mirror of
https://github.com/certbot/certbot.git
synced 2026-06-08 16:22:18 -04:00
Merge remote-tracking branch 'origin/master' into plugin-docs
This commit is contained in:
Peter Eckersley
commit
a12405ace0
32 changed files with 1493 additions and 279 deletions
|
|
@ -3,9 +3,9 @@ ChangeLog
|
|||
|
||||
Please note:
|
||||
the change log will only get updated after first release - for now please use the
|
||||
`commit log <https://github.com/letsencrypt/letsencrypt/commits/master>`_.
|
||||
`commit log <https://github.com/certbot/certbot/commits/master>`_.
|
||||
|
||||
To see the changes in a given release, inspect the github milestone for the
|
||||
release. For instance:
|
||||
|
||||
https://github.com/letsencrypt/letsencrypt/issues?utf8=%E2%9C%93&q=milestone%3A0.3.0
|
||||
https://github.com/certbot/certbot/issues?utf8=%E2%9C%93&q=milestone%3A0.3.0
|
||||
|
|
|
|||
|
|
@ -15,4 +15,4 @@ to the Sphinx generated docs is provided below.
|
|||
|
||||
-->
|
||||
|
||||
https://letsencrypt.readthedocs.org/en/latest/contributing.html
|
||||
https://certbot.eff.org/docs/contributing.html
|
||||
|
|
|
|||
76
README.rst
76
README.rst
|
|
@ -11,43 +11,60 @@ For more information regarding the status of the project, please see
|
|||
https://letsencrypt.org. Be sure to checkout the
|
||||
`Frequently Asked Questions (FAQ) <https://community.letsencrypt.org/t/frequently-asked-questions-faq/26#topic-title>`_.
|
||||
|
||||
About the Let's Encrypt Client
|
||||
About Certbot
|
||||
==============================
|
||||
|
||||
The Let's Encrypt Client is a fully-featured, extensible client for the Let's
|
||||
Certbot is a fully-featured, extensible client for the Let's
|
||||
Encrypt CA (or any other CA that speaks the `ACME
|
||||
<https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-acme-acme.md>`_
|
||||
protocol) that can automate the tasks of obtaining certificates and
|
||||
configuring webservers to use them. This client runs on Unix-based operating
|
||||
systems.
|
||||
|
||||
Until May 2016, Certbot was named simply ``letsencrypt`` or ``letsencrypt-auto``,
|
||||
depending on install method. Instructions on the Internet, and some pieces of the
|
||||
software, may still refer to this older name.
|
||||
|
||||
Contributing
|
||||
------------
|
||||
|
||||
If you'd like to contribute to this project please read `Developer Guide
|
||||
<https://certbot.eff.org/docs/contributing.html>`_.
|
||||
|
||||
Installation
|
||||
------------
|
||||
|
||||
If ``letsencrypt`` is packaged for your Unix OS, you can install it from
|
||||
there, and run it by typing ``letsencrypt``. Because not all operating
|
||||
systems have packages yet, we provide a temporary solution via the
|
||||
``letsencrypt-auto`` wrapper script, which obtains some dependencies
|
||||
from your OS and puts others in a python virtual environment::
|
||||
If ``certbot`` (or ``letsencrypt``) is packaged for your Unix OS, you can install
|
||||
it from there, and run it by typing ``certbot`` (or ``letsencrypt``).
|
||||
Because not all operating systems have packages yet, we provide a temporary
|
||||
solution via the ``certbot-auto`` wrapper script, which obtains some
|
||||
dependencies from your OS and puts others in a python virtual environment::
|
||||
|
||||
user@webserver:~$ git clone https://github.com/letsencrypt/letsencrypt
|
||||
user@webserver:~$ cd letsencrypt
|
||||
user@webserver:~/letsencrypt$ ./letsencrypt-auto --help
|
||||
user@webserver:~$ wget https://dl.eff.org/certbot-auto
|
||||
user@webserver:~$ chmod a+x ./certbot-auto
|
||||
user@webserver:~$ ./certbot-auto --help
|
||||
|
||||
Or for full command line help, type::
|
||||
.. hint:: The certbot-auto download is protected by HTTPS, which is pretty good, but if you'd like to
|
||||
double check the integrity of the ``certbot-auto`` script, you can use these steps for verification before running it::
|
||||
|
||||
./letsencrypt-auto --help all
|
||||
user@server:~$ wget -N https://dl.eff.org/certbot-auto.asc
|
||||
user@server:~$ gpg2 --recv-key A2CFB51FA275A7286234E7B24D17C995CD9775F2
|
||||
user@server:~$ gpg2 --trusted-key 4D17C995CD9775F2 --verify certbot-auto.asc certbot-auto
|
||||
|
||||
``letsencrypt-auto`` updates to the latest client release automatically. And
|
||||
since ``letsencrypt-auto`` is a wrapper to ``letsencrypt``, it accepts exactly
|
||||
And for full command line help, you can type::
|
||||
|
||||
./certbot-auto --help all
|
||||
|
||||
``certbot-auto`` updates to the latest client release automatically. And
|
||||
since ``certbot-auto`` is a wrapper to ``certbot``, it accepts exactly
|
||||
the same command line flags and arguments. More details about this script and
|
||||
other installation methods can be found `in the User Guide
|
||||
<https://letsencrypt.readthedocs.org/en/latest/using.html#installation>`_.
|
||||
<https://certbot.eff.org/docs/using.html#installation>`_.
|
||||
|
||||
How to run the client
|
||||
---------------------
|
||||
|
||||
In many cases, you can just run ``letsencrypt-auto`` or ``letsencrypt``, and the
|
||||
In many cases, you can just run ``certbot-auto`` or ``certbot``, and the
|
||||
client will guide you through the process of obtaining and installing certs
|
||||
interactively.
|
||||
|
||||
|
|
@ -56,7 +73,7 @@ For instance, if you want to obtain a cert for ``example.com``,
|
|||
``www.example.com``, and ``other.example.net``, using the Apache plugin to both
|
||||
obtain and install the certs, you could do this::
|
||||
|
||||
./letsencrypt-auto --apache -d example.com -d www.example.com -d other.example.net
|
||||
./certbot-auto --apache -d example.com -d www.example.com -d other.example.net
|
||||
|
||||
(The first time you run the command, it will make an account, and ask for an
|
||||
email and agreement to the Let's Encrypt Subscriber Agreement; you can
|
||||
|
|
@ -65,7 +82,7 @@ automate those with ``--email`` and ``--agree-tos``)
|
|||
If you want to use a webserver that doesn't have full plugin support yet, you
|
||||
can still use "standalone" or "webroot" plugins to obtain a certificate::
|
||||
|
||||
./letsencrypt-auto certonly --standalone --email admin@example.com -d example.com -d www.example.com -d other.example.net
|
||||
./certbot-auto certonly --standalone --email admin@example.com -d example.com -d www.example.com -d other.example.net
|
||||
|
||||
|
||||
Understanding the client in more depth
|
||||
|
|
@ -73,21 +90,21 @@ Understanding the client in more depth
|
|||
|
||||
To understand what the client is doing in detail, it's important to
|
||||
understand the way it uses plugins. Please see the `explanation of
|
||||
plugins <https://letsencrypt.readthedocs.org/en/latest/using.html#plugins>`_ in
|
||||
plugins <https://certbot.eff.org/docs/using.html#plugins>`_ in
|
||||
the User Guide.
|
||||
|
||||
Links
|
||||
=====
|
||||
|
||||
Documentation: https://letsencrypt.readthedocs.org
|
||||
Documentation: https://certbot.eff.org/docs
|
||||
|
||||
Software project: https://github.com/letsencrypt/letsencrypt
|
||||
Software project: https://github.com/certbot/certbot
|
||||
|
||||
Notes for developers: https://letsencrypt.readthedocs.org/en/latest/contributing.html
|
||||
Notes for developers: https://certbot.eff.org/docs/contributing.html
|
||||
|
||||
Main Website: https://letsencrypt.org/
|
||||
|
||||
IRC Channel: #letsencrypt on `Freenode`_
|
||||
IRC Channel: #letsencrypt on `Freenode`_ or #certbot on `OFTC`_
|
||||
|
||||
Community: https://community.letsencrypt.org
|
||||
|
||||
|
|
@ -103,12 +120,12 @@ email to client-dev+subscribe@letsencrypt.org)
|
|||
|
||||
|
||||
|
||||
.. |build-status| image:: https://travis-ci.org/letsencrypt/letsencrypt.svg?branch=master
|
||||
:target: https://travis-ci.org/letsencrypt/letsencrypt
|
||||
.. |build-status| image:: https://travis-ci.org/certbot/certbot.svg?branch=master
|
||||
:target: https://travis-ci.org/certbot/certbot
|
||||
:alt: Travis CI status
|
||||
|
||||
.. |coverage| image:: https://coveralls.io/repos/letsencrypt/letsencrypt/badge.svg?branch=master
|
||||
:target: https://coveralls.io/r/letsencrypt/letsencrypt
|
||||
.. |coverage| image:: https://coveralls.io/repos/certbot/certbot/badge.svg?branch=master
|
||||
:target: https://coveralls.io/r/certbot/certbot
|
||||
:alt: Coverage status
|
||||
|
||||
.. |docs| image:: https://readthedocs.org/projects/letsencrypt/badge/
|
||||
|
|
@ -151,10 +168,10 @@ Current Features
|
|||
- standalone (runs its own simple webserver to prove you control a domain)
|
||||
- webroot (adds files to webroot directories in order to prove control of
|
||||
domains and obtain certs)
|
||||
- nginx/0.8.48+ (highly experimental, not included in letsencrypt-auto)
|
||||
- nginx/0.8.48+ (highly experimental, not included in certbot-auto)
|
||||
|
||||
* The private key is generated locally on your system.
|
||||
* Can talk to the Let's Encrypt CA or optionally to other ACME
|
||||
* Can talk to the Let's Encrypt CA or optionally to other ACME
|
||||
compliant services.
|
||||
* Can get domain-validated (DV) certificates.
|
||||
* Can revoke certificates.
