From bd7d85fd601eab333d83bd7264bc5bc2bef4c3e9 Mon Sep 17 00:00:00 2001
From: Maikel <maikel@experius.nl>
Date: Mon, 21 Mar 2016 13:52:56 +0100
Subject: [PATCH 01/20] Fix symlink webroot paths

When using symlinks for webroot folders and requesting SSL for same websites with symlink domains.
The challenges files and acme-challenge directory are removed on the first domain and on second domain the
acme-challenge directory is already removed and tries to remove it again.
---
 letsencrypt/plugins/webroot.py      |  3 +++
 letsencrypt/plugins/webroot_test.py | 15 ++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/letsencrypt/plugins/webroot.py b/letsencrypt/plugins/webroot.py
index 6d2899511..6254719ed 100644
--- a/letsencrypt/plugins/webroot.py
+++ b/letsencrypt/plugins/webroot.py
@@ -155,5 +155,8 @@ to serve all files under specified web root ({0})."""
                     elif exc.errno == errno.EACCES:
                         logger.debug("Challenges cleaned up but no permissions for %s",
                                      root_path)
+                    elif exc.errno == errno.ENOENT:
+                        logger.debug("Challenges cleaned up, %s does not exists",
+                                     root_path)
                     else:
                         raise
diff --git a/letsencrypt/plugins/webroot_test.py b/letsencrypt/plugins/webroot_test.py
index ed0326555..b39e3912a 100644
--- a/letsencrypt/plugins/webroot_test.py
+++ b/letsencrypt/plugins/webroot_test.py
@@ -176,12 +176,25 @@ class AuthenticatorTest(unittest.TestCase):
         self.auth.perform([self.achall])
 
         os_error = OSError()
-        os_error.errno = errno.ENOENT
+        os_error.errno = errno.EPERM
         mock_rmdir.side_effect = os_error
 
         self.assertRaises(OSError, self.auth.cleanup, [self.achall])
         self.assertFalse(os.path.exists(self.validation_path))
         self.assertTrue(os.path.exists(self.root_challenge_path))
 
+    @mock.patch('os.rmdir')
+    def test_cleanup_file_not_exists(self, mock_rmdir):
+        self.auth.prepare()
+        self.auth.perform([self.achall])
+
+        os_error = OSError()
+        os_error.errno = errno.ENOENT
+        mock_rmdir.side_effect = os_error
+
+        self.auth.cleanup([self.achall])
+        self.assertFalse(os.path.exists(self.validation_path))
+        self.assertTrue(os.path.exists(self.root_challenge_path))
+
 if __name__ == "__main__":
     unittest.main()  # pragma: no cover

From 8145b7c11b9f824831ef2f059eaafdb664307d90 Mon Sep 17 00:00:00 2001
From: Jakub Warmuz <jakub@warmuz.org>
Date: Sat, 9 Apr 2016 08:15:24 +0000
Subject: [PATCH 02/20] ACME: omitempty Error.detail, Error.type (fixes #2289)

---
 acme/acme/messages.py      | 4 ++--
 acme/acme/messages_test.py | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/acme/acme/messages.py b/acme/acme/messages.py
index 24a3b580c..40ddbdb2f 100644
--- a/acme/acme/messages.py
+++ b/acme/acme/messages.py
@@ -37,9 +37,9 @@ class Error(jose.JSONObjectWithFields, errors.Error):
         )
     )
 
-    typ = jose.Field('type')
+    typ = jose.Field('type', omitempty=True, default='about:blank')
     title = jose.Field('title', omitempty=True)
-    detail = jose.Field('detail')
+    detail = jose.Field('detail', omitempty=True)
 
     @property
     def description(self):
diff --git a/acme/acme/messages_test.py b/acme/acme/messages_test.py
index b2b7febdc..c1f027302 100644
--- a/acme/acme/messages_test.py
+++ b/acme/acme/messages_test.py
@@ -28,6 +28,14 @@ class ErrorTest(unittest.TestCase):
         self.error_custom = Error(typ='custom', detail='bar')
         self.jobj_cusom = {'type': 'custom', 'detail': 'bar'}
 
+    def test_default_typ(self):
+        from acme.messages import Error
+        self.assertEqual(Error().typ, 'about:blank')
+
+    def test_from_json_empty(self):
+        from acme.messages import Error
+        self.assertEqual(Error(), Error.from_json('{}'))
+
     def test_from_json_hashable(self):
         from acme.messages import Error
         hash(Error.from_json(self.error.to_json()))

From 0839168de7da3950e93056c2f80d029e7225e43f Mon Sep 17 00:00:00 2001
From: Jakub Warmuz <jakub@warmuz.org>
Date: Sun, 10 Apr 2016 07:50:39 +0000
Subject: [PATCH 03/20] Fake deserialization error in
 test_check_response_not_ok_jobj_no_error

---
 acme/acme/client_test.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/acme/acme/client_test.py b/acme/acme/client_test.py
index c8e95a423..7403cde81 100644
--- a/acme/acme/client_test.py
+++ b/acme/acme/client_test.py
@@ -484,9 +484,11 @@ class ClientNetworkTest(unittest.TestCase):
     def test_check_response_not_ok_jobj_no_error(self):
         self.response.ok = False
         self.response.json.return_value = {}
-        # pylint: disable=protected-access
-        self.assertRaises(
-            errors.ClientError, self.net._check_response, self.response)
+        with mock.patch('acme.client.messages.Error.from_json') as from_json:
+            from_json.side_effect = jose.DeserializationError
+            # pylint: disable=protected-access
+            self.assertRaises(
+                errors.ClientError, self.net._check_response, self.response)
 
     def test_check_response_not_ok_jobj_error(self):
         self.response.ok = False

From 45681909c7fba2e0b061f6e5abe471d252c45a08 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Wed, 20 Apr 2016 14:39:26 -0400
Subject: [PATCH 04/20] Selectively rename le-auto strings

---
 letsencrypt-auto-source/letsencrypt-auto      | 38 +++++++++----------
 .../letsencrypt-auto.template                 | 20 +++++-----
 letsencrypt-auto-source/pieces/fetch.py       |  2 +-
 .../pieces/letsencrypt-auto-requirements.txt  |  2 +-
 letsencrypt-auto-source/tests/auto_test.py    | 12 +++---
 5 files changed, 35 insertions(+), 39 deletions(-)

diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index 111f2b272..c137c4978 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Download and run the latest release version of the Let's Encrypt client.
+# Download and run the latest release version of the Certbot client.
 #
 # NOTE: THIS SCRIPT IS AUTO-GENERATED AND SELF-UPDATING
 #
@@ -21,7 +21,7 @@ VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"}
 VENV_BIN="$VENV_PATH/bin"
 LE_AUTO_VERSION="0.6.0.dev0"
 
-# This script takes the same arguments as the main letsencrypt program, but it
+# This script takes the same arguments as the main certbot program, but it
 # additionally responds to --verbose (more output) and --debug (allow support
 # for experimental platforms)
 for arg in "$@" ; do
@@ -45,8 +45,8 @@ for arg in "$@" ; do
   esac
 done
 
