect coverage reports"
-      condition: in(variables['TOXENV'], 'py37-cover', 'integration-certbot')
-      env:
-        CODECOV_TOKEN: $(codecov_token)
-      displayName: Publish coverage

.codecov.yml

@@ -1,18 +0,0 @@
-coverage:
-  status:
-    project:
-      default: off
-      linux:
-        flags: linux
-        # Fixed target instead of auto set by #7173, can
-        # be removed when flags in Codecov are added back.
-        target: 97.4
-        threshold: 0.1
-        base: auto
-      windows:
-        flags: windows
-        # Fixed target instead of auto set by #7173, can
-        # be removed when flags in Codecov are added back.
-        target: 97.4
-        threshold: 0.1
-        base: auto

.coveragerc

@@ -1,5 +1,2 @@
-[run]
-omit = */setup.py
-
 [report]
 omit = */setup.py

.github/stale.yml

@@ -1,35 +0,0 @@
-# Configuration for https://github.com/marketplace/stale
-
-# Number of days of inactivity before an Issue or Pull Request becomes stale
-daysUntilStale: 365
-
-# Number of days of inactivity before an Issue or Pull Request with the stale label is closed.
-# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.
-# When changing this value, be sure to also update markComment below.
-daysUntilClose: 30
-
-# Ignore issues with an assignee (defaults to false)
-exemptAssignees: true
-
-# Label to use when marking as stale
-staleLabel: needs-update
-
-# Comment to post when marking as stale. Set to `false` to disable
-markComment: >
-  We've made a lot of changes to Certbot since this issue was opened. If you
-  still have this issue with an up-to-date version of Certbot, can you please
-  add a comment letting us know? This helps us to better see what issues are
-  still affecting our users. If there is no activity in the next 30 days, this
-  issue will be automatically closed.
-
-# Comment to post when closing a stale Issue or Pull Request.
-closeComment: >
-  This issue has been closed due to lack of activity, but if you think it
-  should be reopened, please open a new issue with a link to this one and we'll
-  take a look.
-
-# Limit the number of actions per hour, from 1-30. Default is 30
-limitPerRun: 1
-
-# Don't mark pull requests as stale.
-only: issues

.gitignore

@@ -6,8 +6,7 @@ dist*/
 /venv*/
 /kgs/
 /.tox/
-/releases*/
-/log*
+/releases/
 letsencrypt.log
 certbot.log
 letsencrypt-auto-source/letsencrypt-auto.sig.lzma.base64
@@ -39,13 +38,3 @@ tests/letstest/venv/
 
 # pytest cache
 .cache
-.mypy_cache/
-.pytest_cache/
-
-# docker files
-.docker
-
-# certbot tests
-.certbot_test_workspace
-**/assets/pebble*
-**/assets/challtestsrv*

.isort.cfg

@@ -1,7 +0,0 @@
-[settings]
-skip_glob=venv*
-skip=letsencrypt-auto-source
-force_sort_within_sections=True
-force_single_line=True
-order_by_type=False
-line_length=400

.pylintrc

@@ -24,11 +24,6 @@ persistent=yes
 # usually to register additional checkers.
 load-plugins=linter_plugin
 
-# A comma-separated list of package or module names from where C extensions may
-# be loaded. Extensions are loading into the active Python interpreter and may
-# run arbitrary code.
-extension-pkg-whitelist=pywintypes,win32api,win32file,win32security
-
 
 [MESSAGES CONTROL]
 
@@ -46,14 +41,10 @@ extension-pkg-whitelist=pywintypes,win32api,win32file,win32security
 # --enable=similarities". If you want to run only the classes checker, but have
 # no Warning level messages displayed, use"--disable=all --enable=classes
 # --disable=W"
-# CERTBOT COMMENT
-# 1) Once certbot codebase is claimed to be compatible exclusively with Python 3,
-#    the useless-object-inheritance check can be enabled again, and code fixed accordingly.
-# 2) Check unsubscriptable-object tends to create a lot of false positives. Let's disable it.
-#    See https://github.com/PyCQA/pylint/issues/1498.
-# 3) Same as point 2 for no-value-for-parameter.
-#    See https://github.com/PyCQA/pylint/issues/2820.
-disable=fixme,locally-disabled,locally-enabled,bad-continuation,no-self-use,invalid-name,cyclic-import,duplicate-code,design,import-outside-toplevel,useless-object-inheritance,unsubscriptable-object,no-value-for-parameter,no-else-return,no-else-raise,no-else-break,no-else-continue
+disable=fixme,locally-disabled,abstract-class-not-used,abstract-class-little-used,bad-continuation,too-few-public-methods,no-self-use,invalid-name,too-many-instance-attributes,cyclic-import,duplicate-code
+# abstract-class-not-used cannot be disabled locally (at least in
+# pylint 1.4.1), same for abstract-class-little-used
+
 
 [REPORTS]
 
@@ -260,7 +251,7 @@ ignored-modules=pkg_resources,confargparse,argparse,six.moves,six.moves.urllib
 
 # List of classes names for which member attributes should not be checked
 # (useful for classes with attributes dynamically set).
-ignored-classes=Field,Header,JWS,closing
+ignored-classes=SQLObject
 
 # When zope mode is activated, add a predefined set of Zope acquired attributes
 # to generated-members.
@@ -306,6 +297,40 @@ valid-classmethod-first-arg=cls
 valid-metaclass-classmethod-first-arg=mcs
 
 
+[DESIGN]
+
+# Maximum number of arguments for function / method
+max-args=6
+
+# Argument names that match this expression will be ignored. Default to name
+# with leading underscore
+ignored-argument-names=_.*
+
+# Maximum number of locals for function / method body
+max-locals=15
+
+# Maximum number of return / yield for function / method body
+max-returns=6
+
+# Maximum number of branch for function / method body
+max-branches=12
+
+# Maximum number of statements in function / method body
+max-statements=50
+
+# Maximum number of parents for a class (see R0901).
+max-parents=12
+
+# Maximum number of attributes for a class (see R0902).
+max-attributes=7
+
+# Minimum number of public methods for a class (see R0903).
+min-public-methods=2
+
+# Maximum number of public methods for a class (see R0904).
+max-public-methods=20
+
+
 [EXCEPTIONS]
 
 # Exceptions that will emit a warning when being caught. Defaults to

.travis.yml

@@ -1,17 +1,22 @@
 language: python
-dist: xenial
 
 cache:
     directories:
         - $HOME/.cache/pip
 
+before_install:
+  - '([ $TRAVIS_OS_NAME == linux ] && dpkg -s libaugeas0) || (brew update && brew install augeas python3 && brew upgrade python && brew link python)'
+
 before_script:
-  - 'if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then ulimit -n 1024 ; fi'
-  # On Travis, the fastest parallelization for integration tests has proved to be 4.
-  - 'if [[ "$TOXENV" == *"integration"* ]]; then export PYTEST_ADDOPTS="--numprocesses 4"; fi'
-  # Use Travis retry feature for farm tests since they are flaky
-  - 'if [[ "$TOXENV" == "travis-test-farm"* ]]; then export TRAVIS_RETRY=travis_retry; fi'
-  - export TOX_TESTENV_PASSENV=TRAVIS
+  - 'if [ $TRAVIS_OS_NAME = osx ] ; then ulimit -n 1024 ; fi'
+
+matrix:
+  include:
+    - python: "2.7"
+      env: TOXENV=py27_install BOULDER_INTEGRATION=1
+      sudo: required
+      services: docker
+
 
 # Only build pushes to the master branch, PRs, and branches beginning with
 # `test-` or of the form `digit(s).digit(s).x`. This reduces the number of
@@ -19,259 +24,20 @@ before_script:
 # is a cap of on the number of simultaneous runs.
 branches:
   only:
-    # apache-parser-v2 is a temporary branch for doing work related to
-    # rewriting the parser in the Apache plugin.
-    - apache-parser-v2
     - master
     - /^\d+\.\d+\.x$/
     - /^test-.*$/
 
-# Jobs for the main test suite are always executed (including on PRs) except for pushes on master.
-not-on-master: &not-on-master
-  if: NOT (type = push AND branch = master)
-
-# Jobs for the extended test suite are executed for cron jobs and pushes to
-# non-development branches. See the explanation for apache-parser-v2 above.
-extended-test-suite: &extended-test-suite
-  if: type = cron OR (type = push AND branch NOT IN (apache-parser-v2, master))
-
-matrix:
-  include:
-    # Main test suite
-    - python: "2.7"
-      env: ACME_SERVER=pebble TOXENV=integration
-      <<: *not-on-master
-
-    # This job is always executed, including on master
-    - python: "2.7"
-      env: TOXENV=py27-cover FYI="py27 tests + code coverage"
-
-    - python: "3.7"
-      env: TOXENV=lint
-      <<: *not-on-master
-    - python: "3.5"
-      env: TOXENV=mypy
-      <<: *not-on-master
-    - python: "2.7"
-      # Ubuntu Trusty or older must be used because the oldest version of
-      # cryptography we support cannot be compiled against the version of
-      # OpenSSL in Xenial or newer.
-      dist: trusty
-      env: TOXENV='py27-{acme,apache,apache-v2,certbot,dns,nginx}-oldest'
-      <<: *not-on-master
-    - python: "3.4"
-      env: TOXENV=py34
-      <<: *not-on-master
-    - python: "3.7"
-      env: TOXENV=py37
-      <<: *not-on-master
-    - python: "3.8"
-      env: TOXENV=py38
-      <<: *not-on-master
-    - sudo: required
-      env: TOXENV=apache_compat
-      services: docker
-      before_install:
-      addons:
-      <<: *not-on-master
-    - sudo: required
-      env: TOXENV=le_auto_xenial
-      services: docker
-      <<: *not-on-master
-    - python: "2.7"
-      env: TOXENV=apacheconftest-with-pebble
-      <<: *not-on-master
-    - python: "2.7"
-      env: TOXENV=nginxroundtrip
-      <<: *not-on-master
-
-    # Extended test suite on cron jobs and pushes to tested branches other than master
-    - sudo: required
-      env: TOXENV=nginx_compat
-      services: docker
-      before_install:
-      addons:
-      <<: *extended-test-suite
-    - python: "2.7"
-      env:
-        - TOXENV=travis-test-farm-apache2
-        - secure: "f+j/Lj9s1lcuKo5sEFrlRd1kIAMnIJI4z0MTI7QF8jl9Fkmbx7KECGzw31TNgzrOSzxSapHbcueFYvNCLKST+kE/8ogMZBbwqXfEDuKpyF6BY3uYoJn+wPVE5pIb8Hhe08xPte8TTDSMIyHI3EyTfcAKrIreauoArePvh/cRvSw="
-      <<: *extended-test-suite
-    - python: "2.7"
-      env:
-        - TOXENV=travis-test-farm-leauto-upgrades
-        - secure: "f+j/Lj9s1lcuKo5sEFrlRd1kIAMnIJI4z0MTI7QF8jl9Fkmbx7KECGzw31TNgzrOSzxSapHbcueFYvNCLKST+kE/8ogMZBbwqXfEDuKpyF6BY3uYoJn+wPVE5pIb8Hhe08xPte8TTDSMIyHI3EyTfcAKrIreauoArePvh/cRvSw="
-      git:
-        depth: false  # This is needed to have the history to checkout old versions of certbot-auto.
-      <<: *extended-test-suite
-    - python: "2.7"
-      env:
-        - TOXENV=travis-test-farm-certonly-standalone
-        - secure: "f+j/Lj9s1lcuKo5sEFrlRd1kIAMnIJI4z0MTI7QF8jl9Fkmbx7KECGzw31TNgzrOSzxSapHbcueFYvNCLKST+kE/8ogMZBbwqXfEDuKpyF6BY3uYoJn+wPVE5pIb8Hhe08xPte8TTDSMIyHI3EyTfcAKrIreauoArePvh/cRvSw="
-      <<: *extended-test-suite
-    - python: "2.7"
-      env:
-        - TOXENV=travis-test-farm-sdists
-        - secure: "f+j/Lj9s1lcuKo5sEFrlRd1kIAMnIJI4z0MTI7QF8jl9Fkmbx7KECGzw31TNgzrOSzxSapHbcueFYvNCLKST+kE/8ogMZBbwqXfEDuKpyF6BY3uYoJn+wPVE5pIb8Hhe08xPte8TTDSMIyHI3EyTfcAKrIreauoArePvh/cRvSw="
-      <<: *extended-test-suite
-    - python: "3.7"
-      env: TOXENV=py37 CERTBOT_NO_PIN=1
-      <<: *extended-test-suite
-    - python: "2.7"
-      env: ACME_SERVER=boulder-v1 TOXENV=integration
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "2.7"
-      env: ACME_SERVER=boulder-v2 TOXENV=integration
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "2.7"
-      env: ACME_SERVER=boulder-v1 TOXENV=integration-certbot-oldest
-      # Ubuntu Trusty or older must be used because the oldest version of
-      # cryptography we support cannot be compiled against the version of
-      # OpenSSL in Xenial or newer.
-      dist: trusty
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "2.7"
-      env: ACME_SERVER=boulder-v2 TOXENV=integration-certbot-oldest
-      # Ubuntu Trusty or older must be used because the oldest version of
-      # cryptography we support cannot be compiled against the version of
-      # OpenSSL in Xenial or newer.
-      dist: trusty
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "2.7"
-      env: ACME_SERVER=boulder-v1 TOXENV=integration-nginx-oldest
-      # Ubuntu Trusty or older must be used because the oldest version of
-      # cryptography we support cannot be compiled against the version of
-      # OpenSSL in Xenial or newer.
-      dist: trusty
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "2.7"
-      env: ACME_SERVER=boulder-v2 TOXENV=integration-nginx-oldest
-      # Ubuntu Trusty or older must be used because the oldest version of
-      # cryptography we support cannot be compiled against the version of
-      # OpenSSL in Xenial or newer.
-      dist: trusty
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "3.4"
-      env: TOXENV=py34
-      <<: *extended-test-suite
-    - python: "3.5"
-      env: TOXENV=py35
-      <<: *extended-test-suite
-    - python: "3.6"
-      env: TOXENV=py36
-      <<: *extended-test-suite
-    - python: "3.7"
-      env: TOXENV=py37
-      <<: *extended-test-suite
-    - python: "3.8"
-      env: TOXENV=py38
-      <<: *extended-test-suite
-    - python: "3.4"
-      env: ACME_SERVER=boulder-v1 TOXENV=integration
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "3.4"
-      env: ACME_SERVER=boulder-v2 TOXENV=integration
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "3.5"
-      env: ACME_SERVER=boulder-v1 TOXENV=integration
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "3.5"
-      env: ACME_SERVER=boulder-v2 TOXENV=integration
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "3.6"
-      env: ACME_SERVER=boulder-v1 TOXENV=integration
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "3.6"
-      env: ACME_SERVER=boulder-v2 TOXENV=integration
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "3.7"
-      env: ACME_SERVER=boulder-v1 TOXENV=integration
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "3.7"
-      env: ACME_SERVER=boulder-v2 TOXENV=integration
-      sudo: required
-      services: docker
-      <<: *extended-test-suite
-    - python: "3.8"
-      env: ACME_SERVER=boulder-v1 TOXENV=integration
-      <<: *extended-test-suite
-    - python: "3.8"
-      env: ACME_SERVER=boulder-v2 TOXENV=integration
-      <<: *extended-test-suite
-    - sudo: required
-      env: TOXENV=le_auto_jessie
-      services: docker
-      <<: *extended-test-suite
-    - sudo: required
-      env: TOXENV=le_auto_centos6
-      services: docker
-      <<: *extended-test-suite
-    - sudo: required
-      env: TOXENV=docker_dev
-      services: docker
-      addons:
-        apt:
-          packages:  # don't install nginx and apache
-            - libaugeas0
-      <<: *extended-test-suite
-    - language: generic
-      env: TOXENV=py27
-      os: osx
-      # Using this osx_image is a workaround for
-      # https://travis-ci.community/t/xcode-8-3-homebrew-outdated-error/3798.
-      osx_image: xcode10.2
-      addons:
-        homebrew:
-          packages:
-            - augeas
-            - python2
-      <<: *extended-test-suite
-    - language: generic
-      env: TOXENV=py3
-      os: osx
-      # Using this osx_image is a workaround for
-      # https://travis-ci.community/t/xcode-8-3-homebrew-outdated-error/3798.
-      osx_image: xcode10.2
-      addons:
-        homebrew:
-          packages:
-            - augeas
-            - python3
-      <<: *extended-test-suite
-
 # container-based infrastructure
 sudo: false
 
 addons:
   apt:
+    sources:
+    - augeas
     packages:  # Keep in sync with letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh and Boulder.
     - python-dev
+    - python-virtualenv
     - gcc
     - libaugeas0
     - libssl-dev
@@ -280,30 +46,14 @@ addons:
     # For certbot-nginx integration testing
     - nginx-light
     - openssl
+    # for apacheconftest
+    - apache2
+    - libapache2-mod-wsgi
+    - libapache2-mod-macro
 
-# tools/pip_install.py is used to pin packages to a known working version
-# except in tests where the environment variable CERTBOT_NO_PIN is set.
-# virtualenv is listed here explicitly to make sure it is upgraded when
-# CERTBOT_NO_PIN is set to work around failures we've seen when using an older
-# version of virtualenv.
-install: 'tools/pip_install.py -U codecov tox virtualenv'
-# Most of the time TRAVIS_RETRY is an empty string, and has no effect on the
-# script command. It is set only to `travis_retry` during farm tests, in
-# order to trigger the Travis retry feature, and compensate the inherent
-# flakiness of these specific tests.
-script: '$TRAVIS_RETRY tox'
+install: "travis_retry $(command -v pip || command -v pip3) install tox coveralls"
+script:
+    - travis_retry tox
+    - '[ -z "${BOULDER_INTEGRATION+x}" ] || (travis_retry tests/boulder-fetch.sh && tests/tox-boulder-integration.sh)'
 
-after_success: '[ "$TOXENV" == "py27-cover" ] && codecov -F linux'
-
-notifications:
-  email: false
-  irc:
-    channels:
-      # This is set to a secure variable to prevent forks from sending
-      # notifications. This value was created by installing
-      # https://github.com/travis-ci/travis.rb and running
-      # `travis encrypt "chat.freenode.net#certbot-devel"`.
-      - secure: "EWW66E2+KVPZyIPR8ViENZwfcup4Gx3/dlimmAZE0WuLwxDCshBBOd3O8Rf6pBokEoZlXM5eDT6XdyJj8n0DLslgjO62pExdunXpbcMwdY7l1ELxX2/UbnDTE6UnPYa09qVBHNG7156Z6yE0x2lH4M9Ykvp0G0cubjPQHylAwo0="
-    on_cancel: never
-    on_success: never
-    on_failure: always
+after_success: '[ "$TOXENV" == "cover" ] && coveralls'

AUTHORS.md

@@ -5,7 +5,6 @@ Authors
 * Aaron Zuehlke
 * Ada Lovelace
 * [Adam Woodbeck](https://github.com/awoodbeck)
-* [Adrien Ferrand](https://github.com/adferrand)
 * [Aidin Gharibnavaz](https://github.com/aidin36)
 * [AJ ONeal](https://github.com/coolaj86)
 * [Alcaro](https://github.com/Alcaro)
@@ -15,10 +14,8 @@ Authors
 * [Alex Gaynor](https://github.com/alex)
 * [Alex Halderman](https://github.com/jhalderm)
 * [Alex Jordan](https://github.com/strugee)
-* [Alex Zorin](https://github.com/alexzorin)
 * [Amjad Mashaal](https://github.com/TheNavigat)
 * [Andrew Murray](https://github.com/radarhere)
-* [Andrzej Górski](https://github.com/andrzej3393)
 * [Anselm Levskaya](https://github.com/levskaya)
 * [Antoine Jacoutot](https://github.com/ajacoutot)
 * [asaph](https://github.com/asaph)
@@ -78,7 +75,6 @@ Authors
 * [Fabian](https://github.com/faerbit)
 * [Faidon Liambotis](https://github.com/paravoid)
 * [Fan Jiang](https://github.com/tcz001)
-* [Felix Lechner](https://github.com/lechner)
 * [Felix Schwarz](https://github.com/FelixSchwarz)
 * [Felix Yan](https://github.com/felixonmars)
 * [Filip Ochnik](https://github.com/filipochnik)
@@ -128,7 +124,6 @@ Authors
 * [Joubin Jabbari](https://github.com/joubin)
 * [Juho Juopperi](https://github.com/jkjuopperi)
 * [Kane York](https://github.com/riking)
-* [Kenichi Maehashi](https://github.com/kmaehashi)
 * [Kenneth Skovhede](https://github.com/kenkendk)
 * [Kevin Burke](https://github.com/kevinburke)
 * [Kevin London](https://github.com/kevinlondon)
@@ -164,10 +159,8 @@ Authors
 * [Michael Schumacher](https://github.com/schumaml)
 * [Michael Strache](https://github.com/Jarodiv)
 * [Michael Sverdlin](https://github.com/sveder)
-* [Michael Watters](https://github.com/blackknight36)
 * [Michal Moravec](https://github.com/https://github.com/Majkl578)
 * [Michal Papis](https://github.com/mpapis)
-* [Mickaël Schoentgen](https://github.com/BoboTiG)
 * [Minn Soe](https://github.com/MinnSoe)
 * [Min RK](https://github.com/minrk)
 * [Miquel Ruiz](https://github.com/miquelruiz)
@@ -231,7 +224,6 @@ Authors
 * [Stavros Korokithakis](https://github.com/skorokithakis)
 * [Stefan Weil](https://github.com/stweil)
 * [Steve Desmond](https://github.com/stevedesmond-ca)
-* [sydneyli](https://github.com/sydneyli)
 * [Tan Jay Jun](https://github.com/jayjun)
 * [Tapple Gao](https://github.com/tapple)
 * [Telepenin Nikolay](https://github.com/telepenin)

CHANGELOG.md

@@ -1 +0,0 @@
-certbot/CHANGELOG.md

CHANGELOG.md

@@ -0,0 +1,772 @@
+# Certbot change log
+
+Certbot adheres to [Semantic Versioning](http://semver.org/).
+
+## 0.20.0 - 2017-12-06
+
+### Added
+
+* Certbot's ACME library now recognizes URL fields in challenge objects in
+  preparation for Let's Encrypt's new ACME endpoint. The value is still
+  accessible in our ACME library through the name "uri".
+
+### Changed
+
+* The Apache plugin now parses some distro specific Apache configuration files
+  on non-Debian systems allowing it to get a clearer picture on the running
+  configuration. Internally, these changes were structured so that external
+  contributors can easily write patches to make the plugin work in new Apache
+  configurations.
+* Certbot better reports network failures by removing information about
+  connection retries from the error output.
+* An unnecessary question when using Certbot's webroot plugin interactively has
+  been removed.
+
+### Fixed
+
+* Certbot's NGINX plugin no longer sometimes incorrectly reports that it was
+  unable to deploy a HTTP->HTTPS redirect when requesting Certbot to enable a
+  redirect for multiple domains.
+* Problems where the Apache plugin was failing to find directives and
+  duplicating existing directives on openSUSE have been resolved.
+* An issue running the test shipped with Certbot and some our DNS plugins with
+  older versions of mock have been resolved.
+* On some systems, users reported strangely interleaved output depending on
+  when stdout and stderr were flushed. This problem was resolved by having
+  Certbot regularly flush these streams.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/milestone/44?closed=1
+
+## 0.19.0 - 2017-10-04
+
+### Added
+
+* Certbot now has renewal hook directories where executable files can be placed
+  for Certbot to run with the renew subcommand. Pre-hooks, deploy-hooks, and
+  post-hooks can be specified in the renewal-hooks/pre, renewal-hooks/deploy,
+  and renewal-hooks/post directories respectively in Certbot's configuration
+  directory (which is /etc/letsencrypt by default). Certbot will automatically
+  create these directories when it is run if they do not already exist.
+* After revoking a certificate with the revoke subcommand, Certbot will offer
+  to delete the lineage associated with the certificate. When Certbot is run
+  with --non-interactive, it will automatically try to delete the associated
+  lineage.
+* When using Certbot's Google Cloud DNS plugin on Google Compute Engine, you no
+  longer have to provide a credential file to Certbot if you have configured
+  sufficient permissions for the instance which Certbot can automatically
+  obtain using Google's metadata service.
+
+### Changed
+
+* When deleting certificates interactively using the delete subcommand, Certbot
+  will now allow you to select multiple lineages to be deleted at once.
+* Certbot's Apache plugin no longer always parses Apache's sites-available on
+  Debian based systems and instead only parses virtual hosts included in your
+  Apache configuration. You can provide an additional directory for Certbot to
+  parse using the command line flag --apache-vhost-root.
+
+### Fixed
+
+* The plugins subcommand can now be run without root access.
+* certbot-auto now includes a timeout when updating itself so it no longer
+  hangs indefinitely when it is unable to connect to the external server.
+* An issue where Certbot's Apache plugin would sometimes fail to deploy a
+  certificate on Debian based systems if mod_ssl wasn't already enabled has
+  been resolved.
+* A bug in our Docker image where the certificates subcommand could not report
+  if certificates maintained by Certbot had been revoked has been fixed.
+* Certbot's RFC 2136 DNS plugin (for use with software like BIND) now properly
+  performs DNS challenges when the domain being verified contains a CNAME
+  record.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/milestone/43?closed=1
+
+## 0.18.2 - 2017-09-20
+
+### Fixed
+
+* An issue where Certbot's ACME module would raise an AttributeError trying to
+  create self-signed certificates when used with pyOpenSSL 17.3.0 has been
+  resolved. For Certbot users with this version of pyOpenSSL, this caused
+  Certbot to crash when performing a TLS SNI challenge or when the Nginx plugin
+  tried to create an SSL server block.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/milestone/46?closed=1
+
+## 0.18.1 - 2017-09-08
+
+### Fixed
+
+* If certbot-auto was running as an unprivileged user and it upgraded from
+  0.17.0 to 0.18.0, it would crash with a permissions error and would need to
+  be run again to successfully complete the upgrade. This has been fixed and
+  certbot-auto should upgrade cleanly to 0.18.1.
+* Certbot usually uses "certbot-auto" or "letsencrypt-auto" in error messages
+  and the User-Agent string instead of "certbot" when you are using one of
+  these wrapper scripts. Proper detection of this was broken with Certbot's new
+  installation path in /opt in 0.18.0 but this problem has been resolved.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/milestone/45?closed=1
+
+## 0.18.0 - 2017-09-06
+
+### Added
+
+* The Nginx plugin now configures Nginx to use 2048-bit Diffie-Hellman
+  parameters. Java 6 clients do not support Diffie-Hellman parameters larger
+  than 1024 bits, so if you need to support these clients you will need to
+  manually modify your Nginx configuration after using the Nginx installer.
+
+### Changed
+
+* certbot-auto now installs Certbot in directories under `/opt/eff.org`. If you
+  had an existing installation from certbot-auto, a symlink is created to the
+  new directory. You can configure certbot-auto to use a different path by
+  setting the environment variable VENV_PATH.
+* The Nginx plugin can now be selected in Certbot's interactive output.
+* Output verbosity of renewal failures when running with `--quiet` has been
+  reduced.
+* The default revocation reason shown in Certbot help output now is a human
+  readable string instead of a numerical code.
+* Plugin selection is now included in normal terminal output.
+
+### Fixed
+
+* A newer version of ConfigArgParse is now installed when using certbot-auto
+  causing values set to false in a Certbot INI configuration file to be handled
+  intuitively. Setting a boolean command line flag to false is equivalent to
+  not including it in the configuration file at all.
+* New naming conventions preventing certbot-auto from installing OS
+  dependencies on Fedora 26 have been resolved.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/milestone/42?closed=1
+
+## 0.17.0 - 2017-08-02
+
+### Added
+
+* Support in our nginx plugin for modifying SSL server blocks that do
+  not contain certificate or key directives.
+* A `--max-log-backups` flag to allow users to configure or even completely
+  disable Certbot's built in log rotation.
+* A `--user-agent-comment` flag to allow people who build tools around Certbot
+  to differentiate their user agent string by adding a comment to its default
+  value.
+
+### Changed
+
+* Due to some awesome work by
+  [cryptography project](https://github.com/pyca/cryptography), compilation can
+  now be avoided on most systems when using certbot-auto. This eliminates many
+  problems people have had in the past such as running out of memory, having
+  invalid headers/libraries, and changes to the OS packages on their system
+  after compilation breaking Certbot.
+* The `--renew-hook` flag has been hidden in favor of `--deploy-hook`. This new
+  flag works exactly the same way except it is always run when a certificate is
+  issued rather than just when it is renewed.
+* We have started printing deprecation warnings in certbot-auto for
+  experimentally supported systems with OS packages available.
+* A certificate lineage's name is included in error messages during renewal.
+
+### Fixed
+
+* Encoding errors that could occur when parsing error messages from the ACME
+  server containing Unicode have been resolved.
+* certbot-auto no longer prints misleading messages about there being a newer
+  pip version available when installation fails.
+* Certbot's ACME library now properly extracts domains from critical SAN
+  extensions.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.17.0+is%3Aclosed
+
+## 0.16.0 - 2017-07-05
+
+### Added
+
+* A plugin for performing DNS challenges using dynamic DNS updates as defined
+  in RFC 2316. This plugin is packaged separately from Certbot and is available
+  at https://pypi.python.org/pypi/certbot-dns-rfc2136. It supports Python 2.6,
+  2.7, and 3.3+. At this time, there isn't a good way to install this plugin
+  when using certbot-auto, but this should change in the near future.
+* Plugins for performing DNS challenges for the providers
+  [DNS Made Easy](https://pypi.python.org/pypi/certbot-dns-dnsmadeeasy) and
+  [LuaDNS](https://pypi.python.org/pypi/certbot-dns-luadns). These plugins are
+  packaged separately from Certbot and support Python 2.7 and 3.3+. Currently,
+  there isn't a good way to install these plugins when using certbot-auto,
+  but that should change soon.
+* Support for performing TLS-SNI-01 challenges when using the manual plugin.
+* Automatic detection of Arch Linux in the Apache plugin providing better
+  default settings for the plugin.
+
+### Changed
+
+* The text of the interactive question about whether a redirect from HTTP to
+  HTTPS should be added by Certbot has been rewritten to better explain the
+  choices to the user.
+* Simplified HTTP challenge instructions in the manual plugin.
+
+### Fixed
+
+* Problems performing a dry run when using the Nginx plugin have been fixed.
+* Resolved an issue where certbot-dns-digitalocean's test suite would sometimes
+  fail when ran using Python 3.
+* On some systems, previous versions of certbot-auto would error out with a
+  message about a missing hash for setuptools. This has been fixed.
+* A bug where Certbot would sometimes not print a space at the end of an
+  interactive prompt has been resolved.
+* Nonfatal tracebacks are no longer shown in rare cases where Certbot
+  encounters an exception trying to close its TCP connection with the ACME
+  server.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.16.0+is%3Aclosed
+
+## 0.15.0 - 2017-06-08
+
+### Added
+
+* Plugins for performing DNS challenges for popular providers. Like the Apache
+  and Nginx plugins, these plugins are packaged separately and not included in
+  Certbot by default. So far, we have plugins for
+  [Amazon Route 53](https://pypi.python.org/pypi/certbot-dns-route53),
+  [Cloudflare](https://pypi.python.org/pypi/certbot-dns-cloudflare),
+  [DigitalOcean](https://pypi.python.org/pypi/certbot-dns-digitalocean), and
+  [Google Cloud](https://pypi.python.org/pypi/certbot-dns-google) which all
+  work on Python 2.6, 2.7, and 3.3+. Additionally, we have plugins for
+  [CloudXNS](https://pypi.python.org/pypi/certbot-dns-cloudxns),
+  [DNSimple](https://pypi.python.org/pypi/certbot-dns-dnsimple),
+  [NS1](https://pypi.python.org/pypi/certbot-dns-nsone) which work on Python
+  2.7 and 3.3+ (and not 2.6). Currently, there isn't a good way to install
+  these plugins when using `certbot-auto`, but that should change soon.
+* IPv6 support in the standalone plugin. When performing a challenge, the
+  standalone plugin automatically handles listening for IPv4/IPv6 traffic based
+  on the configuration of your system.
+* A mechanism for keeping your Apache and Nginx SSL/TLS configuration up to
+  date. When the Apache or Nginx plugins are used, they place SSL/TLS
+  configuration options in the root of Certbot's config directory
+  (`/etc/letsencrypt` by default). Now when a new version of these plugins run
+  on your system, they will automatically update the file to the newest
+  version if it is unmodified. If you manually modified the file, Certbot will
+  display a warning giving you a path to the updated file which you can use as
+  a reference to manually update your modified copy.
+* `--http-01-address` and `--tls-sni-01-address` flags for controlling the
+  address Certbot listens on when using the standalone plugin.
+* The command `certbot certificates` that lists certificates managed by Certbot
+  now performs additional validity checks to notify you if your files have
+  become corrupted.
+
+### Changed
+
+* Messages custom hooks print to `stdout` are now displayed by Certbot when not
+  running in `--quiet` mode.
+* `jwk` and `alg` fields in JWS objects have been moved into the protected
+  header causing Certbot to more closely follow the latest version of the ACME
+  spec.
+
+### Fixed
+
+* Permissions on renewal configuration files are now properly preserved when
+  they are updated.
+* A bug causing Certbot to display strange defaults in its help output when
+  using Python <= 2.7.4 has been fixed.
+* Certbot now properly handles mixed case domain names found in custom CSRs.
+* A number of poorly worded prompts and error messages.
+
+### Removed
+
+* Support for OpenSSL 1.0.0 in `certbot-auto` has been removed as we now pin a
+  newer version of `cryptography` which dropped support for this version.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.15.0+is%3Aclosed
+
+## 0.14.2 - 2017-05-25
+
+### Fixed
+
+* Certbot 0.14.0 included a bug where Certbot would create a temporary log file
+(usually in /tmp) if the program exited during argument parsing. If a user
+provided -h/--help/help, --version, or an invalid command line argument,
+Certbot would create this temporary log file. This was especially bothersome to
+certbot-auto users as certbot-auto runs `certbot --version` internally to see
+if the script needs to upgrade causing it to create at least one of these files
+on every run. This problem has been resolved.
+
+More details about this change can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.14.2+is%3Aclosed
+
+## 0.14.1 - 2017-05-16
+
+### Fixed
+
+* Certbot now works with configargparse 0.12.0.
+* Issues with the Apache plugin and Augeas 1.7+ have been resolved.
+* A problem where the Nginx plugin would fail to install certificates on
+systems that had the plugin's SSL/TLS options file from 7+ months ago has been
+fixed.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.14.1+is%3Aclosed
+
+## 0.14.0 - 2017-05-04
+
+### Added
+
+* Python 3.3+ support for all Certbot packages. `certbot-auto` still currently
+only supports Python 2, but the `acme`, `certbot`, `certbot-apache`, and
+`certbot-nginx` packages on PyPI now fully support Python 2.6, 2.7, and 3.3+.
+* Certbot's Apache plugin now handles multiple virtual hosts per file.
+* Lockfiles to prevent multiple versions of Certbot running simultaneously.
+
+### Changed
+
+* When converting an HTTP virtual host to HTTPS in Apache, Certbot only copies
+the virtual host rather than the entire contents of the file it's contained
+in.
+* The Nginx plugin now includes SSL/TLS directives in a separate file located
+in Certbot's configuration directory rather than copying the contents of the
+file into every modified `server` block.
+
+### Fixed
+
+* Ensure logging is configured before parts of Certbot attempt to log any
+messages.
+* Support for the `--quiet` flag in `certbot-auto`.
+* Reverted a change made in a previous release to make the `acme` and `certbot`
+packages always depend on `argparse`. This dependency is conditional again on
+the user's Python version.
+* Small bugs in the Nginx plugin such as properly handling empty `server`
+blocks and setting `server_names_hash_bucket_size` during challenges.
+
+As always, a more complete list of changes can be found on GitHub:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.14.0+is%3Aclosed
+
+## 0.13.0 - 2017-04-06
+
+### Added
+
+* `--debug-challenges` now pauses Certbot after setting up challenges for debugging.
+* The Nginx parser can now handle all valid directives in configuration files.
+* Nginx ciphersuites have changed to Mozilla Intermediate.
+* `certbot-auto --no-bootstrap` provides the option to not install OS dependencies.
+
+### Fixed
+
+* `--register-unsafely-without-email` now respects `--quiet`.
+* Hyphenated renewal parameters are now saved in renewal config files.
+* `--dry-run` no longer persists keys and csrs.
+* Certbot no longer hangs when trying to start Nginx in Arch Linux.
+* Apache rewrite rules no longer double-encode characters.
+
+A full list of changes is available on GitHub:
+https://github.com/certbot/certbot/issues?q=is%3Aissue%20milestone%3A0.13.0%20is%3Aclosed%20
+
+## 0.12.0 - 2017-03-02
+
+### Added
+
+* Certbot now allows non-camelcase Apache VirtualHost names.
+* Certbot now allows more log messages to be silenced.
+
+### Fixed
+
+* Fixed a regression around using `--cert-name` when getting new certificates
+
+More information about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue%20milestone%3A0.12.0
+
+## 0.11.1 - 2017-02-01
+
+### Fixed
+
+* Resolved a problem where Certbot would crash while parsing command line
+arguments in some cases.
+* Fixed a typo.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/pulls?q=is%3Apr%20milestone%3A0.11.1%20is%3Aclosed
+
+## 0.11.0 - 2017-02-01
+
+### Added
+
+* When using the standalone plugin while running Certbot interactively 
+and a required port is bound by another process, Certbot will give you
+the option to retry to grab the port rather than immediately exiting.
+* You are now able to deactivate your account with the Let's Encrypt
+server using the `unregister` subcommand.
+* When revoking a certificate using the `revoke` subcommand, you now
+have the option to provide the reason the certificate is being revoked
+to Let's Encrypt with `--reason`.
+
+### Changed
+
+* Providing `--quiet` to `certbot-auto` now silences package manager output.
+
+### Removed
+
+* Removed the optional `dnspython` dependency in our `acme` package.
+Now the library does not support client side verification of the DNS
+challenge.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.11.0+is%3Aclosed
+
+## 0.10.2 - 2017-01-25
+
+### Added
+
+* If Certbot receives a request with a `badNonce` error, it now
+automatically retries the request. Since nonces from Let's Encrypt expire,
+this helps people performing the DNS challenge with the `manual` plugin
+who may have to wait an extended period of time for their DNS changes to
+propagate.
+
+### Fixed
+
+* Certbot now saves the `--preferred-challenges` values for renewal. Previously
+these values were discarded causing a different challenge type to be used when
+renewing certs in some cases.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.10.2+is%3Aclosed
+
+## 0.10.1 - 2017-01-13
+
+### Fixed
+
+* Resolve problems where when asking Certbot to update a certificate at
+an existing path to include different domain names, the old names would
+continue to be used.
+* Fix issues successfully running our unit test suite on some systems.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.10.1+is%3Aclosed
+
+## 0.10.0 - 2017-01-11
+
+## Added
+
+* Added the ability to customize and automatically complete DNS and HTTP
+domain validation challenges with the manual plugin. The flags
+`--manual-auth-hook` and `--manual-cleanup-hook` can now be provided
+when using the manual plugin to execute commands provided by the user to
+perform and clean up challenges provided by the CA. This is best used in
+complicated setups where the DNS challenge must be used or Certbot's
+existing plugins cannot be used to perform HTTP challenges. For more
+information on how this works, see `certbot --help manual`.
+* Added a `--cert-name` flag for specifying the name to use for the
+certificate in Certbot's configuration directory. Using this flag in
+combination with `-d/--domains`, a user can easily request a new
+certificate with different domains and save it with the name provided by
+`--cert-name`. Additionally, `--cert-name` can be used to select a
+certificate with the `certonly` and `run` subcommands so a full list of
+domains in the certificate does not have to be provided.
+* Added subcommand `certificates` for listing the certificates managed by
+Certbot and their properties.
+* Added the `delete` subcommand for removing certificates managed by Certbot
+from the configuration directory.
+* Certbot now supports requesting internationalized domain names (IDNs).
+* Hooks provided to Certbot are now saved to be reused during renewal.
+If you run Certbot with `--pre-hook`, `--renew-hook`, or `--post-hook`
+flags when obtaining a certificate, the provided commands will
+automatically be saved and executed again when renewing the certificate.
+A pre-hook and/or post-hook can also be given to the `certbot renew`
+command either on the command line or in a [configuration
+file](https://certbot.eff.org/docs/using.html#configuration-file) to run
+an additional command before/after any certificate is renewed. Hooks
+will only be run if a certificate is renewed.
+* Support Busybox in certbot-auto.
+
+### Changed
+
+* Recategorized `-h/--help` output to improve documentation and
+discoverability.
+
+### Removed
+
+* Removed the ncurses interface. This change solves problems people
+were having on many systems, reduces the number of Certbot
+dependencies, and simplifies our code. Certbot's only interface now is
+the text interface which was available by providing `-t/--text` to
+earlier versions of Certbot.
+
+### Fixed
+
+* Many small bug fixes.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.10.0is%3Aclosed
+
+## 0.9.3 - 2016-10-13
+
+### Added
+
+* The Apache plugin uses information about your OS to help determine the
+layout of your Apache configuration directory. We added a patch to
+ensure this code behaves the same way when testing on different systems
+as the tests were failing in some cases.
+
+### Changed
+
+* Certbot adopted more conservative behavior about reporting a needed port as
+unavailable when using the standalone plugin.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/milestone/27?closed=1
+
+## 0.9.2 - 2016-10-12
+
+### Added
+
+* Certbot stopped requiring that all possibly required ports are available when
+using the standalone plugin. It now only verifies that the ports are available
+when they are necessary.
+
+### Fixed
+
+* Certbot now verifies that our optional dependencies version matches what is
+required by Certbot.
+* Certnot now properly copies the `ssl on;` directives as necessary when
+performing domain validation in the Nginx plugin.
+* Fixed problem where symlinks were becoming files when they were
+packaged, causing errors during testing and OS packaging.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/milestone/26?closed=1
+
+## 0.9.1 - 2016-10-06
+
+### Fixed
+
+* Fixed a bug that was introduced in version 0.9.0 where the command
+line flag -q/--quiet wasn't respected in some cases.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/milestone/25?closed=1
+
+## 0.9.0 - 2016-10-05
+
+### Added
+
+* Added an alpha version of the Nginx plugin. This plugin fully automates the
+process of obtaining and installing certificates with Nginx.
+Additionally, it is able to automatically configure security
+enhancements such as an HTTP to HTTPS redirect and OCSP stapling. To use
+this plugin, you must have the `certbot-nginx` package installed (which
+is installed automatically when using `certbot-auto`) and provide
+`--nginx` on the command line. This plugin is still in its early stages
+so we recommend you use it with some caution and make sure you have a
+backup of your Nginx configuration.
+* Added support for the `DNS` challenge in the `acme` library and `DNS` in
+Certbot's `manual` plugin. This allows you to create DNS records to
+prove to Let's Encrypt you control the requested domain name. To use
+this feature, include `--manual --preferred-challenges dns` on the
+command line.
+* Certbot now helps with enabling Extra Packages for Enterprise Linux (EPEL) on
+CentOS 6 when using `certbot-auto`. To use `certbot-auto` on CentOS 6,
+the EPEL repository has to be enabled. `certbot-auto` will now prompt
+users asking them if they would like the script to enable this for them
+automatically. This is done without prompting users when using
+`letsencrypt-auto` or if `-n/--non-interactive/--noninteractive` is
+included on the command line.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.9.0+is%3Aclosed
+
+## 0.8.1 - 2016-06-14
+
+### Added
+
+* Certbot now preserves a certificate's common name when using `renew`.
+* Certbot now saves webroot values for renewal when they are entered interactively.
+* Certbot now gracefully reports that the Apache plugin isn't usable when Augeas is not installed.
+* Added experimental support for Mageia has been added to `certbot-auto`.
+
+### Fixed
+
+* Fixed problems with an invalid user-agent string on OS X.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.8.1+
+
+## 0.8.0 - 2016-06-02
+
+### Added
+
+* Added the `register` subcommand which can be used to register an account
+with the Let's Encrypt CA.
+* You can now run `certbot register --update-registration` to
+change the e-mail address associated with your registration.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue+milestone%3A0.8.0+
+
+## 0.7.0 - 2016-05-27
+
+### Added
+
+* Added `--must-staple` to request certificates from Let's Encrypt
+with the OCSP must staple extension.
+* Certbot now automatically configures OSCP stapling for Apache.
+* Certbot now allows requesting certificates for domains found in the common name
+of a custom CSR.
+
+### Fixed
+
+* Fixed a number of miscellaneous bugs
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=milestone%3A0.7.0+is%3Aissue
+
+## 0.6.0 - 2016-05-12
+
+### Added
+
+* Versioned the datetime dependency in setup.py.
+
+### Changed
+
+* Renamed the client from `letsencrypt` to `certbot`.
+
+### Fixed
+
+* Fixed a small json deserialization error.
+* Certbot now preserves domain order in generated CSRs.
+* Fixed some minor bugs.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/certbot/certbot/issues?q=is%3Aissue%20milestone%3A0.6.0%20is%3Aclosed%20
+
+## 0.5.0 - 2016-04-05
+
+### Added
+
+* Added the ability to use the webroot plugin interactively.
+* Added the flags --pre-hook, --post-hook, and --renew-hook which can be used with
+the renew subcommand to register shell commands to run in response to
+renewal events. Pre-hook commands will be run before any certs are
+renewed, post-hook commands will be run after any certs are renewed,
+and renew-hook commands will be run after each cert is renewed. If no
+certs are due for renewal, no command is run.
+* Added a -q/--quiet flag which silences all output except errors.
+* Added an --allow-subset-of-domains flag which can be used with the renew
+command to prevent renewal failures for a subset of the requested
+domains from causing the client to exit.
+
+### Changed
+
+* Certbot now uses renewal configuration files. In /etc/letsencrypt/renewal
+by default, these files can be used to control what parameters are
+used when renewing a specific certificate.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/letsencrypt/letsencrypt/issues?q=milestone%3A0.5.0+is%3Aissue
+
+## 0.4.2 - 2016-03-03
+
+### Fixed
+
+* Resolved problems encountered when compiling letsencrypt
+against the new OpenSSL release.
+* Fixed problems encountered when using `letsencrypt renew` with configuration files
+from the private beta.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/letsencrypt/letsencrypt/issues?q=is%3Aissue+milestone%3A0.4.2
+
+## 0.4.1 - 2016-02-29
+
+### Fixed
+
+* Fixed Apache parsing errors encountered with some configurations.
+* Fixed Werkzeug dependency problems encountered on some Red Hat systems.
+* Fixed bootstrapping failures when using letsencrypt-auto with --no-self-upgrade.
+* Fixed problems with parsing renewal config files from private beta.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/letsencrypt/letsencrypt/issues?q=is:issue+milestone:0.4.1
+
+## 0.4.0 - 2016-02-10
+
+### Added
+
+* Added the verb/subcommand `renew` which can be used to renew your existing
+certificates as they approach expiration. Running `letsencrypt renew`
+will examine all existing certificate lineages and determine if any are
+less than 30 days from expiration. If so, the client will use the
+settings provided when you previously obtained the certificate to renew
+it. The subcommand finishes by printing a summary of which renewals were
+successful, failed, or not yet due.
+* Added a `--dry-run` flag to help with testing configuration
+without affecting production rate limits. Currently supported by the
+`renew` and `certonly` subcommands, providing `--dry-run` on the command
+line will obtain certificates from the staging server without saving the
+resulting certificates to disk.
+* Added major improvements to letsencrypt-auto. This script
+has been rewritten to include full support for Python 2.6, the ability
+for letsencrypt-auto to update itself, and improvements to the
+stability, security, and performance of the script.
+* Added support for Apache 2.2 to the Apache plugin.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/letsencrypt/letsencrypt/issues?q=is%3Aissue+milestone%3A0.4.0
+
+## 0.3.0 - 2016-01-27
+
+### Added
+
+* Added a non-interactive mode which can be enabled by including `-n` or
+`--non-interactive` on the command line. This can be used to guarantee
+the client will not prompt when run automatically using cron/systemd.
+* Added preparation for the new letsencrypt-auto script. Over the past
+couple months, we've been working on increasing the reliability and
+security of letsencrypt-auto. A number of changes landed in this
+release to prepare for the new version of this script.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/letsencrypt/letsencrypt/issues?q=is%3Aissue+milestone%3A0.3.0
+
+## 0.2.0 - 2016-01-14
+
+### Added
+
+* Added Apache plugin support for non-Debian based systems. Support has been
+added for modern Red Hat based systems such as Fedora 23, Red Hat 7,
+and CentOS 7 running Apache 2.4. In theory, this plugin should be
+able to be configured to run on any Unix-like OS running Apache 2.4.
+* Relaxed PyOpenSSL version requirements. This adds support for systems
+with PyOpenSSL versions 0.13 or 0.14.
+* Improved error messages from the client.
+
+### Fixed
+
+* Resolved issues with the Apache plugin enabling an HTTP to HTTPS
+redirect on some systems.
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/letsencrypt/letsencrypt/issues?q=is%3Aissue+milestone%3A0.2.0
+
+## 0.1.1 - 2015-12-15
+
+### Added
+
+* Added a check that avoids attempting to issue for unqualified domain names like
+"localhost".
+
+### Fixed
+
+* Fixed a confusing UI path that caused some users to repeatedly renew
+their certs while experimenting with the client, in some cases hitting
+issuance rate limits.
+* Fixed numerous Apache configuration parser problems
+* Fixed --webroot permission handling for non-root users
+
+More details about these changes can be found on our GitHub repo:
+https://github.com/letsencrypt/letsencrypt/issues?q=milestone%3A0.1.1

CHANGES.rst

@@ -0,0 +1,8 @@
+ChangeLog
+=========
+
+To see the changes in a given release, view the issues closed in a given
+release's GitHub milestone:
+
+ - `Past releases <https://github.com/certbot/certbot/milestones?state=closed>`_
+ - `Upcoming releases <https://github.com/certbot/certbot/milestones>`_

CODE_OF_CONDUCT.md

@@ -1 +0,0 @@
-This project is governed by [EFF's Public Projects Code of Conduct](https://www.eff.org/pages/eppcode).