|
||||
|
|
@ -169,4 +186,5 @@ Current Features
|
|||
|
||||
|
||||
.. _Freenode: https://webchat.freenode.net?channels=%23letsencrypt
|
||||
.. _OFTC: https://webchat.oftc.net?channels=%23certbot
|
||||
.. _client-dev: https://groups.google.com/a/letsencrypt.org/forum/#!forum/client-dev
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ from setuptools import setup
|
|||
from setuptools import find_packages
|
||||
|
||||
|
||||
version = '0.6.0.dev0'
|
||||
version = '0.7.0.dev0'
|
||||
|
||||
# Please update tox.ini when modifying dependency version requirements
|
||||
install_requires = [
|
||||
|
|
|
|||
|
|
@ -314,5 +314,5 @@ texinfo_documents = [
|
|||
intersphinx_mapping = {
|
||||
'python': ('https://docs.python.org/', None),
|
||||
'acme': ('https://acme-python.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://letsencrypt.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://certbot.eff.org/docs/', None),
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ from setuptools import setup
|
|||
from setuptools import find_packages
|
||||
|
||||
|
||||
version = '0.6.0.dev0'
|
||||
version = '0.7.0.dev0'
|
||||
|
||||
# Please update tox.ini when modifying dependency version requirements
|
||||
install_requires = [
|
||||
|
|
|
|||
1088
certbot-auto
Executable file
1088
certbot-auto
Executable file
File diff suppressed because it is too large
Load diff
|
|
@ -311,7 +311,7 @@ texinfo_documents = [
|
|||
intersphinx_mapping = {
|
||||
'python': ('https://docs.python.org/', None),
|
||||
'acme': ('https://acme-python.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://letsencrypt.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://certbot.eff.org/docs/', None),
|
||||
'certbot-apache': (
|
||||
'https://letsencrypt-apache.readthedocs.org/en/latest/', None),
|
||||
'certbot-nginx': (
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ from setuptools import setup
|
|||
from setuptools import find_packages
|
||||
|
||||
|
||||
version = '0.6.0.dev0'
|
||||
version = '0.7.0.dev0'
|
||||
|
||||
install_requires = [
|
||||
'certbot=={0}'.format(version),
|
||||
|
|
|
|||
|
|
@ -30,10 +30,11 @@ class RawNginxParser(object):
|
|||
assignment = (key + Optional(space + value, default=None) + semicolon)
|
||||
location_statement = Optional(space + modifier) + Optional(space + location)
|
||||
if_statement = Literal("if") + space + Regex(r"\(.+\)") + space
|
||||
map_statement = Literal("map") + space + Regex(r"\S+") + space + Regex(r"\$\S+") + space
|
||||
block = Forward()
|
||||
|
||||
block << Group(
|
||||
(Group(key + location_statement) ^ Group(if_statement)) +
|
||||
(Group(key + location_statement) ^ Group(if_statement) ^ Group(map_statement)) +
|
||||
left_bracket +
|
||||
Group(ZeroOrMore(Group(comment | assignment) | block)) +
|
||||
right_bracket)
|
||||
|
|
|
|||
|
|
@ -307,5 +307,5 @@ texinfo_documents = [
|
|||
intersphinx_mapping = {
|
||||
'python': ('https://docs.python.org/', None),
|
||||
'acme': ('https://acme-python.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://letsencrypt.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://certbot.eff.org/docs/', None),
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ from setuptools import setup
|
|||
from setuptools import find_packages
|
||||
|
||||
|
||||
version = '0.6.0.dev0'
|
||||
version = '0.7.0.dev0'
|
||||
|
||||
# Please update tox.ini when modifying dependency version requirements
|
||||
install_requires = [
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
"""Certbot client."""
|
||||
|
||||
# version number like 1.2.3a0, must have at least 2 parts, like 1.2
|
||||
__version__ = '0.6.0.dev0'
|
||||
__version__ = '0.7.0.dev0'
|
||||
|
|
|
|||
|
|
@ -17,15 +17,13 @@ Autoupdates
|
|||
Within certain limits, TLS server software can choose what kind of
|
||||
cryptography to use when a client connects. These choices can affect
|
||||
security, compatibility, and performance in complex ways. Most of
|
||||
these options are independent of a particular certificate. The Let's
|
||||
Encrypt client tries to provide defaults that we think are most useful
|
||||
to our users.
|
||||
these options are independent of a particular certificate. Certbot
|
||||
tries to provide defaults that we think are most useful to our users.
|
||||
|
||||
As described below, the Let's Encrypt client will default to modifying
|
||||
As described below, Certbot will default to modifying
|
||||
server software's cryptographic settings to keep these up-to-date with
|
||||
what we think are appropriate defaults when new versions of the Let's
|
||||
Encrypt client are installed (for example, by an operating system package
|
||||
manager).
|
||||
what we think are appropriate defaults when new versions of the Certbot
|
||||
are installed (for example, by an operating system package manager).
|
||||
|
||||
When this feature is implemented, this document will be updated
|
||||
to describe how to disable these automatic changes.
|
||||
|
|
@ -54,7 +52,7 @@ improve, others' security. But important information that improves our
|
|||
understanding of the state of the art is published regularly.
|
||||
|
||||
When enabling TLS support in a compatible web server (which is a separate
|
||||
step from obtaining a certificate), Let's Encrypt has the ability to
|
||||
step from obtaining a certificate), Certbot has the ability to
|
||||
update that web server's TLS configuration. Again, this is *different
|
||||
from the cryptographic particulars of the certificate itself*; the
|
||||
certificate as of the initial release will be RSA-signed using one of
|
||||
|
|
@ -80,30 +78,29 @@ art. However, the Let's Encrypt certificate authority does *not*
|
|||
dictate end-users' security policy, and any site is welcome to change
|
||||
its preferences in accordance with its own policy or its administrators'
|
||||
preferences, and use different cryptographic mechanisms or parameters,
|
||||
or a different priority order, than the defaults provided by the Let's
|
||||
Encrypt client.
|
||||
or a different priority order, than the defaults provided by Certbot.
|
||||
|
||||
If you don't use the Let's Encrypt client to configure your server
|
||||
directly, because the client doesn't integrate with your server software
|
||||
or because you chose not to use this integration, then the cryptographic
|
||||
defaults haven't been modified, and the cryptography chosen by the server
|
||||
will still be whatever the default for your software was. For example,
|
||||
if you obtain a certificate using *standalone* mode and then manually
|
||||
install it in an IMAP or LDAP server, your cryptographic settings will
|
||||
not be modified by the client in any way.
|
||||
If you don't use Certbot to configure your server directly, because the
|
||||
client doesn't integrate with your server software or because you chose
|
||||
not to use this integration, then the cryptographic defaults haven't been
|
||||
modified, and the cryptography chosen by the server will still be whatever
|
||||
the default for your software was. For example, if you obtain a
|
||||
certificate using *standalone* mode and then manually install it in an IMAP
|
||||
or LDAP server, your cryptographic settings will not be modified by the
|
||||
client in any way.
|
||||
|
||||
|
||||
Sources of defaults
|
||||
-------------------
|
||||
|
||||
Initially, the Let's Encrypt client will configure users' servers to
|
||||
use the cryptographic defaults recommended by the Mozilla project.
|
||||
These settings are well-reasoned recommendations that carefully
|
||||
consider client software compatibility. They are described at
|
||||
Initially, Certbot will configure users' servers to use the cryptographic
|
||||
defaults recommended by the Mozilla project. These settings are well-reasoned
|
||||
recommendations that carefully consider client software compatibility. They
|
||||
are described at
|
||||
|
||||
https://wiki.mozilla.org/Security/Server_Side_TLS
|
||||
|
||||
and the version implemented by the Let's Encrypt client will be the
|
||||
and the version implemented by Certbot will be the
|
||||
version that was most current as of the release date of each client
|
||||
version. Mozilla offers three separate sets of cryptographic options,
|
||||
which trade off security and compatibility differently. These are
|
||||
|
|
@ -113,12 +110,12 @@ to most-backwards compatible). The client will follow the Mozilla defaults
|
|||
for the *Intermediate* configuration by default, at least with regards to
|
||||
ciphersuites and TLS versions. Mozilla's web site describes which client
|
||||
software will be compatible with each configuration. You can also use
|
||||
the Qualys SSL Labs site, which the Let's Encrypt software will suggest
|
||||
the Qualys SSL Labs site, which Certbot will suggest
|
||||
when installing a certificate, to test your server and see whether it
|
||||
will be compatible with particular software versions.
|
||||
|
||||
It will be possible to ask the Let's Encrypt client to instead apply
|
||||
(and track) Modern or Old configurations.
|
||||
It will be possible to ask Certbot to instead apply (and track) Modern
|
||||
or Old configurations.
|
||||
|
||||
The Let's Encrypt project expects to follow the Mozilla recommendations
|
||||
in the future as those recommendations are updated. (For example, some
|
||||
|
|
@ -127,15 +124,15 @@ which uses the ChaCha and Poly1305 algorithms, and which is already
|
|||
implemented by the Chrome browser. Mozilla has delayed recommending
|
||||
``0xcc13`` over compatibility and standardization concerns, but is likely
|
||||
to recommend it in the future once these concerns have been addressed. At
|
||||
that point, the Let's Encrypt client would likely follow the Mozilla
|
||||
recommendations and favor the use of this ciphersuite as well.)
|
||||
that point, Certbot would likely follow the Mozilla recommendations and favor
|
||||
the use of this ciphersuite as well.)
|
||||
|
||||
The Let's Encrypt project may deviate from the Mozilla recommendations
|
||||
in the future if good cause is shown and we believe our users'
|
||||
priorities would be well-served by doing so. In general, please address
|
||||
relevant proposals for changing priorities to the Mozilla security
|
||||
team first, before asking the Let's Encrypt project to change the
|
||||
client's priorities. The Mozilla security team is likely to have more
|
||||
team first, before asking the Certbot developers to change
|
||||
Certbot's priorities. The Mozilla security team is likely to have more
|
||||
resources and expertise to bring to bear on evaluating reasons why its
|
||||
recommendations should be updated.
|
||||
|
||||
|
|
@ -144,8 +141,8 @@ small number of alternative configurations (apart from Modern,
|
|||
Intermediate, and Old) that there's reason to believe would be widely
|
||||
used by sysadmins; this would usually be a preferable course to modifying
|
||||
an existing configuration. For example, if many sysadmins want their
|
||||
servers configured to track a different expert recommendation, Let's
|
||||
Encrypt could add an option to do so.
