Merge branch 'master' into candidate-1.32.1

.azure-pipelines/templates/jobs/extended-tests-jobs.yml

@@ -4,7 +4,7 @@ jobs:
       - name: IMAGE_NAME
         value: ubuntu-22.04
       - name: PYTHON_VERSION
-        value: 3.10
+        value: 3.11
       - group: certbot-common
     strategy:
       matrix:
@@ -14,12 +14,13 @@ jobs:
         linux-py39:
           PYTHON_VERSION: 3.9
           TOXENV: py39
+        linux-py310:
+          PYTHON_VERSION: 3.10
+          TOXENV: py310
         linux-py37-nopin:
           PYTHON_VERSION: 3.7
           TOXENV: py37
           CERTBOT_NO_PIN: 1
-        linux-external-mock:
-          TOXENV: external-mock
         linux-boulder-v2-integration-certbot-oldest:
           PYTHON_VERSION: 3.7
           TOXENV: integration-certbot-oldest
@@ -44,6 +45,10 @@ jobs:
           PYTHON_VERSION: 3.10
           TOXENV: integration
           ACME_SERVER: boulder-v2
+        linux-boulder-v2-py311-integration:
+          PYTHON_VERSION: 3.11
+          TOXENV: integration
+          ACME_SERVER: boulder-v2
         nginx-compat:
           TOXENV: nginx_compat
         linux-integration-rfc2136:

.azure-pipelines/templates/jobs/standard-tests-jobs.yml

@@ -1,17 +1,16 @@
 jobs:
   - job: test
     variables:
-      PYTHON_VERSION: 3.10
+      PYTHON_VERSION: 3.11
     strategy:
       matrix:
         macos-py37-cover:
           IMAGE_NAME: macOS-12
           PYTHON_VERSION: 3.7
           TOXENV: py37-cover
-        macos-py310-cover:
+        macos-cover:
           IMAGE_NAME: macOS-12
-          PYTHON_VERSION: 3.10
-          TOXENV: py310-cover
+          TOXENV: py3-cover
         windows-py37:
           IMAGE_NAME: windows-2019
           PYTHON_VERSION: 3.7
@@ -36,17 +35,14 @@ jobs:
           IMAGE_NAME: ubuntu-22.04
           PYTHON_VERSION: 3.7
           TOXENV: py37
-        linux-py310-cover:
+        linux-cover:
           IMAGE_NAME: ubuntu-22.04
-          PYTHON_VERSION: 3.10
-          TOXENV: py310-cover
-        linux-py310-lint:
+          TOXENV: py3-cover
+        linux-lint:
           IMAGE_NAME: ubuntu-22.04
-          PYTHON_VERSION: 3.10
           TOXENV: lint-posix
-        linux-py310-mypy:
+        linux-mypy:
           IMAGE_NAME: ubuntu-22.04
-          PYTHON_VERSION: 3.10
           TOXENV: mypy-posix
         linux-integration:
           IMAGE_NAME: ubuntu-22.04

.pylintrc

@@ -1,10 +1,65 @@
-[MASTER]
+[MAIN]
 
-# use as many jobs as there are cores
-jobs=0
+# Analyse import fallback blocks. This can be used to support both Python 2 and
+# 3 compatible code, which means that the block might have code that exists
+# only in one or another interpreter, leading to false positives when analysed.
+analyse-fallback-blocks=no
 
-# Specify a configuration file.
-#rcfile=
+# Load and enable all available extensions. Use --list-extensions to see a list
+# all available extensions.
+#enable-all-extensions=
+
+# In error mode, messages with a category besides ERROR or FATAL are
+# suppressed, and no reports are done by default. Error mode is compatible with
+# disabling specific errors.
+#errors-only=
+
+# Always return a 0 (non-error) status code, even if lint errors are found.
+# This is primarily useful in continuous integration scripts.
+#exit-zero=
+
+# A comma-separated list of package or module names from where C extensions may
+# be loaded. Extensions are loading into the active Python interpreter and may
+# run arbitrary code.
+extension-pkg-allow-list=
+
+# A comma-separated list of package or module names from where C extensions may
+# be loaded. Extensions are loading into the active Python interpreter and may
+# run arbitrary code. (This is an alternative name to extension-pkg-allow-list
+# for backward compatibility.)
+extension-pkg-whitelist=pywintypes,win32api,win32file,win32security
+
+# Return non-zero exit code if any of these messages/categories are detected,
+# even if score is above --fail-under value. Syntax same as enable. Messages
+# specified are enabled, while categories only check already-enabled messages.
+fail-on=
+
+# Specify a score threshold under which the program will exit with error.
+fail-under=10
+
+# Interpret the stdin as a python script, whose filename needs to be passed as
+# the module_or_package argument.
+#from-stdin=
+
+# Files or directories to be skipped. They should be base names, not paths.
+ignore=CVS
+
+# Add files or directories matching the regular expressions patterns to the
+# ignore-list. The regex matches against paths and can be in Posix or Windows
+# format. Because '\' represents the directory delimiter on Windows systems, it
+# can't be used as an escape character.
+ignore-paths=
+
+# Files or directories matching the regular expression patterns are skipped.
+# The regex matches against base names, not paths. The default value ignores
+# Emacs file locks
+ignore-patterns=^\.#
+
+# List of module names for which member attributes should not be checked
+# (useful for modules/projects where namespaces are manipulated during runtime
+# and thus existing member attributes cannot be deduced by static analysis). It
+# supports qualified module names, as well as Unix pattern matching.
+ignored-modules=
 
 # Python code to execute, usually for sys.path manipulation such as
 # pygtk.require().
@@ -13,42 +68,303 @@ jobs=0
 # https://github.com/PyCQA/pylint/pull/3396.
 init-hook="import pylint.config, os, sys; sys.path.append(os.path.dirname(pylint.config.PYLINTRC))"
 
-# Profiled execution.
-profile=no
+# Use multiple processes to speed up Pylint. Specifying 0 will auto-detect the
+# number of processors available to use, and will cap the count on Windows to
+# avoid hangs.
+jobs=0
 
-# Add files or directories to the blacklist. They should be base names, not
-# paths.
-ignore=CVS
+# Control the amount of potential inferred values when inferring a single
+# object. This can help the performance when dealing with large functions or
+# complex, nested conditions.
+limit-inference-results=100
+
+# List of plugins (as comma separated values of python module names) to load,
+# usually to register additional checkers.
+load-plugins=linter_plugin
 
 # Pickle collected data for later comparisons.
 persistent=yes
 
-# List of plugins (as comma separated values of python modules names) to load,
-# usually to register additional checkers.
-load-plugins=linter_plugin
+# Minimum Python version to use for version dependent checks. Will default to
+# the version used to run pylint.
+py-version=3.10
 
-# A comma-separated list of package or module names from where C extensions may
-# be loaded. Extensions are loading into the active Python interpreter and may
-# run arbitrary code.
-extension-pkg-whitelist=pywintypes,win32api,win32file,win32security
+# Discover python modules and packages in the file system subtree.
+recursive=no
+
+# When enabled, pylint would attempt to guess common misconfiguration and emit
+# user-friendly hints instead of false-positive error messages.
+suggestion-mode=yes
+
+# Allow loading of arbitrary C extensions. Extensions are imported into the
+# active Python interpreter and may run arbitrary code.
+unsafe-load-any-extension=no
+
+# In verbose mode, extra non-checker-related info will be displayed.
+#verbose=
+
+
+[BASIC]
+
+# Naming style matching correct argument names.
+argument-naming-style=snake_case
+
+# Regular expression matching correct argument names. Overrides argument-
+# naming-style. If left empty, argument names will be checked with the set
+# naming style.
+#argument-rgx=
+
+# Naming style matching correct attribute names.
+attr-naming-style=snake_case
+
+# Regular expression matching correct attribute names. Overrides attr-naming-
+# style. If left empty, attribute names will be checked with the set naming
+# style.
+#attr-rgx=
+
+# Bad variable names which should always be refused, separated by a comma.
+bad-names=foo,
+          bar,
+          baz,
+          toto,
+          tutu,
+          tata
+
+# Bad variable names regexes, separated by a comma. If names match any regex,
+# they will always be refused
+bad-names-rgxs=
+
+# Naming style matching correct class attribute names.
+class-attribute-naming-style=any
+
+# Regular expression matching correct class attribute names. Overrides class-
+# attribute-naming-style. If left empty, class attribute names will be checked
+# with the set naming style.
+#class-attribute-rgx=
+
+# Naming style matching correct class constant names.
+class-const-naming-style=UPPER_CASE
+
+# Regular expression matching correct class constant names. Overrides class-
+# const-naming-style. If left empty, class constant names will be checked with
+# the set naming style.
+#class-const-rgx=
+
+# Naming style matching correct class names.
+class-naming-style=PascalCase
+
+# Regular expression matching correct class names. Overrides class-naming-
+# style. If left empty, class names will be checked with the set naming style.
+#class-rgx=
+
+# Naming style matching correct constant names.
+const-naming-style=UPPER_CASE
+
+# Regular expression matching correct constant names. Overrides const-naming-
+# style. If left empty, constant names will be checked with the set naming
+# style.
+#const-rgx=
+
+# Minimum line length for functions/classes that require docstrings, shorter
+# ones are exempt.
+docstring-min-length=-1
+
+# Naming style matching correct function names.
+function-naming-style=snake_case
+
+# Regular expression matching correct function names. Overrides function-
+# naming-style. If left empty, function names will be checked with the set
+# naming style.
+function-rgx=[a-z_][a-z0-9_]{2,40}$
+
+# Good variable names which should always be accepted, separated by a comma.
+good-names=i,
+           j,
+           k,
+           ex,
+           Run,
+           _,
+           fd,
+           logger
+
+# Good variable names regexes, separated by a comma. If names match any regex,
+# they will always be accepted
+good-names-rgxs=
+
+# Include a hint for the correct naming format with invalid-name.
+include-naming-hint=no
+
+# Naming style matching correct inline iteration names.
+inlinevar-naming-style=any
+
+# Regular expression matching correct inline iteration names. Overrides
+# inlinevar-naming-style. If left empty, inline iteration names will be checked
+# with the set naming style.
+#inlinevar-rgx=
+
+# Naming style matching correct method names.
+method-naming-style=snake_case
+
+# Regular expression matching correct method names. Overrides method-naming-
+# style. If left empty, method names will be checked with the set naming style.
+method-rgx=[a-z_][a-z0-9_]{2,50}$
+
+# Naming style matching correct module names.
+module-naming-style=snake_case
+
+# Regular expression matching correct module names. Overrides module-naming-
+# style. If left empty, module names will be checked with the set naming style.
+#module-rgx=
+
+# Colon-delimited sets of names that determine each other's naming style when
+# the name regexes allow several styles.
+name-group=
+
+# Regular expression which should only match function or class names that do
+# not require a docstring.
+no-docstring-rgx=(__.*__)|(test_[A-Za-z0-9_]*)|(_.*)|(.*Test$)
+
+# List of decorators that produce properties, such as abc.abstractproperty. Add
+# to this list to register other decorators that produce valid properties.
+# These decorators are taken in consideration only for invalid-name.
+property-classes=abc.abstractproperty
+
+# Regular expression matching correct type variable names. If left empty, type
+# variable names will be checked with the set naming style.
+#typevar-rgx=
+
+# Naming style matching correct variable names.
+variable-naming-style=snake_case
+
+# Regular expression matching correct variable names. Overrides variable-
+# naming-style. If left empty, variable names will be checked with the set
+# naming style.
+variable-rgx=[a-z_][a-z0-9_]{1,30}$
+
+
+[CLASSES]
+
+# Warn about protected attribute access inside special methods
+check-protected-access-in-special-methods=no
+
+# List of method names used to declare (i.e. assign) instance attributes.
+defining-attr-methods=__init__,
+                      __new__,
+                      setUp,
+                      __post_init__
+
+# List of valid names for the first argument in a class method.
+valid-classmethod-first-arg=cls
+
+# List of valid names for the first argument in a metaclass class method.
+valid-metaclass-classmethod-first-arg=cls
+
+
+[EXCEPTIONS]
+
+# Exceptions that will emit a warning when caught.
+overgeneral-exceptions=BaseException,
+                       Exception
+
+
+[FORMAT]
+
+# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
+expected-line-ending-format=
+
+# Regexp for a line that is allowed to be longer than the limit.
+ignore-long-lines=^\s*(# )?<?https?://\S+>?$
+
+# Number of spaces of indent required inside a hanging or continued line.
+# git history told me that "This does something silly/broken..."
+#indent-after-paren=4
+
+# String used as indentation unit. This is usually "    " (4 spaces) or "\t" (1
+# tab).
+indent-string='    '
+
+# Maximum number of characters on a single line.
+max-line-length=100
+
+# Maximum number of lines in a module.
+max-module-lines=1250
+
+# Allow the body of a class to be on the same line as the declaration if body
+# contains single statement.
+single-line-class-stmt=no
+
+# Allow the body of an if to be on the same line as the test if there is no
+# else.
+single-line-if-stmt=no
+
+
+[IMPORTS]
+
+# List of modules that can be imported at any level, not just the top level
+# one.
+allow-any-import-level=
+
+# Allow wildcard imports from modules that define __all__.
+allow-wildcard-with-all=no
+
+# Deprecated modules which should not be used, separated by a comma.
+deprecated-modules=
+
+# Output a graph (.gv or any supported image format) of external dependencies
+# to the given file (report RP0402 must not be disabled).
+ext-import-graph=
+
+# Output a graph (.gv or any supported image format) of all (i.e. internal and
+# external) dependencies to the given file (report RP0402 must not be
+# disabled).
+import-graph=
+
+# Output a graph (.gv or any supported image format) of internal dependencies
+# to the given file (report RP0402 must not be disabled).
+int-import-graph=
+
+# Force import order to recognize a module as part of the standard
+# compatibility libraries.
+known-standard-library=
+
+# Force import order to recognize a module as part of a third party library.
+known-third-party=enchant
+
+# Couples of modules and preferred modules, separated by a comma.
+preferred-modules=
+
+
+[LOGGING]
+
+# The type of string formatting that logging methods do. `old` means using %
+# formatting, `new` is for `{}` formatting.
+logging-format-style=old
+
+# Logging modules to check that the string format arguments are in logging
+# function parameter format.
+logging-modules=logging,logger
 
 
 [MESSAGES CONTROL]
 
-# Enable the message, report, category or checker with the given id(s). You can
-# either give multiple identifier separated by comma (,) or put this option
-# multiple time. See also the "--disable" option for examples.
-#enable=
+# Only show warnings with the listed confidence levels. Leave empty to show
+# all. Valid levels: HIGH, CONTROL_FLOW, INFERENCE, INFERENCE_FAILURE,
+# UNDEFINED.
+confidence=HIGH,
+           CONTROL_FLOW,
+           INFERENCE,
+           INFERENCE_FAILURE,
+           UNDEFINED
 
 # Disable the message, report, category or checker with the given id(s). You
 # can either give multiple identifiers separated by comma (,) or put this
 # option multiple times (only on the command line, not in the configuration
-# file where it should appear only once).You can also use "--disable=all" to
-# disable everything first and then reenable specific checks. For example, if
+# file where it should appear only once). You can also use "--disable=all" to
+# disable everything first and then re-enable specific checks. For example, if
 # you want to run only the similarities checker, you can use "--disable=all
 # --enable=similarities". If you want to run only the classes checker, but have
-# no Warning level messages displayed, use"--disable=all --enable=classes
-# --disable=W"
+# no Warning level messages displayed, use "--disable=all --enable=classes
+# --disable=W".
 # CERTBOT COMMENT
 # 1) Once certbot codebase is claimed to be compatible exclusively with Python 3,
 #    the useless-object-inheritance check can be enabled again, and code fixed accordingly.
@@ -74,261 +390,185 @@ extension-pkg-whitelist=pywintypes,win32api,win32file,win32security
 #    not need to enforce encoding on files so we disable this check.
 # 7) consider-using-f-string is "suggesting" to move to f-string when possible with an error. This
 #    clearly relates to code design and not to potential defects in the code, let's just ignore that.
-disable=fixme,locally-disabled,locally-enabled,bad-continuation,no-self-use,invalid-name,cyclic-import,duplicate-code,design,import-outside-toplevel,useless-object-inheritance,unsubscriptable-object,no-value-for-parameter,no-else-return,no-else-raise,no-else-break,no-else-continue,raise-missing-from,wrong-import-order,unspecified-encoding,consider-using-f-string
+disable=fixme,locally-disabled,invalid-name,cyclic-import,duplicate-code,design,import-outside-toplevel,useless-object-inheritance,unsubscriptable-object,no-value-for-parameter,no-else-return,no-else-raise,no-else-break,no-else-continue,raise-missing-from,wrong-import-order,unspecified-encoding,consider-using-f-string,raw-checker-failed,bad-inline-option,file-ignored,suppressed-message,useless-suppression,deprecated-pragma,use-symbolic-message-instead
 
-[REPORTS]
-
-# Set the output format. Available formats are text, parseable, colorized, msvs
-# (visual studio) and html. You can also give a reporter class, eg
-# mypackage.mymodule.MyReporterClass.
-output-format=text
-
-# Put messages in a separate file for each module / package specified on the
-# command line instead of printing them on stdout. Reports (if any) will be
-# written in a file name "pylint_global.[txt|html]".
-files-output=no
-
-# Tells whether to display a full report or only the messages
-reports=yes
-
-# Python expression which should return a note less than 10 (10 is the highest
-# note). You have access to the variables errors warning, statement which
-# respectively contain the number of errors / warnings messages and the total
-# number of statements analyzed. This is used by the global evaluation report
-# (RP0004).
-evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
-
-# Add a comment according to your evaluation note. This is used by the global
-# evaluation report (RP0004).
-comment=no
-
-# Template used to display messages. This is a python new-style format string
-# used to format the message information. See doc for all details
-#msg-template=
+# Enable the message, report, category or checker with the given id(s). You can
+# either give multiple identifier separated by comma (,) or put this option
+# multiple time (only on the command line, not in the configuration file where
+# it should appear only once). See also the "--disable" option for examples.
+enable=c-extension-no-member
 
 
-[BASIC]
+[METHOD_ARGS]
 
-# Required attributes for module, separated by a comma
-required-attributes=
-
-# List of builtins function names that should not be used, separated by a comma
-bad-functions=map,filter,apply,input,file
-
-# Good variable names which should always be accepted, separated by a comma
-good-names=f,i,j,k,ex,Run,_,fd,logger
-
-# Bad variable names which should always be refused, separated by a comma
-bad-names=foo,bar,baz,toto,tutu,tata
-
-# Colon-delimited sets of names that determine each other's naming style when
-# the name regexes allow several styles.
-name-group=
-
-# Include a hint for the correct naming format with invalid-name
-include-naming-hint=no
-
-# Regular expression matching correct function names
-function-rgx=[a-z_][a-z0-9_]{2,40}$
-
-# Naming hint for function names
-function-name-hint=[a-z_][a-z0-9_]{2,40}$
-
-# Regular expression matching correct variable names
-variable-rgx=[a-z_][a-z0-9_]{1,30}$
-
-# Naming hint for variable names
-variable-name-hint=[a-z_][a-z0-9_]{2,30}$
-
-# Regular expression matching correct constant names
-const-rgx=(([A-Z_][A-Z0-9_]*)|(__.*__))$
-
-# Naming hint for constant names
-const-name-hint=(([A-Z_][A-Z0-9_]*)|(__.*__))$
-
-# Regular expression matching correct attribute names
-attr-rgx=[a-z_][a-z0-9_]{2,30}$
-
-# Naming hint for attribute names
-attr-name-hint=[a-z_][a-z0-9_]{2,30}$
-
-# Regular expression matching correct argument names
-argument-rgx=[a-z_][a-z0-9_]{2,30}$
-
-# Naming hint for argument names
-argument-name-hint=[a-z_][a-z0-9_]{2,30}$
-
-# Regular expression matching correct class attribute names
-class-attribute-rgx=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$
-
-# Naming hint for class attribute names
-class-attribute-name-hint=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$
-
-# Regular expression matching correct inline iteration names
-inlinevar-rgx=[A-Za-z_][A-Za-z0-9_]*$
-
-# Naming hint for inline iteration names
-inlinevar-name-hint=[A-Za-z_][A-Za-z0-9_]*$
-
-# Regular expression matching correct class names
-class-rgx=[A-Z_][a-zA-Z0-9]+$
-
-# Naming hint for class names
-class-name-hint=[A-Z_][a-zA-Z0-9]+$
-
-# Regular expression matching correct module names
-module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
-
-# Naming hint for module names
-module-name-hint=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
-
-# Regular expression matching correct method names
-method-rgx=[a-z_][a-z0-9_]{2,50}$
-
-# Naming hint for method names
-method-name-hint=[a-z_][a-z0-9_]{2,50}$
-
-# Regular expression which should only match function or class names that do
-# not require a docstring.
-no-docstring-rgx=(__.*__)|(test_[A-Za-z0-9_]*)|(_.*)|(.*Test$)
-
-# Minimum line length for functions/classes that require docstrings, shorter
-# ones are exempt.
-docstring-min-length=-1
+# List of qualified names (i.e., library.method) which require a timeout
+# parameter e.g. 'requests.api.get,requests.api.post'
+timeout-methods=requests.api.delete,requests.api.get,requests.api.head,requests.api.options,requests.api.patch,requests.api.post,requests.api.put,requests.api.request
 
 
 [MISCELLANEOUS]
 
 # List of note tags to take in consideration, separated by a comma.
-notes=FIXME,XXX,TODO
+notes=FIXME,
+      XXX,
+      TODO
+
+# Regular expression of note tags to take in consideration.
+notes-rgx=
 
 
-[LOGGING]
+[REFACTORING]
 
-# Logging modules to check that the string format arguments are in logging
-# function parameter format
-logging-modules=logging,logger
+# Maximum number of nested blocks for function / method body
+max-nested-blocks=5
+
+# Complete name of functions that never returns. When checking for
+# inconsistent-return-statements if a never returning function is called then
+# it will be considered as an explicit return statement and no message will be
+# printed.
+never-returning-functions=sys.exit,argparse.parse_error
 
 
-[VARIABLES]
+[REPORTS]
 
-# Tells whether we should check for unused import in __init__ files.
-init-import=no
+# Python expression which should return a score less than or equal to 10. You
+# have access to the variables 'fatal', 'error', 'warning', 'refactor',
+# 'convention', and 'info' which contain the number of messages in each
+# category, as well as 'statement' which is the total number of statements
+# analyzed. This score is used by the global evaluation report (RP0004).
+evaluation=max(0, 0 if fatal else 10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10))
 
-# A regular expression matching the name of dummy variables (i.e. expectedly
-# not used).
-dummy-variables-rgx=(unused)?_.*|dummy
+# Template used to display messages. This is a python new-style format string
+# used to format the message information. See doc for all details.
+msg-template=
 
-# List of additional names supposed to be defined in builtins. Remember that
-# you should avoid to define new builtins when possible.
-additional-builtins=
+# Set the output format. Available formats are text, parseable, colorized, json
+# and msvs (visual studio). You can also give a reporter class, e.g.
+# mypackage.mymodule.MyReporterClass.
+#output-format=
+
+# Tells whether to display a full report or only the messages.
+reports=no
+
+# Activate the evaluation score.
+score=yes
 
 
 [SIMILARITIES]
 
+# Comments are removed from the similarity computation
+ignore-comments=yes
+
+# Docstrings are removed from the similarity computation
+ignore-docstrings=yes
+
+# Imports are removed from the similarity computation
+ignore-imports=yes
+
+# Signatures are removed from the similarity computation
+ignore-signatures=yes
+
 # Minimum lines number of a similarity.
 min-similarity-lines=6
 
-# Ignore comments when computing similarities.
-ignore-comments=yes
 
-# Ignore docstrings when computing similarities.
-ignore-docstrings=yes
+[STRING]
 
-# Ignore imports when computing similarities.
-ignore-imports=yes
+# This flag controls whether inconsistent-quotes generates a warning when the
+# character used as a quote delimiter is used inconsistently within a module.
+check-quote-consistency=no
 
-
-[FORMAT]
-
-# Maximum number of characters on a single line.
-max-line-length=100
-
-# Regexp for a line that is allowed to be longer than the limit.
-ignore-long-lines=^\s*(# )?<?https?://\S+>?$
-
-# Allow the body of an if to be on the same line as the test if there is no
-# else.
-single-line-if-stmt=no
-
-# List of optional constructs for which whitespace checking is disabled
-no-space-check=trailing-comma
-
-# Maximum number of lines in a module
-max-module-lines=1250
-
-# String used as indentation unit. This is usually " " (4 spaces) or "\t" (1
-# tab).
-indent-string='    '
-
-# Number of spaces of indent required inside a hanging or continued line.
-# This does something silly/broken...
-#indent-after-paren=4
+# This flag controls whether the implicit-str-concat should generate a warning
+# on implicit string concatenation in sequences defined over several lines.
+check-str-concat-over-line-jumps=no
 
 
 [TYPECHECK]
 
-# Tells whether missing members accessed in mixin class should be ignored. A
-# mixin class is detected if its name ends with "mixin" (case insensitive).
-ignore-mixin-members=yes
+# List of decorators that produce context managers, such as
+# contextlib.contextmanager. Add to this list to register other decorators that
+# produce valid context managers.
+contextmanager-decorators=contextlib.contextmanager
+
+# List of members which are set dynamically and missed by pylint inference
+# system, and so shouldn't trigger E1101 when accessed. Python regular
+# expressions are accepted.
+generated-members=
+
+# Tells whether to warn about missing members when the owner of the attribute
+# is inferred to be None.
+ignore-none=yes
+
+# This flag controls whether pylint should warn about no-member and similar
+# checks whenever an opaque object is returned when inferring. The inference
+# can return multiple potential results while evaluating a Python object, but
+# some branches might not be evaluated, which results in partial inference. In
+# that case, it might be useful to still emit no-member and other checks for
+# the rest of the inferred objects.
+ignore-on-opaque-inference=yes
+
+# List of symbolic message names to ignore for Mixin members.
+ignored-checks-for-mixins=no-member,
+                          not-async-context-manager,
+                          not-context-manager,
+                          attribute-defined-outside-init
+
+# List of class names for which member attributes should not be checked (useful
+# for classes with dynamically set attributes). This supports the use of
+# qualified names.
+ignored-classes=optparse.Values,thread._local,_thread._local,argparse.Namespace,Field,Header,JWS,closing
 