-# letsencrypt-auto needs root access to bootstrap OS dependencies, and
-# letsencrypt itself needs root access for almost all modes of operation
+# certbot-auto needs root access to bootstrap OS dependencies, and
+# certbot itself needs root access for almost all modes of operation
 # The "normal" case is that sudo is used for the steps that need root, but
 # this script *can* be run as root (not recommended), or fall back to using
 # `su`
@@ -186,7 +186,7 @@ BootstrapDebCommon() {
           AddBackportRepo precise-backports "deb http://archive.ubuntu.com/ubuntu precise-backports main restricted universe multiverse"
       else
           echo "No libaugeas0 version is available that's new enough to run the"
-          echo "Let's Encrypt apache plugin..."
+          echo "Certbot apache plugin..."
       fi
       # XXX add a case for ubuntu PPAs
   fi
@@ -426,7 +426,7 @@ Bootstrap() {
   elif grep -iq "Amazon Linux" /etc/issue ; then
     ExperimentalBootstrap "Amazon Linux" BootstrapRpmCommon
   else
-    echo "Sorry, I don't know how to bootstrap Let's Encrypt on your operating system!"
+    echo "Sorry, I don't know how to bootstrap Certbot on your operating system!"
     echo
     echo "You will need to bootstrap, configure virtualenv, and run pip install manually."
     echo "Please see https://letsencrypt.readthedocs.org/en/latest/contributing.html#prerequisites"
@@ -446,7 +446,8 @@ if [ "$1" = "--le-auto-phase2" ]; then
   shift 1  # the --le-auto-phase2 arg
   if [ -f "$VENV_BIN/letsencrypt" ]; then
     # --version output ran through grep due to python-cryptography DeprecationWarnings
-    INSTALLED_VERSION=$("$VENV_BIN/letsencrypt" --version 2>&1 | grep ^letsencrypt | cut -d " " -f 2)
+    # grep for both certbot and letsencrypt until certbot and shim packages have been released
+    INSTALLED_VERSION=$("$VENV_BIN/letsencrypt" --version 2>&1 | grep "^certbot\|^letsencrypt" | cut -d " " -f 2)
   else
     INSTALLED_VERSION="none"
   fi
@@ -465,8 +466,8 @@ if [ "$1" = "--le-auto-phase2" ]; then
     # There is no $ interpolation due to quotes on starting heredoc delimiter.
     # -------------------------------------------------------------------------
     cat << "UNLIKELY_EOF" > "$TEMP_DIR/letsencrypt-auto-requirements.txt"
-# This is the flattened list of packages letsencrypt-auto installs. To generate
-# this, do `pip install --no-cache-dir -e acme -e . -e letsencrypt-apache`, and
+# This is the flattened list of packages certbot-auto installs. To generate
+# this, do `pip install --no-cache-dir -e acme -e . -e certbot-apache`, and
 # then use `hashin` or a more secure method to gather the hashes.
 
 argparse==1.4.0 \
@@ -823,16 +824,16 @@ UNLIKELY_EOF
     fi
     echo "Installation succeeded."
   fi
-  echo "Requesting root privileges to run letsencrypt..."
+  echo "Requesting root privileges to run certbot..."
   echo "  " $SUDO "$VENV_BIN/letsencrypt" "$@"
   $SUDO "$VENV_BIN/letsencrypt" "$@"
 else
-  # Phase 1: Upgrade letsencrypt-auto if neceesary, then self-invoke.
+  # Phase 1: Upgrade certbot-auto if neceesary, then self-invoke.
   #
   # Each phase checks the version of only the thing it is responsible for
   # upgrading. Phase 1 checks the version of the latest release of
-  # letsencrypt-auto (which is always the same as that of the letsencrypt
-  # package). Phase 2 checks the version of the locally installed letsencrypt.
+  # certbot-auto (which is always the same as that of the certbot
+  # package). Phase 2 checks the version of the locally installed certbot.
 
   if [ ! -f "$VENV_BIN/letsencrypt" ]; then
     # If it looks like we've never bootstrapped before, bootstrap:
@@ -953,7 +954,7 @@ def verified_new_le_auto(get, tag, temp_dir):
                        stderr=dev_null)
     except CalledProcessError as exc:
         raise ExpectedError("Couldn't verify signature of downloaded "
-                            "letsencrypt-auto.", exc)
+                            "certbot-auto.", exc)
 
 
 def main():
@@ -980,27 +981,24 @@ UNLIKELY_EOF
     DeterminePythonVersion
     REMOTE_VERSION=`"$LE_PYTHON" "$TEMP_DIR/fetch.py" --latest-version`
     if [ "$LE_AUTO_VERSION" != "$REMOTE_VERSION" ]; then
-      echo "Upgrading letsencrypt-auto $LE_AUTO_VERSION to $REMOTE_VERSION..."
+      echo "Upgrading certbot-auto $LE_AUTO_VERSION to $REMOTE_VERSION..."
 
       # Now we drop into Python so we don't have to install even more
       # dependencies (curl, etc.), for better flow control, and for the option of
       # future Windows compatibility.
       "$LE_PYTHON" "$TEMP_DIR/fetch.py" --le-auto-script "v$REMOTE_VERSION"
 
-      # Install new copy of letsencrypt-auto.
+      # Install new copy of certbot-auto.
       # TODO: Deal with quotes in pathnames.
-      echo "Replacing letsencrypt-auto..."
+      echo "Replacing certbot-auto..."
       # Clone permissions with cp. chmod and chown don't have a --reference
       # option on OS X or BSD, and stat -c on Linux is stat -f on OS X and BSD:
-      echo "  " $SUDO cp -p "$0" "$TEMP_DIR/letsencrypt-auto.permission-clone"
       $SUDO cp -p "$0" "$TEMP_DIR/letsencrypt-auto.permission-clone"
-      echo "  " $SUDO cp "$TEMP_DIR/letsencrypt-auto" "$TEMP_DIR/letsencrypt-auto.permission-clone"
       $SUDO cp "$TEMP_DIR/letsencrypt-auto" "$TEMP_DIR/letsencrypt-auto.permission-clone"
       # Using mv rather than cp leaves the old file descriptor pointing to the
       # original copy so the shell can continue to read it unmolested. mv across
       # filesystems is non-atomic, doing `rm dest, cp src dest, rm src`, but the
       # cp is unlikely to fail (esp. under sudo) if the rm doesn't.
-      echo "  " $SUDO mv -f "$TEMP_DIR/letsencrypt-auto.permission-clone" "$0"
       $SUDO mv -f "$TEMP_DIR/letsencrypt-auto.permission-clone" "$0"
       # TODO: Clean up temp dir safely, even if it has quotes in its path.
       rm -rf "$TEMP_DIR"
diff --git a/letsencrypt-auto-source/letsencrypt-auto.template b/letsencrypt-auto-source/letsencrypt-auto.template
index 2c8e1ec4c..67f82febf 100755
--- a/letsencrypt-auto-source/letsencrypt-auto.template
+++ b/letsencrypt-auto-source/letsencrypt-auto.template
@@ -21,7 +21,7 @@ VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"}
 VENV_BIN="$VENV_PATH/bin"
 LE_AUTO_VERSION="{{ LE_AUTO_VERSION }}"
 
-# This script takes the same arguments as the main letsencrypt program, but it
+# This script takes the same arguments as the main certbot program, but it
 # additionally responds to --verbose (more output) and --debug (allow support
 # for experimental platforms)
 for arg in "$@" ; do
@@ -45,7 +45,7 @@ for arg in "$@" ; do
   esac
 done
 
-# letsencrypt-auto needs root access to bootstrap OS dependencies, and
+# certbot-auto needs root access to bootstrap OS dependencies, and
 # certbot itself needs root access for almost all modes of operation
 # The "normal" case is that sudo is used for the steps that need root, but
 # this script *can* be run as root (not recommended), or fall back to using
@@ -177,7 +177,8 @@ if [ "$1" = "--le-auto-phase2" ]; then
   shift 1  # the --le-auto-phase2 arg
   if [ -f "$VENV_BIN/letsencrypt" ]; then
     # --version output ran through grep due to python-cryptography DeprecationWarnings
-    INSTALLED_VERSION=$("$VENV_BIN/letsencrypt" --version 2>&1 | grep ^letsencrypt | cut -d " " -f 2)
+    # grep for both certbot and letsencrypt until certbot and shim packages have been released
+    INSTALLED_VERSION=$("$VENV_BIN/letsencrypt" --version 2>&1 | grep "^certbot\|^letsencrypt" | cut -d " " -f 2)
   else
     INSTALLED_VERSION="none"
   fi
@@ -223,11 +224,11 @@ UNLIKELY_EOF
   echo "  " $SUDO "$VENV_BIN/letsencrypt" "$@"
   $SUDO "$VENV_BIN/letsencrypt" "$@"
 else
-  # Phase 1: Upgrade letsencrypt-auto if neceesary, then self-invoke.
+  # Phase 1: Upgrade certbot-auto if neceesary, then self-invoke.
   #
   # Each phase checks the version of only the thing it is responsible for
   # upgrading. Phase 1 checks the version of the latest release of
-  # letsencrypt-auto (which is always the same as that of the certbot
+  # certbot-auto (which is always the same as that of the certbot
   # package). Phase 2 checks the version of the locally installed certbot.
 
   if [ ! -f "$VENV_BIN/letsencrypt" ]; then
@@ -250,27 +251,24 @@ UNLIKELY_EOF
     DeterminePythonVersion
     REMOTE_VERSION=`"$LE_PYTHON" "$TEMP_DIR/fetch.py" --latest-version`
     if [ "$LE_AUTO_VERSION" != "$REMOTE_VERSION" ]; then
-      echo "Upgrading letsencrypt-auto $LE_AUTO_VERSION to $REMOTE_VERSION..."
+      echo "Upgrading certbot-auto $LE_AUTO_VERSION to $REMOTE_VERSION..."
 
