Merge remote-tracking branch 'letsencrypt/master'

.travis.yml

@@ -1,5 +1,9 @@
 language: python
 
+cache:
+    directories:
+        - $HOME/.cache/pip
+
 services:
   - rabbitmq
   - mariadb
@@ -19,23 +23,30 @@ env:
   global:
     - GOPATH=/tmp/go
     - PATH=$GOPATH/bin:$PATH
-  matrix:
-    - TOXENV=py26 BOULDER_INTEGRATION=1
-    - TOXENV=py27 BOULDER_INTEGRATION=1
-    - TOXENV=py26-oldest BOULDER_INTEGRATION=1
-    - TOXENV=py27-oldest BOULDER_INTEGRATION=1
-    - TOXENV=py33
-    - TOXENV=py34
-    - TOXENV=lint
-    - TOXENV=cover
-# Disabled for now due to requiring sudo -> causing more boulder integration
-# DNS timeouts :(
-#    - TOXENV=apacheconftest
 matrix:
   include:
-    - env: TOXENV=py35
-      python: 3.5
-
+    - python: "2.6"
+      env: TOXENV=py26 BOULDER_INTEGRATION=1
+    - python: "2.6"
+      env: TOXENV=py26-oldest BOULDER_INTEGRATION=1
+# Disabled for now due to requiring sudo -> causing more boulder integration
+# DNS timeouts :(
+#   - python: "2.7"
+#     env: TOXENV=apacheconftest
+    - python: "2.7"
+      env: TOXENV=py27 BOULDER_INTEGRATION=1
+    - python: "2.7"
+      env: TOXENV=py27-oldest BOULDER_INTEGRATION=1
+    - python: "2.7"
+      env: TOXENV=cover
+    - python: "2.7"
+      env: TOXENV=lint
+    - python: "3.3"
+      env: TOXENV=py33
+    - python: "3.4"
+      env: TOXENV=py34
+    - python: "3.5"
+      env: TOXENV=py35
 
 # Only build pushes to the master branch, PRs, and branches beginning with
 # `test-`. This reduces the number of simultaneous Travis runs, which speeds
@@ -57,7 +68,6 @@ addons:
     sources:
     - augeas
     packages:  # keep in sync with bootstrap/ubuntu.sh and Boulder
-    - python
     - python-dev
     - python-virtualenv
     - gcc

Dockerfile-dev

@@ -22,8 +22,8 @@ WORKDIR /opt/letsencrypt
 
 # TODO: Install non-default Python versions for tox.
 # TODO: Install Apache/Nginx for plugin development.
-COPY bootstrap/ubuntu.sh /opt/letsencrypt/src/ubuntu.sh
-RUN /opt/letsencrypt/src/ubuntu.sh && \
+COPY letsencrypt-auto-source/letsencrypt-auto /opt/letsencrypt/src/letsencrypt-auto
+RUN /opt/letsencrypt/src/letsencrypt-auto --os-packages-only && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* \
            /tmp/* \

Vagrantfile

@@ -7,7 +7,7 @@ VAGRANTFILE_API_VERSION = "2"
 # Setup instructions from docs/contributing.rst
 $ubuntu_setup_script = <<SETUP_SCRIPT
 cd /vagrant
-./bootstrap/install-deps.sh
+./letsencrypt-auto-source/letsencrypt-auto --os-packages-only
 ./bootstrap/dev/venv.sh
 SETUP_SCRIPT
 
@@ -21,6 +21,10 @@ Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
       # Cannot allocate memory" when running
       # letsencrypt.client.tests.display.util_test.NcursesDisplayTest
       v.memory = 1024
+
+      # Handle cases when the host is behind a private network by making the 
+      # NAT engine use the host's resolver mechanisms to handle DNS requests.
+      v.customize ["modifyvm", :id, "--natdnshostresolver1", "on"]
     end
   end
 

acme/.pylintrc

@@ -100,7 +100,7 @@ comment=no
 [FORMAT]
 
 # Maximum number of characters on a single line.
-max-line-length=100
+max-line-length=80
 
 # Regexp for a line that is allowed to be longer than the limit.
 ignore-long-lines=^\s*(# )?<?https?://\S+>?$

acme/acme/challenges_test.py

@@ -73,7 +73,8 @@ class KeyAuthorizationChallengeResponseTest(unittest.TestCase):
     def test_verify_wrong_form(self):
         from acme.challenges import KeyAuthorizationChallengeResponse
         response = KeyAuthorizationChallengeResponse(
-            key_authorization='.foo.oKGqedy-b-acd5eoybm2f-NVFxvyOoET5CNy3xnv8WY')
+            key_authorization='.foo.oKGqedy-b-acd5eoybm2f-'
+            'NVFxvyOoET5CNy3xnv8WY')
         self.assertFalse(response.verify(self.chall, KEY.public_key()))
 
 
@@ -273,10 +274,12 @@ class TLSSNI01ResponseTest(unittest.TestCase):
     @mock.patch('acme.challenges.TLSSNI01Response.verify_cert', autospec=True)
     def test_simple_verify(self, mock_verify_cert):
         mock_verify_cert.return_value = mock.sentinel.verification
-        self.assertEqual(mock.sentinel.verification, self.response.simple_verify(
-            self.chall, self.domain, KEY.public_key(),
-            cert=mock.sentinel.cert))
-        mock_verify_cert.assert_called_once_with(self.response, mock.sentinel.cert)
+        self.assertEqual(
+            mock.sentinel.verification, self.response.simple_verify(
+                self.chall, self.domain, KEY.public_key(),
+                cert=mock.sentinel.cert))
+        mock_verify_cert.assert_called_once_with(
+            self.response, mock.sentinel.cert)
 
     @mock.patch('acme.challenges.TLSSNI01Response.probe_cert')
     def test_simple_verify_false_on_probe_error(self, mock_probe_cert):
@@ -590,7 +593,8 @@ class DNSTest(unittest.TestCase):
 
     def test_check_validation_wrong_fields(self):
         bad_validation = jose.JWS.sign(
-            payload=self.msg.update(token=b'x' * 20).json_dumps().encode('utf-8'),
+            payload=self.msg.update(
+                token=b'x' * 20).json_dumps().encode('utf-8'),
             alg=jose.RS256, key=KEY)
         self.assertFalse(self.msg.check_validation(
             bad_validation, KEY.public_key()))

acme/acme/client.py

@@ -1,4 +1,5 @@
 """ACME client API."""
+import collections
 import datetime
 import heapq
 import logging
@@ -334,8 +335,9 @@ class Client(object):  # pylint: disable=too-many-instance-attributes
         :param authzrs: `list` of `.AuthorizationResource`
         :param int mintime: Minimum time before next attempt, used if
             ``Retry-After`` is not present in the response.
-        :param int max_attempts: Maximum number of attempts before
-            `PollError` with non-empty ``waiting`` is raised.
+        :param int max_attempts: Maximum number of attempts (per
+            authorization) before `PollError` with non-empty ``waiting``
+            is raised.
 
         :returns: ``(cert, updated_authzrs)`` `tuple` where ``cert`` is
             the issued certificate (`.messages.CertificateResource`),
@@ -349,6 +351,11 @@ class Client(object):  # pylint: disable=too-many-instance-attributes
             was marked by the CA as invalid
 
         """
+        # pylint: disable=too-many-locals
+        assert max_attempts > 0
+        attempts = collections.defaultdict(int)
+        exhausted = set()
+
         # priority queue with datetime (based on Retry-After) as key,
         # and original Authorization Resource as value
         waiting = [(datetime.datetime.now(), authzr) for authzr in authzrs]
@@ -356,8 +363,7 @@ class Client(object):  # pylint: disable=too-many-instance-attributes
         # recently updated one
         updated = dict((authzr, authzr) for authzr in authzrs)
 
-        while waiting and max_attempts:
-            max_attempts -= 1
+        while waiting:
             # find the smallest Retry-After, and sleep if necessary
             when, authzr = heapq.heappop(waiting)
             now = datetime.datetime.now()
@@ -371,16 +377,20 @@ class Client(object):  # pylint: disable=too-many-instance-attributes
             updated_authzr, response = self.poll(updated[authzr])
             updated[authzr] = updated_authzr
 
+            attempts[authzr] += 1
             # pylint: disable=no-member
             if updated_authzr.body.status not in (
                     messages.STATUS_VALID, messages.STATUS_INVALID):
-                # push back to the priority queue, with updated retry_after
-                heapq.heappush(waiting, (self.retry_after(
-                    response, default=mintime), authzr))
+                if attempts[authzr] < max_attempts:
+                    # push back to the priority queue, with updated retry_after
+                    heapq.heappush(waiting, (self.retry_after(
+                        response, default=mintime), authzr))
+                else:
+                    exhausted.add(authzr)
 
-        if not max_attempts or any(authzr.body.status == messages.STATUS_INVALID
-                                   for authzr in six.itervalues(updated)):
-            raise errors.PollError(waiting, updated)
+        if exhausted or any(authzr.body.status == messages.STATUS_INVALID
+                            for authzr in six.itervalues(updated)):
+            raise errors.PollError(exhausted, updated)
 
         updated_authzrs = tuple(updated[authzr] for authzr in authzrs)
         return self.request_issuance(csr, updated_authzrs), updated_authzrs

acme/acme/client_test.py

@@ -34,8 +34,10 @@ class ClientTest(unittest.TestCase):
         self.net.get.return_value = self.response
 
         self.directory = messages.Directory({
-            messages.NewRegistration: 'https://www.letsencrypt-demo.org/acme/new-reg',
-            messages.Revocation: 'https://www.letsencrypt-demo.org/acme/revoke-cert',
+            messages.NewRegistration:
+                'https://www.letsencrypt-demo.org/acme/new-reg',
+            messages.Revocation:
+                'https://www.letsencrypt-demo.org/acme/revoke-cert',
         })
 
         from acme.client import Client
@@ -317,7 +319,10 @@ class ClientTest(unittest.TestCase):
         )
 
         cert, updated_authzrs = self.client.poll_and_request_issuance(
-            csr, authzrs, mintime=mintime)
+            csr, authzrs, mintime=mintime,
+            # make sure that max_attempts is per-authorization, rather
+            # than global
+            max_attempts=max(len(authzrs[0].retries), len(authzrs[1].retries)))
         self.assertTrue(cert[0] is csr)
         self.assertTrue(cert[1] is updated_authzrs)
         self.assertEqual(updated_authzrs[0].uri, 'a...')
@@ -338,7 +343,8 @@ class ClientTest(unittest.TestCase):
         self.assertEqual(clock.dt, datetime.datetime(2015, 3, 27, 0, 1, 7))
 
         # CA sets invalid | TODO: move to a separate test
-        invalid_authzr = mock.MagicMock(times=[], retries=[messages.STATUS_INVALID])
+        invalid_authzr = mock.MagicMock(
+            times=[], retries=[messages.STATUS_INVALID])
         self.assertRaises(
             errors.PollError, self.client.poll_and_request_issuance,
             csr, authzrs=(invalid_authzr,), mintime=mintime)

acme/acme/errors.py

@@ -56,26 +56,25 @@ class MissingNonce(NonceError):
 class PollError(ClientError):
     """Generic error when polling for authorization fails.
 
-    This might be caused by either timeout (`waiting` will be non-empty)
+    This might be caused by either timeout (`exhausted` will be non-empty)
     or by some authorization being invalid.
 
-    :ivar waiting: Priority queue with `datetime.datatime` (based on
-        ``Retry-After``) as key, and original `.AuthorizationResource`
-        as value.
+    :ivar exhausted: Set of `.AuthorizationResource` that didn't finish
+        within max allowed attempts.
     :ivar updated: Mapping from original `.AuthorizationResource`
         to the most recently updated one
 
     """
-    def __init__(self, waiting, updated):
-        self.waiting = waiting
+    def __init__(self, exhausted, updated):
+        self.exhausted = exhausted
         self.updated = updated
         super(PollError, self).__init__()
 
     @property
     def timeout(self):
         """Was the error caused by timeout?"""
-        return bool(self.waiting)
+        return bool(self.exhausted)
 
     def __repr__(self):
-        return '{0}(waiting={1!r}, updated={2!r})'.format(
-            self.__class__.__name__, self.waiting, self.updated)
+        return '{0}(exhausted={1!r}, updated={2!r})'.format(
+            self.__class__.__name__, self.exhausted, self.updated)

acme/acme/errors_test.py

@@ -1,5 +1,4 @@
 """Tests for acme.errors."""
-import datetime
 import unittest
 
 import mock
@@ -36,9 +35,9 @@ class PollErrorTest(unittest.TestCase):
     def setUp(self):
         from acme.errors import PollError
         self.timeout = PollError(
-            waiting=[(datetime.datetime(2015, 11, 29), mock.sentinel.AR)],
+            exhausted=set([mock.sentinel.AR]),
             updated={})
-        self.invalid = PollError(waiting=[], updated={
+        self.invalid = PollError(exhausted=set(), updated={
             mock.sentinel.AR: mock.sentinel.AR2})
 
     def test_timeout(self):
@@ -46,8 +45,8 @@ class PollErrorTest(unittest.TestCase):
         self.assertFalse(self.invalid.timeout)
 
     def test_repr(self):
-        self.assertEqual('PollError(waiting=[], updated={sentinel.AR: '
-                         'sentinel.AR2})', repr(self.invalid))
+        self.assertEqual('PollError(exhausted=%s, updated={sentinel.AR: '
+                         'sentinel.AR2})' % repr(set()), repr(self.invalid))
 
 
 if __name__ == "__main__":

acme/acme/messages.py

@@ -130,8 +130,9 @@ class Directory(jose.JSONDeSerializable):
     @classmethod
     def register(cls, resource_body_cls):
         """Register resource."""
-        assert resource_body_cls.resource_type not in cls._REGISTERED_TYPES
-        cls._REGISTERED_TYPES[resource_body_cls.resource_type] = resource_body_cls
+        resource_type = resource_body_cls.resource_type
+        assert resource_type not in cls._REGISTERED_TYPES
+        cls._REGISTERED_TYPES[resource_type] = resource_body_cls
         return resource_body_cls
 
     def __init__(self, jobj):

acme/acme/standalone_test.py

@@ -32,11 +32,10 @@ class TLSSNI01ServerTest(unittest.TestCase):
     """Test for acme.standalone.TLSSNI01Server."""
 
     def setUp(self):
-        self.certs = {
-            b'localhost': (test_util.load_pyopenssl_private_key('rsa512_key.pem'),
-                           # pylint: disable=protected-access
-                           test_util.load_cert('cert.pem')),
-        }
+        self.certs = {b'localhost': (
+            test_util.load_pyopenssl_private_key('rsa512_key.pem'),
+            test_util.load_cert('cert.pem'),
+        )}
         from acme.standalone import TLSSNI01Server
         self.server = TLSSNI01Server(("", 0), certs=self.certs)
         # pylint: disable=no-member
@@ -49,7 +48,8 @@ class TLSSNI01ServerTest(unittest.TestCase):
 
     def test_it(self):
         host, port = self.server.socket.getsockname()[:2]
-        cert = crypto_util.probe_sni(b'localhost', host=host, port=port, timeout=1)
+        cert = crypto_util.probe_sni(
+            b'localhost', host=host, port=port, timeout=1)
         self.assertEqual(jose.ComparableX509(cert),
                          jose.ComparableX509(self.certs[b'localhost'][1]))
 
@@ -140,7 +140,8 @@ class TestSimpleTLSSNI01Server(unittest.TestCase):
         while max_attempts:
             max_attempts -= 1
             try:
-                cert = crypto_util.probe_sni(b'localhost', b'0.0.0.0', self.port)
+                cert = crypto_util.probe_sni(
+                    b'localhost', b'0.0.0.0', self.port)
             except errors.Error:
                 self.assertTrue(max_attempts > 0, "Timeout!")
                 time.sleep(1)  # wait until thread starts

acme/setup.cfg

@@ -0,0 +1,2 @@
+[bdist_wheel]
+universal = 1

acme/setup.py

@@ -4,13 +4,15 @@ from setuptools import setup
 from setuptools import find_packages
 
 
-version = '0.2.0.dev0'
+version = '0.4.0.dev0'
 
 # Please update tox.ini when modifying dependency version requirements
 install_requires = [
     # load_pem_private/public_key (>=0.6)
     # rsa_recover_prime_factors (>=0.8)
     'cryptography>=0.8',
+    'ndg-httpsclient',  # urllib3 InsecurePlatformWarning (#304)
+    'pyasn1',  # urllib3 InsecurePlatformWarning (#304)
     # Connection.set_tlsext_host_name (>=0.13)
     'PyOpenSSL>=0.13',
     'pyrfc3339',
@@ -22,6 +24,7 @@ install_requires = [
 ]
 
 # env markers in extras_require cause problems with older pip: #517
+# Keep in sync with conditional_requirements.py.
 if sys.version_info < (2, 7):
     install_requires.extend([
         # only some distros recognize stdlib argparse as already satisfying
@@ -31,11 +34,6 @@ if sys.version_info < (2, 7):
 else:
     install_requires.append('mock')
 
-if sys.version_info < (2, 7, 9):
-    # For secure SSL connection with Python 2.7 (InsecurePlatformWarning)
-    install_requires.append('ndg-httpsclient')
-    install_requires.append('pyasn1')
-
 docs_extras = [
     'Sphinx>=1.0',  # autodoc_member_order = 'bysource', autodoc_default_flags
     'sphinx_rtd_theme',

bootstrap/_rpm_common.sh

@@ -3,6 +3,7 @@
 # Tested with:
 #   - Fedora 22, 23 (x64)
 #   - Centos 7 (x64: on DigitalOcean droplet)
+#   - CentOS 7 Minimal install in a Hyper-V VM
 
 if type dnf 2>/dev/null
 then
@@ -21,12 +22,16 @@ fi
 if ! $tool install -y \
        python \
        python-devel \
-       python-virtualenv
+       python-virtualenv \
+       python-tools \
+       python-pip
 then
   if ! $tool install -y \
          python27 \
          python27-devel \
-         python27-virtualenv
+         python27-virtualenv \
+         python27-tools \
+         python27-pip
   then
     echo "Could not install Python dependencies. Aborting bootstrap!"
     exit 1

docs/ciphers.rst

@@ -170,7 +170,7 @@ Changing your settings
 
 This will probably look something like
 
-..code-block: shell
+.. code-block:: shell
 
   letsencrypt --cipher-recommendations mozilla-secure
   letsencrypt --cipher-recommendations mozilla-intermediate
@@ -179,14 +179,14 @@ This will probably look something like
 to track Mozilla's *Secure*, *Intermediate*, or *Old* recommendations,
 and
 
-..code-block: shell
+.. code-block:: shell
 
   letsencrypt --update-ciphers on
 
 to enable updating ciphers with each new Let's Encrypt client release,
 or
 
-..code-block: shell
+.. code-block:: shell
 
   letsencrypt --update-ciphers off
 

docs/contributing.rst

@@ -22,7 +22,7 @@ once:
 
    git clone https://github.com/letsencrypt/letsencrypt
    cd letsencrypt
-   ./bootstrap/install-deps.sh
+   ./letsencrypt-auto-source/letsencrypt-auto --os-packages-only
    ./bootstrap/dev/venv.sh
 
 Then in each shell where you're working on the client, do:
@@ -96,11 +96,32 @@ Integration testing with the boulder CA
 Generally it is sufficient to open a pull request and let Github and Travis run
 integration tests for you.
 