 # List of module names for which member attributes should not be checked
 # (useful for modules/projects where namespaces are manipulated during runtime
 # and thus existing member attributes cannot be deduced by static analysis
 ignored-modules=pkg_resources,confargparse,argparse
-# import errors ignored only in 1.4.4
-# https://bitbucket.org/logilab/pylint/commits/cd000904c9e2
 
-# List of classes names for which member attributes should not be checked
-# (useful for classes with attributes dynamically set).
-ignored-classes=Field,Header,JWS,closing
+# Show a hint with possible names when a member name was not found. The aspect
+# of finding the hint is based on edit distance.
+missing-member-hint=yes
 
-# When zope mode is activated, add a predefined set of Zope acquired attributes
-# to generated-members.
-zope=yes
+# The minimum edit distance a name should have in order to be considered a
+# similar match for a missing member name.
+missing-member-hint-distance=1
 
-# List of members which are set dynamically and missed by pylint inference
-# system, and so shouldn't trigger E0201 when accessed. Python regular
-# expressions are accepted.
-generated-members=REQUEST,acl_users,aq_parent
+# The total number of similar names that should be taken in consideration when
+# showing a hint for a missing member.
+missing-member-max-choices=1
+
+# Regex pattern to define which classes are considered mixins.
+mixin-class-rgx=.*[Mm]ixin
+
+# List of decorators that change the signature of a decorated function.
+signature-mutators=
 
 
-[IMPORTS]
+[VARIABLES]
 
-# Deprecated modules which should not be used, separated by a comma
-deprecated-modules=regsub,TERMIOS,Bastion,rexec
+# List of additional names supposed to be defined in builtins. Remember that
+# you should avoid defining new builtins when possible.
+additional-builtins=
 
-# Create a graph of every (i.e. internal and external) dependencies in the
-# given file (report RP0402 must not be disabled)
-import-graph=
+# Tells whether unused global variables should be treated as a violation.
+allow-global-unused-variables=yes
 
-# Create a graph of external dependencies in the given file (report RP0402 must
-# not be disabled)
-ext-import-graph=
+# List of names allowed to shadow builtins
+allowed-redefined-builtins=
 
-# Create a graph of internal dependencies in the given file (report RP0402 must
-# not be disabled)
-int-import-graph=
+# List of strings which can identify a callback function by name. A callback
+# name must start or end with one of those strings.
+callbacks=cb_,
+          _cb
 
+# A regular expression matching the name of dummy variables (i.e. expected to
+# not be used).
+dummy-variables-rgx=_+$|(_[a-zA-Z0-9_]*[a-zA-Z0-9]+?$)|dummy|^ignored_|^unused_
 
-[CLASSES]
+# Argument names that match this expression will be ignored.
+ignored-argument-names=_.*|^ignored_|^unused_
 
-# List of interface methods to ignore, separated by a comma. This is used for
-# instance to not check methods defined in Zope's Interface base class.
-ignore-iface-methods=isImplementedBy,deferred,extends,names,namesAndDescriptions,queryDescriptionFor,getBases,getDescriptionFor,getDoc,getName,getTaggedValue,getTaggedValueTags,isEqualOrExtendedBy,setTaggedValue,isImplementedByInstancesOf,adaptWith,is_implemented_by,implementedBy,providedBy
+# Tells whether we should check for unused import in __init__ files.
+init-import=no
 
-# List of method names used to declare (i.e. assign) instance attributes.
-defining-attr-methods=__init__,__new__,setUp
-
-# List of valid names for the first argument in a class method.
-valid-classmethod-first-arg=cls
-
-# List of valid names for the first argument in a metaclass class method.
-valid-metaclass-classmethod-first-arg=mcs
-
-
-[EXCEPTIONS]
-
-# Exceptions that will emit a warning when being caught. Defaults to
-# "Exception"
-overgeneral-exceptions=Exception
+# List of qualified module names which can have objects that can redefine
+# builtins.
+redefining-builtins-modules=six.moves,past.builtins,future.builtins,builtins,io

acme/acme/challenges.py

@@ -14,7 +14,6 @@ from typing import Tuple
 from typing import Type
 from typing import TypeVar
 from typing import Union
-import warnings
 
 from cryptography.hazmat.primitives import hashes
 import josepy as jose
@@ -24,12 +23,6 @@ import requests
 
 from acme import crypto_util
 from acme import errors
-from acme import fields
-
-with warnings.catch_warnings():
-    warnings.filterwarnings("ignore", category=DeprecationWarning)
-    from acme.mixins import ResourceMixin
-    from acme.mixins import TypeMixin
 
 logger = logging.getLogger(__name__)
 
@@ -51,14 +44,17 @@ class Challenge(jose.TypedJSONObjectWithFields):
             return UnrecognizedChallenge.from_json(jobj)
 
 
-class ChallengeResponse(ResourceMixin, TypeMixin, jose.TypedJSONObjectWithFields):
+class ChallengeResponse(jose.TypedJSONObjectWithFields):
     # _fields_to_partial_json
     """ACME challenge response."""
     TYPES: Dict[str, Type['ChallengeResponse']] = {}
-    resource_type = 'challenge'
-    with warnings.catch_warnings():
-        warnings.filterwarnings('ignore', 'resource attribute in acme.fields', DeprecationWarning)
-        resource: str = fields.resource(resource_type)
+
+    def to_partial_json(self) -> Dict[str, Any]:
+        # Removes the `type` field which is inserted by TypedJSONObjectWithFields.to_partial_json.
+        # This field breaks RFC8555 compliance.
+        jobj = super().to_partial_json()
+        jobj.pop(self.type_field_name, None)
+        return jobj
 
 
 class UnrecognizedChallenge(Challenge):
@@ -305,7 +301,7 @@ class HTTP01Response(KeyAuthorizationChallengeResponse):
     """Whitespace characters which should be ignored at the end of the body."""
 
     def simple_verify(self, chall: 'HTTP01', domain: str, account_public_key: jose.JWK,
-                      port: Optional[int] = None) -> bool:
+                      port: Optional[int] = None, timeout: int = 30) -> bool:
         """Simple verify.
 
         :param challenges.SimpleHTTP chall: Corresponding challenge.
@@ -313,6 +309,7 @@ class HTTP01Response(KeyAuthorizationChallengeResponse):
         :param JWK account_public_key: Public key for the key pair
             being authorized.
         :param int port: Port used in the validation.
+        :param int timeout: Timeout in seconds.
 
         :returns: ``True`` iff validation with the files currently served by the
             HTTP server is successful.
@@ -334,7 +331,7 @@ class HTTP01Response(KeyAuthorizationChallengeResponse):
         uri = chall.uri(domain)
         logger.debug("Verifying %s at %s...", chall.typ, uri)
         try:
-            http_response = requests.get(uri, verify=False)
+            http_response = requests.get(uri, verify=False, timeout=timeout)
         except requests.exceptions.RequestException as error:
             logger.error("Unable to reach %s: %s", uri, error)
             return False

acme/acme/fields.py

@@ -1,12 +1,8 @@
 """ACME JSON fields."""
 import datetime
-import logging
-import sys
-from types import ModuleType
 from typing import Any
-from typing import cast
-from typing import List
-import warnings
+
+import logging
 
 import josepy as jose
 import pyrfc3339
@@ -55,26 +51,6 @@ class RFC3339Field(jose.Field):
             raise jose.DeserializationError(error)
 
 
-class Resource(jose.Field):
-    """Resource MITM field.
-
-    .. deprecated: 1.30.0
-
-    """
-
-    def __init__(self, resource_type: str, *args: Any, **kwargs: Any) -> None:
-        self.resource_type = resource_type
-        kwargs['default'] = resource_type
-        super().__init__('resource', *args, **kwargs)
-
-    def decode(self, value: Any) -> Any:
-        if value != self.resource_type:
-            raise jose.DeserializationError(
-                'Wrong resource type: {0} instead of {1}'.format(
-                    value, self.resource_type))
-        return value
-
-
 def fixed(json_name: str, value: Any) -> Any:
     """Generates a type-friendly Fixed field."""
     return Fixed(json_name, value)
@@ -83,43 +59,3 @@ def fixed(json_name: str, value: Any) -> Any:
 def rfc3339(json_name: str, omitempty: bool = False) -> Any:
     """Generates a type-friendly RFC3339 field."""
     return RFC3339Field(json_name, omitempty=omitempty)
-
-
-def resource(resource_type: str) -> Any:
-    """Generates a type-friendly Resource field.
-
-    .. deprecated: 1.30.0
-
-    """
-    return Resource(resource_type)
-
-
-# This class takes a similar approach to the cryptography project to deprecate attributes
-# in public modules. See the _ModuleWithDeprecation class here:
-# https://github.com/pyca/cryptography/blob/91105952739442a74582d3e62b3d2111365b0dc7/src/cryptography/utils.py#L129
-class _FieldsDeprecationModule: # pragma: no cover
-    """
-    Internal class delegating to a module, and displaying warnings when
-    module attributes deprecated in acme.fields are accessed.
-    """
-    def __init__(self, module: ModuleType) -> None:
-        self.__dict__['_module'] = module
-
-    def __getattr__(self, attr: str) -> None:
-        if attr in ('Resource', 'resource'):
-            warnings.warn('{0} attribute in acme.fields module is deprecated '
-                          'and will be removed soon.'.format(attr),
-                          DeprecationWarning, stacklevel=2)
-        return getattr(self._module, attr)
-
-    def __setattr__(self, attr: str, value: Any) -> None:
-        setattr(self._module, attr, value)
-
-    def __delattr__(self, attr: str) -> None:
-        delattr(self._module, attr)
-
-    def __dir__(self) -> List[str]:
-        return ['_module'] + dir(self._module)
-
-
-sys.modules[__name__] = cast(ModuleType, _FieldsDeprecationModule(sys.modules[__name__]))

acme/acme/magic_typing.py

@@ -1,18 +0,0 @@
-"""Simple shim around the typing module.
-
-This was useful when this code supported Python 2 and typing wasn't always
-available. This code is being kept for now for backwards compatibility.
-
-"""
-import warnings
-from typing import *  # pylint: disable=wildcard-import, unused-wildcard-import
-from typing import Any
-
-warnings.warn("acme.magic_typing is deprecated and will be removed in a future release.",
-              DeprecationWarning)
-
-
-class TypingClass:
-    """Ignore import errors by getting anything"""
-    def __getattr__(self, name: str) -> Any:
-        return None  # pragma: no cover

acme/acme/messages.py

@@ -2,9 +2,7 @@
 import datetime
 from collections.abc import Hashable
 import json
-from types import ModuleType
 from typing import Any
-from typing import cast
 from typing import Dict
 from typing import Iterator
 from typing import List
@@ -13,11 +11,7 @@ from typing import MutableMapping
 from typing import Optional
 from typing import Tuple
 from typing import Type
-from typing import TYPE_CHECKING
 from typing import TypeVar
-from typing import Union
-import sys
-import warnings
 
 import josepy as jose
 
@@ -26,16 +20,8 @@ from acme import errors
 from acme import fields
 from acme import jws
 from acme import util
-with warnings.catch_warnings():
-    warnings.filterwarnings("ignore", ".*acme.mixins", category=DeprecationWarning)
-    from acme.mixins import ResourceMixin
 
-if TYPE_CHECKING:
-    from typing_extensions import Protocol  # pragma: no cover
-else:
-    Protocol = object
 
-OLD_ERROR_PREFIX = "urn:acme:error:"
 ERROR_PREFIX = "urn:ietf:params:acme:error:"
 
 ERROR_CODES = {
@@ -73,15 +59,13 @@ ERROR_CODES = {
 
 ERROR_TYPE_DESCRIPTIONS = {**{
     ERROR_PREFIX + name: desc for name, desc in ERROR_CODES.items()
-}, **{  # add errors with old prefix, deprecate me
-    OLD_ERROR_PREFIX + name: desc for name, desc in ERROR_CODES.items()
 }}
 
 
 def is_acme_error(err: BaseException) -> bool:
     """Check if argument is an ACME error."""
     if isinstance(err, Error) and (err.typ is not None):
-        return (ERROR_PREFIX in err.typ) or (OLD_ERROR_PREFIX in err.typ)
+        return ERROR_PREFIX in err.typ
     return False
 
 
@@ -229,25 +213,15 @@ STATUS_READY = Status('ready')
 STATUS_DEACTIVATED = Status('deactivated')
 
 
-class HasResourceType(Protocol):
-    """
-    Represents a class with a resource_type class parameter of type string.
-    """
-    resource_type: str = NotImplemented
-
-
-GenericHasResourceType = TypeVar("GenericHasResourceType", bound=HasResourceType)
-
-
 class Directory(jose.JSONDeSerializable):
-    """Directory."""
+    """Directory.
 
-    _REGISTERED_TYPES: Dict[str, Type[HasResourceType]] = {}
+    Directory resources must be accessed by the exact field name in RFC8555 (section 9.7.5).
+    """
 
     class Meta(jose.JSONObjectWithFields):
         """Directory Meta."""
-        _terms_of_service: str = jose.field('terms-of-service', omitempty=True)
-        _terms_of_service_v2: str = jose.field('termsOfService', omitempty=True)
+        _terms_of_service: str = jose.field('termsOfService', omitempty=True)
         website: str = jose.field('website', omitempty=True)
         caa_identities: List[str] = jose.field('caaIdentities', omitempty=True)
         external_account_required: bool = jose.field('externalAccountRequired', omitempty=True)
@@ -259,7 +233,7 @@ class Directory(jose.JSONDeSerializable):
         @property
         def terms_of_service(self) -> str:
             """URL for the CA TOS"""
-            return self._terms_of_service or self._terms_of_service_v2
+            return self._terms_of_service
 
         def __iter__(self) -> Iterator[str]:
             # When iterating over fields, use the external name 'terms_of_service' instead of
@@ -270,51 +244,23 @@ class Directory(jose.JSONDeSerializable):
         def _internal_name(self, name: str) -> str:
             return '_' + name if name == 'terms_of_service' else name
 
-    @classmethod
-    def _canon_key(cls, key: Union[str, HasResourceType, Type[HasResourceType]]) -> str:
-        if isinstance(key, str):
-            return key
-        return key.resource_type
-
-    @classmethod
-    def register(cls,
-                 resource_body_cls: Type[GenericHasResourceType]) -> Type[GenericHasResourceType]:
-        """Register resource."""
-        warnings.warn(
-            "acme.messages.Directory.register is deprecated and will be removed in the next "
-            "major release of Certbot", DeprecationWarning, stacklevel=2
-        )
-        resource_type = resource_body_cls.resource_type
-        assert resource_type not in cls._REGISTERED_TYPES
-        cls._REGISTERED_TYPES[resource_type] = resource_body_cls
-        return resource_body_cls
-
     def __init__(self, jobj: Mapping[str, Any]) -> None:
-        canon_jobj = util.map_keys(jobj, self._canon_key)
-        # TODO: check that everything is an absolute URL; acme-spec is
-        # not clear on that
-        self._jobj = canon_jobj
+        self._jobj = jobj
 
     def __getattr__(self, name: str) -> Any:
         try:
-            return self[name.replace('_', '-')]
+            return self[name]
         except KeyError as error:
             raise AttributeError(str(error))
 
-    def __getitem__(self, name: Union[str, HasResourceType, Type[HasResourceType]]) -> Any:
-        if not isinstance(name, str):
-            warnings.warn(
-                "Looking up acme.messages.Directory resources by non-string keys is deprecated "
-                "and will be removed in the next major release of Certbot",
-                DeprecationWarning, stacklevel=2
-            )
+    def __getitem__(self, name: str) -> Any:
         try:
-            return self._jobj[self._canon_key(name)]
+            return self._jobj[name]
         except KeyError:
-            raise KeyError('Directory field "' + self._canon_key(name) + '" not found')
+            raise KeyError(f'Directory field "{name}" not found')
 
     def to_partial_json(self) -> Dict[str, Any]:
-        return self._jobj
+        return util.map_keys(self._jobj, lambda k: k)
 
     @classmethod
     def from_json(cls, jobj: MutableMapping[str, Any]) -> 'Directory':
@@ -475,6 +421,14 @@ class Registration(ResourceBody):
         return self._filter_contact(self.email_prefix)
 
 
+class NewRegistration(Registration):
+    """New registration."""
+
+
+class UpdateRegistration(Registration):
+    """Update registration."""
+
+
 class RegistrationResource(ResourceWithURI):
     """Registration Resource.
 
@@ -510,7 +464,6 @@ class ChallengeBody(ResourceBody):
     # challenge object supports either one, but should be accessed through the
     # name "uri". In Client.answer_challenge, whichever one is set will be
     # used.
-    _uri: str = jose.field('uri', omitempty=True, default=None)
     _url: str = jose.field('url', omitempty=True, default=None)
     status: Status = jose.field('status', decoder=Status.from_json,
                         omitempty=True, default=STATUS_PENDING)
@@ -539,7 +492,7 @@ class ChallengeBody(ResourceBody):
     @property
     def uri(self) -> str:
         """The URL of this challenge."""
-        return self._url or self._uri
+        return self._url
 
     def __getattr__(self, name: str) -> Any:
         return getattr(self.chall, name)
@@ -548,10 +501,10 @@ class ChallengeBody(ResourceBody):
         # When iterating over fields, use the external name 'uri' instead of
         # the internal '_uri'.
         for name in super().__iter__():
-            yield name[1:] if name == '_uri' else name
+            yield 'uri' if name == '_url' else name
 
     def _internal_name(self, name: str) -> str:
-        return '_' + name if name == 'uri' else name
+        return '_url' if name == 'uri' else name
 
 
 class ChallengeResource(Resource):
@@ -575,15 +528,12 @@ class Authorization(ResourceBody):
 
     :ivar acme.messages.Identifier identifier:
     :ivar list challenges: `list` of `.ChallengeBody`
-    :ivar tuple combinations: Challenge combinations (`tuple` of `tuple`
-        of `int`, as opposed to `list` of `list` from the spec). (deprecated since 1.30.0)
     :ivar acme.messages.Status status:
     :ivar datetime.datetime expires:
 
     """
     identifier: Identifier = jose.field('identifier', decoder=Identifier.from_json, omitempty=True)
     challenges: List[ChallengeBody] = jose.field('challenges', omitempty=True)
-    _combinations: Tuple[Tuple[int, ...], ...] = jose.field('combinations', omitempty=True)
 
     status: Status = jose.field('status', omitempty=True, decoder=Status.from_json)
     # TODO: 'expires' is allowed for Authorization Resources in
@@ -593,53 +543,19 @@ class Authorization(ResourceBody):
     expires: datetime.datetime = fields.rfc3339('expires', omitempty=True)
     wildcard: bool = jose.field('wildcard', omitempty=True)
 
-    # combinations is temporarily renamed to _combinations during its deprecation
-    # period. See https://github.com/certbot/certbot/pull/9369#issuecomment-1199849262.
-    def __init__(self, **kwargs: Any) -> None:
-        if 'combinations' in kwargs:
-            kwargs['_combinations'] = kwargs.pop('combinations')
-        super().__init__(**kwargs)
-
     # Mypy does not understand the josepy magic happening here, and falsely claims
     # that challenge is redefined. Let's ignore the type check here.
     @challenges.decoder  # type: ignore
     def challenges(value: List[Dict[str, Any]]) -> Tuple[ChallengeBody, ...]:  # pylint: disable=no-self-argument,missing-function-docstring
         return tuple(ChallengeBody.from_json(chall) for chall in value)
 
-    @property
-    def combinations(self) -> Tuple[Tuple[int, ...], ...]:
-        """Challenge combinations.
-        (`tuple` of `tuple` of `int`, as opposed to `list` of `list` from the spec).
 
-        .. deprecated: 1.30.0
+class NewAuthorization(Authorization):
+    """New authorization."""
 
-        """
-        warnings.warn(
-            "acme.messages.Authorization.combinations is deprecated and will be "
-            "removed in a future release.", DeprecationWarning, stacklevel=2)
-        return self._combinations
 
-    @combinations.setter
-    def combinations(self, combos: Tuple[Tuple[int, ...], ...]) -> None: # pragma: no cover
-        warnings.warn(
-            "acme.messages.Authorization.combinations is deprecated and will be "
-            "removed in a future release.", DeprecationWarning, stacklevel=2)
-        self._combinations = combos
-
-    @property
-    def resolved_combinations(self) -> Tuple[Tuple[ChallengeBody, ...], ...]:
-        """Combinations with challenges instead of indices.
-
-        .. deprecated: 1.30.0
-
-        """
-        warnings.warn(
-            "acme.messages.Authorization.resolved_combinations is deprecated and will be "
-            "removed in a future release.", DeprecationWarning, stacklevel=2)
-        with warnings.catch_warnings():
-            warnings.filterwarnings('ignore', '.*combinations', DeprecationWarning)
-            return tuple(tuple(self.challenges[idx] for idx in combo)
-                        for combo in self.combinations)  # pylint: disable=not-an-iterable
+class UpdateAuthorization(Authorization):
+    """Update authorization."""
 
 
 class AuthorizationResource(ResourceWithURI):
@@ -653,6 +569,16 @@ class AuthorizationResource(ResourceWithURI):
     new_cert_uri: str = jose.field('new_cert_uri', omitempty=True)
 
 
+class CertificateRequest(jose.JSONObjectWithFields):
+    """ACME newOrder request.
+
+    :ivar jose.ComparableX509 csr:
+        `OpenSSL.crypto.X509Req` wrapped in `.ComparableX509`
+
+    """
+    csr: jose.ComparableX509 = jose.field('csr', decoder=jose.decode_csr, encoder=jose.encode_csr)
+
+
 class CertificateResource(ResourceWithURI):
     """Certificate Resource.
 
@@ -666,6 +592,18 @@ class CertificateResource(ResourceWithURI):
     authzrs: Tuple[AuthorizationResource, ...] = jose.field('authzrs')
 
 
+class Revocation(jose.JSONObjectWithFields):
+    """Revocation message.
+
+    :ivar jose.ComparableX509 certificate: `OpenSSL.crypto.X509` wrapped in
+        `jose.ComparableX509`
+
+    """
+    certificate: jose.ComparableX509 = jose.field(
+        'certificate', decoder=jose.decode_cert, encoder=jose.encode_cert)
+    reason: int = jose.field('reason')
+
+
 class Order(ResourceBody):
     """Order Resource Body.
 