       # Now we drop into Python so we don't have to install even more
       # dependencies (curl, etc.), for better flow control, and for the option of
       # future Windows compatibility.
       "$LE_PYTHON" "$TEMP_DIR/fetch.py" --le-auto-script "v$REMOTE_VERSION"
 
-      # Install new copy of letsencrypt-auto.
+      # Install new copy of certbot-auto.
       # TODO: Deal with quotes in pathnames.
-      echo "Replacing letsencrypt-auto..."
+      echo "Replacing certbot-auto..."
       # Clone permissions with cp. chmod and chown don't have a --reference
       # option on OS X or BSD, and stat -c on Linux is stat -f on OS X and BSD:
-      echo "  " $SUDO cp -p "$0" "$TEMP_DIR/letsencrypt-auto.permission-clone"
       $SUDO cp -p "$0" "$TEMP_DIR/letsencrypt-auto.permission-clone"
-      echo "  " $SUDO cp "$TEMP_DIR/letsencrypt-auto" "$TEMP_DIR/letsencrypt-auto.permission-clone"
       $SUDO cp "$TEMP_DIR/letsencrypt-auto" "$TEMP_DIR/letsencrypt-auto.permission-clone"
       # Using mv rather than cp leaves the old file descriptor pointing to the
       # original copy so the shell can continue to read it unmolested. mv across
       # filesystems is non-atomic, doing `rm dest, cp src dest, rm src`, but the
       # cp is unlikely to fail (esp. under sudo) if the rm doesn't.
-      echo "  " $SUDO mv -f "$TEMP_DIR/letsencrypt-auto.permission-clone" "$0"
       $SUDO mv -f "$TEMP_DIR/letsencrypt-auto.permission-clone" "$0"
       # TODO: Clean up temp dir safely, even if it has quotes in its path.
       rm -rf "$TEMP_DIR"
diff --git a/letsencrypt-auto-source/pieces/fetch.py b/letsencrypt-auto-source/pieces/fetch.py
index 39ff7777c..38f4aa255 100644
--- a/letsencrypt-auto-source/pieces/fetch.py
+++ b/letsencrypt-auto-source/pieces/fetch.py
@@ -103,7 +103,7 @@ def verified_new_le_auto(get, tag, temp_dir):
                        stderr=dev_null)
     except CalledProcessError as exc:
         raise ExpectedError("Couldn't verify signature of downloaded "
-                            "letsencrypt-auto.", exc)
+                            "certbot-auto.", exc)
 
 
 def main():
diff --git a/letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt b/letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt
index 27cfb3d43..3a1ce34f1 100644
--- a/letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt
+++ b/letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt
@@ -1,4 +1,4 @@
-# This is the flattened list of packages letsencrypt-auto installs. To generate
+# This is the flattened list of packages certbot-auto installs. To generate
 # this, do `pip install --no-cache-dir -e acme -e . -e certbot-apache`, and
 # then use `hashin` or a more secure method to gather the hashes.
 
diff --git a/letsencrypt-auto-source/tests/auto_test.py b/letsencrypt-auto-source/tests/auto_test.py
index edb5f0c04..3b7e8731b 100644
--- a/letsencrypt-auto-source/tests/auto_test.py
+++ b/letsencrypt-auto-source/tests/auto_test.py
@@ -231,7 +231,7 @@ class AutoTests(TestCase):
     * The OpenSSL sig mismatches.
 
     For tests which get to the end, we run merely ``letsencrypt --version``.
-    The functioning of the rest of the letsencrypt script is covered by other
+    The functioning of the rest of the certbot script is covered by other
     test suites.
 
     """
@@ -277,7 +277,7 @@ class AutoTests(TestCase):
                 ok_(re.match(r'letsencrypt \d+\.\d+\.\d+',
                              err.strip().splitlines()[-1]))
                 # Make a few assertions to test the validity of the next tests:
-                self.assertIn('Upgrading letsencrypt-auto ', out)
+                self.assertIn('Upgrading certbot-auto ', out)
                 self.assertIn('Creating virtual environment...', out)
 
                 # Now we have le-auto 99.9.9  and LE 99.9.9 installed. This
@@ -286,14 +286,14 @@ class AutoTests(TestCase):
                 # Test when neither phase-1 upgrade nor phase-2 upgrade is
                 # needed (probably a common case):
                 out, err = run_letsencrypt_auto()
-                self.assertNotIn('Upgrading letsencrypt-auto ', out)
+                self.assertNotIn('Upgrading certbot-auto ', out)
                 self.assertNotIn('Creating virtual environment...', out)
 
                 # Test when a phase-1 upgrade is not needed but a phase-2
                 # upgrade is:
                 set_le_script_version(venv_dir, '0.0.1')
                 out, err = run_letsencrypt_auto()
-                self.assertNotIn('Upgrading letsencrypt-auto ', out)
+                self.assertNotIn('Upgrading certbot-auto ', out)
                 self.assertIn('Creating virtual environment...', out)
 
     def test_openssl_failure(self):
@@ -312,10 +312,10 @@ class AutoTests(TestCase):
                 except CalledProcessError as exc:
                     eq_(exc.returncode, 1)
                     self.assertIn("Couldn't verify signature of downloaded "
-                                  "letsencrypt-auto.",
+                                  "certbot-auto.",
                                   exc.output)
                 else:
-                    self.fail('Signature check on letsencrypt-auto erroneously passed.')
+                    self.fail('Signature check on certbot-auto erroneously passed.')
 
     def test_pip_failure(self):
         """Make sure pip stops us if there is a hash mismatch."""

From 530033a37dec26e40ba526d58694f61fd52c6066 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Thu, 21 Apr 2016 15:16:39 -0400
Subject: [PATCH 05/20] Add CLI parsing

---
 letsencrypt-auto-source/letsencrypt-auto          | 10 ++++++++++
 letsencrypt-auto-source/letsencrypt-auto.template | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index c137c4978..1b88f1cc1 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -34,6 +34,10 @@ for arg in "$@" ; do
       # Do not upgrade this script (also prevents client upgrades, because each
       # copy of the script pins a hash of the python client)
       NO_SELF_UPGRADE=1;;
+    --help)
+      HELP=1;;
+    --yes)
+      ASSUME_YES=1;;
     --verbose)
       VERBOSE=1;;
     [!-]*|-*[!v]*|-)
@@ -81,6 +85,12 @@ else
   SUDO=
 fi
 
+if [ $(basename $0) = "letsencrypt-auto" ]; then
+  # letsencrypt-auto does not respect --help or --yes for backwards compatibility
+  ASSUME_YES=1
+  HELP=0
+fi
+
 ExperimentalBootstrap() {
   # Arguments: Platform name, bootstrap function name
   if [ "$DEBUG" = 1 ]; then
diff --git a/letsencrypt-auto-source/letsencrypt-auto.template b/letsencrypt-auto-source/letsencrypt-auto.template
index 67f82febf..f274418f3 100755
--- a/letsencrypt-auto-source/letsencrypt-auto.template
+++ b/letsencrypt-auto-source/letsencrypt-auto.template
@@ -34,6 +34,10 @@ for arg in "$@" ; do
       # Do not upgrade this script (also prevents client upgrades, because each
       # copy of the script pins a hash of the python client)
       NO_SELF_UPGRADE=1;;
+    --help)
+      HELP=1;;
+    --yes)
+      ASSUME_YES=1;;
     --verbose)
       VERBOSE=1;;
     [!-]*|-*[!v]*|-)
@@ -81,6 +85,12 @@ else
   SUDO=
 fi
 