CONTRIBUTING.md

@@ -33,5 +33,3 @@ started. In particular, we recommend you read these sections
  - [Finding issues to work on](https://certbot.eff.org/docs/contributing.html#find-issues-to-work-on)
  - [Coding style](https://certbot.eff.org/docs/contributing.html#coding-style)
  - [Submitting a pull request](https://certbot.eff.org/docs/contributing.html#submitting-a-pull-request)
- - [EFF's Public Projects Code of Conduct](https://www.eff.org/pages/eppcode)
-

Dockerfile

@@ -0,0 +1,27 @@
+FROM python:2-alpine
+
+ENTRYPOINT [ "certbot" ]
+EXPOSE 80 443
+VOLUME /etc/letsencrypt /var/lib/letsencrypt
+WORKDIR /opt/certbot
+
+COPY CHANGES.rst README.rst setup.py src/
+COPY acme src/acme
+COPY certbot src/certbot
+
+RUN apk add --no-cache --virtual .certbot-deps \
+        libffi \
+        libssl1.0 \
+        openssl \
+        ca-certificates \
+        binutils
+RUN apk add --no-cache --virtual .build-deps \
+        gcc \
+        linux-headers \
+        openssl-dev \
+        musl-dev \
+        libffi-dev \
+    && pip install --no-cache-dir \
+        --editable /opt/certbot/src/acme \
+        --editable /opt/certbot/src \
+    && apk del .build-deps

Dockerfile-dev

@@ -1,20 +1,70 @@
 # This Dockerfile builds an image for development.
-FROM debian:buster
+FROM ubuntu:trusty
+MAINTAINER Jakub Warmuz <jakub@warmuz.org>
+MAINTAINER William Budington <bill@eff.org>
+MAINTAINER Yan <yan@eff.org>
 
-# Note: this only exposes the port to other docker containers.
-EXPOSE 80 443
+# Note: this only exposes the port to other docker containers. You
+# still have to bind to 443@host at runtime, as per the ACME spec.
+EXPOSE 443
+
+# TODO: make sure --config-dir and --work-dir cannot be changed
+# through the CLI (certbot-docker wrapper that uses standalone
+# authenticator and text mode only?)
+VOLUME /etc/letsencrypt /var/lib/letsencrypt
 
 WORKDIR /opt/certbot/src
 
-COPY . .
-RUN apt-get update && \
-    apt-get install apache2 git python3-dev python3-venv gcc libaugeas0 \
-                    libssl-dev libffi-dev ca-certificates openssl nginx-light -y && \
+# no need to mkdir anything:
+# https://docs.docker.com/reference/builder/#copy
+# If <dest> doesn't exist, it is created along with all missing
+# directories in its path.
+
+# TODO: Install Apache/Nginx for plugin development.
+COPY letsencrypt-auto-source/letsencrypt-auto /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto
+RUN /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto --os-packages-only && \
+    apt-get install python3-dev git -y && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* \
            /tmp/* \
            /var/tmp/*
 
-RUN VENV_NAME="../venv3" python3 tools/venv3.py
+# the above is not likely to change, so by putting it further up the
+# Dockerfile we make sure we cache as much as possible
 
-ENV PATH /opt/certbot/venv3/bin:$PATH
+COPY setup.py README.rst CHANGES.rst MANIFEST.in linter_plugin.py tox.cover.sh tox.ini .pylintrc /opt/certbot/src/
+
+# all above files are necessary for setup.py, however, package source
+# code directory has to be copied separately to a subdirectory...
+# https://docs.docker.com/reference/builder/#copy: "If <src> is a
+# directory, the entire contents of the directory are copied,
+# including filesystem metadata. Note: The directory itself is not
+# copied, just its contents." Order again matters, three files are far
+# more likely to be cached than the whole project directory
+
+COPY certbot /opt/certbot/src/certbot/
+COPY acme /opt/certbot/src/acme/
+COPY certbot-apache /opt/certbot/src/certbot-apache/
+COPY certbot-nginx /opt/certbot/src/certbot-nginx/
+COPY letshelp-certbot /opt/certbot/src/letshelp-certbot/
+COPY certbot-compatibility-test /opt/certbot/src/certbot-compatibility-test/
+COPY tests /opt/certbot/src/tests/
+
+RUN virtualenv --no-site-packages -p python2 /opt/certbot/venv && \
+    /opt/certbot/venv/bin/pip install -U pip && \
+    /opt/certbot/venv/bin/pip install -U setuptools && \
+    /opt/certbot/venv/bin/pip install \
+    -e /opt/certbot/src/acme \
+    -e /opt/certbot/src \
+    -e /opt/certbot/src/certbot-apache \
+    -e /opt/certbot/src/certbot-nginx \
+    -e /opt/certbot/src/letshelp-certbot \
+    -e /opt/certbot/src/certbot-compatibility-test \
+    -e /opt/certbot/src[dev,docs]
+
+# install in editable mode (-e) to save space: it's not possible to
+# "rm -rf /opt/certbot/src" (it's stays in the underlaying image);
+# this might also help in debugging: you can "docker run --entrypoint
+# bash" and investigate, apply patches, etc.
+
+ENV PATH /opt/certbot/venv/bin:$PATH

Dockerfile-old

@@ -0,0 +1,75 @@
+# https://github.com/letsencrypt/letsencrypt/pull/431#issuecomment-103659297
+# it is more likely developers will already have ubuntu:trusty rather
+# than e.g. debian:jessie and image size differences are negligible
+FROM ubuntu:trusty
+MAINTAINER Jakub Warmuz <jakub@warmuz.org>
+MAINTAINER William Budington <bill@eff.org>
+
+# Note: this only exposes the port to other docker containers. You
+# still have to bind to 443@host at runtime, as per the ACME spec.
+EXPOSE 443
+
+# TODO: make sure --config-dir and --work-dir cannot be changed
+# through the CLI (certbot-docker wrapper that uses standalone
+# authenticator and text mode only?)
+VOLUME /etc/letsencrypt /var/lib/letsencrypt
+
+WORKDIR /opt/certbot
+
+# no need to mkdir anything:
+# https://docs.docker.com/reference/builder/#copy
+# If <dest> doesn't exist, it is created along with all missing
+# directories in its path.
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+COPY letsencrypt-auto-source/letsencrypt-auto /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto
+RUN /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto --os-packages-only && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* \
+           /tmp/* \
+           /var/tmp/*
+
+# the above is not likely to change, so by putting it further up the
+# Dockerfile we make sure we cache as much as possible
+
+
+COPY setup.py README.rst CHANGES.rst MANIFEST.in letsencrypt-auto-source/pieces/pipstrap.py /opt/certbot/src/
+
+# all above files are necessary for setup.py and venv setup, however,
+# package source code directory has to be copied separately to a
+# subdirectory...
+# https://docs.docker.com/reference/builder/#copy: "If <src> is a
+# directory, the entire contents of the directory are copied,
+# including filesystem metadata. Note: The directory itself is not
+# copied, just its contents." Order again matters, three files are far
+# more likely to be cached than the whole project directory
+
+COPY certbot /opt/certbot/src/certbot/
+COPY acme /opt/certbot/src/acme/
+COPY certbot-apache /opt/certbot/src/certbot-apache/
+COPY certbot-nginx /opt/certbot/src/certbot-nginx/
+
+
+RUN virtualenv --no-site-packages -p python2 /opt/certbot/venv
+
+# PATH is set now so pipstrap upgrades the correct (v)env
+ENV PATH /opt/certbot/venv/bin:$PATH
+RUN /opt/certbot/venv/bin/python /opt/certbot/src/pipstrap.py && \
+    /opt/certbot/venv/bin/pip install \
+    -e /opt/certbot/src/acme \
+    -e /opt/certbot/src \
+    -e /opt/certbot/src/certbot-apache \
+    -e /opt/certbot/src/certbot-nginx
+
+# install in editable mode (-e) to save space: it's not possible to
+# "rm -rf /opt/certbot/src" (it's stays in the underlaying image);
+# this might also help in debugging: you can "docker run --entrypoint
+# bash" and investigate, apply patches, etc.
+
+# set up certbot/letsencrypt wrapper to warn people about Dockerfile changes
+COPY tools/docker-warning.sh /opt/certbot/bin/certbot
+RUN ln -s /opt/certbot/bin/certbot /opt/certbot/bin/letsencrypt
+ENV PATH /opt/certbot/bin:$PATH
+
+ENTRYPOINT [ "certbot" ]

ISSUE_TEMPLATE.md

@@ -1,9 +1,3 @@
-If you're having trouble using Certbot and aren't sure you've found a bug or
-request for a new feature, please first try asking for help at
-https://community.letsencrypt.org/. There is a much larger community there of
-people familiar with the project who will be able to more quickly answer your
-questions.
-
 ## My operating system is (include version):
 
 

MANIFEST.in

@@ -1,10 +1,9 @@
 include README.rst
-include CHANGELOG.md
+include CHANGES.rst
+include CONTRIBUTING.md
 include LICENSE.txt
+include linter_plugin.py
 recursive-include docs *
 recursive-include examples *
 recursive-include certbot/tests/testdata *
-recursive-include tests *.py
 include certbot/ssl-dhparams.pem
-global-exclude __pycache__
-global-exclude *.py[cod]

README.rst

@@ -1 +0,0 @@
-certbot/README.rst

README.rst

@@ -0,0 +1,161 @@
+.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin
+
+Certbot is part of EFF’s effort to encrypt the entire Internet. Secure communication over the Web relies on HTTPS, which requires the use of a digital certificate that lets browsers verify the identity of web servers (e.g., is that really google.com?). Web servers obtain their certificates from trusted third parties called certificate authorities (CAs). Certbot is an easy-to-use client that fetches a certificate from Let’s Encrypt—an open certificate authority launched by the EFF, Mozilla, and others—and deploys it to a web server.
+
+Anyone who has gone through the trouble of setting up a secure website knows what a hassle getting and maintaining a certificate is. Certbot and Let’s Encrypt can automate away the pain and let you turn on and manage HTTPS with simple commands. Using Certbot and Let's Encrypt is free, so there’s no need to arrange payment.
+
+How you use Certbot depends on the configuration of your web server. The best way to get started is to use our `interactive guide <https://certbot.eff.org>`_. It generates instructions based on your configuration settings. In most cases, you’ll need `root or administrator access <https://certbot.eff.org/faq/#does-certbot-require-root-administrator-privileges>`_ to your web server to run Certbot.
+
+If you’re using a hosted service and don’t have direct access to your web server, you might not be able to use Certbot. Check with your hosting provider for documentation about uploading certificates or using certificates issued by Let’s Encrypt.
+
+Certbot is a fully-featured, extensible client for the Let's
+Encrypt CA (or any other CA that speaks the `ACME
+<https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-acme-acme.md>`_
+protocol) that can automate the tasks of obtaining certificates and
+configuring webservers to use them. This client runs on Unix-based operating
+systems.
+
+To see the changes made to Certbot between versions please refer to our
+`changelog <https://github.com/certbot/certbot/blob/master/CHANGELOG.md>`_.
+
+Until May 2016, Certbot was named simply ``letsencrypt`` or ``letsencrypt-auto``,
+depending on install method. Instructions on the Internet, and some pieces of the
+software, may still refer to this older name.
+
+Contributing
+------------
+
+If you'd like to contribute to this project please read `Developer Guide
+<https://certbot.eff.org/docs/contributing.html>`_.
+
+.. _installation:
+
+Installation
+------------
+
+The easiest way to install Certbot is by visiting `certbot.eff.org`_, where you can
+find the correct installation instructions for many web server and OS combinations.
+For more information, see `Get Certbot <https://certbot.eff.org/docs/install.html>`_.
+
+.. _certbot.eff.org: https://certbot.eff.org/
+
+How to run the client
+---------------------
+
+In many cases, you can just run ``certbot-auto`` or ``certbot``, and the
+client will guide you through the process of obtaining and installing certs
+interactively.
+
+For full command line help, you can type::
+
+  ./certbot-auto --help all
+
+
+You can also tell it exactly what you want it to do from the command line.
+For instance, if you want to obtain a cert for ``example.com``,
+``www.example.com``, and ``other.example.net``, using the Apache plugin to both
+obtain and install the certs, you could do this::
+
+  ./certbot-auto --apache -d example.com -d www.example.com -d other.example.net
+
+(The first time you run the command, it will make an account, and ask for an
+email and agreement to the Let's Encrypt Subscriber Agreement; you can
+automate those with ``--email`` and ``--agree-tos``)
+
+If you want to use a webserver that doesn't have full plugin support yet, you
+can still use "standalone" or "webroot" plugins to obtain a certificate::
+
+  ./certbot-auto certonly --standalone --email admin@example.com -d example.com -d www.example.com -d other.example.net
+
+
+Understanding the client in more depth
+--------------------------------------
+
+To understand what the client is doing in detail, it's important to
+understand the way it uses plugins.  Please see the `explanation of
+plugins <https://certbot.eff.org/docs/using.html#plugins>`_ in
+the User Guide.
+
+Links
+=====
+
+.. Do not modify this comment unless you know what you're doing. tag:links-begin
+
+Documentation: https://certbot.eff.org/docs
+
+Software project: https://github.com/certbot/certbot
+
+Notes for developers: https://certbot.eff.org/docs/contributing.html
+
+Main Website: https://certbot.eff.org
+
+Let's Encrypt Website: https://letsencrypt.org
+
+IRC Channel: #letsencrypt on `Freenode`_
+
+Community: https://community.letsencrypt.org
+
+ACME spec: http://ietf-wg-acme.github.io/acme/
+
+ACME working area in github: https://github.com/ietf-wg-acme/acme
+
+|build-status| |coverage| |docs| |container|
+
+.. _Freenode: https://webchat.freenode.net?channels=%23letsencrypt
+
+.. |build-status| image:: https://travis-ci.org/certbot/certbot.svg?branch=master
+   :target: https://travis-ci.org/certbot/certbot
+   :alt: Travis CI status
+
+.. |coverage| image:: https://coveralls.io/repos/certbot/certbot/badge.svg?branch=master
+   :target: https://coveralls.io/r/certbot/certbot
+   :alt: Coverage status
+
+.. |docs| image:: https://readthedocs.org/projects/letsencrypt/badge/
+   :target: https://readthedocs.org/projects/letsencrypt/
+   :alt: Documentation status
+
+.. |container| image:: https://quay.io/repository/letsencrypt/letsencrypt/status
+   :target: https://quay.io/repository/letsencrypt/letsencrypt
+   :alt: Docker Repository on Quay.io
+
+.. Do not modify this comment unless you know what you're doing. tag:links-end
+
+System Requirements
+===================
+
+See https://certbot.eff.org/docs/install.html#system-requirements.
+
+.. Do not modify this comment unless you know what you're doing. tag:intro-end
+
+.. Do not modify this comment unless you know what you're doing. tag:features-begin
+
+Current Features
+=====================
+
+* Supports multiple web servers:
+
+  - apache/2.x
+  - nginx/0.8.48+
+  - webroot (adds files to webroot directories in order to prove control of
+    domains and obtain certs)
+  - standalone (runs its own simple webserver to prove you control a domain)
+  - other server software via `third party plugins <https://certbot.eff.org/docs/using.html#third-party-plugins>`_
+
+* The private key is generated locally on your system.
+* Can talk to the Let's Encrypt CA or optionally to other ACME
+  compliant services.
+* Can get domain-validated (DV) certificates.
+* Can revoke certificates.
+* Adjustable RSA key bit-length (2048 (default), 4096, ...).
+* Can optionally install a http -> https redirect, so your site effectively
+  runs https only (Apache only)
+* Fully automated.
+* Configuration changes are logged and can be reverted.
+* Supports an interactive text UI, or can be driven entirely from the
+  command line.
+* Free and Open Source Software, made with Python.
+
+.. Do not modify this comment unless you know what you're doing. tag:features-end
+
+For extensive documentation on using and contributing to Certbot, go to https://certbot.eff.org/docs. If you would like to contribute to the project or run the latest code from git, you should read our `developer guide <https://certbot.eff.org/docs/contributing.html>`_.

acme/MANIFEST.in

@@ -1,8 +1,5 @@
 include LICENSE.txt
 include README.rst
-include pytest.ini
 recursive-include docs *
 recursive-include examples *
-recursive-include tests *
-global-exclude __pycache__
-global-exclude *.py[cod]
+recursive-include acme/testdata *

acme/acme/__init__.py

@@ -1,22 +1,22 @@
 """ACME protocol implementation.
 
-This module is an implementation of the `ACME protocol`_.
+This module is an implementation of the `ACME protocol`_. Latest
+supported version: `draft-ietf-acme-01`_.
+
 
 .. _`ACME protocol`: https://ietf-wg-acme.github.io/acme
 
+.. _`draft-ietf-acme-01`:
+  https://github.com/ietf-wg-acme/acme/tree/draft-ietf-acme-acme-01
+
 """
 import sys
 import warnings
 
-# This code exists to keep backwards compatibility with people using acme.jose
-# before it became the standalone josepy package.
-#
-# It is based on
-# https://github.com/requests/requests/blob/1278ecdf71a312dc2268f3bfc0aabfab3c006dcf/requests/packages.py
-import josepy as jose
-
-for mod in list(sys.modules):
-    # This traversal is apparently necessary such that the identities are
-    # preserved (acme.jose.* is josepy.*)
-    if mod == 'josepy' or mod.startswith('josepy.'):
-        sys.modules['acme.' + mod.replace('josepy', 'jose', 1)] = sys.modules[mod]
+for (major, minor) in [(2, 6), (3, 3)]:
+    if sys.version_info[:2] == (major, minor):
+        warnings.warn(
+                "Python {0}.{1} support will be dropped in the next release of "
+                "acme. Please upgrade your Python version.".format(major, minor),
+                DeprecationWarning,
+        ) #pragma: no cover

acme/acme/challenges.py

@@ -3,19 +3,25 @@ import abc
 import functools
 import hashlib
 import logging
+import socket
 
 from cryptography.hazmat.primitives import hashes  # type: ignore
 import josepy as jose
+import OpenSSL
 import requests
-import six
 
+from acme import errors
+from acme import crypto_util
 from acme import fields
 
 logger = logging.getLogger(__name__)
 
 
+# pylint: disable=too-few-public-methods
+
+
 class Challenge(jose.TypedJSONObjectWithFields):
-    # _fields_to_partial_json
+    # _fields_to_partial_json | pylint: disable=abstract-method
     """ACME challenge."""
     TYPES = {}  # type: dict
 
@@ -29,7 +35,7 @@ class Challenge(jose.TypedJSONObjectWithFields):
 
 
 class ChallengeResponse(jose.TypedJSONObjectWithFields):
-    # _fields_to_partial_json
+    # _fields_to_partial_json | pylint: disable=abstract-method
     """ACME challenge response."""
     TYPES = {}  # type: dict
     resource_type = 'challenge'
@@ -54,7 +60,8 @@ class UnrecognizedChallenge(Challenge):
         object.__setattr__(self, "jobj", jobj)
 
     def to_partial_json(self):
-        return self.jobj  # pylint: disable=no-member
+        # pylint: disable=no-member
+        return self.jobj
 
     @classmethod
     def from_json(cls, jobj):
@@ -87,7 +94,6 @@ class _TokenChallenge(Challenge):
         """
         # TODO: check that path combined with uri does not go above
         # URI_ROOT_PATH!
-        # pylint: disable=unsupported-membership-test
         return b'..' not in self.token and b'/' not in self.token
 
 
@@ -112,7 +118,7 @@ class KeyAuthorizationChallengeResponse(ChallengeResponse):
         :rtype: bool
 
         """
-        parts = self.key_authorization.split('.')
+        parts = self.key_authorization.split('.')  # pylint: disable=no-member
         if len(parts) != 2:
             logger.debug("Key authorization (%r) is not well formed",
                          self.key_authorization)
@@ -132,21 +138,17 @@ class KeyAuthorizationChallengeResponse(ChallengeResponse):
 
         return True
 
-    def to_partial_json(self):
-        jobj = super(KeyAuthorizationChallengeResponse, self).to_partial_json()
-        jobj.pop('keyAuthorization', None)
-        return jobj
 
-
-@six.add_metaclass(abc.ABCMeta)
 class KeyAuthorizationChallenge(_TokenChallenge):
+    # pylint: disable=abstract-class-little-used,too-many-ancestors
     """Challenge based on Key Authorization.
 
     :param response_cls: Subclass of `KeyAuthorizationChallengeResponse`
         that will be used to generate `response`.
-    :param str typ: type of the challenge
+
     """
-    typ = NotImplemented
+    __metaclass__ = abc.ABCMeta
+
     response_cls = NotImplemented
     thumbprint_hash_function = (
         KeyAuthorizationChallengeResponse.thumbprint_hash_function)
@@ -171,7 +173,7 @@ class KeyAuthorizationChallenge(_TokenChallenge):
         :rtype: KeyAuthorizationChallengeResponse
 
         """
-        return self.response_cls(  # pylint: disable=not-callable
+        return self.response_cls(
             key_authorization=self.key_authorization(account_key))
 
     @abc.abstractmethod
@@ -208,7 +210,7 @@ class DNS01Response(KeyAuthorizationChallengeResponse):
     """ACME dns-01 challenge response."""
     typ = "dns-01"
 
-    def simple_verify(self, chall, domain, account_public_key):  # pylint: disable=unused-argument
+    def simple_verify(self, chall, domain, account_public_key):
         """Simple verify.
 
         This method no longer checks DNS records and is a simple wrapper
@@ -224,13 +226,14 @@ class DNS01Response(KeyAuthorizationChallengeResponse):
         :rtype: bool
 
         """
+        # pylint: disable=unused-argument
         verified = self.verify(chall, account_public_key)
         if not verified:
             logger.debug("Verification of key authorization in response failed")
         return verified
 
 
-@Challenge.register
+@Challenge.register  # pylint: disable=too-many-ancestors
 class DNS01(KeyAuthorizationChallenge):
     """ACME dns-01 challenge."""
     response_cls = DNS01Response
@@ -320,7 +323,7 @@ class HTTP01Response(KeyAuthorizationChallengeResponse):
         return True
 
 
-@Challenge.register
+@Challenge.register  # pylint: disable=too-many-ancestors
 class HTTP01(KeyAuthorizationChallenge):
     """ACME http-01 challenge."""
     response_cls = HTTP01Response
@@ -361,33 +364,149 @@ class HTTP01(KeyAuthorizationChallenge):
 
 
 @ChallengeResponse.register
-class TLSALPN01Response(KeyAuthorizationChallengeResponse):
-    """ACME TLS-ALPN-01 challenge response.
+class TLSSNI01Response(KeyAuthorizationChallengeResponse):
+    """ACME tls-sni-01 challenge response."""
+    typ = "tls-sni-01"
 
-    This class only allows initiating a TLS-ALPN-01 challenge returned from the
-    CA. Full support for responding to TLS-ALPN-01 challenges by generating and
-    serving the expected response certificate is not currently provided.
-    """
-    typ = "tls-alpn-01"
+    DOMAIN_SUFFIX = b".acme.invalid"
+    """Domain name suffix."""
 
+    PORT = 443
+    """Verification port as defined by the protocol.
 
-@Challenge.register
-class TLSALPN01(KeyAuthorizationChallenge):
-    """ACME tls-alpn-01 challenge.
-
-    This class simply allows parsing the TLS-ALPN-01 challenge returned from
-    the CA. Full TLS-ALPN-01 support is not currently provided.
+    You can override it (e.g. for testing) by passing ``port`` to
+    `simple_verify`.
 
     """
-    typ = "tls-alpn-01"
-    response_cls = TLSALPN01Response
+
+    @property
+    def z(self):  # pylint: disable=invalid-name
+        """``z`` value used for verification.
+
+        :rtype bytes:
+
+        """
+        return hashlib.sha256(
+            self.key_authorization.encode("utf-8")).hexdigest().lower().encode()
+
+    @property
+    def z_domain(self):
+        """Domain name used for verification, generated from `z`.
+
+        :rtype bytes:
+
+        """
+        return self.z[:32] + b'.' + self.z[32:] + self.DOMAIN_SUFFIX
+
+    def gen_cert(self, key=None, bits=2048):
+        """Generate tls-sni-01 certificate.
+
+        :param OpenSSL.crypto.PKey key: Optional private key used in
+            certificate generation. If not provided (``None``), then
+            fresh key will be generated.
+        :param int bits: Number of bits for newly generated key.
+
+        :rtype: `tuple` of `OpenSSL.crypto.X509` and `OpenSSL.crypto.PKey`
+
+        """
+        if key is None:
+            key = OpenSSL.crypto.PKey()
+            key.generate_key(OpenSSL.crypto.TYPE_RSA, bits)
+        return crypto_util.gen_ss_cert(key, [
+            # z_domain is too big to fit into CN, hence first dummy domain
+            'dummy', self.z_domain.decode()], force_san=True), key
+
+    def probe_cert(self, domain, **kwargs):
+        """Probe tls-sni-01 challenge certificate.
+
+        :param unicode domain:
+
+        """
+        # TODO: domain is not necessary if host is provided
+        if "host" not in kwargs:
+            host = socket.gethostbyname(domain)
+            logger.debug('%s resolved to %s', domain, host)
+            kwargs["host"] = host
+
+        kwargs.setdefault("port", self.PORT)
+        kwargs["name"] = self.z_domain
+        # TODO: try different methods?
+        # pylint: disable=protected-access
+        return crypto_util.probe_sni(**kwargs)
+
+    def verify_cert(self, cert):
+        """Verify tls-sni-01 challenge certificate.
+
+        :param OpensSSL.crypto.X509 cert: Challenge certificate.
+
+        :returns: Whether the certificate was successfully verified.
+        :rtype: bool
+
+        """
+        # pylint: disable=protected-access
+        sans = crypto_util._pyopenssl_cert_or_req_san(cert)
+        logger.debug('Certificate %s. SANs: %s', cert.digest('sha256'), sans)
+        return self.z_domain.decode() in sans
+
+    def simple_verify(self, chall, domain, account_public_key,
+                      cert=None, **kwargs):
+        """Simple verify.
+
+        Verify ``validation`` using ``account_public_key``, optionally
+        probe tls-sni-01 certificate and check using `verify_cert`.
+
+        :param .challenges.TLSSNI01 chall: Corresponding challenge.
+        :param str domain: Domain name being validated.
+        :param JWK account_public_key:
+        :param OpenSSL.crypto.X509 cert: Optional certificate. If not
+            provided (``None``) certificate will be retrieved using
+            `probe_cert`.
+        :param int port: Port used to probe the certificate.
+
+
+        :returns: ``True`` iff client's control of the domain has been
+            verified.
+        :rtype: bool
+
+        """
+        if not self.verify(chall, account_public_key):
+            logger.debug("Verification of key authorization in response failed")
+            return False
+
+        if cert is None:
+            try:
+                cert = self.probe_cert(domain=domain, **kwargs)
+            except errors.Error as error:
+                logger.debug(error, exc_info=True)
+                return False
+
+        return self.verify_cert(cert)
+
+
+@Challenge.register  # pylint: disable=too-many-ancestors
+class TLSSNI01(KeyAuthorizationChallenge):
+    """ACME tls-sni-01 challenge."""
+    response_cls = TLSSNI01Response
+    typ = response_cls.typ
+
+    # boulder#962, ietf-wg-acme#22
+    #n = jose.Field("n", encoder=int, decoder=int)
 
     def validation(self, account_key, **kwargs):
-        """Generate validation for the challenge."""
-        raise NotImplementedError()
+        """Generate validation.
+
+        :param JWK account_key:
+        :param OpenSSL.crypto.PKey cert_key: Optional private key used
+            in certificate generation. If not provided (``None``), then
+            fresh key will be generated.
+
+        :rtype: `tuple` of `OpenSSL.crypto.X509` and `OpenSSL.crypto.PKey`
+
+        """
+        return self.response(account_key).gen_cert(key=kwargs.get('cert_key'))
 
 
-@Challenge.register
+@Challenge.register  # pylint: disable=too-many-ancestors
 class DNS(_TokenChallenge):
     """ACME "dns" challenge."""
     typ = "dns"

acme/acme/challenges_test.py

@@ -3,10 +3,13 @@ import unittest
 
 import josepy as jose
 import mock
+import OpenSSL
 import requests
-from six.moves.urllib import parse as urllib_parse
 
-import test_util
+from six.moves.urllib import parse as urllib_parse  # pylint: disable=import-error
+
+from acme import errors
+from acme import test_util
 
 CERT = test_util.load_comparable_cert('cert.pem')
 KEY = jose.JWKRSA(key=test_util.load_rsa_private_key('rsa512_key.pem'))
@@ -18,6 +21,7 @@ class ChallengeTest(unittest.TestCase):
         from acme.challenges import Challenge
         from acme.challenges import UnrecognizedChallenge
         chall = UnrecognizedChallenge({"type": "foo"})
+        # pylint: disable=no-member
         self.assertEqual(chall, Challenge.from_json(chall.jobj))
 
 
@@ -73,6 +77,7 @@ class KeyAuthorizationChallengeResponseTest(unittest.TestCase):
 
 
 class DNS01ResponseTest(unittest.TestCase):
+    # pylint: disable=too-many-instance-attributes
 
     def setUp(self):
         from acme.challenges import DNS01Response
@@ -88,8 +93,7 @@ class DNS01ResponseTest(unittest.TestCase):
         self.response = self.chall.response(KEY)
 
     def test_to_partial_json(self):
-        self.assertEqual({k: v for k, v in self.jmsg.items() if k != 'keyAuthorization'},
-                         self.msg.to_partial_json())
+        self.assertEqual(self.jmsg, self.msg.to_partial_json())
 
     def test_from_json(self):
         from acme.challenges import DNS01Response
@@ -144,6 +148,7 @@ class DNS01Test(unittest.TestCase):
 
 
 class HTTP01ResponseTest(unittest.TestCase):
+    # pylint: disable=too-many-instance-attributes
 
     def setUp(self):
         from acme.challenges import HTTP01Response
@@ -159,8 +164,7 @@ class HTTP01ResponseTest(unittest.TestCase):
         self.response = self.chall.response(KEY)
 
     def test_to_partial_json(self):
-        self.assertEqual({k: v for k, v in self.jmsg.items() if k != 'keyAuthorization'},
-                         self.msg.to_partial_json())
+        self.assertEqual(self.jmsg, self.msg.to_partial_json())
 
     def test_from_json(self):
         from acme.challenges import HTTP01Response
@@ -253,42 +257,114 @@ class HTTP01Test(unittest.TestCase):
             self.msg.update(token=b'..').good_token)
 
 
-class TLSALPN01ResponseTest(unittest.TestCase):
+class TLSSNI01ResponseTest(unittest.TestCase):
+    # pylint: disable=too-many-instance-attributes
 
     def setUp(self):
-        from acme.challenges import TLSALPN01Response
-        self.msg = TLSALPN01Response(key_authorization=u'foo')
+        from acme.challenges import TLSSNI01
+        self.chall = TLSSNI01(
+            token=jose.b64decode(b'a82d5ff8ef740d12881f6d3c2277ab2e'))
+
+        self.response = self.chall.response(KEY)
         self.jmsg = {
             'resource': 'challenge',
-            'type': 'tls-alpn-01',
-            'keyAuthorization': u'foo',
+            'type': 'tls-sni-01',
+            'keyAuthorization': self.response.key_authorization,
         }
 
-        from acme.challenges import TLSALPN01
-        self.chall = TLSALPN01(token=(b'x' * 16))
-        self.response = self.chall.response(KEY)
+        # pylint: disable=invalid-name
+        label1 = b'dc38d9c3fa1a4fdcc3a5501f2d38583f'
+        label2 = b'b7793728f084394f2a1afd459556bb5c'
+        self.z = label1 + label2
+        self.z_domain = label1 + b'.' + label2 + b'.acme.invalid'
+        self.domain = 'foo.com'
+
+    def test_z_and_domain(self):
+        self.assertEqual(self.z, self.response.z)
+        self.assertEqual(self.z_domain, self.response.z_domain)
 
     def test_to_partial_json(self):
-        self.assertEqual({k: v for k, v in self.jmsg.items() if k != 'keyAuthorization'},
-                         self.msg.to_partial_json())
+        self.assertEqual(self.jmsg, self.response.to_partial_json())
 
     def test_from_json(self):
-        from acme.challenges import TLSALPN01Response
-        self.assertEqual(self.msg, TLSALPN01Response.from_json(self.jmsg))
+        from acme.challenges import TLSSNI01Response
+        self.assertEqual(self.response, TLSSNI01Response.from_json(self.jmsg))
 
     def test_from_json_hashable(self):
-        from acme.challenges import TLSALPN01Response
-        hash(TLSALPN01Response.from_json(self.jmsg))
+        from acme.challenges import TLSSNI01Response
+        hash(TLSSNI01Response.from_json(self.jmsg))
+
+    @mock.patch('acme.challenges.socket.gethostbyname')
+    @mock.patch('acme.challenges.crypto_util.probe_sni')
+    def test_probe_cert(self, mock_probe_sni, mock_gethostbyname):
+        mock_gethostbyname.return_value = '127.0.0.1'
+        self.response.probe_cert('foo.com')
+        mock_gethostbyname.assert_called_once_with('foo.com')
+        mock_probe_sni.assert_called_once_with(
+            host='127.0.0.1', port=self.response.PORT,
+            name=self.z_domain)
+
+        self.response.probe_cert('foo.com', host='8.8.8.8')
+        mock_probe_sni.assert_called_with(
+            host='8.8.8.8', port=mock.ANY, name=mock.ANY)
+
+        self.response.probe_cert('foo.com', port=1234)
+        mock_probe_sni.assert_called_with(
+            host=mock.ANY, port=1234, name=mock.ANY)
+
+        self.response.probe_cert('foo.com', bar='baz')
+        mock_probe_sni.assert_called_with(
+            host=mock.ANY, port=mock.ANY, name=mock.ANY, bar='baz')
+
+        self.response.probe_cert('foo.com', name=b'xxx')
+        mock_probe_sni.assert_called_with(
+            host=mock.ANY, port=mock.ANY,
+            name=self.z_domain)
+
+    def test_gen_verify_cert(self):
+        key1 = test_util.load_pyopenssl_private_key('rsa512_key.pem')
+        cert, key2 = self.response.gen_cert(key1)
+        self.assertEqual(key1, key2)
+        self.assertTrue(self.response.verify_cert(cert))
+
+    def test_gen_verify_cert_gen_key(self):
+        cert, key = self.response.gen_cert()
+        self.assertTrue(isinstance(key, OpenSSL.crypto.PKey))
+        self.assertTrue(self.response.verify_cert(cert))
+
+    def test_verify_bad_cert(self):
+        self.assertFalse(self.response.verify_cert(
+            test_util.load_cert('cert.pem')))
+
+    def test_simple_verify_bad_key_authorization(self):
+        key2 = jose.JWKRSA.load(test_util.load_vector('rsa256_key.pem'))
+        self.response.simple_verify(self.chall, "local", key2.public_key())
+
+    @mock.patch('acme.challenges.TLSSNI01Response.verify_cert', autospec=True)
+    def test_simple_verify(self, mock_verify_cert):
+        mock_verify_cert.return_value = mock.sentinel.verification
+        self.assertEqual(
+            mock.sentinel.verification, self.response.simple_verify(
+                self.chall, self.domain, KEY.public_key(),
+                cert=mock.sentinel.cert))
+        mock_verify_cert.assert_called_once_with(
+            self.response, mock.sentinel.cert)
+
+    @mock.patch('acme.challenges.TLSSNI01Response.probe_cert')
+    def test_simple_verify_false_on_probe_error(self, mock_probe_cert):
+        mock_probe_cert.side_effect = errors.Error
+        self.assertFalse(self.response.simple_verify(
+            self.chall, self.domain, KEY.public_key()))
 
 
-class TLSALPN01Test(unittest.TestCase):
+class TLSSNI01Test(unittest.TestCase):
 
     def setUp(self):
-        from acme.challenges import TLSALPN01
-        self.msg = TLSALPN01(
+        from acme.challenges import TLSSNI01
+        self.msg = TLSSNI01(
             token=jose.b64decode('a82d5ff8ef740d12881f6d3c2277ab2e'))
         self.jmsg = {
-            'type': 'tls-alpn-01',
+            'type': 'tls-sni-01',
             'token': 'a82d5ff8ef740d12881f6d3c2277ab2e',
         }
 
@@ -296,21 +372,25 @@ class TLSALPN01Test(unittest.TestCase):
         self.assertEqual(self.jmsg, self.msg.to_partial_json())
 
     def test_from_json(self):
-        from acme.challenges import TLSALPN01
-        self.assertEqual(self.msg, TLSALPN01.from_json(self.jmsg))
+        from acme.challenges import TLSSNI01
+        self.assertEqual(self.msg, TLSSNI01.from_json(self.jmsg))
 
     def test_from_json_hashable(self):
-        from acme.challenges import TLSALPN01
-        hash(TLSALPN01.from_json(self.jmsg))
+        from acme.challenges import TLSSNI01
+        hash(TLSSNI01.from_json(self.jmsg))
 
     def test_from_json_invalid_token_length(self):
-        from acme.challenges import TLSALPN01
+        from acme.challenges import TLSSNI01
         self.jmsg['token'] = jose.encode_b64jose(b'abcd')
         self.assertRaises(
-            jose.DeserializationError, TLSALPN01.from_json, self.jmsg)
+            jose.DeserializationError, TLSSNI01.from_json, self.jmsg)
 
-    def test_validation(self):
-        self.assertRaises(NotImplementedError, self.msg.validation, KEY)
+    @mock.patch('acme.challenges.TLSSNI01Response.gen_cert')
+    def test_validation(self, mock_gen_cert):
+        mock_gen_cert.return_value = ('cert', 'key')
+        self.assertEqual(('cert', 'key'), self.msg.validation(
+            KEY, cert_key=mock.sentinel.cert_key))
+        mock_gen_cert.assert_called_once_with(key=mock.sentinel.cert_key)
 
 
 class DNSTest(unittest.TestCase):

acme/acme/client.py

@@ -5,26 +5,21 @@ import datetime
 from email.utils import parsedate_tz
 import heapq
 import logging
-import re
-import sys
 import time
 
-import josepy as jose
-import OpenSSL
-import requests
-from requests.adapters import HTTPAdapter
-from requests_toolbelt.adapters.source import SourceAddressAdapter
 import six
 from six.moves import http_client  # pylint: disable=import-error
 
-from acme import crypto_util
+import josepy as jose
+import OpenSSL
+import re
+import requests
+import sys
+
 from acme import errors
 from acme import jws
 from acme import messages
-from acme.magic_typing import Dict  # pylint: disable=unused-import, no-name-in-module
-from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
-from acme.magic_typing import Set  # pylint: disable=unused-import, no-name-in-module
-from acme.magic_typing import Text  # pylint: disable=unused-import, no-name-in-module
+
 
 logger = logging.getLogger(__name__)
 
@@ -44,23 +39,39 @@ DEFAULT_NETWORK_TIMEOUT = 45
 DER_CONTENT_TYPE = 'application/pkix-cert'
 
 
-class ClientBase(object):
-    """ACME client base object.
+class Client(object):  # pylint: disable=too-many-instance-attributes
+    """ACME client.
+
+    .. todo::
+       Clean up raised error types hierarchy, document, and handle (wrap)
+       instances of `.DeserializationError` raised in `from_json()`.
 
     :ivar messages.Directory directory:
-    :ivar .ClientNetwork net: Client network.
-    :ivar int acme_version: ACME protocol version. 1 or 2.
+    :ivar key: `.JWK` (private)
+    :ivar alg: `.JWASignature`
+    :ivar bool verify_ssl: Verify SSL certificates?
+    :ivar .ClientNetwork net: Client network. Useful for testing. If not
+        supplied, it will be initialized using `key`, `alg` and
+        `verify_ssl`.
+
     """
-    def __init__(self, directory, net, acme_version):
+
+    def __init__(self, directory, key, alg=jose.RS256, verify_ssl=True,
+                 net=None):
         """Initialize.
 