@@ -717,98 +655,5 @@ class OrderResource(ResourceWithURI):
                                                        omitempty=True)
 
 
-with warnings.catch_warnings():
-    warnings.filterwarnings("ignore", "acme.messages.Directory.register", DeprecationWarning)
-    warnings.filterwarnings("ignore", "resource attribute in acme.fields", DeprecationWarning)
-
-    @Directory.register
-    class NewOrder(Order):
-        """New order."""
-        resource_type = 'new-order'
-
-
-    @Directory.register
-    class Revocation(ResourceMixin, jose.JSONObjectWithFields):
-        """Revocation message.
-
-        :ivar jose.ComparableX509 certificate: `OpenSSL.crypto.X509` wrapped in
-            `jose.ComparableX509`
-
-        """
-        resource_type = 'revoke-cert'
-        resource: str = fields.resource(resource_type)
-        certificate: jose.ComparableX509 = jose.field(
-            'certificate', decoder=jose.decode_cert, encoder=jose.encode_cert)
-        reason: int = jose.field('reason')
-
-
-    @Directory.register
-    class CertificateRequest(ResourceMixin, jose.JSONObjectWithFields):
-        """ACME new-cert request.
-
-        :ivar jose.ComparableX509 csr:
-            `OpenSSL.crypto.X509Req` wrapped in `.ComparableX509`
-
-        """
-        resource_type = 'new-cert'
-        resource: str = fields.resource(resource_type)
-        csr: jose.ComparableX509 = jose.field('csr', decoder=jose.decode_csr,
-                                                encoder=jose.encode_csr)
-
-
-    @Directory.register
-    class NewAuthorization(ResourceMixin, Authorization):
-        """New authorization."""
-        resource_type = 'new-authz'
-        resource: str = fields.resource(resource_type)
-
-
-    class UpdateAuthorization(ResourceMixin, Authorization):
-        """Update authorization."""
-        resource_type = 'authz'
-        resource: str = fields.resource(resource_type)
-
-
-    @Directory.register
-    class NewRegistration(ResourceMixin, Registration):
-        """New registration."""
-        resource_type = 'new-reg'
-        resource: str = fields.resource(resource_type)
-
-
-    class UpdateRegistration(ResourceMixin, Registration):
-        """Update registration."""
-        resource_type = 'reg'
-        resource: str = fields.resource(resource_type)
-
-
-# This class takes a similar approach to the cryptography project to deprecate attributes
-# in public modules. See the _ModuleWithDeprecation class here:
-# https://github.com/pyca/cryptography/blob/91105952739442a74582d3e62b3d2111365b0dc7/src/cryptography/utils.py#L129
-class _MessagesDeprecationModule: # pragma: no cover
-    """
-    Internal class delegating to a module, and displaying warnings when
-    module attributes deprecated in acme.messages are accessed.
-    """
-    def __init__(self, module: ModuleType) -> None:
-        self.__dict__['_module'] = module
-
-    def __getattr__(self, attr: str) -> None:
-        if attr == 'OLD_ERROR_PREFIX':
-            warnings.warn('{0} attribute in acme.messages module is deprecated '
-                          'and will be removed soon.'.format(attr),
-                          DeprecationWarning, stacklevel=2)
-        return getattr(self._module, attr)
-
-    def __setattr__(self, attr: str, value: Any) -> None:
-        setattr(self._module, attr, value)
-
-    def __delattr__(self, attr: str) -> None:
-        delattr(self._module, attr)
-
-    def __dir__(self) -> List[str]:
-        return ['_module'] + dir(self._module)
-
-
-# Patching ourselves to warn about acme.messages.OLD_ERROR_PREFIX deprecation and planned removal.
-sys.modules[__name__] = cast(ModuleType, _MessagesDeprecationModule(sys.modules[__name__]))
+class NewOrder(Order):
+    """New order."""

acme/acme/mixins.py

@@ -1,72 +0,0 @@
-"""Useful mixins for Challenge and Resource objects"""
-from typing import Any
-from typing import Dict
-import warnings
-
-warnings.warn(f'The module {__name__} is deprecated and will be removed in a future release',
-              DeprecationWarning, stacklevel=2)
-
-
-class VersionedLEACMEMixin:
-    """This mixin stores the version of Let's Encrypt's endpoint being used."""
-    @property
-    def le_acme_version(self) -> int:
-        """Define the version of ACME protocol to use"""
-        return getattr(self, '_le_acme_version', 1)
-
-    @le_acme_version.setter
-    def le_acme_version(self, version: int) -> None:
-        # We need to use object.__setattr__ to not depend on the specific implementation of
-        # __setattr__  in current class (eg. jose.TypedJSONObjectWithFields raises AttributeError
-        # for any attempt to set an attribute to make objects immutable).
-        object.__setattr__(self, '_le_acme_version', version)
-
-    def __setattr__(self, key: str, value: Any) -> None:
-        if key == 'le_acme_version':
-            # Required for @property to operate properly. See comment above.
-            object.__setattr__(self, key, value)
-        else:
-            super().__setattr__(key, value)  # pragma: no cover
-
-
-class ResourceMixin(VersionedLEACMEMixin):
-    """
-    This mixin generates a RFC8555 compliant JWS payload
-    by removing the `resource` field if needed (eg. ACME v2 protocol).
-    """
-    def to_partial_json(self) -> Dict[str, Any]:
-        """See josepy.JSONDeserializable.to_partial_json()"""
-        return _safe_jobj_compliance(super(),
-                                     'to_partial_json', 'resource')
-
-    def fields_to_partial_json(self) -> Dict[str, Any]:
-        """See josepy.JSONObjectWithFields.fields_to_partial_json()"""
-        return _safe_jobj_compliance(super(),
-                                     'fields_to_partial_json', 'resource')
-
-
-class TypeMixin(VersionedLEACMEMixin):
-    """
-    This mixin allows generation of a RFC8555 compliant JWS payload
-    by removing the `type` field if needed (eg. ACME v2 protocol).
-    """
-    def to_partial_json(self) -> Dict[str, Any]:
-        """See josepy.JSONDeserializable.to_partial_json()"""
-        return _safe_jobj_compliance(super(),
-                                     'to_partial_json', 'type')
-
-    def fields_to_partial_json(self) -> Dict[str, Any]:
-        """See josepy.JSONObjectWithFields.fields_to_partial_json()"""
-        return _safe_jobj_compliance(super(),
-                                     'fields_to_partial_json', 'type')
-
-
-def _safe_jobj_compliance(instance: Any, jobj_method: str,
-                          uncompliant_field: str) -> Dict[str, Any]:
-    if hasattr(instance, jobj_method):
-        jobj: Dict[str, Any] = getattr(instance, jobj_method)()
-        if instance.le_acme_version == 2:
-            jobj.pop(uncompliant_field, None)
-        return jobj
-
-    raise AttributeError(f'Method {jobj_method}() is not implemented.')  # pragma: no cover

acme/examples/http01_example.py

@@ -163,7 +163,7 @@ def example_http():
     # Register account and accept TOS
 
     net = client.ClientNetwork(acc_key, user_agent=USER_AGENT)
-    directory = messages.Directory.from_json(net.get(DIRECTORY_URL).json())
+    directory = client.ClientV2.get_directory(DIRECTORY_URL, net)
     client_acme = client.ClientV2(directory, net=net)
 
     # Terms of Service URL is in client_acme.directory.meta.terms_of_service
@@ -215,8 +215,7 @@ def example_http():
     try:
         regr = client_acme.query_registration(regr)
     except errors.Error as err:
-        if err.typ == messages.OLD_ERROR_PREFIX + 'unauthorized' \
-                or err.typ == messages.ERROR_PREFIX + 'unauthorized':
+        if err.typ == messages.ERROR_PREFIX + 'unauthorized':
             # Status is deactivated.
             pass
         raise

acme/setup.py

@@ -3,7 +3,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'cryptography>=2.5.0',
@@ -12,7 +12,6 @@ install_requires = [
     'pyrfc3339',
     'pytz>=2019.3',
     'requests>=2.20.0',
-    'requests-toolbelt>=0.3.0',
     'setuptools>=41.6.0',
 ]
 
@@ -46,6 +45,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
     ],

acme/tests/challenges_test.py

@@ -92,8 +92,7 @@ class DNS01ResponseTest(unittest.TestCase):
         self.response = self.chall.response(KEY)
 
     def test_to_partial_json(self):
-        self.assertEqual({k: v for k, v in self.jmsg.items() if k != 'keyAuthorization'},
-                         self.msg.to_partial_json())
+        self.assertEqual({}, self.msg.to_partial_json())
 
     def test_from_json(self):
         from acme.challenges import DNS01Response
@@ -163,8 +162,7 @@ class HTTP01ResponseTest(unittest.TestCase):
         self.response = self.chall.response(KEY)
 
     def test_to_partial_json(self):
-        self.assertEqual({k: v for k, v in self.jmsg.items() if k != 'keyAuthorization'},
-                         self.msg.to_partial_json())
+        self.assertEqual({}, self.msg.to_partial_json())
 
     def test_from_json(self):
         from acme.challenges import HTTP01Response
@@ -185,7 +183,8 @@ class HTTP01ResponseTest(unittest.TestCase):
         mock_get.return_value = mock.MagicMock(text=validation)
         self.assertTrue(self.response.simple_verify(
             self.chall, "local", KEY.public_key()))
-        mock_get.assert_called_once_with(self.chall.uri("local"), verify=False)
+        mock_get.assert_called_once_with(self.chall.uri("local"), verify=False,
+                                         timeout=mock.ANY)
 
     @mock.patch("acme.challenges.requests.get")
     def test_simple_verify_bad_validation(self, mock_get):
@@ -201,7 +200,8 @@ class HTTP01ResponseTest(unittest.TestCase):
                   HTTP01Response.WHITESPACE_CUTSET))
         self.assertTrue(self.response.simple_verify(
             self.chall, "local", KEY.public_key()))
-        mock_get.assert_called_once_with(self.chall.uri("local"), verify=False)
+        mock_get.assert_called_once_with(self.chall.uri("local"), verify=False,
+                                         timeout=mock.ANY)
 
     @mock.patch("acme.challenges.requests.get")
     def test_simple_verify_connection_error(self, mock_get):
@@ -217,6 +217,16 @@ class HTTP01ResponseTest(unittest.TestCase):
         self.assertEqual("local:8080", urllib_parse.urlparse(
             mock_get.mock_calls[0][1][0]).netloc)
 
+    @mock.patch("acme.challenges.requests.get")
+    def test_simple_verify_timeout(self, mock_get):
+        self.response.simple_verify(self.chall, "local", KEY.public_key())
+        mock_get.assert_called_once_with(self.chall.uri("local"), verify=False,
+                                         timeout=30)
+        mock_get.reset_mock()
+        self.response.simple_verify(self.chall, "local", KEY.public_key(), timeout=1234)
+        mock_get.assert_called_once_with(self.chall.uri("local"), verify=False,
+                                         timeout=1234)
+
 
 class HTTP01Test(unittest.TestCase):
 
@@ -274,8 +284,7 @@ class TLSALPN01ResponseTest(unittest.TestCase):
         }
 
     def test_to_partial_json(self):
-        self.assertEqual({k: v for k, v in self.jmsg.items() if k != 'keyAuthorization'},
-                         self.response.to_partial_json())
+        self.assertEqual({}, self.response.to_partial_json())
 
     def test_from_json(self):
         from acme.challenges import TLSALPN01Response
@@ -461,8 +470,6 @@ class DNSResponseTest(unittest.TestCase):
         from acme.challenges import DNSResponse
         self.msg = DNSResponse(validation=self.validation)
         self.jmsg_to = {
-            'resource': 'challenge',
-            'type': 'dns',
             'validation': self.validation,
         }
         self.jmsg_from = {
@@ -492,7 +499,6 @@ class JWSPayloadRFC8555Compliant(unittest.TestCase):
         from acme.challenges import HTTP01Response
 
         challenge_body = HTTP01Response()
-        challenge_body.le_acme_version = 2
 
         jobj = challenge_body.json_dumps(indent=2).encode()
         # RFC8555 states that challenge responses must have an empty payload.

acme/tests/client_test.py

@@ -7,10 +7,8 @@ import json
 import unittest
 from typing import Dict
 from unittest import mock
-import warnings
 
 import josepy as jose
-import OpenSSL
 import requests
 
 from acme import challenges
@@ -19,44 +17,24 @@ from acme import jws as acme_jws
 from acme import messages
 from acme.client import ClientNetwork
 from acme.client import ClientV2
-from acme.mixins import VersionedLEACMEMixin
 import messages_test
 import test_util
-# Remove the following in Certbot 2.0:
-with warnings.catch_warnings():
-    warnings.filterwarnings('ignore', '.* in acme.client', DeprecationWarning)
-    from acme.client import BackwardsCompatibleClientV2
-    from acme.client import Client
 
-
-CERT_DER = test_util.load_vector('cert.der')
 CERT_SAN_PEM = test_util.load_vector('cert-san.pem')
-CSR_SAN_PEM = test_util.load_vector('csr-san.pem')
 CSR_MIXED_PEM = test_util.load_vector('csr-mixed.pem')
 KEY = jose.JWKRSA.load(test_util.load_vector('rsa512_key.pem'))
-KEY2 = jose.JWKRSA.load(test_util.load_vector('rsa256_key.pem'))
-
-DIRECTORY_V1 = messages.Directory({
-    messages.NewRegistration:
-        'https://www.letsencrypt-demo.org/acme/new-reg',
-    messages.Revocation:
-        'https://www.letsencrypt-demo.org/acme/revoke-cert',
-    messages.NewAuthorization:
-        'https://www.letsencrypt-demo.org/acme/new-authz',
-    messages.CertificateRequest:
-        'https://www.letsencrypt-demo.org/acme/new-cert',
-})
 
 DIRECTORY_V2 = messages.Directory({
     'newAccount': 'https://www.letsencrypt-demo.org/acme/new-account',
     'newNonce': 'https://www.letsencrypt-demo.org/acme/new-nonce',
     'newOrder': 'https://www.letsencrypt-demo.org/acme/new-order',
     'revokeCert': 'https://www.letsencrypt-demo.org/acme/revoke-cert',
+    'meta': messages.Directory.Meta(),
 })
 
 
-class ClientTestBase(unittest.TestCase):
-    """Base for tests in acme.client."""
+class ClientV2Test(unittest.TestCase):
+    """Tests for acme.client.ClientV2."""
 
     def setUp(self):
         self.response = mock.MagicMock(
@@ -88,651 +66,13 @@ class ClientTestBase(unittest.TestCase):
         self.authz = messages.Authorization(
             identifier=messages.Identifier(
                 typ=messages.IDENTIFIER_FQDN, value='example.com'),
-            challenges=(challb,), combinations=None)
+            challenges=(challb,))
         self.authzr = messages.AuthorizationResource(
             body=self.authz, uri=authzr_uri)
 
         # Reason code for revocation
         self.rsn = 1
 
-class BackwardsCompatibleClientV2Test(ClientTestBase):
-    """Tests for  acme.client.BackwardsCompatibleClientV2."""
-
-    def setUp(self):
-        super().setUp()
-
-        # For some reason, required to suppress warnings on mock.patch('acme.client.Client')
-        self.warning_cap = warnings.catch_warnings()
-        self.warning_cap.__enter__()
-        warnings.filterwarnings('ignore', '.*acme.client', DeprecationWarning)
-
-        # contains a loaded cert
-        self.certr = messages.CertificateResource(
-            body=messages_test.CERT)
-
-        loaded = OpenSSL.crypto.load_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, CERT_SAN_PEM)
-        wrapped = jose.ComparableX509(loaded)
-        self.chain = [wrapped, wrapped]
-
-        self.cert_pem = OpenSSL.crypto.dump_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, messages_test.CERT.wrapped).decode()
-
-        single_chain = OpenSSL.crypto.dump_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, loaded).decode()
-        self.chain_pem = single_chain + single_chain
-
-        self.fullchain_pem = self.cert_pem + self.chain_pem
-
-        self.orderr = messages.OrderResource(
-            csr_pem=CSR_SAN_PEM)
-
-    def tearDown(self) -> None:
-        self.warning_cap.__exit__()
-        return super().tearDown()
-
-    def _init(self):
-        uri = 'http://www.letsencrypt-demo.org/directory'
-        return BackwardsCompatibleClientV2(net=self.net,
-            key=KEY, server=uri)
-
-    def test_init_downloads_directory(self):
-        uri = 'http://www.letsencrypt-demo.org/directory'
-        BackwardsCompatibleClientV2(net=self.net,
-            key=KEY, server=uri)
-        self.net.get.assert_called_once_with(uri)
-
-    def test_init_acme_version(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        client = self._init()
-        self.assertEqual(client.acme_version, 1)
-
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        client = self._init()
-        self.assertEqual(client.acme_version, 2)
-
-    def test_query_registration_client_v2(self):
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        client = self._init()
-        self.response.json.return_value = self.regr.body.to_json()
-        self.response.headers = {'Location': 'https://www.letsencrypt-demo.org/acme/reg/1'}
-        self.assertEqual(self.regr, client.query_registration(self.regr))
-
-    def test_forwarding(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        client = self._init()
-        self.assertEqual(client.directory, client.client.directory)
-        self.assertEqual(client.key, KEY)
-        self.assertEqual(client.deactivate_registration, client.client.deactivate_registration)
-        self.assertRaises(AttributeError, client.__getattr__, 'nonexistent')
-        self.assertRaises(AttributeError, client.__getattr__, 'new_account_and_tos')
-        self.assertRaises(AttributeError, client.__getattr__, 'new_account')
-
-    def test_new_account_and_tos(self):
-        # v2 no tos
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.new_account_and_tos(self.new_reg)
-            mock_client().new_account.assert_called_with(self.new_reg)
-
-        # v2 tos good
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            mock_client().directory.meta.__contains__.return_value = True
-            client = self._init()
-            client.new_account_and_tos(self.new_reg, lambda x: True)
-            mock_client().new_account.assert_called_with(
-                self.new_reg.update(terms_of_service_agreed=True))
-
-        # v2 tos bad
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            mock_client().directory.meta.__contains__.return_value = True
-            client = self._init()
-            def _tos_cb(tos):
-                raise errors.Error
-            self.assertRaises(errors.Error, client.new_account_and_tos,
-                self.new_reg, _tos_cb)
-            mock_client().new_account.assert_not_called()
-
-        # v1 yes tos
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        with mock.patch('acme.client.Client') as mock_client:
-            regr = mock.MagicMock(terms_of_service="TOS")
-            mock_client().register.return_value = regr
-            client = self._init()
-            client.new_account_and_tos(self.new_reg)
-            mock_client().register.assert_called_once_with(self.new_reg)
-            mock_client().agree_to_tos.assert_called_once_with(regr)
-
-        # v1 no tos
-        with mock.patch('acme.client.Client') as mock_client:
-            regr = mock.MagicMock(terms_of_service=None)
-            mock_client().register.return_value = regr
-            client = self._init()
-            client.new_account_and_tos(self.new_reg)
-            mock_client().register.assert_called_once_with(self.new_reg)
-            mock_client().agree_to_tos.assert_not_called()
-
-    @mock.patch('OpenSSL.crypto.load_certificate_request')
-    @mock.patch('acme.crypto_util._pyopenssl_cert_or_req_all_names')
-    def test_new_order_v1(self, mock__pyopenssl_cert_or_req_all_names,
-        unused_mock_load_certificate_request):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        mock__pyopenssl_cert_or_req_all_names.return_value = ['example.com', 'www.example.com']
-        mock_csr_pem = mock.MagicMock()
-        with mock.patch('acme.client.Client') as mock_client:
-            mock_client().request_domain_challenges.return_value = mock.sentinel.auth
-            client = self._init()
-            orderr = client.new_order(mock_csr_pem)
-            self.assertEqual(orderr.authorizations, [mock.sentinel.auth, mock.sentinel.auth])
-
-    def test_new_order_v2(self):
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        mock_csr_pem = mock.MagicMock()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.new_order(mock_csr_pem)
-            mock_client().new_order.assert_called_once_with(mock_csr_pem)
-
-    @mock.patch('acme.client.Client')
-    def test_finalize_order_v1_success(self, mock_client):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-
-        mock_client().request_issuance.return_value = self.certr
-        mock_client().fetch_chain.return_value = self.chain
-
-        deadline = datetime.datetime(9999, 9, 9)
-        client = self._init()
-        result = client.finalize_order(self.orderr, deadline)
-        self.assertEqual(result.fullchain_pem, self.fullchain_pem)
-        mock_client().fetch_chain.assert_called_once_with(self.certr)
-
-    @mock.patch('acme.client.Client')
-    def test_finalize_order_v1_fetch_chain_error(self, mock_client):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-
-        mock_client().request_issuance.return_value = self.certr
-        mock_client().fetch_chain.return_value = self.chain
-        mock_client().fetch_chain.side_effect = [errors.Error, self.chain]
-
-        deadline = datetime.datetime(9999, 9, 9)
-        client = self._init()
-        result = client.finalize_order(self.orderr, deadline)
-        self.assertEqual(result.fullchain_pem, self.fullchain_pem)
-        self.assertEqual(mock_client().fetch_chain.call_count, 2)
-
-    @mock.patch('acme.client.Client')
-    def test_finalize_order_v1_timeout(self, mock_client):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-
-        mock_client().request_issuance.return_value = self.certr
-
-        deadline = deadline = datetime.datetime.now() - datetime.timedelta(seconds=60)
-        client = self._init()
-        self.assertRaises(errors.TimeoutError, client.finalize_order,
-            self.orderr, deadline)
-
-    def test_finalize_order_v2(self):
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        mock_orderr = mock.MagicMock()
-        mock_deadline = mock.MagicMock()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.finalize_order(mock_orderr, mock_deadline)
-            mock_client().finalize_order.assert_called_once_with(mock_orderr, mock_deadline, False)
-
-    def test_revoke(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        with mock.patch('acme.client.Client') as mock_client:
-            client = self._init()
-            client.revoke(messages_test.CERT, self.rsn)
-        mock_client().revoke.assert_called_once_with(messages_test.CERT, self.rsn)
-
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.revoke(messages_test.CERT, self.rsn)
-        mock_client().revoke.assert_called_once_with(messages_test.CERT, self.rsn)
-
-    def test_update_registration(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        with mock.patch('acme.client.Client') as mock_client:
-            client = self._init()
-            client.update_registration(mock.sentinel.regr, None)
-        mock_client().update_registration.assert_called_once_with(mock.sentinel.regr, None)
-
-    # newNonce present means it will pick acme_version 2
-    def test_external_account_required_true(self):
-        self.response.json.return_value = messages.Directory({
-            'newNonce': 'http://letsencrypt-test.com/acme/new-nonce',
-            'meta': messages.Directory.Meta(external_account_required=True),
-        }).to_json()
-
-        client = self._init()
-
-        self.assertTrue(client.external_account_required())
-
-    # newNonce present means it will pick acme_version 2
-    def test_external_account_required_false(self):
-        self.response.json.return_value = messages.Directory({
-            'newNonce': 'http://letsencrypt-test.com/acme/new-nonce',
-            'meta': messages.Directory.Meta(external_account_required=False),
-        }).to_json()
-
-        client = self._init()
-
-        self.assertFalse(client.external_account_required())
-
-    def test_external_account_required_false_v1(self):
-        self.response.json.return_value = messages.Directory({
-            'meta': messages.Directory.Meta(external_account_required=False),
-        }).to_json()
-
-        client = self._init()
-
-        self.assertFalse(client.external_account_required())
-
-
-class ClientTest(ClientTestBase):
-    """Tests for acme.client.Client."""
-
-    def setUp(self):
-        super().setUp()
-
-        self.directory = DIRECTORY_V1
-
-        # Registration
-        self.regr = self.regr.update(
-            terms_of_service='https://www.letsencrypt-demo.org/tos')
-
-        # Request issuance
-        self.certr = messages.CertificateResource(
-            body=messages_test.CERT, authzrs=(self.authzr,),
-            uri='https://www.letsencrypt-demo.org/acme/cert/1',
-            cert_chain_uri='https://www.letsencrypt-demo.org/ca')
-
-        self.client = Client(
-            directory=self.directory, key=KEY, alg=jose.RS256, net=self.net)
-
-    def test_init_downloads_directory(self):
-        uri = 'http://www.letsencrypt-demo.org/directory'
-        self.client = Client(
-            directory=uri, key=KEY, alg=jose.RS256, net=self.net)
-        self.net.get.assert_called_once_with(uri)
-
-    @mock.patch('acme.client.ClientNetwork')
-    def test_init_without_net(self, mock_net):
-        mock_net.return_value = mock.sentinel.net
-        alg = jose.RS256
-        self.client = Client(
-            directory=self.directory, key=KEY, alg=alg)
-        mock_net.called_once_with(KEY, alg=alg, verify_ssl=True)
-        self.assertEqual(self.client.net, mock.sentinel.net)
-
-    def test_register(self):
-        # "Instance of 'Field' has no to_json/update member" bug:
-        self.response.status_code = http_client.CREATED
-        self.response.json.return_value = self.regr.body.to_json()
-        self.response.headers['Location'] = self.regr.uri
-        self.response.links.update({
-            'terms-of-service': {'url': self.regr.terms_of_service},
-        })
-
-        self.assertEqual(self.regr, self.client.register(self.new_reg))
-        # TODO: test POST call arguments
-
-    def test_update_registration(self):
-        # "Instance of 'Field' has no to_json/update member" bug:
-        self.response.headers['Location'] = self.regr.uri
-        self.response.json.return_value = self.regr.body.to_json()
-        self.assertEqual(self.regr, self.client.update_registration(self.regr))
-        # TODO: test POST call arguments
-
-        # TODO: split here and separate test
-        self.response.json.return_value = self.regr.body.update(
-            contact=()).to_json()
-
-    def test_deactivate_account(self):
-        self.response.headers['Location'] = self.regr.uri
-        self.response.json.return_value = self.regr.body.to_json()
-        self.assertEqual(self.regr,
-                         self.client.deactivate_registration(self.regr))
-
-    def test_query_registration(self):
-        self.response.json.return_value = self.regr.body.to_json()
-        self.assertEqual(self.regr, self.client.query_registration(self.regr))
-
-    def test_agree_to_tos(self):
-        self.client.update_registration = mock.Mock()
-        self.client.agree_to_tos(self.regr)
-        regr = self.client.update_registration.call_args[0][0]
-        self.assertEqual(self.regr.terms_of_service, regr.body.agreement)
-
-    def _prepare_response_for_request_challenges(self):
-        self.response.status_code = http_client.CREATED
-        self.response.headers['Location'] = self.authzr.uri
-        self.response.json.return_value = self.authz.to_json()
-
-    def test_request_challenges(self):
-        self._prepare_response_for_request_challenges()
-        self.client.request_challenges(self.identifier)
-        self.net.post.assert_called_once_with(
-            self.directory.new_authz,
-            messages.NewAuthorization(identifier=self.identifier),
-            acme_version=1)
-
-    def test_request_challenges_deprecated_arg(self):
-        self._prepare_response_for_request_challenges()
-        self.client.request_challenges(self.identifier, new_authzr_uri="hi")
-        self.net.post.assert_called_once_with(
-            self.directory.new_authz,
-            messages.NewAuthorization(identifier=self.identifier),
-            acme_version=1)
-
-    def test_request_challenges_custom_uri(self):
-        self._prepare_response_for_request_challenges()
-        self.client.request_challenges(self.identifier)
-        self.net.post.assert_called_once_with(
-            'https://www.letsencrypt-demo.org/acme/new-authz', mock.ANY,
-            acme_version=1)
-
-    def test_request_challenges_unexpected_update(self):
-        self._prepare_response_for_request_challenges()
-        self.response.json.return_value = self.authz.update(
-            identifier=self.identifier.update(value='foo')).to_json()
-        self.assertRaises(
-            errors.UnexpectedUpdate, self.client.request_challenges,
-            self.identifier)
-
-    def test_request_challenges_wildcard(self):
-        wildcard_identifier = messages.Identifier(
-            typ=messages.IDENTIFIER_FQDN, value='*.example.org')
-        self.assertRaises(
-            errors.WildcardUnsupportedError, self.client.request_challenges,
-            wildcard_identifier)
-
-    def test_request_domain_challenges(self):
-        self.client.request_challenges = mock.MagicMock()
-        self.assertEqual(
-            self.client.request_challenges(self.identifier),
-            self.client.request_domain_challenges('example.com'))
-
-    def test_answer_challenge(self):
-        self.response.links['up'] = {'url': self.challr.authzr_uri}
-        self.response.json.return_value = self.challr.body.to_json()
-
-        chall_response = challenges.DNSResponse(validation=None)
-
-        self.client.answer_challenge(self.challr.body, chall_response)
-
-        # TODO: split here and separate test
-        self.assertRaises(errors.UnexpectedUpdate, self.client.answer_challenge,
-                          self.challr.body.update(uri='foo'), chall_response)
-
-    def test_answer_challenge_missing_next(self):
-        self.assertRaises(
-            errors.ClientError, self.client.answer_challenge,
-            self.challr.body, challenges.DNSResponse(validation=None))
-
-    def test_retry_after_date(self):
-        self.response.headers['Retry-After'] = 'Fri, 31 Dec 1999 23:59:59 GMT'
-        self.assertEqual(
-            datetime.datetime(1999, 12, 31, 23, 59, 59),
-            self.client.retry_after(response=self.response, default=10))
-
-    @mock.patch('acme.client.datetime')
-    def test_retry_after_invalid(self, dt_mock):
-        dt_mock.datetime.now.return_value = datetime.datetime(2015, 3, 27)
-        dt_mock.timedelta = datetime.timedelta
-
-        self.response.headers['Retry-After'] = 'foooo'
-        self.assertEqual(
-            datetime.datetime(2015, 3, 27, 0, 0, 10),
-            self.client.retry_after(response=self.response, default=10))
-
-    @mock.patch('acme.client.datetime')
-    def test_retry_after_overflow(self, dt_mock):
-        dt_mock.datetime.now.return_value = datetime.datetime(2015, 3, 27)
-        dt_mock.timedelta = datetime.timedelta
-        dt_mock.datetime.side_effect = datetime.datetime
-
-        self.response.headers['Retry-After'] = "Tue, 116 Feb 2016 11:50:00 MST"
-        self.assertEqual(
-            datetime.datetime(2015, 3, 27, 0, 0, 10),
-            self.client.retry_after(response=self.response, default=10))
-
-    @mock.patch('acme.client.datetime')
-    def test_retry_after_seconds(self, dt_mock):
-        dt_mock.datetime.now.return_value = datetime.datetime(2015, 3, 27)
-        dt_mock.timedelta = datetime.timedelta
-
-        self.response.headers['Retry-After'] = '50'
-        self.assertEqual(
-            datetime.datetime(2015, 3, 27, 0, 0, 50),
-            self.client.retry_after(response=self.response, default=10))
-
-    @mock.patch('acme.client.datetime')
-    def test_retry_after_missing(self, dt_mock):
-        dt_mock.datetime.now.return_value = datetime.datetime(2015, 3, 27)
-        dt_mock.timedelta = datetime.timedelta
-
-        self.assertEqual(
-            datetime.datetime(2015, 3, 27, 0, 0, 10),
-            self.client.retry_after(response=self.response, default=10))
-
-    def test_poll(self):
-        self.response.json.return_value = self.authzr.body.to_json()
-        self.assertEqual((self.authzr, self.response),
-                         self.client.poll(self.authzr))
-
-        # TODO: split here and separate test
-        self.response.json.return_value = self.authz.update(
-            identifier=self.identifier.update(value='foo')).to_json()
-        self.assertRaises(
-            errors.UnexpectedUpdate, self.client.poll, self.authzr)
-
-    def test_request_issuance(self):
-        self.response.content = CERT_DER
-        self.response.headers['Location'] = self.certr.uri
-        self.response.links['up'] = {'url': self.certr.cert_chain_uri}
-        self.assertEqual(self.certr, self.client.request_issuance(
-            messages_test.CSR, (self.authzr,)))
-        # TODO: check POST args
-
-    def test_request_issuance_missing_up(self):
-        self.response.content = CERT_DER
-        self.response.headers['Location'] = self.certr.uri
-        self.assertEqual(
-            self.certr.update(cert_chain_uri=None),
-            self.client.request_issuance(messages_test.CSR, (self.authzr,)))
-
-    def test_request_issuance_missing_location(self):
-        self.assertRaises(
-            errors.ClientError, self.client.request_issuance,
-            messages_test.CSR, (self.authzr,))
-
-    @mock.patch('acme.client.datetime')
-    @mock.patch('acme.client.time')
-    def test_poll_and_request_issuance(self, time_mock, dt_mock):
-        # clock.dt | pylint: disable=no-member
-        clock = mock.MagicMock(dt=datetime.datetime(2015, 3, 27))
-
-        def sleep(seconds):
-            """increment clock"""
-            clock.dt += datetime.timedelta(seconds=seconds)
-        time_mock.sleep.side_effect = sleep
-
-        def now():
-            """return current clock value"""
-            return clock.dt
-        dt_mock.datetime.now.side_effect = now
-        dt_mock.timedelta = datetime.timedelta
-
-        def poll(authzr):  # pylint: disable=missing-docstring
-            # record poll start time based on the current clock value
-            authzr.times.append(clock.dt)
-
-            # suppose it takes 2 seconds for server to produce the
-            # result, increment clock
-            clock.dt += datetime.timedelta(seconds=2)
-
-            if len(authzr.retries) == 1:  # no more retries
-                done = mock.MagicMock(uri=authzr.uri, times=authzr.times)
-                done.body.status = authzr.retries[0]
-                return done, []
-
-            # response (2nd result tuple element) is reduced to only
-            # Retry-After header contents represented as integer
-            # seconds; authzr.retries is a list of Retry-After
-            # headers, head(retries) is peeled of as a current
-            # Retry-After header, and tail(retries) is persisted for
-            # later poll() calls
-            return (mock.MagicMock(retries=authzr.retries[1:],
-                                   uri=authzr.uri + '.', times=authzr.times),
-                    authzr.retries[0])
-        self.client.poll = mock.MagicMock(side_effect=poll)
-
-        mintime = 7
-
-        def retry_after(response, default):
-            # pylint: disable=missing-docstring
-            # check that poll_and_request_issuance correctly passes mintime
-            self.assertEqual(default, mintime)
-            return clock.dt + datetime.timedelta(seconds=response)
-        self.client.retry_after = mock.MagicMock(side_effect=retry_after)
-
-        def request_issuance(csr, authzrs):  # pylint: disable=missing-docstring
-            return csr, authzrs
-        self.client.request_issuance = mock.MagicMock(
-            side_effect=request_issuance)
-
-        csr = mock.MagicMock()
-        authzrs = (
-            mock.MagicMock(uri='a', times=[], retries=(
-                8, 20, 30, messages.STATUS_VALID)),
-            mock.MagicMock(uri='b', times=[], retries=(
-                5, messages.STATUS_VALID)),
-        )
-
-        cert, updated_authzrs = self.client.poll_and_request_issuance(
-            csr, authzrs, mintime=mintime,
-            # make sure that max_attempts is per-authorization, rather
-            # than global
-            max_attempts=max(len(authzrs[0].retries), len(authzrs[1].retries)))
-        self.assertIs(cert[0], csr)
-        self.assertIs(cert[1], updated_authzrs)
-        self.assertEqual(updated_authzrs[0].uri, 'a...')
-        self.assertEqual(updated_authzrs[1].uri, 'b.')
-        self.assertEqual(updated_authzrs[0].times, [
-            datetime.datetime(2015, 3, 27),
-            # a is scheduled for 10, but b is polling [9..11), so it
-            # will be picked up as soon as b is finished, without
-            # additional sleeping
-            datetime.datetime(2015, 3, 27, 0, 0, 11),
-            datetime.datetime(2015, 3, 27, 0, 0, 33),
-            datetime.datetime(2015, 3, 27, 0, 1, 5),
-        ])
-        self.assertEqual(updated_authzrs[1].times, [
-            datetime.datetime(2015, 3, 27, 0, 0, 2),
-            datetime.datetime(2015, 3, 27, 0, 0, 9),
-        ])
-        self.assertEqual(clock.dt, datetime.datetime(2015, 3, 27, 0, 1, 7))
-
-        # CA sets invalid | TODO: move to a separate test
-        invalid_authzr = mock.MagicMock(
-            times=[], retries=[messages.STATUS_INVALID])
-        self.assertRaises(
-            errors.PollError, self.client.poll_and_request_issuance,
-            csr, authzrs=(invalid_authzr,), mintime=mintime)
-
-        # exceeded max_attempts | TODO: move to a separate test
-        self.assertRaises(
-            errors.PollError, self.client.poll_and_request_issuance,
-            csr, authzrs, mintime=mintime, max_attempts=2)
-
-    def test_deactivate_authorization(self):
-        authzb = self.authzr.body.update(status=messages.STATUS_DEACTIVATED)
-        self.response.json.return_value = authzb.to_json()
-        authzr = self.client.deactivate_authorization(self.authzr)
-        self.assertEqual(authzb, authzr.body)
-        self.assertEqual(self.client.net.post.call_count, 1)
-        self.assertIn(self.authzr.uri, self.net.post.call_args_list[0][0])
-
-    def test_check_cert(self):
-        self.response.headers['Location'] = self.certr.uri
-        self.response.content = CERT_DER
-        self.assertEqual(self.certr.update(body=messages_test.CERT),
-                         self.client.check_cert(self.certr))
-
-        # TODO: split here and separate test
-        self.response.headers['Location'] = 'foo'
-        self.assertRaises(
-            errors.UnexpectedUpdate, self.client.check_cert, self.certr)
-
-    def test_check_cert_missing_location(self):
-        self.response.content = CERT_DER
-        self.assertRaises(
-            errors.ClientError, self.client.check_cert, self.certr)
-
-    def test_refresh(self):
-        self.client.check_cert = mock.MagicMock()
-        self.assertEqual(
-            self.client.check_cert(self.certr), self.client.refresh(self.certr))
-
-    def test_fetch_chain_no_up_link(self):
-        self.assertEqual([], self.client.fetch_chain(self.certr.update(
-            cert_chain_uri=None)))
-
-    def test_fetch_chain_single(self):
-        # pylint: disable=protected-access
-        self.client._get_cert = mock.MagicMock()
-        self.client._get_cert.return_value = (
-            mock.MagicMock(links={}), "certificate")
-        self.assertEqual([self.client._get_cert(self.certr.cert_chain_uri)[1]],
-                         self.client.fetch_chain(self.certr))
-
-    def test_fetch_chain_max(self):
-        # pylint: disable=protected-access
-        up_response = mock.MagicMock(links={'up': {'url': 'http://cert'}})
-        noup_response = mock.MagicMock(links={})
-        self.client._get_cert = mock.MagicMock()
-        self.client._get_cert.side_effect = [
-            (up_response, "cert")] * 9 + [(noup_response, "last_cert")]
-        chain = self.client.fetch_chain(self.certr, max_length=10)
-        self.assertEqual(chain, ["cert"] * 9 + ["last_cert"])
-
-    def test_fetch_chain_too_many(self):  # recursive
-        # pylint: disable=protected-access
-        response = mock.MagicMock(links={'up': {'url': 'http://cert'}})
-        self.client._get_cert = mock.MagicMock()
-        self.client._get_cert.return_value = (response, "certificate")
-        self.assertRaises(errors.Error, self.client.fetch_chain, self.certr)
-
-    def test_revoke(self):
-        self.client.revoke(self.certr.body, self.rsn)
-        self.net.post.assert_called_once_with(
-            self.directory[messages.Revocation], mock.ANY, acme_version=1)
-
-    def test_revocation_payload(self):
-        obj = messages.Revocation(certificate=self.certr.body, reason=self.rsn)
-        self.assertIn('reason', obj.to_partial_json().keys())
-        self.assertEqual(self.rsn, obj.to_partial_json()['reason'])
-
-    def test_revoke_bad_status_raises_error(self):
-        self.response.status_code = http_client.METHOD_NOT_ALLOWED
-        self.assertRaises(
-            errors.ClientError,
-            self.client.revoke,
-            self.certr,
-            self.rsn)
-
-
-class ClientV2Test(ClientTestBase):
-    """Tests for acme.client.ClientV2."""
-
-    def setUp(self):
-        super().setUp()
-
         self.directory = DIRECTORY_V2
 