+if [ $(basename $0) = "letsencrypt-auto" ]; then
+  # letsencrypt-auto does not respect --help or --yes for backwards compatibility
+  ASSUME_YES=1
+  HELP=0
+fi
+
 ExperimentalBootstrap() {
   # Arguments: Platform name, bootstrap function name
   if [ "$DEBUG" = 1 ]; then

From 0fa18b608150472801ccddaead63f5b3e6a96f12 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Thu, 21 Apr 2016 15:55:28 -0400
Subject: [PATCH 06/20] Add help text

---
 letsencrypt-auto-source/letsencrypt-auto      | 22 +++++++++++++++----
 .../letsencrypt-auto.template                 | 22 +++++++++++++++----
 2 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index 1b88f1cc1..df4783a72 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -20,10 +20,24 @@ VENV_NAME="letsencrypt"
 VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"}
 VENV_BIN="$VENV_PATH/bin"
 LE_AUTO_VERSION="0.6.0.dev0"
+BASENAME=$(basename $0)
+USAGE="Usage: $BASENAME [OPTION]
+A self-updating wrapper script for the Certbot ACME client. When run, updates
+to both this script and certbot will be downloaded and installed. After
+ensuring you have the latest versions installed, certbot will be invoked with
+all arguments you provided.
+
+Help for certbot itself cannot be provided until it is installed.
+
+  --debug               attempt installation on experimental platforms
+  --help                print this help
+  --no-self-upgrade     do not download updates for certbot or certbot-auto
+  --os-packages-only    install OS dependencies and exit
+  -v, --verbose         provide more output
+  --yes                 assume yes is the answer to all prompts
+
+All arguments are accepted and forwarded to the Certbot client when run."
 
-# This script takes the same arguments as the main certbot program, but it
-# additionally responds to --verbose (more output) and --debug (allow support
-# for experimental platforms)
 for arg in "$@" ; do
   case "$arg" in
     --debug)
@@ -85,7 +99,7 @@ else
   SUDO=
 fi
 
-if [ $(basename $0) = "letsencrypt-auto" ]; then
+if [ $BASENAME = "letsencrypt-auto" ]; then
   # letsencrypt-auto does not respect --help or --yes for backwards compatibility
   ASSUME_YES=1
   HELP=0
diff --git a/letsencrypt-auto-source/letsencrypt-auto.template b/letsencrypt-auto-source/letsencrypt-auto.template
index f274418f3..a17d11fa4 100755
--- a/letsencrypt-auto-source/letsencrypt-auto.template
+++ b/letsencrypt-auto-source/letsencrypt-auto.template
@@ -20,10 +20,24 @@ VENV_NAME="letsencrypt"
 VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"}
 VENV_BIN="$VENV_PATH/bin"
 LE_AUTO_VERSION="{{ LE_AUTO_VERSION }}"
+BASENAME=$(basename $0)
+USAGE="Usage: $BASENAME [OPTION]
+A self-updating wrapper script for the Certbot ACME client. When run, updates
+to both this script and certbot will be downloaded and installed. After
+ensuring you have the latest versions installed, certbot will be invoked with
+all arguments you provided.
+
+Help for certbot itself cannot be provided until it is installed.
+
+  --debug               attempt installation on experimental platforms
+  --help                print this help
+  --no-self-upgrade     do not download updates for certbot or certbot-auto
+  --os-packages-only    install OS dependencies and exit
+  -v, --verbose         provide more output
+  --yes                 assume yes is the answer to all prompts
+
+All arguments are accepted and forwarded to the Certbot client when run."
 
-# This script takes the same arguments as the main certbot program, but it
-# additionally responds to --verbose (more output) and --debug (allow support
-# for experimental platforms)
 for arg in "$@" ; do
   case "$arg" in
     --debug)
@@ -85,7 +99,7 @@ else
   SUDO=
 fi
 
-if [ $(basename $0) = "letsencrypt-auto" ]; then
+if [ $BASENAME = "letsencrypt-auto" ]; then
   # letsencrypt-auto does not respect --help or --yes for backwards compatibility
   ASSUME_YES=1
   HELP=0

From c66f0bd18e9d65a48935eaf9d0c9ef630aa0f218 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Thu, 21 Apr 2016 16:13:17 -0400
Subject: [PATCH 07/20] Make le-auto helpful

---
 letsencrypt-auto-source/letsencrypt-auto          | 8 ++++++--
 letsencrypt-auto-source/letsencrypt-auto.template | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index df4783a72..9be546584 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -21,11 +21,11 @@ VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"}
 VENV_BIN="$VENV_PATH/bin"
 LE_AUTO_VERSION="0.6.0.dev0"
 BASENAME=$(basename $0)
-USAGE="Usage: $BASENAME [OPTION]
+USAGE="Usage: $BASENAME [OPTIONS]
 A self-updating wrapper script for the Certbot ACME client. When run, updates
 to both this script and certbot will be downloaded and installed. After
 ensuring you have the latest versions installed, certbot will be invoked with
-all arguments you provided.
+all arguments you have provided.
 
 Help for certbot itself cannot be provided until it is installed.
 
@@ -860,6 +860,10 @@ else
   # package). Phase 2 checks the version of the locally installed certbot.
 
   if [ ! -f "$VENV_BIN/letsencrypt" ]; then
+    if [ "$HELP" = 1 ]; then
+      echo "$USAGE"
+      exit 0
+    fi
     # If it looks like we've never bootstrapped before, bootstrap:
     Bootstrap
   fi
diff --git a/letsencrypt-auto-source/letsencrypt-auto.template b/letsencrypt-auto-source/letsencrypt-auto.template
index a17d11fa4..fe4baeafd 100755
--- a/letsencrypt-auto-source/letsencrypt-auto.template
+++ b/letsencrypt-auto-source/letsencrypt-auto.template
@@ -21,11 +21,11 @@ VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"}
 VENV_BIN="$VENV_PATH/bin"
 LE_AUTO_VERSION="{{ LE_AUTO_VERSION }}"
 BASENAME=$(basename $0)
-USAGE="Usage: $BASENAME [OPTION]
+USAGE="Usage: $BASENAME [OPTIONS]
 A self-updating wrapper script for the Certbot ACME client. When run, updates
 to both this script and certbot will be downloaded and installed. After
 ensuring you have the latest versions installed, certbot will be invoked with
-all arguments you provided.
+all arguments you have provided.
 
 Help for certbot itself cannot be provided until it is installed.
 
@@ -256,6 +256,10 @@ else
   # package). Phase 2 checks the version of the locally installed certbot.
 
   if [ ! -f "$VENV_BIN/letsencrypt" ]; then
+    if [ "$HELP" = 1 ]; then
+      echo "$USAGE"
+      exit 0
+    fi
     # If it looks like we've never bootstrapped before, bootstrap:
     Bootstrap
   fi

From 61203db2ebd17a27cb0f3316812bb5d72683c546 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Fri, 22 Apr 2016 13:01:32 -0400
Subject: [PATCH 08/20] Add --yes support to arch and debian bootstrappers

---
 letsencrypt-auto-source/letsencrypt-auto           | 14 +++++++++++---
 .../pieces/bootstrappers/arch_common.sh            |  6 +++++-
 .../pieces/bootstrappers/deb_common.sh             |  8 ++++++--
 3 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index 9be546584..d96836e64 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -175,6 +175,10 @@ BootstrapDebCommon() {
   augeas_pkg="libaugeas0 augeas-lenses"
   AUGVERSION=`apt-cache show --no-all-versions libaugeas0 | grep ^Version: | cut -d" " -f2`
 
+  if [ "$ASSUME_YES" = 1 ]; then
+    YES_FLAG="-y"
+  fi
+
   AddBackportRepo() {
       # ARGS:
       BACKPORT_NAME="$1"
@@ -196,7 +200,7 @@ BootstrapDebCommon() {
               $SUDO apt-get update
           fi
       fi
-      $SUDO apt-get install -y --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
+      $SUDO apt-get install $YES_FLAG --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
       augeas_pkg=
 