-        :param .messages.Directory directory: Directory Resource
-        :param .ClientNetwork net: Client network.
-        :param int acme_version: ACME protocol version. 1 or 2.
+        :param directory: Directory Resource (`.messages.Directory`) or
+            URI from which the resource will be downloaded.
+
         """
-        self.directory = directory
-        self.net = net
-        self.acme_version = acme_version
+        self.key = key
+        self.net = ClientNetwork(key, alg, verify_ssl) if net is None else net
+
+        if isinstance(directory, six.string_types):
+            self.directory = messages.Directory.from_json(
+                self.net.get(directory).json())
+        else:
+            self.directory = directory
 
     @classmethod
     def _regr_from_response(cls, response, uri=None, terms_of_service=None):
@@ -72,8 +83,28 @@ class ClientBase(object):
             uri=response.headers.get('Location', uri),
             terms_of_service=terms_of_service)
 
+    def register(self, new_reg=None):
+        """Register.
+
+        :param .NewRegistration new_reg:
+
+        :returns: Registration Resource.
+        :rtype: `.RegistrationResource`
+
+        """
+        new_reg = messages.NewRegistration() if new_reg is None else new_reg
+        assert isinstance(new_reg, messages.NewRegistration)
+
+        response = self.net.post(self.directory[new_reg], new_reg)
+        # TODO: handle errors
+        assert response.status_code == http_client.CREATED
+
+        # "Instance of 'Field' has no key/contact member" bug:
+        # pylint: disable=no-member
+        return self._regr_from_response(response)
+
     def _send_recv_regr(self, regr, body):
-        response = self._post(regr.uri, body)
+        response = self.net.post(regr.uri, body)
 
         # TODO: Boulder returns httplib.ACCEPTED
         #assert response.status_code == httplib.OK
@@ -85,15 +116,6 @@ class ClientBase(object):
             response, uri=regr.uri,
             terms_of_service=regr.terms_of_service)
 
-    def _post(self, *args, **kwargs):
-        """Wrapper around self.net.post that adds the acme_version.
-
-        """
-        kwargs.setdefault('acme_version', self.acme_version)
-        if hasattr(self.directory, 'newNonce'):
-            kwargs.setdefault('new_nonce_url', getattr(self.directory, 'newNonce'))
-        return self.net.post(*args, **kwargs)
-
     def update_registration(self, regr, update=None):
         """Update registration.
 
@@ -108,7 +130,6 @@ class ClientBase(object):
         update = regr.body if update is None else update
         body = messages.UpdateRegistration(**dict(update))
         updated_regr = self._send_recv_regr(regr, body=body)
-        self.net.account = updated_regr
         return updated_regr
 
     def deactivate_registration(self, regr):
@@ -123,30 +144,74 @@ class ClientBase(object):
         """
         return self.update_registration(regr, update={'status': 'deactivated'})
 
-    def deactivate_authorization(self, authzr):
-        # type: (messages.AuthorizationResource) -> messages.AuthorizationResource
-        """Deactivate authorization.
+    def query_registration(self, regr):
+        """Query server about registration.
 
-        :param messages.AuthorizationResource authzr: The Authorization resource
-            to be deactivated.
-
-        :returns: The Authorization resource that was deactivated.
-        :rtype: `.AuthorizationResource`
+        :param messages.RegistrationResource: Existing Registration
+            Resource.
 
         """
-        body = messages.UpdateAuthorization(status='deactivated')
-        response = self._post(authzr.uri, body)
-        return self._authzr_from_response(response,
-            authzr.body.identifier, authzr.uri)
+        return self._send_recv_regr(regr, messages.UpdateRegistration())
 
-    def _authzr_from_response(self, response, identifier=None, uri=None):
+    def agree_to_tos(self, regr):
+        """Agree to the terms-of-service.
+
+        Agree to the terms-of-service in a Registration Resource.
+
+        :param regr: Registration Resource.
+        :type regr: `.RegistrationResource`
+
+        :returns: Updated Registration Resource.
+        :rtype: `.RegistrationResource`
+
+        """
+        return self.update_registration(
+            regr.update(body=regr.body.update(agreement=regr.terms_of_service)))
+
+    def _authzr_from_response(self, response, identifier, uri=None):
         authzr = messages.AuthorizationResource(
             body=messages.Authorization.from_json(response.json()),
             uri=response.headers.get('Location', uri))
-        if identifier is not None and authzr.body.identifier != identifier:
+        if authzr.body.identifier != identifier:
             raise errors.UnexpectedUpdate(authzr)
         return authzr
 
+    def request_challenges(self, identifier, new_authzr_uri=None):
+        """Request challenges.
+
+        :param .messages.Identifier identifier: Identifier to be challenged.
+        :param str new_authzr_uri: Deprecated. Do not use.
+
+        :returns: Authorization Resource.
+        :rtype: `.AuthorizationResource`
+
+        """
+        if new_authzr_uri is not None:
+            logger.debug("request_challenges with new_authzr_uri deprecated.")
+        new_authz = messages.NewAuthorization(identifier=identifier)
+        response = self.net.post(self.directory.new_authz, new_authz)
+        # TODO: handle errors
+        assert response.status_code == http_client.CREATED
+        return self._authzr_from_response(response, identifier)
+
+    def request_domain_challenges(self, domain, new_authzr_uri=None):
+        """Request challenges for domain names.
+
+        This is simply a convenience function that wraps around
+        `request_challenges`, but works with domain names instead of
+        generic identifiers. See ``request_challenges`` for more
+        documentation.
+
+        :param str domain: Domain name to be challenged.
+        :param str new_authzr_uri: Deprecated. Do not use.
+
+        :returns: Authorization Resource.
+        :rtype: `.AuthorizationResource`
+
+        """
+        return self.request_challenges(messages.Identifier(
+            typ=messages.IDENTIFIER_FQDN, value=domain), new_authzr_uri)
+
     def answer_challenge(self, challb, response):
         """Answer challenge.
 
@@ -162,7 +227,7 @@ class ClientBase(object):
         :raises .UnexpectedUpdate:
 
         """
-        response = self._post(challb.uri, response)
+        response = self.net.post(challb.uri, response)
         try:
             authzr_uri = response.links['up']['url']
         except KeyError:
@@ -207,149 +272,21 @@ class ClientBase(object):
 
         return datetime.datetime.now() + datetime.timedelta(seconds=seconds)
 
-    def _revoke(self, cert, rsn, url):
-        """Revoke certificate.
+    def poll(self, authzr):
+        """Poll Authorization Resource for status.
 
-        :param .ComparableX509 cert: `OpenSSL.crypto.X509` wrapped in
-            `.ComparableX509`
+        :param authzr: Authorization Resource
+        :type authzr: `.AuthorizationResource`
 
-        :param int rsn: Reason code for certificate revocation.
+        :returns: Updated Authorization Resource and HTTP response.
 
-        :param str url: ACME URL to post to
-
-        :raises .ClientError: If revocation is unsuccessful.
+        :rtype: (`.AuthorizationResource`, `requests.Response`)
 
         """
-        response = self._post(url,
-                              messages.Revocation(
-                                certificate=cert,
-                                reason=rsn))
-        if response.status_code != http_client.OK:
-            raise errors.ClientError(
-                'Successful revocation must return HTTP OK status')
-
-
-class Client(ClientBase):
-    """ACME client for a v1 API.
-
-    .. todo::
-       Clean up raised error types hierarchy, document, and handle (wrap)
-       instances of `.DeserializationError` raised in `from_json()`.
-
-    :ivar messages.Directory directory:
-    :ivar key: `josepy.JWK` (private)
-    :ivar alg: `josepy.JWASignature`
-    :ivar bool verify_ssl: Verify SSL certificates?
-    :ivar .ClientNetwork net: Client network. Useful for testing. If not
-        supplied, it will be initialized using `key`, `alg` and
-        `verify_ssl`.
-
-    """
-
-    def __init__(self, directory, key, alg=jose.RS256, verify_ssl=True,
-                 net=None):
-        """Initialize.
-
-        :param directory: Directory Resource (`.messages.Directory`) or
-            URI from which the resource will be downloaded.
-
-        """
-        self.key = key
-        if net is None:
-            net = ClientNetwork(key, alg=alg, verify_ssl=verify_ssl)
-
-        if isinstance(directory, six.string_types):
-            directory = messages.Directory.from_json(
-                net.get(directory).json())
-        super(Client, self).__init__(directory=directory,
-            net=net, acme_version=1)
-
-    def register(self, new_reg=None):
-        """Register.
-
-        :param .NewRegistration new_reg:
-
-        :returns: Registration Resource.
-        :rtype: `.RegistrationResource`
-
-        """
-        new_reg = messages.NewRegistration() if new_reg is None else new_reg
-        response = self._post(self.directory[new_reg], new_reg)
-        # TODO: handle errors
-        assert response.status_code == http_client.CREATED
-
-        # "Instance of 'Field' has no key/contact member" bug:
-        return self._regr_from_response(response)
-
-    def query_registration(self, regr):
-        """Query server about registration.
-
-        :param messages.RegistrationResource: Existing Registration
-            Resource.
-
-        """
-        return self._send_recv_regr(regr, messages.UpdateRegistration())
-
-    def agree_to_tos(self, regr):
-        """Agree to the terms-of-service.
-
-        Agree to the terms-of-service in a Registration Resource.
-
-        :param regr: Registration Resource.
-        :type regr: `.RegistrationResource`
-
-        :returns: Updated Registration Resource.
-        :rtype: `.RegistrationResource`
-
-        """
-        return self.update_registration(
-            regr.update(body=regr.body.update(agreement=regr.terms_of_service)))
-
-    def request_challenges(self, identifier, new_authzr_uri=None):
-        """Request challenges.
-
-        :param .messages.Identifier identifier: Identifier to be challenged.
-        :param str new_authzr_uri: Deprecated. Do not use.
-
-        :returns: Authorization Resource.
-        :rtype: `.AuthorizationResource`
-
-        :raises errors.WildcardUnsupportedError: if a wildcard is requested
-
-        """
-        if new_authzr_uri is not None:
-            logger.debug("request_challenges with new_authzr_uri deprecated.")
-
-        if identifier.value.startswith("*"):
-            raise errors.WildcardUnsupportedError(
-                "Requesting an authorization for a wildcard name is"
-                " forbidden by this version of the ACME protocol.")
-
-        new_authz = messages.NewAuthorization(identifier=identifier)
-        response = self._post(self.directory.new_authz, new_authz)
-        # TODO: handle errors
-        assert response.status_code == http_client.CREATED
-        return self._authzr_from_response(response, identifier)
-
-    def request_domain_challenges(self, domain, new_authzr_uri=None):
-        """Request challenges for domain names.
-
-        This is simply a convenience function that wraps around
-        `request_challenges`, but works with domain names instead of
-        generic identifiers. See ``request_challenges`` for more
-        documentation.
-
-        :param str domain: Domain name to be challenged.
-        :param str new_authzr_uri: Deprecated. Do not use.
-
-        :returns: Authorization Resource.
-        :rtype: `.AuthorizationResource`
-
-        :raises errors.WildcardUnsupportedError: if a wildcard is requested
-
-        """
-        return self.request_challenges(messages.Identifier(
-            typ=messages.IDENTIFIER_FQDN, value=domain), new_authzr_uri)
+        response = self.net.get(authzr.uri)
+        updated_authzr = self._authzr_from_response(
+            response, authzr.body.identifier, authzr.uri)
+        return updated_authzr, response
 
     def request_issuance(self, csr, authzrs):
         """Request issuance.
@@ -370,7 +307,7 @@ class Client(ClientBase):
         req = messages.CertificateRequest(csr=csr)
 
         content_type = DER_CONTENT_TYPE  # TODO: add 'cert_type 'argument
-        response = self._post(
+        response = self.net.post(
             self.directory.new_cert,
             req,
             content_type=content_type,
@@ -388,22 +325,6 @@ class Client(ClientBase):
             body=jose.ComparableX509(OpenSSL.crypto.load_certificate(
                 OpenSSL.crypto.FILETYPE_ASN1, response.content)))
 
-    def poll(self, authzr):
-        """Poll Authorization Resource for status.
-
-        :param authzr: Authorization Resource
-        :type authzr: `.AuthorizationResource`
-
-        :returns: Updated Authorization Resource and HTTP response.
-
-        :rtype: (`.AuthorizationResource`, `requests.Response`)
-
-        """
-        response = self.net.get(authzr.uri)
-        updated_authzr = self._authzr_from_response(
-            response, authzr.body.identifier, authzr.uri)
-        return updated_authzr, response
-
     def poll_and_request_issuance(
             self, csr, authzrs, mintime=5, max_attempts=10):
         """Poll and request issuance.
@@ -433,8 +354,9 @@ class Client(ClientBase):
             was marked by the CA as invalid
 
         """
+        # pylint: disable=too-many-locals
         assert max_attempts > 0
-        attempts = collections.defaultdict(int) # type: Dict[messages.AuthorizationResource, int]
+        attempts = collections.defaultdict(int)
         exhausted = set()
 
         # priority queue with datetime.datetime (based on Retry-After) as key,
@@ -463,6 +385,7 @@ class Client(ClientBase):
             updated[authzr] = updated_authzr
 
             attempts[authzr] += 1
+            # pylint: disable=no-member
             if updated_authzr.body.status not in (
                     messages.STATUS_VALID, messages.STATUS_INVALID):
                 if attempts[authzr] < max_attempts:
@@ -547,7 +470,7 @@ class Client(ClientBase):
         :rtype: `list` of `OpenSSL.crypto.X509` wrapped in `.ComparableX509`
 
         """
-        chain = [] # type: List[jose.ComparableX509]
+        chain = []
         uri = certr.cert_chain_uri
         while uri is not None and len(chain) < max_length:
             response, cert = self._get_cert(uri)
@@ -569,404 +492,32 @@ class Client(ClientBase):
         :raises .ClientError: If revocation is unsuccessful.
 
         """
-        return self._revoke(cert, rsn, self.directory[messages.Revocation])
-
-
-class ClientV2(ClientBase):
-    """ACME client for a v2 API.
-
-    :ivar messages.Directory directory:
-    :ivar .ClientNetwork net: Client network.
-    """
-
-    def __init__(self, directory, net):
-        """Initialize.
-
-        :param .messages.Directory directory: Directory Resource
-        :param .ClientNetwork net: Client network.
-        """
-        super(ClientV2, self).__init__(directory=directory,
-            net=net, acme_version=2)
-
-    def new_account(self, new_account):
-        """Register.
-
-        :param .NewRegistration new_account:
-
-        :raises .ConflictError: in case the account already exists
-
-        :returns: Registration Resource.
-        :rtype: `.RegistrationResource`
-        """
-        response = self._post(self.directory['newAccount'], new_account)
-        # if account already exists
-        if response.status_code == 200 and 'Location' in response.headers:
-            raise errors.ConflictError(response.headers.get('Location'))
-        # "Instance of 'Field' has no key/contact member" bug:
-        regr = self._regr_from_response(response)
-        self.net.account = regr
-        return regr
-
-    def query_registration(self, regr):
-        """Query server about registration.
-
-        :param messages.RegistrationResource: Existing Registration
-            Resource.
-
-        """
-        self.net.account = regr  # See certbot/certbot#6258
-        # ACME v2 requires to use a POST-as-GET request (POST an empty JWS) here.
-        # This is done by passing None instead of an empty UpdateRegistration to _post().
-        response = self._post(regr.uri, None)
-        self.net.account = self._regr_from_response(response, uri=regr.uri,
-                                                    terms_of_service=regr.terms_of_service)
-        return self.net.account
-
-    def update_registration(self, regr, update=None):
-        """Update registration.
-
-        :param messages.RegistrationResource regr: Registration Resource.
-        :param messages.Registration update: Updated body of the
-            resource. If not provided, body will be taken from `regr`.
-
-        :returns: Updated Registration Resource.
-        :rtype: `.RegistrationResource`
-
-        """
-        # https://github.com/certbot/certbot/issues/6155
-        new_regr = self._get_v2_account(regr)
-        return super(ClientV2, self).update_registration(new_regr, update)
-
-    def _get_v2_account(self, regr):
-        self.net.account = None
-        only_existing_reg = regr.body.update(only_return_existing=True)
-        response = self._post(self.directory['newAccount'], only_existing_reg)
-        updated_uri = response.headers['Location']
-        new_regr = regr.update(uri=updated_uri)
-        self.net.account = new_regr
-        return new_regr
-
-    def new_order(self, csr_pem):
-        """Request a new Order object from the server.
-
-        :param str csr_pem: A CSR in PEM format.
-
-        :returns: The newly created order.
-        :rtype: OrderResource
-        """
-        csr = OpenSSL.crypto.load_certificate_request(OpenSSL.crypto.FILETYPE_PEM, csr_pem)
-        # pylint: disable=protected-access
-        dnsNames = crypto_util._pyopenssl_cert_or_req_all_names(csr)
-
-        identifiers = []
-        for name in dnsNames:
-            identifiers.append(messages.Identifier(typ=messages.IDENTIFIER_FQDN,
-                value=name))
-        order = messages.NewOrder(identifiers=identifiers)
-        response = self._post(self.directory['newOrder'], order)
-        body = messages.Order.from_json(response.json())
-        authorizations = []
-        for url in body.authorizations:  # pylint: disable=not-an-iterable
-            authorizations.append(self._authzr_from_response(self._post_as_get(url), uri=url))
-        return messages.OrderResource(
-            body=body,
-            uri=response.headers.get('Location'),
-            authorizations=authorizations,
-            csr_pem=csr_pem)
-
-    def poll(self, authzr):
-        """Poll Authorization Resource for status.
-
-        :param authzr: Authorization Resource
-        :type authzr: `.AuthorizationResource`
-
-        :returns: Updated Authorization Resource and HTTP response.
-
-        :rtype: (`.AuthorizationResource`, `requests.Response`)
-
-        """
-        response = self._post_as_get(authzr.uri)
-        updated_authzr = self._authzr_from_response(
-            response, authzr.body.identifier, authzr.uri)
-        return updated_authzr, response
-
-    def poll_and_finalize(self, orderr, deadline=None):
-        """Poll authorizations and finalize the order.
-
-        If no deadline is provided, this method will timeout after 90
-        seconds.
-
-        :param messages.OrderResource orderr: order to finalize
-        :param datetime.datetime deadline: when to stop polling and timeout
-
-        :returns: finalized order
-        :rtype: messages.OrderResource
-
-        """
-        if deadline is None:
-            deadline = datetime.datetime.now() + datetime.timedelta(seconds=90)
-        orderr = self.poll_authorizations(orderr, deadline)
-        return self.finalize_order(orderr, deadline)
-
-    def poll_authorizations(self, orderr, deadline):
-        """Poll Order Resource for status."""
-        responses = []
-        for url in orderr.body.authorizations:
-            while datetime.datetime.now() < deadline:
-                authzr = self._authzr_from_response(self._post_as_get(url), uri=url)
-                if authzr.body.status != messages.STATUS_PENDING:
-                    responses.append(authzr)
-                    break
-                time.sleep(1)
-        # If we didn't get a response for every authorization, we fell through
-        # the bottom of the loop due to hitting the deadline.
-        if len(responses) < len(orderr.body.authorizations):
-            raise errors.TimeoutError()
-        failed = []
-        for authzr in responses:
-            if authzr.body.status != messages.STATUS_VALID:
-                for chall in authzr.body.challenges:
-                    if chall.error is not None:
-                        failed.append(authzr)
-        if failed:
-            raise errors.ValidationError(failed)
-        return orderr.update(authorizations=responses)
-
-    def finalize_order(self, orderr, deadline):
-        """Finalize an order and obtain a certificate.
-
-        :param messages.OrderResource orderr: order to finalize
-        :param datetime.datetime deadline: when to stop polling and timeout
-
-        :returns: finalized order
-        :rtype: messages.OrderResource
-
-        """
-        csr = OpenSSL.crypto.load_certificate_request(
-            OpenSSL.crypto.FILETYPE_PEM, orderr.csr_pem)
-        wrapped_csr = messages.CertificateRequest(csr=jose.ComparableX509(csr))
-        self._post(orderr.body.finalize, wrapped_csr)
-        while datetime.datetime.now() < deadline:
-            time.sleep(1)
-            response = self._post_as_get(orderr.uri)
-            body = messages.Order.from_json(response.json())
-            if body.error is not None:
-                raise errors.IssuanceError(body.error)
-            if body.certificate is not None:
-                certificate_response = self._post_as_get(body.certificate).text
-                return orderr.update(body=body, fullchain_pem=certificate_response)
-        raise errors.TimeoutError()
-
-    def revoke(self, cert, rsn):
-        """Revoke certificate.
-
-        :param .ComparableX509 cert: `OpenSSL.crypto.X509` wrapped in
-            `.ComparableX509`
-
-        :param int rsn: Reason code for certificate revocation.
-
-        :raises .ClientError: If revocation is unsuccessful.
-
-        """
-        return self._revoke(cert, rsn, self.directory['revokeCert'])
-
-    def external_account_required(self):
-        """Checks if ACME server requires External Account Binding authentication."""
-        return hasattr(self.directory, 'meta') and self.directory.meta.external_account_required
-
-    def _post_as_get(self, *args, **kwargs):
-        """
-        Send GET request using the POST-as-GET protocol.
-        :param args:
-        :param kwargs:
-        :return:
-        """
-        new_args = args[:1] + (None,) + args[1:]
-        return self._post(*new_args, **kwargs)
-
-
-class BackwardsCompatibleClientV2(object):
-    """ACME client wrapper that tends towards V2-style calls, but
-    supports V1 servers.
-
-    .. note:: While this class handles the majority of the differences
-        between versions of the ACME protocol, if you need to support an
-        ACME server based on version 3 or older of the IETF ACME draft
-        that uses combinations in authorizations (or lack thereof) to
-        signal that the client needs to complete something other than
-        any single challenge in the authorization to make it valid, the
-        user of this class needs to understand and handle these
-        differences themselves.  This does not apply to either of Let's
-        Encrypt's endpoints where successfully completing any challenge
-        in an authorization will make it valid.
-
-    :ivar int acme_version: 1 or 2, corresponding to the Let's Encrypt endpoint
-    :ivar .ClientBase client: either Client or ClientV2
-    """
-
-    def __init__(self, net, key, server):
-        directory = messages.Directory.from_json(net.get(server).json())
-        self.acme_version = self._acme_version_from_directory(directory)
-        if self.acme_version == 1:
-            self.client = Client(directory, key=key, net=net)
-        else:
-            self.client = ClientV2(directory, net=net)
-
-    def __getattr__(self, name):
-        return getattr(self.client, name)
-
-    def new_account_and_tos(self, regr, check_tos_cb=None):
-        """Combined register and agree_tos for V1, new_account for V2
-
-        :param .NewRegistration regr:
-        :param callable check_tos_cb: callback that raises an error if
-            the check does not work
-        """
-        def _assess_tos(tos):
-            if check_tos_cb is not None:
-                check_tos_cb(tos)
-        if self.acme_version == 1:
-            regr = self.client.register(regr)
-            if regr.terms_of_service is not None:
-                _assess_tos(regr.terms_of_service)
-                return self.client.agree_to_tos(regr)
-            return regr
-        else:
-            if "terms_of_service" in self.client.directory.meta:
-                _assess_tos(self.client.directory.meta.terms_of_service)
-                regr = regr.update(terms_of_service_agreed=True)
-            return self.client.new_account(regr)
-
-    def new_order(self, csr_pem):
-        """Request a new Order object from the server.
-
-        If using ACMEv1, returns a dummy OrderResource with only
-        the authorizations field filled in.
-
-        :param str csr_pem: A CSR in PEM format.
-
-        :returns: The newly created order.
-        :rtype: OrderResource
-
-        :raises errors.WildcardUnsupportedError: if a wildcard domain is
-            requested but unsupported by the ACME version
-
-        """
-        if self.acme_version == 1:
-            csr = OpenSSL.crypto.load_certificate_request(OpenSSL.crypto.FILETYPE_PEM, csr_pem)
-            # pylint: disable=protected-access
-            dnsNames = crypto_util._pyopenssl_cert_or_req_all_names(csr)
-            authorizations = []
-            for domain in dnsNames:
-                authorizations.append(self.client.request_domain_challenges(domain))
-            return messages.OrderResource(authorizations=authorizations, csr_pem=csr_pem)
-        return self.client.new_order(csr_pem)
-
-    def finalize_order(self, orderr, deadline):
-        """Finalize an order and obtain a certificate.
-
-        :param messages.OrderResource orderr: order to finalize
-        :param datetime.datetime deadline: when to stop polling and timeout
-
-        :returns: finalized order
-        :rtype: messages.OrderResource
-
-        """
-        if self.acme_version == 1:
-            csr_pem = orderr.csr_pem
-            certr = self.client.request_issuance(
-                jose.ComparableX509(
-                    OpenSSL.crypto.load_certificate_request(OpenSSL.crypto.FILETYPE_PEM, csr_pem)),
-                    orderr.authorizations)
-
-            chain = None
-            while datetime.datetime.now() < deadline:
-                try:
-                    chain = self.client.fetch_chain(certr)
-                    break
-                except errors.Error:
-                    time.sleep(1)
-
-            if chain is None:
-                raise errors.TimeoutError(
-                    'Failed to fetch chain. You should not deploy the generated '
-                    'certificate, please rerun the command for a new one.')
-
-            cert = OpenSSL.crypto.dump_certificate(
-                    OpenSSL.crypto.FILETYPE_PEM, certr.body.wrapped).decode()
-            chain = crypto_util.dump_pyopenssl_chain(chain).decode()
-
-            return orderr.update(fullchain_pem=(cert + chain))
-        return self.client.finalize_order(orderr, deadline)
-
-    def revoke(self, cert, rsn):
-        """Revoke certificate.
-
-        :param .ComparableX509 cert: `OpenSSL.crypto.X509` wrapped in
-            `.ComparableX509`
-
-        :param int rsn: Reason code for certificate revocation.
-
-        :raises .ClientError: If revocation is unsuccessful.
-
-        """
-        return self.client.revoke(cert, rsn)
-
-    def _acme_version_from_directory(self, directory):
-        if hasattr(directory, 'newNonce'):
-            return 2
-        return 1
-
-    def external_account_required(self):
-        """Checks if the server requires an external account for ACMEv2 servers.
-
-        Always return False for ACMEv1 servers, as it doesn't use External Account Binding."""
-        if self.acme_version == 1:
-            return False
-        return self.client.external_account_required()
-
-
-class ClientNetwork(object):
-    """Wrapper around requests that signs POSTs for authentication.
-
-    Also adds user agent, and handles Content-Type.
-    """
+        response = self.net.post(self.directory[messages.Revocation],
+                                 messages.Revocation(
+                                     certificate=cert,
+                                     reason=rsn),
+                                 content_type=None)
+        if response.status_code != http_client.OK:
+            raise errors.ClientError(
+                'Successful revocation must return HTTP OK status')
+
+
+class ClientNetwork(object):  # pylint: disable=too-many-instance-attributes
+    """Client network."""
     JSON_CONTENT_TYPE = 'application/json'
     JOSE_CONTENT_TYPE = 'application/jose+json'
     JSON_ERROR_CONTENT_TYPE = 'application/problem+json'
     REPLAY_NONCE_HEADER = 'Replay-Nonce'
 
-    """Initialize.
-
-    :param josepy.JWK key: Account private key
-    :param messages.RegistrationResource account: Account object. Required if you are
-            planning to use .post() with acme_version=2 for anything other than
-            creating a new account; may be set later after registering.
-    :param josepy.JWASignature alg: Algoritm to use in signing JWS.
-    :param bool verify_ssl: Whether to verify certificates on SSL connections.
-    :param str user_agent: String to send as User-Agent header.
-    :param float timeout: Timeout for requests.
-    :param source_address: Optional source address to bind to when making requests.
-    :type source_address: str or tuple(str, int)
-    """
-    def __init__(self, key, account=None, alg=jose.RS256, verify_ssl=True,
-                 user_agent='acme-python', timeout=DEFAULT_NETWORK_TIMEOUT,
-                 source_address=None):
+    def __init__(self, key, alg=jose.RS256, verify_ssl=True,
+                 user_agent='acme-python', timeout=DEFAULT_NETWORK_TIMEOUT):
         self.key = key
-        self.account = account
         self.alg = alg
         self.verify_ssl = verify_ssl
-        self._nonces = set() # type: Set[Text]
+        self._nonces = set()
         self.user_agent = user_agent
         self.session = requests.Session()
         self._default_timeout = timeout
-        adapter = HTTPAdapter()
-
-        if source_address is not None:
-            adapter = SourceAddressAdapter(source_address)
-
-        self.session.mount("http://", adapter)
-        self.session.mount("https://", adapter)
 
     def __del__(self):
         # Try to close the session, but don't show exceptions to the
@@ -976,31 +527,21 @@ class ClientNetwork(object):
         except Exception:  # pylint: disable=broad-except
             pass
 
-    def _wrap_in_jws(self, obj, nonce, url, acme_version):
+    def _wrap_in_jws(self, obj, nonce):
         """Wrap `JSONDeSerializable` object in JWS.
 
         .. todo:: Implement ``acmePath``.
 
-        :param josepy.JSONDeSerializable obj:
-        :param str url: The URL to which this object will be POSTed
+        :param .JSONDeSerializable obj:
         :param bytes nonce:
-        :rtype: `josepy.JWS`
+        :rtype: `.JWS`
 
         """
-        jobj = obj.json_dumps(indent=2).encode() if obj else b''
+        jobj = obj.json_dumps(indent=2).encode()
         logger.debug('JWS payload:\n%s', jobj)
-        kwargs = {
-            "alg": self.alg,
-            "nonce": nonce
-        }
-        if acme_version == 2:
-            kwargs["url"] = url
-            # newAccount and revokeCert work without the kid
-            # newAccount must not have kid
-            if self.account is not None:
-                kwargs["kid"] = self.account["uri"]
-        kwargs["key"] = self.key
-        return jws.JWS.sign(jobj, **kwargs).json_dumps(indent=2)
+        return jws.JWS.sign(
+            payload=jobj, key=self.key, alg=self.alg,
+            nonce=nonce).json_dumps(indent=2)
 
     @classmethod
     def _check_response(cls, response, content_type=None):
@@ -1059,6 +600,7 @@ class ClientNetwork(object):
         return response
 
     def _send_request(self, method, url, *args, **kwargs):
+        # pylint: disable=too-many-locals
         """Send HTTP request.
 
         Makes sure that `verify_ssl` is respected. Logs request and
@@ -1105,16 +647,17 @@ class ClientNetwork(object):
             err_regex = r".*host='(\S*)'.*Max retries exceeded with url\: (\/\w*).*(\[Errno \d+\])([A-Za-z ]*)"
             m = re.match(err_regex, str(e))
             if m is None:
-                raise  # pragma: no cover
-            host, path, _err_no, err_msg = m.groups()
-            raise ValueError("Requesting {0}{1}:{2}".format(host, path, err_msg))
+                raise # pragma: no cover
+            else:
+                host, path, _err_no, err_msg = m.groups()
+                raise ValueError("Requesting {0}{1}:{2}".format(host, path, err_msg))
 
         # If content is DER, log the base64 of it instead of raw bytes, to keep
         # binary data out of the logs.
         if response.headers.get("Content-Type") == DER_CONTENT_TYPE:
             debug_content = base64.b64encode(response.content)
         else:
-            debug_content = response.content.decode("utf-8")
+            debug_content = response.content
         logger.debug('Received response:\nHTTP %d\n%s\n\n%s',
                      response.status_code,
                      "\n".join(["{0}: {1}".format(k, v)
@@ -1149,15 +692,10 @@ class ClientNetwork(object):
         else:
             raise errors.MissingNonce(response)
 
-    def _get_nonce(self, url, new_nonce_url):
+    def _get_nonce(self, url):
         if not self._nonces:
             logger.debug('Requesting fresh nonce')
-            if new_nonce_url is None:
-                response = self.head(url)
-            else:
-                # request a new nonce from the acme newNonce endpoint
-                response = self._check_response(self.head(new_nonce_url), content_type=None)
-            self._add_nonce(response)
+            self._add_nonce(self.head(url))
         return self._nonces.pop()
 
     def post(self, *args, **kwargs):
@@ -1173,14 +711,12 @@ class ClientNetwork(object):
             if error.code == 'badNonce':
                 logger.debug('Retrying request after error:\n%s', error)
                 return self._post_once(*args, **kwargs)
-            raise
+            else:
+                raise
 
-    def _post_once(self, url, obj, content_type=JOSE_CONTENT_TYPE,
-            acme_version=1, **kwargs):
-        new_nonce_url = kwargs.pop('new_nonce_url', None)
-        data = self._wrap_in_jws(obj, self._get_nonce(url, new_nonce_url), url, acme_version)
+    def _post_once(self, url, obj, content_type=JOSE_CONTENT_TYPE, **kwargs):
+        data = self._wrap_in_jws(obj, self._get_nonce(url))
         kwargs.setdefault('headers', {'Content-Type': content_type})
         response = self._send_request('POST', url, data=data, **kwargs)
-        response = self._check_response(response, content_type=content_type)
         self._add_nonce(response)
-        return response
+        return self._check_response(response, content_type=content_type)

acme/acme/client_test.py

@@ -1,51 +1,30 @@
 """Tests for acme.client."""
-# pylint: disable=too-many-lines
-import copy
 import datetime
 import json
 import unittest
 
+from six.moves import http_client  # pylint: disable=import-error
+
 import josepy as jose
 import mock
-import OpenSSL
 import requests
-from six.moves import http_client  # pylint: disable=import-error
 
 from acme import challenges
 from acme import errors
 from acme import jws as acme_jws
 from acme import messages
-from acme.magic_typing import Dict  # pylint: disable=unused-import, no-name-in-module
-import messages_test
-import test_util
+from acme import messages_test
+from acme import test_util
+
 
 CERT_DER = test_util.load_vector('cert.der')
-CERT_SAN_PEM = test_util.load_vector('cert-san.pem')
-CSR_SAN_PEM = test_util.load_vector('csr-san.pem')
 KEY = jose.JWKRSA.load(test_util.load_vector('rsa512_key.pem'))
 KEY2 = jose.JWKRSA.load(test_util.load_vector('rsa256_key.pem'))
 
-DIRECTORY_V1 = messages.Directory({
-    messages.NewRegistration:
-        'https://www.letsencrypt-demo.org/acme/new-reg',
-    messages.Revocation:
-        'https://www.letsencrypt-demo.org/acme/revoke-cert',
-    messages.NewAuthorization:
-        'https://www.letsencrypt-demo.org/acme/new-authz',
-    messages.CertificateRequest:
-        'https://www.letsencrypt-demo.org/acme/new-cert',
-})
 
-DIRECTORY_V2 = messages.Directory({
-    'newAccount': 'https://www.letsencrypt-demo.org/acme/new-account',
-    'newNonce': 'https://www.letsencrypt-demo.org/acme/new-nonce',
-    'newOrder': 'https://www.letsencrypt-demo.org/acme/new-order',
-    'revokeCert': 'https://www.letsencrypt-demo.org/acme/revoke-cert',
-})
-
-
-class ClientTestBase(unittest.TestCase):
-    """Base for tests in acme.client."""
+class ClientTest(unittest.TestCase):
+    """Tests for  acme.client.Client."""
+    # pylint: disable=too-many-instance-attributes,too-many-public-methods
 
     def setUp(self):
         self.response = mock.MagicMock(
@@ -54,6 +33,21 @@ class ClientTestBase(unittest.TestCase):
         self.net.post.return_value = self.response
         self.net.get.return_value = self.response
 
+        self.directory = messages.Directory({
+            messages.NewRegistration:
+                'https://www.letsencrypt-demo.org/acme/new-reg',
+            messages.Revocation:
+                'https://www.letsencrypt-demo.org/acme/revoke-cert',
+            messages.NewAuthorization:
+                'https://www.letsencrypt-demo.org/acme/new-authz',
+            messages.CertificateRequest:
+                'https://www.letsencrypt-demo.org/acme/new-cert',
+        })
+
+        from acme.client import Client
+        self.client = Client(
+            directory=self.directory, key=KEY, alg=jose.RS256, net=self.net)
+
         self.identifier = messages.Identifier(
             typ=messages.IDENTIFIER_FQDN, value='example.com')
 
@@ -61,10 +55,10 @@ class ClientTestBase(unittest.TestCase):
         self.contact = ('mailto:cert-admin@example.com', 'tel:+12025551212')
         reg = messages.Registration(
             contact=self.contact, key=KEY.public_key())
-        the_arg = dict(reg)  # type: Dict
-        self.new_reg = messages.NewRegistration(**the_arg)
+        self.new_reg = messages.NewRegistration(**dict(reg))
         self.regr = messages.RegistrationResource(
-            body=reg, uri='https://www.letsencrypt-demo.org/acme/reg/1')
+            body=reg, uri='https://www.letsencrypt-demo.org/acme/reg/1',
+            terms_of_service='https://www.letsencrypt-demo.org/tos')
 
         # Authorization
         authzr_uri = 'https://www.letsencrypt-demo.org/acme/authz/1'
@@ -81,260 +75,14 @@ class ClientTestBase(unittest.TestCase):
         self.authzr = messages.AuthorizationResource(
             body=self.authz, uri=authzr_uri)
 
-        # Reason code for revocation
-        self.rsn = 1
-
-
-class BackwardsCompatibleClientV2Test(ClientTestBase):
-    """Tests for  acme.client.BackwardsCompatibleClientV2."""
-
-    def setUp(self):
-        super(BackwardsCompatibleClientV2Test, self).setUp()
-        # contains a loaded cert
-        self.certr = messages.CertificateResource(
-            body=messages_test.CERT)
-
-        loaded = OpenSSL.crypto.load_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, CERT_SAN_PEM)
-        wrapped = jose.ComparableX509(loaded)
-        self.chain = [wrapped, wrapped]
-
-        self.cert_pem = OpenSSL.crypto.dump_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, messages_test.CERT.wrapped).decode()
-
-        single_chain = OpenSSL.crypto.dump_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, loaded).decode()
-        self.chain_pem = single_chain + single_chain
-
-        self.fullchain_pem = self.cert_pem + self.chain_pem
-
-        self.orderr = messages.OrderResource(
-            csr_pem=CSR_SAN_PEM)
-
-    def _init(self):
-        uri = 'http://www.letsencrypt-demo.org/directory'
-        from acme.client import BackwardsCompatibleClientV2
-        return BackwardsCompatibleClientV2(net=self.net,
-            key=KEY, server=uri)
-
-    def test_init_downloads_directory(self):
-        uri = 'http://www.letsencrypt-demo.org/directory'
-        from acme.client import BackwardsCompatibleClientV2
-        BackwardsCompatibleClientV2(net=self.net,
-            key=KEY, server=uri)
-        self.net.get.assert_called_once_with(uri)
-
-    def test_init_acme_version(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        client = self._init()
-        self.assertEqual(client.acme_version, 1)
-
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        client = self._init()
-        self.assertEqual(client.acme_version, 2)
-
-    def test_query_registration_client_v2(self):
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        client = self._init()
-        self.response.json.return_value = self.regr.body.to_json()
-        self.assertEqual(self.regr, client.query_registration(self.regr))
-
-    def test_forwarding(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        client = self._init()
-        self.assertEqual(client.directory, client.client.directory)
-        self.assertEqual(client.key, KEY)
-        self.assertEqual(client.deactivate_registration, client.client.deactivate_registration)
-        self.assertRaises(AttributeError, client.__getattr__, 'nonexistent')
-        self.assertRaises(AttributeError, client.__getattr__, 'new_account_and_tos')
-        self.assertRaises(AttributeError, client.__getattr__, 'new_account')
-
-    def test_new_account_and_tos(self):
-        # v2 no tos
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.new_account_and_tos(self.new_reg)
-            mock_client().new_account.assert_called_with(self.new_reg)
-
-        # v2 tos good
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            mock_client().directory.meta.__contains__.return_value = True
-            client = self._init()
-            client.new_account_and_tos(self.new_reg, lambda x: True)
-            mock_client().new_account.assert_called_with(
-                self.new_reg.update(terms_of_service_agreed=True))
-
-        # v2 tos bad
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            mock_client().directory.meta.__contains__.return_value = True
-            client = self._init()
-            def _tos_cb(tos):
-                raise errors.Error
-            self.assertRaises(errors.Error, client.new_account_and_tos,
-                self.new_reg, _tos_cb)
-            mock_client().new_account.assert_not_called()
-
-        # v1 yes tos
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        with mock.patch('acme.client.Client') as mock_client:
-            regr = mock.MagicMock(terms_of_service="TOS")
-            mock_client().register.return_value = regr
-            client = self._init()
-            client.new_account_and_tos(self.new_reg)
-            mock_client().register.assert_called_once_with(self.new_reg)
-            mock_client().agree_to_tos.assert_called_once_with(regr)
-
-        # v1 no tos
-        with mock.patch('acme.client.Client') as mock_client:
-            regr = mock.MagicMock(terms_of_service=None)
-            mock_client().register.return_value = regr
-            client = self._init()
-            client.new_account_and_tos(self.new_reg)
-            mock_client().register.assert_called_once_with(self.new_reg)
-            mock_client().agree_to_tos.assert_not_called()
-
-    @mock.patch('OpenSSL.crypto.load_certificate_request')
-    @mock.patch('acme.crypto_util._pyopenssl_cert_or_req_all_names')
-    def test_new_order_v1(self, mock__pyopenssl_cert_or_req_all_names,
-        unused_mock_load_certificate_request):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        mock__pyopenssl_cert_or_req_all_names.return_value = ['example.com', 'www.example.com']
-        mock_csr_pem = mock.MagicMock()
-        with mock.patch('acme.client.Client') as mock_client:
-            mock_client().request_domain_challenges.return_value = mock.sentinel.auth
-            client = self._init()
-            orderr = client.new_order(mock_csr_pem)
-            self.assertEqual(orderr.authorizations, [mock.sentinel.auth, mock.sentinel.auth])
-
-    def test_new_order_v2(self):
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        mock_csr_pem = mock.MagicMock()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.new_order(mock_csr_pem)
-            mock_client().new_order.assert_called_once_with(mock_csr_pem)
-
-    @mock.patch('acme.client.Client')
-    def test_finalize_order_v1_success(self, mock_client):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-
-        mock_client().request_issuance.return_value = self.certr
-        mock_client().fetch_chain.return_value = self.chain
-
-        deadline = datetime.datetime(9999, 9, 9)
-        client = self._init()
-        result = client.finalize_order(self.orderr, deadline)
-        self.assertEqual(result.fullchain_pem, self.fullchain_pem)
-        mock_client().fetch_chain.assert_called_once_with(self.certr)
-
-    @mock.patch('acme.client.Client')
-    def test_finalize_order_v1_fetch_chain_error(self, mock_client):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-
-        mock_client().request_issuance.return_value = self.certr
-        mock_client().fetch_chain.return_value = self.chain
-        mock_client().fetch_chain.side_effect = [errors.Error, self.chain]
-
-        deadline = datetime.datetime(9999, 9, 9)
-        client = self._init()
-        result = client.finalize_order(self.orderr, deadline)
-        self.assertEqual(result.fullchain_pem, self.fullchain_pem)
-        self.assertEqual(mock_client().fetch_chain.call_count, 2)
-
-    @mock.patch('acme.client.Client')
-    def test_finalize_order_v1_timeout(self, mock_client):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-
-        mock_client().request_issuance.return_value = self.certr
-
-        deadline = deadline = datetime.datetime.now() - datetime.timedelta(seconds=60)
-        client = self._init()
-        self.assertRaises(errors.TimeoutError, client.finalize_order,
-            self.orderr, deadline)
-
-    def test_finalize_order_v2(self):
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        mock_orderr = mock.MagicMock()
-        mock_deadline = mock.MagicMock()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.finalize_order(mock_orderr, mock_deadline)
-            mock_client().finalize_order.assert_called_once_with(mock_orderr, mock_deadline)
-
-    def test_revoke(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        with mock.patch('acme.client.Client') as mock_client:
-            client = self._init()
-            client.revoke(messages_test.CERT, self.rsn)
-        mock_client().revoke.assert_called_once_with(messages_test.CERT, self.rsn)
-
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.revoke(messages_test.CERT, self.rsn)
-        mock_client().revoke.assert_called_once_with(messages_test.CERT, self.rsn)
-
-    def test_update_registration(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        with mock.patch('acme.client.Client') as mock_client:
-            client = self._init()
-            client.update_registration(mock.sentinel.regr, None)
-        mock_client().update_registration.assert_called_once_with(mock.sentinel.regr, None)
-
-    # newNonce present means it will pick acme_version 2
-    def test_external_account_required_true(self):
-        self.response.json.return_value = messages.Directory({
-            'newNonce': 'http://letsencrypt-test.com/acme/new-nonce',
-            'meta': messages.Directory.Meta(external_account_required=True),
-        }).to_json()
-
-        client = self._init()
-
-        self.assertTrue(client.external_account_required())
-
-    # newNonce present means it will pick acme_version 2
-    def test_external_account_required_false(self):
-        self.response.json.return_value = messages.Directory({
-            'newNonce': 'http://letsencrypt-test.com/acme/new-nonce',
-            'meta': messages.Directory.Meta(external_account_required=False),
-        }).to_json()
-
-        client = self._init()
-
-        self.assertFalse(client.external_account_required())
-
-    def test_external_account_required_false_v1(self):
-        self.response.json.return_value = messages.Directory({
-            'meta': messages.Directory.Meta(external_account_required=False),
-        }).to_json()
-
-        client = self._init()
-
-        self.assertFalse(client.external_account_required())
-
-
-class ClientTest(ClientTestBase):
-    """Tests for acme.client.Client."""
-
-    def setUp(self):
-        super(ClientTest, self).setUp()
-
-        self.directory = DIRECTORY_V1
-
-        # Registration
-        self.regr = self.regr.update(
-            terms_of_service='https://www.letsencrypt-demo.org/tos')
-
         # Request issuance
         self.certr = messages.CertificateResource(
             body=messages_test.CERT, authzrs=(self.authzr,),
             uri='https://www.letsencrypt-demo.org/acme/cert/1',
             cert_chain_uri='https://www.letsencrypt-demo.org/ca')
 