         self.client = ClientV2(self.directory, self.net)
@@ -763,11 +103,40 @@ class ClientV2Test(ClientTestBase):
 
         self.assertEqual(self.regr, self.client.new_account(self.new_reg))
 
+    def test_new_account_tos_link(self):
+        self.response.status_code = http_client.CREATED
+        self.response.json.return_value = self.regr.body.to_json()
+        self.response.headers['Location'] = self.regr.uri
+        self.response.links.update({
+            'terms-of-service': {'url': 'https://www.letsencrypt-demo.org/tos'},
+        })
+
+        self.assertEqual(self.client.new_account(self.new_reg).terms_of_service,
+                         'https://www.letsencrypt-demo.org/tos')
+
+
     def test_new_account_conflict(self):
         self.response.status_code = http_client.OK
         self.response.headers['Location'] = self.regr.uri
         self.assertRaises(errors.ConflictError, self.client.new_account, self.new_reg)
 
+    def test_deactivate_account(self):
+        deactivated_regr = self.regr.update(
+            body=self.regr.body.update(status='deactivated'))
+        self.response.json.return_value = deactivated_regr.body.to_json()
+        self.response.status_code = http_client.OK
+        self.response.headers['Location'] = self.regr.uri
+        self.assertEqual(self.client.deactivate_registration(self.regr), deactivated_regr)
+
+    def test_deactivate_authorization(self):
+        deactivated_authz = self.authzr.update(
+            body=self.authzr.body.update(status=messages.STATUS_DEACTIVATED))
+        self.response.json.return_value = deactivated_authz.body.to_json()
+        authzr = self.client.deactivate_authorization(self.authzr)
+        self.assertEqual(deactivated_authz.body, authzr.body)
+        self.assertEqual(self.client.net.post.call_count, 1)
+        self.assertIn(self.authzr.uri, self.net.post.call_args_list[0][0])
+
     def test_new_order(self):
         order_response = copy.deepcopy(self.response)
         order_response.status_code = http_client.CREATED
@@ -786,6 +155,20 @@ class ClientV2Test(ClientTestBase):
             mock_post_as_get.side_effect = (authz_response, authz_response2)
             self.assertEqual(self.client.new_order(CSR_MIXED_PEM), self.orderr)
 
+    def test_answer_challege(self):
+        self.response.links['up'] = {'url': self.challr.authzr_uri}
+        self.response.json.return_value = self.challr.body.to_json()
+        chall_response = challenges.DNSResponse(validation=None)
+        self.client.answer_challenge(self.challr.body, chall_response)
+
+        self.assertRaises(errors.UnexpectedUpdate, self.client.answer_challenge,
+                          self.challr.body.update(uri='foo'), chall_response)
+
+    def test_answer_challenge_missing_next(self):
+        self.assertRaises(
+            errors.ClientError, self.client.answer_challenge,
+            self.challr.body, challenges.DNSResponse(validation=None))
+
     @mock.patch('acme.client.datetime')
     def test_poll_and_finalize(self, mock_datetime):
         mock_datetime.datetime.now.return_value = datetime.datetime(2018, 2, 15)
@@ -832,6 +215,11 @@ class ClientV2Test(ClientTestBase):
             self.authz.to_json(), self.authz2.to_json(), updated_authz2.to_json())
         self.assertEqual(self.client.poll_authorizations(self.orderr, deadline), updated_orderr)
 
+    def test_poll_unexpected_update(self):
+        updated_authz = self.authz.update(identifier=self.identifier.update(value='foo'))
+        self.response.json.return_value = updated_authz.to_json()
+        self.assertRaises(errors.UnexpectedUpdate, self.client.poll, self.authzr)
+
     def test_finalize_order_success(self):
         updated_order = self.order.update(
             certificate='https://www.letsencrypt-demo.org/acme/cert/',
@@ -883,9 +271,9 @@ class ClientV2Test(ClientTestBase):
         deadline = datetime.datetime(9999, 9, 9)
         resp = self.client.finalize_order(self.orderr, deadline, fetch_alternative_chains=True)
         self.net.post.assert_any_call('https://example.com/acme/cert/1',
-                                      mock.ANY, acme_version=2, new_nonce_url=mock.ANY)
+                                      mock.ANY, new_nonce_url=mock.ANY)
         self.net.post.assert_any_call('https://example.com/acme/cert/2',
-                                      mock.ANY, acme_version=2, new_nonce_url=mock.ANY)
+                                      mock.ANY, new_nonce_url=mock.ANY)
         self.assertEqual(resp, updated_orderr)
 
         del self.response.headers['Link']
@@ -895,8 +283,15 @@ class ClientV2Test(ClientTestBase):
     def test_revoke(self):
         self.client.revoke(messages_test.CERT, self.rsn)
         self.net.post.assert_called_once_with(
-            self.directory["revokeCert"], mock.ANY, acme_version=2,
-            new_nonce_url=DIRECTORY_V2['newNonce'])
+            self.directory["revokeCert"], mock.ANY, new_nonce_url=DIRECTORY_V2['newNonce'])
+
+    def test_revoke_bad_status_raises_error(self):
+        self.response.status_code = http_client.METHOD_NOT_ALLOWED
+        self.assertRaises(
+            errors.ClientError,
+            self.client.revoke,
+            messages_test.CERT,
+            self.rsn)
 
     def test_update_registration(self):
         # "Instance of 'Field' has no to_json/update member" bug:
@@ -927,6 +322,11 @@ class ClientV2Test(ClientTestBase):
     def test_external_account_required_default(self):
         self.assertFalse(self.client.external_account_required())
 
+    def test_query_registration_client(self):
+        self.response.json.return_value = self.regr.body.to_json()
+        self.response.headers['Location'] = 'https://www.letsencrypt-demo.org/acme/reg/1'
+        self.assertEqual(self.regr, self.client.query_registration(self.regr))
+
     def test_post_as_get(self):
         with mock.patch('acme.client.ClientV2._authzr_from_response') as mock_client:
             mock_client.return_value = self.authzr2
@@ -934,12 +334,64 @@ class ClientV2Test(ClientTestBase):
             self.client.poll(self.authzr2)  # pylint: disable=protected-access
 
             self.client.net.post.assert_called_once_with(
-                self.authzr2.uri, None, acme_version=2,
+                self.authzr2.uri, None,
                 new_nonce_url='https://www.letsencrypt-demo.org/acme/new-nonce')
             self.client.net.get.assert_not_called()
 
+    def test_retry_after_date(self):
+        self.response.headers['Retry-After'] = 'Fri, 31 Dec 1999 23:59:59 GMT'
+        self.assertEqual(
+            datetime.datetime(1999, 12, 31, 23, 59, 59),
+            self.client.retry_after(response=self.response, default=10))
 
-class MockJSONDeSerializable(VersionedLEACMEMixin, jose.JSONDeSerializable):
+    @mock.patch('acme.client.datetime')
+    def test_retry_after_invalid(self, dt_mock):
+        dt_mock.datetime.now.return_value = datetime.datetime(2015, 3, 27)
+        dt_mock.timedelta = datetime.timedelta
+
+        self.response.headers['Retry-After'] = 'foooo'
+        self.assertEqual(
+            datetime.datetime(2015, 3, 27, 0, 0, 10),
+            self.client.retry_after(response=self.response, default=10))
+
+    @mock.patch('acme.client.datetime')
+    def test_retry_after_overflow(self, dt_mock):
+        dt_mock.datetime.now.return_value = datetime.datetime(2015, 3, 27)
+        dt_mock.timedelta = datetime.timedelta
+        dt_mock.datetime.side_effect = datetime.datetime
+
+        self.response.headers['Retry-After'] = "Tue, 116 Feb 2016 11:50:00 MST"
+        self.assertEqual(
+            datetime.datetime(2015, 3, 27, 0, 0, 10),
+            self.client.retry_after(response=self.response, default=10))
+
+    @mock.patch('acme.client.datetime')
+    def test_retry_after_seconds(self, dt_mock):
+        dt_mock.datetime.now.return_value = datetime.datetime(2015, 3, 27)
+        dt_mock.timedelta = datetime.timedelta
+
+        self.response.headers['Retry-After'] = '50'
+        self.assertEqual(
+            datetime.datetime(2015, 3, 27, 0, 0, 50),
+            self.client.retry_after(response=self.response, default=10))
+
+    @mock.patch('acme.client.datetime')
+    def test_retry_after_missing(self, dt_mock):
+        dt_mock.datetime.now.return_value = datetime.datetime(2015, 3, 27)
+        dt_mock.timedelta = datetime.timedelta
+
+        self.assertEqual(
+            datetime.datetime(2015, 3, 27, 0, 0, 10),
+            self.client.retry_after(response=self.response, default=10))
+
+    def test_get_directory(self):
+        self.response.json.return_value = DIRECTORY_V2.to_json()
+        self.assertEqual(
+            DIRECTORY_V2.to_partial_json(),
+            ClientV2.get_directory('https://example.com/dir', self.net).to_partial_json())
+
+
+class MockJSONDeSerializable(jose.JSONDeSerializable):
     # pylint: disable=missing-docstring
     def __init__(self, value):
         self.value = value
@@ -973,8 +425,7 @@ class ClientNetworkTest(unittest.TestCase):
     def test_wrap_in_jws(self):
         # pylint: disable=protected-access
         jws_dump = self.net._wrap_in_jws(
-            MockJSONDeSerializable('foo'), nonce=b'Tg', url="url",
-            acme_version=1)
+            MockJSONDeSerializable('foo'), nonce=b'Tg', url="url")
         jws = acme_jws.JWS.json_loads(jws_dump)
         self.assertEqual(json.loads(jws.payload.decode()), {'foo': 'foo'})
         self.assertEqual(jws.signature.combined.nonce, b'Tg')
@@ -983,8 +434,7 @@ class ClientNetworkTest(unittest.TestCase):
         self.net.account = {'uri': 'acct-uri'}
         # pylint: disable=protected-access
         jws_dump = self.net._wrap_in_jws(
-            MockJSONDeSerializable('foo'), nonce=b'Tg', url="url",
-            acme_version=2)
+            MockJSONDeSerializable('foo'), nonce=b'Tg', url="url")
         jws = acme_jws.JWS.json_loads(jws_dump)
         self.assertEqual(json.loads(jws.payload.decode()), {'foo': 'foo'})
         self.assertEqual(jws.signature.combined.nonce, b'Tg')
@@ -1090,14 +540,13 @@ class ClientNetworkTest(unittest.TestCase):
         self.net.session = mock.MagicMock()
         self.net.session.request.return_value = mock.MagicMock(
             ok=True, status_code=http_client.OK,
-            headers={"Content-Type": "application/pkix-cert"},
             content=b"hi")
         # pylint: disable=protected-access
         self.net._send_request('HEAD', 'http://example.com/', 'foo',
-          timeout=mock.ANY, bar='baz')
+          timeout=mock.ANY, bar='baz', headers={'Accept': 'application/pkix-cert'})
         mock_logger.debug.assert_called_with(
             'Received response:\nHTTP %d\n%s\n\n%s', 200,
-            'Content-Type: application/pkix-cert', b'aGk=')
+            '', b'aGk=')
 
     def test_send_request_post(self):
         self.net.session = mock.MagicMock()
@@ -1269,13 +718,13 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
             'uri', self.obj, content_type=self.content_type))
         self.assertTrue(self.response.checked)
         self.net._wrap_in_jws.assert_called_once_with(
-            self.obj, jose.b64decode(self.all_nonces.pop()), "uri", 1)
+            self.obj, jose.b64decode(self.all_nonces.pop()), "uri")
 
         self.available_nonces = []
         self.assertRaises(errors.MissingNonce, self.net.post,
                           'uri', self.obj, content_type=self.content_type)
         self.net._wrap_in_jws.assert_called_with(
-            self.obj, jose.b64decode(self.all_nonces.pop()), "uri", 1)
+            self.obj, jose.b64decode(self.all_nonces.pop()), "uri")
 
     def test_post_wrong_initial_nonce(self):  # HEAD
         self.available_nonces = [b'f', jose.b64encode(b'good')]
@@ -1333,42 +782,14 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
         check_response = mock.MagicMock()
         self.net._check_response = check_response
         self.assertRaises(errors.ClientError, self.net.post, 'uri',
-                          self.obj, content_type=self.content_type, acme_version=2,
+                          self.obj, content_type=self.content_type,
                           new_nonce_url='new_nonce_uri')
         self.assertEqual(check_response.call_count, 1)
 
     def test_new_nonce_uri_removed(self):
         self.content_type = None
-        self.net.post('uri', self.obj, content_type=None,
-            acme_version=2, new_nonce_url='new_nonce_uri')
+        self.net.post('uri', self.obj, content_type=None, new_nonce_url='new_nonce_uri')
 
 
-class ClientNetworkSourceAddressBindingTest(unittest.TestCase):
-    """Tests that if ClientNetwork has a source IP set manually, the underlying library has
-    used the provided source address."""
-
-    def setUp(self):
-        self.source_address = "8.8.8.8"
-
-    def test_source_address_set(self):
-        with mock.patch('warnings.warn') as mock_warn:
-            net = ClientNetwork(key=None, alg=None, source_address=self.source_address)
-            mock_warn.assert_called_once()
-            self.assertIn('source_address', mock_warn.call_args[0][0])
-        for adapter in net.session.adapters.values():
-            self.assertIn(self.source_address, adapter.source_address)
-
-    def test_behavior_assumption(self):
-        """This is a test that guardrails the HTTPAdapter behavior so that if the default for
-        a Session() changes, the assumptions here aren't violated silently."""
-        # Source address not specified, so the default adapter type should be bound -- this
-        # test should fail if the default adapter type is changed by requests
-        net = ClientNetwork(key=None, alg=None)
-        session = requests.Session()
-        for scheme in session.adapters:
-            client_network_adapter = net.session.adapters.get(scheme)
-            default_adapter = session.adapters.get(scheme)
-            self.assertEqual(client_network_adapter.__class__, default_adapter.__class__)
-
 if __name__ == '__main__':
     unittest.main()  # pragma: no cover

acme/tests/fields_test.py

@@ -55,21 +55,5 @@ class RFC3339FieldTest(unittest.TestCase):
             jose.DeserializationError, RFC3339Field.default_decoder, '')
 