-Mac OS X users: Run `./tests/mac-bootstrap.sh` instead of `boulder-start.sh` to
-install dependencies, configure the environment, and start boulder.
+Mac OS X users: Run ``./tests/mac-bootstrap.sh`` instead of
+``boulder-start.sh`` to install dependencies, configure the
+environment, and start boulder.
 
-Otherwise, install `Go`_ 1.5, libtool-ltdl, mariadb-server and
-rabbitmq-server and then start Boulder_, an ACME CA server::
+Otherwise, install `Go`_ 1.5, ``libtool-ltdl``, ``mariadb-server`` and
+``rabbitmq-server`` and then start Boulder_, an ACME CA server.
+
+If you can't get packages of Go 1.5 for your Linux system,
+you can execute the following commands to install it:
+
+.. code-block:: shell
+
+  wget https://storage.googleapis.com/golang/go1.5.3.linux-amd64.tar.gz -P /tmp/
+  sudo tar -C /usr/local -xzf /tmp/go1.5.3.linux-amd64.tar.gz
+  if ! grep -Fxq "export GOROOT=/usr/local/go" ~/.profile ; then echo "export GOROOT=/usr/local/go" >> ~/.profile; fi
+  if ! grep -Fxq "export PATH=\\$GOROOT/bin:\\$PATH" ~/.profile ; then echo "export PATH=\\$GOROOT/bin:\\$PATH" >> ~/.profile; fi
+
+These commands download `Go`_ 1.5.3 to ``/tmp/``, extracts to ``/usr/local``,
+and then adds the export lines required to execute ``boulder-start.sh`` to
+``~/.profile`` if they were not previously added
+
+Make sure you execute the following command after `Go`_ finishes installing::
+
+  if ! grep -Fxq "export GOPATH=\\$HOME/go" ~/.profile ; then echo "export GOPATH=\\$HOME/go" >> ~/.profile; fi
+
+Afterwards, you'd be able to start Boulder_ using the following command::
 
   ./tests/boulder-start.sh
 
@@ -365,10 +386,13 @@ Now run tests inside the Docker image:
 Notes on OS dependencies
 ========================
 
-OS level dependencies are managed by scripts in ``bootstrap``.  Some notes
-are provided here mainly for the :ref:`developers <hacking>` reference.
+OS-level dependencies can be installed like so:
 
-In general:
+.. code-block:: shell
+
+    letsencrypt-auto-source/letsencrypt-auto --os-packages-only
+
+In general...
 
 * ``sudo`` is required as a suggested way of running privileged process
 * `Python`_ 2.6/2.7 is required
@@ -380,62 +404,19 @@ In general:
 .. _Augeas: http://augeas.net/
 .. _Virtualenv: https://virtualenv.pypa.io
 
-Ubuntu
-------
-
-.. code-block:: shell
-
-   sudo ./bootstrap/ubuntu.sh
-
 
 Debian
 ------
 
-.. code-block:: shell
-
-   sudo ./bootstrap/debian.sh
-
 For squeeze you will need to:
 
 - Use ``virtualenv --no-site-packages -p python`` instead of ``-p python2``.
 
 
-.. _`#280`: https://github.com/letsencrypt/letsencrypt/issues/280
-
-
-Mac OSX
--------
-
-.. code-block:: shell
-
-   ./bootstrap/mac.sh
-
-
-Fedora
-------
-
-.. code-block:: shell
-
-   sudo ./bootstrap/fedora.sh
-
-
-Centos 7
---------
-
-.. code-block:: shell
-
-   sudo ./bootstrap/centos.sh
-
-
 FreeBSD
 -------
 
-.. code-block:: shell
-
-   sudo ./bootstrap/freebsd.sh
-
-Bootstrap script for FreeBSD uses ``pkg`` for package installation,
-i.e. it does not use ports.
+Package installation for FreeBSD uses ``pkg``, not ports.
 
 FreeBSD by default uses ``tcsh``. In order to activate virtualenv (see
 below), you will need a compatible shell, e.g. ``pkg install bash &&

letsencrypt-apache/letsencrypt_apache/augeas_configurator.py

@@ -120,7 +120,8 @@ class AugeasConfigurator(common.Plugin):
                     self.reverter.add_to_temp_checkpoint(
                         save_files, self.save_notes)
                 else:
-                    self.reverter.add_to_checkpoint(save_files, self.save_notes)
+                    self.reverter.add_to_checkpoint(save_files,
+                                                    self.save_notes)
             except errors.ReverterError as err:
                 raise errors.PluginError(str(err))
 

letsencrypt-apache/letsencrypt_apache/augeas_lens/httpd.aug

@@ -106,11 +106,17 @@ let section (body:lens) =
     let inner = (sep_spc . argv arg_sec)? . sep_osp .
              dels ">" . opt_eol . ((body|comment) . (body|empty|comment)*)? .
              indent . dels "</" in
-    let kword = key word in
-    let dword = del word "a" in
+    let kword = key (word - /perl/i) in
+    let dword = del (word - /perl/i) "a" in
         [ indent . dels "<" . square kword inner dword . del />[ \t\n\r]*/ ">\n" ]
 
+let perl_section = [ indent . label "Perl" . del /<perl>/i "<Perl>"
+                   . store /[^<]*/
+                   . del /<\/perl>/i "</Perl>" . eol ]
+
+
 let rec content = section (content|directive)
+                | perl_section
 
 let lns = (content|directive|comment|empty)*
 
@@ -121,6 +127,7 @@ let filter = (incl "/etc/apache2/apache2.conf") .
              (incl "/etc/apache2/conf-available/*.conf") .
              (incl "/etc/apache2/mods-available/*") .
              (incl "/etc/apache2/sites-available/*") .
+             (incl "/etc/apache2/vhosts.d/*.conf") .
              (incl "/etc/httpd/conf.d/*.conf") .
              (incl "/etc/httpd/httpd.conf") .
              (incl "/etc/httpd/conf/httpd.conf") .

letsencrypt-apache/letsencrypt_apache/configurator.py

@@ -133,7 +133,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
     @property
     def mod_ssl_conf(self):
         """Full absolute path to SSL configuration file."""
-        return os.path.join(self.config.config_dir, constants.MOD_SSL_CONF_DEST)
+        return os.path.join(self.config.config_dir,
+                            constants.MOD_SSL_CONF_DEST)
 
     def prepare(self):
         """Prepare the authenticator/installer.
@@ -154,10 +155,16 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
         # Set Version
         if self.version is None:
             self.version = self.get_version()
-        if self.version < (2, 2):
+        if self.version < (2, 4):
             raise errors.NotSupportedError(
                 "Apache Version %s not supported.", str(self.version))
 
+        if not self._check_aug_version():
+            raise errors.NotSupportedError(
+                "Apache plugin support requires libaugeas0 and augeas-lenses "
+                "version 1.2.0 or higher, please make sure you have you have "
+                "those installed.")
+
         self.parser = parser.ApacheParser(
             self.aug, self.conf("server-root"), self.conf("vhost-root"),
             self.version)
@@ -169,16 +176,31 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
 
         install_ssl_options_conf(self.mod_ssl_conf)
 
+    def _check_aug_version(self):
+        """ Checks that we have recent enough version of libaugeas.
+        If augeas version is recent enough, it will support case insensitive
+        regexp matching"""
+
+        self.aug.set("/test/path/testing/arg", "aRgUMeNT")
+        try:
+            matches = self.aug.match(
+                "/test//*[self::arg=~regexp('argument', 'i')]")
+        except RuntimeError:
+            self.aug.remove("/test/path")
+            return False
+        self.aug.remove("/test/path")
+        return matches
+
     def deploy_cert(self, domain, cert_path, key_path,
-                    chain_path=None, fullchain_path=None):  # pylint: disable=unused-argument
+                    chain_path=None, fullchain_path=None):
         """Deploys certificate to specified virtual host.
 
         Currently tries to find the last directives to deploy the cert in
         the VHost associated with the given domain. If it can't find the
-        directives, it searches the "included" confs. The function verifies that
-        it has located the three directives and finally modifies them to point
-        to the correct destination. After the certificate is installed, the
-        VirtualHost is enabled if it isn't already.
+        directives, it searches the "included" confs. The function verifies
+        that it has located the three directives and finally modifies them
+        to point to the correct destination. After the certificate is
+        installed, the VirtualHost is enabled if it isn't already.
 
         .. todo:: Might be nice to remove chain directive if none exists
                   This shouldn't happen within letsencrypt though
@@ -194,8 +216,10 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
         # cert_key... can all be parsed appropriately
         self.prepare_server_https("443")
 
-        path = {"cert_path": self.parser.find_dir("SSLCertificateFile", None, vhost.path),
-                "cert_key": self.parser.find_dir("SSLCertificateKeyFile", None, vhost.path)}
+        path = {"cert_path": self.parser.find_dir("SSLCertificateFile",
+                                                  None, vhost.path),
+                "cert_key": self.parser.find_dir("SSLCertificateKeyFile",
+                                                 None, vhost.path)}
 
         # Only include if a certificate chain is specified
         if chain_path is not None:
@@ -225,7 +249,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
                 self.parser.add_dir(vhost.path,
                                     "SSLCertificateChainFile", chain_path)
             else:
-                raise errors.PluginError("--chain-path is required for your version of Apache")
+                raise errors.PluginError("--chain-path is required for your "
+                                         "version of Apache")
         else:
             if not fullchain_path:
                 raise errors.PluginError("Please provide the --fullchain-path\
@@ -299,7 +324,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
         elif not vhost.ssl:
             addrs = self._get_proposed_addrs(vhost, "443")
             # TODO: Conflicts is too conservative
-            if not any(vhost.enabled and vhost.conflicts(addrs) for vhost in self.vhosts):
+            if not any(vhost.enabled and vhost.conflicts(addrs) for
+                       vhost in self.vhosts):
                 vhost = self.make_vhost_ssl(vhost)
             else:
                 logger.error(
@@ -567,15 +593,16 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
         self.prepare_https_modules(temp)
         # Check for Listen <port>
         # Note: This could be made to also look for ip:443 combo
-        listens = [self.parser.get_arg(x).split()[0] for x in self.parser.find_dir("Listen")]
+        listens = [self.parser.get_arg(x).split()[0] for
+                   x in self.parser.find_dir("Listen")]
         # In case no Listens are set (which really is a broken apache config)
         if not listens:
             listens = ["80"]
         if port in listens:
             return
         for listen in listens:
-            # For any listen statement, check if the machine also listens on Port 443.
-            # If not, add such a listen statement.
+            # For any listen statement, check if the machine also listens on
+            # Port 443. If not, add such a listen statement.
             if len(listen.split(":")) == 1:
                 # Its listening to all interfaces
                 if port not in listens:
@@ -603,8 +630,9 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
                     self.parser.add_dir_to_ifmodssl(
                         parser.get_aug_path(
                             self.parser.loc["listen"]), "Listen", args)
-                    self.save_notes += "Added Listen %s:%s directive to %s\n" % (
-                                       ip, port, self.parser.loc["listen"])
+                    self.save_notes += ("Added Listen %s:%s directive to "
+                                        "%s\n") % (ip, port,
+                                                   self.parser.loc["listen"])
                     listens.append("%s:%s" % (ip, port))
 
     def prepare_https_modules(self, temp):
@@ -803,20 +831,25 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
     def _clean_vhost(self, vhost):
         # remove duplicated or conflicting ssl directives
         self._deduplicate_directives(vhost.path,
-            ["SSLCertificateFile", "SSLCertificateKeyFile"])
+                                     ["SSLCertificateFile",
+                                      "SSLCertificateKeyFile"])
         # remove all problematic directives
         self._remove_directives(vhost.path, ["SSLCertificateChainFile"])
 
     def _deduplicate_directives(self, vh_path, directives):
         for directive in directives:
-            while len(self.parser.find_dir(directive, None, vh_path, False)) > 1:
-                directive_path = self.parser.find_dir(directive, None, vh_path, False)
+            while len(self.parser.find_dir(directive, None,
+                                           vh_path, False)) > 1:
+                directive_path = self.parser.find_dir(directive, None,
+                                                      vh_path, False)
                 self.aug.remove(re.sub(r"/\w*$", "", directive_path[0]))
 
     def _remove_directives(self, vh_path, directives):
         for directive in directives:
-            while len(self.parser.find_dir(directive, None, vh_path, False)) > 0:
-                directive_path = self.parser.find_dir(directive, None, vh_path, False)
+            while len(self.parser.find_dir(directive, None,
+                                           vh_path, False)) > 0:
+                directive_path = self.parser.find_dir(directive, None,
+                                                      vh_path, False)
                 self.aug.remove(re.sub(r"/\w*$", "", directive_path[0]))
 
     def _add_dummy_ssl_directives(self, vh_path):
@@ -843,7 +876,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
         for addr in vhost.addrs:
             for test_vh in self.vhosts:
                 if (vhost.filep != test_vh.filep and
-                        any(test_addr == addr for test_addr in test_vh.addrs) and
+                        any(test_addr == addr for
+                            test_addr in test_vh.addrs) and
                         not self.is_name_vhost(addr)):
                     self.add_name_vhost(addr)
                     logger.info("Enabling NameVirtualHosts on %s", addr)
@@ -852,9 +886,9 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
         if need_to_save:
             self.save()
 
-    ############################################################################
+    ######################################################################
     # Enhancements
-    ############################################################################
+    ######################################################################
     def supported_enhancements(self):  # pylint: disable=no-self-use
         """Returns currently supported enhancements."""
         return ["redirect", "ensure-http-header"]
@@ -915,14 +949,14 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
 
         # Add directives to server
         self.parser.add_dir(ssl_vhost.path, "Header",
-                constants.HEADER_ARGS[header_substring])
+                            constants.HEADER_ARGS[header_substring])
 
         self.save_notes += ("Adding %s header to ssl vhost in %s\n" %
-                (header_substring, ssl_vhost.filep))
+                            (header_substring, ssl_vhost.filep))
 
         self.save()
         logger.info("Adding %s header to ssl vhost in %s", header_substring,
-                ssl_vhost.filep)
+                    ssl_vhost.filep)
 
     def _verify_no_matching_http_header(self, ssl_vhost, header_substring):
         """Checks to see if an there is an existing Header directive that
@@ -942,14 +976,15 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
                 header_substring exists
 
         """
-        header_path = self.parser.find_dir("Header", None, start=ssl_vhost.path)
+        header_path = self.parser.find_dir("Header", None,
+                                           start=ssl_vhost.path)
         if header_path:
             # "Existing Header directive for virtualhost"
             pat = '(?:[ "]|^)(%s)(?:[ "]|$)' % (header_substring.lower())
             for match in header_path:
                 if re.search(pat, self.aug.get(match).lower()):
                     raise errors.PluginEnhancementAlreadyPresent(
-                            "Existing %s header" % (header_substring))
+                        "Existing %s header" % (header_substring))
 
     def _enable_redirect(self, ssl_vhost, unused_options):
         """Redirect all equivalent HTTP traffic to ssl_vhost.
@@ -998,7 +1033,6 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
             # Check if LetsEncrypt redirection already exists
             self._verify_no_letsencrypt_redirect(general_vh)
 
-
             # Note: if code flow gets here it means we didn't find the exact
             # letsencrypt RewriteRule config for redirection. Finding
             # another RewriteRule is likely to be fine in most or all cases,
@@ -1017,10 +1051,10 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
 
             if self.get_version() >= (2, 3, 9):
                 self.parser.add_dir(general_vh.path, "RewriteRule",
-                                constants.REWRITE_HTTPS_ARGS_WITH_END)
+                                    constants.REWRITE_HTTPS_ARGS_WITH_END)
             else:
                 self.parser.add_dir(general_vh.path, "RewriteRule",
-                                constants.REWRITE_HTTPS_ARGS)
+                                    constants.REWRITE_HTTPS_ARGS)
 
             self.save_notes += ("Redirecting host in %s to ssl vhost in %s\n" %
                                 (general_vh.filep, ssl_vhost.filep))
@@ -1042,7 +1076,7 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
                 letsencrypt redirection WriteRule exists in virtual host.
         """
         rewrite_path = self.parser.find_dir(
-                "RewriteRule", None, start=vhost.path)
+            "RewriteRule", None, start=vhost.path)
 
         # There can be other RewriteRule directive lines in vhost config.
         # rewrite_args_dict keys are directive ids and the corresponding value
@@ -1057,12 +1091,12 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
 
         if rewrite_args_dict:
             redirect_args = [constants.REWRITE_HTTPS_ARGS,
-                constants.REWRITE_HTTPS_ARGS_WITH_END]
+                             constants.REWRITE_HTTPS_ARGS_WITH_END]
 
             for matches in rewrite_args_dict.values():
                 if [self.aug.get(x) for x in matches] in redirect_args:
                     raise errors.PluginEnhancementAlreadyPresent(
-                    "Let's Encrypt has already enabled redirection")
+                        "Let's Encrypt has already enabled redirection")
 
     def _is_rewrite_exists(self, vhost):
         """Checks if there exists a RewriteRule directive in vhost
@@ -1075,7 +1109,7 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
 
         """
         rewrite_path = self.parser.find_dir(
-                "RewriteRule", None, start=vhost.path)
+            "RewriteRule", None, start=vhost.path)
         return bool(rewrite_path)
 
     def _is_rewrite_engine_on(self, vhost):
@@ -1086,7 +1120,7 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
 
         """
         rewrite_engine_path = self.parser.find_dir("RewriteEngine", "on",
-                start=vhost.path)
+                                                   start=vhost.path)
         if rewrite_engine_path:
             return self.parser.get_arg(rewrite_engine_path[0])
         return False
@@ -1132,7 +1166,6 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
         else:
             rewrite_rule_args = constants.REWRITE_HTTPS_ARGS
 
-
         return ("<VirtualHost %s>\n"
                 "%s \n"
                 "%s \n"
@@ -1144,7 +1177,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
                 "ErrorLog /var/log/apache2/redirect.error.log\n"
                 "LogLevel warn\n"
                 "</VirtualHost>\n"
-                % (" ".join(str(addr) for addr in self._get_proposed_addrs(ssl_vhost)),
+                % (" ".join(str(addr) for
+                            addr in self._get_proposed_addrs(ssl_vhost)),
                    servername, serveralias,
                    " ".join(rewrite_rule_args)))
 
@@ -1158,7 +1192,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
             if len(ssl_vhost.name) < (255 - (len(redirect_filename) + 1)):
                 redirect_filename = "le-redirect-%s.conf" % ssl_vhost.name
 
-        redirect_filepath = os.path.join(self.conf("vhost-root"), redirect_filename)
+        redirect_filepath = os.path.join(self.conf("vhost-root"),
+                                         redirect_filename)
 
         # Register the new file that will be created
         # Note: always register the creation before writing to ensure file will
@@ -1186,7 +1221,7 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
 
         return None
 
-    def _get_proposed_addrs(self, vhost, port="80"):  # pylint: disable=no-self-use
+    def _get_proposed_addrs(self, vhost, port="80"):
         """Return all addrs of vhost with the port replaced with the specified.
 