   }
@@ -215,7 +219,7 @@ BootstrapDebCommon() {
       # XXX add a case for ubuntu PPAs
   fi
 
-  $SUDO apt-get install -y --no-install-recommends \
+  $SUDO apt-get install $YES_FLAG --no-install-recommends \
     python \
     python-dev \
     $virtualenv \
@@ -334,8 +338,12 @@ BootstrapArchCommon() {
   # pacman -T exits with 127 if there are missing dependencies
   missing=$($SUDO pacman -T $deps) || true
 
+  if [ "$ASSUME_YES" = 1 ]; then
+    noconfirm="--noconfirm"
+  fi
+
   if [ "$missing" ]; then
-    $SUDO pacman -S --needed $missing
+    $SUDO pacman -S --needed $missing $noconfirm
   fi
 }
 
diff --git a/letsencrypt-auto-source/pieces/bootstrappers/arch_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/arch_common.sh
index b2fc01a14..39e2da5fe 100755
--- a/letsencrypt-auto-source/pieces/bootstrappers/arch_common.sh
+++ b/letsencrypt-auto-source/pieces/bootstrappers/arch_common.sh
@@ -21,7 +21,11 @@ BootstrapArchCommon() {
   # pacman -T exits with 127 if there are missing dependencies
   missing=$($SUDO pacman -T $deps) || true
 
+  if [ "$ASSUME_YES" = 1 ]; then
+    noconfirm="--noconfirm"
+  fi
+
   if [ "$missing" ]; then
-    $SUDO pacman -S --needed $missing
+    $SUDO pacman -S --needed $missing $noconfirm
   fi
 }
diff --git a/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
index 57ed11399..b2b76fd55 100644
--- a/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
+++ b/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
@@ -34,6 +34,10 @@ BootstrapDebCommon() {
   augeas_pkg="libaugeas0 augeas-lenses"
   AUGVERSION=`apt-cache show --no-all-versions libaugeas0 | grep ^Version: | cut -d" " -f2`
 
+  if [ "$ASSUME_YES" = 1 ]; then
+    YES_FLAG="-y"
+  fi
+
   AddBackportRepo() {
       # ARGS:
       BACKPORT_NAME="$1"
@@ -55,7 +59,7 @@ BootstrapDebCommon() {
               $SUDO apt-get update
           fi
       fi
-      $SUDO apt-get install -y --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
+      $SUDO apt-get install $YES_FLAG --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
       augeas_pkg=
 
   }
@@ -74,7 +78,7 @@ BootstrapDebCommon() {
       # XXX add a case for ubuntu PPAs
   fi
 
-  $SUDO apt-get install -y --no-install-recommends \
+  $SUDO apt-get install $YES_FLAG --no-install-recommends \
     python \
     python-dev \
     $virtualenv \

From 40aa4dbf91349f5ca7a191d5f00f55b49f6e92af Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Fri, 22 Apr 2016 14:51:40 -0400
Subject: [PATCH 09/20] add --yes support to red hat bootstrap script

---
 letsencrypt-auto-source/letsencrypt-auto      | 78 ++++++++++---------
 .../pieces/bootstrappers/rpm_common.sh        | 78 ++++++++++---------
 2 files changed, 82 insertions(+), 74 deletions(-)

diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index d96836e64..9e1dfef42 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -240,9 +240,10 @@ BootstrapDebCommon() {
 
 BootstrapRpmCommon() {
   # Tested with:
-  #   - Fedora 22, 23 (x64)
+  #   - Fedora 20, 21, 22, 23 (x64)
   #   - Centos 7 (x64: on DigitalOcean droplet)
   #   - CentOS 7 Minimal install in a Hyper-V VM
+  #   - CentOS 6 (EPEL must be installed manually)
 
   if type dnf 2>/dev/null
   then
@@ -256,47 +257,50 @@ BootstrapRpmCommon() {
     exit 1
   fi
 
+  pkgs="
+    gcc
+    dialog
+    augeas-libs
+    openssl
+    openssl-devel
+    libffi-devel
+    redhat-rpm-config
+    ca-certificates
+  "
+
   # Some distros and older versions of current distros use a "python27"
   # instead of "python" naming convention. Try both conventions.
-  if ! $SUDO $tool install -y \
-         python \
-         python-devel \
-         python-virtualenv \
-         python-tools \
-         python-pip
-  then
-    if ! $SUDO $tool install -y \
-           python27 \
-           python27-devel \
-           python27-virtualenv \
-           python27-tools \
-           python27-pip
-    then
-      echo "Could not install Python dependencies. Aborting bootstrap!"
-      exit 1
-    fi
+  if $SUDO $tool list python >/dev/null 2>&1; then
+    pkgs="$pkgs
+      python
+      python-devel
+      python-virtualenv
+      python-tools
+      python-pip
+    "
+  else
+    pkgs="$pkgs
+      python27
+      python27-devel
+      python27-virtualenv
+      python27-tools
+      python27-pip
+    "
   fi
 
-  if ! $SUDO $tool install -y \
-         gcc \
-         dialog \
-         augeas-libs \
-         openssl \
-         openssl-devel \
-         libffi-devel \
-         redhat-rpm-config \
-         ca-certificates
-  then
-      echo "Could not install additional dependencies. Aborting bootstrap!"
-      exit 1
-  fi
-
-
   if $SUDO $tool list installed "httpd" >/dev/null 2>&1; then
-    if ! $SUDO $tool install -y mod_ssl
-    then
-      echo "Apache found, but mod_ssl could not be installed."
-    fi
+    pkgs="$pkgs
+      mod_ssl
+    "
+  fi
+
+  if [ "$ASSUME_YES" = 1 ]; then
+    yes_flag="-y"
+  fi
+
+  if ! $SUDO $tool install $yes_flag $pkgs; then
+      echo "Could not install OS dependencies. Aborting bootstrap!"
+      exit 1
   fi
 }
 
diff --git a/letsencrypt-auto-source/pieces/bootstrappers/rpm_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/rpm_common.sh
index 68a11a531..0f98b4bbc 100755
--- a/letsencrypt-auto-source/pieces/bootstrappers/rpm_common.sh
+++ b/letsencrypt-auto-source/pieces/bootstrappers/rpm_common.sh
@@ -1,8 +1,9 @@
 BootstrapRpmCommon() {
   # Tested with:
-  #   - Fedora 22, 23 (x64)
+  #   - Fedora 20, 21, 22, 23 (x64)
   #   - Centos 7 (x64: on DigitalOcean droplet)
   #   - CentOS 7 Minimal install in a Hyper-V VM
+  #   - CentOS 6 (EPEL must be installed manually)
 
   if type dnf 2>/dev/null
   then
@@ -16,46 +17,49 @@ BootstrapRpmCommon() {
     exit 1
   fi
 
+  pkgs="
+    gcc
+    dialog
+    augeas-libs
+    openssl
+    openssl-devel
+    libffi-devel
+    redhat-rpm-config
+    ca-certificates
+  "
+
   # Some distros and older versions of current distros use a "python27"
   # instead of "python" naming convention. Try both conventions.
-  if ! $SUDO $tool install -y \
-         python \
-         python-devel \
-         python-virtualenv \
-         python-tools \
-         python-pip
-  then
-    if ! $SUDO $tool install -y \
-           python27 \
-           python27-devel \
-           python27-virtualenv \
-           python27-tools \
-           python27-pip
-    then
-      echo "Could not install Python dependencies. Aborting bootstrap!"
-      exit 1
-    fi
+  if $SUDO $tool list python >/dev/null 2>&1; then
+    pkgs="$pkgs
+      python
+      python-devel
+      python-virtualenv
+      python-tools
+      python-pip
+    "
+  else
+    pkgs="$pkgs
+      python27
+      python27-devel
+      python27-virtualenv
+      python27-tools
+      python27-pip
+    "
   fi
 