 
-class ResourceTest(unittest.TestCase):
-    """Tests for acme.fields.Resource."""
-
-    def setUp(self):
-        with warnings.catch_warnings():
-            warnings.filterwarnings('ignore', '.*Resource', DeprecationWarning)
-            from acme.fields import Resource
-            self.field = Resource('x')
-
-    def test_decode_good(self):
-        self.assertEqual('x', self.field.decode('x'))
-
-    def test_decode_wrong(self):
-        self.assertRaises(jose.DeserializationError, self.field.decode, 'y')
-
-
 if __name__ == '__main__':
     unittest.main()  # pragma: no cover

acme/tests/magic_typing_test.py

@@ -1,30 +0,0 @@
-"""Tests for acme.magic_typing."""
-import sys
-import unittest
-import warnings
-from unittest import mock
-
-
-class MagicTypingTest(unittest.TestCase):
-    """Tests for acme.magic_typing."""
-    def test_import_success(self):
-        try:
-            import typing as temp_typing
-        except ImportError:  # pragma: no cover
-            temp_typing = None  # pragma: no cover
-        typing_class_mock = mock.MagicMock()
-        text_mock = mock.MagicMock()
-        typing_class_mock.Text = text_mock
-        sys.modules['typing'] = typing_class_mock
-        if 'acme.magic_typing' in sys.modules:
-            del sys.modules['acme.magic_typing']  # pragma: no cover
-        with warnings.catch_warnings():
-            warnings.filterwarnings("ignore", category=DeprecationWarning)
-            from acme.magic_typing import Text
-        self.assertEqual(Text, text_mock)
-        del sys.modules['acme.magic_typing']
-        sys.modules['typing'] = temp_typing
-
-
-if __name__ == '__main__':
-    unittest.main()  # pragma: no cover

acme/tests/messages_test.py

@@ -135,8 +135,8 @@ class DirectoryTest(unittest.TestCase):
     def setUp(self):
         from acme.messages import Directory
         self.dir = Directory({
-            'new-reg': 'reg',
-            mock.MagicMock(resource_type='new-cert'): 'cert',
+            'newReg': 'reg',
+            'newCert': 'cert',
             'meta': Directory.Meta(
                 terms_of_service='https://example.com/acme/terms',
                 website='https://www.example.com/',
@@ -149,28 +149,23 @@ class DirectoryTest(unittest.TestCase):
         Directory({'foo': 'bar'})
 
     def test_getitem(self):
-        self.assertEqual('reg', self.dir['new-reg'])
-        from acme.messages import NewRegistration
-        with warnings.catch_warnings():
-            warnings.filterwarnings('ignore', '.* non-string keys', DeprecationWarning)
-            self.assertEqual('reg', self.dir[NewRegistration])
-            self.assertEqual('reg', self.dir[NewRegistration()])
+        self.assertEqual('reg', self.dir['newReg'])
 
     def test_getitem_fails_with_key_error(self):
         self.assertRaises(KeyError, self.dir.__getitem__, 'foo')
 
     def test_getattr(self):
-        self.assertEqual('reg', self.dir.new_reg)
+        self.assertEqual('reg', self.dir.newReg)
 
     def test_getattr_fails_with_attribute_error(self):
         self.assertRaises(AttributeError, self.dir.__getattr__, 'foo')
 
     def test_to_json(self):
         self.assertEqual(self.dir.to_json(), {
-            'new-reg': 'reg',
-            'new-cert': 'cert',
+            'newReg': 'reg',
+            'newCert': 'cert',
             'meta': {
-                'terms-of-service': 'https://example.com/acme/terms',
+                'termsOfService': 'https://example.com/acme/terms',
                 'website': 'https://www.example.com/',
                 'caaIdentities': ['example.com'],
             },
@@ -290,7 +285,7 @@ class UpdateRegistrationTest(unittest.TestCase):
     def test_empty(self):
         from acme.messages import UpdateRegistration
         jstring = '{"resource": "reg"}'
-        self.assertEqual(jstring, UpdateRegistration().json_dumps())
+        self.assertEqual('{}', UpdateRegistration().json_dumps())
         self.assertEqual(
             UpdateRegistration(), UpdateRegistration.json_loads(jstring))
 
@@ -338,7 +333,7 @@ class ChallengeBodyTest(unittest.TestCase):
             error=error)
 
         self.jobj_to = {
-            'uri': 'http://challb',
+            'url': 'http://challb',
             'status': self.status,
             'type': 'dns',
             'token': 'evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA',
@@ -385,20 +380,17 @@ class AuthorizationTest(unittest.TestCase):
                           chall=challenges.DNS(
                               token=b'DGyRejmCefe7v4NfDGDKfA')),
         )
-        combinations = ((0,), (1,))
 
         from acme.messages import Authorization
         from acme.messages import Identifier
         from acme.messages import IDENTIFIER_FQDN
         identifier = Identifier(typ=IDENTIFIER_FQDN, value='example.com')
         self.authz = Authorization(
-            identifier=identifier, combinations=combinations,
-            challenges=self.challbs)
+            identifier=identifier, challenges=self.challbs)
 
         self.jobj_from = {
             'identifier': identifier.to_json(),
             'challenges': [challb.to_json() for challb in self.challbs],
-            'combinations': combinations,
         }
 
     def test_from_json(self):
@@ -409,14 +401,6 @@ class AuthorizationTest(unittest.TestCase):
         from acme.messages import Authorization
         hash(Authorization.from_json(self.jobj_from))
 
-    def test_resolved_combinations(self):
-        with warnings.catch_warnings():
-            warnings.filterwarnings('ignore', '.*resolved_combinations', DeprecationWarning)
-            self.assertEqual(self.authz.resolved_combinations, (
-                (self.challbs[0],),
-                (self.challbs[1],),
-            ))
-
 
 class AuthorizationResourceTest(unittest.TestCase):
     """Tests for acme.messages.AuthorizationResource."""
@@ -507,7 +491,6 @@ class JWSPayloadRFC8555Compliant(unittest.TestCase):
         from acme.messages import NewAuthorization
 
         new_order = NewAuthorization()
-        new_order.le_acme_version = 2
 
         jobj = new_order.json_dumps(indent=2).encode()
         # RFC8555 states that JWS bodies must not have a resource field.

certbot-apache/certbot_apache/_internal/apacheparser.py

@@ -118,7 +118,8 @@ class ApacheBlockNode(ApacheDirectiveNode):
 
     # pylint: disable=unused-argument
     def add_child_directive(self, name: str, parameters: Optional[List[str]] = None,
-                            position: int = None) -> ApacheDirectiveNode:  # pragma: no cover
+                            position: Optional[int] = None
+    ) -> ApacheDirectiveNode:  # pragma: no cover
         """Adds a new DirectiveNode to the sequence of children"""
         new_dir = ApacheDirectiveNode(name=assertions.PASS,
                                       parameters=assertions.PASS,

certbot-apache/certbot_apache/_internal/configurator.py

@@ -366,12 +366,9 @@ class ApacheConfigurator(common.Configurator):
             self.version = self.get_version()
             logger.debug('Apache version is %s',
                          '.'.join(str(i) for i in self.version))
-        if self.version < (2, 2):
+        if self.version < (2, 4):
             raise errors.NotSupportedError(
                 "Apache Version {0} not supported.".format(str(self.version)))
-        elif self.version < (2, 4):
-            logger.warning('Support for Apache 2.2 is deprecated and will be removed in a '
-                           'future release.')
 
         # Recover from previous crash before Augeas initialization to have the
         # correct parse tree from the get go.
@@ -815,7 +812,7 @@ class ApacheConfigurator(common.Configurator):
         return self._find_best_vhost(target, filtered_vhosts, filter_defaults)
 
     def _find_best_vhost(
-        self, target_name: str, vhosts: List[obj.VirtualHost] = None,
+        self, target_name: str, vhosts: Optional[List[obj.VirtualHost]] = None,
         filter_defaults: bool = True
     ) -> Optional[obj.VirtualHost]:
         """Finds the best vhost for a target_name.
@@ -1188,46 +1185,6 @@ class ApacheConfigurator(common.Configurator):
                     vhost.aliases.add(serveralias)
             vhost.name = servername
 
-    def is_name_vhost(self, target_addr: obj.Addr) -> bool:
-        """Returns if vhost is a name based vhost
-
-        NameVirtualHost was deprecated in Apache 2.4 as all VirtualHosts are
-        now NameVirtualHosts. If version is earlier than 2.4, check if addr
-        has a NameVirtualHost directive in the Apache config
-
-        :param certbot_apache._internal.obj.Addr target_addr: vhost address
-
-        :returns: Success
-        :rtype: bool
-
-        """
-        # Mixed and matched wildcard NameVirtualHost with VirtualHost
-        # behavior is undefined. Make sure that an exact match exists
-
-        # search for NameVirtualHost directive for ip_addr
-        # note ip_addr can be FQDN although Apache does not recommend it
-        return (self.version >= (2, 4) or
-                bool(self.parser.find_dir("NameVirtualHost", str(target_addr))))
-
-    def add_name_vhost(self, addr: obj.Addr) -> None:
-        """Adds NameVirtualHost directive for given address.
-
-        :param addr: Address that will be added as NameVirtualHost directive
-        :type addr: :class:`~certbot_apache._internal.obj.Addr`
-
-        """
-
-        loc = parser.get_aug_path(self.parser.loc["name"])
-        if addr.get_port() == "443":
-            self.parser.add_dir_to_ifmodssl(
-                loc, "NameVirtualHost", [str(addr)])
-        else:
-            self.parser.add_dir(loc, "NameVirtualHost", [str(addr)])
-
-        msg = "Setting {0} to be NameBasedVirtualHost\n".format(addr)
-        logger.debug(msg)
-        self.save_notes += msg
-
     def prepare_server_https(self, port: str, temp: bool = False) -> None:
         """Prepare the server for HTTPS.
 
@@ -1375,8 +1332,7 @@ class ApacheConfigurator(common.Configurator):
         """
 
         if self.options.handle_modules:
-            if self.version >= (2, 4) and ("socache_shmcb_module" not in
-                                           self.parser.modules):
+            if "socache_shmcb_module" not in self.parser.modules:
                 self.enable_mod("socache_shmcb", temp=temp)
             if "ssl_module" not in self.parser.modules:
                 self.enable_mod("ssl", temp=temp)
@@ -1463,10 +1419,6 @@ class ApacheConfigurator(common.Configurator):
         #       for the new directives; For these reasons... this is tacked
         #       on after fully creating the new vhost
 
-        # Now check if addresses need to be added as NameBasedVhost addrs
-        # This is for compliance with versions of Apache < 2.4
-        self._add_name_vhost_if_necessary(ssl_vhost)
-
         return ssl_vhost
 
     def _get_new_vh_path(self, orig_matches: List[str], new_matches: List[str]) -> Optional[str]:
@@ -1765,40 +1717,6 @@ class ApacheConfigurator(common.Configurator):
         aliases = (self.parser.aug.get(match) for match in matches)
         return self.domain_in_names(aliases, target_name)
 
-    def _add_name_vhost_if_necessary(self, vhost: obj.VirtualHost) -> None:
-        """Add NameVirtualHost Directives if necessary for new vhost.
-
-        NameVirtualHosts was a directive in Apache < 2.4
-        https://httpd.apache.org/docs/2.2/mod/core.html#namevirtualhost
-
-        :param vhost: New virtual host that was recently created.
-        :type vhost: :class:`~certbot_apache._internal.obj.VirtualHost`
-
-        """
-        need_to_save: bool = False
-
-        # See if the exact address appears in any other vhost
-        # Remember 1.1.1.1:* == 1.1.1.1 -> hence any()
-        for addr in vhost.addrs:
-            # In Apache 2.2, when a NameVirtualHost directive is not
-            # set, "*" and "_default_" will conflict when sharing a port
-            addrs = {addr,}
-            if addr.get_addr() in ("*", "_default_"):
-                addrs.update(obj.Addr((a, addr.get_port(),))
-                             for a in ("*", "_default_"))
-
-            for test_vh in self.vhosts:
-                if (vhost.filep != test_vh.filep and
-                    any(test_addr in addrs for
-                        test_addr in test_vh.addrs) and not self.is_name_vhost(addr)):
-                    self.add_name_vhost(addr)
-                    logger.info("Enabling NameVirtualHosts on %s", addr)
-                    need_to_save = True
-                    break
-
-        if need_to_save:
-            self.save()
-
     def find_vhost_by_id(self, id_str: str) -> obj.VirtualHost:
         """
         Searches through VirtualHosts and tries to match the id in a comment
@@ -2014,12 +1932,6 @@ class ApacheConfigurator(common.Configurator):
         :param unused_options: Not currently used
         :type unused_options: Not Available
         """
-        min_apache_ver = (2, 3, 3)
-        if self.get_version() < min_apache_ver:
-            raise errors.PluginError(
-                "Unable to set OCSP directives.\n"
-                "Apache version is below 2.3.3.")
-
         if "socache_shmcb_module" not in self.parser.modules:
             self.enable_mod("socache_shmcb")
 
@@ -2200,10 +2112,7 @@ class ApacheConfigurator(common.Configurator):
                         general_vh.filep, ssl_vhost.filep)
 
     def _set_https_redirection_rewrite_rule(self, vhost: obj.VirtualHost) -> None:
-        if self.get_version() >= (2, 3, 9):
-            self.parser.add_dir(vhost.path, "RewriteRule", constants.REWRITE_HTTPS_ARGS_WITH_END)
-        else:
-            self.parser.add_dir(vhost.path, "RewriteRule", constants.REWRITE_HTTPS_ARGS)
+        self.parser.add_dir(vhost.path, "RewriteRule", constants.REWRITE_HTTPS_ARGS)
 
     def _verify_no_certbot_redirect(self, vhost: obj.VirtualHost) -> None:
         """Checks to see if a redirect was already installed by certbot.
@@ -2235,9 +2144,6 @@ class ApacheConfigurator(common.Configurator):
                 rewrite_args_dict[dir_path].append(match)
 
         if rewrite_args_dict:
-            redirect_args = [constants.REWRITE_HTTPS_ARGS,
-                             constants.REWRITE_HTTPS_ARGS_WITH_END]
-
             for dir_path, args_paths in rewrite_args_dict.items():
                 arg_vals = [self.parser.aug.get(x) for x in args_paths]
 
@@ -2249,7 +2155,7 @@ class ApacheConfigurator(common.Configurator):
                     raise errors.PluginEnhancementAlreadyPresent(
                         "Certbot has already enabled redirection")
 
-                if arg_vals in redirect_args:
+                if arg_vals == constants.REWRITE_HTTPS_ARGS:
                     raise errors.PluginEnhancementAlreadyPresent(
                         "Certbot has already enabled redirection")
 
@@ -2318,12 +2224,6 @@ class ApacheConfigurator(common.Configurator):
         if ssl_vhost.aliases:
             serveralias = "ServerAlias " + " ".join(ssl_vhost.aliases)
 
-        rewrite_rule_args: List[str]
-        if self.get_version() >= (2, 3, 9):
-            rewrite_rule_args = constants.REWRITE_HTTPS_ARGS_WITH_END
-        else:
-            rewrite_rule_args = constants.REWRITE_HTTPS_ARGS
-
         return (
             f"<VirtualHost {' '.join(str(addr) for addr in self._get_proposed_addrs(ssl_vhost))}>\n"
             f"{servername} \n"
@@ -2331,7 +2231,7 @@ class ApacheConfigurator(common.Configurator):
             f"ServerSignature Off\n"
             f"\n"
             f"RewriteEngine On\n"
-            f"RewriteRule {' '.join(rewrite_rule_args)}\n"
+            f"RewriteRule {' '.join(constants.REWRITE_HTTPS_ARGS)}\n"
             "\n"
             f"ErrorLog {self.options.logs_root}/redirect.error.log\n"
             f"LogLevel warn\n"

certbot-apache/certbot_apache/_internal/constants.py

@@ -42,18 +42,14 @@ AUGEAS_LENS_DIR = pkg_resources.resource_filename(
 """Path to the Augeas lens directory"""
 
 REWRITE_HTTPS_ARGS: List[str] = [
-    "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[L,NE,R=permanent]"]
-"""Apache version<2.3.9 rewrite rule arguments used for redirections to
-https vhost"""
-
-REWRITE_HTTPS_ARGS_WITH_END: List[str] = [
     "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[END,NE,R=permanent]"]
 """Apache version >= 2.3.9 rewrite rule arguments used for redirections to
     https vhost"""
 
 OLD_REWRITE_HTTPS_ARGS: List[List[str]] = [
     ["^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[L,QSA,R=permanent]"],
-    ["^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[END,QSA,R=permanent]"]]
+    ["^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[END,QSA,R=permanent]"],
+    ["^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[L,NE,R=permanent]"]]
 
 HSTS_ARGS: List[str] = ["always", "set", "Strict-Transport-Security",
              "\"max-age=31536000\""]

certbot-apache/certbot_apache/_internal/http_01.py

@@ -24,22 +24,6 @@ logger = logging.getLogger(__name__)
 class ApacheHttp01(common.ChallengePerformer):
     """Class that performs HTTP-01 challenges within the Apache configurator."""
 
-    CONFIG_TEMPLATE22_PRE = """\
-        RewriteEngine on
-        RewriteRule ^/\\.well-known/acme-challenge/([A-Za-z0-9-_=]+)$ {0}/$1 [L]
-
-    """
-    CONFIG_TEMPLATE22_POST = """\
-        <Directory {0}>
-            Order Allow,Deny
-            Allow from all
-        </Directory>
-        <Location /.well-known/acme-challenge>
-            Order Allow,Deny
-            Allow from all
-        </Location>
-    """
-
     CONFIG_TEMPLATE24_PRE = """\
         RewriteEngine on
         RewriteRule ^/\\.well-known/acme-challenge/([A-Za-z0-9-_=]+)$ {0}/$1 [END]
@@ -90,11 +74,7 @@ class ApacheHttp01(common.ChallengePerformer):
         """Make sure that we have the needed modules available for http01"""
 
         if self.configurator.conf("handle-modules"):
-            needed_modules = ["rewrite"]
-            if self.configurator.version < (2, 4):
-                needed_modules.append("authz_host")
-            else:
-                needed_modules.append("authz_core")
+            needed_modules = ["rewrite", "authz_core"]
             for mod in needed_modules:
                 if mod + "_module" not in self.configurator.parser.modules:
                     self.configurator.enable_mod(mod, temp=True)
@@ -131,15 +111,8 @@ class ApacheHttp01(common.ChallengePerformer):
         self.configurator.reverter.register_file_creation(
             True, self.challenge_conf_post)
 
-        if self.configurator.version < (2, 4):
-            config_template_pre = self.CONFIG_TEMPLATE22_PRE
-            config_template_post = self.CONFIG_TEMPLATE22_POST
-        else:
-            config_template_pre = self.CONFIG_TEMPLATE24_PRE
-            config_template_post = self.CONFIG_TEMPLATE24_POST
-
-        config_text_pre = config_template_pre.format(self.challenge_dir)
-        config_text_post = config_template_post.format(self.challenge_dir)
+        config_text_pre = self.CONFIG_TEMPLATE24_PRE.format(self.challenge_dir)
+        config_text_post = self.CONFIG_TEMPLATE24_POST.format(self.challenge_dir)
 
         logger.debug("writing a pre config file with text:\n %s", config_text_pre)
         with open(self.challenge_conf_pre, "w") as new_conf:
@@ -184,15 +157,13 @@ class ApacheHttp01(common.ChallengePerformer):
 
     def _set_up_challenges(self) -> List[KeyAuthorizationChallengeResponse]:
         if not os.path.isdir(self.challenge_dir):
-            old_umask = filesystem.umask(0o022)
-            try:
-                filesystem.makedirs(self.challenge_dir, 0o755)
-            except OSError as exception:
-                if exception.errno not in (errno.EEXIST, errno.EISDIR):
-                    raise errors.PluginError(
-                        "Couldn't create root for http-01 challenge")
-            finally:
-                filesystem.umask(old_umask)
+            with filesystem.temp_umask(0o022):
+                try:
+                    filesystem.makedirs(self.challenge_dir, 0o755)
+                except OSError as exception:
+                    if exception.errno not in (errno.EEXIST, errno.EISDIR):
+                        raise errors.PluginError(
+                            "Couldn't create root for http-01 challenge")
 
         responses = []
         for achall in self.achalls:

certbot-apache/certbot_apache/_internal/override_centos.py

@@ -1,8 +1,6 @@
 """ Distribution specific override class for CentOS family (RHEL, Fedora) """
 import logging
 from typing import Any
-from typing import cast
-from typing import List
 
 from certbot_apache._internal import apache_util
 from certbot_apache._internal import configurator
@@ -11,7 +9,6 @@ from certbot_apache._internal.configurator import OsOptions
 
 from certbot import errors
 from certbot import util
-from certbot.errors import MisconfigurationError
 
 logger = logging.getLogger(__name__)
 
@@ -61,8 +58,13 @@ class CentOSConfigurator(configurator.ApacheConfigurator):
             "rhel", "redhatenterpriseserver", "red hat enterprise linux server",
             "scientific", "scientific linux",
         ]
+        # It is important that the loose version comparison below is not made
+        # if the OS is not RHEL derived. See
+        # https://github.com/certbot/certbot/issues/9481.
+        if not rhel_derived:
+            return False
         at_least_v9 = util.parse_loose_version(os_version) >= util.parse_loose_version('9')
-        return rhel_derived and at_least_v9
+        return at_least_v9
 
     def _override_cmds(self) -> None:
         super()._override_cmds()
@@ -101,82 +103,6 @@ class CentOSConfigurator(configurator.ApacheConfigurator):
         return CentOSParser(
             self.options.server_root, self, self.options.vhost_root, self.version)
 
-    def _deploy_cert(self, *args: Any, **kwargs: Any) -> None:  # pylint: disable=arguments-differ
-        """
-        Override _deploy_cert in order to ensure that the Apache configuration
-        has "LoadModule ssl_module..." before parsing the VirtualHost configuration
-        that was created by Certbot
-        """
-        super()._deploy_cert(*args, **kwargs)
-        if self.version < (2, 4, 0):
-            self._deploy_loadmodule_ssl_if_needed()
-
-    def _deploy_loadmodule_ssl_if_needed(self) -> None:
-        """
-        Add "LoadModule ssl_module <pre-existing path>" to main httpd.conf if
-        it doesn't exist there already.
-        """
-
-        loadmods = self.parser.find_dir("LoadModule", "ssl_module", exclude=False)
-
-        correct_ifmods: List[str] = []
-        loadmod_args: List[str] = []
-        loadmod_paths: List[str] = []
-        for m in loadmods:
-            noarg_path = m.rpartition("/")[0]
-            path_args = self.parser.get_all_args(noarg_path)
-            if loadmod_args:
-                if loadmod_args != path_args:
-                    msg = ("Certbot encountered multiple LoadModule directives "
-                           "for LoadModule ssl_module with differing library paths. "
-                           "Please remove or comment out the one(s) that are not in "
-                           "use, and run Certbot again.")
-                    raise MisconfigurationError(msg)
-            else:
-                loadmod_args = [arg for arg in path_args if arg]
-
-            centos_parser: CentOSParser = cast(CentOSParser, self.parser)
-            if centos_parser.not_modssl_ifmodule(noarg_path):
-                if centos_parser.loc["default"] in noarg_path:
-                    # LoadModule already in the main configuration file
-                    if "ifmodule/" in noarg_path.lower() or "ifmodule[1]" in noarg_path.lower():
-                        # It's the first or only IfModule in the file
-                        return
-                # Populate the list of known !mod_ssl.c IfModules
-                nodir_path = noarg_path.rpartition("/directive")[0]
-                correct_ifmods.append(nodir_path)
-            else:
-                loadmod_paths.append(noarg_path)
-
-        if not loadmod_args:
-            # Do not try to enable mod_ssl
-            return
-
-        # Force creation as the directive wasn't found from the beginning of
-        # httpd.conf
-        rootconf_ifmod = self.parser.create_ifmod(
-            parser.get_aug_path(self.parser.loc["default"]),
-            "!mod_ssl.c", beginning=True)
-        # parser.get_ifmod returns a path postfixed with "/", remove that
-        self.parser.add_dir(rootconf_ifmod[:-1], "LoadModule", loadmod_args)
-        correct_ifmods.append(rootconf_ifmod[:-1])
-        self.save_notes += "Added LoadModule ssl_module to main configuration.\n"
-
-        # Wrap LoadModule mod_ssl inside of <IfModule !mod_ssl.c> if it's not
-        # configured like this already.
-        for loadmod_path in loadmod_paths:
-            nodir_path = loadmod_path.split("/directive")[0]
-            # Remove the old LoadModule directive
-            self.parser.aug.remove(loadmod_path)
-
-            # Create a new IfModule !mod_ssl.c if not already found on path
-            ssl_ifmod = self.parser.get_ifmod(nodir_path, "!mod_ssl.c", beginning=True)[:-1]
-            if ssl_ifmod not in correct_ifmods:
-                self.parser.add_dir(ssl_ifmod, "LoadModule", loadmod_args)
-                correct_ifmods.append(ssl_ifmod)
-                self.save_notes += ("Wrapped pre-existing LoadModule ssl_module "
-                                    "inside of <IfModule !mod_ssl> block.\n")
-
 
 class CentOSParser(parser.ApacheParser):
     """CentOS specific ApacheParser override class"""
@@ -196,33 +122,3 @@ class CentOSParser(parser.ApacheParser):
         defines = apache_util.parse_define_file(self.sysconfig_filep, "OPTIONS")
         for k, v in defines.items():
             self.variables[k] = v
-
-    def not_modssl_ifmodule(self, path: str) -> bool:
-        """Checks if the provided Augeas path has argument !mod_ssl"""
-
-        if "ifmodule" not in path.lower():
-            return False
-
-        # Trim the path to the last ifmodule
-        workpath = path.lower()
-        while workpath:
-            # Get path to the last IfModule (ignore the tail)
-            parts = workpath.rpartition("ifmodule")
-
-            if not parts[0]:
-                # IfModule not found
-                break
-            ifmod_path = parts[0] + parts[1]
-            # Check if ifmodule had an index
-            if parts[2].startswith("["):
-                # Append the index from tail
-                ifmod_path += parts[2].partition("/")[0]
-            # Get the original path trimmed to correct length
-            # This is required to preserve cases
-            ifmod_real_path = path[0:len(ifmod_path)]
-            if "!mod_ssl.c" in self.get_all_args(ifmod_real_path):
-                return True
-            # Set the workpath to the heading part
-            workpath = parts[0]
-
-        return False

certbot-apache/certbot_apache/_internal/parser.py

@@ -47,6 +47,7 @@ class ApacheParser:
     arg_var_interpreter: Pattern = re.compile(r"\$\{[^ \}]*}")
     fnmatch_chars: Set[str] = {"*", "?", "\\", "[", "]"}
 
+    # pylint: disable=unused-argument
     def __init__(self, root: str, configurator: "ApacheConfigurator",
                  vhostroot: str, version: Tuple[int, ...] = (2, 4)) -> None:
         # Note: Order is important here.
@@ -74,9 +75,8 @@ class ApacheParser:
         self.loc: Dict[str, str] = {"root": self._find_config_root()}
         self.parse_file(self.loc["root"])
 
-        if version >= (2, 4):
-            # Look up variables from httpd and add to DOM if not already parsed
-            self.update_runtime_variables()
+        # Look up variables from httpd and add to DOM if not already parsed
+        self.update_runtime_variables()
 
         # This problem has been fixed in Augeas 1.0
         self.standardize_excl()
@@ -95,11 +95,6 @@ class ApacheParser:
             self.parse_file(os.path.abspath(vhostroot) + "/" +
                             self.configurator.options.vhost_files)
 
-        # check to see if there were unparsed define statements
-        if version < (2, 4):
-            if self.find_dir("Define", exclude=False):
-                raise errors.PluginError("Error parsing runtime variables")
-
     def check_parsing_errors(self, lens: str) -> None:
         """Verify Augeas can parse all of the lens files.
 