|
||||
servers configured to track a different expert recommendation, Certbot
|
||||
could add an option to do so.
|
||||
|
||||
|
||||
Resources for recommendations
|
||||
|
|
@ -156,9 +153,9 @@ recommendations with sources of expert guidance on ciphersuites and other
|
|||
cryptographic parameters. We're grateful to everyone who contributed
|
||||
suggestions. The recommendations we received are available at
|
||||
|
||||
https://github.com/letsencrypt/letsencrypt/wiki/Ciphersuite-guidance
|
||||
https://github.com/certbot/certbot/wiki/Ciphersuite-guidance
|
||||
|
||||
Let's Encrypt client users are welcome to review these authorities to
|
||||
Certbot users are welcome to review these authorities to
|
||||
better inform their own cryptographic parameter choices. We also
|
||||
welcome suggestions of other resources to add to this list. Please keep
|
||||
in mind that different recommendations may reflect different priorities
|
||||
|
|
@ -172,26 +169,25 @@ This will probably look something like
|
|||
|
||||
.. code-block:: shell
|
||||
|
||||
letsencrypt --cipher-recommendations mozilla-secure
|
||||
letsencrypt --cipher-recommendations mozilla-intermediate
|
||||
letsencrypt --cipher-recommendations mozilla-old
|
||||
certbot --cipher-recommendations mozilla-secure
|
||||
certbot --cipher-recommendations mozilla-intermediate
|
||||
certbot --cipher-recommendations mozilla-old
|
||||
|
||||
to track Mozilla's *Secure*, *Intermediate*, or *Old* recommendations,
|
||||
and
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
letsencrypt --update-ciphers on
|
||||
certbot --update-ciphers on
|
||||
|
||||
to enable updating ciphers with each new Let's Encrypt client release,
|
||||
or
|
||||
to enable updating ciphers with each new Certbot release, or
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
letsencrypt --update-ciphers off
|
||||
certbot --update-ciphers off
|
||||
|
||||
to disable automatic configuration updates. These features have not yet
|
||||
been implemented and this syntax may change then they are implemented.
|
||||
been implemented and this syntax may change when they are implemented.
|
||||
|
||||
|
||||
TODO
|
||||
|
|
@ -200,7 +196,7 @@ TODO
|
|||
The status of this feature is tracked as part of issue #1123 in our
|
||||
bug tracker.
|
||||
|
||||
https://github.com/letsencrypt/letsencrypt/issues/1123
|
||||
https://github.com/certbot/certbot/issues/1123
|
||||
|
||||
Prior to implementation of #1123, the client does not actually modify
|
||||
ciphersuites (this is intended to be implemented as a "configuration
|
||||
|
|
|
|||
16
docs/conf.py
16
docs/conf.py
|
|
@ -64,8 +64,8 @@ source_suffix = '.rst'
|
|||
master_doc = 'index'
|
||||
|
||||
# General information about the project.
|
||||
project = u'Let\'s Encrypt'
|
||||
copyright = u'2014-2015, Let\'s Encrypt Project'
|
||||
project = u'Certbot'
|
||||
copyright = u'2014-2016 - The Certbot software and documentation are licensed under the Apache 2.0 license as described at https://eff.org/cb-license '
|
||||
|
||||
# The version info for the project you're documenting, acts as replacement for
|
||||
# |version| and |release|, also used in various other places throughout the
|
||||
|
|
@ -225,7 +225,7 @@ html_static_path = ['_static']
|
|||
#html_search_scorer = 'scorer.js'
|
||||
|
||||
# Output file base name for HTML help builder.
|
||||
htmlhelp_basename = 'LetsEncryptdoc'
|
||||
htmlhelp_basename = 'Certbotdoc'
|
||||
|
||||
# -- Options for LaTeX output ---------------------------------------------
|
||||
|
||||
|
|
@ -247,8 +247,8 @@ latex_elements = {
|
|||
# (source start file, target name, title,
|
||||
# author, documentclass [howto, manual, or own class]).
|
||||
latex_documents = [
|
||||
('index', 'LetsEncrypt.tex', u'Let\'s Encrypt Documentation',
|
||||
u'Let\'s Encrypt Project', 'manual'),
|
||||
('index', 'Certbot.tex', u'Certbot Documentation',
|
||||
u'Certbot Project', 'manual'),
|
||||
]
|
||||
|
||||
# The name of an image file (relative to this directory) to place at the top of
|
||||
|
|
@ -277,7 +277,7 @@ latex_documents = [
|
|||
# One entry per manual page. List of tuples
|
||||
# (source start file, name, description, authors, manual section).
|
||||
man_pages = [
|
||||
('index', 'certbot', u'Let\'s Encrypt Documentation',
|
||||
('index', 'certbot', u'Certbot Documentation',
|
||||
[project], 7),
|
||||
('man/certbot', 'certbot', u'certbot script documentation',
|
||||
[project], 1),
|
||||
|
|
@ -293,8 +293,8 @@ man_pages = [
|
|||
# (source start file, target name, title, author,
|
||||
# dir menu entry, description, category)
|
||||
texinfo_documents = [
|
||||
('index', 'LetsEncrypt', u'Let\'s Encrypt Documentation',
|
||||
u'Let\'s Encrypt Project', 'LetsEncrypt', 'One line description of project.',
|
||||
('index', 'Certbot', u'Certbot Documentation',
|
||||
u'Certbot Project', 'Certbot', 'One line description of project.',
|
||||
'Miscellaneous'),
|
||||
]
|
||||
|
||||
|
|
|
|||
|
|
@ -20,8 +20,8 @@ once:
|
|||
|
||||
.. code-block:: shell
|
||||
|
||||
git clone https://github.com/letsencrypt/letsencrypt
|
||||
cd letsencrypt
|
||||
git clone https://github.com/certbot/certbot
|
||||
cd certbot
|
||||
./letsencrypt-auto-source/letsencrypt-auto --os-packages-only
|
||||
./tools/venv.sh
|
||||
|
||||
|
|
@ -57,8 +57,8 @@ your pull request must have thorough unit test coverage, pass our
|
|||
`integration`_ tests, and be compliant with the :ref:`coding style
|
||||
<coding-style>`.
|
||||
|
||||
.. _github issue tracker: https://github.com/letsencrypt/letsencrypt/issues
|
||||
.. _Good Volunteer Task: https://github.com/letsencrypt/letsencrypt/issues?q=is%3Aopen+is%3Aissue+label%3A%22Good+Volunteer+Task%22
|
||||
.. _github issue tracker: https://github.com/certbot/certbot/issues
|
||||
.. _Good Volunteer Task: https://github.com/certbot/certbot/issues?q=is%3Aopen+is%3Aissue+label%3A%22Good+Volunteer+Task%22
|
||||
|
||||
Testing
|
||||
-------
|
||||
|
|
@ -175,8 +175,8 @@ Configurators may implement just one of those).
|
|||
There are also `~certbot.interfaces.IDisplay` plugins,
|
||||
which implement bindings to alternative UI libraries.
|
||||
|
||||
.. _interfaces.py: https://github.com/letsencrypt/letsencrypt/blob/master/certbot/interfaces.py
|
||||
.. _plugins/common.py: https://github.com/letsencrypt/letsencrypt/blob/master/certbot/plugins/common.py#L34
|
||||
.. _interfaces.py: https://github.com/certbot/certbot/blob/master/certbot/interfaces.py
|
||||
.. _plugins/common.py: https://github.com/certbot/certbot/blob/master/certbot/plugins/common.py#L34
|
||||
|
||||
|
||||
Authenticators
|
||||
|
|
@ -323,7 +323,7 @@ Steps:
|
|||
See `Known Issues`_. If it's not a known issue, fix any errors.
|
||||
|
||||
.. _Known Issues:
|
||||
https://github.com/letsencrypt/letsencrypt/wiki/Known-issues
|
||||
https://github.com/certbot/certbot/wiki/Known-issues
|
||||
|
||||
Updating the documentation
|
||||
==========================
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
Welcome to the Let's Encrypt client documentation!
|
||||
Welcome to the Certbot documentation!
|
||||
==================================================
|
||||
|
||||
.. toctree::
|
||||
|
|
|
|||
|
|
@ -3,4 +3,4 @@ Packaging Guide
|
|||
===============
|
||||
|
||||
Documentation can be found at
|
||||
https://github.com/letsencrypt/letsencrypt/wiki/Packaging.
|
||||
https://github.com/certbot/certbot/wiki/Packaging.
|
||||
|
|
|
|||
116
docs/using.rst
116
docs/using.rst
|
|
@ -10,12 +10,12 @@ User Guide
|
|||
Installation
|
||||
============
|
||||
|
||||
.. _letsencrypt-auto:
|
||||
.. _certbot-auto:
|
||||
|
||||
letsencrypt-auto
|
||||
certbot-auto
|
||||
----------------
|
||||
|
||||
``letsencrypt-auto`` is a wrapper which installs some dependencies
|
||||
``certbot-auto`` is a wrapper which installs some dependencies
|
||||
from your OS standard package repositories (e.g. using `apt-get` or
|
||||
`yum`), and for other dependencies it sets up a virtualized Python
|
||||
environment with packages downloaded from PyPI [#venv]_. It also
|
||||
|
|
@ -25,33 +25,33 @@ To install and run the client, just type...
|
|||
|
||||
.. code-block:: shell
|
||||
|
||||
./letsencrypt-auto
|
||||
./certbot-auto
|
||||
|
||||
.. hint:: During the beta phase, Let's Encrypt enforces strict rate limits on
|
||||
the number of certificates issued for one domain. It is recommended to
|
||||
initially use the test server via `--test-cert` until you get the desired
|
||||
.. hint:: The Let's Encrypt servers enforce rate
|
||||
limits on the number of certificates issued for one domain. It is recommended
|
||||
to initially use the test server via `--test-cert` until you get the desired
|
||||
certificates.