-  if ! $SUDO $tool install -y \
-         gcc \
-         dialog \
-         augeas-libs \
-         openssl \
-         openssl-devel \
-         libffi-devel \
-         redhat-rpm-config \
-         ca-certificates
-  then
-      echo "Could not install additional dependencies. Aborting bootstrap!"
-      exit 1
-  fi
-
-
   if $SUDO $tool list installed "httpd" >/dev/null 2>&1; then
-    if ! $SUDO $tool install -y mod_ssl
-    then
-      echo "Apache found, but mod_ssl could not be installed."
-    fi
+    pkgs="$pkgs
+      mod_ssl
+    "
+  fi
+
+  if [ "$ASSUME_YES" = 1 ]; then
+    yes_flag="-y"
+  fi
+
+  if ! $SUDO $tool install $yes_flag $pkgs; then
+      echo "Could not install OS dependencies. Aborting bootstrap!"
+      exit 1
   fi
 }

From ab2319e6097beab3b05e5428b8185a6e1b330e5e Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Fri, 22 Apr 2016 15:00:24 -0400
Subject: [PATCH 10/20] Respect yes with opensuse bootstrap

---
 letsencrypt-auto-source/letsencrypt-auto                   | 7 ++++++-
 .../pieces/bootstrappers/suse_common.sh                    | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index 9e1dfef42..dfa39b6d1 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -307,7 +307,12 @@ BootstrapRpmCommon() {
 BootstrapSuseCommon() {
   # SLE12 don't have python-virtualenv
 
-  $SUDO zypper -nq in -l \
+  if [ "$ASSUME_YES" = 1 ]; then
+    zypper_flags="-nq"
+    install_flags="-l"
+  fi
+
+  $SUDO zypper $zypper_flags in $install_flags \
     python \
     python-devel \
     python-virtualenv \
diff --git a/letsencrypt-auto-source/pieces/bootstrappers/suse_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/suse_common.sh
index 46c60f992..9ac295922 100755
--- a/letsencrypt-auto-source/pieces/bootstrappers/suse_common.sh
+++ b/letsencrypt-auto-source/pieces/bootstrappers/suse_common.sh
@@ -1,7 +1,12 @@
 BootstrapSuseCommon() {
   # SLE12 don't have python-virtualenv
 
-  $SUDO zypper -nq in -l \
+  if [ "$ASSUME_YES" = 1 ]; then
+    zypper_flags="-nq"
+    install_flags="-l"
+  fi
+
+  $SUDO zypper $zypper_flags in $install_flags \
     python \
     python-devel \
     python-virtualenv \

From 23baf225a4ee9fb9382381290781f9d9c124ac20 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Fri, 22 Apr 2016 16:44:06 -0400
Subject: [PATCH 11/20] Ask before enabling backports

---
 letsencrypt-auto-source/letsencrypt-auto      | 34 ++++++++++++-------
 .../pieces/bootstrappers/deb_common.sh        | 34 ++++++++++++-------
 2 files changed, 42 insertions(+), 26 deletions(-)

diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index dfa39b6d1..3ca88c279 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -183,26 +183,34 @@ BootstrapDebCommon() {
       # ARGS:
       BACKPORT_NAME="$1"
       BACKPORT_SOURCELINE="$2"
+      echo "To use the Apache Certbot plugin, augeas needs to be installed from $BACKPORT_NAME."
       if ! grep -v -e ' *#' /etc/apt/sources.list | grep -q "$BACKPORT_NAME" ; then
           # This can theoretically error if sources.list.d is empty, but in that case we don't care.
           if ! grep -v -e ' *#' /etc/apt/sources.list.d/* 2>/dev/null | grep -q "$BACKPORT_NAME"; then
-              /bin/echo -n "Installing augeas from $BACKPORT_NAME in 3 seconds..."
-              sleep 1s
-              /bin/echo -ne "\e[0K\rInstalling augeas from $BACKPORT_NAME in 2 seconds..."
-              sleep 1s
-              /bin/echo -e "\e[0K\rInstalling augeas from $BACKPORT_NAME in 1 second ..."
-              sleep 1s
               if echo $BACKPORT_NAME | grep -q wheezy ; then
-                  /bin/echo '(Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports")'
+                  echo 'Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports"'
+              fi
+              if [ "$ASSUME_YES" = 1 ]; then
+                  add_backports=1
+              else
+                  read -p "Would you like to enable the $BACKPORT_NAME repository [Y/n]? " response
+                  case $response in
+                      [yY][eE][sS]|[yY]|"")
+                          add_backports=1;;
+                      *)
+                          add_backports=0;;
+                  esac
+              fi
+              if [ "$add_backports" = 1 ]; then
+                  $SUDO sh -c "echo $BACKPORT_SOURCELINE >> /etc/apt/sources.list.d/$BACKPORT_NAME.list"
+                  $SUDO apt-get update
               fi
-
-              $SUDO sh -c "echo $BACKPORT_SOURCELINE >> /etc/apt/sources.list.d/$BACKPORT_NAME.list"
-              $SUDO apt-get update
           fi
       fi
-      $SUDO apt-get install $YES_FLAG --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
-      augeas_pkg=
-
+      if [ "$add_backports" != 0 ]; then
+          $SUDO apt-get install $YES_FLAG --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
+          augeas_pkg=
+      fi
   }
 
 
diff --git a/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
index b2b76fd55..5370aa2f2 100644
--- a/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
+++ b/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
@@ -42,26 +42,34 @@ BootstrapDebCommon() {
       # ARGS:
       BACKPORT_NAME="$1"
       BACKPORT_SOURCELINE="$2"
+      echo "To use the Apache Certbot plugin, augeas needs to be installed from $BACKPORT_NAME."
       if ! grep -v -e ' *#' /etc/apt/sources.list | grep -q "$BACKPORT_NAME" ; then
           # This can theoretically error if sources.list.d is empty, but in that case we don't care.
           if ! grep -v -e ' *#' /etc/apt/sources.list.d/* 2>/dev/null | grep -q "$BACKPORT_NAME"; then
-              /bin/echo -n "Installing augeas from $BACKPORT_NAME in 3 seconds..."
-              sleep 1s
-              /bin/echo -ne "\e[0K\rInstalling augeas from $BACKPORT_NAME in 2 seconds..."
-              sleep 1s
-              /bin/echo -e "\e[0K\rInstalling augeas from $BACKPORT_NAME in 1 second ..."
-              sleep 1s
               if echo $BACKPORT_NAME | grep -q wheezy ; then
-                  /bin/echo '(Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports")'
+                  echo 'Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports"'
+              fi
+              if [ "$ASSUME_YES" = 1 ]; then
+                  add_backports=1
+              else
+                  read -p "Would you like to enable the $BACKPORT_NAME repository [Y/n]? " response
+                  case $response in
+                      [yY][eE][sS]|[yY]|"")
+                          add_backports=1;;
+                      *)
+                          add_backports=0;;
+                  esac
+              fi
+              if [ "$add_backports" = 1 ]; then
+                  $SUDO sh -c "echo $BACKPORT_SOURCELINE >> /etc/apt/sources.list.d/$BACKPORT_NAME.list"
+                  $SUDO apt-get update
               fi
-
-              $SUDO sh -c "echo $BACKPORT_SOURCELINE >> /etc/apt/sources.list.d/$BACKPORT_NAME.list"
-              $SUDO apt-get update
           fi
       fi
-      $SUDO apt-get install $YES_FLAG --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
-      augeas_pkg=
-
+      if [ "$add_backports" != 0 ]; then
+          $SUDO apt-get install $YES_FLAG --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
+          augeas_pkg=
+      fi
   }
 
 

From 0f228e935dd39ef72792aa39b70a2163b665594d Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Mon, 2 May 2016 11:52:57 -0700
Subject: [PATCH 12/20] Add backports countdown when using
 --yes/letsencrypt-auto