@@ -382,7 +377,7 @@ class ApacheParser:
             for i, arg in enumerate(args):
                 self.aug.set("%s/arg[%d]" % (nvh_path, i + 1), arg)
 
-    def get_ifmod(self, aug_conf_path: str, mod: str, beginning: bool = False) -> str:
+    def get_ifmod(self, aug_conf_path: str, mod: str) -> str:
         """Returns the path to <IfMod mod> and creates one if it doesn't exist.
 
         :param str aug_conf_path: Augeas configuration path
@@ -399,35 +394,26 @@ class ApacheParser:
         if_mods = self.aug.match(("%s/IfModule/*[self::arg='%s']" %
                                   (aug_conf_path, mod)))
         if not if_mods:
-            return self.create_ifmod(aug_conf_path, mod, beginning)
+            return self.create_ifmod(aug_conf_path, mod)
 
         # Strip off "arg" at end of first ifmod path
         return if_mods[0].rpartition("arg")[0]
 
-    def create_ifmod(self, aug_conf_path: str, mod: str, beginning: bool = False) -> str:
+    def create_ifmod(self, aug_conf_path: str, mod: str) -> str:
         """Creates a new <IfMod mod> and returns its path.
 
         :param str aug_conf_path: Augeas configuration path
         :param str mod: module ie. mod_ssl.c
-        :param bool beginning: If the IfModule should be created to the beginning
-            of augeas path DOM tree.
 
         :returns: Augeas path of the newly created IfModule directive.
             The path may be dynamic, i.e. .../IfModule[last()]
         :rtype: str
 
         """
-        if beginning:
-            c_path_arg = "{}/IfModule[1]/arg".format(aug_conf_path)
-            # Insert IfModule before the first directive
-            self.aug.insert("{}/directive[1]".format(aug_conf_path),
-                            "IfModule", True)
-            retpath = "{}/IfModule[1]/".format(aug_conf_path)
-        else:
-            c_path = "{}/IfModule[last() + 1]".format(aug_conf_path)
-            c_path_arg = "{}/IfModule[last()]/arg".format(aug_conf_path)
-            self.aug.set(c_path, "")
-            retpath = "{}/IfModule[last()]/".format(aug_conf_path)
+        c_path = "{}/IfModule[last() + 1]".format(aug_conf_path)
+        c_path_arg = "{}/IfModule[last()]/arg".format(aug_conf_path)
+        self.aug.set(c_path, "")
+        retpath = "{}/IfModule[last()]/".format(aug_conf_path)
         self.aug.set(c_path_arg, mod)
         return retpath
 
@@ -587,20 +573,6 @@ class ApacheParser:
 
         return ordered_matches
 
-    def get_all_args(self, match: str) -> List[Optional[str]]:
-        """
-        Tries to fetch all arguments for a directive. See get_arg.
-
-        Note that if match is an ancestor node, it returns all names of
-        child directives as well as the list of arguments.
-
-        """
-
-        if match[-1] != "/":
-            match = match + "/"
-        allargs = self.aug.match(match + '*')
-        return [self.get_arg(arg) for arg in allargs]
-
     def get_arg(self, match: str) -> Optional[str]:
         """Uses augeas.get to get argument value and interprets result.
 

certbot-apache/setup.py

@@ -1,7 +1,7 @@
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     # We specify the minimum acme and certbot version as the current plugin
@@ -38,6 +38,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-apache/tests/augeasnode_test.py

@@ -1,13 +1,9 @@
 """Tests for AugeasParserNode classes"""
 from typing import List
 
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
-
 import os
 import util
+from unittest import mock
 
 from certbot import errors
 

certbot-apache/tests/autohsts_test.py

@@ -2,11 +2,7 @@
 """Test for certbot_apache._internal.configurator AutoHSTS functionality"""
 import re
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from certbot import errors
 from certbot_apache._internal import constants

certbot-apache/tests/centos6_test.py

@@ -1,228 +0,0 @@
-"""Test for certbot_apache._internal.configurator for CentOS 6 overrides"""
-import unittest
-from unittest import mock
-
-from certbot.compat import os
-from certbot.errors import MisconfigurationError
-from certbot_apache._internal import obj
-from certbot_apache._internal import override_centos
-from certbot_apache._internal import parser
-import util
-
-
-def get_vh_truth(temp_dir, config_name):
-    """Return the ground truth for the specified directory."""
-    prefix = os.path.join(
-        temp_dir, config_name, "httpd/conf.d")
-
-    aug_pre = "/files" + prefix
-    vh_truth = [
-        obj.VirtualHost(
-            os.path.join(prefix, "test.example.com.conf"),
-            os.path.join(aug_pre, "test.example.com.conf/VirtualHost"),
-            {obj.Addr.fromstring("*:80")},
-            False, True, "test.example.com"),
-        obj.VirtualHost(
-            os.path.join(prefix, "ssl.conf"),
-            os.path.join(aug_pre, "ssl.conf/VirtualHost"),
-            {obj.Addr.fromstring("_default_:443")},
-            True, True, None)
-    ]
-    return vh_truth
-
-class CentOS6Tests(util.ApacheTest):
-    """Tests for CentOS 6"""
-
-    def setUp(self):  # pylint: disable=arguments-differ
-        test_dir = "centos6_apache/apache"
-        config_root = "centos6_apache/apache/httpd"
-        vhost_root = "centos6_apache/apache/httpd/conf.d"
-        super().setUp(test_dir=test_dir,
-                      config_root=config_root,
-                      vhost_root=vhost_root)
-
-        self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir,
-            version=(2, 2, 15), os_info="centos")
-        self.vh_truth = get_vh_truth(
-            self.temp_dir, "centos6_apache/apache")
-
-    def test_get_parser(self):
-        self.assertIsInstance(self.config.parser, override_centos.CentOSParser)
-
-    def test_get_virtual_hosts(self):
-        """Make sure all vhosts are being properly found."""
-        vhs = self.config.get_virtual_hosts()
-        self.assertEqual(len(vhs), 2)
-        found = 0
-
-        for vhost in vhs:
-            for centos_truth in self.vh_truth:
-                if vhost == centos_truth:
-                    found += 1
-                    break
-            else:
-                raise Exception("Missed: %s" % vhost)  # pragma: no cover
-        self.assertEqual(found, 2)
-
-    @mock.patch("certbot_apache._internal.configurator.display_util.notify")
-    def test_loadmod_default(self, unused_mock_notify):
-        ssl_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", exclude=False)
-        self.assertEqual(len(ssl_loadmods), 1)
-        # Make sure the LoadModule ssl_module is in ssl.conf (default)
-        self.assertIn("ssl.conf", ssl_loadmods[0])
-        # ...and that it's not inside of <IfModule>
-        self.assertNotIn("IfModule", ssl_loadmods[0])
-
-        # Get the example vhost
-        self.config.assoc["test.example.com"] = self.vh_truth[0]
-        self.config.deploy_cert(
-            "random.demo", "example/cert.pem", "example/key.pem",
-            "example/cert_chain.pem", "example/fullchain.pem")
-        self.config.save()
-
-        post_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", exclude=False)
-
-        # We should now have LoadModule ssl_module in root conf and ssl.conf
-        self.assertEqual(len(post_loadmods), 2)
-        for lm in post_loadmods:
-            # lm[:-7] removes "/arg[#]" from the path
-            arguments = self.config.parser.get_all_args(lm[:-7])
-            self.assertEqual(arguments, ["ssl_module", "modules/mod_ssl.so"])
-            # ...and both of them should be wrapped in <IfModule !mod_ssl.c>
-            # lm[:-17] strips off /directive/arg[1] from the path.
-            ifmod_args = self.config.parser.get_all_args(lm[:-17])
-            self.assertIn("!mod_ssl.c", ifmod_args)
-
-    @mock.patch("certbot_apache._internal.configurator.display_util.notify")
-    def test_loadmod_multiple(self, unused_mock_notify):
-        sslmod_args = ["ssl_module", "modules/mod_ssl.so"]
-        # Adds another LoadModule to main httpd.conf in addtition to ssl.conf
-        self.config.parser.add_dir(self.config.parser.loc["default"], "LoadModule",
-                                   sslmod_args)
-        self.config.save()
-        pre_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", exclude=False)
-        # LoadModules are not within IfModule blocks
-        self.assertIs(any("ifmodule" in m.lower() for m in pre_loadmods), False)
-        self.config.assoc["test.example.com"] = self.vh_truth[0]
-        self.config.deploy_cert(
-            "random.demo", "example/cert.pem", "example/key.pem",
-            "example/cert_chain.pem", "example/fullchain.pem")
-        post_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", exclude=False)
-
-        for mod in post_loadmods:
-            with self.subTest(mod=mod):
-                # pylint: disable=no-member
-                self.assertIs(self.config.parser.not_modssl_ifmodule(mod), True)
-
-    @mock.patch("certbot_apache._internal.configurator.display_util.notify")
-    def test_loadmod_rootconf_exists(self, unused_mock_notify):
-        sslmod_args = ["ssl_module", "modules/mod_ssl.so"]
-        rootconf_ifmod = self.config.parser.get_ifmod(
-            parser.get_aug_path(self.config.parser.loc["default"]),
-            "!mod_ssl.c", beginning=True)
-        self.config.parser.add_dir(rootconf_ifmod[:-1], "LoadModule", sslmod_args)
-        self.config.save()
-        # Get the example vhost
-        self.config.assoc["test.example.com"] = self.vh_truth[0]
-        self.config.deploy_cert(
-            "random.demo", "example/cert.pem", "example/key.pem",
-            "example/cert_chain.pem", "example/fullchain.pem")
-        self.config.save()
-
-        root_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module",
-            start=parser.get_aug_path(self.config.parser.loc["default"]),
-            exclude=False)
-
-        mods = [lm for lm in root_loadmods if self.config.parser.loc["default"] in lm]
-
-        self.assertEqual(len(mods), 1)
-        # [:-7] removes "/arg[#]" from the path
-        self.assertEqual(
-            self.config.parser.get_all_args(mods[0][:-7]),
-            sslmod_args)
-
-    @mock.patch("certbot_apache._internal.configurator.display_util.notify")
-    def test_neg_loadmod_already_on_path(self, unused_mock_notify):
-        loadmod_args = ["ssl_module", "modules/mod_ssl.so"]
-        ifmod = self.config.parser.get_ifmod(
-            self.vh_truth[1].path, "!mod_ssl.c", beginning=True)
-        self.config.parser.add_dir(ifmod[:-1], "LoadModule", loadmod_args)
-        self.config.parser.add_dir(self.vh_truth[1].path, "LoadModule", loadmod_args)
-        self.config.save()
-        pre_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", start=self.vh_truth[1].path, exclude=False)
-        self.assertEqual(len(pre_loadmods), 2)
-        # The ssl.conf now has two LoadModule directives, one inside of
-        # !mod_ssl.c IfModule
-        self.config.assoc["test.example.com"] = self.vh_truth[0]
-        self.config.deploy_cert(
-            "random.demo", "example/cert.pem", "example/key.pem",
-            "example/cert_chain.pem", "example/fullchain.pem")
-        self.config.save()
-        # Ensure that the additional LoadModule wasn't written into the IfModule
-        post_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", start=self.vh_truth[1].path, exclude=False)
-        self.assertEqual(len(post_loadmods), 1)
-
-    def test_loadmod_non_duplicate(self):
-        # the modules/mod_ssl.so exists in ssl.conf
-        sslmod_args = ["ssl_module", "modules/mod_somethingelse.so"]
-        rootconf_ifmod = self.config.parser.get_ifmod(
-            parser.get_aug_path(self.config.parser.loc["default"]),
-            "!mod_ssl.c", beginning=True)
-        self.config.parser.add_dir(rootconf_ifmod[:-1], "LoadModule", sslmod_args)
-        self.config.save()
-        self.config.assoc["test.example.com"] = self.vh_truth[0]
-        pre_matches = self.config.parser.find_dir("LoadModule",
-                                                  "ssl_module", exclude=False)
-
-        self.assertRaises(MisconfigurationError, self.config.deploy_cert,
-                "random.demo", "example/cert.pem", "example/key.pem",
-                "example/cert_chain.pem", "example/fullchain.pem")
-
-        post_matches = self.config.parser.find_dir("LoadModule",
-                                                   "ssl_module", exclude=False)
-        # Make sure that none was changed
-        self.assertEqual(pre_matches, post_matches)
-
-    @mock.patch("certbot_apache._internal.configurator.display_util.notify")
-    def test_loadmod_not_found(self, unused_mock_notify):
-        # Remove all existing LoadModule ssl_module... directives
-        orig_loadmods = self.config.parser.find_dir("LoadModule",
-                                                    "ssl_module",
-                                                    exclude=False)
-        for mod in orig_loadmods:
-            noarg_path = mod.rpartition("/")[0]
-            self.config.parser.aug.remove(noarg_path)
-        self.config.save()
-        self.config.deploy_cert(
-            "random.demo", "example/cert.pem", "example/key.pem",
-            "example/cert_chain.pem", "example/fullchain.pem")
-
-        post_loadmods = self.config.parser.find_dir("LoadModule",
-                                                    "ssl_module",
-                                                    exclude=False)
-        self.assertEqual(post_loadmods, [])
-
-    def test_no_ifmod_search_false(self):
-        #pylint: disable=no-member
-
-        self.assertIs(self.config.parser.not_modssl_ifmodule(
-            "/path/does/not/include/ifmod"
-        ), False)
-        self.assertIs(self.config.parser.not_modssl_ifmodule(
-            ""
-        ), False)
-        self.assertIs(self.config.parser.not_modssl_ifmodule(
-            "/path/includes/IfModule/but/no/arguments"
-        ), False)
-
-
-if __name__ == "__main__":
-    unittest.main()  # pragma: no cover

certbot-apache/tests/centos_test.py

@@ -1,10 +1,6 @@
 """Test for certbot_apache._internal.configurator for Centos overrides"""
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from certbot import errors
 from certbot.compat import filesystem

certbot-apache/tests/configurator_reverter_test.py

@@ -1,11 +1,7 @@
 """Test for certbot_apache._internal.configurator implementations of reverter"""
 import shutil
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from certbot import errors
 import util

certbot-apache/tests/configurator_test.py

@@ -5,11 +5,7 @@ import shutil
 import socket
 import tempfile
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from acme import challenges
 from certbot import achallenges
@@ -443,18 +439,6 @@ class MultipleVhostsTest(util.ApacheTest):
             "SSLCertificateChainFile", "two/cert_chain.pem",
             self.vh_truth[1].path))
 
-    def test_is_name_vhost(self):
-        addr = obj.Addr.fromstring("*:80")
-        self.assertIs(self.config.is_name_vhost(addr), True)
-        self.config.version = (2, 2)
-        self.assertIs(self.config.is_name_vhost(addr), False)
-
-    def test_add_name_vhost(self):
-        self.config.add_name_vhost(obj.Addr.fromstring("*:443"))
-        self.config.add_name_vhost(obj.Addr.fromstring("*:80"))
-        self.assertTrue(self.config.parser.find_dir("NameVirtualHost", "*:443", exclude=False))
-        self.assertTrue(self.config.parser.find_dir("NameVirtualHost", "*:80"))
-
     def test_add_listen_80(self):
         mock_find = mock.Mock()
         mock_add_dir = mock.Mock()
@@ -642,9 +626,6 @@ class MultipleVhostsTest(util.ApacheTest):
         self.assertIs(ssl_vhost.ssl, True)
         self.assertIs(ssl_vhost.enabled, False)
 
-        self.assertEqual(self.config.is_name_vhost(self.vh_truth[0]),
-                         self.config.is_name_vhost(ssl_vhost))
-
         self.assertEqual(len(self.config.vhosts), 13)
 
     def test_clean_vhost_ssl(self):
@@ -721,21 +702,6 @@ class MultipleVhostsTest(util.ApacheTest):
         # pylint: disable=protected-access
         self.assertIs(self.config._get_ssl_vhost_path("example_path").endswith(".conf"), True)
 
-    def test_add_name_vhost_if_necessary(self):
-        # pylint: disable=protected-access
-        self.config.add_name_vhost = mock.Mock()
-        self.config.version = (2, 2)
-        self.config._add_name_vhost_if_necessary(self.vh_truth[0])
-        self.assertIs(self.config.add_name_vhost.called, True)
-
-        new_addrs = set()
-        for addr in self.vh_truth[0].addrs:
-            new_addrs.add(obj.Addr(("_default_", addr.get_port(),)))
-
-        self.vh_truth[0].addrs = new_addrs
-        self.config._add_name_vhost_if_necessary(self.vh_truth[0])
-        self.assertEqual(self.config.add_name_vhost.call_count, 2)
-
     @mock.patch("certbot_apache._internal.configurator.http_01.ApacheHttp01.perform")
     @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.restart")
     def test_perform(self, mock_restart, mock_http_perform):
@@ -946,20 +912,6 @@ class MultipleVhostsTest(util.ApacheTest):
 
         self.assertEqual(len(stapling_cache_aug_path), 1)
 
-
-    @mock.patch("certbot.util.exe_exists")
-    def test_ocsp_unsupported_apache_version(self, mock_exe):
-        mock_exe.return_value = True
-        self.config.parser.update_runtime_variables = mock.Mock()
-        self.config.parser.modules["mod_ssl.c"] = None
-        self.config.parser.modules["socache_shmcb_module"] = None
-        self.config.get_version = mock.Mock(return_value=(2, 2, 0))
-        self.config.choose_vhost("certbot.demo")
-
-        self.assertRaises(errors.PluginError,
-                self.config.enhance, "certbot.demo", "staple-ocsp")
-
-
     def test_get_http_vhost_third_filter(self):
         ssl_vh = obj.VirtualHost(
             "fp", "ap", {obj.Addr(("*", "443"))},
@@ -1137,7 +1089,7 @@ class MultipleVhostsTest(util.ApacheTest):
         self.config.parser.modules["rewrite_module"] = None
         self.config.parser.update_runtime_variables = mock.Mock()
         mock_exe.return_value = True
-        self.config.get_version = mock.Mock(return_value=(2, 2, 0))
+        self.config.get_version = mock.Mock(return_value=(2, 4, 0))
 
         ssl_vhost = self.config.choose_vhost("certbot.demo")
 
@@ -1567,9 +1519,6 @@ class MultiVhostsTest(util.ApacheTest):
         self.assertIs(ssl_vhost.ssl, True)
         self.assertIs(ssl_vhost.enabled, False)
 
-        self.assertEqual(self.config.is_name_vhost(self.vh_truth[1]),
-                         self.config.is_name_vhost(ssl_vhost))
-
         mock_path = "certbot_apache._internal.configurator.ApacheConfigurator._get_new_vh_path"
         with mock.patch(mock_path) as mock_getpath:
             mock_getpath.return_value = None

certbot-apache/tests/debian_test.py

@@ -1,11 +1,7 @@
 """Test for certbot_apache._internal.configurator for Debian overrides"""
 import shutil
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from certbot import errors
 from certbot.compat import os

certbot-apache/tests/display_ops_test.py

@@ -1,10 +1,6 @@
 """Test certbot_apache._internal.display_ops."""
 import unittest
-
-try:
-    import mock
-except ImportError:  # pragma: no cover
-    from unittest import mock  # type: ignore
+from unittest import mock
 
 from certbot import errors
 from certbot.display import util as display_util

certbot-apache/tests/dualnode_test.py

@@ -1,10 +1,6 @@
 """Tests for DualParserNode implementation"""
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from certbot_apache._internal import assertions
 from certbot_apache._internal import augeasparser

certbot-apache/tests/entrypoint_test.py

@@ -1,10 +1,6 @@
 """Test for certbot_apache._internal.entrypoint for override class resolution"""
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from certbot_apache._internal import configurator
 from certbot_apache._internal import entrypoint

certbot-apache/tests/fedora_test.py

@@ -1,10 +1,6 @@
 """Test for certbot_apache._internal.configurator for Fedora 29+ overrides"""
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from certbot import errors
 from certbot.compat import filesystem

certbot-apache/tests/gentoo_test.py

@@ -1,10 +1,6 @@
 """Test for certbot_apache._internal.configurator for Gentoo overrides"""
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from certbot import errors
 from certbot.compat import filesystem

certbot-apache/tests/http_01_test.py

@@ -2,11 +2,7 @@
 import unittest
 import errno
 from typing import List
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from acme import challenges
 from certbot import achallenges
@@ -53,15 +49,6 @@ class ApacheHttp01Test(util.ApacheTest):
     def test_empty_perform(self):
         self.assertEqual(len(self.http.perform()), 0)
 
-    @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.enable_mod")
-    def test_enable_modules_apache_2_2(self, mock_enmod):
-        self.config.version = (2, 2)
-        del self.config.parser.modules["authz_host_module"]
-        del self.config.parser.modules["mod_authz_host.c"]
-
-        enmod_calls = self.common_enable_modules_test(mock_enmod)
-        self.assertEqual(enmod_calls[0][0][0], "authz_host")
-
     @mock.patch("certbot_apache._internal.configurator.ApacheConfigurator.enable_mod")
     def test_enable_modules_apache_2_4(self, mock_enmod):
         del self.config.parser.modules["authz_core_module"]
@@ -143,21 +130,12 @@ class ApacheHttp01Test(util.ApacheTest):
         self.config.config.http01_port = 12345
         self.assertRaises(errors.PluginError, self.http.perform)
 
-    def test_perform_1_achall_apache_2_2(self):
-        self.combinations_perform_test(num_achalls=1, minor_version=2)
-
     def test_perform_1_achall_apache_2_4(self):
         self.combinations_perform_test(num_achalls=1, minor_version=4)
 
-    def test_perform_2_achall_apache_2_2(self):
-        self.combinations_perform_test(num_achalls=2, minor_version=2)
-
     def test_perform_2_achall_apache_2_4(self):
         self.combinations_perform_test(num_achalls=2, minor_version=4)
 
-    def test_perform_3_achall_apache_2_2(self):
-        self.combinations_perform_test(num_achalls=3, minor_version=2)
-
     def test_perform_3_achall_apache_2_4(self):
         self.combinations_perform_test(num_achalls=3, minor_version=4)
 
@@ -230,10 +208,7 @@ class ApacheHttp01Test(util.ApacheTest):
         self.assertIn("RewriteRule", pre_conf_contents)
 
         self.assertIn(self.http.challenge_dir, post_conf_contents)
-        if self.config.version < (2, 4):
-            self.assertIn("Allow from all", post_conf_contents)
-        else:
-            self.assertIn("Require all granted", post_conf_contents)
+        self.assertIn("Require all granted", post_conf_contents)
 
     def _test_challenge_file(self, achall):
         name = os.path.join(self.http.challenge_dir, achall.chall.encode("token"))

certbot-apache/tests/parser_test.py

@@ -1,11 +1,7 @@
 """Tests for certbot_apache._internal.parser."""
 import shutil
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from certbot import errors
 from certbot.compat import os
@@ -370,15 +366,6 @@ class ParserInitTest(util.ApacheTest):
                 ApacheParser, os.path.relpath(self.config_path), self.config,
                 "/dummy/vhostpath", version=(2, 4, 22))
 