|
||||
|
||||
Throughout the documentation, whenever you see references to
|
||||
``letsencrypt`` script/binary, you can substitute in
|
||||
``letsencrypt-auto``. For example, to get basic help you would type:
|
||||
``certbot`` script/binary, you can substitute in
|
||||
``certbot-auto``. For example, to get basic help you would type:
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
./letsencrypt-auto --help
|
||||
./certbot-auto --help
|
||||
|
||||
or for full help, type:
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
./letsencrypt-auto --help all
|
||||
./certbot-auto --help all
|
||||
|
||||
|
||||
``letsencrypt-auto`` is the recommended method of running the Let's Encrypt
|
||||
``certbot-auto`` is the recommended method of running the Certbot
|
||||
client beta releases on systems that don't have a packaged version. Debian,
|
||||
Arch Linux, Gentoo, FreeBSD, and OpenBSD now have native packages, so on those
|
||||
systems you can just install ``letsencrypt`` (and perhaps
|
||||
``letsencrypt-apache``). If you'd like to run the latest copy from Git, or
|
||||
systems you can just install ``certbot`` (and perhaps
|
||||
``certbot-apache``). If you'd like to run the latest copy from Git, or
|
||||
run your own locally modified copy of the client, follow the instructions in
|
||||
the :doc:`contributing`. Some `other methods of installation`_ are discussed
|
||||
below.
|
||||
|
|
@ -60,11 +60,11 @@ below.
|
|||
Plugins
|
||||
=======
|
||||
|
||||
The Let's Encrypt client supports a number of different "plugins" that can be
|
||||
The Certbot client supports a number of different "plugins" that can be
|
||||
used to obtain and/or install certificates. Plugins that can obtain a cert
|
||||
are called "authenticators" and can be used with the "certonly" command.
|
||||
Plugins that can install a cert are called "installers". Plugins that do both
|
||||
can be used with the "letsencrypt run" command, which is the default.
|
||||
can be used with the "certbot run" command, which is the default.
|
||||
|
||||
=========== ==== ==== ===============================================================
|
||||
Plugin Auth Inst Notes
|
||||
|
|
@ -79,7 +79,7 @@ standalone_ Y N Uses a "standalone" webserver to obtain a cert. Requires
|
|||
webserver is not supported or not desired.
|
||||
manual_ Y N Helps you obtain a cert by giving you instructions to perform
|
||||
domain validation yourself.
|
||||
nginx_ Y Y Very experimental and not included in letsencrypt-auto_.
|
||||
nginx_ Y Y Very experimental and not included in certbot-auto_.
|
||||
=========== ==== ==== ===============================================================
|
||||
|
||||
Third-party plugins
|
||||
|
|
@ -145,16 +145,16 @@ specified ``--webroot-path``. So, for instance,
|
|||
|
||||
::
|
||||
|
||||
letsencrypt certonly --webroot -w /var/www/example/ -d www.example.com -d example.com -w /var/www/other -d other.example.net -d another.other.example.net
|
||||
certbot certonly --webroot -w /var/www/example/ -d www.example.com -d example.com -w /var/www/other -d other.example.net -d another.other.example.net
|
||||
|
||||
would obtain a single certificate for all of those names, using the
|
||||
``/var/www/example`` webroot directory for the first two, and
|
||||
``/var/www/other`` for the second two.
|
||||
|
||||
The webroot plugin works by creating a temporary file for each of your requested
|
||||
domains in ``${webroot-path}/.well-known/acme-challenge``. Then the Let's
|
||||
Encrypt validation server makes HTTP requests to validate that the DNS for each
|
||||
requested domain resolves to the server running letsencrypt. An example request
|
||||
domains in ``${webroot-path}/.well-known/acme-challenge``. Then the Let's Encrypt
|
||||
validation server makes HTTP requests to validate that the DNS for each
|
||||
requested domain resolves to the server running certbot. An example request
|
||||
made to your web server would look like:
|
||||
|
||||
::
|
||||
|
|
@ -188,7 +188,7 @@ specified port using each requested domain name.
|
|||
Manual
|
||||
------
|
||||
|
||||
If you'd like to obtain a cert running ``letsencrypt`` on a machine
|
||||
If you'd like to obtain a cert running ``certbot`` on a machine
|
||||
other than your target webserver or perform the steps for domain
|
||||
validation yourself, you can use the manual plugin. While hidden from
|
||||
the UI, you can use the plugin to obtain a cert by specifying
|
||||
|
|
@ -201,11 +201,10 @@ Nginx
|
|||
|
||||
In the future, if you're running Nginx you will hopefully be able to use this
|
||||
plugin to automatically obtain and install your certificate. The Nginx plugin is
|
||||
still experimental, however, and is not installed with letsencrypt-auto_. If
|
||||
still experimental, however, and is not installed with certbot-auto_. If
|
||||
installed, you can select this plugin on the command line by including
|
||||
``--nginx``.
|
||||
|
||||
|
||||
Renewal
|
||||
=======
|
||||
|
||||
|
|
@ -213,11 +212,11 @@ Renewal
|
|||
days). Make sure you renew the certificates at least once in 3
|
||||
months.
|
||||
|
||||
The ``letsencrypt`` client now supports a ``renew`` action to check
|
||||
The ``certbot`` client now supports a ``renew`` action to check
|
||||
all installed certificates for impending expiry and attempt to renew
|
||||
them. The simplest form is simply
|
||||
|
||||
``letsencrypt renew``
|
||||
``certbot renew``
|
||||
|
||||
This will attempt to renew any previously-obtained certificates that
|
||||
expire in less than 30 days. The same plugin and options that were used
|
||||
|
|
@ -228,14 +227,14 @@ You can also specify hooks to be run before or after a certificate is
|
|||
renewed. For example, if you want to use the standalone_ plugin to renew
|
||||
your certificates, you may want to use a command like
|
||||
|
||||
``letsencrypt renew --standalone --pre-hook "service nginx stop" --post-hook "service nginx start"``
|
||||
``certbot renew --standalone --pre-hook "service nginx stop" --post-hook "service nginx start"``
|
||||
|
||||
This will stop Nginx so standalone can bind to the necessary ports and
|
||||
then restart Nginx after the plugin is finished. The hooks will only be
|
||||
run if a certificate is due for renewal, so you can run this command
|
||||
frequently without unnecessarily stopping your webserver. More
|
||||
information about renewal hooks can be found by running
|
||||
``letsencrypt --help renew``.
|
||||
``certbot --help renew``.
|
||||
|
||||
If you're sure that this command executes successfully without human
|
||||
intervention, you can add the command to ``crontab`` (since certificates
|
||||
|
|
@ -251,9 +250,9 @@ certificate regardless of its age. (This form is not appropriate to run
|
|||
daily because each certificate will be renewed every day, which will
|
||||
quickly run into the certificate authority rate limit.)
|
||||
|
||||
Note that options provided to ``letsencrypt renew`` will apply to
|
||||
Note that options provided to ``certbot renew`` will apply to
|
||||
*every* certificate for which renewal is attempted; for example,
|
||||
``letsencrypt renew --rsa-key-size 4096`` would try to replace every
|
||||
``certbot renew --rsa-key-size 4096`` would try to replace every
|
||||
near-expiry certificate with an equivalent certificate using a 4096-bit
|
||||
RSA public key. If a certificate is successfully renewed using
|
||||
specified options, those options will be saved and used for future
|
||||
|
|
@ -262,12 +261,12 @@ renewals of that certificate.
|
|||
|
||||
An alternative form that provides for more fine-grained control over the
|
||||
renewal process (while renewing specified certificates one at a time),
|
||||
is ``letsencrypt certonly`` with the complete set of subject domains of
|
||||
is ``certbot certonly`` with the complete set of subject domains of
|
||||
a specific certificate specified via `-d` flags. You may also want to
|
||||
include the ``-n`` or ``--noninteractive`` flag to prevent blocking on
|
||||
user input (which is useful when running the command from cron).
|
||||
|
||||
``letsencrypt certonly -n -d example.com -d www.example.com``
|
||||
``certbot certonly -n -d example.com -d www.example.com``
|
||||
|
||||
(All of the domains covered by the certificate must be specified in
|
||||
this case in order to renew and replace the old certificate rather
|
||||
|
|
@ -280,7 +279,7 @@ The ``certonly`` form attempts to renew one individual certificate.
|
|||
Please note that the CA will send notification emails to the address
|
||||
you provide if you do not renew certificates that are about to expire.
|
||||
|
||||
Let's Encrypt is working hard on improving the renewal process, and we
|
||||
Certbot is working hard on improving the renewal process, and we
|
||||
apologize for any inconveniences you encounter in integrating these
|
||||
commands into your individual environment.
|
||||
|
||||
|
|
@ -311,7 +310,7 @@ The following files are available:
|
|||
Private key for the certificate.
|
||||
|
||||
.. warning:: This **must be kept secret at all times**! Never share
|
||||
it with anyone, including Let's Encrypt developers. You cannot
|
||||
it with anyone, including Certbot developers. You cannot
|
||||
put it into a safe, however - your server still needs to access
|
||||
this file in order for SSL/TLS to work.
|
||||
|
||||
|
|
@ -364,7 +363,7 @@ Configuration file
|
|||
==================
|
||||
|
||||
It is possible to specify configuration file with
|
||||
``letsencrypt-auto --config cli.ini`` (or shorter ``-c cli.ini``). An
|
||||
``certbot-auto --config cli.ini`` (or shorter ``-c cli.ini``). An
|
||||
example configuration file is shown below:
|
||||
|
||||
.. include:: ../examples/cli.ini
|
||||
|
|
@ -383,13 +382,14 @@ By default, the following locations are searched:
|
|||
Getting help
|
||||
============
|
||||
|
||||
If you're having problems you can chat with us on `IRC (#letsencrypt @
|
||||
Freenode) <https://webchat.freenode.net?channels=%23letsencrypt>`_ or
|
||||
get support on our `forums <https://community.letsencrypt.org>`_.
|
||||
If you're having problems you can chat with us on `IRC (#certbot @
|
||||
OFTC) <https://webchat.oftc.net?channels=%23certbot>`_ or at
|
||||
`IRC (#letsencrypt @ freenode) <https://webchat.freenode.net?channels=%23letsencrypt>`_
|
||||
or get support on the Let's Encrypt `forums <https://community.letsencrypt.org>`_.