---
 letsencrypt-auto-source/letsencrypt-auto                   | 6 ++++++
 letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index 3ca88c279..adeb94e3e 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -191,6 +191,12 @@ BootstrapDebCommon() {
                   echo 'Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports"'
               fi
               if [ "$ASSUME_YES" = 1 ]; then
+                  /bin/echo -n "Installing augeas from $BACKPORT_NAME in 3 seconds..."
+                  sleep 1s
+                  /bin/echo -ne "\e[0K\rInstalling augeas from $BACKPORT_NAME in 2 seconds..."
+                  sleep 1s
+                  /bin/echo -e "\e[0K\rInstalling augeas from $BACKPORT_NAME in 1 second ..."
+                  sleep 1s
                   add_backports=1
               else
                   read -p "Would you like to enable the $BACKPORT_NAME repository [Y/n]? " response
diff --git a/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
index 5370aa2f2..e91f52261 100644
--- a/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
+++ b/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
@@ -50,6 +50,12 @@ BootstrapDebCommon() {
                   echo 'Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports"'
               fi
               if [ "$ASSUME_YES" = 1 ]; then
+                  /bin/echo -n "Installing augeas from $BACKPORT_NAME in 3 seconds..."
+                  sleep 1s
+                  /bin/echo -ne "\e[0K\rInstalling augeas from $BACKPORT_NAME in 2 seconds..."
+                  sleep 1s
+                  /bin/echo -e "\e[0K\rInstalling augeas from $BACKPORT_NAME in 1 second ..."
+                  sleep 1s
                   add_backports=1
               else
                   read -p "Would you like to enable the $BACKPORT_NAME repository [Y/n]? " response

From a9ecd146a9797eb068827bf6c357fde15f3a9a03 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Mon, 2 May 2016 14:16:41 -0700
Subject: [PATCH 13/20] Make certbot accept --yes flag

---
 certbot/cli.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/certbot/cli.py b/certbot/cli.py
index e2c57595b..40af5dccb 100644
--- a/certbot/cli.py
+++ b/certbot/cli.py
@@ -649,6 +649,9 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False):
         "automation", "--no-self-upgrade", action="store_true",
         help="(letsencrypt-auto only) prevent the letsencrypt-auto script from"
              " upgrading itself to newer released versions")
+    helpful.add(
+        "automation", "--yes", action="store_true",
+        help="(letsencrypt-auto only) assume yes is the answer to all prompts")
     helpful.add(
         "automation", "-q", "--quiet", dest="quiet", action="store_true",
         help="Silence all output except errors. Useful for automation via cron."

From b844b7d605b2bcaa174cf4b025af926bffd1bc81 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Tue, 3 May 2016 15:44:36 -0700
Subject: [PATCH 14/20] Create certbot-auto during release process

---
 tools/release.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/release.sh b/tools/release.sh
index d41192af9..06aefea44 100755
--- a/tools/release.sh
+++ b/tools/release.sh
@@ -188,9 +188,10 @@ while ! openssl dgst -sha256 -verify $RELEASE_OPENSSL_PUBKEY -signature \
 done
 
 # copy leauto to the root, overwriting the previous release version
+cp -p letsencrypt-auto-source/letsencrypt-auto certbot-auto
 cp -p letsencrypt-auto-source/letsencrypt-auto letsencrypt-auto
 
-git add letsencrypt-auto letsencrypt-auto-source
+git add certbot-auto letsencrypt-auto letsencrypt-auto-source
 git diff --cached
 git commit --gpg-sign="$RELEASE_GPG_KEY" -m "Release $version"
 git tag --local-user "$RELEASE_GPG_KEY" --sign --message "Release $version" "$tag"

From d38cf4a74ed565679c1cd9998c23b8af55be9bfe Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Wed, 4 May 2016 17:55:12 -0700
Subject: [PATCH 15/20] Build shim packages in next release

---
 tools/release.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/release.sh b/tools/release.sh
index 06aefea44..e6169c5c8 100755
--- a/tools/release.sh
+++ b/tools/release.sh
@@ -45,7 +45,7 @@ export GPG_TTY=$(tty)
 PORT=${PORT:-1234}
 
 # subpackages to be released
-SUBPKGS=${SUBPKGS:-"acme certbot-apache certbot-nginx letshelp-certbot"}
+SUBPKGS=${SUBPKGS:-"acme certbot-apache certbot-nginx letshelp-certbot letsencrypt letsencrypt-apache letsencrypt-nginx letshelp-letsencrypt"}
 subpkgs_modules="$(echo $SUBPKGS | sed s/-/_/g)"
 # certbot_compatibility_test is not packaged because:
 # - it is not meant to be used by anyone else than Certbot devs
@@ -162,12 +162,12 @@ done
 deactivate
 
 # pin pip hashes of the things we just built
-for pkg in acme certbot certbot-apache ; do
+for pkg in acme certbot certbot-apache letsencrypt letsencrypt-apache ; do
     echo $pkg==$version \\
     pip hash dist."$version/$pkg"/*.{whl,gz} | grep "^--hash" | python2 -c 'from sys import stdin; input = stdin.read(); print "   ", input.replace("\n--hash", " \\\n    --hash"),'
 done > /tmp/hashes.$$
 
-if ! wc -l /tmp/hashes.$$ | grep -qE "^\s*9 " ; then
+if ! wc -l /tmp/hashes.$$ | grep -qE "^\s*15 " ; then
     echo Unexpected pip hash output
     exit 1
 fi

From 7f8fadee37e6c2de78786338d9a30c8a21e9995f Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Mon, 9 May 2016 18:33:47 -0700
Subject: [PATCH 16/20] Revert "Make certbot accept --yes flag"

This reverts commit a9ecd146a9797eb068827bf6c357fde15f3a9a03.
---
 certbot/cli.py | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/certbot/cli.py b/certbot/cli.py
index 40af5dccb..e2c57595b 100644
--- a/certbot/cli.py
+++ b/certbot/cli.py
@@ -649,9 +649,6 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False):
         "automation", "--no-self-upgrade", action="store_true",
         help="(letsencrypt-auto only) prevent the letsencrypt-auto script from"
              " upgrading itself to newer released versions")
-    helpful.add(
-        "automation", "--yes", action="store_true",
-        help="(letsencrypt-auto only) assume yes is the answer to all prompts")
     helpful.add(
         "automation", "-q", "--quiet", dest="quiet", action="store_true",
         help="Silence all output except errors. Useful for automation via cron."

From f38d59d6756f76be4f51b86e1365556da569216f Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Mon, 9 May 2016 19:08:25 -0700
Subject: [PATCH 17/20] Use --non-interactive instead of --yes and use getopt
 for parsing short opts

---
 letsencrypt-auto-source/letsencrypt-auto      | 31 +++++++++++--------
 .../letsencrypt-auto.template                 | 31 +++++++++++--------
 2 files changed, 36 insertions(+), 26 deletions(-)

diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index adeb94e3e..538226d2f 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -29,15 +29,26 @@ all arguments you have provided.
 
 Help for certbot itself cannot be provided until it is installed.
 
-  --debug               attempt installation on experimental platforms
-  --help                print this help
-  --no-self-upgrade     do not download updates for certbot or certbot-auto
-  --os-packages-only    install OS dependencies and exit
-  -v, --verbose         provide more output
-  --yes                 assume yes is the answer to all prompts
+  --debug                                   attempt experimental installation
+  -h, --help                                print this help
+  -n, --non-interactive, --noninteractive   run without asking for user input
+  --no-self-upgrade                         do not download updates
+  --os-packages-only                        install OS dependencies and exit
+  -v, --verbose                             provide more output
 
 All arguments are accepted and forwarded to the Certbot client when run."
 
+while getopts ":hnv" arg; do
+    case $arg in
+        h)
+            HELP=1;;
+        n)
+            ASSUME_YES=1;;
+        v)
+            VERBOSE=1;;
+    esac
+done
+
 for arg in "$@" ; do
   case "$arg" in
     --debug)
@@ -50,16 +61,10 @@ for arg in "$@" ; do
       NO_SELF_UPGRADE=1;;
     --help)
       HELP=1;;
-    --yes)
+    --noninteractive|--non-interactive)
       ASSUME_YES=1;;
     --verbose)
       VERBOSE=1;;
-    [!-]*|-*[!v]*|-)
-      # Anything that isn't -v, -vv, etc.: that is, anything that does not
-      # start with a -, contains anything that's not a v, or is just "-"
-      ;;
-    *)  # -v+ remains.
-      VERBOSE=1;;
   esac
 done
 
diff --git a/letsencrypt-auto-source/letsencrypt-auto.template b/letsencrypt-auto-source/letsencrypt-auto.template
index fe4baeafd..af4ed62d3 100755
--- a/letsencrypt-auto-source/letsencrypt-auto.template
+++ b/letsencrypt-auto-source/letsencrypt-auto.template
@@ -29,15 +29,26 @@ all arguments you have provided.
 