-        from acme.client import Client
-        self.client = Client(
-            directory=self.directory, key=KEY, alg=jose.RS256, net=self.net)
+        # Reason code for revocation
+        self.rsn = 1
 
     def test_init_downloads_directory(self):
         uri = 'http://www.letsencrypt-demo.org/directory'
@@ -343,18 +91,9 @@ class ClientTest(ClientTestBase):
             directory=uri, key=KEY, alg=jose.RS256, net=self.net)
         self.net.get.assert_called_once_with(uri)
 
-    @mock.patch('acme.client.ClientNetwork')
-    def test_init_without_net(self, mock_net):
-        mock_net.return_value = mock.sentinel.net
-        alg = jose.RS256
-        from acme.client import Client
-        self.client = Client(
-            directory=self.directory, key=KEY, alg=alg)
-        mock_net.called_once_with(KEY, alg=alg, verify_ssl=True)
-        self.assertEqual(self.client.net, mock.sentinel.net)
-
     def test_register(self):
         # "Instance of 'Field' has no to_json/update member" bug:
+        # pylint: disable=no-member
         self.response.status_code = http_client.CREATED
         self.response.json.return_value = self.regr.body.to_json()
         self.response.headers['Location'] = self.regr.uri
@@ -367,6 +106,7 @@ class ClientTest(ClientTestBase):
 
     def test_update_registration(self):
         # "Instance of 'Field' has no to_json/update member" bug:
+        # pylint: disable=no-member
         self.response.headers['Location'] = self.regr.uri
         self.response.json.return_value = self.regr.body.to_json()
         self.assertEqual(self.regr, self.client.update_registration(self.regr))
@@ -402,23 +142,20 @@ class ClientTest(ClientTestBase):
         self.client.request_challenges(self.identifier)
         self.net.post.assert_called_once_with(
             self.directory.new_authz,
-            messages.NewAuthorization(identifier=self.identifier),
-            acme_version=1)
+            messages.NewAuthorization(identifier=self.identifier))
 
     def test_request_challenges_deprecated_arg(self):
         self._prepare_response_for_request_challenges()
         self.client.request_challenges(self.identifier, new_authzr_uri="hi")
         self.net.post.assert_called_once_with(
             self.directory.new_authz,
-            messages.NewAuthorization(identifier=self.identifier),
-            acme_version=1)
+            messages.NewAuthorization(identifier=self.identifier))
 
     def test_request_challenges_custom_uri(self):
         self._prepare_response_for_request_challenges()
         self.client.request_challenges(self.identifier)
         self.net.post.assert_called_once_with(
-            'https://www.letsencrypt-demo.org/acme/new-authz', mock.ANY,
-            acme_version=1)
+            'https://www.letsencrypt-demo.org/acme/new-authz', mock.ANY)
 
     def test_request_challenges_unexpected_update(self):
         self._prepare_response_for_request_challenges()
@@ -428,13 +165,6 @@ class ClientTest(ClientTestBase):
             errors.UnexpectedUpdate, self.client.request_challenges,
             self.identifier)
 
-    def test_request_challenges_wildcard(self):
-        wildcard_identifier = messages.Identifier(
-            typ=messages.IDENTIFIER_FQDN, value='*.example.org')
-        self.assertRaises(
-            errors.WildcardUnsupportedError, self.client.request_challenges,
-            wildcard_identifier)
-
     def test_request_domain_challenges(self):
         self.client.request_challenges = mock.MagicMock()
         self.assertEqual(
@@ -634,14 +364,6 @@ class ClientTest(ClientTestBase):
             errors.PollError, self.client.poll_and_request_issuance,
             csr, authzrs, mintime=mintime, max_attempts=2)
 
-    def test_deactivate_authorization(self):
-        authzb = self.authzr.body.update(status=messages.STATUS_DEACTIVATED)
-        self.response.json.return_value = authzb.to_json()
-        authzr = self.client.deactivate_authorization(self.authzr)
-        self.assertEqual(authzb, authzr.body)
-        self.assertEqual(self.client.net.post.call_count, 1)
-        self.assertTrue(self.authzr.uri in self.net.post.call_args_list[0][0])
-
     def test_check_cert(self):
         self.response.headers['Location'] = self.certr.uri
         self.response.content = CERT_DER
@@ -695,12 +417,12 @@ class ClientTest(ClientTestBase):
     def test_revoke(self):
         self.client.revoke(self.certr.body, self.rsn)
         self.net.post.assert_called_once_with(
-            self.directory[messages.Revocation], mock.ANY, acme_version=1)
+            self.directory[messages.Revocation], mock.ANY, content_type=None)
 
     def test_revocation_payload(self):
         obj = messages.Revocation(certificate=self.certr.body, reason=self.rsn)
         self.assertTrue('reason' in obj.to_partial_json().keys())
-        self.assertEqual(self.rsn, obj.to_partial_json()['reason'])
+        self.assertEquals(self.rsn, obj.to_partial_json()['reason'])
 
     def test_revoke_bad_status_raises_error(self):
         self.response.status_code = http_client.METHOD_NOT_ALLOWED
@@ -711,194 +433,6 @@ class ClientTest(ClientTestBase):
             self.rsn)
 
 
-class ClientV2Test(ClientTestBase):
-    """Tests for acme.client.ClientV2."""
-
-    def setUp(self):
-        super(ClientV2Test, self).setUp()
-
-        self.directory = DIRECTORY_V2
-
-        from acme.client import ClientV2
-        self.client = ClientV2(self.directory, self.net)
-
-        self.new_reg = self.new_reg.update(terms_of_service_agreed=True)
-
-        self.authzr_uri2 = 'https://www.letsencrypt-demo.org/acme/authz/2'
-        self.authz2 = self.authz.update(identifier=messages.Identifier(
-            typ=messages.IDENTIFIER_FQDN, value='www.example.com'),
-            status=messages.STATUS_PENDING)
-        self.authzr2 = messages.AuthorizationResource(
-            body=self.authz2, uri=self.authzr_uri2)
-
-        self.order = messages.Order(
-            identifiers=(self.authz.identifier, self.authz2.identifier),
-            status=messages.STATUS_PENDING,
-            authorizations=(self.authzr.uri, self.authzr_uri2),
-            finalize='https://www.letsencrypt-demo.org/acme/acct/1/order/1/finalize')
-        self.orderr = messages.OrderResource(
-            body=self.order,
-            uri='https://www.letsencrypt-demo.org/acme/acct/1/order/1',
-            authorizations=[self.authzr, self.authzr2], csr_pem=CSR_SAN_PEM)
-
-    def test_new_account(self):
-        self.response.status_code = http_client.CREATED
-        self.response.json.return_value = self.regr.body.to_json()
-        self.response.headers['Location'] = self.regr.uri
-
-        self.assertEqual(self.regr, self.client.new_account(self.new_reg))
-
-    def test_new_account_conflict(self):
-        self.response.status_code = http_client.OK
-        self.response.headers['Location'] = self.regr.uri
-        self.assertRaises(errors.ConflictError, self.client.new_account, self.new_reg)
-
-    def test_new_order(self):
-        order_response = copy.deepcopy(self.response)
-        order_response.status_code = http_client.CREATED
-        order_response.json.return_value = self.order.to_json()
-        order_response.headers['Location'] = self.orderr.uri
-        self.net.post.return_value = order_response
-
-        authz_response = copy.deepcopy(self.response)
-        authz_response.json.return_value = self.authz.to_json()
-        authz_response.headers['Location'] = self.authzr.uri
-        authz_response2 = self.response
-        authz_response2.json.return_value = self.authz2.to_json()
-        authz_response2.headers['Location'] = self.authzr2.uri
-
-        with mock.patch('acme.client.ClientV2._post_as_get') as mock_post_as_get:
-            mock_post_as_get.side_effect = (authz_response, authz_response2)
-            self.assertEqual(self.client.new_order(CSR_SAN_PEM), self.orderr)
-
-    @mock.patch('acme.client.datetime')
-    def test_poll_and_finalize(self, mock_datetime):
-        mock_datetime.datetime.now.return_value = datetime.datetime(2018, 2, 15)
-        mock_datetime.timedelta = datetime.timedelta
-        expected_deadline = mock_datetime.datetime.now() + datetime.timedelta(seconds=90)
-
-        self.client.poll_authorizations = mock.Mock(return_value=self.orderr)
-        self.client.finalize_order = mock.Mock(return_value=self.orderr)
-
-        self.assertEqual(self.client.poll_and_finalize(self.orderr), self.orderr)
-        self.client.poll_authorizations.assert_called_once_with(self.orderr, expected_deadline)
-        self.client.finalize_order.assert_called_once_with(self.orderr, expected_deadline)
-
-    @mock.patch('acme.client.datetime')
-    def test_poll_authorizations_timeout(self, mock_datetime):
-        now_side_effect = [datetime.datetime(2018, 2, 15),
-                           datetime.datetime(2018, 2, 16),
-                           datetime.datetime(2018, 2, 17)]
-        mock_datetime.datetime.now.side_effect = now_side_effect
-        self.response.json.side_effect = [
-            self.authz.to_json(), self.authz2.to_json(), self.authz2.to_json()]
-
-        self.assertRaises(
-            errors.TimeoutError, self.client.poll_authorizations, self.orderr, now_side_effect[1])
-
-    def test_poll_authorizations_failure(self):
-        deadline = datetime.datetime(9999, 9, 9)
-        challb = self.challr.body.update(status=messages.STATUS_INVALID,
-                                         error=messages.Error.with_code('unauthorized'))
-        authz = self.authz.update(status=messages.STATUS_INVALID, challenges=(challb,))
-        self.response.json.return_value = authz.to_json()
-
-        self.assertRaises(
-            errors.ValidationError, self.client.poll_authorizations, self.orderr, deadline)
-
-    def test_poll_authorizations_success(self):
-        deadline = datetime.datetime(9999, 9, 9)
-        updated_authz2 = self.authz2.update(status=messages.STATUS_VALID)
-        updated_authzr2 = messages.AuthorizationResource(
-            body=updated_authz2, uri=self.authzr_uri2)
-        updated_orderr = self.orderr.update(authorizations=[self.authzr, updated_authzr2])
-
-        self.response.json.side_effect = (
-            self.authz.to_json(), self.authz2.to_json(), updated_authz2.to_json())
-        self.assertEqual(self.client.poll_authorizations(self.orderr, deadline), updated_orderr)
-
-    def test_finalize_order_success(self):
-        updated_order = self.order.update(
-            certificate='https://www.letsencrypt-demo.org/acme/cert/')
-        updated_orderr = self.orderr.update(body=updated_order, fullchain_pem=CERT_SAN_PEM)
-
-        self.response.json.return_value = updated_order.to_json()
-        self.response.text = CERT_SAN_PEM
-
-        deadline = datetime.datetime(9999, 9, 9)
-        self.assertEqual(self.client.finalize_order(self.orderr, deadline), updated_orderr)
-
-    def test_finalize_order_error(self):
-        updated_order = self.order.update(error=messages.Error.with_code('unauthorized'))
-        self.response.json.return_value = updated_order.to_json()
-
-        deadline = datetime.datetime(9999, 9, 9)
-        self.assertRaises(errors.IssuanceError, self.client.finalize_order, self.orderr, deadline)
-
-    def test_finalize_order_timeout(self):
-        deadline = datetime.datetime.now() - datetime.timedelta(seconds=60)
-        self.assertRaises(errors.TimeoutError, self.client.finalize_order, self.orderr, deadline)
-
-    def test_revoke(self):
-        self.client.revoke(messages_test.CERT, self.rsn)
-        self.net.post.assert_called_once_with(
-            self.directory["revokeCert"], mock.ANY, acme_version=2,
-            new_nonce_url=DIRECTORY_V2['newNonce'])
-
-    def test_update_registration(self):
-        # "Instance of 'Field' has no to_json/update member" bug:
-        self.response.headers['Location'] = self.regr.uri
-        self.response.json.return_value = self.regr.body.to_json()
-        self.assertEqual(self.regr, self.client.update_registration(self.regr))
-        self.assertNotEqual(self.client.net.account, None)
-        self.assertEqual(self.client.net.post.call_count, 2)
-        self.assertTrue(DIRECTORY_V2.newAccount in self.net.post.call_args_list[0][0])
-
-        self.response.json.return_value = self.regr.body.update(
-            contact=()).to_json()
-
-    def test_external_account_required_true(self):
-        self.client.directory = messages.Directory({
-            'meta': messages.Directory.Meta(external_account_required=True)
-        })
-
-        self.assertTrue(self.client.external_account_required())
-
-    def test_external_account_required_false(self):
-        self.client.directory = messages.Directory({
-            'meta': messages.Directory.Meta(external_account_required=False)
-        })
-
-        self.assertFalse(self.client.external_account_required())
-
-    def test_external_account_required_default(self):
-        self.assertFalse(self.client.external_account_required())
-
-    def test_post_as_get(self):
-        with mock.patch('acme.client.ClientV2._authzr_from_response') as mock_client:
-            mock_client.return_value = self.authzr2
-
-            self.client.poll(self.authzr2)  # pylint: disable=protected-access
-
-            self.client.net.post.assert_called_once_with(
-                self.authzr2.uri, None, acme_version=2,
-                new_nonce_url='https://www.letsencrypt-demo.org/acme/new-nonce')
-            self.client.net.get.assert_not_called()
-
-
-class MockJSONDeSerializable(jose.JSONDeSerializable):
-    # pylint: disable=missing-docstring
-    def __init__(self, value):
-        self.value = value
-
-    def to_partial_json(self):
-        return {'foo': self.value}
-
-    @classmethod
-    def from_json(cls, jobj):
-        pass  # pragma: no cover
-
-
 class ClientNetworkTest(unittest.TestCase):
     """Tests for acme.client.ClientNetwork."""
 
@@ -919,25 +453,24 @@ class ClientNetworkTest(unittest.TestCase):
         self.assertTrue(self.net.verify_ssl is self.verify_ssl)
 
     def test_wrap_in_jws(self):
-        # pylint: disable=protected-access
-        jws_dump = self.net._wrap_in_jws(
-            MockJSONDeSerializable('foo'), nonce=b'Tg', url="url",
-            acme_version=1)
-        jws = acme_jws.JWS.json_loads(jws_dump)
-        self.assertEqual(json.loads(jws.payload.decode()), {'foo': 'foo'})
-        self.assertEqual(jws.signature.combined.nonce, b'Tg')
+        class MockJSONDeSerializable(jose.JSONDeSerializable):
+            # pylint: disable=missing-docstring
+            def __init__(self, value):
+                self.value = value
+
+            def to_partial_json(self):
+                return {'foo': self.value}
+
+            @classmethod
+            def from_json(cls, value):
+                pass  # pragma: no cover
 
-    def test_wrap_in_jws_v2(self):
-        self.net.account = {'uri': 'acct-uri'}
         # pylint: disable=protected-access
         jws_dump = self.net._wrap_in_jws(
-            MockJSONDeSerializable('foo'), nonce=b'Tg', url="url",
-            acme_version=2)
+            MockJSONDeSerializable('foo'), nonce=b'Tg')
         jws = acme_jws.JWS.json_loads(jws_dump)
         self.assertEqual(json.loads(jws.payload.decode()), {'foo': 'foo'})
         self.assertEqual(jws.signature.combined.nonce, b'Tg')
-        self.assertEqual(jws.signature.combined.kid, u'acct-uri')
-        self.assertEqual(jws.signature.combined.url, u'url')
 
     def test_check_response_not_ok_jobj_no_error(self):
         self.response.ok = False
@@ -950,8 +483,8 @@ class ClientNetworkTest(unittest.TestCase):
 
     def test_check_response_not_ok_jobj_error(self):
         self.response.ok = False
-        self.response.json.return_value = messages.Error.with_code(
-            'serverInternal', detail='foo', title='some title').to_json()
+        self.response.json.return_value = messages.Error(
+            detail='foo', typ='serverInternal', title='some title').to_json()
         # pylint: disable=protected-access
         self.assertRaises(
             messages.Error, self.net._check_response, self.response)
@@ -976,7 +509,7 @@ class ClientNetworkTest(unittest.TestCase):
         self.response.json.side_effect = ValueError
         for response_ct in [self.net.JSON_CONTENT_TYPE, 'foo']:
             self.response.headers['Content-Type'] = response_ct
-            # pylint: disable=protected-access
+            # pylint: disable=protected-access,no-value-for-parameter
             self.assertEqual(
                 self.response, self.net._check_response(self.response))
 
@@ -990,7 +523,7 @@ class ClientNetworkTest(unittest.TestCase):
         self.response.json.return_value = {}
         for response_ct in [self.net.JSON_CONTENT_TYPE, 'foo']:
             self.response.headers['Content-Type'] = response_ct
-            # pylint: disable=protected-access
+            # pylint: disable=protected-access,no-value-for-parameter
             self.assertEqual(
                 self.response, self.net._check_response(self.response))
 
@@ -1101,11 +634,12 @@ class ClientNetworkTest(unittest.TestCase):
 
         # Requests Library Exceptions
         except requests.exceptions.ConnectionError as z: #pragma: no cover
-            self.assertTrue("'Connection aborted.'" in str(z) or "[WinError 10061]" in str(z))
-
+            self.assertEqual("('Connection aborted.', "
+                             "error(111, 'Connection refused'))", str(z))
 
 class ClientNetworkWithMockedResponseTest(unittest.TestCase):
     """Tests for acme.client.ClientNetwork which mock out response."""
+    # pylint: disable=too-many-instance-attributes
 
     def setUp(self):
         from acme.client import ClientNetwork
@@ -1114,10 +648,7 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
         self.response = mock.MagicMock(ok=True, status_code=http_client.OK)
         self.response.headers = {}
         self.response.links = {}
-        self.response.checked = False
-        self.acmev1_nonce_response = mock.MagicMock(
-            ok=False, status_code=http_client.METHOD_NOT_ALLOWED)
-        self.acmev1_nonce_response.headers = {}
+        self.checked_response = mock.MagicMock()
         self.obj = mock.MagicMock()
         self.wrapped_obj = mock.MagicMock()
         self.content_type = mock.sentinel.content_type
@@ -1129,21 +660,13 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
 
         def send_request(*args, **kwargs):
             # pylint: disable=unused-argument,missing-docstring
-            self.assertFalse("new_nonce_url" in kwargs)
-            method = args[0]
-            uri = args[1]
-            if method == 'HEAD' and uri != "new_nonce_uri":
-                response = self.acmev1_nonce_response
-            else:
-                response = self.response
-
             if self.available_nonces:
-                response.headers = {
+                self.response.headers = {
                     self.net.REPLAY_NONCE_HEADER:
                     self.available_nonces.pop().decode()}
             else:
-                response.headers = {}
-            return response
+                self.response.headers = {}
+            return self.response
 
         # pylint: disable=protected-access
         self.net._send_request = self.send_request = mock.MagicMock(
@@ -1155,47 +678,36 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
         # pylint: disable=missing-docstring
         self.assertEqual(self.response, response)
         self.assertEqual(self.content_type, content_type)
-        self.assertTrue(self.response.ok)
-        self.response.checked = True
-        return self.response
+        return self.checked_response
 
     def test_head(self):
-        self.assertEqual(self.acmev1_nonce_response, self.net.head(
+        self.assertEqual(self.response, self.net.head(
             'http://example.com/', 'foo', bar='baz'))
         self.send_request.assert_called_once_with(
             'HEAD', 'http://example.com/', 'foo', bar='baz')
 
-    def test_head_v2(self):
-        self.assertEqual(self.response, self.net.head(
-            'new_nonce_uri', 'foo', bar='baz'))
-        self.send_request.assert_called_once_with(
-            'HEAD', 'new_nonce_uri', 'foo', bar='baz')
-
     def test_get(self):
-        self.assertEqual(self.response, self.net.get(
+        self.assertEqual(self.checked_response, self.net.get(
             'http://example.com/', content_type=self.content_type, bar='baz'))
-        self.assertTrue(self.response.checked)
         self.send_request.assert_called_once_with(
             'GET', 'http://example.com/', bar='baz')
 
     def test_post_no_content_type(self):
         self.content_type = self.net.JOSE_CONTENT_TYPE
-        self.assertEqual(self.response, self.net.post('uri', self.obj))
-        self.assertTrue(self.response.checked)
+        self.assertEqual(self.checked_response, self.net.post('uri', self.obj))
 
     def test_post(self):
         # pylint: disable=protected-access
-        self.assertEqual(self.response, self.net.post(
+        self.assertEqual(self.checked_response, self.net.post(
             'uri', self.obj, content_type=self.content_type))
-        self.assertTrue(self.response.checked)
         self.net._wrap_in_jws.assert_called_once_with(
-            self.obj, jose.b64decode(self.all_nonces.pop()), "uri", 1)
+            self.obj, jose.b64decode(self.all_nonces.pop()))
 
         self.available_nonces = []
         self.assertRaises(errors.MissingNonce, self.net.post,
                           'uri', self.obj, content_type=self.content_type)
         self.net._wrap_in_jws.assert_called_with(
-            self.obj, jose.b64decode(self.all_nonces.pop()), "uri", 1)
+            self.obj, jose.b64decode(self.all_nonces.pop()))
 
     def test_post_wrong_initial_nonce(self):  # HEAD
         self.available_nonces = [b'f', jose.b64encode(b'good')]
@@ -1219,7 +731,7 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
     def test_post_not_retried(self):
         check_response = mock.MagicMock()
         check_response.side_effect = [messages.Error.with_code('malformed'),
-                                      self.response]
+                                      self.checked_response]
 
         # pylint: disable=protected-access
         self.net._check_response = check_response
@@ -1227,12 +739,13 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
                           self.obj, content_type=self.content_type)
 
     def test_post_successful_retry(self):
-        post_once = mock.MagicMock()
-        post_once.side_effect = [messages.Error.with_code('badNonce'),
-                                      self.response]
+        check_response = mock.MagicMock()
+        check_response.side_effect = [messages.Error.with_code('badNonce'),
+                                      self.checked_response]
 
         # pylint: disable=protected-access
-        self.assertEqual(self.response, self.net.post(
+        self.net._check_response = check_response
+        self.assertEqual(self.checked_response, self.net.post(
             'uri', self.obj, content_type=self.content_type))
 
     def test_head_get_post_error_passthrough(self):
@@ -1243,51 +756,6 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
         self.assertRaises(requests.exceptions.RequestException,
                           self.net.post, 'uri', obj=self.obj)
 
-    def test_post_bad_nonce_head(self):
-        # pylint: disable=protected-access
-        # regression test for https://github.com/certbot/certbot/issues/6092
-        bad_response = mock.MagicMock(ok=False, status_code=http_client.SERVICE_UNAVAILABLE)
-        self.net._send_request = mock.MagicMock()
-        self.net._send_request.return_value = bad_response
-        self.content_type = None
-        check_response = mock.MagicMock()
-        self.net._check_response = check_response
-        self.assertRaises(errors.ClientError, self.net.post, 'uri',
-                          self.obj, content_type=self.content_type, acme_version=2,
-                          new_nonce_url='new_nonce_uri')
-        self.assertEqual(check_response.call_count, 1)
-
-    def test_new_nonce_uri_removed(self):
-        self.content_type = None
-        self.net.post('uri', self.obj, content_type=None,
-            acme_version=2, new_nonce_url='new_nonce_uri')
-
-
-class ClientNetworkSourceAddressBindingTest(unittest.TestCase):
-    """Tests that if ClientNetwork has a source IP set manually, the underlying library has
-    used the provided source address."""
-
-    def setUp(self):
-        self.source_address = "8.8.8.8"
-
-    def test_source_address_set(self):
-        from acme.client import ClientNetwork
-        net = ClientNetwork(key=None, alg=None, source_address=self.source_address)
-        for adapter in net.session.adapters.values():
-            self.assertTrue(self.source_address in adapter.source_address)
-
-    def test_behavior_assumption(self):
-        """This is a test that guardrails the HTTPAdapter behavior so that if the default for
-        a Session() changes, the assumptions here aren't violated silently."""
-        from acme.client import ClientNetwork
-        # Source address not specified, so the default adapter type should be bound -- this
-        # test should fail if the default adapter type is changed by requests
-        net = ClientNetwork(key=None, alg=None)
-        session = requests.Session()
-        for scheme in session.adapters.keys():
-            client_network_adapter = net.session.adapters.get(scheme)
-            default_adapter = session.adapters.get(scheme)
-            self.assertEqual(client_network_adapter.__class__, default_adapter.__class__)
 
 if __name__ == '__main__':
     unittest.main()  # pragma: no cover

acme/acme/crypto_util.py

@@ -5,30 +5,29 @@ import logging
 import os
 import re
 import socket
+import sys
 
-import josepy as jose
-from OpenSSL import crypto
-from OpenSSL import SSL  # type: ignore # https://github.com/python/typeshed/issues/2052
+import OpenSSL
 
 from acme import errors
-from acme.magic_typing import Callable  # pylint: disable=unused-import, no-name-in-module
-from acme.magic_typing import Optional  # pylint: disable=unused-import, no-name-in-module
-from acme.magic_typing import Tuple  # pylint: disable=unused-import, no-name-in-module
-from acme.magic_typing import Union  # pylint: disable=unused-import, no-name-in-module
+
 
 logger = logging.getLogger(__name__)
 
-# Default SSL method selected here is the most compatible, while secure
-# SSL method: TLSv1_METHOD is only compatible with
+# TLSSNI01 certificate serving and probing is not affected by SSL
+# vulnerabilities: prober needs to check certificate for expected
+# contents anyway. Working SNI is the only thing that's necessary for
+# the challenge and thus scoping down SSL/TLS method (version) would
+# cause interoperability issues: TLSv1_METHOD is only compatible with
 # TLSv1_METHOD, while SSLv23_METHOD is compatible with all other
 # methods, including TLSv2_METHOD (read more at
 # https://www.openssl.org/docs/ssl/SSLv23_method.html). _serve_sni
 # should be changed to use "set_options" to disable SSLv2 and SSLv3,
 # in case it's used for things other than probing/serving!
-_DEFAULT_SSL_METHOD = SSL.SSLv23_METHOD  # type: ignore
+_DEFAULT_TLSSNI01_SSL_METHOD = OpenSSL.SSL.SSLv23_METHOD  # type: ignore
 
 
-class SSLSocket(object):
+class SSLSocket(object):  # pylint: disable=too-few-public-methods
     """SSL wrapper for sockets.
 
     :ivar socket sock: Original wrapped socket.
@@ -37,7 +36,7 @@ class SSLSocket(object):
     :ivar method: See `OpenSSL.SSL.Context` for allowed values.
 
     """
-    def __init__(self, sock, certs, method=_DEFAULT_SSL_METHOD):
+    def __init__(self, sock, certs, method=_DEFAULT_TLSSNI01_SSL_METHOD):
         self.sock = sock
         self.certs = certs
         self.method = method
@@ -64,9 +63,9 @@ class SSLSocket(object):
             logger.debug("Server name (%s) not recognized, dropping SSL",
                          server_name)
             return
-        new_context = SSL.Context(self.method)
-        new_context.set_options(SSL.OP_NO_SSLv2)
-        new_context.set_options(SSL.OP_NO_SSLv3)
+        new_context = OpenSSL.SSL.Context(self.method)
+        new_context.set_options(OpenSSL.SSL.OP_NO_SSLv2)
+        new_context.set_options(OpenSSL.SSL.OP_NO_SSLv3)
         new_context.use_privatekey(key)
         new_context.use_certificate(cert)
         connection.set_context(new_context)
@@ -74,7 +73,7 @@ class SSLSocket(object):
     class FakeConnection(object):
         """Fake OpenSSL.SSL.Connection."""
 
-        # pylint: disable=missing-docstring
+        # pylint: disable=too-few-public-methods,missing-docstring
 
         def __init__(self, connection):
             self._wrapped = connection
@@ -89,18 +88,18 @@ class SSLSocket(object):
     def accept(self):  # pylint: disable=missing-docstring
         sock, addr = self.sock.accept()
 
-        context = SSL.Context(self.method)
-        context.set_options(SSL.OP_NO_SSLv2)
-        context.set_options(SSL.OP_NO_SSLv3)
+        context = OpenSSL.SSL.Context(self.method)
+        context.set_options(OpenSSL.SSL.OP_NO_SSLv2)
+        context.set_options(OpenSSL.SSL.OP_NO_SSLv3)
         context.set_tlsext_servername_callback(self._pick_certificate_cb)
 
-        ssl_sock = self.FakeConnection(SSL.Connection(context, sock))
+        ssl_sock = self.FakeConnection(OpenSSL.SSL.Connection(context, sock))
         ssl_sock.set_accept_state()
 
         logger.debug("Performing handshake with %s", addr)
         try:
             ssl_sock.do_handshake()
-        except SSL.Error as error:
+        except OpenSSL.SSL.Error as error:
             # _pick_certificate_cb might have returned without
             # creating SSL context (wrong server name)
             raise socket.error(error)
@@ -109,7 +108,7 @@ class SSLSocket(object):
 
 
 def probe_sni(name, host, port=443, timeout=300,
-              method=_DEFAULT_SSL_METHOD, source_address=('', 0)):
+              method=_DEFAULT_TLSSNI01_SSL_METHOD, source_address=('', 0)):
     """Probe SNI server for SSL certificate.
 
     :param bytes name: Byte string to send as the server name in the
@@ -128,32 +127,31 @@ def probe_sni(name, host, port=443, timeout=300,
     :rtype: OpenSSL.crypto.X509
 
     """
-    context = SSL.Context(method)
+    context = OpenSSL.SSL.Context(method)
     context.set_timeout(timeout)
 
-    socket_kwargs = {'source_address': source_address}
+    socket_kwargs = {} if sys.version_info < (2, 7) else {
+        'source_address': source_address}
+
+    host_protocol_agnostic = None if host == '::' or host == '0' else host
 
     try:
-        logger.debug(
-            "Attempting to connect to %s:%d%s.", host, port,
-            " from {0}:{1}".format(
-                source_address[0],
-                source_address[1]
-            ) if socket_kwargs else ""
-        )
-        socket_tuple = (host, port)  # type: Tuple[str, int]
-        sock = socket.create_connection(socket_tuple, **socket_kwargs)  # type: ignore
+        # pylint: disable=star-args
+        logger.debug("Attempting to connect to %s:%d%s.", host_protocol_agnostic, port,
+            " from {0}:{1}".format(source_address[0], source_address[1]) if \
+            socket_kwargs else "")
+        sock = socket.create_connection((host_protocol_agnostic, port), **socket_kwargs)
     except socket.error as error:
         raise errors.Error(error)
 
     with contextlib.closing(sock) as client:
-        client_ssl = SSL.Connection(context, client)
+        client_ssl = OpenSSL.SSL.Connection(context, client)
         client_ssl.set_connect_state()
         client_ssl.set_tlsext_host_name(name)  # pyOpenSSL>=0.13
         try:
             client_ssl.do_handshake()
             client_ssl.shutdown()
-        except SSL.Error as error:
+        except OpenSSL.SSL.Error as error:
             raise errors.Error(error)
     return client_ssl.get_peer_certificate()
 
@@ -166,18 +164,18 @@ def make_csr(private_key_pem, domains, must_staple=False):
         OCSP Must Staple: https://tools.ietf.org/html/rfc7633).
     :returns: buffer PEM-encoded Certificate Signing Request.
     """
-    private_key = crypto.load_privatekey(
-        crypto.FILETYPE_PEM, private_key_pem)
-    csr = crypto.X509Req()
+    private_key = OpenSSL.crypto.load_privatekey(
+        OpenSSL.crypto.FILETYPE_PEM, private_key_pem)
+    csr = OpenSSL.crypto.X509Req()
     extensions = [
-        crypto.X509Extension(
+        OpenSSL.crypto.X509Extension(
             b'subjectAltName',
             critical=False,
             value=', '.join('DNS:' + d for d in domains).encode('ascii')
         ),
     ]
     if must_staple:
-        extensions.append(crypto.X509Extension(
+        extensions.append(OpenSSL.crypto.X509Extension(
             b"1.3.6.1.5.5.7.1.24",
             critical=False,
             value=b"DER:30:03:02:01:05"))
@@ -185,16 +183,8 @@ def make_csr(private_key_pem, domains, must_staple=False):
     csr.set_pubkey(private_key)
     csr.set_version(2)
     csr.sign(private_key, 'sha256')
-    return crypto.dump_certificate_request(
-        crypto.FILETYPE_PEM, csr)
-
-def _pyopenssl_cert_or_req_all_names(loaded_cert_or_req):
-    common_name = loaded_cert_or_req.get_subject().CN
-    sans = _pyopenssl_cert_or_req_san(loaded_cert_or_req)
-
-    if common_name is None:
-        return sans
-    return [common_name] + [d for d in sans if d != common_name]
+    return OpenSSL.crypto.dump_certificate_request(
+        OpenSSL.crypto.FILETYPE_PEM, csr)
 
 def _pyopenssl_cert_or_req_san(cert_or_req):
     """Get Subject Alternative Names from certificate or CSR using pyOpenSSL.
@@ -222,12 +212,11 @@ def _pyopenssl_cert_or_req_san(cert_or_req):
     parts_separator = ", "
     prefix = "DNS" + part_separator
 
-    if isinstance(cert_or_req, crypto.X509):
-        # pylint: disable=line-too-long
-        func = crypto.dump_certificate # type: Union[Callable[[int, crypto.X509Req], bytes], Callable[[int, crypto.X509], bytes]]
+    if isinstance(cert_or_req, OpenSSL.crypto.X509):
+        func = OpenSSL.crypto.dump_certificate
     else:
-        func = crypto.dump_certificate_request
-    text = func(crypto.FILETYPE_TEXT, cert_or_req).decode("utf-8")
+        func = OpenSSL.crypto.dump_certificate_request
+    text = func(OpenSSL.crypto.FILETYPE_TEXT, cert_or_req).decode("utf-8")
     # WARNING: this function does not support multiple SANs extensions.
     # Multiple X509v3 extensions of the same type is disallowed by RFC 5280.
     match = re.search(r"X509v3 Subject Alternative Name:(?: critical)?\s*(.*)", text)
@@ -254,12 +243,12 @@ def gen_ss_cert(key, domains, not_before=None,
 
     """
     assert domains, "Must provide one or more hostnames for the cert."
-    cert = crypto.X509()
+    cert = OpenSSL.crypto.X509()
     cert.set_serial_number(int(binascii.hexlify(os.urandom(16)), 16))
     cert.set_version(2)
 
     extensions = [
-        crypto.X509Extension(
+        OpenSSL.crypto.X509Extension(
             b"basicConstraints", True, b"CA:TRUE, pathlen:0"),
     ]
 
@@ -268,7 +257,7 @@ def gen_ss_cert(key, domains, not_before=None,
     cert.set_issuer(cert.get_subject())
 
     if force_san or len(domains) > 1:
-        extensions.append(crypto.X509Extension(
+        extensions.append(OpenSSL.crypto.X509Extension(
             b"subjectAltName",
             critical=False,
             value=b", ".join(b"DNS:" + d.encode() for d in domains)
@@ -282,26 +271,3 @@ def gen_ss_cert(key, domains, not_before=None,
     cert.set_pubkey(key)
     cert.sign(key, "sha256")
     return cert
-
-def dump_pyopenssl_chain(chain, filetype=crypto.FILETYPE_PEM):
-    """Dump certificate chain into a bundle.
-
-    :param list chain: List of `OpenSSL.crypto.X509` (or wrapped in
-        :class:`josepy.util.ComparableX509`).
-
-    :returns: certificate chain bundle
-    :rtype: bytes
-
-    """
-    # XXX: returns empty string when no chain is available, which
-    # shuts up RenewableCert, but might not be the best solution...
-
-    def _dump_cert(cert):
-        if isinstance(cert, jose.ComparableX509):
-            # pylint: disable=protected-access
-            cert = cert.wrapped
-        return crypto.dump_certificate(filetype, cert)
-
-    # assumes that OpenSSL.crypto.dump_certificate includes ending
-    # newline character
-    return b"".join(_dump_cert(cert) for cert in chain)

acme/acme/crypto_util_test.py

@@ -5,14 +5,14 @@ import threading
 import time
 import unittest
 
+import six
+from six.moves import socketserver  #type: ignore  # pylint: disable=import-error
+
 import josepy as jose
 import OpenSSL
-import six
-from six.moves import socketserver  # type: ignore  # pylint: disable=import-error
 
 from acme import errors
-from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
-import test_util
+from acme import test_util
 
 
 class SSLSocketAndProbeSNITest(unittest.TestCase):
@@ -29,6 +29,7 @@ class SSLSocketAndProbeSNITest(unittest.TestCase):
 
         class _TestServer(socketserver.TCPServer):
 
+            # pylint: disable=too-few-public-methods
             # six.moves.* | pylint: disable=attribute-defined-outside-init,no-init
 
             def server_bind(self):  # pylint: disable=missing-docstring
@@ -38,63 +39,30 @@ class SSLSocketAndProbeSNITest(unittest.TestCase):
         self.server = _TestServer(('', 0), socketserver.BaseRequestHandler)
         self.port = self.server.socket.getsockname()[1]
         self.server_thread = threading.Thread(
+            # pylint: disable=no-member
             target=self.server.handle_request)
+        self.server_thread.start()
+        time.sleep(1)  # TODO: avoid race conditions in other way
 
     def tearDown(self):
-        if self.server_thread.is_alive():
-            # The thread may have already terminated.
-            self.server_thread.join()  # pragma: no cover
+        self.server_thread.join()
 
     def _probe(self, name):
         from acme.crypto_util import probe_sni
         return jose.ComparableX509(probe_sni(
             name, host='127.0.0.1', port=self.port))
 
-    def _start_server(self):
-        self.server_thread.start()
-        time.sleep(1)  # TODO: avoid race conditions in other way
-
     def test_probe_ok(self):
-        self._start_server()
         self.assertEqual(self.cert, self._probe(b'foo'))
 
     def test_probe_not_recognized_name(self):
-        self._start_server()
         self.assertRaises(errors.Error, self._probe, b'bar')
 
-    def test_probe_connection_error(self):
-        # pylint has a hard time with six
-        self.server.server_close()
-        original_timeout = socket.getdefaulttimeout()
-        try:
-            socket.setdefaulttimeout(1)
-            self.assertRaises(errors.Error, self._probe, b'bar')
-        finally:
-            socket.setdefaulttimeout(original_timeout)
-
-
-class PyOpenSSLCertOrReqAllNamesTest(unittest.TestCase):
-    """Test for acme.crypto_util._pyopenssl_cert_or_req_all_names."""
-
-    @classmethod
-    def _call(cls, loader, name):
-        # pylint: disable=protected-access
-        from acme.crypto_util import _pyopenssl_cert_or_req_all_names
-        return _pyopenssl_cert_or_req_all_names(loader(name))
-
-    def _call_cert(self, name):
-        return self._call(test_util.load_cert, name)
-
-    def test_cert_one_san_no_common(self):
-        self.assertEqual(self._call_cert('cert-nocn.der'),
-                         ['no-common-name.badssl.com'])
-
-    def test_cert_no_sans_yes_common(self):
-        self.assertEqual(self._call_cert('cert.pem'), ['example.com'])
-
-    def test_cert_two_sans_yes_common(self):
-        self.assertEqual(self._call_cert('cert-san.pem'),
-                         ['example.com', 'www.example.com'])
+    # TODO: py33/py34 tox hangs forever on do_handshake in second probe
+    #def probe_connection_error(self):
+    #    self._probe(b'foo')
+    #    #time.sleep(1)  # TODO: avoid race conditions in other way
+    #    self.assertRaises(errors.Error, self._probe, b'bar')
 
 
 class PyOpenSSLCertOrReqSANTest(unittest.TestCase):
@@ -173,7 +141,7 @@ class RandomSnTest(unittest.TestCase):
 
     def setUp(self):
         self.cert_count = 5
-        self.serial_num = [] # type: List[int]
+        self.serial_num = []
         self.key = OpenSSL.crypto.PKey()
         self.key.generate_key(OpenSSL.crypto.TYPE_RSA, 2048)
 
@@ -202,12 +170,12 @@ class MakeCSRTest(unittest.TestCase):
         self.assertTrue(b'--END CERTIFICATE REQUEST--' in csr_pem)
         csr = OpenSSL.crypto.load_certificate_request(
             OpenSSL.crypto.FILETYPE_PEM, csr_pem)
-        # In pyopenssl 0.13 (used with TOXENV=py27-oldest), csr objects don't
-        # have a get_extensions() method, so we skip this test if the method
-        # isn't available.
+        # In pyopenssl 0.13 (used with TOXENV=py26-oldest and py27-oldest), csr
+        # objects don't have a get_extensions() method, so we skip this test if
+        # the method isn't available.
         if hasattr(csr, 'get_extensions'):
-            self.assertEqual(len(csr.get_extensions()), 1)
-            self.assertEqual(csr.get_extensions()[0].get_data(),
+            self.assertEquals(len(csr.get_extensions()), 1)
+            self.assertEquals(csr.get_extensions()[0].get_data(),
                 OpenSSL.crypto.X509Extension(
                     b'subjectAltName',
                     critical=False,
@@ -220,11 +188,11 @@ class MakeCSRTest(unittest.TestCase):
         csr = OpenSSL.crypto.load_certificate_request(
             OpenSSL.crypto.FILETYPE_PEM, csr_pem)
 
-        # In pyopenssl 0.13 (used with TOXENV=py27-oldest), csr objects don't
-        # have a get_extensions() method, so we skip this test if the method
-        # isn't available.
+        # In pyopenssl 0.13 (used with TOXENV=py26-oldest and py27-oldest), csr
+        # objects don't have a get_extensions() method, so we skip this test if
+        # the method isn't available.
         if hasattr(csr, 'get_extensions'):
-            self.assertEqual(len(csr.get_extensions()), 2)
+            self.assertEquals(len(csr.get_extensions()), 2)
             # NOTE: Ideally we would filter by the TLS Feature OID, but
             # OpenSSL.crypto.X509Extension doesn't give us the extension's raw OID,
             # and the shortname field is just "UNDEF"
@@ -233,33 +201,5 @@ class MakeCSRTest(unittest.TestCase):
             self.assertEqual(len(must_staple_exts), 1,
                 "Expected exactly one Must Staple extension")
 
-
-class DumpPyopensslChainTest(unittest.TestCase):
-    """Test for dump_pyopenssl_chain."""
-
-    @classmethod
-    def _call(cls, loaded):
-        # pylint: disable=protected-access
-        from acme.crypto_util import dump_pyopenssl_chain
-        return dump_pyopenssl_chain(loaded)
-
-    def test_dump_pyopenssl_chain(self):
-        names = ['cert.pem', 'cert-san.pem', 'cert-idnsans.pem']
-        loaded = [test_util.load_cert(name) for name in names]
-        length = sum(
-            len(OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_PEM, cert))
-            for cert in loaded)
-        self.assertEqual(len(self._call(loaded)), length)
-
-    def test_dump_pyopenssl_chain_wrapped(self):
-        names = ['cert.pem', 'cert-san.pem', 'cert-idnsans.pem']
-        loaded = [test_util.load_cert(name) for name in names]
-        wrap_func = jose.ComparableX509
-        wrapped = [wrap_func(cert) for cert in loaded]
-        dump_func = OpenSSL.crypto.dump_certificate
-        length = sum(len(dump_func(OpenSSL.crypto.FILETYPE_PEM, cert)) for cert in loaded)
-        self.assertEqual(len(self._call(wrapped)), length)
-
-
 if __name__ == '__main__':
     unittest.main()  # pragma: no cover

acme/acme/errors.py

@@ -29,12 +29,7 @@ class NonceError(ClientError):
 class BadNonce(NonceError):
     """Bad nonce error."""
     def __init__(self, nonce, error, *args, **kwargs):
-        # MyPy complains here that there is too many arguments for BaseException constructor.
-        # This is an error fixed in typeshed, see https://github.com/python/mypy/issues/4183
-        # The fix is included in MyPy>=0.740, but upgrading it would bring dozen of errors due to
-        #   new types definitions. So we ignore the error until the code base is fixed to match
-        #   with MyPy>=0.740 referential.
-        super(BadNonce, self).__init__(*args, **kwargs)  # type: ignore
+        super(BadNonce, self).__init__(*args, **kwargs)
         self.nonce = nonce
         self.error = error
 
@@ -53,8 +48,7 @@ class MissingNonce(NonceError):
 
     """
     def __init__(self, response, *args, **kwargs):
-        # See comment in BadNonce constructor above for an explanation of type: ignore here.
-        super(MissingNonce, self).__init__(*args, **kwargs)  # type: ignore
+        super(MissingNonce, self).__init__(*args, **kwargs)
         self.response = response
 
     def __str__(self):
@@ -89,44 +83,13 @@ class PollError(ClientError):
         return '{0}(exhausted={1!r}, updated={2!r})'.format(
             self.__class__.__name__, self.exhausted, self.updated)
 
-
-class ValidationError(Error):
-    """Error for authorization failures. Contains a list of authorization
-    resources, each of which is invalid and should have an error field.
-    """
-    def __init__(self, failed_authzrs):
-        self.failed_authzrs = failed_authzrs
-        super(ValidationError, self).__init__()
-
-
-class TimeoutError(Error):  # pylint: disable=redefined-builtin
-    """Error for when polling an authorization or an order times out."""
-
-
-class IssuanceError(Error):
-    """Error sent by the server after requesting issuance of a certificate."""
-
-    def __init__(self, error):
-        """Initialize.
-
-        :param messages.Error error: The error provided by the server.
-        """
-        self.error = error
-        super(IssuanceError, self).__init__()
-
-
 class ConflictError(ClientError):
     """Error for when the server returns a 409 (Conflict) HTTP status.
 