-    @mock.patch("certbot_apache._internal.apache_util._get_runtime_cfg")
-    def test_unparseable(self, mock_cfg):
-        from certbot_apache._internal.parser import ApacheParser
-        mock_cfg.return_value = ('Define: TEST')
-        self.assertRaises(
-            errors.PluginError,
-            ApacheParser, os.path.relpath(self.config_path), self.config,
-            "/dummy/vhostpath", version=(2, 2, 22))
-
     def test_root_normalized(self):
         from certbot_apache._internal.parser import ApacheParser
 

certbot-apache/tests/parsernode_configurator_test.py

@@ -1,10 +1,6 @@
 """Tests for ApacheConfigurator for AugeasParserNode classes"""
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 import util
 

certbot-apache/tests/testdata/centos6_apache/apache/httpd/conf.d/README

@@ -1,9 +0,0 @@
-
-This directory holds Apache 2.0 module-specific configuration files;
-any files in this directory which have the ".conf" extension will be
-processed as Apache configuration files.
-
-Files are processed in alphabetical order, so if using configuration
-directives which depend on, say, mod_perl being loaded, ensure that
-these are placed in a filename later in the sort order than "perl.conf".
-

certbot-apache/tests/testdata/centos6_apache/apache/httpd/conf.d/ssl.conf

@@ -1,222 +0,0 @@
-#
-# This is the Apache server configuration file providing SSL support.
-# It contains the configuration directives to instruct the server how to
-# serve pages over an https connection. For detailing information about these 
-# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
-# 
-# Do NOT simply read the instructions in here without understanding
-# what they do.  They're here only as hints or reminders.  If you are unsure
-# consult the online docs. You have been warned.  
-#
-
-LoadModule ssl_module modules/mod_ssl.so
-
-#
-# When we also provide SSL we have to listen to the 
-# the HTTPS port in addition.
-#
-Listen 443
-
-##
-##  SSL Global Context
-##
-##  All SSL configuration in this context applies both to
-##  the main server and all SSL-enabled virtual hosts.
-##
-
-#   Pass Phrase Dialog:
-#   Configure the pass phrase gathering process.
-#   The filtering dialog program (`builtin' is an internal
-#   terminal dialog) has to provide the pass phrase on stdout.
-SSLPassPhraseDialog  builtin
-
-#   Inter-Process Session Cache:
-#   Configure the SSL Session Cache: First the mechanism 
-#   to use and second the expiring timeout (in seconds).
-SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
-SSLSessionCacheTimeout  300
-
-#   Semaphore:
-#   Configure the path to the mutual exclusion semaphore the
-#   SSL engine uses internally for inter-process synchronization. 
-SSLMutex default
-
-#   Pseudo Random Number Generator (PRNG):
-#   Configure one or more sources to seed the PRNG of the 
-#   SSL library. The seed data should be of good random quality.
-#   WARNING! On some platforms /dev/random blocks if not enough entropy
-#   is available. This means you then cannot use the /dev/random device
-#   because it would lead to very long connection times (as long as
-#   it requires to make more entropy available). But usually those
-#   platforms additionally provide a /dev/urandom device which doesn't
-#   block. So, if available, use this one instead. Read the mod_ssl User
-#   Manual for more details.
-SSLRandomSeed startup file:/dev/urandom  256
-SSLRandomSeed connect builtin
-#SSLRandomSeed startup file:/dev/random  512
-#SSLRandomSeed connect file:/dev/random  512
-#SSLRandomSeed connect file:/dev/urandom 512
-
-#
-# Use "SSLCryptoDevice" to enable any supported hardware
-# accelerators. Use "openssl engine -v" to list supported
-# engine names.  NOTE: If you enable an accelerator and the
-# server does not start, consult the error logs and ensure
-# your accelerator is functioning properly. 
-#
-SSLCryptoDevice builtin
-#SSLCryptoDevice ubsec
-
-##
-## SSL Virtual Host Context
-##
-
-<VirtualHost _default_:443>
-
-# General setup for the virtual host, inherited from global configuration
-#DocumentRoot "/var/www/html"
-#ServerName www.example.com:443
-
-# Use separate log files for the SSL virtual host; note that LogLevel
-# is not inherited from httpd.conf.
-ErrorLog logs/ssl_error_log
-TransferLog logs/ssl_access_log
-LogLevel warn
-
-#   SSL Engine Switch:
-#   Enable/Disable SSL for this virtual host.
-SSLEngine on
-
-#   SSL Protocol support:
-# List the enable protocol levels with which clients will be able to
-# connect.  Disable SSLv2 access by default:
-SSLProtocol all -SSLv2
-
-#   SSL Cipher Suite:
-# List the ciphers that the client is permitted to negotiate.
-# See the mod_ssl documentation for a complete list.
-SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
-
-#   Server Certificate:
-# Point SSLCertificateFile at a PEM encoded certificate.  If
-# the certificate is encrypted, then you will be prompted for a
-# pass phrase.  Note that a kill -HUP will prompt again.  A new
-# certificate can be generated using the genkey(1) command.
-SSLCertificateFile /etc/pki/tls/certs/localhost.crt
-
-#   Server Private Key:
-#   If the key is not combined with the certificate, use this
-#   directive to point at the key file.  Keep in mind that if
-#   you've both a RSA and a DSA private key you can configure
-#   both in parallel (to also allow the use of DSA ciphers, etc.)
-SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
-
-#   Server Certificate Chain:
-#   Point SSLCertificateChainFile at a file containing the
-#   concatenation of PEM encoded CA certificates which form the
-#   certificate chain for the server certificate. Alternatively
-#   the referenced file can be the same as SSLCertificateFile
-#   when the CA certificates are directly appended to the server
-#   certificate for convinience.
-#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
-
-#   Certificate Authority (CA):
-#   Set the CA certificate verification path where to find CA
-#   certificates for client authentication or alternatively one
-#   huge file containing all of them (file must be PEM encoded)
-#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
-
-#   Client Authentication (Type):
-#   Client certificate verification type and depth.  Types are
-#   none, optional, require and optional_no_ca.  Depth is a
-#   number which specifies how deeply to verify the certificate
-#   issuer chain before deciding the certificate is not valid.
-#SSLVerifyClient require
-#SSLVerifyDepth  10
-
-#   Access Control:
-#   With SSLRequire you can do per-directory access control based
-#   on arbitrary complex boolean expressions containing server
-#   variable checks and other lookup directives.  The syntax is a
-#   mixture between C and Perl.  See the mod_ssl documentation
-#   for more details.
-#<Location />
-#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
-#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
-#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
-#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
-#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
-#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
-#</Location>
-
-#   SSL Engine Options:
-#   Set various options for the SSL engine.
-#   o FakeBasicAuth:
-#     Translate the client X.509 into a Basic Authorisation.  This means that
-#     the standard Auth/DBMAuth methods can be used for access control.  The
-#     user name is the `one line' version of the client's X.509 certificate.
-#     Note that no password is obtained from the user. Every entry in the user
-#     file needs this password: `xxj31ZMTZzkVA'.
-#   o ExportCertData:
-#     This exports two additional environment variables: SSL_CLIENT_CERT and
-#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
-#     server (always existing) and the client (only existing when client
-#     authentication is used). This can be used to import the certificates
-#     into CGI scripts.
-#   o StdEnvVars:
-#     This exports the standard SSL/TLS related `SSL_*' environment variables.
-#     Per default this exportation is switched off for performance reasons,
-#     because the extraction step is an expensive operation and is usually
-#     useless for serving static content. So one usually enables the
-#     exportation for CGI and SSI requests only.
-#   o StrictRequire:
-#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
-#     under a "Satisfy any" situation, i.e. when it applies access is denied
-#     and no other module can change it.
-#   o OptRenegotiate:
-#     This enables optimized SSL connection renegotiation handling when SSL
-#     directives are used in per-directory context. 
-#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
-<Files ~ "\.(cgi|shtml|phtml|php3?)$">
-    SSLOptions +StdEnvVars
-</Files>
-<Directory "/var/www/cgi-bin">
-    SSLOptions +StdEnvVars
-</Directory>
-
-#   SSL Protocol Adjustments:
-#   The safe and default but still SSL/TLS standard compliant shutdown
-#   approach is that mod_ssl sends the close notify alert but doesn't wait for
-#   the close notify alert from client. When you need a different shutdown
-#   approach you can use one of the following variables:
-#   o ssl-unclean-shutdown:
-#     This forces an unclean shutdown when the connection is closed, i.e. no
-#     SSL close notify alert is send or allowed to received.  This violates
-#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
-#     this when you receive I/O errors because of the standard approach where
-#     mod_ssl sends the close notify alert.
-#   o ssl-accurate-shutdown:
-#     This forces an accurate shutdown when the connection is closed, i.e. a
-#     SSL close notify alert is send and mod_ssl waits for the close notify
-#     alert of the client. This is 100% SSL/TLS standard compliant, but in
-#     practice often causes hanging connections with brain-dead browsers. Use
-#     this only for browsers where you know that their SSL implementation
-#     works correctly. 
-#   Notice: Most problems of broken clients are also related to the HTTP
-#   keep-alive facility, so you usually additionally want to disable
-#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
-#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
-#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
-#   "force-response-1.0" for this.
-SetEnvIf User-Agent ".*MSIE.*" \
-         nokeepalive ssl-unclean-shutdown \
-         downgrade-1.0 force-response-1.0
-
-#   Per-Server Logging:
-#   The home of a custom SSL log file. Use this when you want a
-#   compact non-error SSL logfile on a virtual host basis.
-CustomLog logs/ssl_request_log \
-          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
-
-</VirtualHost>                                  
-

certbot-apache/tests/testdata/centos6_apache/apache/httpd/conf.d/test.example.com.conf

@@ -1,7 +0,0 @@
-<VirtualHost *:80>
-    ServerName test.example.com
-    ServerAdmin webmaster@dummy-host.example.com
-    DocumentRoot /var/www/htdocs
-    ErrorLog logs/dummy-host.example.com-error_log
-    CustomLog logs/dummy-host.example.com-access_log common
-</VirtualHost>

certbot-apache/tests/testdata/centos6_apache/apache/httpd/conf.d/welcome.conf

@@ -1,11 +0,0 @@
-# 
-# This configuration file enables the default "Welcome"
-# page if there is no default index page present for
-# the root URL.  To disable the Welcome page, comment
-# out all the lines below.
-#
-<LocationMatch "^/+$">
-    Options -Indexes
-    ErrorDocument 403 /error/noindex.html
-</LocationMatch>
-

certbot-apache/tests/util.py

@@ -4,11 +4,7 @@ import unittest
 
 import augeas
 import josepy as jose
-
-try:
-    import mock
-except ImportError:  # pragma: no cover
-    from unittest import mock  # type: ignore
+from unittest import mock
 
 from certbot.compat import os
 from certbot.plugins import common

certbot-ci/certbot_integration_tests/certbot_tests/assertions.py

@@ -33,8 +33,8 @@ def assert_elliptic_key(key: str, curve: Type[EllipticCurve]) -> None:
 
     key = load_pem_private_key(data=privkey1, password=None, backend=default_backend())
 
-    assert isinstance(key, EllipticCurvePrivateKey)
-    assert isinstance(key.curve, curve)
+    assert isinstance(key, EllipticCurvePrivateKey), f"should be an EC key but was {type(key)}"
+    assert isinstance(key.curve, curve), f"should have curve {curve} but was {key.curve}"
 
 
 def assert_rsa_key(key: str, key_size: Optional[int] = None) -> None:

certbot-ci/certbot_integration_tests/certbot_tests/context.py

@@ -17,8 +17,8 @@ class IntegrationTestsContext:
         self.request = request
 
         if hasattr(request.config, 'workerinput'):  # Worker node
-            self.worker_id = request.config.workerinput['workerid']  # type: ignore[attr-defined]
-            acme_xdist = request.config.workerinput['acme_xdist']  # type: ignore[attr-defined]
+            self.worker_id = request.config.workerinput['workerid']
+            acme_xdist = request.config.workerinput['acme_xdist']
         else:  # Primary node
             self.worker_id = 'primary'
             acme_xdist = request.config.acme_xdist  # type: ignore[attr-defined]

certbot-ci/certbot_integration_tests/certbot_tests/test_main.py

@@ -112,7 +112,7 @@ def test_http_01(context: IntegrationTestsContext) -> None:
 
     assert_hook_execution(context.hook_probe, 'deploy')
     assert_saved_renew_hook(context.config_dir, certname)
-    assert_saved_lineage_option(context.config_dir, certname, 'key_type', 'rsa')
+    assert_saved_lineage_option(context.config_dir, certname, 'key_type', 'ecdsa')
 
 
 def test_manual_http_auth(context: IntegrationTestsContext) -> None:
@@ -315,23 +315,23 @@ def test_graceful_renew_it_is_time(context: IntegrationTestsContext) -> None:
 def test_renew_with_changed_private_key_complexity(context: IntegrationTestsContext) -> None:
     """Test proper renew with updated private key complexity."""
     certname = context.get_domain('renew')
-    context.certbot(['-d', certname, '--rsa-key-size', '4096'])
+    context.certbot(['-d', certname, '--key-type', 'rsa', '--rsa-key-size', '4096'])
 
     key1 = join(context.config_dir, 'archive', certname, 'privkey1.pem')
-    assert os.stat(key1).st_size > 3000  # 4096 bits keys takes more than 3000 bytes
+    assert_rsa_key(key1, 4096)
     assert_cert_count_for_lineage(context.config_dir, certname, 1)
 
     context.certbot(['renew'])
 
     assert_cert_count_for_lineage(context.config_dir, certname, 2)
     key2 = join(context.config_dir, 'archive', certname, 'privkey2.pem')
-    assert os.stat(key2).st_size > 3000
+    assert_rsa_key(key2, 4096)
 
     context.certbot(['renew', '--rsa-key-size', '2048'])
 
     assert_cert_count_for_lineage(context.config_dir, certname, 3)
     key3 = join(context.config_dir, 'archive', certname, 'privkey3.pem')
-    assert os.stat(key3).st_size < 1800  # 2048 bits keys takes less than 1800 bytes
+    assert_rsa_key(key3, 2048)
 
 
 def test_renew_ignoring_directory_hooks(context: IntegrationTestsContext) -> None:
@@ -482,7 +482,7 @@ def test_new_key(context: IntegrationTestsContext) -> None:
     certname = context.get_domain('newkey')
 
     context.certbot(['--domains', certname, '--reuse-key',
-                     '--key-type', 'rsa', '--rsa-key-size', '4096'])
+                     '--key-type', 'ecdsa', '--elliptic-curve', 'secp384r1'])
     privkey1, _ = private_key(1)
 
     # renew: --new-key should replace the key, but keep reuse_key and the key type + params
@@ -490,22 +490,34 @@ def test_new_key(context: IntegrationTestsContext) -> None:
     privkey2, privkey2_path = private_key(2)
     assert privkey1 != privkey2
     assert_saved_lineage_option(context.config_dir, certname, 'reuse_key', 'True')
-    assert_rsa_key(privkey2_path, 4096)
+    assert_elliptic_key(privkey2_path, SECP384R1)
 
-    # certonly: it should replace the key but the key size will change
+    # certonly: it should replace the key but the elliptic curve will change
     context.certbot(['certonly', '-d', certname, '--reuse-key', '--new-key'])
     privkey3, privkey3_path = private_key(3)
     assert privkey2 != privkey3
     assert_saved_lineage_option(context.config_dir, certname, 'reuse_key', 'True')
-    assert_rsa_key(privkey3_path, 2048)
+    assert_elliptic_key(privkey3_path, SECP256R1)
 
     # certonly: it should be possible to change the key type and keep reuse_key
-    context.certbot(['certonly', '-d', certname, '--reuse-key', '--new-key', '--key-type', 'ecdsa',
-                     '--cert-name', certname])
+    context.certbot(['certonly', '-d', certname, '--reuse-key', '--new-key', '--key-type', 'rsa',
+                     '--rsa-key-size', '4096', '--cert-name', certname])
     privkey4, privkey4_path = private_key(4)
     assert privkey3 != privkey4
     assert_saved_lineage_option(context.config_dir, certname, 'reuse_key', 'True')
-    assert_elliptic_key(privkey4_path, SECP256R1)
+    assert_rsa_key(privkey4_path, 4096)
+
+    # certonly: it should not be possible to change a key parameter without --new-key
+    with pytest.raises(subprocess.CalledProcessError) as error:
+        context.certbot(['certonly', '-d', certname, '--key-type', 'rsa', '--reuse-key',
+                         '--rsa-key-size', '2048'])
+    assert 'Unable to change the --rsa-key-size' in error.value.stderr
+
+    # certonly: not specifying --key-type should keep the existing key type (non-interactively).
+    context.certbot(['certonly', '-d', certname, '--no-reuse-key'])
+    privkey5, privkey5_path = private_key(5)
+    assert_rsa_key(privkey5_path, 2048)
+    assert privkey4 != privkey5
 
 
 def test_incorrect_key_type(context: IntegrationTestsContext) -> None:
@@ -535,24 +547,24 @@ def test_ecdsa(context: IntegrationTestsContext) -> None:
 
 
 def test_default_key_type(context: IntegrationTestsContext) -> None:
-    """Test default key type is RSA"""
+    """Test default key type is ECDSA"""
     certname = context.get_domain('renew')
     context.certbot([
         'certonly',
         '--cert-name', certname, '-d', certname
     ])
     filename = join(context.config_dir, 'archive/{0}/privkey1.pem').format(certname)
-    assert_rsa_key(filename)
+    assert_elliptic_key(filename, SECP256R1)
 
 
-def test_default_curve_type(context: IntegrationTestsContext) -> None:
-    """test that the curve used when not specifying any is secp256r1"""
+def test_default_rsa_size(context: IntegrationTestsContext) -> None:
+    """test that the RSA key size used when not specifying any is 2048"""
     certname = context.get_domain('renew')
     context.certbot([
-        '--key-type', 'ecdsa', '--cert-name', certname, '-d', certname
+        '--key-type', 'rsa', '--cert-name', certname, '-d', certname
     ])
     key1 = join(context.config_dir, 'archive/{0}/privkey1.pem'.format(certname))
-    assert_elliptic_key(key1, SECP256R1)
+    assert_rsa_key(key1, 2048)
 
 
 @pytest.mark.parametrize('curve,curve_cls,skip_servers', [

certbot-ci/certbot_integration_tests/rfc2136_tests/context.py

@@ -21,7 +21,7 @@ class IntegrationTestsContext(certbot_context.IntegrationTestsContext):
         self.request = request
 
         if hasattr(request.config, 'workerinput'):  # Worker node
-            self._dns_xdist = request.config.workerinput['dns_xdist']  # type: ignore[attr-defined]
+            self._dns_xdist = request.config.workerinput['dns_xdist']
         else:  # Primary node
             self._dns_xdist = request.config.dns_xdist  # type: ignore[attr-defined]
 

certbot-ci/certbot_integration_tests/utils/acme_server.py

@@ -219,7 +219,8 @@ class ACMEServer:
                 # Configure challtestsrv to answer any A record request with ip of the docker host.
                 response = requests.post(
                     f'{BOULDER_V2_CHALLTESTSRV_URL}/set-default-ipv4',
-                    json={'ip': '10.77.77.1'}
+                    json={'ip': '10.77.77.1'},
+                    timeout=10
                 )
                 response.raise_for_status()
         except BaseException:

certbot-ci/certbot_integration_tests/utils/dns_server.py

@@ -70,7 +70,7 @@ class DNSServer:
             try:
                 self.process.terminate()
                 self.process.wait(constants.MAX_SUBPROCESS_WAIT)
-            except BaseException as e:
+            except BaseException as e:  # pylint: disable=broad-except
                 print("BIND9 did not stop cleanly: {}".format(e), file=sys.stderr)
 
         shutil.rmtree(self.bind_root, ignore_errors=True)

certbot-ci/certbot_integration_tests/utils/misc.py

@@ -65,9 +65,9 @@ def check_until_timeout(url: str, attempts: int = 30) -> None:
     for _ in range(attempts):
         time.sleep(1)
         try:
-            if requests.get(url, verify=False).status_code == 200:
+            if requests.get(url, verify=False, timeout=10).status_code == 200:
                 return
-        except requests.exceptions.ConnectionError:
+        except requests.exceptions.RequestException:
             pass
 
     raise ValueError('Error, url did not respond after {0} attempts: {1}'.format(attempts, url))
@@ -331,7 +331,9 @@ def get_acme_issuers(context: IntegrationTestsContext) -> List[Certificate]:
 
     issuers = []
     for i in range(PEBBLE_ALTERNATE_ROOTS + 1):
-        request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediates/{}'.format(i), verify=False)
+        request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediates/{}'.format(i),
+                               verify=False,
+                               timeout=10)
         issuers.append(load_pem_x509_certificate(request.content, default_backend()))
 
     return issuers

certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py

@@ -31,7 +31,7 @@ def _fetch_asset(asset: str, suffix: str) -> str:
     if not os.path.exists(asset_path):
         asset_url = ('https://github.com/letsencrypt/pebble/releases/download/{0}/{1}_{2}'
                      .format(PEBBLE_VERSION, asset, suffix))
-        response = requests.get(asset_url)
+        response = requests.get(asset_url, timeout=30)
         response.raise_for_status()
         with open(asset_path, 'wb') as file_h:
             file_h.write(response.content)

certbot-ci/certbot_integration_tests/utils/pebble_ocsp_server.py

@@ -23,10 +23,12 @@ from certbot_integration_tests.utils.misc import GracefulTCPServer
 class _ProxyHandler(BaseHTTPServer.BaseHTTPRequestHandler):
     # pylint: disable=missing-function-docstring
     def do_POST(self) -> None:
-        request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediate-keys/0', verify=False)
+        request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediate-keys/0',
+                               verify=False, timeout=10)
         issuer_key = serialization.load_pem_private_key(request.content, None, default_backend())
 
-        request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediates/0', verify=False)
+        request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediates/0',
+                               verify=False, timeout=10)
         issuer_cert = x509.load_pem_x509_certificate(request.content, default_backend())
 
         content_len = int(self.headers.get('Content-Length'))
@@ -34,7 +36,7 @@ class _ProxyHandler(BaseHTTPServer.BaseHTTPRequestHandler):
         ocsp_request = ocsp.load_der_ocsp_request(self.rfile.read(content_len))
         response = requests.get('{0}/cert-status-by-serial/{1}'.format(
             PEBBLE_MANAGEMENT_URL, str(hex(ocsp_request.serial_number)).replace('0x', '')),
-            verify=False
+            verify=False, timeout=10
         )
 
         if not response.ok:

certbot-ci/certbot_integration_tests/utils/proxy.py

@@ -21,7 +21,7 @@ def _create_proxy(mapping: Mapping[str, str]) -> Type[BaseHTTPServer.BaseHTTPReq
             headers = {key.lower(): value for key, value in self.headers.items()}
             backend = [backend for pattern, backend in mapping.items()
                        if re.match(pattern, headers['host'])][0]
-            response = requests.get(backend + self.path, headers=headers)
+            response = requests.get(backend + self.path, headers=headers, timeout=10)
 
             self.send_response(response.status_code)
             for key, value in response.headers.items():

certbot-ci/setup.py

@@ -50,6 +50,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
     ],

certbot-compatibility-test/certbot_compatibility_test/test_driver.py

@@ -33,7 +33,6 @@ from acme import messages
 from certbot import achallenges
 from certbot import errors as le_errors
 from certbot._internal.display import obj as display_obj
-from certbot.display import util as display_util
 from certbot.tests import acme_util
 
 DESCRIPTION = """
@@ -339,7 +338,7 @@ def setup_logging(args: argparse.Namespace) -> None:
 
 def setup_display() -> None:
     """"Prepares a display utility instance for the Certbot plugins """
-    displayer = display_util.NoninteractiveDisplay(sys.stdout)
+    displayer = display_obj.NoninteractiveDisplay(sys.stdout)
     display_obj.set_display(displayer)
 
 

certbot-compatibility-test/certbot_compatibility_test/validator.py

@@ -15,6 +15,9 @@ from acme import errors as acme_errors
 logger = logging.getLogger(__name__)
 
 
+_VALIDATION_TIMEOUT = 10
+
+
 class Validator:
     """Collection of functions to test a live webserver's configuration"""
 
@@ -43,9 +46,12 @@ class Validator:
         """Test whether webserver redirects to secure connection."""
         url = "http://{0}:{1}".format(name, port)
         if headers:
-            response = requests.get(url, headers=headers, allow_redirects=False)
+            response = requests.get(url, headers=headers,
+                                    allow_redirects=False,
+                                    timeout=_VALIDATION_TIMEOUT)
         else:
-            response = requests.get(url, allow_redirects=False)
+            response = requests.get(url, allow_redirects=False,
+                                    timeout=_VALIDATION_TIMEOUT)
 
         redirect_location = response.headers.get("location", "")
         # We're checking that the redirect we added behaves correctly.
@@ -65,15 +71,19 @@ class Validator:
         """Test whether webserver redirects."""
         url = "http://{0}:{1}".format(name, port)
         if headers:
-            response = requests.get(url, headers=headers, allow_redirects=False)
+            response = requests.get(url, headers=headers,
+                                    allow_redirects=False,
+                                    timeout=_VALIDATION_TIMEOUT)
         else:
-            response = requests.get(url, allow_redirects=False)
+            response = requests.get(url, allow_redirects=False,
+                                    timeout=_VALIDATION_TIMEOUT)
 
         return response.status_code in range(300, 309)
 
     def hsts(self, name: str) -> bool:
         """Test for HTTP Strict Transport Security header"""
-        headers = requests.get("https://" + name).headers
+        headers = requests.get("https://" + name,
+                               timeout=_VALIDATION_TIMEOUT).headers
         hsts_header = headers.get("strict-transport-security")
 
         if not hsts_header:

certbot-compatibility-test/setup.py

@@ -1,7 +1,7 @@
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'certbot',
@@ -29,6 +29,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
     ],

certbot-dns-cloudflare/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'cloudflare>=1.5.1',
@@ -51,6 +51,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-cloudflare/tests/dns_cloudflare_test.py

@@ -1,12 +1,9 @@
 """Tests for certbot_dns_cloudflare._internal.dns_cloudflare."""
 