         :param obj.VirtualHost ssl_vhost: Original Vhost
@@ -1266,7 +1301,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
         .. note:: Does not make sure that the site correctly works or that all
                   modules are enabled appropriately.
 
-        .. todo:: This function should number subdomains before the domain vhost
+        .. todo:: This function should number subdomains before the domain
+                  vhost
 
         .. todo:: Make sure link is not broken...
 

letsencrypt-apache/letsencrypt_apache/constants.py

@@ -73,7 +73,8 @@ AUGEAS_LENS_DIR = pkg_resources.resource_filename(
 
 REWRITE_HTTPS_ARGS = [
     "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[L,QSA,R=permanent]"]
-"""Apache version<2.3.9 rewrite rule arguments used for redirections to https vhost"""
+"""Apache version<2.3.9 rewrite rule arguments used for redirections to
+https vhost"""
 
 REWRITE_HTTPS_ARGS_WITH_END = [
     "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[END,QSA,R=permanent]"]
@@ -81,14 +82,14 @@ REWRITE_HTTPS_ARGS_WITH_END = [
     https vhost"""
 
 HSTS_ARGS = ["always", "set", "Strict-Transport-Security",
-    "\"max-age=31536000\""]
+             "\"max-age=31536000\""]
 """Apache header arguments for HSTS"""
 
 UIR_ARGS = ["always", "set", "Content-Security-Policy",
-    "upgrade-insecure-requests"]
+            "upgrade-insecure-requests"]
 
 HEADER_ARGS = {"Strict-Transport-Security": HSTS_ARGS,
-        "Upgrade-Insecure-Requests": UIR_ARGS}
+               "Upgrade-Insecure-Requests": UIR_ARGS}
 
 
 def os_constant(key):

letsencrypt-apache/letsencrypt_apache/display_ops.py

@@ -4,6 +4,7 @@ import os
 
 import zope.component
 
+from letsencrypt import errors
 from letsencrypt import interfaces
 
 import letsencrypt.display.util as display_util
@@ -78,11 +79,18 @@ def _vhost_menu(domain, vhosts):
                 name_size=disp_name_size)
         )
 
-    code, tag = zope.component.getUtility(interfaces.IDisplay).menu(
-        "We were unable to find a vhost with a ServerName or Address of {0}.{1}"
-        "Which virtual host would you like to choose?".format(
-            domain, os.linesep),
-        choices, help_label="More Info", ok_label="Select")
+    try:
+        code, tag = zope.component.getUtility(interfaces.IDisplay).menu(
+            "We were unable to find a vhost with a ServerName "
+            "or Address of {0}.{1}Which virtual host would you "
+            "like to choose?".format(domain, os.linesep),
+            choices, help_label="More Info", ok_label="Select")
+    except errors.MissingCommandlineFlag, e:
+        msg = ("Failed to run Apache plugin non-interactively{1}{0}{1}"
+               "(The best solution is to add ServerName or ServerAlias "
+               "entries to the VirtualHost directives of your apache "
+               "configuration files.)".format(e, os.linesep))
+        raise errors.MissingCommandlineFlag, msg
 
     return code, tag
 

letsencrypt-apache/letsencrypt_apache/parser.py

@@ -96,11 +96,12 @@ class ApacheParser(object):
     def update_runtime_variables(self):
         """"
 
-        .. note:: Compile time variables (apache2ctl -V) are not used within the
-            dynamic configuration files.  These should not be parsed or
+        .. note:: Compile time variables (apache2ctl -V) are not used within
+            the dynamic configuration files.  These should not be parsed or
             interpreted.
 
-        .. todo:: Create separate compile time variables... simply for arg_get()
+        .. todo:: Create separate compile time variables...
+            simply for arg_get()
 
         """
         stdout = self._get_runtime_cfg()
@@ -177,7 +178,8 @@ class ApacheParser(object):
                     # Make sure we don't cause an IndexError (end of list)
                     # Check to make sure arg + 1 doesn't exist
                     if (i == (len(matches) - 1) or
-                            not matches[i + 1].endswith("/arg[%d]" % (args + 1))):
+                            not matches[i + 1].endswith("/arg[%d]" %
+                                                        (args + 1))):
                         filtered.append(matches[i][:-len("/arg[%d]" % args)])
 
         return filtered
@@ -311,8 +313,6 @@ class ApacheParser(object):
         for match in matches:
             dir_ = self.aug.get(match).lower()
             if dir_ == "include" or dir_ == "includeoptional":
-                # start[6:] to strip off /files
-                #print self._get_include_path(self.get_arg(match +"/arg")), directive, arg
                 ordered_matches.extend(self.find_dir(
                     directive, arg,
                     self._get_include_path(self.get_arg(match + "/arg")),
@@ -331,8 +331,8 @@ class ApacheParser(object):
         """
         value = self.aug.get(match)
 
-        # No need to strip quotes for variables, as apache2ctl already does this
-        # but we do need to strip quotes for all normal arguments.
+        # No need to strip quotes for variables, as apache2ctl already does
+        # this, but we do need to strip quotes for all normal arguments.
 
         # Note: normal argument may be a quoted variable
         # e.g. strip now, not later
@@ -454,7 +454,7 @@ class ApacheParser(object):
         https://apr.apache.org/docs/apr/2.0/apr__fnmatch_8h_source.html
         http://apache2.sourcearchive.com/documentation/2.2.16-6/apr__fnmatch_8h_source.html
 
-        :param str clean_fn_match: Apache style filename match, similar to globs
+        :param str clean_fn_match: Apache style filename match, like globs
 
         :returns: regex suitable for augeas
         :rtype: str

letsencrypt-apache/letsencrypt_apache/tests/complex_parsing_test.py

@@ -96,7 +96,8 @@ class ComplexParserTest(util.ParserTest):
         else:
             self.assertFalse(self.parser.find_dir("FNMATCH_DIRECTIVE"))
 
-    # NOTE: Only run one test per function otherwise you will have inf recursion
+    # NOTE: Only run one test per function otherwise you will have
+    # inf recursion
     def test_include(self):
         self.verify_fnmatch("test_fnmatch.?onf")
 
@@ -104,7 +105,8 @@ class ComplexParserTest(util.ParserTest):
         self.verify_fnmatch("../complex_parsing/[te][te]st_*.?onf")
 
     def test_include_fullpath(self):
-        self.verify_fnmatch(os.path.join(self.config_path, "test_fnmatch.conf"))
+        self.verify_fnmatch(os.path.join(self.config_path,
+                                         "test_fnmatch.conf"))
 
     def test_include_fullpath_trailing_slash(self):
         self.verify_fnmatch(self.config_path + "//")

letsencrypt-apache/letsencrypt_apache/tests/configurator_test.py

@@ -35,10 +35,10 @@ class TwoVhost80Test(util.ApacheTest):
     def mock_deploy_cert(self, config):
         """A test for a mock deploy cert"""
         self.config.real_deploy_cert = self.config.deploy_cert
+
         def mocked_deploy_cert(*args, **kwargs):
             """a helper to mock a deployed cert"""
-            with mock.patch(
-                 "letsencrypt_apache.configurator.ApacheConfigurator.enable_mod"):
+            with mock.patch("letsencrypt_apache.configurator.ApacheConfigurator.enable_mod"):
                 config.real_deploy_cert(*args, **kwargs)
         self.config.deploy_cert = mocked_deploy_cert
         return self.config
@@ -65,6 +65,16 @@ class TwoVhost80Test(util.ApacheTest):
         self.assertRaises(
             errors.NotSupportedError, self.config.prepare)
 
+    @mock.patch("letsencrypt_apache.parser.ApacheParser")
+    @mock.patch("letsencrypt_apache.configurator.le_util.exe_exists")
+    def test_prepare_old_aug(self, mock_exe_exists, _):
+        mock_exe_exists.return_value = True
+        self.config.config_test = mock.Mock()
+        # pylint: disable=protected-access
+        self.config._check_aug_version = mock.Mock(return_value=False)
+        self.assertRaises(
+            errors.NotSupportedError, self.config.prepare)
+
     def test_add_parser_arguments(self):  # pylint: disable=no-self-use
         from letsencrypt_apache.configurator import ApacheConfigurator
         # Weak test..
@@ -101,8 +111,8 @@ class TwoVhost80Test(util.ApacheTest):
     def test_add_servernames_alias(self):
         self.config.parser.add_dir(
             self.vh_truth[2].path, "ServerAlias", ["*.le.co"])
-        self.config._add_servernames(self.vh_truth[2])  # pylint: disable=protected-access
-
+        # pylint: disable=protected-access
+        self.config._add_servernames(self.vh_truth[2])
         self.assertEqual(
             self.vh_truth[2].get_names(), set(["*.le.co", "ip-172-30-0-17"]))
 
@@ -168,7 +178,8 @@ class TwoVhost80Test(util.ApacheTest):
     def test_choose_vhost_select_vhost_conflicting_non_ssl(self, mock_select):
         mock_select.return_value = self.vh_truth[3]
         conflicting_vhost = obj.VirtualHost(
-            "path", "aug_path", set([obj.Addr.fromstring("*:443")]), True, True)
+            "path", "aug_path", set([obj.Addr.fromstring("*:443")]),
+            True, True)
         self.config.vhosts.append(conflicting_vhost)
 
         self.assertRaises(
@@ -187,7 +198,8 @@ class TwoVhost80Test(util.ApacheTest):
     def test_find_best_vhost_variety(self):
         # pylint: disable=protected-access
         ssl_vh = obj.VirtualHost(
-            "fp", "ap", set([obj.Addr(("*", "443")), obj.Addr(("zombo.com",))]),
+            "fp", "ap", set([obj.Addr(("*", "443")),
+                             obj.Addr(("zombo.com",))]),
             True, False)
         self.config.vhosts.append(ssl_vh)
         self.assertEqual(self.config._find_best_vhost("zombo.com"), ssl_vh)
@@ -268,7 +280,8 @@ class TwoVhost80Test(util.ApacheTest):
 
     def test_deploy_cert_newssl(self):
         self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir, version=(2, 4, 16))
+            self.config_path, self.vhost_path, self.config_dir,
+            self.work_dir, version=(2, 4, 16))
 
         self.config.parser.modules.add("ssl_module")
         self.config.parser.modules.add("mod_ssl.c")
@@ -286,7 +299,8 @@ class TwoVhost80Test(util.ApacheTest):
         self.assertTrue("ssl_module" in self.config.parser.modules)
 
         loc_cert = self.config.parser.find_dir(
-            "sslcertificatefile", "example/fullchain.pem", self.vh_truth[1].path)
+            "sslcertificatefile", "example/fullchain.pem",
+            self.vh_truth[1].path)
         loc_key = self.config.parser.find_dir(
             "sslcertificateKeyfile", "example/key.pem", self.vh_truth[1].path)
 
@@ -301,7 +315,8 @@ class TwoVhost80Test(util.ApacheTest):
 
     def test_deploy_cert_newssl_no_fullchain(self):
         self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir, version=(2, 4, 16))
+            self.config_path, self.vhost_path, self.config_dir,
+            self.work_dir, version=(2, 4, 16))
         self.config = self.mock_deploy_cert(self.config)
 
         self.config.parser.modules.add("ssl_module")
@@ -311,11 +326,13 @@ class TwoVhost80Test(util.ApacheTest):
         self.config.assoc["random.demo"] = self.vh_truth[1]
         self.assertRaises(errors.PluginError,
                           lambda: self.config.deploy_cert(
-                              "random.demo", "example/cert.pem", "example/key.pem"))
+                              "random.demo", "example/cert.pem",
+                              "example/key.pem"))
 
     def test_deploy_cert_old_apache_no_chain(self):
         self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir, version=(2, 4, 7))
+            self.config_path, self.vhost_path, self.config_dir,
+            self.work_dir, version=(2, 4, 7))
         self.config = self.mock_deploy_cert(self.config)
 
         self.config.parser.modules.add("ssl_module")
@@ -325,7 +342,8 @@ class TwoVhost80Test(util.ApacheTest):
         self.config.assoc["random.demo"] = self.vh_truth[1]
         self.assertRaises(errors.PluginError,
                           lambda: self.config.deploy_cert(
-                              "random.demo", "example/cert.pem", "example/key.pem"))
+                              "random.demo", "example/cert.pem",
+                              "example/key.pem"))
 
     def test_deploy_cert(self):
         self.config.parser.modules.add("ssl_module")
@@ -433,7 +451,8 @@ class TwoVhost80Test(util.ApacheTest):
 
         # Test Listen statements with specific ip listeed
         self.config.prepare_server_https("443")
-        # Should only be 2 here, as the third interface already listens to the correct port
+        # Should only be 2 here, as the third interface
+        # already listens to the correct port
         self.assertEqual(mock_add_dir.call_count, 2)
 
         # Check argument to new Listen statements
@@ -447,9 +466,12 @@ class TwoVhost80Test(util.ApacheTest):
         # Test
         self.config.prepare_server_https("8080", temp=True)
         self.assertEqual(mock_add_dir.call_count, 3)
-        self.assertEqual(mock_add_dir.call_args_list[0][0][2], ["1.2.3.4:8080", "https"])
-        self.assertEqual(mock_add_dir.call_args_list[1][0][2], ["[::1]:8080", "https"])
-        self.assertEqual(mock_add_dir.call_args_list[2][0][2], ["1.1.1.1:8080", "https"])
+        self.assertEqual(mock_add_dir.call_args_list[0][0][2],
+                         ["1.2.3.4:8080", "https"])
+        self.assertEqual(mock_add_dir.call_args_list[1][0][2],
+                         ["[::1]:8080", "https"])
+        self.assertEqual(mock_add_dir.call_args_list[2][0][2],
+                         ["1.1.1.1:8080", "https"])
 
     def test_prepare_server_https_mixed_listen(self):
 
@@ -467,7 +489,8 @@ class TwoVhost80Test(util.ApacheTest):
 
         # Test Listen statements with specific ip listeed
         self.config.prepare_server_https("443")
-        # Should only be 2 here, as the third interface already listens to the correct port
+        # Should only be 2 here, as the third interface
+        # already listens to the correct port
         self.assertEqual(mock_add_dir.call_count, 0)
 
     def test_make_vhost_ssl(self):
@@ -501,7 +524,8 @@ class TwoVhost80Test(util.ApacheTest):
         for directive in ["SSLCertificateFile", "SSLCertificateKeyFile",
                           "SSLCertificateChainFile", "SSLCACertificatePath"]:
             for _ in range(10):
-                self.config.parser.add_dir(self.vh_truth[1].path, directive, ["bogus"])
+                self.config.parser.add_dir(self.vh_truth[1].path,
+                                           directive, ["bogus"])
         self.config.save()
 
         self.config._clean_vhost(self.vh_truth[1])
@@ -527,23 +551,24 @@ class TwoVhost80Test(util.ApacheTest):
         # pylint: disable=protected-access
         DIRECTIVE = "Foo"
         for _ in range(10):
-            self.config.parser.add_dir(self.vh_truth[1].path, DIRECTIVE, ["bar"])
+            self.config.parser.add_dir(self.vh_truth[1].path,
+                                       DIRECTIVE, ["bar"])
         self.config.save()
 
         self.config._deduplicate_directives(self.vh_truth[1].path, [DIRECTIVE])
         self.config.save()
 
         self.assertEqual(
-                         len(self.config.parser.find_dir(
-                             DIRECTIVE, None, self.vh_truth[1].path, False)),
-                         1)
+            len(self.config.parser.find_dir(
+                DIRECTIVE, None, self.vh_truth[1].path, False)), 1)
 
     def test_remove_directives(self):
         # pylint: disable=protected-access
         DIRECTIVES = ["Foo", "Bar"]
         for directive in DIRECTIVES:
             for _ in range(10):
-                self.config.parser.add_dir(self.vh_truth[1].path, directive, ["baz"])
+                self.config.parser.add_dir(self.vh_truth[1].path,
+                                           directive, ["baz"])
         self.config.save()
 
         self.config._remove_directives(self.vh_truth[1].path, DIRECTIVES)
@@ -551,9 +576,8 @@ class TwoVhost80Test(util.ApacheTest):
 
         for directive in DIRECTIVES:
             self.assertEqual(
-                             len(self.config.parser.find_dir(
-                                 directive, None, self.vh_truth[1].path, False)),
-                             0)
+                len(self.config.parser.find_dir(
+                    directive, None, self.vh_truth[1].path, False)), 0)
 
     def test_make_vhost_ssl_extra_vhs(self):
         self.config.aug.match = mock.Mock(return_value=["p1", "p2"])
@@ -642,7 +666,8 @@ class TwoVhost80Test(util.ApacheTest):
         self.assertRaises(errors.PluginError, self.config.get_version)
 
         mock_script.return_value = (
-            "Server Version: Apache/2.3{0} Apache/2.4.7".format(os.linesep), "")
+            "Server Version: Apache/2.3{0} Apache/2.4.7".format(
+                os.linesep), "")
         self.assertRaises(errors.PluginError, self.config.get_version)
 
         mock_script.side_effect = errors.SubprocessError("Can't find program")
@@ -666,7 +691,8 @@ class TwoVhost80Test(util.ApacheTest):
     def test_config_test_bad_process(self, mock_run_script):
         mock_run_script.side_effect = errors.SubprocessError
 