|
||||
|
||||
If you find a bug in the software, please do report it in our `issue
|
||||
tracker
|
||||
<https://github.com/letsencrypt/letsencrypt/issues>`_. Remember to
|
||||
<https://github.com/certbot/certbot/issues>`_. Remember to
|
||||
give us as much information as possible:
|
||||
|
||||
- copy and paste exact command line used and the output (though mind
|
||||
|
|
@ -397,7 +397,7 @@ give us as much information as possible:
|
|||
information, including your email and domains)
|
||||
- copy and paste logs from ``/var/log/letsencrypt`` (though mind they
|
||||
also might contain personally identifiable information)
|
||||
- copy and paste ``letsencrypt --version`` output
|
||||
- copy and paste ``certbot --version`` output
|
||||
- your operating system, including specific version
|
||||
- specify which installation_ method you've chosen
|
||||
|
||||
|
|
@ -414,10 +414,10 @@ plugins cannot reach it from inside the Docker container.
|
|||
|
||||
You should definitely read the :ref:`where-certs` section, in order to
|
||||
know how to manage the certs
|
||||
manually. https://github.com/letsencrypt/letsencrypt/wiki/Ciphersuite-guidance
|
||||
manually. https://github.com/certbot/certbot/wiki/Ciphersuite-guidance
|
||||
provides some information about recommended ciphersuites. If none of
|
||||
these make much sense to you, you should definitely use the
|
||||
letsencrypt-auto_ method, which enables you to use installer plugins
|
||||
certbot-auto_ method, which enables you to use installer plugins
|
||||
that cover both of those hard topics.
|
||||
|
||||
If you're still not convinced and have decided to use this method,
|
||||
|
|
@ -426,7 +426,7 @@ to, `install Docker`_, then issue the following command:
|
|||
|
||||
.. code-block:: shell
|
||||
|
||||
sudo docker run -it --rm -p 443:443 -p 80:80 --name letsencrypt \
|
||||
sudo docker run -it --rm -p 443:443 -p 80:80 --name certbot \
|
||||
-v "/etc/letsencrypt:/etc/letsencrypt" \
|
||||
-v "/var/lib/letsencrypt:/var/lib/letsencrypt" \
|
||||
quay.io/letsencrypt/letsencrypt:latest auth
|
||||
|
|
@ -456,19 +456,19 @@ Operating System Packages
|
|||
|
||||
.. code-block:: shell
|
||||
|
||||
sudo pacman -S letsencrypt letsencrypt-apache
|
||||
sudo pacman -S letsencrypt
|
||||
|
||||
**Debian**
|
||||
|
||||
If you run Debian Stretch or Debian Sid, you can install letsencrypt packages.
|
||||
If you run Debian Stretch or Debian Sid, you can install certbot packages.
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
sudo apt-get update
|
||||
sudo apt-get install letsencrypt python-letsencrypt-apache
|
||||
sudo apt-get install certbot python-certbot-apache
|
||||
|
||||
If you don't want to use the Apache plugin, you can omit the
|
||||
``python-letsencrypt-apache`` package.
|
||||
``python-certbot-apache`` package.
|
||||
|
||||
Packages exist for Debian Jessie via backports. First you'll have to follow the
|
||||
instructions at http://backports.debian.org/Instructions/ to enable the Jessie backports
|
||||
|
|
@ -486,7 +486,7 @@ repo, if you have not already done so. Then run:
|
|||
|
||||
**Gentoo**
|
||||
|
||||
The official Let's Encrypt client is available in Gentoo Portage. If you
|
||||
The official Certbot client is available in Gentoo Portage. If you
|
||||
want to use the Apache plugin, it has to be installed separately:
|
||||
|
||||
.. code-block:: shell
|
||||
|
|
@ -495,8 +495,12 @@ want to use the Apache plugin, it has to be installed separately:
|
|||
emerge -av app-crypt/letsencrypt-apache
|
||||
|
||||
Currently, only the Apache plugin is included in Portage. However, if you
|
||||
want the nginx plugin, you can use Layman to add the mrueg overlay which
|
||||
does include the nginx plugin package:
|
||||
Warning!
|
||||
You can use Layman to add the mrueg overlay which does include a package for the
|
||||
Certbot Nginx plugin, however, this plugin is known to be buggy and should only
|
||||
be used with caution after creating a backup up your Nginx configuration.
|
||||
We strongly recommend you use the app-crypt/letsencrypt package instead until
|
||||
the Nginx plugin is ready.
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
|
|
@ -533,7 +537,7 @@ Note: this change is not required for the other plugins.
|
|||
**Other Operating Systems**
|
||||
|
||||
OS packaging is an ongoing effort. If you'd like to package
|
||||
Let's Encrypt client for your distribution of choice please have a
|
||||
Certbot for your distribution of choice please have a
|
||||
look at the :doc:`packaging`.
|
||||
|
||||
|
||||
|
|
@ -549,19 +553,19 @@ whole process is described in the :doc:`contributing`.
|
|||
environment, e.g. ``sudo python setup.py install``, ``sudo pip
|
||||
install``, ``sudo ./venv/bin/...``. These modes of operation might
|
||||
corrupt your operating system and are **not supported** by the
|
||||
Let's Encrypt team!
|
||||
Certbot team!
|
||||
|
||||
|
||||
Comparison of different methods
|
||||
-------------------------------
|
||||
|
||||
Unless you have a very specific requirements, we kindly ask you to use
|
||||
the letsencrypt-auto_ method. It's the fastest, the most thoroughly
|
||||
Unless you have a very specific requirements, we kindly suggest that you use
|
||||
the certbot-auto_ method. It's the fastest, the most thoroughly
|
||||
tested and the most reliable way of getting our software and the free
|
||||
SSL certificates!
|
||||
TLS/SSL certificates!
|
||||
|
||||
Beyond the methods discussed here, other methods may be possible, such as
|
||||
installing Let's Encrypt directly with pip from PyPI or downloading a ZIP
|
||||
installing Certbot directly with pip from PyPI or downloading a ZIP
|
||||
archive from GitHub may be technically possible but are not presently
|
||||
recommended or supported.
|
||||
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ here = os.path.abspath(os.path.dirname(__file__))
|
|||
readme = read_file(os.path.join(here, 'README.rst'))
|
||||
|
||||
|
||||
version = '0.6.0.dev0'
|
||||
version = '0.7.0.dev0'
|
||||
|
||||
|
||||
# This package is a simple shim around certbot-apache
|
||||
|
|
|
|||
269
letsencrypt-auto
269
letsencrypt-auto
|
|
@ -1,6 +1,6 @@
|
|||
#!/bin/sh
|
||||
#
|
||||
# Download and run the latest release version of the Let's Encrypt client.
|
||||
# Download and run the latest release version of the Certbot client.
|
||||
#
|
||||
# NOTE: THIS SCRIPT IS AUTO-GENERATED AND SELF-UPDATING
|
||||
#
|
||||
|
|
@ -19,11 +19,36 @@ XDG_DATA_HOME=${XDG_DATA_HOME:-~/.local/share}
|
|||
VENV_NAME="letsencrypt"
|
||||
VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"}
|
||||
VENV_BIN="$VENV_PATH/bin"
|
||||
LE_AUTO_VERSION="0.5.0"
|
||||
LE_AUTO_VERSION="0.6.0"
|
||||
BASENAME=$(basename $0)
|
||||
USAGE="Usage: $BASENAME [OPTIONS]
|
||||
A self-updating wrapper script for the Certbot ACME client. When run, updates
|
||||
to both this script and certbot will be downloaded and installed. After
|
||||
ensuring you have the latest versions installed, certbot will be invoked with
|
||||
all arguments you have provided.
|
||||
|
||||
Help for certbot itself cannot be provided until it is installed.
|
||||
|
||||
--debug attempt experimental installation
|
||||
-h, --help print this help
|
||||
-n, --non-interactive, --noninteractive run without asking for user input
|
||||
--no-self-upgrade do not download updates
|
||||
--os-packages-only install OS dependencies and exit
|
||||
-v, --verbose provide more output
|
||||
|
||||
All arguments are accepted and forwarded to the Certbot client when run."
|
||||
|
||||
while getopts ":hnv" arg; do
|
||||
case $arg in
|
||||
h)
|
||||
HELP=1;;
|
||||
n)
|
||||
ASSUME_YES=1;;
|
||||
v)
|
||||
VERBOSE=1;;
|
||||
esac
|
||||
done
|
||||
|
||||
# This script takes the same arguments as the main letsencrypt program, but it
|
||||
# additionally responds to --verbose (more output) and --debug (allow support
|
||||
# for experimental platforms)
|
||||
for arg in "$@" ; do
|
||||
case "$arg" in
|
||||
--debug)
|
||||
|
|
@ -34,25 +59,26 @@ for arg in "$@" ; do
|
|||
# Do not upgrade this script (also prevents client upgrades, because each
|
||||
# copy of the script pins a hash of the python client)
|
||||
NO_SELF_UPGRADE=1;;
|
||||
--help)
|
||||
HELP=1;;
|
||||
--noninteractive|--non-interactive)
|
||||
ASSUME_YES=1;;
|
||||
--verbose)
|
||||
VERBOSE=1;;
|
||||
[!-]*|-*[!v]*|-)
|
||||
# Anything that isn't -v, -vv, etc.: that is, anything that does not
|
||||
# start with a -, contains anything that's not a v, or is just "-"
|
||||
;;
|
||||
*) # -v+ remains.
|
||||
VERBOSE=1;;
|
||||
esac
|
||||
done
|
||||
|
||||
# letsencrypt-auto needs root access to bootstrap OS dependencies, and
|
||||
# letsencrypt itself needs root access for almost all modes of operation
|
||||
# certbot-auto needs root access to bootstrap OS dependencies, and
|
||||
# certbot itself needs root access for almost all modes of operation
|
||||
# The "normal" case is that sudo is used for the steps that need root, but
|
||||
# this script *can* be run as root (not recommended), or fall back to using
|
||||
# `su`
|
||||
SUDO_ENV=""
|
||||
export CERTBOT_AUTO="$0"
|
||||
if test "`id -u`" -ne "0" ; then
|
||||
if command -v sudo 1>/dev/null 2>&1; then
|
||||
SUDO=sudo
|
||||
SUDO_ENV="CERTBOT_AUTO=$0"
|
||||
else
|
||||
echo \"sudo\" is not available, will use \"su\" for installation steps...