 import unittest
+from unittest import mock
 
 import CloudFlare
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
 
 from certbot import errors
 from certbot.compat import os

certbot-dns-cloudxns/LICENSE.txt

@@ -1,190 +0,0 @@
-   Copyright 2015 Electronic Frontier Foundation and others
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS

certbot-dns-cloudxns/MANIFEST.in

@@ -1,7 +0,0 @@
-include LICENSE.txt
-include README.rst
-recursive-include docs *
-recursive-include tests *
-include certbot_dns_cloudxns/py.typed
-global-exclude __pycache__
-global-exclude *.py[cod]

certbot-dns-cloudxns/README.rst

@@ -1 +0,0 @@
-CloudXNS DNS Authenticator plugin for Certbot

certbot-dns-cloudxns/certbot_dns_cloudxns/__init__.py

@@ -1,97 +0,0 @@
-"""
-.. danger::
-   The certbot-dns-cloudxns plugin is deprecated and will be removed in the next major
-   release of Certbot. The CloudXNS DNS service is defunct and we recommend uninstalling
-   the plugin.
-
-----------
-
-The `~certbot_dns_cloudxns.dns_cloudxns` plugin automates the process of
-completing a ``dns-01`` challenge (`~acme.challenges.DNS01`) by creating, and
-subsequently removing, TXT records using the CloudXNS API.
-
-.. note::
-   The plugin is not installed by default. It can be installed by heading to
-   `certbot.eff.org <https://certbot.eff.org/instructions#wildcard>`_, choosing your system and
-   selecting the Wildcard tab.
-
-Named Arguments
----------------
-
-========================================  =====================================
-``--dns-cloudxns-credentials``            CloudXNS credentials_ INI file.
-                                          (Required)
-``--dns-cloudxns-propagation-seconds``    The number of seconds to wait for DNS
-                                          to propagate before asking the ACME
-                                          server to verify the DNS record.
-                                          (Default: 30)
-========================================  =====================================
-
-
-Credentials
------------
-
-Use of this plugin requires a configuration file containing CloudXNS API
-credentials, obtained from your CloudXNS
-`API page <https://www.cloudxns.net/en/AccountManage/apimanage.html>`_.
-
-.. code-block:: ini
-   :name: credentials.ini
-   :caption: Example credentials file:
-
-   # CloudXNS API credentials used by Certbot
-   dns_cloudxns_api_key = 1234567890abcdef1234567890abcdef
-   dns_cloudxns_secret_key = 1122334455667788
-
-The path to this file can be provided interactively or using the
-``--dns-cloudxns-credentials`` command-line argument. Certbot records the path
-to this file for use during renewal, but does not store the file's contents.
-
-.. caution::
-   You should protect these API credentials as you would the password to your
-   CloudXNS account. Users who can read this file can use these credentials to
-   issue arbitrary API calls on your behalf. Users who can cause Certbot to run
-   using these credentials can complete a ``dns-01`` challenge to acquire new
-   certificates or revoke existing certificates for associated domains, even if
-   those domains aren't being managed by this server.
-
-Certbot will emit a warning if it detects that the credentials file can be
-accessed by other users on your system. The warning reads "Unsafe permissions
-on credentials configuration file", followed by the path to the credentials
-file. This warning will be emitted each time Certbot uses the credentials file,
-including for renewal, and cannot be silenced except by addressing the issue
-(e.g., by using a command like ``chmod 600`` to restrict access to the file).
-
-
-Examples
---------
-
-.. code-block:: bash
-   :caption: To acquire a certificate for ``example.com``
-
-   certbot certonly \\
-     --dns-cloudxns \\
-     --dns-cloudxns-credentials ~/.secrets/certbot/cloudxns.ini \\
-     -d example.com
-
-.. code-block:: bash
-   :caption: To acquire a single certificate for both ``example.com`` and
-             ``www.example.com``
-
-   certbot certonly \\
-     --dns-cloudxns \\
-     --dns-cloudxns-credentials ~/.secrets/certbot/cloudxns.ini \\
-     -d example.com \\
-     -d www.example.com
-
-.. code-block:: bash
-   :caption: To acquire a certificate for ``example.com``, waiting 60 seconds
-             for DNS propagation
-
-   certbot certonly \\
-     --dns-cloudxns \\
-     --dns-cloudxns-credentials ~/.secrets/certbot/cloudxns.ini \\
-     --dns-cloudxns-propagation-seconds 60 \\
-     -d example.com
-
-"""

certbot-dns-cloudxns/certbot_dns_cloudxns/_internal/__init__.py

@@ -1 +0,0 @@
-"""Internal implementation of `~certbot_dns_cloudxns.dns_cloudxns` plugin."""

certbot-dns-cloudxns/certbot_dns_cloudxns/_internal/dns_cloudxns.py

@@ -1,99 +0,0 @@
-"""DNS Authenticator for CloudXNS DNS."""
-import logging
-from typing import Any
-from typing import Callable
-from typing import Optional
-import warnings
-
-from lexicon.providers import cloudxns
-from requests import HTTPError
-
-from certbot import errors
-from certbot.plugins import dns_common
-from certbot.plugins import dns_common_lexicon
-from certbot.plugins.dns_common import CredentialsConfiguration
-
-logger = logging.getLogger(__name__)
-
-ACCOUNT_URL = 'https://www.cloudxns.net/en/AccountManage/apimanage.html'
-
-
-class Authenticator(dns_common.DNSAuthenticator):
-    """DNS Authenticator for CloudXNS DNS
-
-    This Authenticator uses the CloudXNS DNS API to fulfill a dns-01 challenge.
-    """
-
-    description = 'Obtain certificates using a DNS TXT record (if you are using CloudXNS for DNS).'
-    ttl = 60
-
-    def __init__(self, *args: Any, **kwargs: Any) -> None:
-        warnings.warn(
-            "The CloudXNS authenticator is deprecated and will be removed in the "
-            "next major release of Certbot. The CloudXNS DNS service is defunct and "
-            "we recommend removing the plugin."
-        )
-        super().__init__(*args, **kwargs)
-        self.credentials: Optional[CredentialsConfiguration] = None
-
-    @classmethod
-    def add_parser_arguments(cls, add: Callable[..., None],
-                             default_propagation_seconds: int = 30) -> None:
-        super().add_parser_arguments(add, default_propagation_seconds)
-        add('credentials', help='CloudXNS credentials INI file.')
-
-    def more_info(self) -> str:
-        return 'This plugin configures a DNS TXT record to respond to a dns-01 challenge using ' + \
-               'the CloudXNS API.'
-
-    def _setup_credentials(self) -> None:
-        self.credentials = self._configure_credentials(
-            'credentials',
-            'CloudXNS credentials INI file',
-            {
-                'api-key': 'API key for CloudXNS account, obtained from {0}'.format(ACCOUNT_URL),
-                'secret-key': 'Secret key for CloudXNS account, obtained from {0}'
-                              .format(ACCOUNT_URL)
-            }
-        )
-
-    def _perform(self, domain: str, validation_name: str, validation: str) -> None:
-        self._get_cloudxns_client().add_txt_record(domain, validation_name, validation)
-
-    def _cleanup(self, domain: str, validation_name: str, validation: str) -> None:
-        self._get_cloudxns_client().del_txt_record(domain, validation_name, validation)
-
-    def _get_cloudxns_client(self) -> "_CloudXNSLexiconClient":
-        if not self.credentials:  # pragma: no cover
-            raise errors.Error("Plugin has not been prepared.")
-        return _CloudXNSLexiconClient(self.credentials.conf('api-key'),
-                                      self.credentials.conf('secret-key'),
-                                      self.ttl)
-
-
-class _CloudXNSLexiconClient(dns_common_lexicon.LexiconClient):
-    """
-    Encapsulates all communication with the CloudXNS via Lexicon.
-    """
-
-    def __init__(self, api_key: str, secret_key: str, ttl: int) -> None:
-        super().__init__()
-
-        config = dns_common_lexicon.build_lexicon_config('cloudxns', {
-            'ttl': ttl,
-        }, {
-            'auth_username': api_key,
-            'auth_token': secret_key,
-        })
-
-        self.provider = cloudxns.Provider(config)
-
-    def _handle_http_error(self, e: HTTPError, domain_name: str) -> Optional[errors.PluginError]:
-        hint = None
-        if str(e).startswith('400 Client Error:'):
-            hint = 'Are your API key and Secret key values correct?'
-
-        hint_disp = f' ({hint})' if hint else ''
-
-        return errors.PluginError(f'Error determining zone identifier for {domain_name}: '
-                                  f'{e}.{hint_disp}')

certbot-dns-cloudxns/docs/.gitignore

@@ -1 +0,0 @@
-/_build/

certbot-dns-cloudxns/docs/Makefile

@@ -1,20 +0,0 @@
-# Minimal makefile for Sphinx documentation
-#
-
-# You can set these variables from the command line.
-SPHINXOPTS    =
-SPHINXBUILD   = sphinx-build
-SPHINXPROJ    = certbot-dns-cloudxns
-SOURCEDIR     = .
-BUILDDIR      = _build
-
-# Put it first so that "make" without argument is like "make help".
-help:
-	@$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
-
-.PHONY: help Makefile
-
-# Catch-all target: route all unknown targets to Sphinx using the new
-# "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
-%: Makefile
-	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)

certbot-dns-cloudxns/docs/api.rst

@@ -1,5 +0,0 @@
-=================
-API Documentation
-=================
-
-Certbot plugins implement the Certbot plugins API, and do not otherwise have an external API.

certbot-dns-cloudxns/docs/conf.py

@@ -1,181 +0,0 @@
-# -*- coding: utf-8 -*-
-#
-# certbot-dns-cloudxns documentation build configuration file, created by
-# sphinx-quickstart on Wed May 10 16:05:50 2017.
-#
-# This file is execfile()d with the current directory set to its
-# containing dir.
-#
-# Note that not all possible configuration values are present in this
-# autogenerated file.
-#
-# All configuration values have a default; values that are commented out
-# serve to show the default.
-
-# If extensions (or modules to document with autodoc) are in another directory,
-# add these directories to sys.path here. If the directory is relative to the
-# documentation root, use os.path.abspath to make it absolute, like shown here.
-#
-import os
-
-# import sys
-# sys.path.insert(0, os.path.abspath('.'))
-
-
-# -- General configuration ------------------------------------------------
-
-# If your documentation needs a minimal Sphinx version, state it here.
-#
-needs_sphinx = '1.0'
-
-# Add any Sphinx extension module names here, as strings. They can be
-# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
-# ones.
-extensions = ['sphinx.ext.autodoc',
-    'sphinx.ext.intersphinx',
-    'sphinx.ext.todo',
-    'sphinx.ext.coverage',
-    'sphinx.ext.viewcode']
-
-autodoc_member_order = 'bysource'
-autodoc_default_flags = ['show-inheritance']
-
-# Add any paths that contain templates here, relative to this directory.
-templates_path = ['_templates']
-
-# The suffix(es) of source filenames.
-# You can specify multiple suffix as a list of string:
-#
-# source_suffix = ['.rst', '.md']
-source_suffix = '.rst'
-
-# The master toctree document.
-master_doc = 'index'
-
-# General information about the project.
-project = u'certbot-dns-cloudxns'
-copyright = u'2017, Certbot Project'
-author = u'Certbot Project'
-
-# The version info for the project you're documenting, acts as replacement for
-# |version| and |release|, also used in various other places throughout the
-# built documents.
-#
-# The short X.Y version.
-version = u'0'
-# The full version, including alpha/beta/rc tags.
-release = u'0'
-
-# The language for content autogenerated by Sphinx. Refer to documentation
-# for a list of supported languages.
-#
-# This is also used if you do content translation via gettext catalogs.
-# Usually you set "language" from the command line for these cases.
-language = 'en'
-
-# List of patterns, relative to source directory, that match files and
-# directories to ignore when looking for source files.
-# This patterns also effect to html_static_path and html_extra_path
-exclude_patterns = ['_build', 'Thumbs.db', '.DS_Store']
-
-default_role = 'py:obj'
-
-# The name of the Pygments (syntax highlighting) style to use.
-pygments_style = 'sphinx'
-
-# If true, `todo` and `todoList` produce output, else they produce nothing.
-todo_include_todos = False
-
-
-# -- Options for HTML output ----------------------------------------------
-
-# The theme to use for HTML and HTML Help pages.  See the documentation for
-# a list of builtin themes.
-#
-
-# https://docs.readthedocs.io/en/stable/faq.html#i-want-to-use-the-read-the-docs-theme-locally
-# on_rtd is whether we are on readthedocs.org
-on_rtd = os.environ.get('READTHEDOCS', None) == 'True'
-if not on_rtd:  # only import and set the theme if we're building docs locally
-    import sphinx_rtd_theme
-    html_theme = 'sphinx_rtd_theme'
-    html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
-# otherwise, readthedocs.org uses their theme by default, so no need to specify it
-
-# Theme options are theme-specific and customize the look and feel of a theme
-# further.  For a list of options available for each theme, see the
-# documentation.
-#
-# html_theme_options = {}
-
-# Add any paths that contain custom static files (such as style sheets) here,
-# relative to this directory. They are copied after the builtin static files,
-# so a file named "default.css" will overwrite the builtin "default.css".
-#html_static_path = ['_static']
-
-
-# -- Options for HTMLHelp output ------------------------------------------
-
-# Output file base name for HTML help builder.
-htmlhelp_basename = 'certbot-dns-cloudxnsdoc'
-
-
-# -- Options for LaTeX output ---------------------------------------------
-
-latex_elements = {
-    # The paper size ('letterpaper' or 'a4paper').
-    #
-    # 'papersize': 'letterpaper',
-
-    # The font size ('10pt', '11pt' or '12pt').
-    #
-    # 'pointsize': '10pt',
-
-    # Additional stuff for the LaTeX preamble.
-    #
-    # 'preamble': '',
-
-    # Latex figure (float) alignment
-    #
-    # 'figure_align': 'htbp',
-}
-
-# Grouping the document tree into LaTeX files. List of tuples
-# (source start file, target name, title,
-#  author, documentclass [howto, manual, or own class]).
-latex_documents = [
-    (master_doc, 'certbot-dns-cloudxns.tex', u'certbot-dns-cloudxns Documentation',
-     u'Certbot Project', 'manual'),
-]
-
-
-# -- Options for manual page output ---------------------------------------
-
-# One entry per manual page. List of tuples
-# (source start file, name, description, authors, manual section).
-man_pages = [
-    (master_doc, 'certbot-dns-cloudxns', u'certbot-dns-cloudxns Documentation',
-     [author], 1)
-]
-
-
-# -- Options for Texinfo output -------------------------------------------
-
-# Grouping the document tree into Texinfo files. List of tuples
-# (source start file, target name, title, author,
-#  dir menu entry, description, category)
-texinfo_documents = [
-    (master_doc, 'certbot-dns-cloudxns', u'certbot-dns-cloudxns Documentation',
-     author, 'certbot-dns-cloudxns', 'One line description of project.',
-     'Miscellaneous'),
-]
-
-
-
-
-# Example configuration for intersphinx: refer to the Python standard library.
-intersphinx_mapping = {
-    'python': ('https://docs.python.org/', None),
-    'acme': ('https://acme-python.readthedocs.org/en/latest/', None),
-    'certbot': ('https://eff-certbot.readthedocs.io/en/stable/', None),
-}

certbot-dns-cloudxns/docs/index.rst

@@ -1,28 +0,0 @@
-.. certbot-dns-cloudxns documentation master file, created by
-   sphinx-quickstart on Wed May 10 16:05:50 2017.
-   You can adapt this file completely to your liking, but it should at least
-   contain the root `toctree` directive.
-
-Welcome to certbot-dns-cloudxns's documentation!
-================================================
-
-.. toctree::
-   :maxdepth: 2
-   :caption: Contents:
-
-.. automodule:: certbot_dns_cloudxns
-   :members:
-
-.. toctree::
-   :maxdepth: 1
-
-   api
-
-
-
-Indices and tables
-==================
-
-* :ref:`genindex`
-* :ref:`modindex`
-* :ref:`search`

certbot-dns-cloudxns/docs/make.bat

@@ -1,36 +0,0 @@
-@ECHO OFF
-
-pushd %~dp0
-
-REM Command file for Sphinx documentation
-
-if "%SPHINXBUILD%" == "" (
-	set SPHINXBUILD=sphinx-build
-)
-set SOURCEDIR=.
-set BUILDDIR=_build
-set SPHINXPROJ=certbot-dns-cloudxns
-
-if "%1" == "" goto help
-
-%SPHINXBUILD% >NUL 2>NUL
-if errorlevel 9009 (
-	echo.
-	echo.The 'sphinx-build' command was not found. Make sure you have Sphinx
-	echo.installed, then set the SPHINXBUILD environment variable to point
-	echo.to the full path of the 'sphinx-build' executable. Alternatively you
-	echo.may add the Sphinx directory to PATH.
-	echo.
-	echo.If you don't have Sphinx installed, grab it from
-	echo.https://www.sphinx-doc.org/
-	exit /b 1
-)
-
-%SPHINXBUILD% -M %1 %SOURCEDIR% %BUILDDIR% %SPHINXOPTS%
-goto end
-
-:help
-%SPHINXBUILD% -M help %SOURCEDIR% %BUILDDIR% %SPHINXOPTS%
-
-:end
-popd

certbot-dns-cloudxns/readthedocs.org.requirements.txt

@@ -1,15 +0,0 @@
-# readthedocs.org gives no way to change the install command to "pip
-# install -e certbot-dns-cloudxns[docs]" (that would in turn install documentation
-# dependencies), but it allows to specify a requirements.txt file at
-# https://readthedocs.org/dashboard/letsencrypt/advanced/ (c.f. #259)
-
-# Although ReadTheDocs certainly doesn't need to install the project
-# in --editable mode (-e), just "pip install certbot-dns-cloudxns[docs]" does not work as
-# expected and "pip install -e certbot-dns-cloudxns[docs]" must be used instead
-
-# We also pin our dependencies for increased stability.
-
--c ../tools/requirements.txt
--e acme
--e certbot
--e certbot-dns-cloudxns[docs]

certbot-dns-cloudxns/setup.py

@@ -1,73 +0,0 @@
-import os
-import sys
-
-from setuptools import find_packages
-from setuptools import setup
-
-version = '2.0.0.dev0'
-
-install_requires = [
-    'dns-lexicon>=3.2.1',
-    'setuptools>=41.6.0',
-]
-
-if not os.environ.get('SNAP_BUILD'):
-    install_requires.extend([
-        # We specify the minimum acme and certbot version as the current plugin
-        # version for simplicity. See
-        # https://github.com/certbot/certbot/issues/8761 for more info.
-        f'acme>={version}',
-        f'certbot>={version}',
-    ])
-elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset SNAP_BUILD when building wheels '
-                       'to include certbot dependencies.')
-if os.environ.get('SNAP_BUILD'):
-    install_requires.append('packaging')
-
-docs_extras = [
-    'Sphinx>=1.0',  # autodoc_member_order = 'bysource', autodoc_default_flags
-    'sphinx_rtd_theme',
-]
-
-setup(
-    name='certbot-dns-cloudxns',
-    version=version,
-    description="CloudXNS DNS Authenticator plugin for Certbot",
-    url='https://github.com/certbot/certbot',
-    author="Certbot Project",
-    author_email='certbot-dev@eff.org',
-    license='Apache License 2.0',
-    python_requires='>=3.7',
-    classifiers=[
-        'Development Status :: 5 - Production/Stable',
-        'Environment :: Plugins',
-        'Intended Audience :: System Administrators',
-        'License :: OSI Approved :: Apache Software License',
-        'Operating System :: POSIX :: Linux',
-        'Programming Language :: Python',
-        'Programming Language :: Python :: 3',
-        'Programming Language :: Python :: 3.7',
-        'Programming Language :: Python :: 3.8',
-        'Programming Language :: Python :: 3.9',
-        'Programming Language :: Python :: 3.10',
-        'Topic :: Internet :: WWW/HTTP',
-        'Topic :: Security',
-        'Topic :: System :: Installation/Setup',
-        'Topic :: System :: Networking',
-        'Topic :: System :: Systems Administration',
-        'Topic :: Utilities',
-    ],
-
-    packages=find_packages(),
-    include_package_data=True,
-    install_requires=install_requires,
-    extras_require={
-        'docs': docs_extras,
-    },
-    entry_points={
-        'certbot.plugins': [
-            'dns-cloudxns = certbot_dns_cloudxns._internal.dns_cloudxns:Authenticator',
-        ],
-    },
-)

certbot-dns-cloudxns/tests/dns_cloudxns_test.py

@@ -1,61 +0,0 @@
-"""Tests for certbot_dns_cloudxns._internal.dns_cloudxns."""
-
-import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
-from requests.exceptions import HTTPError
-from requests.exceptions import RequestException
-import warnings
-
-from certbot.compat import os
-from certbot.plugins import dns_test_common
-from certbot.plugins import dns_test_common_lexicon
-from certbot.tests import util as test_util
-
-DOMAIN_NOT_FOUND = Exception('No domain found')
-GENERIC_ERROR = RequestException
-LOGIN_ERROR = HTTPError('400 Client Error: ...')
-
-API_KEY = 'foo'
-SECRET = 'bar'
-
-
-class AuthenticatorTest(test_util.TempDirTestCase,
-                        dns_test_common_lexicon.BaseLexiconAuthenticatorTest):
-
-    def setUp(self):
-        super().setUp()
-
-        from certbot_dns_cloudxns._internal.dns_cloudxns import Authenticator
-
-        path = os.path.join(self.tempdir, 'file.ini')
-        dns_test_common.write({"cloudxns_api_key": API_KEY, "cloudxns_secret_key": SECRET}, path)
-
-        self.config = mock.MagicMock(cloudxns_credentials=path,
-                                     cloudxns_propagation_seconds=0)  # don't wait during tests
-
-        with warnings.catch_warnings():
-            warnings.filterwarnings("ignore", category=UserWarning)
-            self.auth = Authenticator(self.config, "cloudxns")
-
-        self.mock_client = mock.MagicMock()
-        # _get_cloudxns_client | pylint: disable=protected-access
-        self.auth._get_cloudxns_client = mock.MagicMock(return_value=self.mock_client)
-
-
-class CloudXNSLexiconClientTest(unittest.TestCase, dns_test_common_lexicon.BaseLexiconClientTest):
-
-    def setUp(self):
-        from certbot_dns_cloudxns._internal.dns_cloudxns import _CloudXNSLexiconClient
-
-        self.client = _CloudXNSLexiconClient(API_KEY, SECRET, 0)
-
-        self.provider_mock = mock.MagicMock()
-        self.client.provider = self.provider_mock
-
-
-if __name__ == "__main__":
-    unittest.main()  # pragma: no cover

certbot-dns-digitalocean/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'python-digitalocean>=1.11', # 1.15.0 or newer is recommended for TTL support
@@ -51,6 +51,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-digitalocean/tests/dns_digitalocean_test.py

@@ -1,12 +1,9 @@
 """Tests for certbot_dns_digitalocean._internal.dns_digitalocean."""
 
 import unittest
+from unittest import mock
 
 import digitalocean
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
 
 from certbot import errors
 from certbot.compat import os

certbot-dns-dnsimple/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     # This version of lexicon is required to address the problem described in
@@ -53,6 +53,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-dnsimple/tests/dns_dnsimple_test.py

@@ -1,11 +1,8 @@
 """Tests for certbot_dns_dnsimple._internal.dns_dnsimple."""
 
 import unittest
+from unittest import mock
 
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
 from requests.exceptions import HTTPError
 
 from certbot.compat import os

certbot-dns-dnsmadeeasy/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
@@ -51,6 +51,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-dnsmadeeasy/tests/dns_dnsmadeeasy_test.py

@@ -1,11 +1,8 @@
 """Tests for certbot_dns_dnsmadeeasy._internal.dns_dnsmadeeasy."""
 
 import unittest
+from unittest import mock
 
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
 from requests.exceptions import HTTPError
 
 from certbot.compat import os

certbot-dns-gehirn/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
@@ -51,6 +51,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-gehirn/tests/dns_gehirn_test.py

@@ -1,11 +1,8 @@
 """Tests for certbot_dns_gehirn._internal.dns_gehirn."""
 
 import unittest
+from unittest import mock
 
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
 from requests.exceptions import HTTPError
 
 from certbot.compat import os

certbot-dns-google/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'google-api-python-client>=1.5.5',
@@ -54,6 +54,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-google/tests/dns_google_test.py

@@ -6,10 +6,8 @@ from googleapiclient import discovery
 from googleapiclient.errors import Error
 from googleapiclient.http import HttpMock
 from httplib2 import ServerNotFoundError
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+
+from unittest import mock
 
 from certbot import errors
 from certbot.compat import os

certbot-dns-linode/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
@@ -51,6 +51,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-linode/tests/dns_linode_test.py

@@ -1,11 +1,7 @@
 """Tests for certbot_dns_linode._internal.dns_linode."""
 
 import unittest
-
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
+from unittest import mock
 
 from certbot import errors
 from certbot.compat import os

certbot-dns-luadns/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
@@ -51,6 +51,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-luadns/tests/dns_luadns_test.py

@@ -1,11 +1,8 @@
 """Tests for certbot_dns_luadns._internal.dns_luadns."""
 
 import unittest
+from unittest import mock
 
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
 from requests.exceptions import HTTPError
 
 from certbot.compat import os

certbot-dns-nsone/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
@@ -51,6 +51,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-nsone/tests/dns_nsone_test.py

@@ -1,11 +1,8 @@
 """Tests for certbot_dns_nsone._internal.dns_nsone."""
 
 import unittest
+from unittest import mock
 
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
 from requests.exceptions import HTTPError
 
 from certbot.compat import os

certbot-dns-ovh/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
@@ -51,6 +51,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-ovh/tests/dns_ovh_test.py

@@ -1,11 +1,8 @@
 """Tests for certbot_dns_ovh._internal.dns_ovh."""
 
 import unittest
+from unittest import mock
 
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
 from requests.exceptions import HTTPError
 
 from certbot.compat import os

certbot-dns-rfc2136/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'dnspython>=1.15.0',
@@ -51,6 +51,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-rfc2136/tests/dns_rfc2136_test.py

@@ -1,14 +1,11 @@
 """Tests for certbot_dns_rfc2136._internal.dns_rfc2136."""
 
 import unittest
+from unittest import mock
 
 import dns.flags
 import dns.rcode
 import dns.tsig
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
 
 from certbot import errors
 from certbot.compat import os

certbot-dns-route53/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'boto3>=1.15.15',
@@ -51,6 +51,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-route53/tests/dns_route53_test.py

@@ -1,13 +1,10 @@
 """Tests for certbot_dns_route53._internal.dns_route53.Authenticator"""
 
 import unittest
+from unittest import mock
 
 from botocore.exceptions import ClientError
 from botocore.exceptions import NoCredentialsError
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
 
 from certbot import errors
 from certbot.compat import os

certbot-dns-sakuracloud/setup.py

@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.0.0.dev0'
+version = '2.1.0.dev0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
@@ -51,6 +51,7 @@ setup(
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
         'Topic :: System :: Installation/Setup',

certbot-dns-sakuracloud/tests/dns_sakuracloud_test.py

@@ -1,11 +1,8 @@
 """Tests for certbot_dns_sakuracloud._internal.dns_sakuracloud."""
 
 import unittest
+from unittest import mock
 
-try:
-    import mock
-except ImportError: # pragma: no cover
-    from unittest import mock # type: ignore
 from requests.exceptions import HTTPError
 
 from certbot.compat import os