-        self.assertRaises(errors.MisconfigurationError, self.config.config_test)
+        self.assertRaises(errors.MisconfigurationError,
+                          self.config.config_test)
 
     def test_get_all_certs_keys(self):
         c_k = self.config.get_all_certs_keys()
@@ -678,7 +704,8 @@ class TwoVhost80Test(util.ApacheTest):
         self.assertTrue("default-ssl" in path)
 
     def test_get_all_certs_keys_malformed_conf(self):
-        self.config.parser.find_dir = mock.Mock(side_effect=[["path"], [], ["path"], []])
+        self.config.parser.find_dir = mock.Mock(
+            side_effect=[["path"], [], ["path"], []])
         c_k = self.config.get_all_certs_keys()
 
         self.assertFalse(c_k)
@@ -699,13 +726,13 @@ class TwoVhost80Test(util.ApacheTest):
     def test_supported_enhancements(self):
         self.assertTrue(isinstance(self.config.supported_enhancements(), list))
 
-
     @mock.patch("letsencrypt.le_util.exe_exists")
     def test_enhance_unknown_vhost(self, mock_exe):
         self.config.parser.modules.add("rewrite_module")
         mock_exe.return_value = True
         ssl_vh = obj.VirtualHost(
-            "fp", "ap", set([obj.Addr(("*", "443")), obj.Addr(("satoshi.com",))]),
+            "fp", "ap", set([obj.Addr(("*", "443")),
+                             obj.Addr(("satoshi.com",))]),
             True, False)
         self.config.vhosts.append(ssl_vh)
         self.assertRaises(
@@ -726,7 +753,7 @@ class TwoVhost80Test(util.ApacheTest):
 
         # This will create an ssl vhost for letsencrypt.demo
         self.config.enhance("letsencrypt.demo", "ensure-http-header",
-                "Strict-Transport-Security")
+                            "Strict-Transport-Security")
 
         self.assertTrue("headers_module" in self.config.parser.modules)
 
@@ -736,7 +763,7 @@ class TwoVhost80Test(util.ApacheTest):
         # These are not immediately available in find_dir even with save() and
         # load(). They must be found in sites-available
         hsts_header = self.config.parser.find_dir(
-                "Header", None, ssl_vhost.path)
+            "Header", None, ssl_vhost.path)
 
         # four args to HSTS header
         self.assertEqual(len(hsts_header), 4)
@@ -748,12 +775,12 @@ class TwoVhost80Test(util.ApacheTest):
 
         # This will create an ssl vhost for letsencrypt.demo
         self.config.enhance("encryption-example.demo", "ensure-http-header",
-                "Strict-Transport-Security")
+                            "Strict-Transport-Security")
 
         self.assertRaises(
             errors.PluginEnhancementAlreadyPresent,
-            self.config.enhance, "encryption-example.demo", "ensure-http-header",
-            "Strict-Transport-Security")
+            self.config.enhance, "encryption-example.demo",
+            "ensure-http-header", "Strict-Transport-Security")
 
     @mock.patch("letsencrypt.le_util.run_script")
     @mock.patch("letsencrypt.le_util.exe_exists")
@@ -764,7 +791,7 @@ class TwoVhost80Test(util.ApacheTest):
 
         # This will create an ssl vhost for letsencrypt.demo
         self.config.enhance("letsencrypt.demo", "ensure-http-header",
-                "Upgrade-Insecure-Requests")
+                            "Upgrade-Insecure-Requests")
 
         self.assertTrue("headers_module" in self.config.parser.modules)
 
@@ -774,7 +801,7 @@ class TwoVhost80Test(util.ApacheTest):
         # These are not immediately available in find_dir even with save() and
         # load(). They must be found in sites-available
         uir_header = self.config.parser.find_dir(
-                "Header", None, ssl_vhost.path)
+            "Header", None, ssl_vhost.path)
 
         # four args to HSTS header
         self.assertEqual(len(uir_header), 4)
@@ -786,14 +813,12 @@ class TwoVhost80Test(util.ApacheTest):
 
         # This will create an ssl vhost for letsencrypt.demo
         self.config.enhance("encryption-example.demo", "ensure-http-header",
-                "Upgrade-Insecure-Requests")
+                            "Upgrade-Insecure-Requests")
 
         self.assertRaises(
             errors.PluginEnhancementAlreadyPresent,
-            self.config.enhance, "encryption-example.demo", "ensure-http-header",
-            "Upgrade-Insecure-Requests")
-
-
+            self.config.enhance, "encryption-example.demo",
+            "ensure-http-header", "Upgrade-Insecure-Requests")
 
     @mock.patch("letsencrypt.le_util.run_script")
     @mock.patch("letsencrypt.le_util.exe_exists")
@@ -827,7 +852,8 @@ class TwoVhost80Test(util.ApacheTest):
         self.config.get_version = mock.Mock(return_value=(2, 3, 9))
         self.config.parser.add_dir(
             self.vh_truth[3].path, "RewriteRule", ["Unknown"])
-        self.assertTrue(self.config._is_rewrite_exists(self.vh_truth[3])) # pylint: disable=protected-access
+        # pylint: disable=protected-access
+        self.assertTrue(self.config._is_rewrite_exists(self.vh_truth[3]))
 
     def test_rewrite_engine_exists(self):
         # Skip the enable mod
@@ -835,8 +861,8 @@ class TwoVhost80Test(util.ApacheTest):
         self.config.get_version = mock.Mock(return_value=(2, 3, 9))
         self.config.parser.add_dir(
             self.vh_truth[3].path, "RewriteEngine", "on")
-        self.assertTrue(self.config._is_rewrite_engine_on(self.vh_truth[3])) # pylint: disable=protected-access
-
+        # pylint: disable=protected-access
+        self.assertTrue(self.config._is_rewrite_engine_on(self.vh_truth[3]))
 
     @mock.patch("letsencrypt.le_util.run_script")
     @mock.patch("letsencrypt.le_util.exe_exists")
@@ -848,7 +874,7 @@ class TwoVhost80Test(util.ApacheTest):
         # Create a preexisting rewrite rule
         self.config.parser.add_dir(
             self.vh_truth[3].path, "RewriteRule", ["UnknownPattern",
-                "UnknownTarget"])
+                                                   "UnknownTarget"])
         self.config.save()
 
         # This will create an ssl vhost for letsencrypt.demo
@@ -870,11 +896,11 @@ class TwoVhost80Test(util.ApacheTest):
 
         self.assertTrue("rewrite_module" in self.config.parser.modules)
 
-
     def test_redirect_with_conflict(self):
         self.config.parser.modules.add("rewrite_module")
         ssl_vh = obj.VirtualHost(
-            "fp", "ap", set([obj.Addr(("*", "443")), obj.Addr(("zombo.com",))]),
+            "fp", "ap", set([obj.Addr(("*", "443")),
+                             obj.Addr(("zombo.com",))]),
             True, False)
         # No names ^ this guy should conflict.
 
@@ -899,7 +925,8 @@ class TwoVhost80Test(util.ApacheTest):
         self.vh_truth[1].name = "default.com"
         self.vh_truth[1].aliases = set(["yes.default.com"])
 
-        self.config._enable_redirect(self.vh_truth[1], "")  # pylint: disable=protected-access
+        # pylint: disable=protected-access
+        self.config._enable_redirect(self.vh_truth[1], "")
         self.assertEqual(len(self.config.vhosts), 7)
 
     def test_create_own_redirect_for_old_apache_version(self):
@@ -909,7 +936,8 @@ class TwoVhost80Test(util.ApacheTest):
         self.vh_truth[1].name = "default.com"
         self.vh_truth[1].aliases = set(["yes.default.com"])
 
-        self.config._enable_redirect(self.vh_truth[1], "")  # pylint: disable=protected-access
+        # pylint: disable=protected-access
+        self.config._enable_redirect(self.vh_truth[1], "")
         self.assertEqual(len(self.config.vhosts), 7)
 
     def test_sift_line(self):
@@ -933,10 +961,10 @@ class TwoVhost80Test(util.ApacheTest):
             http_vhost.path, "RewriteEngine", "on")
 
         self.config.parser.add_dir(
-                http_vhost.path, "RewriteRule",
-                ["^",
-                "https://%{SERVER_NAME}%{REQUEST_URI}",
-                "[L,QSA,R=permanent]"])
+            http_vhost.path, "RewriteRule",
+            ["^",
+             "https://%{SERVER_NAME}%{REQUEST_URI}",
+             "[L,QSA,R=permanent]"])
         self.config.save()
 
         ssl_vhost = self.config.make_vhost_ssl(self.vh_truth[0])
@@ -945,8 +973,9 @@ class TwoVhost80Test(util.ApacheTest):
             "RewriteEngine", "on", ssl_vhost.path, False))
 
         conf_text = open(ssl_vhost.filep).read()
-        commented_rewrite_rule = \
-        "# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [L,QSA,R=permanent]"
+        commented_rewrite_rule = ("# RewriteRule ^ "
+                                  "https://%{SERVER_NAME}%{REQUEST_URI} "
+                                  "[L,QSA,R=permanent]")
         self.assertTrue(commented_rewrite_rule in conf_text)
         mock_get_utility().add_message.assert_called_once_with(mock.ANY,
                                                                mock.ANY)
@@ -978,6 +1007,15 @@ class TwoVhost80Test(util.ApacheTest):
         self.assertTrue(self.config.parser.find_dir(
             "NameVirtualHost", "*:443", exclude=False))
 
+    def test_aug_version(self):
+        mock_match = mock.Mock(return_value=["something"])
+        self.config.aug.match = mock_match
+        # pylint: disable=protected-access
+        self.assertEquals(self.config._check_aug_version(),
+                          ["something"])
+        self.config.aug.match.side_effect = RuntimeError
+        self.assertFalse(self.config._check_aug_version())
+
 
 if __name__ == "__main__":
     unittest.main()  # pragma: no cover

letsencrypt-apache/letsencrypt_apache/tests/display_ops_test.py

@@ -6,6 +6,7 @@ import mock
 import zope.component
 
 from letsencrypt.display import util as display_util
+from letsencrypt import errors
 
 from letsencrypt_apache import obj
 
@@ -31,6 +32,14 @@ class SelectVhostTest(unittest.TestCase):
         mock_util().menu.return_value = (display_util.OK, 3)
         self.assertEqual(self.vhosts[3], self._call(self.vhosts))
 
+    @mock.patch("letsencrypt_apache.display_ops.zope.component.getUtility")
+    def test_noninteractive(self, mock_util):
+        mock_util().menu.side_effect = errors.MissingCommandlineFlag("no vhost default")
+        try:
+            self._call(self.vhosts)
+        except errors.MissingCommandlineFlag, e:
+            self.assertTrue("VirtualHost directives" in e.message)
+
     @mock.patch("letsencrypt_apache.display_ops.zope.component.getUtility")
     def test_more_info_cancel(self, mock_util):
         mock_util().menu.side_effect = [

letsencrypt-apache/letsencrypt_apache/tests/obj_test.py

@@ -47,7 +47,8 @@ class VirtualHostTest(unittest.TestCase):
         self.assertTrue(self.vhost1.conflicts([self.addr2]))
         self.assertFalse(self.vhost1.conflicts([self.addr_default]))
 
-        self.assertFalse(self.vhost2.conflicts([self.addr1, self.addr_default]))
+        self.assertFalse(self.vhost2.conflicts([self.addr1,
+                                                self.addr_default]))
 
     def test_same_server(self):
         from letsencrypt_apache.obj import VirtualHost

letsencrypt-apache/letsencrypt_apache/tests/parser_test.py

@@ -118,7 +118,8 @@ class BasicParserTest(util.ParserTest):
         # pylint: disable=protected-access
         path = os.path.join(self.parser.root, "httpd.conf")
         open(path, 'w').close()
-        self.parser.add_dir(self.parser.loc["default"], "Include", "httpd.conf")
+        self.parser.add_dir(self.parser.loc["default"], "Include",
+                            "httpd.conf")
 
         self.assertEqual(
             path, self.parser._set_user_config_file())

letsencrypt-apache/letsencrypt_apache/tests/tls_sni_01_test.py

@@ -9,6 +9,8 @@ from letsencrypt.plugins import common_test
 from letsencrypt_apache import obj
 from letsencrypt_apache.tests import util
 
+from six.moves import xrange  # pylint: disable=redefined-builtin, import-error
+
 
 class TlsSniPerformTest(util.ApacheTest):
     """Test the ApacheTlsSni01 challenge."""
@@ -58,7 +60,7 @@ class TlsSniPerformTest(util.ApacheTest):
 
         mock_setup_cert.assert_called_once_with(achall)
 
-        # Check to make sure challenge config path is included in apache config.
+        # Check to make sure challenge config path is included in apache config
         self.assertEqual(
             len(self.sni.configurator.parser.find_dir(
                 "Include", self.sni.challenge_conf)), 1)
@@ -78,8 +80,7 @@ class TlsSniPerformTest(util.ApacheTest):
         # pylint: disable=protected-access
         self.sni._setup_challenge_cert = mock_setup_cert
 
-        with mock.patch(
-             "letsencrypt_apache.configurator.ApacheConfigurator.enable_mod"):
+        with mock.patch("letsencrypt_apache.configurator.ApacheConfigurator.enable_mod"):
             sni_responses = self.sni.perform()
 
         self.assertEqual(mock_setup_cert.call_count, 2)
@@ -126,13 +127,15 @@ class TlsSniPerformTest(util.ApacheTest):
     def test_get_addrs_default(self):
         self.sni.configurator.choose_vhost = mock.Mock(
             return_value=obj.VirtualHost(
-                "path", "aug_path", set([obj.Addr.fromstring("_default_:443")]),
+                "path", "aug_path",
+                set([obj.Addr.fromstring("_default_:443")]),
                 False, False)
         )
 
+        # pylint: disable=protected-access
         self.assertEqual(
             set([obj.Addr.fromstring("*:443")]),
-            self.sni._get_addrs(self.achalls[0]))  # pylint: disable=protected-access
+            self.sni._get_addrs(self.achalls[0]))
 
 
 if __name__ == "__main__":

letsencrypt-apache/letsencrypt_apache/tests/util.py

@@ -42,6 +42,20 @@ class ApacheTest(unittest.TestCase):  # pylint: disable=too-few-public-methods
         self.rsa512jwk = jose.JWKRSA.load(test_util.load_vector(
             "rsa512_key.pem"))
 
+        # Make sure all vhosts in sites-enabled are symlinks (Python packaging
+        # does not preserve symlinks)
+        sites_enabled = os.path.join(self.config_path, "sites-enabled")
+        if not os.path.exists(sites_enabled):
+            return
+
+        for vhost_basename in os.listdir(sites_enabled):
+            vhost = os.path.join(sites_enabled, vhost_basename)
+            if not os.path.islink(vhost):  # pragma: no cover
+                os.remove(vhost)
+                target = os.path.join(
+                    os.path.pardir, "sites-available", vhost_basename)
+                os.symlink(target, vhost)
+
 
 class ParserTest(ApacheTest):  # pytlint: disable=too-few-public-methods
 
@@ -62,7 +76,8 @@ class ParserTest(ApacheTest):  # pytlint: disable=too-few-public-methods
 
 
 def get_apache_configurator(
-        config_path, vhost_path, config_dir, work_dir, version=(2, 4, 7), conf=None):
+        config_path, vhost_path,
+        config_dir, work_dir, version=(2, 4, 7), conf=None):
     """Create an Apache Configurator with the specified options.
 