|
||||
# Because the parameters in `su -c` has to be a string,
|
||||
|
|
@ -81,6 +107,12 @@ else
|
|||
SUDO=
|
||||
fi
|
||||
|
||||
if [ $BASENAME = "letsencrypt-auto" ]; then
|
||||
# letsencrypt-auto does not respect --help or --yes for backwards compatibility
|
||||
ASSUME_YES=1
|
||||
HELP=0
|
||||
fi
|
||||
|
||||
ExperimentalBootstrap() {
|
||||
# Arguments: Platform name, bootstrap function name
|
||||
if [ "$DEBUG" = 1 ]; then
|
||||
|
|
@ -151,30 +183,45 @@ BootstrapDebCommon() {
|
|||
augeas_pkg="libaugeas0 augeas-lenses"
|
||||
AUGVERSION=`apt-cache show --no-all-versions libaugeas0 | grep ^Version: | cut -d" " -f2`
|
||||
|
||||
if [ "$ASSUME_YES" = 1 ]; then
|
||||
YES_FLAG="-y"
|
||||
fi
|
||||
|
||||
AddBackportRepo() {
|
||||
# ARGS:
|
||||
BACKPORT_NAME="$1"
|
||||
BACKPORT_SOURCELINE="$2"
|
||||
echo "To use the Apache Certbot plugin, augeas needs to be installed from $BACKPORT_NAME."
|
||||
if ! grep -v -e ' *#' /etc/apt/sources.list | grep -q "$BACKPORT_NAME" ; then
|
||||
# This can theoretically error if sources.list.d is empty, but in that case we don't care.
|
||||
if ! grep -v -e ' *#' /etc/apt/sources.list.d/* 2>/dev/null | grep -q "$BACKPORT_NAME"; then
|
||||
/bin/echo -n "Installing augeas from $BACKPORT_NAME in 3 seconds..."
|
||||
sleep 1s
|
||||
/bin/echo -ne "\e[0K\rInstalling augeas from $BACKPORT_NAME in 2 seconds..."
|
||||
sleep 1s
|
||||
/bin/echo -e "\e[0K\rInstalling augeas from $BACKPORT_NAME in 1 second ..."
|
||||
sleep 1s
|
||||
if echo $BACKPORT_NAME | grep -q wheezy ; then
|
||||
/bin/echo '(Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports")'
|
||||
if [ "$ASSUME_YES" = 1 ]; then
|
||||
/bin/echo -n "Installing augeas from $BACKPORT_NAME in 3 seconds..."
|
||||
sleep 1s
|
||||
/bin/echo -ne "\e[0K\rInstalling augeas from $BACKPORT_NAME in 2 seconds..."
|
||||
sleep 1s
|
||||
/bin/echo -e "\e[0K\rInstalling augeas from $BACKPORT_NAME in 1 second ..."
|
||||
sleep 1s
|
||||
add_backports=1
|
||||
else
|
||||
read -p "Would you like to enable the $BACKPORT_NAME repository [Y/n]? " response
|
||||
case $response in
|
||||
[yY][eE][sS]|[yY]|"")
|
||||
add_backports=1;;
|
||||
*)
|
||||
add_backports=0;;
|
||||
esac
|
||||
fi
|
||||
if [ "$add_backports" = 1 ]; then
|
||||
$SUDO sh -c "echo $BACKPORT_SOURCELINE >> /etc/apt/sources.list.d/$BACKPORT_NAME.list"
|
||||
$SUDO apt-get update
|
||||
fi
|
||||
|
||||
$SUDO sh -c "echo $BACKPORT_SOURCELINE >> /etc/apt/sources.list.d/$BACKPORT_NAME.list"
|
||||
$SUDO apt-get update
|
||||
fi
|
||||
fi
|
||||
$SUDO apt-get install -y --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
|
||||
augeas_pkg=
|
||||
|
||||
if [ "$add_backports" != 0 ]; then
|
||||
$SUDO apt-get install $YES_FLAG --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
|
||||
augeas_pkg=
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -186,12 +233,12 @@ BootstrapDebCommon() {
|
|||
AddBackportRepo precise-backports "deb http://archive.ubuntu.com/ubuntu precise-backports main restricted universe multiverse"
|
||||
else
|
||||
echo "No libaugeas0 version is available that's new enough to run the"
|
||||
echo "Let's Encrypt apache plugin..."
|
||||
echo "Certbot apache plugin..."
|
||||
fi
|
||||
# XXX add a case for ubuntu PPAs
|
||||
fi
|
||||
|
||||
$SUDO apt-get install -y --no-install-recommends \
|
||||
$SUDO apt-get install $YES_FLAG --no-install-recommends \
|
||||
python \
|
||||
python-dev \
|
||||
$virtualenv \
|
||||
|
|
@ -212,9 +259,10 @@ BootstrapDebCommon() {
|
|||
|
||||
BootstrapRpmCommon() {
|
||||
# Tested with:
|
||||
# - Fedora 22, 23 (x64)
|
||||
# - Fedora 20, 21, 22, 23 (x64)
|
||||
# - Centos 7 (x64: on DigitalOcean droplet)
|
||||
# - CentOS 7 Minimal install in a Hyper-V VM
|
||||
# - CentOS 6 (EPEL must be installed manually)
|
||||
|
||||
if type dnf 2>/dev/null
|
||||
then
|
||||
|
|
@ -228,54 +276,62 @@ BootstrapRpmCommon() {
|
|||
exit 1
|
||||
fi
|
||||
|
||||
pkgs="
|
||||
gcc
|
||||
dialog
|
||||
augeas-libs
|
||||
openssl
|
||||
openssl-devel
|
||||
libffi-devel
|
||||
redhat-rpm-config
|
||||
ca-certificates
|
||||
"
|
||||
|
||||
# Some distros and older versions of current distros use a "python27"
|
||||
# instead of "python" naming convention. Try both conventions.
|
||||
if ! $SUDO $tool install -y \
|
||||
python \
|
||||
python-devel \
|
||||
python-virtualenv \
|
||||
python-tools \
|
||||
python-pip
|
||||
then
|
||||
if ! $SUDO $tool install -y \
|
||||
python27 \
|
||||
python27-devel \
|
||||
python27-virtualenv \
|
||||
python27-tools \
|
||||
python27-pip
|
||||
then
|
||||
echo "Could not install Python dependencies. Aborting bootstrap!"
|
||||
exit 1
|
||||
fi
|
||||
if $SUDO $tool list python >/dev/null 2>&1; then
|
||||
pkgs="$pkgs
|
||||
python
|
||||
python-devel
|
||||
python-virtualenv
|
||||
python-tools
|
||||
python-pip
|
||||
"
|
||||
else
|
||||
pkgs="$pkgs
|
||||
python27
|
||||
python27-devel
|
||||
python27-virtualenv
|
||||
python27-tools
|
||||
python27-pip
|
||||
"
|
||||
fi
|
||||
|
||||
if ! $SUDO $tool install -y \
|
||||
gcc \
|
||||
dialog \
|
||||
augeas-libs \
|
||||
openssl \
|
||||
openssl-devel \
|
||||
libffi-devel \
|
||||
redhat-rpm-config \
|
||||
ca-certificates
|
||||
then
|
||||
echo "Could not install additional dependencies. Aborting bootstrap!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
if $SUDO $tool list installed "httpd" >/dev/null 2>&1; then
|
||||
if ! $SUDO $tool install -y mod_ssl
|
||||
then
|
||||
echo "Apache found, but mod_ssl could not be installed."
|
||||
fi
|
||||
pkgs="$pkgs
|
||||
mod_ssl
|
||||
"
|
||||
fi
|
||||
|
||||
if [ "$ASSUME_YES" = 1 ]; then
|
||||
yes_flag="-y"
|
||||
fi
|
||||
|
||||
if ! $SUDO $tool install $yes_flag $pkgs; then
|
||||
echo "Could not install OS dependencies. Aborting bootstrap!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
BootstrapSuseCommon() {
|
||||
# SLE12 don't have python-virtualenv
|
||||
|
||||
$SUDO zypper -nq in -l \
|
||||
if [ "$ASSUME_YES" = 1 ]; then
|
||||
zypper_flags="-nq"
|
||||
install_flags="-l"
|
||||
fi
|
||||
|
||||
$SUDO zypper $zypper_flags in $install_flags \
|
||||
python \
|
||||
python-devel \
|
||||
python-virtualenv \
|
||||
|
|
@ -310,8 +366,12 @@ BootstrapArchCommon() {
|
|||
# pacman -T exits with 127 if there are missing dependencies
|
||||
missing=$($SUDO pacman -T $deps) || true
|
||||
|
||||
if [ "$ASSUME_YES" = 1 ]; then
|
||||
noconfirm="--noconfirm"
|
||||
fi
|
||||
|
||||
if [ "$missing" ]; then
|
||||
$SUDO pacman -S --needed $missing
|
||||
$SUDO pacman -S --needed $missing $noconfirm
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -426,7 +486,7 @@ Bootstrap() {
|
|||
elif grep -iq "Amazon Linux" /etc/issue ; then
|
||||
ExperimentalBootstrap "Amazon Linux" BootstrapRpmCommon
|
||||
else
|
||||
echo "Sorry, I don't know how to bootstrap Let's Encrypt on your operating system!"
|
||||
echo "Sorry, I don't know how to bootstrap Certbot on your operating system!"
|
||||
echo
|
||||
echo "You will need to bootstrap, configure virtualenv, and run pip install manually."