     In the version of ACME implemented by Boulder, this is used to find an
     account if you only have the private key, but don't know the account URL.
-
-    Also used in V2 of the ACME client for the same purpose.
     """
     def __init__(self, location):
         self.location = location
         super(ConflictError, self).__init__()
 
-
-class WildcardUnsupportedError(Error):
-    """Error for when a wildcard is requested but is unsupported by ACME CA."""

acme/acme/fields.py

@@ -4,6 +4,7 @@ import logging
 import josepy as jose
 import pyrfc3339
 
+
 logger = logging.getLogger(__name__)
 
 

acme/acme/jws.py

@@ -40,10 +40,10 @@ class Signature(jose.Signature):
 class JWS(jose.JWS):
     """ACME-specific JWS. Includes none, url, and kid in protected header."""
     signature_cls = Signature
-    __slots__ = jose.JWS._orig_slots
+    __slots__ = jose.JWS._orig_slots  # pylint: disable=no-member
 
     @classmethod
-    # pylint: disable=arguments-differ
+    # pylint: disable=arguments-differ,too-many-arguments
     def sign(cls, payload, key, alg, nonce, url=None, kid=None):
         # Per ACME spec, jwk and kid are mutually exclusive, so only include a
         # jwk field if kid is not provided.

acme/acme/jws_test.py

@@ -3,7 +3,8 @@ import unittest
 
 import josepy as jose
 
-import test_util
+from acme import test_util
+
 
 KEY = jose.JWKRSA.load(test_util.load_vector('rsa512_key.pem'))
 

acme/acme/magic_typing.py

@@ -1,17 +0,0 @@
-"""Shim class to not have to depend on typing module in prod."""
-import sys
-
-
-class TypingClass(object):
-    """Ignore import errors by getting anything"""
-    def __getattr__(self, name):
-        return None
-
-try:
-    # mypy doesn't respect modifying sys.modules
-    from typing import *  # pylint: disable=wildcard-import, unused-wildcard-import
-    # pylint: disable=unused-import
-    from typing import Collection, IO  # type: ignore
-    # pylint: enable=unused-import
-except ImportError:
-    sys.modules[__name__] = TypingClass()

acme/acme/messages.py

@@ -1,56 +1,32 @@
 """ACME protocol messages."""
-import json
+import collections
+import six
 
 import josepy as jose
-import six
 
 from acme import challenges
 from acme import errors
 from acme import fields
-from acme import jws
 from acme import util
 
-try:
-    from collections.abc import Hashable  # pylint: disable=no-name-in-module
-except ImportError:  # pragma: no cover
-    from collections import Hashable
-
-
-
 OLD_ERROR_PREFIX = "urn:acme:error:"
 ERROR_PREFIX = "urn:ietf:params:acme:error:"
 
 ERROR_CODES = {
-    'accountDoesNotExist': 'The request specified an account that does not exist',
-    'alreadyRevoked': 'The request specified a certificate to be revoked that has' \
-    ' already been revoked',
     'badCSR': 'The CSR is unacceptable (e.g., due to a short key)',
     'badNonce': 'The client sent an unacceptable anti-replay nonce',
-    'badPublicKey': 'The JWS was signed by a public key the server does not support',
-    'badRevocationReason': 'The revocation reason provided is not allowed by the server',
-    'badSignatureAlgorithm': 'The JWS was signed with an algorithm the server does not support',
-    'caa': 'Certification Authority Authorization (CAA) records forbid the CA from issuing' \
-    ' a certificate',
-    'compound': 'Specific error conditions are indicated in the "subproblems" array',
     'connection': ('The server could not connect to the client to verify the'
                    ' domain'),
-    'dns': 'There was a problem with a DNS query during identifier validation',
     'dnssec': 'The server could not validate a DNSSEC signed domain',
-    'incorrectResponse': 'Response recieved didn\'t match the challenge\'s requirements',
     # deprecate invalidEmail
     'invalidEmail': 'The provided email for a registration was invalid',
     'invalidContact': 'The provided contact URI was invalid',
     'malformed': 'The request message was malformed',
-    'rejectedIdentifier': 'The server will not issue certificates for the identifier',
-    'orderNotReady': 'The request attempted to finalize an order that is not ready to be finalized',
     'rateLimited': 'There were too many requests of a given type',
     'serverInternal': 'The server experienced an internal error',
     'tls': 'The server experienced a TLS error during domain verification',
     'unauthorized': 'The client lacks sufficient authorization',
-    'unsupportedContact': 'A contact URL for an account used an unsupported protocol scheme',
     'unknownHost': 'The server could not resolve a domain name',
-    'unsupportedIdentifier': 'An identifier is of an unsupported type',
-    'externalAccountRequired': 'The server requires external account binding',
 }
 
 ERROR_TYPE_DESCRIPTIONS = dict(
@@ -64,7 +40,8 @@ def is_acme_error(err):
     """Check if argument is an ACME error."""
     if isinstance(err, Error) and (err.typ is not None):
         return (ERROR_PREFIX in err.typ) or (OLD_ERROR_PREFIX in err.typ)
-    return False
+    else:
+        return False
 
 
 @six.python_2_unicode_compatible
@@ -119,7 +96,6 @@ class Error(jose.JSONObjectWithFields, errors.Error):
         code = str(self.typ).split(':')[-1]
         if code in ERROR_CODES:
             return code
-        return None
 
     def __str__(self):
         return b' :: '.join(
@@ -128,25 +104,24 @@ class Error(jose.JSONObjectWithFields, errors.Error):
             if part is not None).decode()
 
 
-class _Constant(jose.JSONDeSerializable, Hashable):  # type: ignore
+class _Constant(jose.JSONDeSerializable, collections.Hashable):  # type: ignore
     """ACME constant."""
     __slots__ = ('name',)
     POSSIBLE_NAMES = NotImplemented
 
     def __init__(self, name):
-        super(_Constant, self).__init__()
-        self.POSSIBLE_NAMES[name] = self  # pylint: disable=unsupported-assignment-operation
+        self.POSSIBLE_NAMES[name] = self
         self.name = name
 
     def to_partial_json(self):
         return self.name
 
     @classmethod
-    def from_json(cls, jobj):
-        if jobj not in cls.POSSIBLE_NAMES:  # pylint: disable=unsupported-membership-test
+    def from_json(cls, value):
+        if value not in cls.POSSIBLE_NAMES:
             raise jose.DeserializationError(
                 '{0} not recognized'.format(cls.__name__))
-        return cls.POSSIBLE_NAMES[jobj]
+        return cls.POSSIBLE_NAMES[value]
 
     def __repr__(self):
         return '{0}({1})'.format(self.__class__.__name__, self.name)
@@ -170,8 +145,6 @@ STATUS_PROCESSING = Status('processing')
 STATUS_VALID = Status('valid')
 STATUS_INVALID = Status('invalid')
 STATUS_REVOKED = Status('revoked')
-STATUS_READY = Status('ready')
-STATUS_DEACTIVATED = Status('deactivated')
 
 
 class IdentifierType(_Constant):
@@ -198,30 +171,9 @@ class Directory(jose.JSONDeSerializable):
 
     class Meta(jose.JSONObjectWithFields):
         """Directory Meta."""
-        _terms_of_service = jose.Field('terms-of-service', omitempty=True)
-        _terms_of_service_v2 = jose.Field('termsOfService', omitempty=True)
+        terms_of_service = jose.Field('terms-of-service', omitempty=True)
         website = jose.Field('website', omitempty=True)
-        caa_identities = jose.Field('caaIdentities', omitempty=True)
-        external_account_required = jose.Field('externalAccountRequired', omitempty=True)
-
-        def __init__(self, **kwargs):
-            kwargs = dict((self._internal_name(k), v) for k, v in kwargs.items())
-            super(Directory.Meta, self).__init__(**kwargs)
-
-        @property
-        def terms_of_service(self):
-            """URL for the CA TOS"""
-            return self._terms_of_service or self._terms_of_service_v2
-
-        def __iter__(self):
-            # When iterating over fields, use the external name 'terms_of_service' instead of
-            # the internal '_terms_of_service'.
-            for name in super(Directory.Meta, self).__iter__():
-                yield name[1:] if name == '_terms_of_service' else name
-
-        def _internal_name(self, name):
-            return '_' + name if name == 'terms_of_service' else name
-
+        caa_identities = jose.Field('caa-identities', omitempty=True)
 
     @classmethod
     def _canon_key(cls, key):
@@ -284,24 +236,6 @@ class ResourceBody(jose.JSONObjectWithFields):
     """ACME Resource Body."""
 
 
-class ExternalAccountBinding(object):
-    """ACME External Account Binding"""
-
-    @classmethod
-    def from_data(cls, account_public_key, kid, hmac_key, directory):
-        """Create External Account Binding Resource from contact details, kid and hmac."""
-
-        key_json = json.dumps(account_public_key.to_partial_json()).encode()
-        decoded_hmac_key = jose.b64.b64decode(hmac_key)
-        url = directory["newAccount"]
-
-        eab = jws.JWS.sign(key_json, jose.jwk.JWKOct(key=decoded_hmac_key),
-                           jose.jwa.HS256, None,
-                           url, kid)
-
-        return eab.to_partial_json()
-
-
 class Registration(ResourceBody):
     """Registration Resource Body.
 
@@ -317,31 +251,24 @@ class Registration(ResourceBody):
     contact = jose.Field('contact', omitempty=True, default=())
     agreement = jose.Field('agreement', omitempty=True)
     status = jose.Field('status', omitempty=True)
-    terms_of_service_agreed = jose.Field('termsOfServiceAgreed', omitempty=True)
-    only_return_existing = jose.Field('onlyReturnExisting', omitempty=True)
-    external_account_binding = jose.Field('externalAccountBinding', omitempty=True)
 
     phone_prefix = 'tel:'
     email_prefix = 'mailto:'
 
     @classmethod
-    def from_data(cls, phone=None, email=None, external_account_binding=None, **kwargs):
+    def from_data(cls, phone=None, email=None, **kwargs):
         """Create registration resource from contact details."""
         details = list(kwargs.pop('contact', ()))
         if phone is not None:
             details.append(cls.phone_prefix + phone)
         if email is not None:
-            details.extend([cls.email_prefix + mail for mail in email.split(',')])
+            details.append(cls.email_prefix + email)
         kwargs['contact'] = tuple(details)
-
-        if external_account_binding:
-            kwargs['external_account_binding'] = external_account_binding
-
         return cls(**kwargs)
 
     def _filter_contact(self, prefix):
         return tuple(
-            detail[len(prefix):] for detail in self.contact  # pylint: disable=not-an-iterable
+            detail[len(prefix):] for detail in self.contact
             if detail.startswith(prefix))
 
     @property
@@ -413,6 +340,7 @@ class ChallengeBody(ResourceBody):
 
     def __init__(self, **kwargs):
         kwargs = dict((self._internal_name(k), v) for k, v in kwargs.items())
+        # pylint: disable=star-args
         super(ChallengeBody, self).__init__(**kwargs)
 
     def encode(self, name):
@@ -475,7 +403,7 @@ class Authorization(ResourceBody):
     :ivar datetime.datetime expires:
 
     """
-    identifier = jose.Field('identifier', decoder=Identifier.from_json, omitempty=True)
+    identifier = jose.Field('identifier', decoder=Identifier.from_json)
     challenges = jose.Field('challenges', omitempty=True)
     combinations = jose.Field('combinations', omitempty=True)
 
@@ -485,7 +413,6 @@ class Authorization(ResourceBody):
     # be absent'... then acme-spec gives example with 'expires'
     # present... That's confusing!
     expires = fields.RFC3339Field('expires', omitempty=True)
-    wildcard = jose.Field('wildcard', omitempty=True)
 
     @challenges.decoder
     def challenges(value):  # pylint: disable=missing-docstring,no-self-argument
@@ -495,7 +422,7 @@ class Authorization(ResourceBody):
     def resolved_combinations(self):
         """Combinations with challenges instead of indices."""
         return tuple(tuple(self.challenges[idx] for idx in combo)
-                     for combo in self.combinations)  # pylint: disable=not-an-iterable
+                     for combo in self.combinations)
 
 
 @Directory.register
@@ -505,12 +432,6 @@ class NewAuthorization(Authorization):
     resource = fields.Resource(resource_type)
 
 
-class UpdateAuthorization(Authorization):
-    """Update authorization."""
-    resource_type = 'authz'
-    resource = fields.Resource(resource_type)
-
-
 class AuthorizationResource(ResourceWithURI):
     """Authorization Resource.
 
@@ -561,49 +482,3 @@ class Revocation(jose.JSONObjectWithFields):
     certificate = jose.Field(
         'certificate', decoder=jose.decode_cert, encoder=jose.encode_cert)
     reason = jose.Field('reason')
-
-
-class Order(ResourceBody):
-    """Order Resource Body.
-
-    :ivar list of .Identifier: List of identifiers for the certificate.
-    :ivar acme.messages.Status status:
-    :ivar list of str authorizations: URLs of authorizations.
-    :ivar str certificate: URL to download certificate as a fullchain PEM.
-    :ivar str finalize: URL to POST to to request issuance once all
-        authorizations have "valid" status.
-    :ivar datetime.datetime expires: When the order expires.
-    :ivar .Error error: Any error that occurred during finalization, if applicable.
-    """
-    identifiers = jose.Field('identifiers', omitempty=True)
-    status = jose.Field('status', decoder=Status.from_json,
-                        omitempty=True)
-    authorizations = jose.Field('authorizations', omitempty=True)
-    certificate = jose.Field('certificate', omitempty=True)
-    finalize = jose.Field('finalize', omitempty=True)
-    expires = fields.RFC3339Field('expires', omitempty=True)
-    error = jose.Field('error', omitempty=True, decoder=Error.from_json)
-
-    @identifiers.decoder
-    def identifiers(value):  # pylint: disable=missing-docstring,no-self-argument
-        return tuple(Identifier.from_json(identifier) for identifier in value)
-
-class OrderResource(ResourceWithURI):
-    """Order Resource.
-
-    :ivar acme.messages.Order body:
-    :ivar str csr_pem: The CSR this Order will be finalized with.
-    :ivar list of acme.messages.AuthorizationResource authorizations:
-        Fully-fetched AuthorizationResource objects.
-    :ivar str fullchain_pem: The fetched contents of the certificate URL
-        produced once the order was finalized, if it's present.
-    """
-    body = jose.Field('body', decoder=Order.from_json)
-    csr_pem = jose.Field('csr_pem', omitempty=True)
-    authorizations = jose.Field('authorizations')
-    fullchain_pem = jose.Field('fullchain_pem', omitempty=True)
-
-@Directory.register
-class NewOrder(Order):
-    """New order."""
-    resource_type = 'new-order'

acme/acme/messages_test.py

@@ -5,8 +5,8 @@ import josepy as jose
 import mock
 
 from acme import challenges
-from acme.magic_typing import Dict  # pylint: disable=unused-import, no-name-in-module
-import test_util
+from acme import test_util
+
 
 CERT = test_util.load_comparable_cert('cert.der')
 CSR = test_util.load_comparable_csr('csr.der')
@@ -18,7 +18,8 @@ class ErrorTest(unittest.TestCase):
 
     def setUp(self):
         from acme.messages import Error, ERROR_PREFIX
-        self.error = Error.with_code('malformed', detail='foo', title='title')
+        self.error = Error(
+            detail='foo', typ=ERROR_PREFIX + 'malformed', title='title')
         self.jobj = {
             'detail': 'foo',
             'title': 'some title',
@@ -26,6 +27,7 @@ class ErrorTest(unittest.TestCase):
         }
         self.error_custom = Error(typ='custom', detail='bar')
         self.empty_error = Error()
+        self.jobj_custom = {'type': 'custom', 'detail': 'bar'}
 
     def test_default_typ(self):
         from acme.messages import Error
@@ -40,7 +42,8 @@ class ErrorTest(unittest.TestCase):
         hash(Error.from_json(self.error.to_json()))
 
     def test_description(self):
-        self.assertEqual('The request message was malformed', self.error.description)
+        self.assertEqual(
+            'The request message was malformed', self.error.description)
         self.assertTrue(self.error_custom.description is None)
 
     def test_code(self):
@@ -50,17 +53,17 @@ class ErrorTest(unittest.TestCase):
         self.assertEqual(None, Error().code)
 
     def test_is_acme_error(self):
-        from acme.messages import is_acme_error, Error
+        from acme.messages import is_acme_error
         self.assertTrue(is_acme_error(self.error))
         self.assertFalse(is_acme_error(self.error_custom))
-        self.assertFalse(is_acme_error(Error()))
         self.assertFalse(is_acme_error(self.empty_error))
         self.assertFalse(is_acme_error("must pet all the {dogs|rabbits}"))
 
     def test_unicode_error(self):
-        from acme.messages import Error, is_acme_error
-        arabic_error = Error.with_code(
-            'malformed', detail=u'\u0639\u062f\u0627\u0644\u0629', title='title')
+        from acme.messages import Error, ERROR_PREFIX, is_acme_error
+        arabic_error = Error(
+                detail=u'\u0639\u062f\u0627\u0644\u0629', typ=ERROR_PREFIX + 'malformed',
+            title='title')
         self.assertTrue(is_acme_error(arabic_error))
 
     def test_with_code(self):
@@ -82,7 +85,7 @@ class ConstantTest(unittest.TestCase):
         from acme.messages import _Constant
 
         class MockConstant(_Constant):  # pylint: disable=missing-docstring
-            POSSIBLE_NAMES = {} # type: Dict
+            POSSIBLE_NAMES = {}
 
         self.MockConstant = MockConstant  # pylint: disable=invalid-name
         self.const_a = MockConstant('a')
@@ -154,7 +157,7 @@ class DirectoryTest(unittest.TestCase):
             'meta': {
                 'terms-of-service': 'https://example.com/acme/terms',
                 'website': 'https://www.example.com/',
-                'caaIdentities': ['example.com'],
+                'caa-identities': ['example.com'],
             },
         })
 
@@ -162,31 +165,6 @@ class DirectoryTest(unittest.TestCase):
         from acme.messages import Directory
         Directory.from_json({'foo': 'bar'})
 
-    def test_iter_meta(self):
-        result = False
-        for k in self.dir.meta:
-            if k == 'terms_of_service':
-                result = self.dir.meta[k] == 'https://example.com/acme/terms'
-        self.assertTrue(result)
-
-
-class ExternalAccountBindingTest(unittest.TestCase):
-    def setUp(self):
-        from acme.messages import Directory
-        self.key = jose.jwk.JWKRSA(key=KEY.public_key())
-        self.kid = "kid-for-testing"
-        self.hmac_key = "hmac-key-for-testing"
-        self.dir = Directory({
-            'newAccount': 'http://url/acme/new-account',
-        })
-
-    def test_from_data(self):
-        from acme.messages import ExternalAccountBinding
-        eab = ExternalAccountBinding.from_data(self.key, self.kid, self.hmac_key, self.dir)
-
-        self.assertEqual(len(eab), 3)
-        self.assertEqual(sorted(eab.keys()), sorted(['protected', 'payload', 'signature']))
-
 
 class RegistrationTest(unittest.TestCase):
     """Tests for acme.messages.Registration."""
@@ -219,22 +197,6 @@ class RegistrationTest(unittest.TestCase):
             'mailto:admin@foo.com',
         ))
 
-    def test_new_registration_from_data_with_eab(self):
-        from acme.messages import NewRegistration, ExternalAccountBinding, Directory
-        key = jose.jwk.JWKRSA(key=KEY.public_key())
-        kid = "kid-for-testing"
-        hmac_key = "hmac-key-for-testing"
-        directory = Directory({
-            'newAccount': 'http://url/acme/new-account',
-        })
-        eab = ExternalAccountBinding.from_data(key, kid, hmac_key, directory)
-        reg = NewRegistration.from_data(email='admin@foo.com', external_account_binding=eab)
-        self.assertEqual(reg.contact, (
-            'mailto:admin@foo.com',
-        ))
-        self.assertEqual(sorted(reg.external_account_binding.keys()),
-                         sorted(['protected', 'payload', 'signature']))
-
     def test_phones(self):
         self.assertEqual(('1234',), self.reg.phones)
 
@@ -301,7 +263,8 @@ class ChallengeBodyTest(unittest.TestCase):
         from acme.messages import Error
         from acme.messages import STATUS_INVALID
         self.status = STATUS_INVALID
-        error = Error.with_code('serverInternal', detail='Unable to communicate with DNS server')
+        error = Error(typ='urn:ietf:params:acme:error:serverInternal',
+                      detail='Unable to communicate with DNS server')
         self.challb = ChallengeBody(
             uri='http://challb', chall=self.chall, status=self.status,
             error=error)
@@ -438,34 +401,5 @@ class RevocationTest(unittest.TestCase):
         hash(Revocation.from_json(self.rev.to_json()))
 
 
-class OrderResourceTest(unittest.TestCase):
-    """Tests for acme.messages.OrderResource."""
-
-    def setUp(self):
-        from acme.messages import OrderResource
-        self.regr = OrderResource(
-            body=mock.sentinel.body, uri=mock.sentinel.uri)
-
-    def test_to_partial_json(self):
-        self.assertEqual(self.regr.to_json(), {
-            'body': mock.sentinel.body,
-            'uri': mock.sentinel.uri,
-            'authorizations': None,
-        })
-
-class NewOrderTest(unittest.TestCase):
-    """Tests for acme.messages.NewOrder."""
-
-    def setUp(self):
-        from acme.messages import NewOrder
-        self.reg = NewOrder(
-            identifiers=mock.sentinel.identifiers)
-
-    def test_to_partial_json(self):
-        self.assertEqual(self.reg.to_json(), {
-            'identifiers': mock.sentinel.identifiers,
-        })
-
-
 if __name__ == '__main__':
     unittest.main()  # pragma: no cover

acme/acme/standalone.py

@@ -1,22 +1,27 @@
 """Support for standalone client challenge solvers. """
+import argparse
 import collections
 import functools
 import logging
+import os
 import socket
+import sys
 import threading
 
 from six.moves import BaseHTTPServer  # type: ignore  # pylint: disable=import-error
 from six.moves import http_client  # pylint: disable=import-error
 from six.moves import socketserver  # type: ignore  # pylint: disable=import-error
 
+import OpenSSL
+
 from acme import challenges
 from acme import crypto_util
-from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
+
 
 logger = logging.getLogger(__name__)
 
 # six.moves.* | pylint: disable=no-member,attribute-defined-outside-init
-# pylint: disable=no-init
+# pylint: disable=too-few-public-methods,no-init
 
 
 class TLSServer(socketserver.TCPServer):
@@ -31,7 +36,7 @@ class TLSServer(socketserver.TCPServer):
         self.certs = kwargs.pop("certs", {})
         self.method = kwargs.pop(
             # pylint: disable=protected-access
-            "method", crypto_util._DEFAULT_SSL_METHOD)
+            "method", crypto_util._DEFAULT_TLSSNI01_SSL_METHOD)
         self.allow_reuse_address = kwargs.pop("allow_reuse_address", True)
         socketserver.TCPServer.__init__(self, *args, **kwargs)
 
@@ -44,7 +49,7 @@ class TLSServer(socketserver.TCPServer):
         return socketserver.TCPServer.server_bind(self)
 
 
-class ACMEServerMixin:
+class ACMEServerMixin:  # pylint: disable=old-style-class
     """ACME server common settings mixin."""
     # TODO: c.f. #858
     server_version = "ACME client standalone challenge solver"
@@ -61,8 +66,8 @@ class BaseDualNetworkedServers(object):
 
     def __init__(self, ServerClass, server_address, *remaining_args, **kwargs):
         port = server_address[1]
-        self.threads = [] # type: List[threading.Thread]
-        self.servers = [] # type: List[ACMEServerMixin]
+        self.threads = []
+        self.servers = []
 
         # Must try True first.
         # Ubuntu, for example, will fail to bind to IPv4 if we've already bound
@@ -76,35 +81,23 @@ class BaseDualNetworkedServers(object):
                 kwargs["ipv6"] = ip_version
                 new_address = (server_address[0],) + (port,) + server_address[2:]
                 new_args = (new_address,) + remaining_args
-                server = ServerClass(*new_args, **kwargs)
-                logger.debug(
-                    "Successfully bound to %s:%s using %s", new_address[0],
-                    new_address[1], "IPv6" if ip_version else "IPv4")
+                server = ServerClass(*new_args, **kwargs) # pylint: disable=star-args
             except socket.error:
-                if self.servers:
-                    # Already bound using IPv6.
-                    logger.debug(
-                        "Certbot wasn't able to bind to %s:%s using %s, this "
-                        "is often expected due to the dual stack nature of "
-                        "IPv6 socket implementations.",
-                        new_address[0], new_address[1],
-                        "IPv6" if ip_version else "IPv4")
-                else:
-                    logger.debug(
-                        "Failed to bind to %s:%s using %s", new_address[0],
-                        new_address[1], "IPv6" if ip_version else "IPv4")
+                logger.debug("Failed to bind to %s:%s using %s", new_address[0],
+                    new_address[1], "IPv6" if ip_version else "IPv4")
             else:
                 self.servers.append(server)
                 # If two servers are set up and port 0 was passed in, ensure we always
                 # bind to the same port for both servers.
                 port = server.socket.getsockname()[1]
-        if not self.servers:
+        if len(self.servers) == 0:
             raise socket.error("Could not bind to IPv4 or IPv6.")
 
     def serve_forever(self):
         """Wraps socketserver.TCPServer.serve_forever"""
         for server in self.servers:
             thread = threading.Thread(
+                # pylint: disable=no-member
                 target=server.serve_forever)
             thread.start()
             self.threads.append(thread)
@@ -124,6 +117,35 @@ class BaseDualNetworkedServers(object):
         self.threads = []
 
 
+class TLSSNI01Server(TLSServer, ACMEServerMixin):
+    """TLSSNI01 Server."""
+
+    def __init__(self, server_address, certs, ipv6=False):
+        TLSServer.__init__(
+            self, server_address, BaseRequestHandlerWithLogging, certs=certs, ipv6=ipv6)
+
+
+class TLSSNI01DualNetworkedServers(BaseDualNetworkedServers):
+    """TLSSNI01Server Wrapper. Tries everything for both. Failures for one don't
+       affect the other."""
+
+    def __init__(self, *args, **kwargs):
+        BaseDualNetworkedServers.__init__(self, TLSSNI01Server, *args, **kwargs)
+
+
+class BaseRequestHandlerWithLogging(socketserver.BaseRequestHandler):
+    """BaseRequestHandler with logging."""
+
+    def log_message(self, format, *args):  # pylint: disable=redefined-builtin
+        """Log arbitrary message."""
+        logger.debug("%s - - %s", self.client_address[0], format % args)
+
+    def handle(self):
+        """Handle request."""
+        self.log_message("Incoming request")
+        socketserver.BaseRequestHandler.handle(self)
+
+
 class HTTPServer(BaseHTTPServer.HTTPServer):
     """Generic HTTP Server."""
 
@@ -167,7 +189,7 @@ class HTTP01RequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
 
     def __init__(self, *args, **kwargs):
         self.simple_http_resources = kwargs.pop("simple_http_resources", set())
-        BaseHTTPServer.BaseHTTPRequestHandler.__init__(self, *args, **kwargs)
+        socketserver.BaseRequestHandler.__init__(self, *args, **kwargs)
 
     def log_message(self, format, *args):  # pylint: disable=redefined-builtin
         """Log arbitrary message."""
@@ -226,3 +248,39 @@ class HTTP01RequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
         """
         return functools.partial(
             cls, simple_http_resources=simple_http_resources)
+
+
+def simple_tls_sni_01_server(cli_args, forever=True):
+    """Run simple standalone TLSSNI01 server."""
+    logging.basicConfig(level=logging.DEBUG)
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "-p", "--port", default=0, help="Port to serve at. By default "
+        "picks random free port.")
+    args = parser.parse_args(cli_args[1:])
+
+    certs = {}
+
+    _, hosts, _ = next(os.walk('.'))
+    for host in hosts:
+        with open(os.path.join(host, "cert.pem")) as cert_file:
+            cert_contents = cert_file.read()
+        with open(os.path.join(host, "key.pem")) as key_file:
+            key_contents = key_file.read()
+        certs[host.encode()] = (
+            OpenSSL.crypto.load_privatekey(
+                OpenSSL.crypto.FILETYPE_PEM, key_contents),
+            OpenSSL.crypto.load_certificate(
+                OpenSSL.crypto.FILETYPE_PEM, cert_contents))
+
+    server = TLSSNI01Server(('', int(args.port)), certs=certs)
+    logger.info("Serving at https://%s:%s...", *server.socket.getsockname()[:2])
+    if forever:  # pragma: no cover
+        server.serve_forever()
+    else:
+        server.handle_request()
+
+
+if __name__ == "__main__":
+    sys.exit(simple_tls_sni_01_server(sys.argv))  # pragma: no cover

acme/acme/standalone_test.py

@@ -1,17 +1,23 @@
 """Tests for acme.standalone."""
+import os
+import shutil
 import socket
 import threading
+import tempfile
+import time
 import unittest
 
+from six.moves import http_client  # pylint: disable=import-error
+from six.moves import socketserver  # type: ignore  # pylint: disable=import-error
+
 import josepy as jose
 import mock
 import requests
-from six.moves import http_client  # pylint: disable=import-error
-from six.moves import socketserver  # type: ignore  # pylint: disable=import-error
 
 from acme import challenges
-from acme.magic_typing import Set  # pylint: disable=unused-import, no-name-in-module
-import test_util
+from acme import crypto_util
+from acme import errors
+from acme import test_util
 
 
 class TLSServerTest(unittest.TestCase):
@@ -22,14 +28,41 @@ class TLSServerTest(unittest.TestCase):
         from acme.standalone import TLSServer
         server = TLSServer(
             ('', 0), socketserver.BaseRequestHandler, bind_and_activate=True)
-        server.server_close()
+        server.server_close()  # pylint: disable=no-member
 
     def test_ipv6(self):
         if socket.has_ipv6:
             from acme.standalone import TLSServer
             server = TLSServer(
                 ('', 0), socketserver.BaseRequestHandler, bind_and_activate=True, ipv6=True)
-            server.server_close()
+            server.server_close()  # pylint: disable=no-member
+
+
+class TLSSNI01ServerTest(unittest.TestCase):
+    """Test for acme.standalone.TLSSNI01Server."""
+
+
+    def setUp(self):
+        self.certs = {b'localhost': (
+            test_util.load_pyopenssl_private_key('rsa2048_key.pem'),
+            test_util.load_cert('rsa2048_cert.pem'),
+        )}
+        from acme.standalone import TLSSNI01Server
+        self.server = TLSSNI01Server(("", 0), certs=self.certs)
+        # pylint: disable=no-member
+        self.thread = threading.Thread(target=self.server.serve_forever)
+        self.thread.start()
+
+    def tearDown(self):
+        self.server.shutdown()  # pylint: disable=no-member
+        self.thread.join()
+
+    def test_it(self):
+        host, port = self.server.socket.getsockname()[:2]
+        cert = crypto_util.probe_sni(
+            b'localhost', host=host, port=port, timeout=1)
+        self.assertEqual(jose.ComparableX509(cert),
+                         jose.ComparableX509(self.certs[b'localhost'][1]))
 
 
 class HTTP01ServerTest(unittest.TestCase):
@@ -39,17 +72,18 @@ class HTTP01ServerTest(unittest.TestCase):
     def setUp(self):
         self.account_key = jose.JWK.load(
             test_util.load_vector('rsa1024_key.pem'))
-        self.resources = set() # type: Set
+        self.resources = set()
 
         from acme.standalone import HTTP01Server
         self.server = HTTP01Server(('', 0), resources=self.resources)
 
+        # pylint: disable=no-member
         self.port = self.server.socket.getsockname()[1]
         self.thread = threading.Thread(target=self.server.serve_forever)
         self.thread.start()
 
     def tearDown(self):
-        self.server.shutdown()
+        self.server.shutdown()  # pylint: disable=no-member
         self.thread.join()
 
     def test_index(self):
@@ -99,10 +133,8 @@ class BaseDualNetworkedServersTest(unittest.TestCase):
                 self.address_family = socket.AF_INET
             socketserver.TCPServer.__init__(self, *args, **kwargs)
             if ipv6:
-                # NB: On Windows, socket.IPPROTO_IPV6 constant may be missing.
-                # We use the corresponding value (41) instead.
-                level = getattr(socket, "IPPROTO_IPV6", 41)
-                self.socket.setsockopt(level, socket.IPV6_V6ONLY, 1)
+                # pylint: disable=no-member
+                self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
                 try:
                     self.server_bind()
                     self.server_activate()
@@ -115,15 +147,15 @@ class BaseDualNetworkedServersTest(unittest.TestCase):
         mock_bind.side_effect = socket.error
         from acme.standalone import BaseDualNetworkedServers
         self.assertRaises(socket.error, BaseDualNetworkedServers,
-                          BaseDualNetworkedServersTest.SingleProtocolServer,
-                          ('', 0),
-                          socketserver.BaseRequestHandler)
+            BaseDualNetworkedServersTest.SingleProtocolServer,
+            ("", 0),
+            socketserver.BaseRequestHandler)
 
     def test_ports_equal(self):
         from acme.standalone import BaseDualNetworkedServers
         servers = BaseDualNetworkedServers(
             BaseDualNetworkedServersTest.SingleProtocolServer,
-            ('', 0),
+            ("", 0),
             socketserver.BaseRequestHandler)
         socknames = servers.getsocknames()
         prev_port = None
@@ -135,6 +167,33 @@ class BaseDualNetworkedServersTest(unittest.TestCase):
             prev_port = port
 
 
+class TLSSNI01DualNetworkedServersTest(unittest.TestCase):
+    """Test for acme.standalone.TLSSNI01DualNetworkedServers."""
+
+
+    def setUp(self):
+        self.certs = {b'localhost': (
+            test_util.load_pyopenssl_private_key('rsa2048_key.pem'),
+            test_util.load_cert('rsa2048_cert.pem'),
+        )}
+        from acme.standalone import TLSSNI01DualNetworkedServers
+        self.servers = TLSSNI01DualNetworkedServers(("", 0), certs=self.certs)
+        self.servers.serve_forever()
+
+    def tearDown(self):
+        self.servers.shutdown_and_server_close()
+
+    def test_connect(self):
+        socknames = self.servers.getsocknames()
+        # connect to all addresses
+        for sockname in socknames:
+            host, port = sockname[:2]
+            cert = crypto_util.probe_sni(
+                b'localhost', host=host, port=port, timeout=1)
+            self.assertEqual(jose.ComparableX509(cert),
+                             jose.ComparableX509(self.certs[b'localhost'][1]))
+
+
 class HTTP01DualNetworkedServersTest(unittest.TestCase):
     """Tests for acme.standalone.HTTP01DualNetworkedServers."""
 
@@ -142,11 +201,12 @@ class HTTP01DualNetworkedServersTest(unittest.TestCase):
     def setUp(self):
         self.account_key = jose.JWK.load(
             test_util.load_vector('rsa1024_key.pem'))
-        self.resources = set() # type: Set
+        self.resources = set()
 
         from acme.standalone import HTTP01DualNetworkedServers
         self.servers = HTTP01DualNetworkedServers(('', 0), resources=self.resources)
 
+        # pylint: disable=no-member
         self.port = self.servers.getsocknames()[0][1]
         self.servers.serve_forever()
 
@@ -185,5 +245,56 @@ class HTTP01DualNetworkedServersTest(unittest.TestCase):
         self.assertFalse(self._test_http01(add=False))
 
 
+class TestSimpleTLSSNI01Server(unittest.TestCase):
+    """Tests for acme.standalone.simple_tls_sni_01_server."""
+
+
+    def setUp(self):
+        # mirror ../examples/standalone
+        self.test_cwd = tempfile.mkdtemp()
+        localhost_dir = os.path.join(self.test_cwd, 'localhost')
+        os.makedirs(localhost_dir)
+        shutil.copy(test_util.vector_path('rsa2048_cert.pem'),
+                    os.path.join(localhost_dir, 'cert.pem'))
+        shutil.copy(test_util.vector_path('rsa2048_key.pem'),
+                    os.path.join(localhost_dir, 'key.pem'))
+
+        from acme.standalone import simple_tls_sni_01_server
+        self.port = 1234
+        self.thread = threading.Thread(
+            target=simple_tls_sni_01_server, kwargs={
+                'cli_args': ('xxx', '--port', str(self.port)),
+                'forever': False,
+            },
+        )
+        self.old_cwd = os.getcwd()
+        os.chdir(self.test_cwd)
+
+    def tearDown(self):
+        os.chdir(self.old_cwd)
+        self.thread.join()
+        shutil.rmtree(self.test_cwd)
+
+    def test_it(self):
+        max_attempts = 5
+        for attempt in range(max_attempts):
+            try:
+                cert = crypto_util.probe_sni(
+                    b'localhost', b'0.0.0.0', self.port)
+            except errors.Error:
+                self.assertTrue(attempt + 1 < max_attempts, "Timeout!")
+                time.sleep(1)  # wait until thread starts
+            else:
+                self.assertEqual(jose.ComparableX509(cert),
+                                 test_util.load_comparable_cert(
+                                     'rsa2048_cert.pem'))
+                break
+
+            if attempt == 0:
+                # the first attempt is always meant to fail, so we can test
+                # the socket failure code-path for probe_sni, as well
+                self.thread.start()
+
+
 if __name__ == "__main__":
     unittest.main()  # pragma: no cover

acme/acme/test_util.py

@@ -4,12 +4,19 @@
 
 """
 import os
+import pkg_resources
+import unittest
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
 import josepy as jose
-from OpenSSL import crypto
-import pkg_resources
+import OpenSSL
+
+
+def vector_path(*names):
+    """Path to a test vector."""
+    return pkg_resources.resource_filename(
+        __name__, os.path.join('testdata', *names))
 
 
 def load_vector(*names):
@@ -25,14 +32,15 @@ def _guess_loader(filename, loader_pem, loader_der):
         return loader_pem
     elif ext.lower() == '.der':
         return loader_der
-    raise ValueError("Loader could not be recognized based on extension")  # pragma: no cover
+    else:  # pragma: no cover
+        raise ValueError("Loader could not be recognized based on extension")
 
 
 def load_cert(*names):
     """Load certificate."""
     loader = _guess_loader(
-        names[-1], crypto.FILETYPE_PEM, crypto.FILETYPE_ASN1)
-    return crypto.load_certificate(loader, load_vector(*names))
+        names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
+    return OpenSSL.crypto.load_certificate(loader, load_vector(*names))
 
 
 def load_comparable_cert(*names):
@@ -43,8 +51,8 @@ def load_comparable_cert(*names):
 def load_csr(*names):
     """Load certificate request."""
     loader = _guess_loader(
-        names[-1], crypto.FILETYPE_PEM, crypto.FILETYPE_ASN1)
-    return crypto.load_certificate_request(loader, load_vector(*names))
+        names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
+    return OpenSSL.crypto.load_certificate_request(loader, load_vector(*names))
 
 
 def load_comparable_csr(*names):
@@ -63,5 +71,26 @@ def load_rsa_private_key(*names):
 def load_pyopenssl_private_key(*names):
     """Load pyOpenSSL private key."""
     loader = _guess_loader(
-        names[-1], crypto.FILETYPE_PEM, crypto.FILETYPE_ASN1)
-    return crypto.load_privatekey(loader, load_vector(*names))
+        names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
+    return OpenSSL.crypto.load_privatekey(loader, load_vector(*names))
+
+
+def skip_unless(condition, reason):  # pragma: no cover
+    """Skip tests unless a condition holds.
+
+    This implements the basic functionality of unittest.skipUnless
+    which is only available on Python 2.7+.
+
+    :param bool condition: If ``False``, the test will be skipped
+    :param str reason: the reason for skipping the test
+
+    :rtype: callable
+    :returns: decorator that hides tests unless condition is ``True``
+
+    """
+    if hasattr(unittest, "skipUnless"):
+        return unittest.skipUnless(condition, reason)
+    elif condition:
+        return lambda cls: cls
+    else:
+        return lambda cls: None

acme/docs/api/other.rst

@@ -0,0 +1,5 @@
+Other ACME objects
+------------------
+
+.. automodule:: acme.other
+   :members:

acme/docs/conf.py

@@ -12,9 +12,10 @@
 # All configuration values have a default; values that are commented out
 # serve to show the default.
 
