From 1b3c8e87c7b14646fbbf820df1a1c59e78660cc0 Mon Sep 17 00:00:00 2001
From: Peter Eckersley <pde@eff.org>
Date: Mon, 11 Jan 2016 13:57:46 -0800
Subject: [PATCH] Better processing & documentation of leauto flags

 - move them to the top for clarity
 - accept them in any position
 - shadow & document them in the Python client
---
 .../letsencrypt-auto.template                 | 35 +++++++++++--------
 letsencrypt/cli.py                            |  7 ++++
 2 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/letsencrypt-auto-source/letsencrypt-auto.template b/letsencrypt-auto-source/letsencrypt-auto.template
index 23e77de38..3d2180280 100755
--- a/letsencrypt-auto-source/letsencrypt-auto.template
+++ b/letsencrypt-auto-source/letsencrypt-auto.template
@@ -21,6 +21,24 @@ VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"}
 VENV_BIN=${VENV_PATH}/bin
 LE_AUTO_VERSION="{{ LE_AUTO_VERSION }}"
 
+# This script takes the same arguments as the main letsencrypt program, but it
+# additionally responds to --verbose (more output) and --debug (allow support
+# for experimental platforms)
+for arg in "$@" ; do
+  # This first clause is redundant with the third, but hedging on portability
+  if [ "$arg" = "-v" ] || [ "$arg" = "--verbose" ] || echo "$arg" | grep -E -- "-v+$" ; then
+    VERBOSE=1
+  elif [ "$arg" = "--no-self-upgrade" ] ; then
+    # Do not upgrade this script (also prevents client upgrades, because each
+    # copy of the script pins a hash of the python client)
+    NO_SELF_UPGRADE=1
+  elif [ "$arg" = "--os-packages-only" ] ; then
+    OS_PACKAGES_ONLY=1
+  elif [ "$arg" = "--debug" ]; then
+    DEBUG=1
+  fi
+done
+
 # letsencrypt-auto needs root access to bootstrap OS dependencies, and
 # letsencrypt itself needs root access for almost all modes of operation
 # The "normal" case is that sudo is used for the steps that need root, but
@@ -150,22 +168,11 @@ TempDir() {
   mktemp -d 2>/dev/null || mktemp -d -t 'le'  # Linux || OS X
 }
 
-# This script takes the same arguments as the main letsencrypt program, but it
-# additionally responds to --verbose (more output) and --debug (allow support
-# for experimental platforms)
-for arg in "$@" ; do
-  # This first clause is redundant with the third, but hedging on portability
-  if [ "$arg" = "-v" ] || [ "$arg" = "--verbose" ] || echo "$arg" | grep -E -- "-v+$" ; then
-    VERBOSE=1
-  elif [ "$arg" = "--debug" ]; then
-    DEBUG=1
-  fi
-done
 
-if [ "$1" = "--no-self-upgrade" ]; then
+
+if [ "$NO_SELF_UPGRADE" = 1 ]; then
   # Phase 2: Create venv, install LE, and run.
 
-  shift 1  # the --no-self-upgrade arg
   if [ -f "$VENV_BIN/letsencrypt" ]; then
     INSTALLED_VERSION=$("$VENV_BIN/letsencrypt" --version 2>&1 | cut -d " " -f 2)
   else
@@ -226,7 +233,7 @@ else
     # If it looks like we've never bootstrapped before, bootstrap:
     Bootstrap
   fi
-  if [ "$1" = "--os-packages-only" ]; then
+  if [ "$OS_PACKAGES_ONLY" = 1 ]; then
     echo "OS packages installed."
     exit 0
   fi
diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
index aba9116f9..1f9504c6e 100644
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -998,6 +998,13 @@ def prepare_and_parse_args(plugins, args):
         "automation", "--duplicate", dest="duplicate", action="store_true",
         help="Allow making a certificate lineage that duplicates an existing one "
              "(both can be renewed in parallel)")
+    helpful.add(
+        "automation", "--os-packages-only", action="store_true",
+        help="(letsencrypt-auto only) install OS package dependencies and then stop")
+    helpful.add(
+        "automation", "--no-self-upgrade", action="store_true",
+        help="(letsencrypt-auto only) prevent the letsencrypt-auto script from"
+             " upgrading itself to newer released versions")
 
     helpful.add_group(
         "testing", description="The following flags are meant for "