|
||||
echo "Please see https://letsencrypt.readthedocs.org/en/latest/contributing.html#prerequisites"
|
||||
|
|
@ -446,7 +506,8 @@ if [ "$1" = "--le-auto-phase2" ]; then
|
|||
shift 1 # the --le-auto-phase2 arg
|
||||
if [ -f "$VENV_BIN/letsencrypt" ]; then
|
||||
# --version output ran through grep due to python-cryptography DeprecationWarnings
|
||||
INSTALLED_VERSION=$("$VENV_BIN/letsencrypt" --version 2>&1 | grep ^letsencrypt | cut -d " " -f 2)
|
||||
# grep for both certbot and letsencrypt until certbot and shim packages have been released
|
||||
INSTALLED_VERSION=$("$VENV_BIN/letsencrypt" --version 2>&1 | grep "^certbot\|^letsencrypt" | cut -d " " -f 2)
|
||||
else
|
||||
INSTALLED_VERSION="none"
|
||||
fi
|
||||
|
|
@ -465,8 +526,8 @@ if [ "$1" = "--le-auto-phase2" ]; then
|
|||
# There is no $ interpolation due to quotes on starting heredoc delimiter.
|
||||
# -------------------------------------------------------------------------
|
||||
cat << "UNLIKELY_EOF" > "$TEMP_DIR/letsencrypt-auto-requirements.txt"
|
||||
# This is the flattened list of packages letsencrypt-auto installs. To generate
|
||||
# this, do `pip install --no-cache-dir -e acme -e . -e letsencrypt-apache`, and
|
||||
# This is the flattened list of packages certbot-auto installs. To generate
|
||||
# this, do `pip install --no-cache-dir -e acme -e . -e certbot-apache`, and
|
||||
# then use `hashin` or a more secure method to gather the hashes.
|
||||
|
||||
argparse==1.4.0 \
|
||||
|
|
@ -645,15 +706,21 @@ mock==1.0.1 \
|
|||
|
||||
# THE LINES BELOW ARE EDITED BY THE RELEASE SCRIPT; ADD ALL DEPENDENCIES ABOVE.
|
||||
|
||||
acme==0.5.0 \
|
||||
--hash=sha256:ceb4127c13213f0006a564be82176b968c6b374d20d9fc78555d0658a252b275 \
|
||||
--hash=sha256:0605c63c656d33c883a05675f5db9cfb85d503f2771c885031800e0da7631abd
|
||||
letsencrypt==0.5.0 \
|
||||
--hash=sha256:f90f883e99cdbdf8142335bdbf4f74a8af143ee4b4ec60fb49c6e47418c1114c \
|
||||
--hash=sha256:e38a2b70b82be79bc195307652244a3e012ec73d897d4dbd3f80cf698496d15a
|
||||
letsencrypt-apache==0.5.0 \
|
||||
--hash=sha256:a767882164a7b09d9c12c80684a28a782135fdaf35654ef5a02c0b7b1d27ab8d \
|
||||
--hash=sha256:c20e7b9c517aa4a7d70e6bd9382da7259f00bc191b9e60d8e312e48837a00c41
|
||||
acme==0.6.0 \
|
||||
--hash=sha256:cbe4e7a340a19725a8740ed86e30abdbe18fc22c4c6022b7a8e56642d502bcc3 \
|
||||
--hash=sha256:ec4e6009dfbd629b58473eb06bbebfd9fb2a79fc8831c149e9205bc38a98ecc6
|
||||
certbot==0.6.0 \
|
||||
--hash=sha256:a893632d228864b0a751db9f3fdd93439ed34b988ea21b64fb0f0fa2ceded6a2 \
|
||||
--hash=sha256:80b0b7dc5afeec2816ef638a61e7c628d73cd72666eebf4984be426d1c2b492d
|
||||
certbot-apache==0.6.0 \
|
||||
--hash=sha256:0ab077f0913b81ed5c1b141c3a7c4c0228ef3738d8d61a93db794d9a80718d43 \
|
||||
--hash=sha256:1cfbe751209079a803758f472200816fac559f2a36fdd582d25e3ba5601423a1
|
||||
letsencrypt==0.6.0 \
|
||||
--hash=sha256:93196c7dcd57272a753e525d145c5a9987c8968c22ec954bcf83dcc9d2499a76 \
|
||||
--hash=sha256:a16d6c395f1bf5fd61a28ef83dc78f42dbecbad9d00be6236f2ad8915645c154
|
||||
letsencrypt-apache==0.6.0 \
|
||||
--hash=sha256:02fadc52a0796e53978c508beec9c53e1fc047660240832b9bde5d53ab3a1379 \
|
||||
--hash=sha256:1c5522d94d7750bdb9bfa6201d2c263e914f662c9d0079e673167233cf4364f1
|
||||
|
||||
UNLIKELY_EOF
|
||||
# -------------------------------------------------------------------------
|
||||
|
|
@ -823,18 +890,30 @@ UNLIKELY_EOF
|
|||
fi
|
||||
echo "Installation succeeded."
|
||||
fi
|
||||
echo "Requesting root privileges to run letsencrypt..."
|
||||
echo " " $SUDO "$VENV_BIN/letsencrypt" "$@"
|
||||
$SUDO "$VENV_BIN/letsencrypt" "$@"
|
||||
echo "Requesting root privileges to run certbot..."
|
||||
if [ -z "$SUDO_ENV" ] ; then
|
||||
# SUDO is su wrapper / noop
|
||||
echo " " $SUDO "$VENV_BIN/letsencrypt" "$@"
|
||||
$SUDO "$VENV_BIN/letsencrypt" "$@"
|
||||
else
|
||||
# sudo
|
||||
echo " " $SUDO "$SUDO_ENV" "$VENV_BIN/letsencrypt" "$@"
|
||||
$SUDO "$SUDO_ENV" "$VENV_BIN/letsencrypt" "$@"
|
||||
fi
|
||||
|
||||
else
|
||||
# Phase 1: Upgrade letsencrypt-auto if neceesary, then self-invoke.
|
||||
# Phase 1: Upgrade certbot-auto if neceesary, then self-invoke.
|
||||
#
|
||||
# Each phase checks the version of only the thing it is responsible for
|
||||
# upgrading. Phase 1 checks the version of the latest release of
|
||||
# letsencrypt-auto (which is always the same as that of the letsencrypt
|
||||
# package). Phase 2 checks the version of the locally installed letsencrypt.
|
||||
# certbot-auto (which is always the same as that of the certbot
|
||||
# package). Phase 2 checks the version of the locally installed certbot.
|
||||
|
||||
if [ ! -f "$VENV_BIN/letsencrypt" ]; then
|
||||
if [ "$HELP" = 1 ]; then
|
||||
echo "$USAGE"
|
||||
exit 0
|
||||
fi
|
||||
# If it looks like we've never bootstrapped before, bootstrap:
|
||||
Bootstrap
|
||||
fi
|
||||
|
|
@ -953,7 +1032,7 @@ def verified_new_le_auto(get, tag, temp_dir):
|
|||
stderr=dev_null)
|
||||
except CalledProcessError as exc:
|
||||
raise ExpectedError("Couldn't verify signature of downloaded "
|
||||
"letsencrypt-auto.", exc)
|
||||
"certbot-auto.", exc)
|
||||
|
||||
|
||||
def main():
|
||||
|
|
@ -978,29 +1057,27 @@ if __name__ == '__main__':
|
|||
UNLIKELY_EOF
|
||||
# ---------------------------------------------------------------------------
|
||||
DeterminePythonVersion
|
||||
REMOTE_VERSION=`"$LE_PYTHON" "$TEMP_DIR/fetch.py" --latest-version`
|
||||
if [ "$LE_AUTO_VERSION" != "$REMOTE_VERSION" ]; then
|
||||
echo "Upgrading letsencrypt-auto $LE_AUTO_VERSION to $REMOTE_VERSION..."
|
||||
if ! REMOTE_VERSION=`"$LE_PYTHON" "$TEMP_DIR/fetch.py" --latest-version` ; then
|
||||
echo "WARNING: unable to check for updates."
|
||||
elif [ "$LE_AUTO_VERSION" != "$REMOTE_VERSION" ]; then
|
||||
echo "Upgrading certbot-auto $LE_AUTO_VERSION to $REMOTE_VERSION..."
|
||||
|
||||
# Now we drop into Python so we don't have to install even more
|
||||
# dependencies (curl, etc.), for better flow control, and for the option of
|
||||
# future Windows compatibility.
|
||||
"$LE_PYTHON" "$TEMP_DIR/fetch.py" --le-auto-script "v$REMOTE_VERSION"
|
||||
|
||||
# Install new copy of letsencrypt-auto.
|
||||
# Install new copy of certbot-auto.
|
||||
# TODO: Deal with quotes in pathnames.
|
||||
echo "Replacing letsencrypt-auto..."
|
||||
echo "Replacing certbot-auto..."
|
||||
# Clone permissions with cp. chmod and chown don't have a --reference
|
||||
# option on OS X or BSD, and stat -c on Linux is stat -f on OS X and BSD:
|
||||
echo " " $SUDO cp -p "$0" "$TEMP_DIR/letsencrypt-auto.permission-clone"
|
||||
$SUDO cp -p "$0" "$TEMP_DIR/letsencrypt-auto.permission-clone"
|
||||
echo " " $SUDO cp "$TEMP_DIR/letsencrypt-auto" "$TEMP_DIR/letsencrypt-auto.permission-clone"
|
||||
$SUDO cp "$TEMP_DIR/letsencrypt-auto" "$TEMP_DIR/letsencrypt-auto.permission-clone"
|
||||
# Using mv rather than cp leaves the old file descriptor pointing to the
|
||||
# original copy so the shell can continue to read it unmolested. mv across
|
||||
# filesystems is non-atomic, doing `rm dest, cp src dest, rm src`, but the
|
||||
# cp is unlikely to fail (esp. under sudo) if the rm doesn't.
|
||||
echo " " $SUDO mv -f "$TEMP_DIR/letsencrypt-auto.permission-clone" "$0"
|
||||
$SUDO mv -f "$TEMP_DIR/letsencrypt-auto.permission-clone" "$0"