+import sys
 import os
 import shlex
-import sys
+
 
 here = os.path.abspath(os.path.dirname(__file__))
 

acme/docs/index.rst

@@ -16,6 +16,13 @@ Contents:
 .. automodule:: acme
    :members:
 
+
+Example client:
+
+.. include:: ../examples/example_client.py
+   :code: python
+
+
 Indices and tables
 ==================
 

acme/examples/example_client.py

@@ -0,0 +1,47 @@
+"""Example script showing how to use acme client API."""
+import logging
+import os
+import pkg_resources
+
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives.asymmetric import rsa
+import josepy as jose
+import OpenSSL
+
+from acme import client
+from acme import messages
+
+
+logging.basicConfig(level=logging.DEBUG)
+
+
+DIRECTORY_URL = 'https://acme-staging.api.letsencrypt.org/directory'
+BITS = 2048  # minimum for Boulder
+DOMAIN = 'example1.com'  # example.com is ignored by Boulder
+
+# generate_private_key requires cryptography>=0.5
+key = jose.JWKRSA(key=rsa.generate_private_key(
+    public_exponent=65537,
+    key_size=BITS,
+    backend=default_backend()))
+acme = client.Client(DIRECTORY_URL, key)
+
+regr = acme.register()
+logging.info('Auto-accepting TOS: %s', regr.terms_of_service)
+acme.agree_to_tos(regr)
+logging.debug(regr)
+
+authzr = acme.request_challenges(
+    identifier=messages.Identifier(typ=messages.IDENTIFIER_FQDN, value=DOMAIN))
+logging.debug(authzr)
+
+authzr, authzr_response = acme.poll(authzr)
+
+csr = OpenSSL.crypto.load_certificate_request(
+    OpenSSL.crypto.FILETYPE_ASN1, pkg_resources.resource_string(
+        'acme', os.path.join('testdata', 'csr.der')))
+try:
+    acme.request_issuance(jose.util.ComparableX509(csr), (authzr,))
+except messages.Error as error:
+    print ("This script is doomed to fail as no authorization "
+           "challenges are ever solved. Error from server: {0}".format(error))

acme/examples/http01_example.py

@@ -1,241 +0,0 @@
-"""Example ACME-V2 API for HTTP-01 challenge.
-
-Brief:
-
-This a complete usage example of the python-acme API.
-
-Limitations of this example:
-    - Works for only one Domain name
-    - Performs only HTTP-01 challenge
-    - Uses ACME-v2
-
-Workflow:
-    (Account creation)
-    - Create account key
-    - Register account and accept TOS
-    (Certificate actions)
-    - Select HTTP-01 within offered challenges by the CA server
-    - Set up http challenge resource
-    - Set up standalone web server
-    - Create domain private key and CSR
-    - Issue certificate
-    - Renew certificate
-    - Revoke certificate
-    (Account update actions)
-    - Change contact information
-    - Deactivate Account
-"""
-from contextlib import contextmanager
-
-from cryptography.hazmat.backends import default_backend
-from cryptography.hazmat.primitives.asymmetric import rsa
-import josepy as jose
-import OpenSSL
-
-from acme import challenges
-from acme import client
-from acme import crypto_util
-from acme import errors
-from acme import messages
-from acme import standalone
-
-# Constants:
-
-# This is the staging point for ACME-V2 within Let's Encrypt.
-DIRECTORY_URL = 'https://acme-staging-v02.api.letsencrypt.org/directory'
-
-USER_AGENT = 'python-acme-example'
-
-# Account key size
-ACC_KEY_BITS = 2048
-
-# Certificate private key size
-CERT_PKEY_BITS = 2048
-
-# Domain name for the certificate.
-DOMAIN = 'client.example.com'
-
-# If you are running Boulder locally, it is possible to configure any port
-# number to execute the challenge, but real CA servers will always use port
-# 80, as described in the ACME specification.
-PORT = 80
-
-
-# Useful methods and classes:
-
-
-def new_csr_comp(domain_name, pkey_pem=None):
-    """Create certificate signing request."""
-    if pkey_pem is None:
-        # Create private key.
-        pkey = OpenSSL.crypto.PKey()
-        pkey.generate_key(OpenSSL.crypto.TYPE_RSA, CERT_PKEY_BITS)
-        pkey_pem = OpenSSL.crypto.dump_privatekey(OpenSSL.crypto.FILETYPE_PEM,
-                                                  pkey)
-    csr_pem = crypto_util.make_csr(pkey_pem, [domain_name])
-    return pkey_pem, csr_pem
-
-
-def select_http01_chall(orderr):
-    """Extract authorization resource from within order resource."""
-    # Authorization Resource: authz.
-    # This object holds the offered challenges by the server and their status.
-    authz_list = orderr.authorizations
-
-    for authz in authz_list:
-        # Choosing challenge.
-        # authz.body.challenges is a set of ChallengeBody objects.
-        for i in authz.body.challenges:
-            # Find the supported challenge.
-            if isinstance(i.chall, challenges.HTTP01):
-                return i
-
-    raise Exception('HTTP-01 challenge was not offered by the CA server.')
-
-
-@contextmanager
-def challenge_server(http_01_resources):
-    """Manage standalone server set up and shutdown."""
-
-    # Setting up a fake server that binds at PORT and any address.
-    address = ('', PORT)
-    try:
-        servers = standalone.HTTP01DualNetworkedServers(address,
-                                                        http_01_resources)
-        # Start client standalone web server.
-        servers.serve_forever()
-        yield servers
-    finally:
-        # Shutdown client web server and unbind from PORT
-        servers.shutdown_and_server_close()
-
-
-def perform_http01(client_acme, challb, orderr):
-    """Set up standalone webserver and perform HTTP-01 challenge."""
-
-    response, validation = challb.response_and_validation(client_acme.net.key)
-
-    resource = standalone.HTTP01RequestHandler.HTTP01Resource(
-        chall=challb.chall, response=response, validation=validation)
-
-    with challenge_server({resource}):
-        # Let the CA server know that we are ready for the challenge.
-        client_acme.answer_challenge(challb, response)
-
-        # Wait for challenge status and then issue a certificate.
-        # It is possible to set a deadline time.
-        finalized_orderr = client_acme.poll_and_finalize(orderr)
-
-    return finalized_orderr.fullchain_pem
-
-
-# Main examples:
-
-
-def example_http():
-    """This example executes the whole process of fulfilling a HTTP-01
-    challenge for one specific domain.
-
-    The workflow consists of:
-    (Account creation)
-    - Create account key
-    - Register account and accept TOS
-    (Certificate actions)
-    - Select HTTP-01 within offered challenges by the CA server
-    - Set up http challenge resource
-    - Set up standalone web server
-    - Create domain private key and CSR
-    - Issue certificate
-    - Renew certificate
-    - Revoke certificate
-    (Account update actions)
-    - Change contact information
-    - Deactivate Account
-
-    """
-    # Create account key
-
-    acc_key = jose.JWKRSA(
-        key=rsa.generate_private_key(public_exponent=65537,
-                                     key_size=ACC_KEY_BITS,
-                                     backend=default_backend()))
-
-    # Register account and accept TOS
-
-    net = client.ClientNetwork(acc_key, user_agent=USER_AGENT)
-    directory = messages.Directory.from_json(net.get(DIRECTORY_URL).json())
-    client_acme = client.ClientV2(directory, net=net)
-
-    # Terms of Service URL is in client_acme.directory.meta.terms_of_service
-    # Registration Resource: regr
-    # Creates account with contact information.
-    email = ('fake@example.com')
-    regr = client_acme.new_account(
-        messages.NewRegistration.from_data(
-            email=email, terms_of_service_agreed=True))
-
-    # Create domain private key and CSR
-    pkey_pem, csr_pem = new_csr_comp(DOMAIN)
-
-    # Issue certificate
-
-    orderr = client_acme.new_order(csr_pem)
-
-    # Select HTTP-01 within offered challenges by the CA server
-    challb = select_http01_chall(orderr)
-
-    # The certificate is ready to be used in the variable "fullchain_pem".
-    fullchain_pem = perform_http01(client_acme, challb, orderr)
-
-    # Renew certificate
-
-    _, csr_pem = new_csr_comp(DOMAIN, pkey_pem)
-
-    orderr = client_acme.new_order(csr_pem)
-
-    challb = select_http01_chall(orderr)
-
-    # Performing challenge
-    fullchain_pem = perform_http01(client_acme, challb, orderr)
-
-    # Revoke certificate
-
-    fullchain_com = jose.ComparableX509(
-        OpenSSL.crypto.load_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, fullchain_pem))
-
-    try:
-        client_acme.revoke(fullchain_com, 0)  # revocation reason = 0
-    except errors.ConflictError:
-        # Certificate already revoked.
-        pass
-
-    # Query registration status.
-    client_acme.net.account = regr
-    try:
-        regr = client_acme.query_registration(regr)
-    except errors.Error as err:
-        if err.typ == messages.OLD_ERROR_PREFIX + 'unauthorized' \
-                or err.typ == messages.ERROR_PREFIX + 'unauthorized':
-            # Status is deactivated.
-            pass
-        raise
-
-    # Change contact information
-
-    email = 'newfake@example.com'
-    regr = client_acme.update_registration(
-        regr.update(
-            body=regr.body.update(
-                contact=('mailto:' + email,)
-            )
-        )
-    )
-
-    # Deactivate account/registration
-
-    regr = client_acme.deactivate_registration(regr)
-
-
-if __name__ == "__main__":
-    example_http()

acme/pytest.ini

@@ -1,2 +0,0 @@
-[pytest]
-norecursedirs = .* build dist CVS _darcs {arch} *.egg

acme/readthedocs.org.requirements.txt

@@ -1,10 +1,10 @@
 # readthedocs.org gives no way to change the install command to "pip
-# install -e acme[docs]" (that would in turn install documentation
+# install -e .[docs]" (that would in turn install documentation
 # dependencies), but it allows to specify a requirements.txt file at
 # https://readthedocs.org/dashboard/letsencrypt/advanced/ (c.f. #259)
 
 # Although ReadTheDocs certainly doesn't need to install the project
-# in --editable mode (-e), just "pip install acme[docs]" does not work as
-# expected and "pip install -e acme[docs]" must be used instead
+# in --editable mode (-e), just "pip install .[docs]" does not work as
+# expected and "pip install -e .[docs]" must be used instead
 
 -e acme[docs]

acme/setup.py

@@ -1,31 +1,37 @@
 import sys
 
-from setuptools import find_packages
 from setuptools import setup
-from setuptools.command.test import test as TestCommand
+from setuptools import find_packages
 
-version = '1.1.0.dev0'
+
+version = '0.21.0.dev0'
 
 # Please update tox.ini when modifying dependency version requirements
 install_requires = [
     # load_pem_private/public_key (>=0.6)
     # rsa_recover_prime_factors (>=0.8)
-    'cryptography>=1.2.3',
+    'cryptography>=0.8',
     # formerly known as acme.jose:
-    # 1.1.0+ is required to avoid the warnings described at
-    # https://github.com/certbot/josepy/issues/13.
-    'josepy>=1.1.0',
-    'mock',
+    'josepy>=1.0.0',
     # Connection.set_tlsext_host_name (>=0.13)
-    'PyOpenSSL>=0.13.1',
+    'mock',
+    'PyOpenSSL>=0.13',
     'pyrfc3339',
     'pytz',
-    'requests[security]>=2.6.0',  # security extras added in 2.4.1
-    'requests-toolbelt>=0.3.0',
-    'setuptools',
+    'requests[security]>=2.4.1',  # security extras added in 2.4.1
+    # For pkg_resources. >=1.0 so pip resolves it to a version cryptography
+    # will tolerate; see #2599:
+    'setuptools>=1.0',
     'six>=1.9.0',  # needed for python_2_unicode_compatible
 ]
 
+# env markers cause problems with older pip and setuptools
+if sys.version_info < (2, 7):
+    install_requires.extend([
+        'argparse',
+        'ordereddict',
+    ])
+
 dev_extras = [
     'pytest',
     'pytest-xdist',
@@ -38,21 +44,6 @@ docs_extras = [
 ]
 
 
-class PyTest(TestCommand):
-    user_options = []
-
-    def initialize_options(self):
-        TestCommand.initialize_options(self)
-        self.pytest_args = ''
-
-    def run_tests(self):
-        import shlex
-        # import here, cause outside the eggs aren't loaded
-        import pytest
-        errno = pytest.main(shlex.split(self.pytest_args))
-        sys.exit(errno)
-
-
 setup(
     name='acme',
     version=version,
@@ -61,20 +52,19 @@ setup(
     author="Certbot Project",
     author_email='client-dev@letsencrypt.org',
     license='Apache License 2.0',
-    python_requires='>=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*',
     classifiers=[
-        'Development Status :: 5 - Production/Stable',
+        'Development Status :: 3 - Alpha',
         'Intended Audience :: Developers',
         'License :: OSI Approved :: Apache Software License',
         'Programming Language :: Python',
         'Programming Language :: Python :: 2',
+        'Programming Language :: Python :: 2.6',
         'Programming Language :: Python :: 2.7',
         'Programming Language :: Python :: 3',
+        'Programming Language :: Python :: 3.3',
         'Programming Language :: Python :: 3.4',
         'Programming Language :: Python :: 3.5',
         'Programming Language :: Python :: 3.6',
-        'Programming Language :: Python :: 3.7',
-        'Programming Language :: Python :: 3.8',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
     ],
@@ -87,6 +77,4 @@ setup(
         'docs': docs_extras,
     },
     test_suite='acme',
-    tests_require=["pytest"],
-    cmdclass={"test": PyTest},
 )

acme/tests/jose_test.py

@@ -1,53 +0,0 @@
-"""Tests for acme.jose shim."""
-import importlib
-import unittest
-
-
-class JoseTest(unittest.TestCase):
-    """Tests for acme.jose shim."""
-
-    def _test_it(self, submodule, attribute):
-        if submodule:
-            acme_jose_path = 'acme.jose.' + submodule
-            josepy_path = 'josepy.' + submodule
-        else:
-            acme_jose_path = 'acme.jose'
-            josepy_path = 'josepy'
-        acme_jose_mod = importlib.import_module(acme_jose_path)
-        josepy_mod = importlib.import_module(josepy_path)
-
-        self.assertIs(acme_jose_mod, josepy_mod)
-        self.assertIs(getattr(acme_jose_mod, attribute), getattr(josepy_mod, attribute))
-
-        # We use the imports below with eval, but pylint doesn't
-        # understand that.
-        import acme  # pylint: disable=unused-import
-        import josepy  # pylint: disable=unused-import
-        acme_jose_mod = eval(acme_jose_path)  # pylint: disable=eval-used
-        josepy_mod = eval(josepy_path)  # pylint: disable=eval-used
-        self.assertIs(acme_jose_mod, josepy_mod)
-        self.assertIs(getattr(acme_jose_mod, attribute), getattr(josepy_mod, attribute))
-
-    def test_top_level(self):
-        self._test_it('', 'RS512')
-
-    def test_submodules(self):
-        # This test ensures that the modules in josepy that were
-        # available at the time it was moved into its own package are
-        # available under acme.jose. Backwards compatibility with new
-        # modules or testing code is not maintained.
-        mods_and_attrs = [('b64', 'b64decode',),
-                          ('errors', 'Error',),
-                          ('interfaces', 'JSONDeSerializable',),
-                          ('json_util', 'Field',),
-                          ('jwa', 'HS256',),
-                          ('jwk', 'JWK',),
-                          ('jws', 'JWS',),
-                          ('util', 'ImmutableMap',),]
-
-        for mod, attr in mods_and_attrs:
-            self._test_it(mod, attr)
-
-
-if __name__ == '__main__':
-    unittest.main()  # pragma: no cover

acme/tests/magic_typing_test.py

@@ -1,41 +0,0 @@
-"""Tests for acme.magic_typing."""
-import sys
-import unittest
-
-import mock
-
-
-class MagicTypingTest(unittest.TestCase):
-    """Tests for acme.magic_typing."""
-    def test_import_success(self):
-        try:
-            import typing as temp_typing
-        except ImportError: # pragma: no cover
-            temp_typing = None # pragma: no cover
-        typing_class_mock = mock.MagicMock()
-        text_mock = mock.MagicMock()
-        typing_class_mock.Text = text_mock
-        sys.modules['typing'] = typing_class_mock
-        if 'acme.magic_typing' in sys.modules:
-            del sys.modules['acme.magic_typing'] # pragma: no cover
-        from acme.magic_typing import Text # pylint: disable=no-name-in-module
-        self.assertEqual(Text, text_mock)
-        del sys.modules['acme.magic_typing']
-        sys.modules['typing'] = temp_typing
-
-    def test_import_failure(self):
-        try:
-            import typing as temp_typing
-        except ImportError: # pragma: no cover
-            temp_typing = None # pragma: no cover
-        sys.modules['typing'] = None
-        if 'acme.magic_typing' in sys.modules:
-            del sys.modules['acme.magic_typing'] # pragma: no cover
-        from acme.magic_typing import Text # pylint: disable=no-name-in-module
-        self.assertTrue(Text is None)
-        del sys.modules['acme.magic_typing']
-        sys.modules['typing'] = temp_typing
-
-
-if __name__ == '__main__':
-    unittest.main()  # pragma: no cover

certbot-apache/MANIFEST.in

@@ -1,8 +1,7 @@
 include LICENSE.txt
 include README.rst
-recursive-include tests *
-include certbot_apache/_internal/centos-options-ssl-apache.conf
-include certbot_apache/_internal/options-ssl-apache.conf
-recursive-include certbot_apache/_internal/augeas_lens *.aug
-global-exclude __pycache__
-global-exclude *.py[cod]
+recursive-include docs *
+recursive-include certbot_apache/tests/testdata *
+include certbot_apache/centos-options-ssl-apache.conf
+include certbot_apache/options-ssl-apache.conf
+recursive-include certbot_apache/augeas_lens *.aug

certbot-apache/certbot_apache/_internal/__init__.py

@@ -1 +0,0 @@
-"""Certbot Apache plugin."""

certbot-apache/certbot_apache/_internal/apache_util.py

@@ -1,243 +0,0 @@
-""" Utility functions for certbot-apache plugin """
-import binascii
-import fnmatch
-import logging
-import re
-import subprocess
-
-from certbot import errors
-from certbot import util
-
-from certbot.compat import os
-
-logger = logging.getLogger(__name__)
-
-
-def get_mod_deps(mod_name):
-    """Get known module dependencies.
-
-    .. note:: This does not need to be accurate in order for the client to
-        run.  This simply keeps things clean if the user decides to revert
-        changes.
-    .. warning:: If all deps are not included, it may cause incorrect parsing
-        behavior, due to enable_mod's shortcut for updating the parser's
-        currently defined modules (`.ApacheParser.add_mod`)
-        This would only present a major problem in extremely atypical
-        configs that use ifmod for the missing deps.
-
-    """
-    deps = {
-        "ssl": ["setenvif", "mime"]
-    }
-    return deps.get(mod_name, [])
-
-
-def get_file_path(vhost_path):
-    """Get file path from augeas_vhost_path.
-
-    Takes in Augeas path and returns the file name
-
-    :param str vhost_path: Augeas virtual host path
-
-    :returns: filename of vhost
-    :rtype: str
-
-    """
-    if not vhost_path or not vhost_path.startswith("/files/"):
-        return None
-
-    return _split_aug_path(vhost_path)[0]
-
-
-def get_internal_aug_path(vhost_path):
-    """Get the Augeas path for a vhost with the file path removed.
-
-    :param str vhost_path: Augeas virtual host path
-
-    :returns: Augeas path to vhost relative to the containing file
-    :rtype: str
-
-    """
-    return _split_aug_path(vhost_path)[1]
-
-
-def _split_aug_path(vhost_path):
-    """Splits an Augeas path into a file path and an internal path.
-
-    After removing "/files", this function splits vhost_path into the
-    file path and the remaining Augeas path.
-
-    :param str vhost_path: Augeas virtual host path
-
-    :returns: file path and internal Augeas path
-    :rtype: `tuple` of `str`
-
-    """
-    # Strip off /files
-    file_path = vhost_path[6:]
-    internal_path = []
-
-    # Remove components from the end of file_path until it becomes valid
-    while not os.path.exists(file_path):
-        file_path, _, internal_path_part = file_path.rpartition("/")
-        internal_path.append(internal_path_part)
-
-    return file_path, "/".join(reversed(internal_path))
-
-
-def parse_define_file(filepath, varname):
-    """ Parses Defines from a variable in configuration file
-
-    :param str filepath: Path of file to parse
-    :param str varname: Name of the variable
-
-    :returns: Dict of Define:Value pairs
-    :rtype: `dict`
-
-    """
-    return_vars = {}
-    # Get list of words in the variable
-    a_opts = util.get_var_from_file(varname, filepath).split()
-    for i, v in enumerate(a_opts):
-        # Handle Define statements and make sure it has an argument
-        if v == "-D" and len(a_opts) >= i+2:
-            var_parts = a_opts[i+1].partition("=")
-            return_vars[var_parts[0]] = var_parts[2]
-        elif len(v) > 2 and v.startswith("-D"):
-            # Found var with no whitespace separator
-            var_parts = v[2:].partition("=")
-            return_vars[var_parts[0]] = var_parts[2]
-    return return_vars
-
-
-def unique_id():
-    """ Returns an unique id to be used as a VirtualHost identifier"""
-    return binascii.hexlify(os.urandom(16)).decode("utf-8")
-
-
-def included_in_paths(filepath, paths):
-    """
-    Returns true if the filepath is included in the list of paths
-    that may contain full paths or wildcard paths that need to be
-    expanded.
-
-    :param str filepath: Filepath to check
-    :params list paths: List of paths to check against
-
-    :returns: True if included
-    :rtype: bool
-    """
-
-    return any([fnmatch.fnmatch(filepath, path) for path in paths])
-
-
-def parse_defines(apachectl):
-    """
-    Gets Defines from httpd process and returns a dictionary of
-    the defined variables.
-
-    :param str apachectl: Path to apachectl executable
-
-    :returns: dictionary of defined variables
-    :rtype: dict
-    """
-
-    variables = dict()
-    define_cmd = [apachectl, "-t", "-D",
-                  "DUMP_RUN_CFG"]
-    matches = parse_from_subprocess(define_cmd, r"Define: ([^ \n]*)")
-    try:
-        matches.remove("DUMP_RUN_CFG")
-    except ValueError:
-        return {}
-
-    for match in matches:
-        if match.count("=") > 1:
-            logger.error("Unexpected number of equal signs in "
-                         "runtime config dump.")
-            raise errors.PluginError(
-                "Error parsing Apache runtime variables")
-        parts = match.partition("=")
-        variables[parts[0]] = parts[2]
-
-    return variables
-
-
-def parse_includes(apachectl):
-    """
-    Gets Include directives from httpd process and returns a list of
-    their values.
-
-    :param str apachectl: Path to apachectl executable
-
-    :returns: list of found Include directive values
-    :rtype: list of str
-    """
-
-    inc_cmd = [apachectl, "-t", "-D",
-               "DUMP_INCLUDES"]
-    return parse_from_subprocess(inc_cmd, r"\(.*\) (.*)")
-
-
-def parse_modules(apachectl):
-    """
-    Get loaded modules from httpd process, and return the list
-    of loaded module names.
-
-    :param str apachectl: Path to apachectl executable
-
-    :returns: list of found LoadModule module names
-    :rtype: list of str
-    """
-
-    mod_cmd = [apachectl, "-t", "-D",
-               "DUMP_MODULES"]
-    return parse_from_subprocess(mod_cmd, r"(.*)_module")
-
-
-def parse_from_subprocess(command, regexp):
-    """Get values from stdout of subprocess command
-
-    :param list command: Command to run
-    :param str regexp: Regexp for parsing
-
-    :returns: list parsed from command output
-    :rtype: list
-
-    """
-    stdout = _get_runtime_cfg(command)
-    return re.compile(regexp).findall(stdout)
-
-
-def _get_runtime_cfg(command):
-    """
-    Get runtime configuration info.
-
-    :param command: Command to run
-
-    :returns: stdout from command
-
-    """
-    try:
-        proc = subprocess.Popen(
-            command,
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
-            universal_newlines=True)
-        stdout, stderr = proc.communicate()
-
-    except (OSError, ValueError):
-        logger.error(
-            "Error running command %s for runtime parameters!%s",
-            command, os.linesep)
-        raise errors.MisconfigurationError(
-            "Error accessing loaded Apache parameters: {0}".format(
-                command))
-    # Small errors that do not impede
-    if proc.returncode != 0:
-        logger.warning("Error in checking parameter list: %s", stderr)
-        raise errors.MisconfigurationError(
-            "Apache is unable to check whether or not the module is "
-            "loaded because Apache is misconfigured.")
-
-    return stdout

certbot-apache/certbot_apache/_internal/apacheparser.py

@@ -1,242 +0,0 @@
-""" apacheconfig implementation of the ParserNode interfaces """
-
-from functools import partial
-
-from certbot import errors
-
-from certbot_apache._internal import assertions
-from certbot_apache._internal import interfaces
-from certbot_apache._internal import parsernode_util as util
-
-
-class ApacheParserNode(interfaces.ParserNode):
-    """ apacheconfig implementation of ParserNode interface.
-
-        Expects metadata `ac_ast` to be passed in, where `ac_ast` is the AST provided
-        by parsing the equivalent configuration text using the apacheconfig library.
-    """
-
-    def __init__(self, **kwargs):
-        ancestor, dirty, filepath, metadata = util.parsernode_kwargs(kwargs)  # pylint: disable=unused-variable
-        super(ApacheParserNode, self).__init__(**kwargs)
-        self.ancestor = ancestor
-        self.filepath = filepath
-        self.dirty = dirty
-        self.metadata = metadata
-        self._raw = self.metadata["ac_ast"]
-
-    def save(self, msg): # pragma: no cover
-        pass
-
-    def find_ancestors(self, name):  # pylint: disable=unused-variable
-        """Find ancestor BlockNodes with a given name"""
-        return [ApacheBlockNode(name=assertions.PASS,
-                                parameters=assertions.PASS,
-                                ancestor=self,
-                                filepath=assertions.PASS,
-                                metadata=self.metadata)]
-
-
-class ApacheCommentNode(ApacheParserNode):
-    """ apacheconfig implementation of CommentNode interface """
-
-    def __init__(self, **kwargs):
-        comment, kwargs = util.commentnode_kwargs(kwargs)  # pylint: disable=unused-variable
-        super(ApacheCommentNode, self).__init__(**kwargs)
-        self.comment = comment
-
-    def __eq__(self, other):  # pragma: no cover
-        if isinstance(other, self.__class__):
-            return (self.comment == other.comment and
-                    self.dirty == other.dirty and
-                    self.ancestor == other.ancestor and
-                    self.metadata == other.metadata and
-                    self.filepath == other.filepath)
-        return False
-
-
-class ApacheDirectiveNode(ApacheParserNode):
-    """ apacheconfig implementation of DirectiveNode interface """
-
-    def __init__(self, **kwargs):
-        name, parameters, enabled, kwargs = util.directivenode_kwargs(kwargs)
-        super(ApacheDirectiveNode, self).__init__(**kwargs)
-        self.name = name
-        self.parameters = parameters
-        self.enabled = enabled
-        self.include = None
-
-    def __eq__(self, other):  # pragma: no cover
-        if isinstance(other, self.__class__):
-            return (self.name == other.name and
-                    self.filepath == other.filepath and
-                    self.parameters == other.parameters and
-                    self.enabled == other.enabled and
-                    self.dirty == other.dirty and
-                    self.ancestor == other.ancestor and
-                    self.metadata == other.metadata)
-        return False
-
-    def set_parameters(self, _parameters):
-        """Sets the parameters for DirectiveNode"""
-        return
-
-
-def _parameters_from_string(text):
-    text = text.strip()
-    words = []
-    word = ""
-    quote = None
-    escape = False
-    for c in text:
-        if c.isspace() and not quote:
-            if word:
-                words.append(word)
-            word = ""
-        else:
-            word += c
-        if not escape:
-            if not quote and c in "\"\'":
-                quote = c
-            elif c == quote:
-                words.append(word[1:-1])
-                word = ""
-                quote = None
-        escape = c == "\\"
-    if word:
-        words.append(word)
-    return tuple(words)
-
-
-class ApacheBlockNode(ApacheDirectiveNode):
-    """ apacheconfig implementation of BlockNode interface """
-
-    def __init__(self, **kwargs):
-        super(ApacheBlockNode, self).__init__(**kwargs)
-        self._raw_children = self._raw
-        children = []
-        for raw_node in self._raw_children:
-            metadata = self.metadata.copy()
-            metadata['ac_ast'] = raw_node
-            if raw_node.typestring == "comment":
-                node = ApacheCommentNode(comment=raw_node.name[2:],
-                                         metadata=metadata, ancestor=self,
-                                         filepath=self.filepath)
-            elif raw_node.typestring == "block":
-                parameters = _parameters_from_string(raw_node.arguments)
-                node = ApacheBlockNode(name=raw_node.tag, parameters=parameters,
-                                       metadata=metadata, ancestor=self,
-                                       filepath=self.filepath, enabled=self.enabled)
-            else:
-                parameters = ()
-                if raw_node.value:
-                    parameters = _parameters_from_string(raw_node.value)
-                node = ApacheDirectiveNode(name=raw_node.name, parameters=parameters,
-                                           metadata=metadata, ancestor=self,
-                                           filepath=self.filepath, enabled=self.enabled)
-            children.append(node)
-        self.children = tuple(children)
-
-    def __eq__(self, other):  # pragma: no cover
-        if isinstance(other, self.__class__):
-            return (self.name == other.name and
-                    self.filepath == other.filepath and
-                    self.parameters == other.parameters and
-                    self.children == other.children and
-                    self.enabled == other.enabled and
-                    self.dirty == other.dirty and
-                    self.ancestor == other.ancestor and
-                    self.metadata == other.metadata)
-        return False
-
-    def _add_child_thing(self, raw_string, partial_node, position):
-        position = len(self._raw_children) if not position else position
-        # Cap position to length to mimic AugeasNode behavior. TODO: document that this happens
-        position = min(len(self._raw_children), position)
-        raw_ast = self._raw_children.add(position, raw_string)
-        metadata = self.metadata.copy()
-        metadata['ac_ast'] = raw_ast
-        new_node = partial_node(ancestor=self, metadata=metadata, filepath=self.filepath)
-
-        # Update metadata
-        children = list(self.children)
-        children.insert(position, new_node)
-        self.children = tuple(children)
-        return new_node
-
-    def add_child_block(self, name, parameters=None, position=None):
-        """Adds a new BlockNode to the sequence of children"""
-        parameters_str = " " + " ".join(parameters) if parameters else ""
-        if not parameters:
-            parameters = []
-        partial_block = partial(ApacheBlockNode, name=name,
-                                parameters=tuple(parameters), enabled=self.enabled)
-        return self._add_child_thing("\n<%s%s>\n</%s>" % (name, parameters_str, name),
-                                                         partial_block, position)
-
-    def add_child_directive(self, name, parameters=None, position=None):
-        """Adds a new DirectiveNode to the sequence of children"""
-        parameters_str = " " + " ".join(parameters) if parameters else ""
-        if not parameters:  # TODO (mona): test
-            parameters = []  # pragma: no cover
-        partial_block = partial(ApacheDirectiveNode, name=name,
-                                parameters=tuple(parameters), enabled=self.enabled)
-        return self._add_child_thing("\n%s%s" % (name, parameters_str), partial_block, position)
-
-    def add_child_comment(self, comment="", position=None):
-        """Adds a new CommentNode to the sequence of children"""
-        partial_comment = partial(ApacheCommentNode, comment=comment)
-        return self._add_child_thing(comment, partial_comment, position)
-
-    def find_blocks(self, name, exclude=True): # pylint: disable=unused-argument
-        """Recursive search of BlockNodes from the sequence of children"""
-        return [ApacheBlockNode(name=assertions.PASS,
-                                parameters=assertions.PASS,
-                                ancestor=self,
-                                filepath=assertions.PASS,
-                                metadata=self.metadata)]
-
-    def find_directives(self, name, exclude=True): # pylint: disable=unused-argument
-        """Recursive search of DirectiveNodes from the sequence of children"""
-        return [ApacheDirectiveNode(name=assertions.PASS,
-                                    parameters=assertions.PASS,
-                                    ancestor=self,
-                                    filepath=assertions.PASS,
-                                    metadata=self.metadata)]
-
-    def find_comments(self, comment, exact=False): # pylint: disable=unused-argument
-        """Recursive search of DirectiveNodes from the sequence of children"""
-        return [ApacheCommentNode(comment=assertions.PASS,
-                                  ancestor=self,
-                                  filepath=assertions.PASS,
-                                  metadata=self.metadata)]
-
-    # TODO (mona): test
-    def delete_child(self, child):  # pragma: no cover
-        """Deletes a ParserNode from the sequence of children"""
-        index = -1
-        i = None
-        for i, elem in enumerate(self.children):
-            if elem == child:
-                index = i
-                break
-        if index < 0:
-            raise errors.PluginError("Could not find child node to delete")
-        children_list = list(self.children)
-        thing = children_list.pop(i)
-        self.children = tuple(children_list)
-        self._raw_children.remove(i)
-        return thing
-
-    def unsaved_files(self):  # pragma: no cover
-        """Returns a list of unsaved filepaths"""
-        return [assertions.PASS]
-
-    def parsed_paths(self):  # pragma: no cover
-        """Returns a list of parsed configuration file paths"""
-        return [assertions.PASS]
-
-
-interfaces.CommentNode.register(ApacheCommentNode)
-interfaces.DirectiveNode.register(ApacheDirectiveNode)
-interfaces.BlockNode.register(ApacheBlockNode)

certbot-apache/certbot_apache/_internal/assertions.py

@@ -1,142 +0,0 @@
-"""Dual parser node assertions"""
-import fnmatch
-
-from certbot_apache._internal import interfaces
-
-
-PASS = "CERTBOT_PASS_ASSERT"
-
-
-def assertEqual(first, second):
-    """ Equality assertion """
-
-    if isinstance(first, interfaces.CommentNode):
-        assertEqualComment(first, second)
-    elif isinstance(first, interfaces.DirectiveNode):
-        assertEqualDirective(first, second)
-
-    # Do an extra interface implementation assertion, as the contents were
-    # already checked for BlockNode in the assertEqualDirective
-    if isinstance(first, interfaces.BlockNode):
-        assert isinstance(second, interfaces.BlockNode)
-
-    # Skip tests if filepath includes the pass value. This is done
-    # because filepath is variable of the base ParserNode interface, and
-    # unless the implementation is actually done, we cannot assume getting
-    # correct results from boolean assertion for dirty
-    if not isPass(first.filepath) and not isPass(second.filepath):
-        assert first.dirty == second.dirty
-        # We might want to disable this later if testing with two separate
-        # (but identical) directory structures.
-        assert first.filepath == second.filepath
-
-def assertEqualComment(first, second): # pragma: no cover
-    """ Equality assertion for CommentNode """
-
-    assert isinstance(first, interfaces.CommentNode)
-    assert isinstance(second, interfaces.CommentNode)
-
-    if not isPass(first.comment) and not isPass(second.comment):  # type: ignore
-        assert first.comment == second.comment  # type: ignore
-
-def _assertEqualDirectiveComponents(first, second): # pragma: no cover
-    """ Handles assertion for instance variables for DirectiveNode and BlockNode"""
-
-    # Enabled value cannot be asserted, because Augeas implementation
-    # is unable to figure that out.
-    # assert first.enabled == second.enabled
-    if not isPass(first.name) and not isPass(second.name):
-        assert first.name == second.name
-
-    if not isPass(first.parameters) and not isPass(second.parameters):
-        assert first.parameters == second.parameters
-
-def assertEqualDirective(first, second):
-    """ Equality assertion for DirectiveNode """
-
-    assert isinstance(first, interfaces.DirectiveNode)
-    assert isinstance(second, interfaces.DirectiveNode)
-    _assertEqualDirectiveComponents(first, second)
-
-def isPass(value): # pragma: no cover
-    """Checks if the value is set to PASS"""
-    if isinstance(value, bool):
-        return True
-    return PASS in value
-
-def isPassDirective(block):
-    """ Checks if BlockNode or DirectiveNode should pass the assertion """
-
-    if isPass(block.name):
-        return True
-    if isPass(block.parameters): # pragma: no cover
-        return True
-    if isPass(block.filepath): # pragma: no cover
-        return True
-    return False
-
-def isPassComment(comment):
-    """ Checks if CommentNode should pass the assertion """
-
-    if isPass(comment.comment):
-        return True
-    if isPass(comment.filepath): # pragma: no cover
-        return True
-    return False
-
-def isPassNodeList(nodelist): # pragma: no cover
-    """ Checks if a ParserNode in the nodelist should pass the assertion,
-    this function is used for results of find_* methods. Unimplemented find_*
-    methods should return a sequence containing a single ParserNode instance
-    with assertion pass string."""
-
-    try:
-        node = nodelist[0]
-    except IndexError:
-        node = None
-
-    if not node: # pragma: no cover
-        return False
-
-    if isinstance(node, interfaces.DirectiveNode):
-        return isPassDirective(node)
-    return isPassComment(node)
-
-def assertEqualSimple(first, second):
-    """ Simple assertion """
-    if not isPass(first) and not isPass(second):
-        assert first == second
-
-def isEqualVirtualHost(first, second):
-    """
-    Checks that two VirtualHost objects are similar. There are some built
-    in differences with the implementations: VirtualHost created by ParserNode
-    implementation doesn't have "path" defined, as it was used for Augeas path
-    and that cannot obviously be used in the future. Similarly the legacy
-    version lacks "node" variable, that has a reference to the BlockNode for the
-    VirtualHost.
-    """
-    return (
-        first.name == second.name and
-        first.aliases == second.aliases and
-        first.filep == second.filep and
-        first.addrs == second.addrs and
-        first.ssl == second.ssl and
-        first.enabled == second.enabled and
-        first.modmacro == second.modmacro and
-        first.ancestor == second.ancestor
-    )
-
-def assertEqualPathsList(first, second):  # pragma: no cover
-    """
-    Checks that the two lists of file paths match. This assertion allows for wildcard
-    paths.
-    """
-    if any([isPass(path) for path in first]):
-        return
-    if any([isPass(path) for path in second]):
-        return
-    for fpath in first:
-        assert any([fnmatch.fnmatch(fpath, spath) for spath in second])
-    for spath in second:
-        assert any([fnmatch.fnmatch(fpath, spath) for fpath in first])

certbot-apache/certbot_apache/_internal/augeasparser.py

@@ -1,538 +0,0 @@
-"""
-Augeas implementation of the ParserNode interfaces.
-
-Augeas works internally by using XPATH notation. The following is a short example
-of how this all works internally, to better understand what's going on under the
-hood.
-
-A configuration file /etc/apache2/apache2.conf with the following content:
-
-    # First comment line
-    # Second comment line
-    WhateverDirective whatevervalue
-    <ABlock>
-        DirectiveInABlock dirvalue
-    </ABlock>
-    SomeDirective somedirectivevalue
-    <ABlock>
-        AnotherDirectiveInABlock dirvalue
-    </ABlock>
-    # Yet another comment
-
-
-Translates over to Augeas path notation (of immediate children), when calling
-for example: aug.match("/files/etc/apache2/apache2.conf/*")
-
-[
-    "/files/etc/apache2/apache2.conf/#comment[1]",
-    "/files/etc/apache2/apache2.conf/#comment[2]",
-    "/files/etc/apache2/apache2.conf/directive[1]",
-    "/files/etc/apache2/apache2.conf/ABlock[1]",
-    "/files/etc/apache2/apache2.conf/directive[2]",
-    "/files/etc/apache2/apache2.conf/ABlock[2]",
-    "/files/etc/apache2/apache2.conf/#comment[3]"
-]
-
-Regardless of directives name, its key in the Augeas tree is always "directive",
-with index where needed of course. Comments work similarly, while blocks
-have their own key in the Augeas XPATH notation.
-
-It's important to note that all of the unique keys have their own indices.
-
-Augeas paths are case sensitive, while Apache configuration is case insensitive.
-It looks like this:
-
-    <block>
-        directive value
-    </block>
-    <Block>
-        Directive Value
-    </Block>
-    <block>
-        directive value
-    </block>
-    <bLoCk>
-        DiReCtiVe VaLuE
-    </bLoCk>
-
-Translates over to:
-
-[
-    "/files/etc/apache2/apache2.conf/block[1]",
-    "/files/etc/apache2/apache2.conf/Block[1]",
-    "/files/etc/apache2/apache2.conf/block[2]",
-    "/files/etc/apache2/apache2.conf/bLoCk[1]",
-]
-"""
-from acme.magic_typing import Set  # pylint: disable=unused-import, no-name-in-module
-from certbot import errors
-from certbot.compat import os
-
-from certbot_apache._internal import apache_util
-from certbot_apache._internal import assertions
-from certbot_apache._internal import interfaces
-from certbot_apache._internal import parser
-from certbot_apache._internal import parsernode_util as util
-
-
-class AugeasParserNode(interfaces.ParserNode):
-    """ Augeas implementation of ParserNode interface """
-
-    def __init__(self, **kwargs):
-        ancestor, dirty, filepath, metadata = util.parsernode_kwargs(kwargs)  # pylint: disable=unused-variable
-        super(AugeasParserNode, self).__init__(**kwargs)
-        self.ancestor = ancestor
-        self.filepath = filepath
-        self.dirty = dirty
-        self.metadata = metadata
-        self.parser = self.metadata.get("augeasparser")
-        try:
-            if self.metadata["augeaspath"].endswith("/"):
-                raise errors.PluginError(
-                    "Augeas path: {} has a trailing slash".format(
-                        self.metadata["augeaspath"]
-                    )
-                )
-        except KeyError:
-            raise errors.PluginError("Augeas path is required")
-
-    def save(self, msg):
-        self.parser.save(msg)
-
-    def find_ancestors(self, name):
-        """
-        Searches for ancestor BlockNodes with a given name.
-
-        :param str name: Name of the BlockNode parent to search for
-
-        :returns: List of matching ancestor nodes.
-        :rtype: list of AugeasBlockNode
-        """
-
-        ancestors = []
-
-        parent = self.metadata["augeaspath"]
-        while True:
-            # Get the path of ancestor node
-            parent = parent.rpartition("/")[0]
-            # Root of the tree
-            if not parent or parent == "/files":
-                break
-            anc = self._create_blocknode(parent)
-            if anc.name.lower() == name.lower():
-                ancestors.append(anc)
-
-        return ancestors
-
-    def _create_blocknode(self, path):
-        """
-        Helper function to create a BlockNode from Augeas path. This is used by
-        AugeasParserNode.find_ancestors and AugeasBlockNode.
-        and AugeasBlockNode.find_blocks
-
-        """
-
-        name = self._aug_get_name(path)
-        metadata = {"augeasparser": self.parser, "augeaspath": path}
-
-        # Check if the file was included from the root config or initial state
-        enabled = self.parser.parsed_in_original(
-            apache_util.get_file_path(path)
-        )
-
-        return AugeasBlockNode(name=name,
-                               enabled=enabled,
-                               ancestor=assertions.PASS,
-                               filepath=apache_util.get_file_path(path),
-                               metadata=metadata)
-
-    def _aug_get_name(self, path):
-        """
-        Helper function to get name of a configuration block or variable from path.
-        """
-
-        # Remove the ending slash if any
-        if path[-1] == "/":  # pragma: no cover
-            path = path[:-1]
-
-        # Get the block name
-        name = path.split("/")[-1]
-
-        # remove [...], it's not allowed in Apache configuration and is used
-        # for indexing within Augeas
-        name = name.split("[")[0]
-        return name
-
-
-class AugeasCommentNode(AugeasParserNode):
-    """ Augeas implementation of CommentNode interface """
-
-    def __init__(self, **kwargs):
-        comment, kwargs = util.commentnode_kwargs(kwargs)  # pylint: disable=unused-variable
-        super(AugeasCommentNode, self).__init__(**kwargs)
-        # self.comment = comment
-        self.comment = comment
-
-    def __eq__(self, other):
-        if isinstance(other, self.__class__):
-            return (self.comment == other.comment and
-                    self.filepath == other.filepath and
-                    self.dirty == other.dirty and
-                    self.ancestor == other.ancestor and
-                    self.metadata == other.metadata)
-        return False
-
-
-class AugeasDirectiveNode(AugeasParserNode):
-    """ Augeas implementation of DirectiveNode interface """
-
-    def __init__(self, **kwargs):
-        name, parameters, enabled, kwargs = util.directivenode_kwargs(kwargs)
-        super(AugeasDirectiveNode, self).__init__(**kwargs)
-        self.name = name
-        self.enabled = enabled
-        if parameters:
-            self.set_parameters(parameters)
-
-    def __eq__(self, other):
-        if isinstance(other, self.__class__):
-            return (self.name == other.name and
-                    self.filepath == other.filepath and
-                    self.parameters == other.parameters and
-                    self.enabled == other.enabled and
-                    self.dirty == other.dirty and
-                    self.ancestor == other.ancestor and
-                    self.metadata == other.metadata)
-        return False
-
-    def set_parameters(self, parameters):
-        """
-        Sets parameters of a DirectiveNode or BlockNode object.
-
-        :param list parameters: List of all parameters for the node to set.
-        """
-        orig_params = self._aug_get_params(self.metadata["augeaspath"])
-
-        # Clear out old parameters
-        for _ in orig_params:
-            # When the first parameter is removed, the indices get updated
-            param_path = "{}/arg[1]".format(self.metadata["augeaspath"])
-            self.parser.aug.remove(param_path)
-        # Insert new ones
-        for pi, param in enumerate(parameters):
-            param_path = "{}/arg[{}]".format(self.metadata["augeaspath"], pi+1)
-            self.parser.aug.set(param_path, param)
-
-    @property
-    def parameters(self):
-        """
-        Fetches the parameters from Augeas tree, ensuring that the sequence always
-        represents the current state
-
-        :returns: Tuple of parameters for this DirectiveNode
-        :rtype: tuple:
-        """
-        return tuple(self._aug_get_params(self.metadata["augeaspath"]))
-
-    def _aug_get_params(self, path):
-        """Helper function to get parameters for DirectiveNodes and BlockNodes"""
-
-        arg_paths = self.parser.aug.match(path + "/arg")
-        return [self.parser.get_arg(apath) for apath in arg_paths]
-
-
-class AugeasBlockNode(AugeasDirectiveNode):
-    """ Augeas implementation of BlockNode interface """
-
-    def __init__(self, **kwargs):
-        super(AugeasBlockNode, self).__init__(**kwargs)
-        self.children = ()
-
-    def __eq__(self, other):
-        if isinstance(other, self.__class__):
-            return (self.name == other.name and
-                    self.filepath == other.filepath and
-                    self.parameters == other.parameters and
-                    self.children == other.children and
-                    self.enabled == other.enabled and
-                    self.dirty == other.dirty and
-                    self.ancestor == other.ancestor and
-                    self.metadata == other.metadata)
-        return False
-
-    # pylint: disable=unused-argument
-    def add_child_block(self, name, parameters=None, position=None):  # pragma: no cover
-        """Adds a new BlockNode to the sequence of children"""
-
-        insertpath, realpath, before = self._aug_resolve_child_position(
-            name,
-            position
-        )
-        new_metadata = {"augeasparser": self.parser, "augeaspath": realpath}
-
-        # Create the new block
-        self.parser.aug.insert(insertpath, name, before)
-        # Check if the file was included from the root config or initial state
-        enabled = self.parser.parsed_in_original(
-            apache_util.get_file_path(realpath)
-        )
-
-        # Parameters will be set at the initialization of the new object
-        new_block = AugeasBlockNode(name=name,
-                                    parameters=parameters,
-                                    enabled=enabled,
-                                    ancestor=assertions.PASS,
-                                    filepath=apache_util.get_file_path(realpath),
-                                    metadata=new_metadata)
-        return new_block
-
-    # pylint: disable=unused-argument
-    def add_child_directive(self, name, parameters=None, position=None):  # pragma: no cover
-        """Adds a new DirectiveNode to the sequence of children"""
-
-        if not parameters:
-            raise errors.PluginError("Directive requires parameters and none were set.")
-
-        insertpath, realpath, before = self._aug_resolve_child_position(
-            "directive",
-            position
-        )
-        new_metadata = {"augeasparser": self.parser, "augeaspath": realpath}
-
-        # Create the new directive
-        self.parser.aug.insert(insertpath, "directive", before)
-        # Set the directive key
-        self.parser.aug.set(realpath, name)
-        # Check if the file was included from the root config or initial state
-        enabled = self.parser.parsed_in_original(
-            apache_util.get_file_path(realpath)
-        )
-
-        new_dir = AugeasDirectiveNode(name=name,
-                                      parameters=parameters,
-                                      enabled=enabled,
-                                      ancestor=assertions.PASS,
-                                      filepath=apache_util.get_file_path(realpath),
-                                      metadata=new_metadata)
-        return new_dir
-
-    def add_child_comment(self, comment="", position=None):
-        """Adds a new CommentNode to the sequence of children"""
-
-        insertpath, realpath, before = self._aug_resolve_child_position(
-            "#comment",
-            position
-        )
-        new_metadata = {"augeasparser": self.parser, "augeaspath": realpath}
-
-        # Create the new comment
-        self.parser.aug.insert(insertpath, "#comment", before)
-        # Set the comment content
-        self.parser.aug.set(realpath, comment)
-
-        new_comment = AugeasCommentNode(comment=comment,
-                                        ancestor=assertions.PASS,
-                                        filepath=apache_util.get_file_path(realpath),
-                                        metadata=new_metadata)
-        return new_comment
-
-    def find_blocks(self, name, exclude=True):
-        """Recursive search of BlockNodes from the sequence of children"""
-
-        nodes = list()
-        paths = self._aug_find_blocks(name)
-        if exclude:
-            paths = self.parser.exclude_dirs(paths)
-        for path in paths:
-            nodes.append(self._create_blocknode(path))
-
-        return nodes
-
-    def find_directives(self, name, exclude=True):
-        """Recursive search of DirectiveNodes from the sequence of children"""
-
-        nodes = list()
-        ownpath = self.metadata.get("augeaspath")
-
-        directives = self.parser.find_dir(name, start=ownpath, exclude=exclude)
-        already_parsed = set()  # type: Set[str]
-        for directive in directives:
-            # Remove the /arg part from the Augeas path
-            directive = directive.partition("/arg")[0]
-            # find_dir returns an object for each _parameter_ of a directive
-            # so we need to filter out duplicates.
-            if directive not in already_parsed:
-                nodes.append(self._create_directivenode(directive))
-                already_parsed.add(directive)
-
-        return nodes
-
-    def find_comments(self, comment):
-        """
-        Recursive search of DirectiveNodes from the sequence of children.
-
-        :param str comment: Comment content to search for.
-        """
-
-        nodes = list()
-        ownpath = self.metadata.get("augeaspath")
-
-        comments = self.parser.find_comments(comment, start=ownpath)
-        for com in comments:
-            nodes.append(self._create_commentnode(com))
-
-        return nodes
-
-    def delete_child(self, child):
-        """
-        Deletes a ParserNode from the sequence of children, and raises an
-        exception if it's unable to do so.
-        :param AugeasParserNode: child: A node to delete.
-        """
-        if not self.parser.aug.remove(child.metadata["augeaspath"]):
-
-            raise errors.PluginError(
-                ("Could not delete child node, the Augeas path: {} doesn't " +
-                 "seem to exist.").format(child.metadata["augeaspath"])
-            )
-
-    def unsaved_files(self):
-        """Returns a list of unsaved filepaths"""
-        return self.parser.unsaved_files()
-
-    def parsed_paths(self):
-        """
-        Returns a list of file paths that have currently been parsed into the parser
-        tree. The returned list may include paths with wildcard characters, for
-        example: ['/etc/apache2/conf.d/*.load']
-
-        This is typically called on the root node of the ParserNode tree.
-
-        :returns: list of file paths of files that have been parsed
-        """
-
-        res_paths = []
-
-        paths = self.parser.existing_paths
-        for directory in paths:
-            for filename in paths[directory]:
-                res_paths.append(os.path.join(directory, filename))
-
-        return res_paths
-
-    def _create_commentnode(self, path):
-        """Helper function to create a CommentNode from Augeas path"""
-
-        comment = self.parser.aug.get(path)
-        metadata = {"augeasparser": self.parser, "augeaspath": path}
-
-        # Because of the dynamic nature of AugeasParser and the fact that we're
-        # not populating the complete node tree, the ancestor has a dummy value
-        return AugeasCommentNode(comment=comment,
-                                 ancestor=assertions.PASS,
-                                 filepath=apache_util.get_file_path(path),
-                                 metadata=metadata)
-
-    def _create_directivenode(self, path):
-        """Helper function to create a DirectiveNode from Augeas path"""
-
-        name = self.parser.get_arg(path)
-        metadata = {"augeasparser": self.parser, "augeaspath": path}
-
-        # Check if the file was included from the root config or initial state
-        enabled = self.parser.parsed_in_original(
-            apache_util.get_file_path(path)
-        )
-        return AugeasDirectiveNode(name=name,
-                                   ancestor=assertions.PASS,
-                                   enabled=enabled,
-                                   filepath=apache_util.get_file_path(path),
-                                   metadata=metadata)
-
-    def _aug_find_blocks(self, name):
-        """Helper function to perform a search to Augeas DOM tree to search
-        configuration blocks with a given name"""
-
-        # The code here is modified from configurator.get_virtual_hosts()
-        blk_paths = set()
-        for vhost_path in list(self.parser.parser_paths):
-            paths = self.parser.aug.match(
-                ("/files%s//*[label()=~regexp('%s')]" %
-                    (vhost_path, parser.case_i(name))))
-            blk_paths.update([path for path in paths if
-                              name.lower() in os.path.basename(path).lower()])
-        return blk_paths
-
-    def _aug_resolve_child_position(self, name, position):
-        """
-        Helper function that iterates through the immediate children and figures
-        out the insertion path for a new AugeasParserNode.
-
-        Augeas also generalizes indices for directives and comments, simply by
-        using "directive" or "comment" respectively as their names.
-
-        This function iterates over the existing children of the AugeasBlockNode,
-        returning their insertion path, resulting Augeas path and if the new node
-        should be inserted before or after the returned insertion path.
-
-        Note: while Apache is case insensitive, Augeas is not, and blocks like
-        Nameofablock and NameOfABlock have different indices.
-
-        :param str name: Name of the AugeasBlockNode to insert, "directive" for
-            AugeasDirectiveNode or "comment" for AugeasCommentNode
-        :param int position: The position to insert the child AugeasParserNode to
-
-        :returns: Tuple of insert path, resulting path and a boolean if the new
-            node should be inserted before it.
-        :rtype: tuple of str, str, bool
-        """
-
-        # Default to appending
-        before = False
-
-        all_children = self.parser.aug.match("{}/*".format(
-            self.metadata["augeaspath"])
-        )
-
-        # Calculate resulting_path
-        # Augeas indices start at 1. We use counter to calculate the index to
-        # be used in resulting_path.
-        counter = 1
-        for i, child in enumerate(all_children):
-            if position is not None and i >= position:
-                # We're not going to insert the new node to an index after this
-                break
-            childname = self._aug_get_name(child)
-            if name == childname:
-                counter += 1
-
-        resulting_path = "{}/{}[{}]".format(
-            self.metadata["augeaspath"],
-            name,
-            counter
-        )
-
-        # Form the correct insert_path
-        # Inserting the only child and appending as the last child work
-        # similarly in Augeas.
-        append = not all_children or position is None or position >= len(all_children)
-        if append:
-            insert_path = "{}/*[last()]".format(
-                self.metadata["augeaspath"]
-            )
-        elif position == 0:
-            # Insert as the first child, before the current first one.
-            insert_path = all_children[0]
-            before = True
-        else:
-            insert_path = "{}/*[{}]".format(
-                self.metadata["augeaspath"],
-                position
-            )
-
-        return (insert_path, resulting_path, before)
-
-
-interfaces.CommentNode.register(AugeasCommentNode)
-interfaces.DirectiveNode.register(AugeasDirectiveNode)
-interfaces.BlockNode.register(AugeasBlockNode)