     :param conf: Function that returns binary paths. self.conf in Configurator
@@ -129,10 +144,12 @@ def get_vh_truth(temp_dir, config_name):
                 os.path.join(prefix, "mod_macro-example.conf"),
                 os.path.join(aug_pre,
                              "mod_macro-example.conf/Macro/VirtualHost"),
-                set([obj.Addr.fromstring("*:80")]), False, True, modmacro=True),
+                set([obj.Addr.fromstring("*:80")]), False, True,
+                modmacro=True),
             obj.VirtualHost(
                 os.path.join(prefix, "default-ssl-port-only.conf"),
-                os.path.join(aug_pre, "default-ssl-port-only.conf/IfModule/VirtualHost"),
+                os.path.join(aug_pre, ("default-ssl-port-only.conf/"
+                                       "IfModule/VirtualHost")),
                 set([obj.Addr.fromstring("_default_:443")]), True, False),
         ]
         return vh_truth

letsencrypt-apache/letsencrypt_apache/tls_sni_01.py

@@ -10,6 +10,7 @@ from letsencrypt_apache import parser
 
 logger = logging.getLogger(__name__)
 
+
 class ApacheTlsSni01(common.TLSSNI01):
     """Class that performs TLS-SNI-01 challenges within the Apache configurator
 
@@ -75,6 +76,7 @@ class ApacheTlsSni01(common.TLSSNI01):
 
         # Setup the configuration
         addrs = self._mod_config()
+        self.configurator.save("Don't lose mod_config changes", True)
         self.configurator.make_addrs_sni_ready(addrs)
 
         # Save reversible changes
@@ -125,7 +127,8 @@ class ApacheTlsSni01(common.TLSSNI01):
                 addrs.add(default_addr)
             else:
                 addrs.add(
-                    addr.get_sni_addr(self.configurator.config.tls_sni_01_port))
+                    addr.get_sni_addr(
+                        self.configurator.config.tls_sni_01_port))
 
         return addrs
 

letsencrypt-apache/setup.py

@@ -4,7 +4,7 @@ from setuptools import setup
 from setuptools import find_packages
 
 
-version = '0.2.0.dev0'
+version = '0.4.0.dev0'
 
 # Please update tox.ini when modifying dependency version requirements
 install_requires = [
@@ -63,4 +63,5 @@ setup(
             'apache = letsencrypt_apache.configurator:ApacheConfigurator',
         ],
     },
+    test_suite='letsencrypt_apache',
 )

letsencrypt-auto-source/Dockerfile

@@ -0,0 +1,33 @@
+# For running tests, build a docker image with a passwordless sudo and a trust
+# store we can manipulate.
+
+FROM ubuntu:trusty
+
+# Add an unprivileged user:
+RUN useradd --create-home --home-dir /home/lea --shell /bin/bash --groups sudo --uid 1000 lea
+
+# Let that user sudo:
+RUN adduser lea sudo
+RUN sed -i.bkp -e \
+      's/%sudo\s\+ALL=(ALL\(:ALL\)\?)\s\+ALL/%sudo ALL=NOPASSWD:ALL/g' \
+      /etc/sudoers
+
+# Install pip and nose:
+RUN apt-get update && \
+    apt-get -q -y install python-pip && \
+    apt-get clean
+RUN pip install nose
+
+RUN mkdir -p /home/lea/letsencrypt/letsencrypt
+
+# Install fake testing CA:
+COPY ./tests/certs/ca/my-root-ca.crt.pem /usr/local/share/ca-certificates/
+RUN update-ca-certificates
+
+# Copy code:
+COPY . /home/lea/letsencrypt/letsencrypt-auto-source
+
+USER lea
+WORKDIR /home/lea
+
+CMD ["nosetests", "-v", "-s", "letsencrypt/letsencrypt-auto-source/tests"]

letsencrypt-auto-source/build.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python
+"""Stitch together the letsencrypt-auto script.
+
+Implement a simple templating language in which {{ some/file }} turns into the
+contents of the file at ./pieces/some/file except for certain tokens which have
+other, special definitions.
+
+"""
+from os.path import abspath, dirname, join
+import re
+from sys import argv
+
+
+DIR = dirname(abspath(__file__))
+
+
+def le_version(build_script_dir):
+    """Return the version number stamped in letsencrypt/__init__.py."""
+    return re.search('''^__version__ = ['"](.+)['"].*''',
+                     file_contents(join(dirname(build_script_dir),
+                                        'letsencrypt',
+                                        '__init__.py')),
+                     re.M).group(1)
+
+
+def file_contents(path):
+    with open(path) as file:
+        return file.read()
+
+
+def build(version=None, requirements=None):
+    """Return the built contents of the letsencrypt-auto script.
+
+    :arg version: The version to attach to the script. Default: the version of
+        the letsencrypt package
+    :arg requirements: The contents of the requirements file to embed. Default:
+        contents of letsencrypt-auto-requirements.txt
+
+    """
+    special_replacements = {
+        'LE_AUTO_VERSION': version or le_version(DIR)
+    }
+    if requirements:
+        special_replacements['letsencrypt-auto-requirements.txt'] = requirements
+
+    def replacer(match):
+        token = match.group(1)
+        if token in special_replacements:
+            return special_replacements[token]
+        else:
+            return file_contents(join(DIR, 'pieces', token))
+
+    return re.sub(r'{{\s*([A-Za-z0-9_./-]+)\s*}}',
+                  replacer,
+                  file_contents(join(DIR, 'letsencrypt-auto.template')))
+
+
+def main():
+    with open(join(DIR, 'letsencrypt-auto'), 'w') as out:
+        out.write(build())
+
+
+if __name__ == '__main__':
+    main()

letsencrypt-auto-source/letsencrypt-auto.sig

@@ -0,0 +1,3 @@
+ßûf3oÐP*ëëŒûÅ]ÈJé3©%ÒuE’ª‘M
½æuþ`újR:y¿‡ÌŇiënF¡N¡|8tuØÏlÆÀ8Ajâñ’
+Æ]¢÷IÍ<49>ì\+Qã2„O¯ÕßF$³v4ËHÆh1ÿ½}EI¼cr<04>W)v
_㕬cŒ‹ðÓé<C393>
+Iërò—Â|ԥţ$O
5Vè ç ®„²OžýqVÎÄ®ŒS®éªó$Kê¶åb3êh¢Â¨éz¥¹ÂwglH†W+Ë& X}ç<
ödðïxkSZ3Qf§Û°¶<C2B0>ŠÍòŸ3ý•aµ¨Æ®…·7˜Õ÷´pÕf

letsencrypt-auto-source/letsencrypt-auto.template

@@ -0,0 +1,262 @@
+#!/bin/sh
+#
+# Download and run the latest release version of the Let's Encrypt client.
+#
+# NOTE: THIS SCRIPT IS AUTO-GENERATED AND SELF-UPDATING
+#
+# IF YOU WANT TO EDIT IT LOCALLY, *ALWAYS* RUN YOUR COPY WITH THE
+# "--no-self-upgrade" FLAG
+#
+# IF YOU WANT TO SEND PULL REQUESTS, THE REAL SOURCE FOR THIS FILE IS
+# letsencrypt-auto-source/letsencrypt-auto.template AND
+# letsencrypt-auto-source/pieces/bootstrappers/*
+
+set -e  # Work even if somebody does "sh thisscript.sh".
+
+# Note: you can set XDG_DATA_HOME or VENV_PATH before running this script,
+# if you want to change where the virtual environment will be installed
+XDG_DATA_HOME=${XDG_DATA_HOME:-~/.local/share}
+VENV_NAME="letsencrypt"
+VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"}
+VENV_BIN=${VENV_PATH}/bin
+LE_AUTO_VERSION="{{ LE_AUTO_VERSION }}"
+
+# This script takes the same arguments as the main letsencrypt program, but it
+# additionally responds to --verbose (more output) and --debug (allow support
+# for experimental platforms)
+for arg in "$@" ; do
+  # This first clause is redundant with the third, but hedging on portability
+  if [ "$arg" = "-v" ] || [ "$arg" = "--verbose" ] || echo "$arg" | grep -E -- "-v+$" ; then
+    VERBOSE=1
+  elif [ "$arg" = "--no-self-upgrade" ] ; then
+    # Do not upgrade this script (also prevents client upgrades, because each
+    # copy of the script pins a hash of the python client)
+    NO_SELF_UPGRADE=1
+  elif [ "$arg" = "--os-packages-only" ] ; then
+    OS_PACKAGES_ONLY=1
+  elif [ "$arg" = "--debug" ]; then
+    DEBUG=1
+  fi
+done
+
+# letsencrypt-auto needs root access to bootstrap OS dependencies, and
+# letsencrypt itself needs root access for almost all modes of operation
+# The "normal" case is that sudo is used for the steps that need root, but
+# this script *can* be run as root (not recommended), or fall back to using
+# `su`
+if test "`id -u`" -ne "0" ; then
+  if command -v sudo 1>/dev/null 2>&1; then
+    SUDO=sudo
+  else
+    echo \"sudo\" is not available, will use \"su\" for installation steps...
+    # Because the parameters in `su -c` has to be a string,
+    # we need properly escape it
+    su_sudo() {
+      args=""
+      # This `while` loop iterates over all parameters given to this function.
+      # For each parameter, all `'` will be replace by `'"'"'`, and the escaped string
+      # will be wrapped in a pair of `'`, then appended to `$args` string
+      # For example, `echo "It's only 1\$\!"` will be escaped to:
+      #   'echo' 'It'"'"'s only 1$!'
+      #     │       │└┼┘│
+      #     │       │ │ └── `'s only 1$!'` the literal string
+      #     │       │ └── `\"'\"` is a single quote (as a string)
+      #     │       └── `'It'`, to be concatenated with the strings following it
+      #     └── `echo` wrapped in a pair of `'`, it's totally fine for the shell command itself
+      while [ $# -ne 0 ]; do
+        args="$args'$(printf "%s" "$1" | sed -e "s/'/'\"'\"'/g")' "
+        shift
+      done
+      su root -c "$args"
+    }
+    SUDO=su_sudo
+  fi
+else
+  SUDO=
+fi
+
+ExperimentalBootstrap() {
+  # Arguments: Platform name, bootstrap function name
+  if [ "$DEBUG" = 1 ]; then
+    if [ "$2" != "" ]; then
+      echo "Bootstrapping dependencies via $1..."
+      $2
+    fi
+  else
+    echo "WARNING: $1 support is very experimental at present..."
+    echo "if you would like to work on improving it, please ensure you have backups"
+    echo "and then run this script again with the --debug flag!"
+    exit 1
+  fi
+}
+
+DeterminePythonVersion() {
+  if command -v python2.7 > /dev/null ; then
+    export LE_PYTHON=${LE_PYTHON:-python2.7}
+  elif command -v python27 > /dev/null ; then
+    export LE_PYTHON=${LE_PYTHON:-python27}
+  elif command -v python2 > /dev/null ; then
+    export LE_PYTHON=${LE_PYTHON:-python2}
+  elif command -v python > /dev/null ; then
+    export LE_PYTHON=${LE_PYTHON:-python}
+  else
+    echo "Cannot find any Pythons... please install one!"
+    exit 1
+  fi
+
+  PYVER=`"$LE_PYTHON" --version 2>&1 | cut -d" " -f 2 | cut -d. -f1,2 | sed 's/\.//'`
+  if [ $PYVER -eq 26 ]; then
+    ExperimentalBootstrap "Python 2.6"
+  elif [ $PYVER -lt 26 ]; then
+    echo "You have an ancient version of Python entombed in your operating system..."
+    echo "This isn't going to work; you'll need at least version 2.6."
+    exit 1
+  fi
+}
+
+{{ bootstrappers/deb_common.sh }}
+{{ bootstrappers/rpm_common.sh }}
+{{ bootstrappers/suse_common.sh }}
+{{ bootstrappers/arch_common.sh }}
+{{ bootstrappers/gentoo_common.sh }}
+{{ bootstrappers/free_bsd.sh }}
+{{ bootstrappers/mac.sh }}
+
+# Install required OS packages:
+Bootstrap() {
+  if [ -f /etc/debian_version ]; then
+    echo "Bootstrapping dependencies for Debian-based OSes..."
+    BootstrapDebCommon
+  elif [ -f /etc/redhat-release ]; then
+    echo "Bootstrapping dependencies for RedHat-based OSes..."
+    BootstrapRpmCommon
+  elif `grep -q openSUSE /etc/os-release` ; then
+    echo "Bootstrapping dependencies for openSUSE-based OSes..."
+    BootstrapSuseCommon
+  elif [ -f /etc/arch-release ]; then
+    if [ "$DEBUG" = 1 ]; then
+      echo "Bootstrapping dependencies for Archlinux..."
+      BootstrapArchCommon
+    else
+      echo "Please use pacman to install letsencrypt packages:"
+      echo "# pacman -S letsencrypt letsencrypt-apache"
+      echo
+      echo "If you would like to use the virtualenv way, please run the script again with the"
+      echo "--debug flag."
+      exit 1
+    fi
+  elif [ -f /etc/manjaro-release ]; then
+    ExperimentalBootstrap "Manjaro Linux" BootstrapArchCommon
+  elif [ -f /etc/gentoo-release ]; then
+    ExperimentalBootstrap "Gentoo" BootstrapGentooCommon
+  elif uname | grep -iq FreeBSD ; then
+    ExperimentalBootstrap "FreeBSD" BootstrapFreeBsd
+  elif uname | grep -iq Darwin ; then
+    ExperimentalBootstrap "Mac OS X" BootstrapMac
+  elif grep -iq "Amazon Linux" /etc/issue ; then
+    ExperimentalBootstrap "Amazon Linux" BootstrapRpmCommon
+  else
+    echo "Sorry, I don't know how to bootstrap Let's Encrypt on your operating system!"
+    echo
+    echo "You will need to bootstrap, configure virtualenv, and run a peep install manually."
+    echo "Please see https://letsencrypt.readthedocs.org/en/latest/contributing.html#prerequisites"
+    echo "for more info."
+  fi
+}
+
+TempDir() {
+  mktemp -d 2>/dev/null || mktemp -d -t 'le'  # Linux || OS X
+}
+
+
+
+if [ "$NO_SELF_UPGRADE" = 1 ]; then
+  # Phase 2: Create venv, install LE, and run.
+
+  if [ -f "$VENV_BIN/letsencrypt" ]; then
+    INSTALLED_VERSION=$("$VENV_BIN/letsencrypt" --version 2>&1 | cut -d " " -f 2)
+  else
+    INSTALLED_VERSION="none"
+  fi
+  if [ "$LE_AUTO_VERSION" != "$INSTALLED_VERSION" ]; then
+    echo "Creating virtual environment..."
+    DeterminePythonVersion
+    rm -rf "$VENV_PATH"
+    if [ "$VERBOSE" = 1 ]; then
+      virtualenv --no-site-packages --python "$LE_PYTHON" "$VENV_PATH"
+    else
+      virtualenv --no-site-packages --python "$LE_PYTHON" "$VENV_PATH" > /dev/null
+    fi
+
+    echo "Installing Python packages..."
+    TEMP_DIR=$(TempDir)
+    # There is no $ interpolation due to quotes on starting heredoc delimiter.
+    # -------------------------------------------------------------------------
+    cat << "UNLIKELY_EOF" > "$TEMP_DIR/letsencrypt-auto-requirements.txt"
+{{ letsencrypt-auto-requirements.txt }}
+UNLIKELY_EOF
+    # -------------------------------------------------------------------------
+    cat << "UNLIKELY_EOF" > "$TEMP_DIR/peep.py"
+{{ peep.py }}
+UNLIKELY_EOF
+    # -------------------------------------------------------------------------
+    set +e
+    PEEP_OUT=`"$VENV_BIN/python" "$TEMP_DIR/peep.py" install -r "$TEMP_DIR/letsencrypt-auto-requirements.txt"`
+    PEEP_STATUS=$?
+    set -e
+    rm -rf "$TEMP_DIR"
+    if [ "$PEEP_STATUS" != 0 ]; then
+      # Report error. (Otherwise, be quiet.)
+      echo "Had a problem while downloading and verifying Python packages:"
+      echo "$PEEP_OUT"
+      exit 1
+    fi
+  fi
+  echo "Requesting root privileges to run letsencrypt..."
+  echo "  " $SUDO "$VENV_BIN/letsencrypt" "$@"
+  $SUDO "$VENV_BIN/letsencrypt" "$@"
+else
+  # Phase 1: Upgrade letsencrypt-auto if neceesary, then self-invoke.
+  #
+  # Each phase checks the version of only the thing it is responsible for
+  # upgrading. Phase 1 checks the version of the latest release of
+  # letsencrypt-auto (which is always the same as that of the letsencrypt
+  # package). Phase 2 checks the version of the locally installed letsencrypt.
+
+  if [ ! -f "$VENV_BIN/letsencrypt" ]; then
+    # If it looks like we've never bootstrapped before, bootstrap:
+    Bootstrap
+  fi
+  if [ "$OS_PACKAGES_ONLY" = 1 ]; then
+    echo "OS packages installed."
+    exit 0
+  fi
+
+  echo "Checking for new version..."
+  TEMP_DIR=$(TempDir)
+  # ---------------------------------------------------------------------------
+  cat << "UNLIKELY_EOF" > "$TEMP_DIR/fetch.py"
+{{ fetch.py }}
+UNLIKELY_EOF
+  # ---------------------------------------------------------------------------
+  DeterminePythonVersion
+  REMOTE_VERSION=`"$LE_PYTHON" "$TEMP_DIR/fetch.py" --latest-version`
+  if [ "$LE_AUTO_VERSION" != "$REMOTE_VERSION" ]; then
+    echo "Upgrading letsencrypt-auto $LE_AUTO_VERSION to $REMOTE_VERSION..."
+
+    # Now we drop into Python so we don't have to install even more
+    # dependencies (curl, etc.), for better flow control, and for the option of
+    # future Windows compatibility.
+    "$LE_PYTHON" "$TEMP_DIR/fetch.py" --le-auto-script "v$REMOTE_VERSION"
+
+    # Install new copy of letsencrypt-auto. This preserves permissions and
+    # ownership from the old copy.
+    # TODO: Deal with quotes in pathnames.
+    echo "Replacing letsencrypt-auto..."
+    echo "  " $SUDO cp "$TEMP_DIR/letsencrypt-auto" "$0"
+    $SUDO cp "$TEMP_DIR/letsencrypt-auto" "$0"
+    # TODO: Clean up temp dir safely, even if it has quotes in its path.
+    rm -rf "$TEMP_DIR"
+  fi  # should upgrade
+  "$0" --no-self-upgrade "$@"
+fi

letsencrypt-auto-source/pieces/bootstrappers/arch_common.sh

@@ -0,0 +1,26 @@
+BootstrapArchCommon() {
+  # Tested with:
+  #   - ArchLinux (x86_64)
+  #
+  # "python-virtualenv" is Python3, but "python2-virtualenv" provides
+  # only "virtualenv2" binary, not "virtualenv" necessary in
+  # ./bootstrap/dev/_common_venv.sh
+
+  deps="
+    python2
+    python-virtualenv
+    gcc
+    dialog
+    augeas
+    openssl
+    libffi
+    ca-certificates
+    pkg-config
+  "
+
+  missing=$("$SUDO" pacman -T $deps)
+
+  if [ "$missing" ]; then
+    "$SUDO" pacman -S --needed $missing
+  fi
+}

letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh

@@ -0,0 +1,94 @@
+BootstrapDebCommon() {
+  # Current version tested with:
+  #
+  # - Ubuntu
+  #     - 14.04 (x64)
+  #     - 15.04 (x64)
+  # - Debian
+  #     - 7.9 "wheezy" (x64)
+  #     - sid (2015-10-21) (x64)
+
+  # Past versions tested with:
+  #
+  # - Debian 8.0 "jessie" (x64)
+  # - Raspbian 7.8 (armhf)
+
+  # Believed not to work:
+  #
+  # - Debian 6.0.10 "squeeze" (x64)
+
+  $SUDO apt-get update || echo apt-get update hit problems but continuing anyway...
+
+  # virtualenv binary can be found in different packages depending on
+  # distro version (#346)
+
+  virtualenv=
+  if apt-cache show virtualenv > /dev/null 2>&1; then
+    virtualenv="virtualenv"
+  fi
+
+  if apt-cache show python-virtualenv > /dev/null 2>&1; then
+    virtualenv="$virtualenv python-virtualenv"
+  fi
+
+  augeas_pkg="libaugeas0 augeas-lenses"
+  AUGVERSION=`apt-cache show --no-all-versions libaugeas0 | grep ^Version: | cut -d" " -f2`
+
+  AddBackportRepo() {
+      # ARGS:
+      BACKPORT_NAME="$1"
+      BACKPORT_SOURCELINE="$2"
+      if ! grep -v -e ' *#' /etc/apt/sources.list | grep -q "$BACKPORT_NAME" ; then
+          # This can theoretically error if sources.list.d is empty, but in that case we don't care.
+          if ! grep -v -e ' *#' /etc/apt/sources.list.d/* 2>/dev/null | grep -q "$BACKPORT_NAME"; then
+              /bin/echo -n "Installing augeas from $BACKPORT_NAME in 3 seconds..."
+              sleep 1s
+              /bin/echo -ne "\e[0K\rInstalling augeas from $BACKPORT_NAME in 2 seconds..."
+              sleep 1s
+              /bin/echo -e "\e[0K\rInstalling augeas from $BACKPORT_NAME in 1 second ..."
+              sleep 1s
+              if echo $BACKPORT_NAME | grep -q wheezy ; then
+                  /bin/echo '(Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports")'
+              fi
+
+              sudo sh -c "echo $BACKPORT_SOURCELINE >> /etc/apt/sources.list.d/$BACKPORT_NAME.list"
+              $SUDO apt-get update
+          fi
+      fi
+      $SUDO apt-get install -y --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
+      augeas_pkg=
+
+  }
+
+
+  if dpkg --compare-versions 1.0 gt "$AUGVERSION" ; then
+      if lsb_release -a | grep -q wheezy ; then
+          AddBackportRepo wheezy-backports "deb http://http.debian.net/debian wheezy-backports main"
+      elif lsb_release -a | grep -q precise ; then
+          # XXX add ARM case
+          AddBackportRepo precise-backports "deb http://archive.ubuntu.com/ubuntu precise-backports main restricted universe multiverse"
+      else
+          echo "No libaugeas0 version is available that's new enough to run the"
+          echo "Let's Encrypt apache plugin..."
+      fi
+      # XXX add a case for ubuntu PPAs
+  fi
+
+  $SUDO apt-get install -y --no-install-recommends \
+    python \
+    python-dev \
+    $virtualenv \
+    gcc \
+    dialog \
+    $augeas_pkg \
+    libssl-dev \
+    libffi-dev \
+    ca-certificates \
+
+
+
+  if ! command -v virtualenv > /dev/null ; then
+    echo Failed to install a working \"virtualenv\" command, exiting
+    exit 1
+  fi
+}

letsencrypt-auto-source/pieces/bootstrappers/free_bsd.sh

@@ -0,0 +1,7 @@
+BootstrapFreeBsd() {
+  "$SUDO" pkg install -Ay \
+    python \
+    py27-virtualenv \
+    augeas \
+    libffi
+}

letsencrypt-auto-source/pieces/bootstrappers/gentoo_common.sh

@@ -0,0 +1,23 @@
+BootstrapGentooCommon() {
+  PACKAGES="
+    dev-lang/python:2.7
+    dev-python/virtualenv
+    dev-util/dialog
+    app-admin/augeas
+    dev-libs/openssl
+    dev-libs/libffi
+    app-misc/ca-certificates
+    virtual/pkgconfig"
+
+  case "$PACKAGE_MANAGER" in
+    (paludis)
+      "$SUDO" cave resolve --keep-targets if-possible $PACKAGES -x
+      ;;
+    (pkgcore)
+      "$SUDO" pmerge --noreplace $PACKAGES
+      ;;
+    (portage|*)
+      "$SUDO" emerge --noreplace $PACKAGES
+      ;;
+  esac
+}

letsencrypt-auto-source/pieces/bootstrappers/mac.sh

@@ -0,0 +1,19 @@
+BootstrapMac() {
+  if ! hash brew 2>/dev/null; then
+      echo "Homebrew Not Installed\nDownloading..."
+      ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
+  fi
+
+  brew install augeas
+  brew install dialog
+
+  if ! hash pip 2>/dev/null; then
+      echo "pip Not Installed\nInstalling python from Homebrew..."
+      brew install python
+  fi
+
+  if ! hash virtualenv 2>/dev/null; then
+      echo "virtualenv Not Installed\nInstalling with pip"
+      pip install virtualenv
+  fi
+}

letsencrypt-auto-source/pieces/bootstrappers/rpm_common.sh

@@ -0,0 +1,61 @@
+BootstrapRpmCommon() {
+  # Tested with:
+  #   - Fedora 22, 23 (x64)
+  #   - Centos 7 (x64: on DigitalOcean droplet)
+  #   - CentOS 7 Minimal install in a Hyper-V VM
+
+  if type dnf 2>/dev/null
+  then
+    tool=dnf
+  elif type yum 2>/dev/null
+  then
+    tool=yum
+
+  else
+    echo "Neither yum nor dnf found. Aborting bootstrap!"
+    exit 1
+  fi
+
+  # Some distros and older versions of current distros use a "python27"
+  # instead of "python" naming convention. Try both conventions.
+  if ! $SUDO $tool install -y \
+         python \
+         python-devel \
+         python-virtualenv \
+         python-tools \
+         python-pip
+  then
+    if ! $SUDO $tool install -y \
+           python27 \
+           python27-devel \
+           python27-virtualenv \
+           python27-tools \
+           python27-pip
+    then
+      echo "Could not install Python dependencies. Aborting bootstrap!"
+      exit 1
+    fi
+  fi
+
+  if ! $SUDO $tool install -y \
+         gcc \
+         dialog \
+         augeas-libs \
+         openssl \
+         openssl-devel \
+         libffi-devel \
+         redhat-rpm-config \
+         ca-certificates
+  then
+      echo "Could not install additional dependencies. Aborting bootstrap!"
+      exit 1
+  fi
+
+
+  if $SUDO $tool list installed "httpd" >/dev/null 2>&1; then
+    if ! $SUDO $tool install -y mod_ssl
+    then
+      echo "Apache found, but mod_ssl could not be installed."
+    fi
+  fi
+}

letsencrypt-auto-source/pieces/bootstrappers/suse_common.sh

@@ -0,0 +1,14 @@
+BootstrapSuseCommon() {
+  # SLE12 don't have python-virtualenv
+
+  $SUDO zypper -nq in -l \
+    python \
+    python-devel \
+    python-virtualenv \
+    gcc \
+    dialog \
+    augeas-lenses \
+    libopenssl-devel \
+    libffi-devel \
+    ca-certificates
+}

letsencrypt-auto-source/pieces/fetch.py

@@ -0,0 +1,126 @@
+"""Do downloading and JSON parsing without additional dependencies. ::
+
+    # Print latest released version of LE to stdout:
+    python fetch.py --latest-version
+    
+    # Download letsencrypt-auto script from git tag v1.2.3 into the folder I'm
+    # in, and make sure its signature verifies:
+    python fetch.py --le-auto-script v1.2.3
+
+On failure, return non-zero.
+
+"""
+from distutils.version import LooseVersion
+from json import loads
+from os import devnull, environ
+from os.path import dirname, join
+import re
+from subprocess import check_call, CalledProcessError
+from sys import argv, exit
+from urllib2 import build_opener, HTTPHandler, HTTPSHandler, HTTPError
+
+PUBLIC_KEY = environ.get('LE_AUTO_PUBLIC_KEY', """-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6MR8W/galdxnpGqBsYbq
+OzQb2eyW15YFjDDEMI0ZOzt8f504obNs920lDnpPD2/KqgsfjOgw2K7xWDJIj/18
+xUvWPk3LDkrnokNiRkA3KOx3W6fHycKL+zID7zy+xZYBuh2fLyQtWV1VGQ45iNRp
+9+Zo7rH86cdfgkdnWTlNSHyTLW9NbXvyv/E12bppPcEvgCTAQXgnDVJ0/sqmeiij
+n9tTFh03aM+R2V/21h8aTraAS24qiPCz6gkmYGC8yr6mglcnNoYbsLNYZ69zF1XH
+cXPduCPdPdfLlzVlKK1/U7hkA28eG3BIAMh6uJYBRJTpiGgaGdPd7YekUB8S6cy+
+CQIDAQAB
+-----END PUBLIC KEY-----
+""")
+
+class ExpectedError(Exception):
+    """A novice-readable exception that also carries the original exception for
+    debugging"""
+
+
+class HttpsGetter(object):
+    def __init__(self):
+        """Build an HTTPS opener."""
+        # Based on pip 1.4.1's URLOpener
+        # This verifies certs on only Python >=2.7.9.
+        self._opener = build_opener(HTTPSHandler())
+        # Strip out HTTPHandler to prevent MITM spoof:
+        for handler in self._opener.handlers:
+            if isinstance(handler, HTTPHandler):
+                self._opener.handlers.remove(handler)
+
+    def get(self, url):
+        """Return the document contents pointed to by an HTTPS URL.
+
+        If something goes wrong (404, timeout, etc.), raise ExpectedError.
+
+        """
+        try:
+            return self._opener.open(url).read()
+        except (HTTPError, IOError) as exc:
+            raise ExpectedError("Couldn't download %s." % url, exc)
+
+
+def write(contents, dir, filename):
+    """Write something to a file in a certain directory."""
+    with open(join(dir, filename), 'w') as file:
+        file.write(contents)
+
+
+def latest_stable_version(get):
+    """Return the latest stable release of letsencrypt."""
+    metadata = loads(get(
+        environ.get('LE_AUTO_JSON_URL',
+                    'https://pypi.python.org/pypi/letsencrypt/json')))
+    # metadata['info']['version'] actually returns the latest of any kind of
+    # release release, contrary to https://wiki.python.org/moin/PyPIJSON.
+    # The regex is a sufficient regex for picking out prereleases for most
+    # packages, LE included.
+    return str(max(LooseVersion(r) for r
+                   in metadata['releases'].iterkeys()
+                   if re.match('^[0-9.]+$', r)))
+
+
+def verified_new_le_auto(get, tag, temp_dir):
+    """Return the path to a verified, up-to-date letsencrypt-auto script.
+
+    If the download's signature does not verify or something else goes wrong
+    with the verification process, raise ExpectedError.
+
+    """
+    le_auto_dir = environ.get(
+        'LE_AUTO_DIR_TEMPLATE',
+        'https://raw.githubusercontent.com/letsencrypt/letsencrypt/%s/'
+        'letsencrypt-auto-source/') % tag
+    write(get(le_auto_dir + 'letsencrypt-auto'), temp_dir, 'letsencrypt-auto')
+    write(get(le_auto_dir + 'letsencrypt-auto.sig'), temp_dir, 'letsencrypt-auto.sig')
+    write(PUBLIC_KEY, temp_dir, 'public_key.pem')
+    try:
+        with open(devnull, 'w') as dev_null:
+            check_call(['openssl', 'dgst', '-sha256', '-verify',
+                        join(temp_dir, 'public_key.pem'),
+                        '-signature',
+                        join(temp_dir, 'letsencrypt-auto.sig'),
+                        join(temp_dir, 'letsencrypt-auto')],
+                       stdout=dev_null,
+                       stderr=dev_null)
+    except CalledProcessError as exc:
+        raise ExpectedError("Couldn't verify signature of downloaded "
+                            "letsencrypt-auto.", exc)
+
+
+def main():
+    get = HttpsGetter().get
+    flag = argv[1]
+    try:
+        if flag == '--latest-version':
+            print latest_stable_version(get)
+        elif flag == '--le-auto-script':
+            tag = argv[2]
+            verified_new_le_auto(get, tag, dirname(argv[0]))
+    except ExpectedError as exc:
+        print exc.args[0], exc.args[1]
+        return 1
+    else:
+        return 0
+
+
+if __name__ == '__main__':
+    exit(main())

letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt

@@ -0,0 +1,206 @@
+# This is the flattened list of packages letsencrypt-auto installs. To generate
+# this, do `pip install -e acme -e . -e letsencrypt-apache`, `pip freeze`,
+# and then gather the hashes.
+
+# sha256: wxZH7baf09RlqEfqMVfTe-0flfGXYLEaR6qRwEtmYxQ
+# sha256: YrCJpVvh2JSc0rx-DfC9254Cj678jDIDjMhIYq791uQ
+argparse==1.4.0
+
+# sha256: U8HJ3bMEMVE-t_PN7wo-BrDxJSGIqqd0SvD1pM1F268
+# sha256: pWj0nfyhKo2fNwGHJX78WKOBCeHu5xTZKFYdegGKZPg
+# sha256: gJxsqM-8ruv71DK0V2ABtA04_yRjdzy1dXfXXhoCC8M
+# sha256: hs3KLNnLpBQiIwOQ3xff6qnzRKkR45dci-naV7NVSOk
+# sha256: JLE9uErsOFyiPHuN7YPvi7QXe8GB0UdY-fl1vl0CDYY
+# sha256: lprv_XwOCX9r4e_WgsFWriJlkaB5OpS2wtXkKT9MjU4
+# sha256: AA81jUsPokn-qrnBzn1bL-fgLnvfaAbCZBhQX8aF4mg
+# sha256: qdhvRgu9g1ii1ROtd54_P8h447k6ALUAL66_YW_-a5w
+# sha256: MSezqzPrI8ysBx-aCAJ0jlz3xcvNAkgrsGPjW0HbsLA
+# sha256: 4rLUIjZGmkAiTTnntsYFdfOIsvQj81TH7pClt_WMgGU
+# sha256: jC3Mr-6JsbQksL7GrS3ZYiyUnSAk6Sn12h7YAerHXx0
+# sha256: pN56TRGu1Ii6tPsU9JiFh6gpvs5aIEM_eA1uM7CAg8s
+# sha256: XKj-MEJSZaSSdOSwITobyY9LE0Sa5elvmEdx5dg-WME
+# sha256: pP04gC9Z5xTrqBoCT2LbcQsn2-J6fqEukRU3MnqoTTA
+# sha256: hs1pErvIPpQF1Kc81_S07oNTZS0tvHyCAQbtW00bqzo
+# sha256: jx0XfTZOo1kAQVriTKPkcb49UzTtBBkpQGjEn0WROZg
+cffi==1.4.2
+
+# sha256: O1CoPdWBSd_O6Yy2VlJl0QtT6cCivKfu73-19VJIkKc
+ConfigArgParse==0.10.0
+
+# sha256: ovVlB3DhyH-zNa8Zqbfrc_wFzPIhROto230AzSvLCQI
+configobj==5.0.6
+
+# sha256: 1U_hszrB4J8cEj4vl0948z6V1h1PSALdISIKXD6MEX0
+# sha256: B1X2aE4RhSAFs2MTdh7ctbqEOmTNAizhrC3L1JqTYG0
+# sha256: zjhNo4lZlluh90VKJfVp737yqxRd8ueiml4pS3TgRnc
+# sha256: GvQDkV3LmWHDB2iuZRr6tpKC0dpaut-mN1IhrBGHdQM
+# sha256: ag08d91PH-W8ZfJ--3fsjQSjiNpesl66DiBAwJgZ30o
+# sha256: KdelgcO6_wTh--IAaltHjZ7cfPmib8ijWUkkf09lA3k
+# sha256: IPAWEKpAh_bVadjMIMR4uB8DhIYnWqqx3Dx12VAsZ-A
+# sha256: l9hGUIulDVomml82OK4cFmWbNTFaH0B_oVF2cH2j0Jc
+# sha256: djfqRMLL1NsvLKccsmtmPRczORqnafi8g2xZVilbd5g
+# sha256: gR-eqJVbPquzLgQGU0XDB4Ui5rPuPZLz0n08fNcWpjM
+# sha256: DXCMjYz97Qm4fCoLqHY856ZjWG4EPmrEL9eDHpKQHLY
+# sha256: Efnq11YqPgATWGytM5o_em9Yg8zhw7S5jhrGnft3p_Y
+# sha256: dNhnm55-0ePs-wq1NNyTUruxz3PTYsmQkJTAlyivqJY
+# sha256: z1Hd-123eBaiB1OKZgEUuC4w4IAD_uhJmwILi4SA2sU
+# sha256: 47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU
+# sha256: dITvgYGUFB3_eUdf-74vd6-FHiw7v-Lk1ZEjEi-KTjM
+# sha256: 7gLB6J7l7pUBV6VK1YTXN8Ec83putMCFPozz8n6WLcA
+# sha256: pfGPaxhQpVVKV9v2YsrSUSpGBW5paHJqmFjngN1bnQo
+# sha256: 26GA8xrb5xi6qdbPirY0hJSwlLK4GAL_8zvVDSfRPnM
+# sha256: 5RinlLjzjoOC9_B3kUGBPOtIE6z9MRVBwNsOGJ69eN4
+# sha256: f1FFn4TWcERCdeYVg59FQsk1R6Euk4oKSQba_l994VM
+cryptography==1.1.2
+
+# sha256: JHXX_N31lR6S_1RpcnWIAt5SYL9Akxmp8ZNOa7yLHcc
+# sha256: NZB977D5krdat3iPZf7cHPIP-iJojg5vbxKvwGs-pQE
+enum34==1.1.2
+
+# sha256: _1rZ4vjZ5dHou_vPR3IqtSfPDVHK7u2dptD0B5k4P94
+# sha256: 2Dzm3wsOpmGHAP4ds1NSY5Goo62ht6ulL-16Ydp3IDM
+funcsigs==0.4
+
+# sha256: my_FC9PEujBrllG2lBHvIgJtTYM1uTr8IhTO8SRs5wc
+# sha256: FhmarZOLKQ9b4QV8Dh78ZUYik5HCPOphypQMEV99PTs
+idna==2.0
+
+# sha256: k1cSgAzkdgcB2JrWd2Zs1SaR_S9vCzQMi0I5o8F5iKU
+# sha256: WjGCsyKnBlJcRigspvBk0noCz_vUSfn0dBbx3JaqcbA
+ipaddress==1.0.16
+
+# sha256: 6MFV_evZxLywgQtO0BrhmHVUse4DTddTLXuP2uOKYnQ
+ndg-httpsclient==0.4.0
+
+# sha256: HDW0rCBs7y0kgWyJ-Jzyid09OM98RJuz-re_bUPwGx8
+ordereddict==1.1
+
+# sha256: OnTxAPkNZZGDFf5kkHca0gi8PxOv0y01_P5OjQs7gSs
+# sha256: Paa-K-UG9ZzOMuGeMOIBBT4btNB-JWaJGOAPikmtQKs
+parsedatetime==1.5
+
+# sha256: Rsjbda51oFa9HMB_ohc0_i5gPRGgeDPswe63TDXHLgw
+# sha256: 4hJ2JqkebIhduJZol22zECDwry2nKJJLVkgPx8zwlkk
+pbr==1.8.1
+
+# sha256: WE8LKfzF1SO0M8uJGLL8dNZ-MO4LRKlbrwMVKPQkYZ8
+# sha256: KMoLbp2Zqo3Chuh0ekRxNitpgSolKR3im2qNcKFUWg0
+# sha256: FnrV__UqZyxN3BwaCyUUbWgT67CKmqsKOsRfiltmnDs
+# sha256: 5t6mFzqYhye7Ij00lzSa1c3vXAsoLv8tg-X5BlxT-F8
+# sha256: KvXgpKrWYEmVXQc0qk49yMqhep6vi0waJ6Xx7m5A9vw
+# sha256: 2YhNwNwuVeJEjklXeNyYmcHIvzeusvQ0wb6nSvk8JoM
+# sha256: 4nwv5t_Mhzi-PSxaAi94XrcpcQV-Gp4eNPunO86KcaY
+# sha256: Za_W_syPOu0J7kvmNYO8jrRy8GzqpP4kxNHVoaPA4T8
+# sha256: uhxVj7_N-UUVwjlLEVXB3FbivCqcF9MDSYJ8ntimfkY
+# sha256: upXqACLctk028MEzXAYF-uNb3z4P6o2S9dD2RWo15Vs
+# sha256: QhtlkdFrUJqqjYwVgh1mu5TLSo3EOFytXFG4XUoJbYU
+# sha256: MmswXL22-U2vv-LCaxHaiLCrB7igf4GIq511_wxuhBo
+# sha256: mu3lsrb-RrN0jqjlIURDiQ0WNAJ77z0zt9rRZVaDAng
+# sha256: c77R24lNGqnDx-YR0wLN6reuig3A7q92cnh42xrFzYc
+# sha256: k1td1tVYr1EvQlAafAj0HXr_E5rxuzlZ2qOruFkjTWw
+# sha256: TKARHPFX3MDy9poyPFtUeHGNaNRfyUNdhL4OwPGGIVs
+# sha256: tvE8lTmKP88CJsTc-kSFYLpYZSWc2W7CgQZYZR6TIYk
+# sha256: 7mvjDRY1u96kxDJdUH3IoNu95-HBmL1i3bn0MZi54hQ
+# sha256: 36eGhYwmjX-74bYXXgAewCc418-uCnzne_m2Ua9nZyk
+# sha256: qnf53nKvnBbMKIzUokz1iCQ4j1fXqB5ADEYWRXYphw4
+# sha256: 9QAJM1fQTagUDYeTLKwuVO9ZKlTKinQ6uyhQ9gwsIus
+psutil==3.3.0
+
+# sha256: YfnZnjzvZf6xv-Oi7vepPrk4GdNFv1S81C9OY9UgTa4
+# sha256: GAKm3TIEXkcqQZ2xRBrsq0adM-DSdJ4ZKr3sUhAXJK8
+# sha256: NQJc2UIsllBJEvBOLxX-eTkKhZe0MMLKXQU0z5MJ_6A
+# sha256: L5btWgwynKFiMLMmyhK3Rh7I9l4L4-T5l1FvNr-Co0U
+# sha256: KP7kQheZHPrZ5qC59-PyYEHiHryWYp6U5YXM0F1J-mU
+# sha256: Mm56hUoX-rB2kSBHR2lfj2ktZ0WIo1XEQfsU9mC_Tmg
+# sha256: zaWpBIVwnKZ5XIYFbD5f5yZgKLBeU_HVJ_35OmNlprg
+# sha256: DLKhR0K1Q_3Wj5MaFM44KRhu0rGyJnoGeHOIyWst2b4
+# sha256: UZH_a5Em0sA53Yf4_wJb7SdLrwf6eK-kb1VrGtcmXW4
+# sha256: gyPgNjey0HLMcEEwC6xuxEjDwolQq0A3YDZ4jpoa9ik
+# sha256: hTys2W0fcB3dZ6oD7MBfUYkBNbcmLpInEBEvEqLtKn8
+pyasn1==0.1.9
+
+# sha256: eVm0p0q9wnsxL-0cIebK-TCc4LKeqGtZH9Lpns3yf3M
+pycparser==2.14
+
+# sha256: iORea7Jd_tJyoe8ucoRh1EtjTCzWiemJtuVqNJxaOuU
+# sha256: 8KJgcNbbCIHei8x4RpNLfDyTDY-cedRYg-5ImEvA1nI
+pyOpenSSL==0.15.1
+
+# sha256: 7qMYNcVuIJavQ2OldFp4SHimHQQ-JH06bWoKMql0H1Y
+# sha256: jfvGxFi42rocDzYgqMeACLMjomiye3NZ6SpK5BMl9TU
+pyRFC3339==1.0
+
+# sha256: Z9WdZs26jWJOA4m4eyqDoXbyHxaodVO1D1cDsj8pusI
+python-augeas==0.5.0
+
+# sha256: BOk_JJlcQ92Q8zjV2GXKcs4_taU1jU2qSWVXHbNfw-w
+# sha256: Pm9ZP-rZj4pSa8PjBpM1MyNuM3KfVS9SiW6lBPVTE_o
+python2-pythondialog==3.3.0
+
+# sha256: Or5qbT_C-75MYBRCEfRdou2-MYKm9lEa9ru6BZix-ZI
+# sha256: k575weEiTZgEBWial__PeCjFbRUXsx1zRkNWwfK3dp4
+# sha256: 6tSu-nAHJJ4F5RsBCVcZ1ajdlXYAifVzCqxWmLGTKRg
+# sha256: PMoN8IvQ7ZhDI5BJTOPe0AP15mGqRgvnpzS__jWYNgU
+# sha256: Pt5HDT0XujwHY436DRBFK8G25a0yYSemW6d-aq6xG-w
+# sha256: aMR5ZPcYbuwwaxNilidyK5B5zURH7Z5eyuzU6shMpzQ
+# sha256: 3V05kZUKrkCmyB3hV4lC5z1imAjO_FHRLNFXmA5s_Bg
+# sha256: p3xSBiwH63x7MFRdvHPjKZW34Rfup1Axe1y1x6RhjxQ
+# sha256: ga-a7EvJYKmgEnxIjxh3La5GNGiSM_BvZUQ-exHr61E
+# sha256: 4Hmx2txcBiRswbtv4bI6ULHRFz8u3VEE79QLtzoo9AY
+# sha256: -9JnRncsJMuTyLl8va1cueRshrvbG52KdD7gDi-x_F0
+# sha256: mSZu8wo35Dky3uwrfKc-g8jbw7n_cD7HPsprHa5r7-o
+# sha256: i2zhyZOQl4O8luC0806iI7_3pN8skL25xODxrJKGieM
+pytz==2015.7
+
+# sha256: ET-7pVManjSUW302szoIToul0GZLcDyBp8Vy2RkZpbg
+# sha256: xXeBXdAPE5QgP8ROuXlySwmPiCZKnviY7kW45enPWH8
+requests==2.9.1
+
+# sha256: D_eMQD2bzPWkJabTGhKqa0fxwhyk3CVzp-LzKpczXrE
+# sha256: EF-NaGFvgkjiS_DpNy7wTTzBAQTxmA9U1Xss5zpa1Wo
+six==1.10.0
+
+# sha256: aUkbUwUVfDxuDwSnAZhNaud_1yn8HJrNJQd_HfOFMms
+# sha256: 619wCpv8lkILBVY1r5AC02YuQ9gMP_0x8iTCW8DV9GI
+Werkzeug==0.11.3
+
+# sha256: KCwRK1XdjjyGmjVx-GdnwVCrEoSprOK97CJsWSrK-Bo
+zope.component==4.2.2
+
+# sha256: 3HpZov2Rcw03kxMaXSYbKek-xOKpfxvEh86N7-4v54Y
+zope.event==4.1.0
+
+# sha256: 8HtjH3pgHNjL0zMtVPQxQscIioMpn4WTVvCNHU1CWbM
+# sha256: 3lzKCDuUOdgAL7drvmtJmMWlpyH6sluEKYln8ALfTJQ
+# sha256: Z4hBb36n9bipe-lIJTd6ol6L3HNGPge6r5hYsp5zcHc
+# sha256: bzIw9yVFGCAeWjcIy7LemMhIME8G497Yv7OeWCXLouE
+# sha256: X6V1pSQPBCAMMIhCfQ1Le3N_bpAYgYpR2ND5J6aiUXo
+# sha256: UiGUrWpUVzXt11yKg_SNZdGvBk5DKn0yDWT1a6_BLpk
+# sha256: 6Mey1AlD9xyZFIyX9myqf1E0FH9XQj-NtbSCUJnOmgk
+# sha256: J5Ak8CCGAcPKqQfFOHbjetiGJffq8cs4QtvjYLIocBc
+# sha256: LiIanux8zFiImieOoT3P7V75OdgLB4Gamos8scaBSE8
+# sha256: aRGJZUEOyG1E3GuQF-4929WC4MCr7vYrOhnb9sitEys
+# sha256: 0E34aG7IZNDK3ozxmff4OuzUFhCaIINNVo-DEN7RLeo
+# sha256: 51qUfhXul-fnHgLqMC_rL8YtOiu0Zov5377UOlBqx-c
+# sha256: TkXSL7iDIipaufKCoRb-xe4ujRpWjM_2otdbvQ62vPw
+# sha256: vOkzm7PHpV4IA7Y9IcWDno5Hm8hcSt9CrkFbcvlPrLI
+# sha256: koE4NlJFoOiGmlmZ-8wqRUdaCm7VKklNYNvcVAM1_t0
+# sha256: DYQbobuEDuoOZIncXsr6YSVVSXH1O1rLh3ZEQeYbzro
+# sha256: sJyMHUezUxxADgGVaX8UFKYyId5u9HhZik8UYPfZo5I
+zope.interface==4.1.3
+
+# sha256: QMIkIvGF3mcJhGLAKRX7n5EVIPjOrfLtklN6ePjbJes
+# sha256: fNFWiij6VxfG5o7u3oNbtrYKQ4q9vhzOLATfxNlozvQ
+acme==0.3.0
+
+# sha256: qdnzpoRf_44QXKoktNoAKs2RBAxUta2Sr6GS0t_tAKo
+# sha256: ELWJaHNvBZIqVPJYkla8yXLtXIuamqAf6f_VAFv16Uk
+letsencrypt==0.3.0
+
+# sha256: EypLpEw3-Tr8unw4aSFsHXgRiU8ZYLrJKOJohP2tC9M
+# sha256: HYvP13GzA-DDJYwlfOoaraJO0zuYO48TCSAyTUAGCqA
+letsencrypt-apache==0.3.0
+
+# sha256: uDndLZwRfHAUMMFJlWkYpCOphjtIsJyQ4wpgE-fS9E8
+# sha256: j4MIDaoknQNsvM-4rlzG_wB7iNbZN1ITca-r57Gbrbw
+mock==1.0.1