|
||||
# TODO: Clean up temp dir safely, even if it has quotes in its path.
|
||||
rm -rf "$TEMP_DIR"
|
||||
|
|
|
|||
11
letsencrypt-auto-source/certbot-auto.asc
Normal file
11
letsencrypt-auto-source/certbot-auto.asc
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
Version: GnuPG v1
|
||||
|
||||
iQEcBAABAgAGBQJXM9ZDAAoJEE0XyZXNl3XyzGkH/2KeR0jYxXKlvwfCkxU6hSC0
|
||||
eXcxZVQk59hCSvkNGE6Mj6rwQcyjSqmRp14MaJpq7NZADN6F+HWb6VB/Wq6moMQs
|
||||
PJtthqwhF767Qg+Py9Hp6XmlKscjXB6AKCVxq5TBwEIOTtj0rhQRLF9/+GW6jFuf
|
||||
kT6aUcDWNjOyWWUtp9vOVprDtegrltp0/2DNitlvPu263pKC+7I3GyLTq4fKP4EE
|
||||
auZSAhFry9SNR3Usf2wD3kzhvLSrT3h9Yh5oA04oaX9H6e86EHwt6RJJRHpg8s6b
|
||||
e0CBIIuaRJEmdiMUWlV/gAfH6M2PbG1wtJdxc0ThNEoWAjTsopr61BoHJ3cpCy4=
|
||||
=+e7/
|
||||
-----END PGP SIGNATURE-----
|
||||
|
|
@ -19,7 +19,7 @@ XDG_DATA_HOME=${XDG_DATA_HOME:-~/.local/share}
|
|||
VENV_NAME="letsencrypt"
|
||||
VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"}
|
||||
VENV_BIN="$VENV_PATH/bin"
|
||||
LE_AUTO_VERSION="0.6.0.dev0"
|
||||
LE_AUTO_VERSION="0.7.0.dev0"
|
||||
BASENAME=$(basename $0)
|
||||
USAGE="Usage: $BASENAME [OPTIONS]
|
||||
A self-updating wrapper script for the Certbot ACME client. When run, updates
|
||||
|
|
@ -706,15 +706,21 @@ mock==1.0.1 \
|
|||
|
||||
# THE LINES BELOW ARE EDITED BY THE RELEASE SCRIPT; ADD ALL DEPENDENCIES ABOVE.
|
||||
|
||||
acme==0.5.0 \
|
||||
--hash=sha256:ceb4127c13213f0006a564be82176b968c6b374d20d9fc78555d0658a252b275 \
|
||||
--hash=sha256:0605c63c656d33c883a05675f5db9cfb85d503f2771c885031800e0da7631abd
|
||||
letsencrypt==0.5.0 \
|
||||
--hash=sha256:f90f883e99cdbdf8142335bdbf4f74a8af143ee4b4ec60fb49c6e47418c1114c \
|
||||
--hash=sha256:e38a2b70b82be79bc195307652244a3e012ec73d897d4dbd3f80cf698496d15a
|
||||
letsencrypt-apache==0.5.0 \
|
||||
--hash=sha256:a767882164a7b09d9c12c80684a28a782135fdaf35654ef5a02c0b7b1d27ab8d \
|
||||
--hash=sha256:c20e7b9c517aa4a7d70e6bd9382da7259f00bc191b9e60d8e312e48837a00c41
|
||||
acme==0.6.0 \
|
||||
--hash=sha256:cbe4e7a340a19725a8740ed86e30abdbe18fc22c4c6022b7a8e56642d502bcc3 \
|
||||
--hash=sha256:ec4e6009dfbd629b58473eb06bbebfd9fb2a79fc8831c149e9205bc38a98ecc6
|
||||
certbot==0.6.0 \
|
||||
--hash=sha256:a893632d228864b0a751db9f3fdd93439ed34b988ea21b64fb0f0fa2ceded6a2 \
|
||||
--hash=sha256:80b0b7dc5afeec2816ef638a61e7c628d73cd72666eebf4984be426d1c2b492d
|
||||
certbot-apache==0.6.0 \
|
||||
--hash=sha256:0ab077f0913b81ed5c1b141c3a7c4c0228ef3738d8d61a93db794d9a80718d43 \
|
||||
--hash=sha256:1cfbe751209079a803758f472200816fac559f2a36fdd582d25e3ba5601423a1
|
||||
letsencrypt==0.6.0 \
|
||||
--hash=sha256:93196c7dcd57272a753e525d145c5a9987c8968c22ec954bcf83dcc9d2499a76 \
|
||||
--hash=sha256:a16d6c395f1bf5fd61a28ef83dc78f42dbecbad9d00be6236f2ad8915645c154
|
||||
letsencrypt-apache==0.6.0 \
|
||||
--hash=sha256:02fadc52a0796e53978c508beec9c53e1fc047660240832b9bde5d53ab3a1379 \
|
||||
--hash=sha256:1c5522d94d7750bdb9bfa6201d2c263e914f662c9d0079e673167233cf4364f1
|
||||
|
||||
UNLIKELY_EOF
|
||||
# -------------------------------------------------------------------------
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -26,7 +26,8 @@ BootstrapMac() {
|
|||
# Workaround for _dlopen not finding augeas on OS X
|
||||
if [ "$pkgman" = "port" ] && ! [ -e "/usr/local/lib/libaugeas.dylib" ] && [ -e "/opt/local/lib/libaugeas.dylib" ]; then
|
||||
echo "Applying augeas workaround"
|
||||
$SUDO ln -s /opt/local/lib/libaugeas.dylib /usr/local/lib
|
||||
$SUDO mkdir -p /usr/local/lib/
|
||||
$SUDO ln -s /opt/local/lib/libaugeas.dylib /usr/local/lib/
|
||||
fi
|
||||
|
||||
if ! hash pip 2>/dev/null; then
|
||||
|
|
|
|||
|
|
@ -178,12 +178,18 @@ mock==1.0.1 \
|
|||
|
||||
# THE LINES BELOW ARE EDITED BY THE RELEASE SCRIPT; ADD ALL DEPENDENCIES ABOVE.
|
||||
|
||||
acme==0.5.0 \
|
||||
--hash=sha256:ceb4127c13213f0006a564be82176b968c6b374d20d9fc78555d0658a252b275 \
|
||||
--hash=sha256:0605c63c656d33c883a05675f5db9cfb85d503f2771c885031800e0da7631abd
|
||||
letsencrypt==0.5.0 \
|
||||
--hash=sha256:f90f883e99cdbdf8142335bdbf4f74a8af143ee4b4ec60fb49c6e47418c1114c \
|
||||
--hash=sha256:e38a2b70b82be79bc195307652244a3e012ec73d897d4dbd3f80cf698496d15a
|
||||
letsencrypt-apache==0.5.0 \
|
||||
--hash=sha256:a767882164a7b09d9c12c80684a28a782135fdaf35654ef5a02c0b7b1d27ab8d \
|
||||
--hash=sha256:c20e7b9c517aa4a7d70e6bd9382da7259f00bc191b9e60d8e312e48837a00c41
|
||||
acme==0.6.0 \
|
||||
--hash=sha256:cbe4e7a340a19725a8740ed86e30abdbe18fc22c4c6022b7a8e56642d502bcc3 \
|
||||
--hash=sha256:ec4e6009dfbd629b58473eb06bbebfd9fb2a79fc8831c149e9205bc38a98ecc6
|
||||
certbot==0.6.0 \
|
||||
--hash=sha256:a893632d228864b0a751db9f3fdd93439ed34b988ea21b64fb0f0fa2ceded6a2 \
|
||||
--hash=sha256:80b0b7dc5afeec2816ef638a61e7c628d73cd72666eebf4984be426d1c2b492d
|
||||
certbot-apache==0.6.0 \
|
||||
--hash=sha256:0ab077f0913b81ed5c1b141c3a7c4c0228ef3738d8d61a93db794d9a80718d43 \
|
||||
--hash=sha256:1cfbe751209079a803758f472200816fac559f2a36fdd582d25e3ba5601423a1
|
||||
letsencrypt==0.6.0 \
|
||||
--hash=sha256:93196c7dcd57272a753e525d145c5a9987c8968c22ec954bcf83dcc9d2499a76 \
|
||||
--hash=sha256:a16d6c395f1bf5fd61a28ef83dc78f42dbecbad9d00be6236f2ad8915645c154
|
||||
letsencrypt-apache==0.6.0 \
|
||||
--hash=sha256:02fadc52a0796e53978c508beec9c53e1fc047660240832b9bde5d53ab3a1379 \
|
||||
--hash=sha256:1c5522d94d7750bdb9bfa6201d2c263e914f662c9d0079e673167233cf4364f1
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ here = os.path.abspath(os.path.dirname(__file__))
|
|||
readme = read_file(os.path.join(here, 'README.rst'))
|
||||
|
||||
|
||||
version = '0.6.0.dev0'
|
||||
version = '0.7.0.dev0'
|
||||
|
||||
|
||||
# This package is a simple shim around certbot-nginx
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ readme = read_file(os.path.join(here, 'README.rst'))
|
|||
install_requires = ['certbot']
|
||||
|
||||
|
||||
version = '0.6.0.dev0'
|
||||
version = '0.7.0.dev0'
|
||||
|
||||
|
||||
setup(
|
||||
|
|
|
|||
|
|
@ -307,5 +307,5 @@ texinfo_documents = [
|
|||
intersphinx_mapping = {
|
||||
'python': ('https://docs.python.org/', None),
|
||||
'acme': ('https://acme-python.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://letsencrypt.readthedocs.org/en/latest/', None),
|
||||
'certbot': ('https://certbot.eff.org/docs/', None),
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ from setuptools import setup
|
|||
from setuptools import find_packages
|
||||
|
||||
|
||||
version = '0.6.0.dev0'
|
||||
version = '0.7.0.dev0'
|
||||
|
||||
install_requires = [
|
||||
'setuptools', # pkg_resources
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ here = os.path.abspath(os.path.dirname(__file__))
|
|||
readme = read_file(os.path.join(here, 'README.rst'))
|
||||
|
||||
|
||||
version = '0.6.0.dev0'
|
||||
version = '0.7.0.dev0'
|
||||
|
||||
|
||||
# This package is a simple shim around letshelp-certbot
|
||||
|
|
|
|||
|
|
@ -187,6 +187,12 @@ while ! openssl dgst -sha256 -verify $RELEASE_OPENSSL_PUBKEY -signature \
|
|||
read -p "Please correctly sign letsencrypt-auto with offline-signrequest.sh"
|
||||
done
|
||||
|
||||
# This signature is not quite as strong, but easier for people to verify out of band
|
||||
gpg -u "$RELEASE_GPG_KEY" --detach-sign --armor --sign letsencrypt-auto-source/letsencrypt-auto
|
||||
# We can't rename the openssl letsencrypt-auto.sig for compatibility reasons,
|
||||
# but we can use the right name for cerbot-auto.asc from day one
|
||||
mv letsencrypt-auto-source/letsencrypt-auto.asc letsencrypt-auto-source/certbot-auto.asc
|
||||
|
||||
# copy leauto to the root, overwriting the previous release version
|
||||
cp -p letsencrypt-auto-source/letsencrypt-auto certbot-auto
|
||||
cp -p letsencrypt-auto-source/letsencrypt-auto letsencrypt-auto
|
||||
|
|
|
|||
Loading…
Reference in a new issue