certbot-apache/certbot_apache/_internal/dualparser.py

@@ -1,306 +0,0 @@
-""" Dual ParserNode implementation """
-from certbot_apache._internal import assertions
-from certbot_apache._internal import augeasparser
-from certbot_apache._internal import apacheparser
-
-
-class DualNodeBase(object):
-    """ Dual parser interface for in development testing. This is used as the
-    base class for dual parser interface classes. This class handles runtime
-    attribute value assertions."""
-
-    def save(self, msg):  # pragma: no cover
-        """ Call save for both parsers """
-        self.primary.save(msg)
-        self.secondary.save(msg)
-
-    def __getattr__(self, aname):
-        """ Attribute value assertion """
-        firstval = getattr(self.primary, aname)
-        secondval = getattr(self.secondary, aname)
-        exclusions = [
-            # Metadata will inherently be different, as ApacheParserNode does
-            # not have Augeas paths and so on.
-            aname == "metadata",
-            callable(firstval)
-        ]
-        if not any(exclusions):
-            assertions.assertEqualSimple(firstval, secondval)
-        return firstval
-
-    def find_ancestors(self, name):
-        """ Traverses the ancestor tree and returns ancestors matching name """
-        return self._find_helper(DualBlockNode, "find_ancestors", name)
-
-    def _find_helper(self, nodeclass, findfunc, search, **kwargs):
-        """A helper for find_* functions. The function specific attributes should
-        be passed as keyword arguments.
-
-        :param interfaces.ParserNode nodeclass: The node class for results.
-        :param str findfunc: Name of the find function to call
-        :param str search: The search term
-        """
-
-        primary_res = getattr(self.primary, findfunc)(search, **kwargs)
-        secondary_res = getattr(self.secondary, findfunc)(search, **kwargs)
-
-        # The order of search results for Augeas implementation cannot be
-        # assured.
-
-        pass_primary = assertions.isPassNodeList(primary_res)
-        pass_secondary = assertions.isPassNodeList(secondary_res)
-        new_nodes = list()
-
-        if pass_primary and pass_secondary:
-            # Both unimplemented
-            new_nodes.append(nodeclass(primary=primary_res[0],
-                                       secondary=secondary_res[0]))  # pragma: no cover
-        elif pass_primary:
-            for c in secondary_res:
-                new_nodes.append(nodeclass(primary=primary_res[0],
-                                           secondary=c))
-        elif pass_secondary:
-            for c in primary_res:
-                new_nodes.append(nodeclass(primary=c,
-                                           secondary=secondary_res[0]))
-        else:
-            assert len(primary_res) == len(secondary_res)
-            matches = self._create_matching_list(primary_res, secondary_res)
-            for p, s in matches:
-                new_nodes.append(nodeclass(primary=p, secondary=s))
-
-        return new_nodes
-
-
-class DualCommentNode(DualNodeBase):
-    """ Dual parser implementation of CommentNode interface """
-
-    def __init__(self, **kwargs):
-        """ This initialization implementation allows ordinary initialization
-        of CommentNode objects as well as creating a DualCommentNode object
-        using precreated or fetched CommentNode objects if provided as optional
-        arguments primary and secondary.
-
-        Parameters other than the following are from interfaces.CommentNode:
-
-        :param CommentNode primary: Primary pre-created CommentNode, mainly
-            used when creating new DualParser nodes using add_* methods.
-        :param CommentNode secondary: Secondary pre-created CommentNode
-        """
-
-        kwargs.setdefault("primary", None)
-        kwargs.setdefault("secondary", None)
-        primary = kwargs.pop("primary")
-        secondary = kwargs.pop("secondary")
-
-        if primary or secondary:
-            assert primary and secondary
-            self.primary = primary
-            self.secondary = secondary
-        else:
-            self.primary = augeasparser.AugeasCommentNode(**kwargs)
-            self.secondary = apacheparser.ApacheCommentNode(**kwargs)
-
-        assertions.assertEqual(self.primary, self.secondary)
-
-
-class DualDirectiveNode(DualNodeBase):
-    """ Dual parser implementation of DirectiveNode interface """
-
-    def __init__(self, **kwargs):
-        """ This initialization implementation allows ordinary initialization
-        of DirectiveNode objects as well as creating a DualDirectiveNode object
-        using precreated or fetched DirectiveNode objects if provided as optional
-        arguments primary and secondary.
-
-        Parameters other than the following are from interfaces.DirectiveNode:
-
-        :param DirectiveNode primary: Primary pre-created DirectiveNode, mainly
-            used when creating new DualParser nodes using add_* methods.
-        :param DirectiveNode secondary: Secondary pre-created DirectiveNode
-
-
-        """
-
-        kwargs.setdefault("primary", None)
-        kwargs.setdefault("secondary", None)
-        primary = kwargs.pop("primary")
-        secondary = kwargs.pop("secondary")
-
-        if primary or secondary:
-            assert primary and secondary
-            self.primary = primary
-            self.secondary = secondary
-        else:
-            self.primary = augeasparser.AugeasDirectiveNode(**kwargs)
-            self.secondary = apacheparser.ApacheDirectiveNode(**kwargs)
-
-        assertions.assertEqual(self.primary, self.secondary)
-
-    def set_parameters(self, parameters):
-        """ Sets parameters and asserts that both implementation successfully
-        set the parameter sequence """
-
-        self.primary.set_parameters(parameters)
-        self.secondary.set_parameters(parameters)
-        assertions.assertEqual(self.primary, self.secondary)
-
-
-class DualBlockNode(DualNodeBase):
-    """ Dual parser implementation of BlockNode interface """
-
-    def __init__(self, **kwargs):
-        """ This initialization implementation allows ordinary initialization
-        of BlockNode objects as well as creating a DualBlockNode object
-        using precreated or fetched BlockNode objects if provided as optional
-        arguments primary and secondary.
-
-        Parameters other than the following are from interfaces.BlockNode:
-
-        :param BlockNode primary: Primary pre-created BlockNode, mainly
-            used when creating new DualParser nodes using add_* methods.
-        :param BlockNode secondary: Secondary pre-created BlockNode
-        """
-
-        kwargs.setdefault("primary", None)
-        kwargs.setdefault("secondary", None)
-        primary = kwargs.pop("primary")
-        secondary = kwargs.pop("secondary")
-
-        if primary or secondary:
-            assert primary and secondary
-            self.primary = primary
-            self.secondary = secondary
-        else:
-            self.primary = augeasparser.AugeasBlockNode(**kwargs)
-            self.secondary = apacheparser.ApacheBlockNode(**kwargs)
-
-        assertions.assertEqual(self.primary, self.secondary)
-
-    def add_child_block(self, name, parameters=None, position=None):
-        """ Creates a new child BlockNode, asserts that both implementations
-        did it in a similar way, and returns a newly created DualBlockNode object
-        encapsulating both of the newly created objects """
-
-        primary_new = self.primary.add_child_block(name, parameters, position)
-        secondary_new = self.secondary.add_child_block(name, parameters, position)
-        assertions.assertEqual(primary_new, secondary_new)
-        new_block = DualBlockNode(primary=primary_new, secondary=secondary_new)
-        return new_block
-
-    def add_child_directive(self, name, parameters=None, position=None):
-        """ Creates a new child DirectiveNode, asserts that both implementations
-        did it in a similar way, and returns a newly created DualDirectiveNode
-        object encapsulating both of the newly created objects """
-
-        primary_new = self.primary.add_child_directive(name, parameters, position)
-        secondary_new = self.secondary.add_child_directive(name, parameters, position)
-        assertions.assertEqual(primary_new, secondary_new)
-        new_dir = DualDirectiveNode(primary=primary_new, secondary=secondary_new)
-        return new_dir
-
-    def add_child_comment(self, comment="", position=None):
-        """ Creates a new child CommentNode, asserts that both implementations
-        did it in a similar way, and returns a newly created DualCommentNode
-        object encapsulating both of the newly created objects """
-
-        primary_new = self.primary.add_child_comment(comment, position)
-        secondary_new = self.secondary.add_child_comment(comment, position)
-        assertions.assertEqual(primary_new, secondary_new)
-        new_comment = DualCommentNode(primary=primary_new, secondary=secondary_new)
-        return new_comment
-
-    def _create_matching_list(self, primary_list, secondary_list):
-        """ Matches the list of primary_list to a list of secondary_list and
-        returns a list of tuples. This is used to create results for find_
-        methods.
-
-        This helper function exists, because we cannot ensure that the list of
-        search results returned by primary.find_* and secondary.find_* are ordered
-        in a same way. The function pairs the same search results from both
-        implementations to a list of tuples.
-        """
-
-        matched = list()
-        for p in primary_list:
-            match = None
-            for s in secondary_list:
-                try:
-                    assertions.assertEqual(p, s)
-                    match = s
-                    break
-                except AssertionError:
-                    continue
-            if match:
-                matched.append((p, match))
-            else:
-                raise AssertionError("Could not find a matching node.")
-        return matched
-
-    def find_blocks(self, name, exclude=True):
-        """
-        Performs a search for BlockNodes using both implementations and does simple
-        checks for results. This is built upon the assumption that unimplemented
-        find_* methods return a list with a single assertion passing object.
-        After the assertion, it creates a list of newly created DualBlockNode
-        instances that encapsulate the pairs of returned BlockNode objects.
-        """
-
-        return self._find_helper(DualBlockNode, "find_blocks", name,
-                                 exclude=exclude)
-
-    def find_directives(self, name, exclude=True):
-        """
-        Performs a search for DirectiveNodes using both implementations and
-        checks the results. This is built upon the assumption that unimplemented
-        find_* methods return a list with a single assertion passing object.
-        After the assertion, it creates a list of newly created DualDirectiveNode
-        instances that encapsulate the pairs of returned DirectiveNode objects.
-        """
-
-        return self._find_helper(DualDirectiveNode, "find_directives", name,
-                                 exclude=exclude)
-
-    def find_comments(self, comment):
-        """
-        Performs a search for CommentNodes using both implementations and
-        checks the results. This is built upon the assumption that unimplemented
-        find_* methods return a list with a single assertion passing object.
-        After the assertion, it creates a list of newly created DualCommentNode
-        instances that encapsulate the pairs of returned CommentNode objects.
-        """
-
-        return self._find_helper(DualCommentNode, "find_comments", comment)
-
-    def delete_child(self, child):
-        """Deletes a child from the ParserNode implementations. The actual
-        ParserNode implementations are used here directly in order to be able
-        to match a child to the list of children."""
-
-        self.primary.delete_child(child.primary)
-        self.secondary.delete_child(child.secondary)
-
-    def unsaved_files(self):
-        """ Fetches the list of unsaved file paths and asserts that the lists
-        match """
-        primary_files = self.primary.unsaved_files()
-        secondary_files = self.secondary.unsaved_files()
-        assertions.assertEqualSimple(primary_files, secondary_files)
-
-        return primary_files
-
-    def parsed_paths(self):
-        """
-        Returns a list of file paths that have currently been parsed into the parser
-        tree. The returned list may include paths with wildcard characters, for
-        example: ['/etc/apache2/conf.d/*.load']
-
-        This is typically called on the root node of the ParserNode tree.
-
-        :returns: list of file paths of files that have been parsed
-        """
-
-        primary_paths = self.primary.parsed_paths()
-        secondary_paths = self.secondary.parsed_paths()
-        assertions.assertEqualPathsList(primary_paths, secondary_paths)
-        return primary_paths

certbot-apache/certbot_apache/_internal/entrypoint.py

@@ -1,68 +0,0 @@
-""" Entry point for Apache Plugin """
-# Pylint does not like disutils.version when running inside a venv.
-# See: https://github.com/PyCQA/pylint/issues/73
-from distutils.version import LooseVersion  # pylint: disable=no-name-in-module,import-error
-
-from certbot import util
-from certbot_apache._internal import configurator
-from certbot_apache._internal import override_arch
-from certbot_apache._internal import override_centos
-from certbot_apache._internal import override_darwin
-from certbot_apache._internal import override_debian
-from certbot_apache._internal import override_fedora
-from certbot_apache._internal import override_gentoo
-from certbot_apache._internal import override_suse
-
-OVERRIDE_CLASSES = {
-    "arch": override_arch.ArchConfigurator,
-    "cloudlinux": override_centos.CentOSConfigurator,
-    "darwin": override_darwin.DarwinConfigurator,
-    "debian": override_debian.DebianConfigurator,
-    "ubuntu": override_debian.DebianConfigurator,
-    "centos": override_centos.CentOSConfigurator,
-    "centos linux": override_centos.CentOSConfigurator,
-    "fedora_old": override_centos.CentOSConfigurator,
-    "fedora": override_fedora.FedoraConfigurator,
-    "linuxmint": override_debian.DebianConfigurator,
-    "ol": override_centos.CentOSConfigurator,
-    "oracle": override_centos.CentOSConfigurator,
-    "redhatenterpriseserver": override_centos.CentOSConfigurator,
-    "red hat enterprise linux server": override_centos.CentOSConfigurator,
-    "rhel": override_centos.CentOSConfigurator,
-    "amazon": override_centos.CentOSConfigurator,
-    "gentoo": override_gentoo.GentooConfigurator,
-    "gentoo base system": override_gentoo.GentooConfigurator,
-    "opensuse": override_suse.OpenSUSEConfigurator,
-    "suse": override_suse.OpenSUSEConfigurator,
-    "sles": override_suse.OpenSUSEConfigurator,
-    "scientific": override_centos.CentOSConfigurator,
-    "scientific linux": override_centos.CentOSConfigurator,
-}
-
-
-def get_configurator():
-    """ Get correct configurator class based on the OS fingerprint """
-    os_name, os_version = util.get_os_info()
-    os_name = os_name.lower()
-    override_class = None
-
-    # Special case for older Fedora versions
-    if os_name == 'fedora' and LooseVersion(os_version) < LooseVersion('29'):
-        os_name = 'fedora_old'
-
-    try:
-        override_class = OVERRIDE_CLASSES[os_name]
-    except KeyError:
-        # OS not found in the list
-        os_like = util.get_systemd_os_like()
-        if os_like:
-            for os_name in os_like:
-                if os_name in OVERRIDE_CLASSES.keys():
-                    override_class = OVERRIDE_CLASSES[os_name]
-        if not override_class:
-            # No override class found, return the generic configurator
-            override_class = configurator.ApacheConfigurator
-    return override_class
-
-
-ENTRYPOINT = get_configurator()

certbot-apache/certbot_apache/_internal/http_01.py

@@ -1,209 +0,0 @@
-"""A class that performs HTTP-01 challenges for Apache"""
-import logging
-
-from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
-from acme.magic_typing import Set  # pylint: disable=unused-import, no-name-in-module
-from certbot import errors
-from certbot.compat import filesystem
-from certbot.compat import os
-from certbot.plugins import common
-from certbot_apache._internal.obj import VirtualHost  # pylint: disable=unused-import
-from certbot_apache._internal.parser import get_aug_path
-
-logger = logging.getLogger(__name__)
-
-
-class ApacheHttp01(common.ChallengePerformer):
-    """Class that performs HTTP-01 challenges within the Apache configurator."""
-
-    CONFIG_TEMPLATE22_PRE = """\
-        RewriteEngine on
-        RewriteRule ^/\\.well-known/acme-challenge/([A-Za-z0-9-_=]+)$ {0}/$1 [L]
-
-    """
-    CONFIG_TEMPLATE22_POST = """\
-        <Directory {0}>
-            Order Allow,Deny
-            Allow from all
-        </Directory>
-        <Location /.well-known/acme-challenge>
-            Order Allow,Deny
-            Allow from all
-        </Location>
-    """
-
-    CONFIG_TEMPLATE24_PRE = """\
-        RewriteEngine on
-        RewriteRule ^/\\.well-known/acme-challenge/([A-Za-z0-9-_=]+)$ {0}/$1 [END]
-    """
-    CONFIG_TEMPLATE24_POST = """\
-        <Directory {0}>
-            Require all granted
-        </Directory>
-        <Location /.well-known/acme-challenge>
-            Require all granted
-        </Location>
-    """
-
-    def __init__(self, *args, **kwargs):
-        super(ApacheHttp01, self).__init__(*args, **kwargs)
-        self.challenge_conf_pre = os.path.join(
-            self.configurator.conf("challenge-location"),
-            "le_http_01_challenge_pre.conf")
-        self.challenge_conf_post = os.path.join(
-            self.configurator.conf("challenge-location"),
-            "le_http_01_challenge_post.conf")
-        self.challenge_dir = os.path.join(
-            self.configurator.config.work_dir,
-            "http_challenges")
-        self.moded_vhosts = set()  # type: Set[VirtualHost]
-
-    def perform(self):
-        """Perform all HTTP-01 challenges."""
-        if not self.achalls:
-            return []
-        # Save any changes to the configuration as a precaution
-        # About to make temporary changes to the config
-        self.configurator.save("Changes before challenge setup", True)
-
-        self.configurator.ensure_listen(str(
-            self.configurator.config.http01_port))
-        self.prepare_http01_modules()
-
-        responses = self._set_up_challenges()
-
-        self._mod_config()
-        # Save reversible changes
-        self.configurator.save("HTTP Challenge", True)
-
-        return responses
-
-    def prepare_http01_modules(self):
-        """Make sure that we have the needed modules available for http01"""
-
-        if self.configurator.conf("handle-modules"):
-            needed_modules = ["rewrite"]
-            if self.configurator.version < (2, 4):
-                needed_modules.append("authz_host")
-            else:
-                needed_modules.append("authz_core")
-            for mod in needed_modules:
-                if mod + "_module" not in self.configurator.parser.modules:
-                    self.configurator.enable_mod(mod, temp=True)
-
-    def _mod_config(self):
-        selected_vhosts = []  # type: List[VirtualHost]
-        http_port = str(self.configurator.config.http01_port)
-        for chall in self.achalls:
-            # Search for matching VirtualHosts
-            for vh in self._matching_vhosts(chall.domain):
-                selected_vhosts.append(vh)
-
-        # Ensure that we have one or more VirtualHosts that we can continue
-        # with. (one that listens to port configured with --http-01-port)
-        found = False
-        for vhost in selected_vhosts:
-            if any(a.is_wildcard() or a.get_port() == http_port for a in vhost.addrs):
-                found = True
-
-        if not found:
-            for vh in self._relevant_vhosts():
-                selected_vhosts.append(vh)
-
-        # Add the challenge configuration
-        for vh in selected_vhosts:
-            self._set_up_include_directives(vh)
-
-        self.configurator.reverter.register_file_creation(
-            True, self.challenge_conf_pre)
-        self.configurator.reverter.register_file_creation(
-            True, self.challenge_conf_post)
-
-        if self.configurator.version < (2, 4):
-            config_template_pre = self.CONFIG_TEMPLATE22_PRE
-            config_template_post = self.CONFIG_TEMPLATE22_POST
-        else:
-            config_template_pre = self.CONFIG_TEMPLATE24_PRE
-            config_template_post = self.CONFIG_TEMPLATE24_POST
-
-        config_text_pre = config_template_pre.format(self.challenge_dir)
-        config_text_post = config_template_post.format(self.challenge_dir)
-
-        logger.debug("writing a pre config file with text:\n %s", config_text_pre)
-        with open(self.challenge_conf_pre, "w") as new_conf:
-            new_conf.write(config_text_pre)
-        logger.debug("writing a post config file with text:\n %s", config_text_post)
-        with open(self.challenge_conf_post, "w") as new_conf:
-            new_conf.write(config_text_post)
-
-    def _matching_vhosts(self, domain):
-        """Return all VirtualHost objects that have the requested domain name or
-        a wildcard name that would match the domain in ServerName or ServerAlias
-        directive.
-        """
-        matching_vhosts = []
-        for vhost in self.configurator.vhosts:
-            if self.configurator.domain_in_names(vhost.get_names(), domain):
-                # domain_in_names also matches the exact names, so no need
-                # to check "domain in vhost.get_names()" explicitly here
-                matching_vhosts.append(vhost)
-
-        return matching_vhosts
-
-    def _relevant_vhosts(self):
-        http01_port = str(self.configurator.config.http01_port)
-        relevant_vhosts = []
-        for vhost in self.configurator.vhosts:
-            if any(a.is_wildcard() or a.get_port() == http01_port for a in vhost.addrs):
-                if not vhost.ssl:
-                    relevant_vhosts.append(vhost)
-        if not relevant_vhosts:
-            raise errors.PluginError(
-                "Unable to find a virtual host listening on port {0} which is"
-                " currently needed for Certbot to prove to the CA that you"
-                " control your domain. Please add a virtual host for port"
-                " {0}.".format(http01_port))
-
-        return relevant_vhosts
-
-    def _set_up_challenges(self):
-        if not os.path.isdir(self.challenge_dir):
-            filesystem.makedirs(self.challenge_dir, 0o755)
-
-        responses = []
-        for achall in self.achalls:
-            responses.append(self._set_up_challenge(achall))
-
-        return responses
-
-    def _set_up_challenge(self, achall):
-        response, validation = achall.response_and_validation()
-
-        name = os.path.join(self.challenge_dir, achall.chall.encode("token"))
-
-        self.configurator.reverter.register_file_creation(True, name)
-        with open(name, 'wb') as f:
-            f.write(validation.encode())
-        filesystem.chmod(name, 0o644)
-
-        return response
-
-    def _set_up_include_directives(self, vhost):
-        """Includes override configuration to the beginning and to the end of
-        VirtualHost. Note that this include isn't added to Augeas search tree"""
-
-        if vhost not in self.moded_vhosts:
-            logger.debug(
-                "Adding a temporary challenge validation Include for name: %s in: %s",
-                vhost.name, vhost.filep)
-            self.configurator.parser.add_dir_beginning(
-                vhost.path, "Include", self.challenge_conf_pre)
-            self.configurator.parser.add_dir(
-                vhost.path, "Include", self.challenge_conf_post)
-
-            if not vhost.enabled:
-                self.configurator.parser.add_dir(
-                    get_aug_path(self.configurator.parser.loc["default"]),
-                    "Include", vhost.filep)
-
-            self.moded_vhosts.add(vhost)

certbot-apache/certbot_apache/_internal/interfaces.py

@@ -1,516 +0,0 @@
-"""ParserNode interface for interacting with configuration tree.
-
-General description
--------------------
-
-The ParserNode interfaces are designed to be able to contain all the parsing logic,
-while allowing their users to interact with the configuration tree in a Pythonic
-and well structured manner.
-
-The structure allows easy traversal of the tree of ParserNodes. Each ParserNode
-stores a reference to its ancestor and immediate children, allowing the user to
-traverse the tree using built in interface methods as well as accessing the interface
-properties directly.
-
-ParserNode interface implementation should stand between the actual underlying
-parser functionality and the business logic within Configurator code, interfacing
-with both. The ParserNode tree is a result of configuration parsing action.
-
-ParserNode tree will be in charge of maintaining the parser state and hence the
-abstract syntax tree (AST). Interactions between ParserNode tree and underlying
-parser should involve only parsing the configuration files to this structure, and
-writing it back to the filesystem - while preserving the format including whitespaces.
-
-For some implementations (Apache for example) it's important to keep track of and
-to use state information while parsing conditional blocks and directives. This
-allows the implementation to set a flag to parts of the parsed configuration
-structure as not being in effect in a case of unmatched conditional block. It's
-important to store these blocks in the tree as well in order to not to conduct
-destructive actions (failing to write back parts of the configuration) while writing
-the AST back to the filesystem.
-
-The ParserNode tree is in charge of maintaining the its own structure while every
-child node fetched with find - methods or by iterating its list of children can be
-changed in place. When making changes the affected nodes should be flagged as "dirty"
-in order for the parser implementation to figure out the parts of the configuration
-that need to be written back to disk during the save() operation.
-
-
-Metadata
---------
-
-The metadata holds all the implementation specific attributes of the ParserNodes -
-things like the positional information related to the AST, file paths, whitespacing,
-and any other information relevant to the underlying parser engine.
-
-Access to the metadata should be handled by implementation specific methods, allowing
-the Configurator functionality to access the underlying information where needed.
-
-For some implementations the node can be initialized using the information carried
-in metadata alone. This is useful especially when populating the ParserNode tree
-while parsing the configuration.
-
-
-Apache implementation
----------------------
-
-The Apache implementation of ParserNode interface requires some implementation
-specific functionalities that are not described by the interface itself.
-
-Initialization
-
-When the user of a ParserNode class is creating these objects, they must specify
-the parameters as described in the documentation for the __init__ methods below.
-When these objects are created internally, however, some parameters may not be
-needed because (possibly more detailed) information is included in the metadata
-parameter. In this case, implementations can deviate from the required parameters
-from __init__, however, they should still behave the same when metadata is not
-provided.
-
-For consistency internally, if an argument is provided directly in the ParserNode
-initialization parameters as well as within metadata it's recommended to establish
-clear behavior around this scenario within the implementation.
-
-Conditional blocks
-
-Apache configuration can have conditional blocks, for example: <IfModule ...>,
-resulting the directives and subblocks within it being either enabled or disabled.
-While find_* interface methods allow including the disabled parts of the configuration
-tree in searches a special care needs to be taken while parsing the structure in
-order to reflect the active state of configuration.
-
-Whitespaces
-
-Each ParserNode object is responsible of storing its prepending whitespace characters
-in order to be able to write the AST back to filesystem like it was, preserving the
-format, this applies for parameters of BlockNode and DirectiveNode as well.
-When parameters of ParserNode are changed, the pre-existing whitespaces in the
-parameter sequence are discarded, as the general reason for storing them is to
-maintain the ability to write the configuration back to filesystem exactly like
-it was. This loses its meaning when we have to change the directives or blocks
-parameters for other reasons.
-
-Searches and matching
-
-Apache configuration is largely case insensitive, so the Apache implementation of
-ParserNode interface needs to provide the user means to match block and directive
-names and parameters in case insensitive manner. This does not apply to everything
-however, for example the parameters of a conditional statement may be case sensitive.
-For this reason the internal representation of data should not ignore the case.
-"""
-
-import abc
-import six
-
-from acme.magic_typing import Any, Dict, Optional, Tuple  # pylint: disable=unused-import, no-name-in-module
-
-
-@six.add_metaclass(abc.ABCMeta)
-class ParserNode(object):
-    """
-    ParserNode is the basic building block of the tree of such nodes,
-    representing the structure of the configuration. It is largely meant to keep
-    the structure information intact and idiomatically accessible.
-
-    The root node as well as the child nodes of it should be instances of ParserNode.
-    Nodes keep track of their differences to on-disk representation of configuration
-    by marking modified ParserNodes as dirty to enable partial write-to-disk for
-    different files in the configuration structure.
-
-    While for the most parts the usage and the child types are obvious, "include"-
-    and similar directives are an exception to this rule. This is because of the
-    nature of include directives - which unroll the contents of another file or
-    configuration block to their place. While we could unroll the included nodes
-    to the parent tree, it remains important to keep the context of include nodes
-    separate in order to write back the original configuration as it was.
-
-    For parsers that require the implementation to keep track of the whitespacing,
-    it's responsibility of each ParserNode object itself to store its prepending
-    whitespaces in order to be able to reconstruct the complete configuration file
-    as it was when originally read from the disk.
-
-    ParserNode objects should have the following attributes:
-
-    # Reference to ancestor node, or None if the node is the root node of the
-    # configuration tree.
-    ancestor: Optional[ParserNode]
-
-    # True if this node has been modified since last save.
-    dirty: bool
-
-    # Filepath of the file where the configuration element for this ParserNode
-    # object resides. For root node, the value for filepath is the httpd root
-    # configuration file. Filepath can be None if a configuration directive is
-    # defined in for example the httpd command line.
-    filepath: Optional[str]
-
-    # Metadata dictionary holds all the implementation specific key-value pairs
-    # for the ParserNode instance.
-    metadata: Dict[str, Any]
-    """
-
-    @abc.abstractmethod
-    def __init__(self, **kwargs):
-        """
-        Initializes the ParserNode instance, and sets the ParserNode specific
-        instance variables. This is not meant to be used directly, but through
-        specific classes implementing ParserNode interface.
-
-        :param ancestor: BlockNode ancestor for this CommentNode. Required.
-        :type ancestor: BlockNode or None
-
-        :param filepath: Filesystem path for the file where this CommentNode
-            does or should exist in the filesystem. Required.
-        :type filepath: str or None
-
-        :param dirty: Boolean flag for denoting if this CommentNode has been
-            created or changed after the last save. Default: False.
-        :type dirty: bool
-
-        :param metadata: Dictionary of metadata values for this ParserNode object.
-            Metadata information should be used only internally in the implementation.
-            Default: {}
-        :type metadata: dict
-        """
-
-    @abc.abstractmethod
-    def save(self, msg):
-        """
-        Save traverses the children, and attempts to write the AST to disk for
-        all the objects that are marked dirty. The actual operation of course
-        depends on the underlying implementation. save() shouldn't be called
-        from the Configurator outside of its designated save() method in order
-        to ensure that the Reverter checkpoints are created properly.
-
-        Note: this approach of keeping internal structure of the configuration
-        within the ParserNode tree does not represent the file inclusion structure
-        of actual configuration files that reside in the filesystem. To handle
-        file writes properly, the file specific temporary trees should be extracted
-        from the full ParserNode tree where necessary when writing to disk.
-
-        :param str msg: Message describing the reason for the save.
-
-        """
-
-    @abc.abstractmethod
-    def find_ancestors(self, name):
-        """
-        Traverses the ancestor tree up, searching for BlockNodes with a specific
-        name.
-
-        :param str name: Name of the ancestor BlockNode to search for
-
-        :returns: A list of ancestor BlockNodes that match the name
-        :rtype: list of BlockNode
-        """
-
-
-# Linter rule exclusion done because of https://github.com/PyCQA/pylint/issues/179
-@six.add_metaclass(abc.ABCMeta)  # pylint: disable=abstract-method
-class CommentNode(ParserNode):
-    """
-    CommentNode class is used for representation of comments within the parsed
-    configuration structure. Because of the nature of comments, it is not able
-    to have child nodes and hence it is always treated as a leaf node.
-
-    CommentNode stores its contents in class variable 'comment' and does not
-    have a specific name.
-
-    CommentNode objects should have the following attributes in addition to
-    the ones described in ParserNode:
-
-    # Contains the contents of the comment without the directive notation
-    # (typically # or /* ... */).
-    comment: str
-
-    """
-
-    @abc.abstractmethod
-    def __init__(self, **kwargs):
-        """
-        Initializes the CommentNode instance and sets its instance variables.
-
-        :param comment: Contents of the comment. Required.
-        :type comment: str
-
-        :param ancestor: BlockNode ancestor for this CommentNode. Required.
-        :type ancestor: BlockNode or None
-
-        :param filepath: Filesystem path for the file where this CommentNode
-            does or should exist in the filesystem. Required.
-        :type filepath: str or None
-
-        :param dirty: Boolean flag for denoting if this CommentNode has been
-            created or changed after the last save. Default: False.
-        :type dirty: bool
-        """
-        super(CommentNode, self).__init__(ancestor=kwargs['ancestor'],
-                                          dirty=kwargs.get('dirty', False),
-                                          filepath=kwargs['filepath'],
-                                          metadata=kwargs.get('metadata', {}))  # pragma: no cover
-
-
-@six.add_metaclass(abc.ABCMeta)
-class DirectiveNode(ParserNode):
-    """
-    DirectiveNode class represents a configuration directive within the configuration.
-    It can have zero or more parameters attached to it. Because of the nature of
-    single directives, it is not able to have child nodes and hence it is always
-    treated as a leaf node.
-
-    If a this directive was defined on the httpd command line, the ancestor instance
-    variable for this DirectiveNode should be None, and it should be inserted to the
-    beginning of root BlockNode children sequence.
-
-    DirectiveNode objects should have the following attributes in addition to
-    the ones described in ParserNode:
-
-    # True if this DirectiveNode is enabled and False if it is inside of an
-    # inactive conditional block.
-    enabled: bool
-
-    # Name, or key of the configuration directive. If BlockNode subclass of
-    # DirectiveNode is the root configuration node, the name should be None.
-    name: Optional[str]
-
-    # Tuple of parameters of this ParserNode object, excluding whitespaces.
-    parameters: Tuple[str, ...]
-
-    """
-
-    @abc.abstractmethod
-    def __init__(self, **kwargs):
-        """
-        Initializes the DirectiveNode instance and sets its instance variables.
-
-        :param name: Name or key of the DirectiveNode object. Required.
-        :type name: str or None
-
-        :param tuple parameters: Tuple of str parameters for this DirectiveNode.
-            Default: ().
-        :type parameters: tuple
-
-        :param ancestor: BlockNode ancestor for this DirectiveNode, or None for
-            root configuration node. Required.
-        :type ancestor: BlockNode or None
-
-        :param filepath: Filesystem path for the file where this DirectiveNode
-            does or should exist in the filesystem, or None for directives introduced
-            in the httpd command line. Required.
-        :type filepath: str or None
-
-        :param dirty: Boolean flag for denoting if this DirectiveNode has been
-            created or changed after the last save. Default: False.
-        :type dirty: bool
-
-        :param enabled: True if this DirectiveNode object is parsed in the active
-            configuration of the httpd. False if the DirectiveNode exists within a
-            unmatched conditional configuration block. Default: True.
-        :type enabled: bool
-
-        """
-        super(DirectiveNode, self).__init__(ancestor=kwargs['ancestor'],
-                                            dirty=kwargs.get('dirty', False),
-                                            filepath=kwargs['filepath'],
-                                            metadata=kwargs.get('metadata', {}))  # pragma: no cover
-
-    @abc.abstractmethod
-    def set_parameters(self, parameters):
-        """
-        Sets the sequence of parameters for this ParserNode object without
-        whitespaces. While the whitespaces for parameters are discarded when using
-        this method, the whitespacing preceeding the ParserNode itself should be
-        kept intact.
-
-        :param list parameters: sequence of parameters
-        """
-
-
-@six.add_metaclass(abc.ABCMeta)
-class BlockNode(DirectiveNode):
-    """
-    BlockNode class represents a block of nested configuration directives, comments
-    and other blocks as its children. A BlockNode can have zero or more parameters
-    attached to it.
-
-    Configuration blocks typically consist of one or more child nodes of all possible
-    types. Because of this, the BlockNode class has various discovery and structure
-    management methods.
-
-    Lists of parameters used as an optional argument for some of the methods should
-    be lists of strings that are applicable parameters for each specific BlockNode
-    or DirectiveNode type. As an example, for a following configuration example:
-
-        <VirtualHost *:80>
-           ...
-        </VirtualHost>
-
-    The node type would be BlockNode, name would be 'VirtualHost' and its parameters
-    would be: ['*:80'].
-
-    While for the following example:
-
-        LoadModule alias_module /usr/lib/apache2/modules/mod_alias.so
-
-    The node type would be DirectiveNode, name would be 'LoadModule' and its
-    parameters would be: ['alias_module', '/usr/lib/apache2/modules/mod_alias.so']
-
-    The applicable parameters are dependent on the underlying configuration language
-    and its grammar.
-
-    BlockNode objects should have the following attributes in addition to
-    the ones described in DirectiveNode:
-
-    # Tuple of direct children of this BlockNode object. The order of children
-    # in this tuple retain the order of elements in the parsed configuration
-    # block.
-    children: Tuple[ParserNode, ...]
-
-    """
-
-    @abc.abstractmethod
-    def add_child_block(self, name, parameters=None, position=None):
-        """
-        Adds a new BlockNode child node with provided values and marks the callee
-        BlockNode dirty. This is used to add new children to the AST. The preceeding
-        whitespaces should not be added based on the ancestor or siblings for the
-        newly created object. This is to match the current behavior of the legacy
-        parser implementation.
-
-        :param str name: The name of the child node to add
-        :param list parameters: list of parameters for the node
-        :param int position: Position in the list of children to add the new child
-            node to. Defaults to None, which appends the newly created node to the list.
-            If an integer is given, the child is inserted before that index in the
-            list similar to list().insert.
-
-        :returns: BlockNode instance of the created child block
-
-        """
-
-    @abc.abstractmethod
-    def add_child_directive(self, name, parameters=None, position=None):
-        """
-        Adds a new DirectiveNode child node with provided values and marks the
-        callee BlockNode dirty. This is used to add new children to the AST. The
-        preceeding whitespaces should not be added based on the ancestor or siblings
-        for the newly created object. This is to match the current behavior of the
-        legacy parser implementation.
-
-
-        :param str name: The name of the child node to add
-        :param list parameters: list of parameters for the node
-        :param int position: Position in the list of children to add the new child
-            node to. Defaults to None, which appends the newly created node to the list.
-            If an integer is given, the child is inserted before that index in the
-            list similar to list().insert.
-
-        :returns: DirectiveNode instance of the created child directive
-
-        """
-
-    @abc.abstractmethod
-    def add_child_comment(self, comment="", position=None):
-        """
-        Adds a new CommentNode child node with provided value and marks the
-        callee BlockNode dirty. This is used to add new children to the AST. The
-        preceeding whitespaces should not be added based on the ancestor or siblings
-        for the newly created object. This is to match the current behavior of the
-        legacy parser implementation.
-
-
-        :param str comment: Comment contents
-        :param int position: Position in the list of children to add the new child
-            node to. Defaults to None, which appends the newly created node to the list.
-            If an integer is given, the child is inserted before that index in the
-            list similar to list().insert.
-
-        :returns: CommentNode instance of the created child comment
-
-        """
-
-    @abc.abstractmethod
-    def find_blocks(self, name, exclude=True):
-        """
-        Find a configuration block by name. This method walks the child tree of
-        ParserNodes under the instance it was called from. This way it is possible
-        to search for the whole configuration tree, when starting from root node or
-        to do a partial search when starting from a specified branch. The lookup
-        should be case insensitive.
-
-        :param str name: The name of the directive to search for
-        :param bool exclude: If the search results should exclude the contents of
-            ParserNode objects that reside within conditional blocks and because
-            of current state are not enabled.
-
-        :returns: A list of found BlockNode objects.
-        """
-
-    @abc.abstractmethod
-    def find_directives(self, name, exclude=True):
-        """
-        Find a directive by name. This method walks the child tree of ParserNodes
-        under the instance it was called from. This way it is possible to search
-        for the whole configuration tree, when starting from root node, or to do
-        a partial search when starting from a specified branch. The lookup should
-        be case insensitive.
-
-        :param str name: The name of the directive to search for
-        :param bool exclude: If the search results should exclude the contents of
-            ParserNode objects that reside within conditional blocks and because
-            of current state are not enabled.
-
-        :returns: A list of found DirectiveNode objects.
-
-        """
-
-    @abc.abstractmethod
-    def find_comments(self, comment):
-        """
-        Find comments with value containing the search term.
-
-        This method walks the child tree of ParserNodes under the instance it was
-        called from. This way it is possible to search for the whole configuration
-        tree, when starting from root node, or to do a partial search when starting
-        from a specified branch. The lookup should be case sensitive.
-
-        :param str comment: The content of comment to search for
-
-        :returns: A list of found CommentNode objects.
-
-        """
-
-    @abc.abstractmethod
-    def delete_child(self, child):
-        """
-        Remove a specified child node from the list of children of the called
-        BlockNode object.
-
-        :param ParserNode child: Child ParserNode object to remove from the list
-            of children of the callee.
-        """
-
-    @abc.abstractmethod
-    def unsaved_files(self):
-        """
-        Returns a list of file paths that have been changed since the last save
-        (or the initial configuration parse). The intended use for this method
-        is to tell the Reverter which files need to be included in a checkpoint.
-
-        This is typically called for the root of the ParserNode tree.
-
-        :returns: list of file paths of files that have been changed but not yet
-            saved to disk.
-        """
-
-    @abc.abstractmethod
-    def parsed_paths(self):
-        """
-        Returns a list of file paths that have currently been parsed into the parser
-        tree. The returned list may include paths with wildcard characters, for
-        example: ['/etc/apache2/conf.d/*.load']
-
-        This is typically called on the root node of the ParserNode tree.
-
-        :returns: list of file paths of files that have been parsed
-        """