 Help for certbot itself cannot be provided until it is installed.
 
-  --debug               attempt installation on experimental platforms
-  --help                print this help
-  --no-self-upgrade     do not download updates for certbot or certbot-auto
-  --os-packages-only    install OS dependencies and exit
-  -v, --verbose         provide more output
-  --yes                 assume yes is the answer to all prompts
+  --debug                                   attempt experimental installation
+  -h, --help                                print this help
+  -n, --non-interactive, --noninteractive   run without asking for user input
+  --no-self-upgrade                         do not download updates
+  --os-packages-only                        install OS dependencies and exit
+  -v, --verbose                             provide more output
 
 All arguments are accepted and forwarded to the Certbot client when run."
 
+while getopts ":hnv" arg; do
+    case $arg in
+        h)
+            HELP=1;;
+        n)
+            ASSUME_YES=1;;
+        v)
+            VERBOSE=1;;
+    esac
+done
+
 for arg in "$@" ; do
   case "$arg" in
     --debug)
@@ -50,16 +61,10 @@ for arg in "$@" ; do
       NO_SELF_UPGRADE=1;;
     --help)
       HELP=1;;
-    --yes)
+    --noninteractive|--non-interactive)
       ASSUME_YES=1;;
     --verbose)
       VERBOSE=1;;
-    [!-]*|-*[!v]*|-)
-      # Anything that isn't -v, -vv, etc.: that is, anything that does not
-      # start with a -, contains anything that's not a v, or is just "-"
-      ;;
-    *)  # -v+ remains.
-      VERBOSE=1;;
   esac
 done
 

From 7a848d2b048b07c1b2fbd5f81b87c2a6cda46359 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@eff.org>
Date: Mon, 9 May 2016 19:51:08 -0700
Subject: [PATCH 18/20] Remove unneeded info about backports

---
 letsencrypt-auto-source/letsencrypt-auto                   | 3 ---
 letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh | 3 ---
 2 files changed, 6 deletions(-)

diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto
index 538226d2f..8dbdf5f9c 100755
--- a/letsencrypt-auto-source/letsencrypt-auto
+++ b/letsencrypt-auto-source/letsencrypt-auto
@@ -192,9 +192,6 @@ BootstrapDebCommon() {
       if ! grep -v -e ' *#' /etc/apt/sources.list | grep -q "$BACKPORT_NAME" ; then
           # This can theoretically error if sources.list.d is empty, but in that case we don't care.
           if ! grep -v -e ' *#' /etc/apt/sources.list.d/* 2>/dev/null | grep -q "$BACKPORT_NAME"; then
-              if echo $BACKPORT_NAME | grep -q wheezy ; then
-                  echo 'Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports"'
-              fi
               if [ "$ASSUME_YES" = 1 ]; then
                   /bin/echo -n "Installing augeas from $BACKPORT_NAME in 3 seconds..."
                   sleep 1s
diff --git a/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
index e91f52261..bfbcfa31d 100644
--- a/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
+++ b/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh
@@ -46,9 +46,6 @@ BootstrapDebCommon() {
       if ! grep -v -e ' *#' /etc/apt/sources.list | grep -q "$BACKPORT_NAME" ; then
           # This can theoretically error if sources.list.d is empty, but in that case we don't care.
           if ! grep -v -e ' *#' /etc/apt/sources.list.d/* 2>/dev/null | grep -q "$BACKPORT_NAME"; then
-              if echo $BACKPORT_NAME | grep -q wheezy ; then
-                  echo 'Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports"'
-              fi
               if [ "$ASSUME_YES" = 1 ]; then
                   /bin/echo -n "Installing augeas from $BACKPORT_NAME in 3 seconds..."
                   sleep 1s

From 762e9e9db0b2b2eb6711b19b016da740946a63a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcel=20Kr=C3=BCger?= <zauguin@gmail.com>
Date: Wed, 11 May 2016 06:16:13 +0200
Subject: [PATCH 19/20] Fix mime.types parsing for nginx

Added characters to key parsing rule which appear in the mime type in mime.types.
---
 certbot-nginx/certbot_nginx/nginxparser.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/certbot-nginx/certbot_nginx/nginxparser.py b/certbot-nginx/certbot_nginx/nginxparser.py
index cef0756d7..8ab7adb0a 100644
--- a/certbot-nginx/certbot_nginx/nginxparser.py
+++ b/certbot-nginx/certbot_nginx/nginxparser.py
@@ -17,7 +17,7 @@ class RawNginxParser(object):
     right_bracket = Literal("}").suppress()
     semicolon = Literal(";").suppress()
     space = White().suppress()
-    key = Word(alphanums + "_/")
+    key = Word(alphanums + "_/+-.")
     # Matches anything that is not a special character AND any chars in single
     # or double quotes
     value = Regex(r"((\".*\")?(\'.*\')?[^\{\};,]?)+")

From 6f9e28fccad96c19b3fd58560d5c6ddba8201d04 Mon Sep 17 00:00:00 2001
From: Jacob Hoffman-Andrews <github@hoffman-andrews.com>
Date: Wed, 11 May 2016 09:49:23 -0700
Subject: [PATCH 20/20] Allow unrecognized fields in directory.

---
 acme/acme/messages.py      | 11 +----------
 acme/acme/messages_test.py |  9 ++++-----
 2 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/acme/acme/messages.py b/acme/acme/messages.py
index 24a3b580c..4a9bd9f47 100644
--- a/acme/acme/messages.py
+++ b/acme/acme/messages.py
@@ -143,12 +143,6 @@ class Directory(jose.JSONDeSerializable):
 
     def __init__(self, jobj):
         canon_jobj = util.map_keys(jobj, self._canon_key)
-        if not set(canon_jobj).issubset(
-                set(self._REGISTERED_TYPES).union(['meta'])):
-            # TODO: acme-spec is not clear about this: 'It is a JSON
-            # dictionary, whose keys are the "resource" values listed
-            # in {{https-requests}}'
-            raise ValueError('Wrong directory fields')
         # TODO: check that everything is an absolute URL; acme-spec is
         # not clear on that
         self._jobj = canon_jobj
@@ -171,10 +165,7 @@ class Directory(jose.JSONDeSerializable):
     @classmethod
     def from_json(cls, jobj):
         jobj['meta'] = cls.Meta.from_json(jobj.pop('meta', {}))
-        try:
-            return cls(jobj)
-        except ValueError as error:
-            raise jose.DeserializationError(str(error))
+        return cls(jobj)
 
 
 class Resource(jose.JSONObjectWithFields):
diff --git a/acme/acme/messages_test.py b/acme/acme/messages_test.py
index b2b7febdc..b39b9ff55 100644
--- a/acme/acme/messages_test.py
+++ b/acme/acme/messages_test.py
@@ -97,9 +97,9 @@ class DirectoryTest(unittest.TestCase):
             ),
         })
 
-    def test_init_wrong_key_value_error(self):
+    def test_init_wrong_key_value_success(self):  # pylint: disable=no-self-use
         from acme.messages import Directory
-        self.assertRaises(ValueError, Directory, {'foo': 'bar'})
+        Directory({'foo': 'bar'})
 
     def test_getitem(self):
         self.assertEqual('reg', self.dir['new-reg'])
@@ -127,10 +127,9 @@ class DirectoryTest(unittest.TestCase):
             },
         })
 
-    def test_from_json_deserialization_error_on_wrong_key(self):
+    def test_from_json_deserialization_unknown_key_success(self):  # pylint: disable=no-self-use
         from acme.messages import Directory
-        self.assertRaises(
-            jose.DeserializationError, Directory.from_json, {'foo': 'bar'})
+        Directory.from_json({'foo': 'bar'})
 
 
 class RegistrationTest(unittest.TestCase):