certbot-apache/certbot_apache/_internal/override_centos.py

@@ -1,215 +0,0 @@
-""" Distribution specific override class for CentOS family (RHEL, Fedora) """
-import logging
-
-import pkg_resources
-import zope.interface
-
-from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
-from certbot import errors
-from certbot import interfaces
-from certbot import util
-from certbot.compat import os
-from certbot.errors import MisconfigurationError
-from certbot_apache._internal import apache_util
-from certbot_apache._internal import configurator
-from certbot_apache._internal import parser
-
-logger = logging.getLogger(__name__)
-
-
-@zope.interface.provider(interfaces.IPluginFactory)
-class CentOSConfigurator(configurator.ApacheConfigurator):
-    """CentOS specific ApacheConfigurator override class"""
-
-    OS_DEFAULTS = dict(
-        server_root="/etc/httpd",
-        vhost_root="/etc/httpd/conf.d",
-        vhost_files="*.conf",
-        logs_root="/var/log/httpd",
-        ctl="apachectl",
-        version_cmd=['apachectl', '-v'],
-        restart_cmd=['apachectl', 'graceful'],
-        restart_cmd_alt=['apachectl', 'restart'],
-        conftest_cmd=['apachectl', 'configtest'],
-        enmod=None,
-        dismod=None,
-        le_vhost_ext="-le-ssl.conf",
-        handle_modules=False,
-        handle_sites=False,
-        challenge_location="/etc/httpd/conf.d",
-        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
-            "certbot_apache", os.path.join("_internal", "centos-options-ssl-apache.conf"))
-    )
-
-    def config_test(self):
-        """
-        Override config_test to mitigate configtest error in vanilla installation
-        of mod_ssl in Fedora. The error is caused by non-existent self-signed
-        certificates referenced by the configuration, that would be autogenerated
-        during the first (re)start of httpd.
-        """
-
-        os_info = util.get_os_info()
-        fedora = os_info[0].lower() == "fedora"
-
-        try:
-            super(CentOSConfigurator, self).config_test()
-        except errors.MisconfigurationError:
-            if fedora:
-                self._try_restart_fedora()
-            else:
-                raise
-
-    def _try_restart_fedora(self):
-        """
-        Tries to restart httpd using systemctl to generate the self signed keypair.
-        """
-
-        try:
-            util.run_script(['systemctl', 'restart', 'httpd'])
-        except errors.SubprocessError as err:
-            raise errors.MisconfigurationError(str(err))
-
-        # Finish with actual config check to see if systemctl restart helped
-        super(CentOSConfigurator, self).config_test()
-
-    def _prepare_options(self):
-        """
-        Override the options dictionary initialization in order to support
-        alternative restart cmd used in CentOS.
-        """
-        super(CentOSConfigurator, self)._prepare_options()
-        self.options["restart_cmd_alt"][0] = self.option("ctl")
-
-    def get_parser(self):
-        """Initializes the ApacheParser"""
-        return CentOSParser(
-            self.option("server_root"), self.option("vhost_root"),
-            self.version, configurator=self)
-
-    def _deploy_cert(self, *args, **kwargs):  # pylint: disable=arguments-differ
-        """
-        Override _deploy_cert in order to ensure that the Apache configuration
-        has "LoadModule ssl_module..." before parsing the VirtualHost configuration
-        that was created by Certbot
-        """
-        super(CentOSConfigurator, self)._deploy_cert(*args, **kwargs)
-        if self.version < (2, 4, 0):
-            self._deploy_loadmodule_ssl_if_needed()
-
-    def _deploy_loadmodule_ssl_if_needed(self):
-        """
-        Add "LoadModule ssl_module <pre-existing path>" to main httpd.conf if
-        it doesn't exist there already.
-        """
-
-        loadmods = self.parser.find_dir("LoadModule", "ssl_module", exclude=False)
-
-        correct_ifmods = []  # type: List[str]
-        loadmod_args = []  # type: List[str]
-        loadmod_paths = []  # type: List[str]
-        for m in loadmods:
-            noarg_path = m.rpartition("/")[0]
-            path_args = self.parser.get_all_args(noarg_path)
-            if loadmod_args:
-                if loadmod_args != path_args:
-                    msg = ("Certbot encountered multiple LoadModule directives "
-                           "for LoadModule ssl_module with differing library paths. "
-                           "Please remove or comment out the one(s) that are not in "
-                           "use, and run Certbot again.")
-                    raise MisconfigurationError(msg)
-            else:
-                loadmod_args = path_args
-
-            if self.parser.not_modssl_ifmodule(noarg_path):  # pylint: disable=no-member
-                if self.parser.loc["default"] in noarg_path:
-                    # LoadModule already in the main configuration file
-                    if ("ifmodule/" in noarg_path.lower() or
-                        "ifmodule[1]" in noarg_path.lower()):
-                        # It's the first or only IfModule in the file
-                        return
-                # Populate the list of known !mod_ssl.c IfModules
-                nodir_path = noarg_path.rpartition("/directive")[0]
-                correct_ifmods.append(nodir_path)
-            else:
-                loadmod_paths.append(noarg_path)
-
-        if not loadmod_args:
-            # Do not try to enable mod_ssl
-            return
-
-        # Force creation as the directive wasn't found from the beginning of
-        # httpd.conf
-        rootconf_ifmod = self.parser.create_ifmod(
-            parser.get_aug_path(self.parser.loc["default"]),
-            "!mod_ssl.c", beginning=True)
-        # parser.get_ifmod returns a path postfixed with "/", remove that
-        self.parser.add_dir(rootconf_ifmod[:-1], "LoadModule", loadmod_args)
-        correct_ifmods.append(rootconf_ifmod[:-1])
-        self.save_notes += "Added LoadModule ssl_module to main configuration.\n"
-
-        # Wrap LoadModule mod_ssl inside of <IfModule !mod_ssl.c> if it's not
-        # configured like this already.
-        for loadmod_path in loadmod_paths:
-            nodir_path = loadmod_path.split("/directive")[0]
-            # Remove the old LoadModule directive
-            self.parser.aug.remove(loadmod_path)
-
-            # Create a new IfModule !mod_ssl.c if not already found on path
-            ssl_ifmod = self.parser.get_ifmod(nodir_path, "!mod_ssl.c",
-                                            beginning=True)[:-1]
-            if ssl_ifmod not in correct_ifmods:
-                self.parser.add_dir(ssl_ifmod, "LoadModule", loadmod_args)
-                correct_ifmods.append(ssl_ifmod)
-                self.save_notes += ("Wrapped pre-existing LoadModule ssl_module "
-                                    "inside of <IfModule !mod_ssl> block.\n")
-
-
-class CentOSParser(parser.ApacheParser):
-    """CentOS specific ApacheParser override class"""
-    def __init__(self, *args, **kwargs):
-        # CentOS specific configuration file for Apache
-        self.sysconfig_filep = "/etc/sysconfig/httpd"
-        super(CentOSParser, self).__init__(*args, **kwargs)
-
-    def update_runtime_variables(self):
-        """ Override for update_runtime_variables for custom parsing """
-        # Opportunistic, works if SELinux not enforced
-        super(CentOSParser, self).update_runtime_variables()
-        self.parse_sysconfig_var()
-
-    def parse_sysconfig_var(self):
-        """ Parses Apache CLI options from CentOS configuration file """
-        defines = apache_util.parse_define_file(self.sysconfig_filep, "OPTIONS")
-        for k in defines:
-            self.variables[k] = defines[k]
-
-    def not_modssl_ifmodule(self, path):
-        """Checks if the provided Augeas path has argument !mod_ssl"""
-
-        if "ifmodule" not in path.lower():
-            return False
-
-        # Trim the path to the last ifmodule
-        workpath = path.lower()
-        while workpath:
-            # Get path to the last IfModule (ignore the tail)
-            parts = workpath.rpartition("ifmodule")
-
-            if not parts[0]:
-                # IfModule not found
-                break
-            ifmod_path = parts[0] + parts[1]
-            # Check if ifmodule had an index
-            if parts[2].startswith("["):
-                # Append the index from tail
-                ifmod_path += parts[2].partition("/")[0]
-            # Get the original path trimmed to correct length
-            # This is required to preserve cases
-            ifmod_real_path = path[0:len(ifmod_path)]
-            if "!mod_ssl.c" in self.get_all_args(ifmod_real_path):
-                return True
-            # Set the workpath to the heading part
-            workpath = parts[0]
-
-        return False

certbot-apache/certbot_apache/_internal/override_fedora.py

@@ -1,98 +0,0 @@
-""" Distribution specific override class for Fedora 29+ """
-import pkg_resources
-import zope.interface
-
-from certbot import errors
-from certbot import interfaces
-from certbot import util
-from certbot.compat import os
-from certbot_apache._internal import apache_util
-from certbot_apache._internal import configurator
-from certbot_apache._internal import parser
-
-
-@zope.interface.provider(interfaces.IPluginFactory)
-class FedoraConfigurator(configurator.ApacheConfigurator):
-    """Fedora 29+ specific ApacheConfigurator override class"""
-
-    OS_DEFAULTS = dict(
-        server_root="/etc/httpd",
-        vhost_root="/etc/httpd/conf.d",
-        vhost_files="*.conf",
-        logs_root="/var/log/httpd",
-        ctl="httpd",
-        version_cmd=['httpd', '-v'],
-        restart_cmd=['apachectl', 'graceful'],
-        restart_cmd_alt=['apachectl', 'restart'],
-        conftest_cmd=['apachectl', 'configtest'],
-        enmod=None,
-        dismod=None,
-        le_vhost_ext="-le-ssl.conf",
-        handle_modules=False,
-        handle_sites=False,
-        challenge_location="/etc/httpd/conf.d",
-        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
-            # TODO: eventually newest version of Fedora will need their own config
-            "certbot_apache", os.path.join("_internal", "centos-options-ssl-apache.conf"))
-    )
-
-    def config_test(self):
-        """
-        Override config_test to mitigate configtest error in vanilla installation
-        of mod_ssl in Fedora. The error is caused by non-existent self-signed
-        certificates referenced by the configuration, that would be autogenerated
-        during the first (re)start of httpd.
-        """
-        try:
-            super(FedoraConfigurator, self).config_test()
-        except errors.MisconfigurationError:
-            self._try_restart_fedora()
-
-    def get_parser(self):
-        """Initializes the ApacheParser"""
-        return FedoraParser(
-            self.option("server_root"), self.option("vhost_root"),
-            self.version, configurator=self)
-
-    def _try_restart_fedora(self):
-        """
-        Tries to restart httpd using systemctl to generate the self signed keypair.
-        """
-        try:
-            util.run_script(['systemctl', 'restart', 'httpd'])
-        except errors.SubprocessError as err:
-            raise errors.MisconfigurationError(str(err))
-
-        # Finish with actual config check to see if systemctl restart helped
-        super(FedoraConfigurator, self).config_test()
-
-    def _prepare_options(self):
-        """
-        Override the options dictionary initialization to keep using apachectl
-        instead of httpd and so take advantages of this new bash script in newer versions
-        of Fedora to restart httpd.
-        """
-        super(FedoraConfigurator, self)._prepare_options()
-        self.options["restart_cmd"][0] = 'apachectl'
-        self.options["restart_cmd_alt"][0] = 'apachectl'
-        self.options["conftest_cmd"][0] = 'apachectl'
-
-
-class FedoraParser(parser.ApacheParser):
-    """Fedora 29+ specific ApacheParser override class"""
-    def __init__(self, *args, **kwargs):
-        # Fedora 29+ specific configuration file for Apache
-        self.sysconfig_filep = "/etc/sysconfig/httpd"
-        super(FedoraParser, self).__init__(*args, **kwargs)
-
-    def update_runtime_variables(self):
-        """ Override for update_runtime_variables for custom parsing """
-        # Opportunistic, works if SELinux not enforced
-        super(FedoraParser, self).update_runtime_variables()
-        self._parse_sysconfig_var()
-
-    def _parse_sysconfig_var(self):
-        """ Parses Apache CLI options from Fedora configuration file """
-        defines = apache_util.parse_define_file(self.sysconfig_filep, "OPTIONS")
-        for k in defines:
-            self.variables[k] = defines[k]

certbot-apache/certbot_apache/_internal/parsernode_util.py

@@ -1,129 +0,0 @@
-"""ParserNode utils"""
-
-
-def validate_kwargs(kwargs, required_names):
-    """
-    Ensures that the kwargs dict has all the expected values. This function modifies
-    the kwargs dictionary, and hence the returned dictionary should be used instead
-    in the caller function instead of the original kwargs.
-
-    :param dict kwargs: Dictionary of keyword arguments to validate.
-    :param list required_names: List of required parameter names.
-    """
-
-    validated_kwargs = dict()
-    for name in required_names:
-        try:
-            validated_kwargs[name] = kwargs.pop(name)
-        except KeyError:
-            raise TypeError("Required keyword argument: {} undefined.".format(name))
-
-    # Raise exception if unknown key word arguments are found.
-    if kwargs:
-        unknown = ", ".join(kwargs.keys())
-        raise TypeError("Unknown keyword argument(s): {}".format(unknown))
-    return validated_kwargs
-
-
-def parsernode_kwargs(kwargs):
-    """
-    Validates keyword arguments for ParserNode. This function modifies the kwargs
-    dictionary, and hence the returned dictionary should be used instead in the
-    caller function instead of the original kwargs.
-
-    If metadata is provided, the otherwise required argument "filepath" may be
-    omitted if the implementation is able to extract its value from the metadata.
-    This usecase is handled within this function. Filepath defaults to None.
-
-    :param dict kwargs: Keyword argument dictionary to validate.
-
-    :returns: Tuple of validated and prepared arguments.
-    """
-
-    # As many values of ParserNode instances can be derived from the metadata,
-    # (ancestor being a common exception here) make sure we permit it here as well.
-    if "metadata" in kwargs:
-        # Filepath can be derived from the metadata in Augeas implementation.
-        # Default is None, as in this case the responsibility of populating this
-        # variable lies on the implementation.
-        kwargs.setdefault("filepath", None)
-
-    kwargs.setdefault("dirty", False)
-    kwargs.setdefault("metadata", {})
-
-    kwargs = validate_kwargs(kwargs, ["ancestor", "dirty", "filepath", "metadata"])
-    return kwargs["ancestor"], kwargs["dirty"], kwargs["filepath"], kwargs["metadata"]
-
-
-def commentnode_kwargs(kwargs):
-    """
-    Validates keyword arguments for CommentNode and sets the default values for
-    optional kwargs. This function modifies the kwargs dictionary, and hence the
-    returned dictionary should be used instead in the caller function instead of
-    the original kwargs.
-
-    If metadata is provided, the otherwise required argument "comment" may be
-    omitted if the implementation is able to extract its value from the metadata.
-    This usecase is handled within this function.
-
-    :param dict kwargs: Keyword argument dictionary to validate.
-
-    :returns: Tuple of validated and prepared arguments and ParserNode kwargs.
-    """
-
-    # As many values of ParserNode instances can be derived from the metadata,
-    # (ancestor being a common exception here) make sure we permit it here as well.
-    if "metadata" in kwargs:
-        kwargs.setdefault("comment", None)
-        # Filepath can be derived from the metadata in Augeas implementation.
-        # Default is None, as in this case the responsibility of populating this
-        # variable lies on the implementation.
-        kwargs.setdefault("filepath", None)
-
-    kwargs.setdefault("dirty", False)
-    kwargs.setdefault("metadata", {})
-
-    kwargs = validate_kwargs(kwargs, ["ancestor", "dirty", "filepath", "comment",
-                                      "metadata"])
-
-    comment = kwargs.pop("comment")
-    return comment, kwargs
-
-
-def directivenode_kwargs(kwargs):
-    """
-    Validates keyword arguments for DirectiveNode and BlockNode and sets the
-    default values for optional kwargs. This function modifies the kwargs
-    dictionary, and hence the returned dictionary should be used instead in the
-    caller function instead of the original kwargs.
-
-    If metadata is provided, the otherwise required argument "name" may be
-    omitted if the implementation is able to extract its value from the metadata.
-    This usecase is handled within this function.
-
-    :param dict kwargs: Keyword argument dictionary to validate.
-
-    :returns: Tuple of validated and prepared arguments and ParserNode kwargs.
-    """
-
-    # As many values of ParserNode instances can be derived from the metadata,
-    # (ancestor being a common exception here) make sure we permit it here as well.
-    if "metadata" in kwargs:
-        kwargs.setdefault("name", None)
-        # Filepath can be derived from the metadata in Augeas implementation.
-        # Default is None, as in this case the responsibility of populating this
-        # variable lies on the implementation.
-        kwargs.setdefault("filepath", None)
-
-    kwargs.setdefault("dirty", False)
-    kwargs.setdefault("enabled", True)
-    kwargs.setdefault("parameters", ())
-    kwargs.setdefault("metadata", {})
-
-    kwargs = validate_kwargs(kwargs, ["ancestor", "dirty", "filepath", "name",
-                                      "parameters", "enabled", "metadata"])
-
-    name = kwargs.pop("name")
-    parameters = kwargs.pop("parameters")
-    enabled = kwargs.pop("enabled")
-    return name, parameters, enabled, kwargs

certbot-apache/certbot_apache/apache_util.py

@@ -0,0 +1,100 @@
+""" Utility functions for certbot-apache plugin """
+import os
+
+from certbot import util
+
+def get_mod_deps(mod_name):
+    """Get known module dependencies.
+
+    .. note:: This does not need to be accurate in order for the client to
+        run.  This simply keeps things clean if the user decides to revert
+        changes.
+    .. warning:: If all deps are not included, it may cause incorrect parsing
+        behavior, due to enable_mod's shortcut for updating the parser's
+        currently defined modules (`.ApacheParser.add_mod`)
+        This would only present a major problem in extremely atypical
+        configs that use ifmod for the missing deps.
+
+    """
+    deps = {
+        "ssl": ["setenvif", "mime"]
+    }
+    return deps.get(mod_name, [])
+
+
+def get_file_path(vhost_path):
+    """Get file path from augeas_vhost_path.
+
+    Takes in Augeas path and returns the file name
+
+    :param str vhost_path: Augeas virtual host path
+
+    :returns: filename of vhost
+    :rtype: str
+
+    """
+    if not vhost_path or not vhost_path.startswith("/files/"):
+        return None
+
+    return _split_aug_path(vhost_path)[0]
+
+
+def get_internal_aug_path(vhost_path):
+    """Get the Augeas path for a vhost with the file path removed.
+
+    :param str vhost_path: Augeas virtual host path
+
+    :returns: Augeas path to vhost relative to the containing file
+    :rtype: str
+
+    """
+    return _split_aug_path(vhost_path)[1]
+
+
+def _split_aug_path(vhost_path):
+    """Splits an Augeas path into a file path and an internal path.
+
+    After removing "/files", this function splits vhost_path into the
+    file path and the remaining Augeas path.
+
+    :param str vhost_path: Augeas virtual host path
+
+    :returns: file path and internal Augeas path
+    :rtype: `tuple` of `str`
+
+    """
+    # Strip off /files
+    file_path = vhost_path[6:]
+    internal_path = []
+
+    # Remove components from the end of file_path until it becomes valid
+    while not os.path.exists(file_path):
+        file_path, _, internal_path_part = file_path.rpartition("/")
+        internal_path.append(internal_path_part)
+
+    return file_path, "/".join(reversed(internal_path))
+
+
+def parse_define_file(filepath, varname):
+    """ Parses Defines from a variable in configuration file
+
+    :param str filepath: Path of file to parse
+    :param str varname: Name of the variable
+
+    :returns: Dict of Define:Value pairs
+    :rtype: `dict`
+
+    """
+    return_vars = {}
+    # Get list of words in the variable
+    a_opts = util.get_var_from_file(varname, filepath).split()
+    for i, v in enumerate(a_opts):
+        # Handle Define statements and make sure it has an argument
+        if v == "-D" and len(a_opts) >= i+2:
+            var_parts = a_opts[i+1].partition("=")
+            return_vars[var_parts[0]] = var_parts[2]
+        elif len(v) > 2 and v.startswith("-D"):
+            # Found var with no whitespace separator
+            var_parts = v[2:].partition("=")
+            return_vars[var_parts[0]] = var_parts[2]
+    return return_vars

certbot-apache/certbot_apache/augeas_configurator.py

@@ -0,0 +1,207 @@
+"""Class of Augeas Configurators."""
+import logging
+
+
+from certbot import errors
+from certbot.plugins import common
+
+from certbot_apache import constants
+
+logger = logging.getLogger(__name__)
+
+
+class AugeasConfigurator(common.Installer):
+    """Base Augeas Configurator class.
+
+    :ivar config: Configuration.
+    :type config: :class:`~certbot.interfaces.IConfig`
+
+    :ivar aug: Augeas object
+    :type aug: :class:`augeas.Augeas`
+
+    :ivar str save_notes: Human-readable configuration change notes
+    :ivar reverter: saves and reverts checkpoints
+    :type reverter: :class:`certbot.reverter.Reverter`
+
+    """
+    def __init__(self, *args, **kwargs):
+        super(AugeasConfigurator, self).__init__(*args, **kwargs)
+
+        # Placeholder for augeas
+        self.aug = None
+
+        self.save_notes = ""
+
+
+    def init_augeas(self):
+        """ Initialize the actual Augeas instance """
+        import augeas
+        self.aug = augeas.Augeas(
+            # specify a directory to load our preferred lens from
+            loadpath=constants.AUGEAS_LENS_DIR,
+            # Do not save backup (we do it ourselves), do not load
+            # anything by default
+            flags=(augeas.Augeas.NONE |
+                   augeas.Augeas.NO_MODL_AUTOLOAD |
+                   augeas.Augeas.ENABLE_SPAN))
+        # See if any temporary changes need to be recovered
+        # This needs to occur before VirtualHost objects are setup...
+        # because this will change the underlying configuration and potential
+        # vhosts
+        self.recovery_routine()
+
+    def check_parsing_errors(self, lens):
+        """Verify Augeas can parse all of the lens files.
+
+        :param str lens: lens to check for errors
+
+        :raises .errors.PluginError: If there has been an error in parsing with
+            the specified lens.
+
+        """
+        error_files = self.aug.match("/augeas//error")
+
+        for path in error_files:
+            # Check to see if it was an error resulting from the use of
+            # the httpd lens
+            lens_path = self.aug.get(path + "/lens")
+            # As aug.get may return null
+            if lens_path and lens in lens_path:
+                msg = (
+                    "There has been an error in parsing the file {0} on line {1}: "
+                    "{2}".format(
+                    # Strip off /augeas/files and /error
+                    path[13:len(path) - 6],
+                    self.aug.get(path + "/line"),
+                    self.aug.get(path + "/message")))
+                raise errors.PluginError(msg)
+
+    def ensure_augeas_state(self):
+        """Makes sure that all Augeas dom changes are written to files to avoid
+        loss of configuration directives when doing additional augeas parsing,
+        causing a possible augeas.load() resulting dom reset
+        """
+
+        if self.unsaved_files():
+            self.save_notes += "(autosave)"
+            self.save()
+
+    def unsaved_files(self):
+        """Lists files that have modified Augeas DOM but the changes have not
+        been written to the filesystem yet, used by `self.save()` and
+        ApacheConfigurator to check the file state.
+
+        :raises .errors.PluginError: If there was an error in Augeas, in
+            an attempt to save the configuration, or an error creating a
+            checkpoint
+
+        :returns: `set` of unsaved files
+        """
+        save_state = self.aug.get("/augeas/save")
+        self.aug.set("/augeas/save", "noop")
+        # Existing Errors
+        ex_errs = self.aug.match("/augeas//error")
+        try:
+            # This is a noop save
+            self.aug.save()
+        except (RuntimeError, IOError):
+            self._log_save_errors(ex_errs)
+            # Erase Save Notes
+            self.save_notes = ""
+            raise errors.PluginError(
+                "Error saving files, check logs for more info.")
+
+        # Return the original save method
+        self.aug.set("/augeas/save", save_state)
+
+        # Retrieve list of modified files
+        # Note: Noop saves can cause the file to be listed twice, I used a
+        # set to remove this possibility. This is a known augeas 0.10 error.
+        save_paths = self.aug.match("/augeas/events/saved")
+
+        save_files = set()
+        if save_paths:
+            for path in save_paths:
+                save_files.add(self.aug.get(path)[6:])
+        return save_files
+
+    def save(self, title=None, temporary=False):
+        """Saves all changes to the configuration files.
+
+        This function first checks for save errors, if none are found,
+        all configuration changes made will be saved. According to the
+        function parameters. If an exception is raised, a new checkpoint
+        was not created.
+
+        :param str title: The title of the save. If a title is given, the
+            configuration will be saved as a new checkpoint and put in a
+            timestamped directory.
+
+        :param bool temporary: Indicates whether the changes made will
+            be quickly reversed in the future (ie. challenges)
+
+        """
+        save_files = self.unsaved_files()
+        if save_files:
+            self.add_to_checkpoint(save_files,
+                                   self.save_notes, temporary=temporary)
+
+        self.save_notes = ""
+        self.aug.save()
+
+        # Force reload if files were modified
+        # This is needed to recalculate augeas directive span
+        if save_files:
+            for sf in save_files:
+                self.aug.remove("/files/"+sf)
+            self.aug.load()
+        if title and not temporary:
+            self.finalize_checkpoint(title)
+
+    def _log_save_errors(self, ex_errs):
+        """Log errors due to bad Augeas save.
+
+        :param list ex_errs: Existing errors before save
+
+        """
+        # Check for the root of save problems
+        new_errs = self.aug.match("/augeas//error")
+        # logger.error("During Save - %s", mod_conf)
+        logger.error("Unable to save files: %s. Attempted Save Notes: %s",
+                     ", ".join(err[13:len(err) - 6] for err in new_errs
+                               # Only new errors caused by recent save
+                               if err not in ex_errs), self.save_notes)
+
+    # Wrapper functions for Reverter class
+    def recovery_routine(self):
+        """Revert all previously modified files.
+
+        Reverts all modified files that have not been saved as a checkpoint
+
+        :raises .errors.PluginError: If unable to recover the configuration
+
+        """
+        super(AugeasConfigurator, self).recovery_routine()
+        # Need to reload configuration after these changes take effect
+        self.aug.load()
+
+    def revert_challenge_config(self):
+        """Used to cleanup challenge configurations.
+
+        :raises .errors.PluginError: If unable to revert the challenge config.
+
+        """
+        self.revert_temporary_config()
+        self.aug.load()
+
+    def rollback_checkpoints(self, rollback=1):
+        """Rollback saved checkpoints.
+
+        :param int rollback: Number of checkpoints to revert
+
+        :raises .errors.PluginError: If there is a problem with the input or
+            the function is unable to correctly revert the configuration
+
+        """
+        super(AugeasConfigurator, self).rollback_checkpoints(rollback)
+        self.aug.load()

certbot-apache/certbot_apache/augeas_lens/httpd.aug

@@ -44,134 +44,67 @@ autoload xfm
  *****************************************************************)
 let dels (s:string)     = del s s
 
-(* The continuation sequence that indicates that we should consider the
- * next line part of the current line *)
-let cont = /\\\\\r?\n/
-
-(* Whitespace within a line: space, tab, and the continuation sequence *)
-let ws = /[ \t]/ | cont
-
-(* Any possible character - '.' does not match \n *)
-let any = /(.|\n)/
-
-(* Any character preceded by a backslash *)
-let esc_any = /\\\\(.|\n)/
-
-(* Newline sequence - both for Unix and DOS newlines *)
-let nl = /\r?\n/
-
-(* Whitespace at the end of a line *)
-let eol = del (ws* . nl) "\n"
-
 (* deal with continuation lines *)
-let sep_spc             = del ws+ " "
-let sep_osp             = del ws* ""
-let sep_eq              = del (ws* . "=" . ws*) "="
+let sep_spc             = del /([ \t]+|[ \t]*\\\\\r?\n[ \t]*)+/ " "
+let sep_osp             = del /([ \t]*|[ \t]*\\\\\r?\n[ \t]*)*/ ""
+let sep_eq              = del /[ \t]*=[ \t]*/ "="
 
 let nmtoken             = /[a-zA-Z:_][a-zA-Z0-9:_.-]*/
 let word                = /[a-z][a-z0-9._-]*/i
 
-(* A complete line that is either just whitespace or a comment that only
- * contains whitespace *)
-let empty = [ del (ws* . /#?/ . ws* . nl) "\n" ]
-
+let eol                 = Util.doseol
+let empty               = Util.empty_dos
 let indent              = Util.indent
 
-(* A comment that is not just whitespace. We define it in terms of the
- * things that are not allowed as part of such a comment:
- *   1) Starts with whitespace
- *   2) Ends with whitespace, a backslash or \r
- *   3) Unescaped newlines
- *)
-let comment =
-  let comment_start = del (ws* . "#" . ws* ) "# " in
-  let unesc_eol = /[^\]?/ . nl in
-  let w = /[^\t\n\r \\]/ in
-  let r = /[\r\\]/ in
-  let s = /[\t\r ]/ in
-  (*
-   * we'd like to write
-   * let b = /\\\\/ in
-   * let t = /[\t\n\r ]/ in
-   * let x = b . (t? . (s|w)* ) in
-   * but the definition of b depends on commit 244c0edd in 1.9.0 and
-   * would make the lens unusable with versions before 1.9.0. So we write
-   * x out which works in older versions, too
-   *)
-  let x = /\\\\[\t\n\r ]?[^\n\\]*/ in
-  let line = ((r . s* . w|w|r) . (s|w)* . x*|(r.s* )?).w.(s*.w)* in
-  [ label "#comment" . comment_start . store line . eol ]
+let comment_val_re      = /([^ \t\r\n](.|\\\\\r?\n)*[^ \\\t\r\n]|[^ \t\r\n])/
+let comment             = [ label "#comment" . del /[ \t]*#[ \t]*/ "# "
+                          . store comment_val_re . eol ]
 
 (* borrowed from shellvars.aug *)
+let char_arg_dir  = /([^\\ '"{\t\r\n]|[^ '"{\t\r\n]+[^\\ \t\r\n])|\\\\"|\\\\'|\\\\ /
 let char_arg_sec  = /([^\\ '"\t\r\n>]|[^ '"\t\r\n>]+[^\\ \t\r\n>])|\\\\"|\\\\'|\\\\ /
 let char_arg_wl   = /([^\\ '"},\t\r\n]|[^ '"},\t\r\n]+[^\\ '"},\t\r\n])/
 
+let cdot = /\\\\./
+let cl = /\\\\\n/
 let dquot =
      let no_dquot = /[^"\\\r\n]/
-  in /"/ . (no_dquot|esc_any)* . /"/
+  in /"/ . (no_dquot|cdot|cl)* . /"/
 let dquot_msg =
      let no_dquot = /([^ \t"\\\r\n]|[^"\\\r\n]+[^ \t"\\\r\n])/
-  in /"/ . (no_dquot|esc_any)* . no_dquot
-
+  in /"/ . (no_dquot|cdot|cl)*
 let squot =
      let no_squot = /[^'\\\r\n]/
-  in /'/ . (no_squot|esc_any)* . /'/
+  in /'/ . (no_squot|cdot|cl)* . /'/
 let comp = /[<>=]?=/
 
 (******************************************************************
  *                            Attributes
  *****************************************************************)
 
-(* The arguments for a directive come in two flavors: quoted with single or
- * double quotes, or bare. Bare arguments may not start with a single or
- * double quote; since we also treat "word lists" special, i.e. lists
- * enclosed in curly braces, bare arguments may not start with those,
- * either.
- *
- * Bare arguments may not contain unescaped spaces, but we allow escaping
- * with '\\'. Quoted arguments can contain anything, though the quote must
- * be escaped with '\\'.
- *)
-let bare = /([^{"' \t\n\r]|\\\\.)([^ \t\n\r]|\\\\.)*[^ \t\n\r\\]|[^{"' \t\n\r\\]/
-
-let arg_quoted = [ label "arg" . store (dquot|squot) ]
-let arg_bare = [ label "arg" . store bare ]
-
+let arg_dir = [ label "arg" . store (char_arg_dir+|dquot|squot) ]
 (* message argument starts with " but ends at EOL *)
 let arg_dir_msg = [ label "arg" . store dquot_msg ]
+let arg_sec = [ label "arg" . store (char_arg_sec+|comp|dquot|squot) ]
 let arg_wl  = [ label "arg" . store (char_arg_wl+|dquot|squot) ]
 
 (* comma-separated wordlist as permitted in the SSLRequire directive *)
 let arg_wordlist =
-     let wl_start = dels "{" in
-     let wl_end   = dels "}" in
+     let wl_start = Util.del_str "{" in
+     let wl_end   = Util.del_str "}" in
      let wl_sep   = del /[ \t]*,[ \t]*/ ", "
   in [ label "wordlist" . wl_start . arg_wl . (wl_sep . arg_wl)* . wl_end ]
 
 let argv (l:lens) = l . (sep_spc . l)*
 
-(* the arguments of a directive. We use this once we have parsed the name
- * of the directive, and the space right after it. When dir_args is used,
- * we also know that we have at least one argument. We need to be careful
- * with the spacing between arguments: quoted arguments and word lists do
- * not need to have space between them, but bare arguments do.
- *
- * Apache apparently is also happy if the last argument starts with a double
- * quote, but has no corresponding closing duoble quote, which is what
- * arg_dir_msg handles
- *)
-let dir_args =
-  let arg_nospc = arg_quoted|arg_wordlist in
-  (arg_bare . sep_spc | arg_nospc . sep_osp)* . (arg_bare|arg_nospc|arg_dir_msg)
-
 let directive =
-  [ indent . label "directive" . store word .  (sep_spc . dir_args)? . eol ]
-
-let arg_sec = [ label "arg" . store (char_arg_sec+|comp|dquot|squot) ]
+    (* arg_dir_msg may be the last or only argument *)
+     let dir_args = (argv (arg_dir|arg_wordlist) . (sep_spc . arg_dir_msg)?) | arg_dir_msg
+  in [ indent . label "directive" . store word .  (sep_spc . dir_args)? . eol ]
 
 let section (body:lens) =
     (* opt_eol includes empty lines *)
-    let opt_eol = del /([ \t]*#?[ \t]*\r?\n)*/ "\n" in
+    let opt_eol = del /([ \t]*#?\r?\n)*/ "\n" in
     let inner = (sep_spc . argv arg_sec)? . sep_osp .
              dels ">" . opt_eol . ((body|comment) . (body|empty|comment)*)? .
              indent . dels "</" in
@@ -200,7 +133,6 @@ let filter = (incl "/etc/apache2/apache2.conf") .
              (incl "/etc/httpd/conf.d/*.conf") .
              (incl "/etc/httpd/httpd.conf") .
              (incl "/etc/httpd/conf/httpd.conf") .
-             (incl "/etc/httpd/conf.modules.d/*.conf") .
              Util.stdexcl
 
 let xfm = transform lns filter

certbot-apache/certbot_apache/constants.py

@@ -1,7 +1,6 @@
 """Apache plugin constants."""
 import pkg_resources
 
-from certbot.compat import os
 
 MOD_SSL_CONF_DEST = "options-ssl-apache.conf"
 """Name of the mod_ssl config file as saved in `IConfig.config_dir`."""
@@ -10,7 +9,6 @@ MOD_SSL_CONF_DEST = "options-ssl-apache.conf"
 UPDATED_MOD_SSL_CONF_DIGEST = ".updated-options-ssl-apache-conf-digest.txt"
 """Name of the hash of the updated or informed mod_ssl_conf as saved in `IConfig.config_dir`."""
 
-# NEVER REMOVE A SINGLE HASH FROM THIS LIST UNLESS YOU KNOW EXACTLY WHAT YOU ARE DOING!
 ALL_SSL_OPTIONS_HASHES = [
     '2086bca02db48daf93468332543c60ac6acdb6f0b58c7bfdf578a5d47092f82a',
     '4844d36c9a0f587172d9fa10f4f1c9518e3bcfa1947379f155e16a70a728c21a',
@@ -20,15 +18,11 @@ ALL_SSL_OPTIONS_HASHES = [
     'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',
     '80720bd171ccdc2e6b917ded340defae66919e4624962396b992b7218a561791',
     'c0c022ea6b8a51ecc8f1003d0a04af6c3f2bc1c3ce506b3c2dfc1f11ef931082',
-    '717b0a89f5e4c39b09a42813ac6e747cfbdeb93439499e73f4f70a1fe1473f20',
-    '0fcdc81280cd179a07ec4d29d3595068b9326b455c488de4b09f585d5dafc137',
-    '86cc09ad5415cd6d5f09a947fe2501a9344328b1e8a8b458107ea903e80baa6c',
-    '06675349e457eae856120cdebb564efe546f0b87399f2264baeb41e442c724c7',
 ]
 """SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC"""
 
 AUGEAS_LENS_DIR = pkg_resources.resource_filename(
-    "certbot_apache", os.path.join("_internal", "augeas_lens"))
+    "certbot_apache", "augeas_lens")
 """Path to the Augeas lens directory"""
 
 REWRITE_HTTPS_ARGS = [
@@ -54,16 +48,3 @@ UIR_ARGS = ["always", "set", "Content-Security-Policy",
 
 HEADER_ARGS = {"Strict-Transport-Security": HSTS_ARGS,
                "Upgrade-Insecure-Requests": UIR_ARGS}
-
-AUTOHSTS_STEPS = [60, 300, 900, 3600, 21600, 43200, 86400]
-"""AutoHSTS increase steps: 1min, 5min, 15min, 1h, 6h, 12h, 24h"""
-
-AUTOHSTS_PERMANENT = 31536000
-"""Value for the last max-age of HSTS"""
-
-AUTOHSTS_FREQ = 172800
-"""Minimum time since last increase to perform a new one: 48h"""
-
-MANAGED_COMMENT = "DO NOT REMOVE - Managed by Certbot"
-MANAGED_COMMENT_ID = MANAGED_COMMENT+", VirtualHost id: {0}"
-"""Managed by Certbot comments and the VirtualHost identification template"""

certbot-apache/certbot_apache/display_ops.py

@@ -1,54 +1,22 @@
 """Contains UI methods for Apache operations."""
 import logging
+import os
 
 import zope.component
 
 from certbot import errors
 from certbot import interfaces
-from certbot.compat import os
+
 import certbot.display.util as display_util
 
+
 logger = logging.getLogger(__name__)
 
 
-def select_vhost_multiple(vhosts):
-    """Select multiple Vhosts to install the certificate for
-
-    :param vhosts: Available Apache VirtualHosts
-    :type vhosts: :class:`list` of type `~obj.Vhost`
-
-    :returns: List of VirtualHosts
-    :rtype: :class:`list`of type `~obj.Vhost`
-    """
-    if not vhosts:
-        return list()
-    tags_list = [vhost.display_repr()+"\n" for vhost in vhosts]
-    # Remove the extra newline from the last entry
-    if tags_list:
-        tags_list[-1] = tags_list[-1][:-1]
-    code, names = zope.component.getUtility(interfaces.IDisplay).checklist(
-        "Which VirtualHosts would you like to install the wildcard certificate for?",
-        tags=tags_list, force_interactive=True)
-    if code == display_util.OK:
-        return_vhosts = _reversemap_vhosts(names, vhosts)
-        return return_vhosts
-    return []
-
-def _reversemap_vhosts(names, vhosts):
-    """Helper function for select_vhost_multiple for mapping string
-    representations back to actual vhost objects"""
-    return_vhosts = list()
-
-    for selection in names:
-        for vhost in vhosts:
-            if vhost.display_repr().strip() == selection.strip():
-                return_vhosts.append(vhost)
-    return return_vhosts
-
 def select_vhost(domain, vhosts):
     """Select an appropriate Apache Vhost.
 
-    :param vhosts: Available Apache VirtualHosts
+    :param vhosts: Available Apache Virtual Hosts
     :type vhosts: :class:`list` of type `~obj.Vhost`
 
     :returns: VirtualHost or `None`
@@ -57,10 +25,13 @@ def select_vhost(domain, vhosts):
     """
     if not vhosts:
         return None
-    code, tag = _vhost_menu(domain, vhosts)
-    if code == display_util.OK:
-        return vhosts[tag]
-    return None
+    while True:
+        code, tag = _vhost_menu(domain, vhosts)
+        if code == display_util.OK:
+            return vhosts[tag]
+        else:
+            return None
+
 
 def _vhost_menu(domain, vhosts):
     """Select an appropriate Apache Vhost.
@@ -77,7 +48,7 @@ def _vhost_menu(domain, vhosts):
 
     if free_chars < 2:
         logger.debug("Display size is too small for "
-                     "certbot_apache._internal.display_ops._vhost_menu()")
+                     "certbot_apache.display_ops._vhost_menu()")
         # This runs the edge off the screen, but it doesn't cause an "error"
         filename_size = 1
         disp_name_size = 1
@@ -90,7 +61,7 @@ def _vhost_menu(domain, vhosts):
     for vhost in vhosts:
         if len(vhost.get_names()) == 1:
             disp_name = next(iter(vhost.get_names()))
-        elif not vhost.get_names():
+        elif len(vhost.get_names()) == 0:
             disp_name = ""
         else:
             disp_name = "Multiple Names"
@@ -110,7 +81,8 @@ def _vhost_menu(domain, vhosts):
         code, tag = zope.component.getUtility(interfaces.IDisplay).menu(
             "We were unable to find a vhost with a ServerName "
             "or Address of {0}.{1}Which virtual host would you "
-            "like to choose?".format(domain, os.linesep),
+            "like to choose?\n(note: conf files with multiple "
+            "vhosts are not yet supported)".format(domain, os.linesep),
             choices, force_interactive=True)
     except errors.MissingCommandlineFlag:
         msg = (