letsencrypt-auto-source/pieces/peep.py

@@ -0,0 +1,961 @@
+#!/usr/bin/env python
+"""peep ("prudently examine every package") verifies that packages conform to a
+trusted, locally stored hash and only then installs them::
+
+    peep install -r requirements.txt
+
+This makes your deployments verifiably repeatable without having to maintain a
+local PyPI mirror or use a vendor lib. Just update the version numbers and
+hashes in requirements.txt, and you're all set.
+
+"""
+# This is here so embedded copies of peep.py are MIT-compliant:
+# Copyright (c) 2013 Erik Rose
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to
+# deal in the Software without restriction, including without limitation the
+# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+# sell copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+from __future__ import print_function
+try:
+    xrange = xrange
+except NameError:
+    xrange = range
+from base64 import urlsafe_b64encode, urlsafe_b64decode
+from binascii import hexlify
+import cgi
+from collections import defaultdict
+from functools import wraps
+from hashlib import sha256
+from itertools import chain, islice
+import mimetypes
+from optparse import OptionParser
+from os.path import join, basename, splitext, isdir
+from pickle import dumps, loads
+import re
+import sys
+from shutil import rmtree, copy
+from sys import argv, exit
+from tempfile import mkdtemp
+import traceback
+try:
+    from urllib2 import build_opener, HTTPHandler, HTTPSHandler, HTTPError
+except ImportError:
+    from urllib.request import build_opener, HTTPHandler, HTTPSHandler
+    from urllib.error import HTTPError
+try:
+    from urlparse import urlparse
+except ImportError:
+    from urllib.parse import urlparse  # 3.4
+# TODO: Probably use six to make urllib stuff work across 2/3.
+
+from pkg_resources import require, VersionConflict, DistributionNotFound
+
+# We don't admit our dependency on pip in setup.py, lest a naive user simply
+# say `pip install peep.tar.gz` and thus pull down an untrusted copy of pip
+# from PyPI. Instead, we make sure it's installed and new enough here and spit
+# out an error message if not:
+
+
+def activate(specifier):
+    """Make a compatible version of pip importable. Raise a RuntimeError if we
+    couldn't."""
+    try:
+        for distro in require(specifier):
+            distro.activate()
+    except (VersionConflict, DistributionNotFound):
+        raise RuntimeError('The installed version of pip is too old; peep '
+                           'requires ' + specifier)
+
+# Before 0.6.2, the log module wasn't there, so some
+# of our monkeypatching fails. It probably wouldn't be
+# much work to support even earlier, though.
+activate('pip>=0.6.2')
+
+import pip
+from pip.commands.install import InstallCommand
+try:
+    from pip.download import url_to_path  # 1.5.6
+except ImportError:
+    try:
+        from pip.util import url_to_path  # 0.7.0
+    except ImportError:
+        from pip.util import url_to_filename as url_to_path  # 0.6.2
+from pip.index import PackageFinder, Link
+try:
+    from pip.log import logger
+except ImportError:
+    from pip import logger  # 6.0
+from pip.req import parse_requirements
+try:
+    from pip.utils.ui import DownloadProgressBar, DownloadProgressSpinner
+except ImportError:
+    class NullProgressBar(object):
+        def __init__(self, *args, **kwargs):
+            pass
+
+        def iter(self, ret, *args, **kwargs):
+            return ret
+
+    DownloadProgressBar = DownloadProgressSpinner = NullProgressBar
+
+__version__ = 3, 0, 0
+
+try:
+    from pip.index import FormatControl  # noqa
+    FORMAT_CONTROL_ARG = 'format_control'
+
+    # The line-numbering bug will be fixed in pip 8. All 7.x releases had it.
+    PIP_MAJOR_VERSION = int(pip.__version__.split('.')[0])
+    PIP_COUNTS_COMMENTS = PIP_MAJOR_VERSION >= 8
+except ImportError:
+    FORMAT_CONTROL_ARG = 'use_wheel'  # pre-7
+    PIP_COUNTS_COMMENTS = True
+
+
+ITS_FINE_ITS_FINE = 0
+SOMETHING_WENT_WRONG = 1
+# "Traditional" for command-line errors according to optparse docs:
+COMMAND_LINE_ERROR = 2
+
+ARCHIVE_EXTENSIONS = ('.tar.bz2', '.tar.gz', '.tgz', '.tar', '.zip')
+
+MARKER = object()
+
+
+class PipException(Exception):
+    """When I delegated to pip, it exited with an error."""
+
+    def __init__(self, error_code):
+        self.error_code = error_code
+
+
+class UnsupportedRequirementError(Exception):
+    """An unsupported line was encountered in a requirements file."""
+
+
+class DownloadError(Exception):
+    def __init__(self, link, exc):
+        self.link = link
+        self.reason = str(exc)
+
+    def __str__(self):
+        return 'Downloading %s failed: %s' % (self.link, self.reason)
+
+
+def encoded_hash(sha):
+    """Return a short, 7-bit-safe representation of a hash.
+
+    If you pass a sha256, this results in the hash algorithm that the Wheel
+    format (PEP 427) uses, except here it's intended to be run across the
+    downloaded archive before unpacking.
+
+    """
+    return urlsafe_b64encode(sha.digest()).decode('ascii').rstrip('=')
+
+
+def path_and_line(req):
+    """Return the path and line number of the file from which an
+    InstallRequirement came.
+
+    """
+    path, line = (re.match(r'-r (.*) \(line (\d+)\)$',
+                           req.comes_from).groups())
+    return path, int(line)
+
+
+def hashes_above(path, line_number):
+    """Yield hashes from contiguous comment lines before line ``line_number``.
+
+    """
+    def hash_lists(path):
+        """Yield lists of hashes appearing between non-comment lines.
+
+        The lists will be in order of appearance and, for each non-empty
+        list, their place in the results will coincide with that of the
+        line number of the corresponding result from `parse_requirements`
+        (which changed in pip 7.0 to not count comments).
+
+        """
+        hashes = []
+        with open(path) as file:
+            for lineno, line in enumerate(file, 1):
+                match = HASH_COMMENT_RE.match(line)
+                if match:  # Accumulate this hash.
+                    hashes.append(match.groupdict()['hash'])
+                if not IGNORED_LINE_RE.match(line):
+                    yield hashes  # Report hashes seen so far.
+                    hashes = []
+                elif PIP_COUNTS_COMMENTS:
+                    # Comment: count as normal req but have no hashes.
+                    yield []
+
+    return next(islice(hash_lists(path), line_number - 1, None))
+
+
+def run_pip(initial_args):
+    """Delegate to pip the given args (starting with the subcommand), and raise
+    ``PipException`` if something goes wrong."""
+    status_code = pip.main(initial_args)
+
+    # Clear out the registrations in the pip "logger" singleton. Otherwise,
+    # loggers keep getting appended to it with every run. Pip assumes only one
+    # command invocation will happen per interpreter lifetime.
+    logger.consumers = []
+
+    if status_code:
+        raise PipException(status_code)
+
+
+def hash_of_file(path):
+    """Return the hash of a downloaded file."""
+    with open(path, 'rb') as archive:
+        sha = sha256()
+        while True:
+            data = archive.read(2 ** 20)
+            if not data:
+                break
+            sha.update(data)
+    return encoded_hash(sha)
+
+
+def is_git_sha(text):
+    """Return whether this is probably a git sha"""
+    # Handle both the full sha as well as the 7-character abbreviation
+    if len(text) in (40, 7):
+        try:
+            int(text, 16)
+            return True
+        except ValueError:
+            pass
+    return False
+
+
+def filename_from_url(url):
+    parsed = urlparse(url)
+    path = parsed.path
+    return path.split('/')[-1]
+
+
+def requirement_args(argv, want_paths=False, want_other=False):
+    """Return an iterable of filtered arguments.
+
+    :arg argv: Arguments, starting after the subcommand
+    :arg want_paths: If True, the returned iterable includes the paths to any
+        requirements files following a ``-r`` or ``--requirement`` option.
+    :arg want_other: If True, the returned iterable includes the args that are
+        not a requirement-file path or a ``-r`` or ``--requirement`` flag.
+
+    """
+    was_r = False
+    for arg in argv:
+        # Allow for requirements files named "-r", don't freak out if there's a
+        # trailing "-r", etc.
+        if was_r:
+            if want_paths:
+                yield arg
+            was_r = False
+        elif arg in ['-r', '--requirement']:
+            was_r = True
+        else:
+            if want_other:
+                yield arg
+
+# any line that is a comment or just whitespace
+IGNORED_LINE_RE = re.compile(r'^(\s*#.*)?\s*$')
+
+HASH_COMMENT_RE = re.compile(
+    r"""
+    \s*\#\s+                   # Lines that start with a '#'
+    (?P<hash_type>sha256):\s+  # Hash type is hardcoded to be sha256 for now.
+    (?P<hash>[^\s]+)           # Hashes can be anything except '#' or spaces.
+    \s*                        # Suck up whitespace before the comment or
+                               #   just trailing whitespace if there is no
+                               #   comment. Also strip trailing newlines.
+    (?:\#(?P<comment>.*))?     # Comments can be anything after a whitespace+#
+                               #   and are optional.
+    $""", re.X)
+
+
+def peep_hash(argv):
+    """Return the peep hash of one or more files, returning a shell status code
+    or raising a PipException.
+
+    :arg argv: The commandline args, starting after the subcommand
+
+    """
+    parser = OptionParser(
+        usage='usage: %prog hash file [file ...]',
+        description='Print a peep hash line for one or more files: for '
+                    'example, "# sha256: '
+                    'oz42dZy6Gowxw8AelDtO4gRgTW_xPdooH484k7I5EOY".')
+    _, paths = parser.parse_args(args=argv)
+    if paths:
+        for path in paths:
+            print('# sha256:', hash_of_file(path))
+        return ITS_FINE_ITS_FINE
+    else:
+        parser.print_usage()
+        return COMMAND_LINE_ERROR
+
+
+class EmptyOptions(object):
+    """Fake optparse options for compatibility with pip<1.2
+
+    pip<1.2 had a bug in parse_requirements() in which the ``options`` kwarg
+    was required. We work around that by passing it a mock object.
+
+    """
+    default_vcs = None
+    skip_requirements_regex = None
+    isolated_mode = False
+
+
+def memoize(func):
+    """Memoize a method that should return the same result every time on a
+    given instance.
+
+    """
+    @wraps(func)
+    def memoizer(self):
+        if not hasattr(self, '_cache'):
+            self._cache = {}
+        if func.__name__ not in self._cache:
+            self._cache[func.__name__] = func(self)
+        return self._cache[func.__name__]
+    return memoizer
+
+
+def package_finder(argv):
+    """Return a PackageFinder respecting command-line options.
+
+    :arg argv: Everything after the subcommand
+
+    """
+    # We instantiate an InstallCommand and then use some of its private
+    # machinery--its arg parser--for our own purposes, like a virus. This
+    # approach is portable across many pip versions, where more fine-grained
+    # ones are not. Ignoring options that don't exist on the parser (for
+    # instance, --use-wheel) gives us a straightforward method of backward
+    # compatibility.
+    try:
+        command = InstallCommand()
+    except TypeError:
+        # This is likely pip 1.3.0's "__init__() takes exactly 2 arguments (1
+        # given)" error. In that version, InstallCommand takes a top=level
+        # parser passed in from outside.
+        from pip.baseparser import create_main_parser
+        command = InstallCommand(create_main_parser())
+    # The downside is that it essentially ruins the InstallCommand class for
+    # further use. Calling out to pip.main() within the same interpreter, for
+    # example, would result in arguments parsed this time turning up there.
+    # Thus, we deepcopy the arg parser so we don't trash its singletons. Of
+    # course, deepcopy doesn't work on these objects, because they contain
+    # uncopyable regex patterns, so we pickle and unpickle instead. Fun!
+    options, _ = loads(dumps(command.parser)).parse_args(argv)
+
+    # Carry over PackageFinder kwargs that have [about] the same names as
+    # options attr names:
+    possible_options = [
+        'find_links',
+        FORMAT_CONTROL_ARG,
+        ('allow_all_prereleases', 'pre'),
+        'process_dependency_links'
+    ]
+    kwargs = {}
+    for option in possible_options:
+        kw, attr = option if isinstance(option, tuple) else (option, option)
+        value = getattr(options, attr, MARKER)
+        if value is not MARKER:
+            kwargs[kw] = value
+
+    # Figure out index_urls:
+    index_urls = [options.index_url] + options.extra_index_urls
+    if options.no_index:
+        index_urls = []
+    index_urls += getattr(options, 'mirrors', [])
+
+    # If pip is new enough to have a PipSession, initialize one, since
+    # PackageFinder requires it:
+    if hasattr(command, '_build_session'):
+        kwargs['session'] = command._build_session(options)
+
+    return PackageFinder(index_urls=index_urls, **kwargs)
+
+
+class DownloadedReq(object):
+    """A wrapper around InstallRequirement which offers additional information
+    based on downloading and examining a corresponding package archive
+
+    These are conceptually immutable, so we can get away with memoizing
+    expensive things.
+
+    """
+    def __init__(self, req, argv, finder):
+        """Download a requirement, compare its hashes, and return a subclass
+        of DownloadedReq depending on its state.
+
+        :arg req: The InstallRequirement I am based on
+        :arg argv: The args, starting after the subcommand
+
+        """
+        self._req = req
+        self._argv = argv
+        self._finder = finder
+
+        # We use a separate temp dir for each requirement so requirements
+        # (from different indices) that happen to have the same archive names
+        # don't overwrite each other, leading to a security hole in which the
+        # latter is a hash mismatch, the former has already passed the
+        # comparison, and the latter gets installed.
+        self._temp_path = mkdtemp(prefix='peep-')
+        # Think of DownloadedReq as a one-shot state machine. It's an abstract
+        # class that ratchets forward to being one of its own subclasses,
+        # depending on its package status. Then it doesn't move again.
+        self.__class__ = self._class()
+
+    def dispose(self):
+        """Delete temp files and dirs I've made. Render myself useless.
+
+        Do not call further methods on me after calling dispose().
+
+        """
+        rmtree(self._temp_path)
+
+    def _version(self):
+        """Deduce the version number of the downloaded package from its filename."""
+        # TODO: Can we delete this method and just print the line from the
+        # reqs file verbatim instead?
+        def version_of_archive(filename, package_name):
+            # Since we know the project_name, we can strip that off the left, strip
+            # any archive extensions off the right, and take the rest as the
+            # version.
+            for ext in ARCHIVE_EXTENSIONS:
+                if filename.endswith(ext):
+                    filename = filename[:-len(ext)]
+                    break
+            # Handle github sha tarball downloads.
+            if is_git_sha(filename):
+                filename = package_name + '-' + filename
+            if not filename.lower().replace('_', '-').startswith(package_name.lower()):
+                # TODO: Should we replace runs of [^a-zA-Z0-9.], not just _, with -?
+                give_up(filename, package_name)
+            return filename[len(package_name) + 1:]  # Strip off '-' before version.
+
+        def version_of_wheel(filename, package_name):
+            # For Wheel files (http://legacy.python.org/dev/peps/pep-0427/#file-
+            # name-convention) we know the format bits are '-' separated.
+            whl_package_name, version, _rest = filename.split('-', 2)
+            # Do the alteration to package_name from PEP 427:
+            our_package_name = re.sub(r'[^\w\d.]+', '_', package_name, re.UNICODE)
+            if whl_package_name != our_package_name:
+                give_up(filename, whl_package_name)
+            return version
+
+        def give_up(filename, package_name):
+            raise RuntimeError("The archive '%s' didn't start with the package name "
+                               "'%s', so I couldn't figure out the version number. "
+                               "My bad; improve me." %
+                               (filename, package_name))
+
+        get_version = (version_of_wheel
+                       if self._downloaded_filename().endswith('.whl')
+                       else version_of_archive)
+        return get_version(self._downloaded_filename(), self._project_name())
+
+    def _is_always_unsatisfied(self):
+        """Returns whether this requirement is always unsatisfied
+
+        This would happen in cases where we can't determine the version
+        from the filename.
+
+        """
+        # If this is a github sha tarball, then it is always unsatisfied
+        # because the url has a commit sha in it and not the version
+        # number.
+        url = self._url()
+        if url:
+            filename = filename_from_url(url)
+            if filename.endswith(ARCHIVE_EXTENSIONS):
+                filename, ext = splitext(filename)
+                if is_git_sha(filename):
+                    return True
+        return False
+
+    @memoize  # Avoid hitting the file[cache] over and over.
+    def _expected_hashes(self):
+        """Return a list of known-good hashes for this package."""
+        return hashes_above(*path_and_line(self._req))
+
+    def _download(self, link):
+        """Download a file, and return its name within my temp dir.
+
+        This does no verification of HTTPS certs, but our checking hashes
+        makes that largely unimportant. It would be nice to be able to use the
+        requests lib, which can verify certs, but it is guaranteed to be
+        available only in pip >= 1.5.
+
+        This also drops support for proxies and basic auth, though those could
+        be added back in.
+
+        """
+        # Based on pip 1.4.1's URLOpener but with cert verification removed
+        def opener(is_https):
+            if is_https:
+                opener = build_opener(HTTPSHandler())
+                # Strip out HTTPHandler to prevent MITM spoof:
+                for handler in opener.handlers:
+                    if isinstance(handler, HTTPHandler):
+                        opener.handlers.remove(handler)
+            else:
+                opener = build_opener()
+            return opener
+
+        # Descended from unpack_http_url() in pip 1.4.1
+        def best_filename(link, response):
+            """Return the most informative possible filename for a download,
+            ideally with a proper extension.
+
+            """
+            content_type = response.info().get('content-type', '')
+            filename = link.filename  # fallback
+            # Have a look at the Content-Disposition header for a better guess:
+            content_disposition = response.info().get('content-disposition')
+            if content_disposition:
+                type, params = cgi.parse_header(content_disposition)
+                # We use ``or`` here because we don't want to use an "empty" value
+                # from the filename param:
+                filename = params.get('filename') or filename
+            ext = splitext(filename)[1]
+            if not ext:
+                ext = mimetypes.guess_extension(content_type)
+                if ext:
+                    filename += ext
+            if not ext and link.url != response.geturl():
+                ext = splitext(response.geturl())[1]
+                if ext:
+                    filename += ext
+            return filename
+
+        # Descended from _download_url() in pip 1.4.1
+        def pipe_to_file(response, path, size=0):
+            """Pull the data off an HTTP response, shove it in a new file, and
+            show progress.
+
+            :arg response: A file-like object to read from
+            :arg path: The path of the new file
+            :arg size: The expected size, in bytes, of the download. 0 for
+                unknown or to suppress progress indication (as for cached
+                downloads)
+
+            """
+            def response_chunks(chunk_size):
+                while True:
+                    chunk = response.read(chunk_size)
+                    if not chunk:
+                        break
+                    yield chunk
+
+            print('Downloading %s%s...' % (
+                self._req.req,
+                (' (%sK)' % (size / 1000)) if size > 1000 else ''))
+            progress_indicator = (DownloadProgressBar(max=size).iter if size
+                                  else DownloadProgressSpinner().iter)
+            with open(path, 'wb') as file:
+                for chunk in progress_indicator(response_chunks(4096), 4096):
+                    file.write(chunk)
+
+        url = link.url.split('#', 1)[0]
+        try:
+            response = opener(urlparse(url).scheme != 'http').open(url)
+        except (HTTPError, IOError) as exc:
+            raise DownloadError(link, exc)
+        filename = best_filename(link, response)
+        try:
+            size = int(response.headers['content-length'])
+        except (ValueError, KeyError, TypeError):
+            size = 0
+        pipe_to_file(response, join(self._temp_path, filename), size=size)
+        return filename
+
+    # Based on req_set.prepare_files() in pip bb2a8428d4aebc8d313d05d590f386fa3f0bbd0f
+    @memoize  # Avoid re-downloading.
+    def _downloaded_filename(self):
+        """Download the package's archive if necessary, and return its
+        filename.
+
+        --no-deps is implied, as we have reimplemented the bits that would
+        ordinarily do dependency resolution.
+
+        """
+        # Peep doesn't support requirements that don't come down as a single
+        # file, because it can't hash them. Thus, it doesn't support editable
+        # requirements, because pip itself doesn't support editable
+        # requirements except for "local projects or a VCS url". Nor does it
+        # support VCS requirements yet, because we haven't yet come up with a
+        # portable, deterministic way to hash them. In summary, all we support
+        # is == requirements and tarballs/zips/etc.
+
+        # TODO: Stop on reqs that are editable or aren't ==.
+
+        # If the requirement isn't already specified as a URL, get a URL
+        # from an index:
+        link = self._link() or self._finder.find_requirement(self._req, upgrade=False)
+
+        if link:
+            lower_scheme = link.scheme.lower()  # pip lower()s it for some reason.
+            if lower_scheme == 'http' or lower_scheme == 'https':
+                file_path = self._download(link)
+                return basename(file_path)
+            elif lower_scheme == 'file':
+                # The following is inspired by pip's unpack_file_url():
+                link_path = url_to_path(link.url_without_fragment)
+                if isdir(link_path):
+                    raise UnsupportedRequirementError(
+                        "%s: %s is a directory. So that it can compute "
+                        "a hash, peep supports only filesystem paths which "
+                        "point to files" %
+                        (self._req, link.url_without_fragment))
+                else:
+                    copy(link_path, self._temp_path)
+                    return basename(link_path)
+            else:
+                raise UnsupportedRequirementError(
+                    "%s: The download link, %s, would not result in a file "
+                    "that can be hashed. Peep supports only == requirements, "
+                    "file:// URLs pointing to files (not folders), and "
+                    "http:// and https:// URLs pointing to tarballs, zips, "
+                    "etc." % (self._req, link.url))
+        else:
+            raise UnsupportedRequirementError(
+                "%s: couldn't determine where to download this requirement from."
+                % (self._req,))
+
+    def install(self):
+        """Install the package I represent, without dependencies.
+
+        Obey typical pip-install options passed in on the command line.
+
+        """
+        other_args = list(requirement_args(self._argv, want_other=True))
+        archive_path = join(self._temp_path, self._downloaded_filename())
+        # -U so it installs whether pip deems the requirement "satisfied" or
+        # not. This is necessary for GitHub-sourced zips, which change without
+        # their version numbers changing.
+        run_pip(['install'] + other_args + ['--no-deps', '-U', archive_path])
+
+    @memoize
+    def _actual_hash(self):
+        """Download the package's archive if necessary, and return its hash."""
+        return hash_of_file(join(self._temp_path, self._downloaded_filename()))
+
+    def _project_name(self):
+        """Return the inner Requirement's "unsafe name".
+
+        Raise ValueError if there is no name.
+
+        """
+        name = getattr(self._req.req, 'project_name', '')
+        if name:
+            return name
+        raise ValueError('Requirement has no project_name.')
+
+    def _name(self):
+        return self._req.name
+
+    def _link(self):
+        try:
+            return self._req.link
+        except AttributeError:
+            # The link attribute isn't available prior to pip 6.1.0, so fall
+            # back to the now deprecated 'url' attribute.
+            return Link(self._req.url) if self._req.url else None
+
+    def _url(self):
+        link = self._link()
+        return link.url if link else None
+
+    @memoize  # Avoid re-running expensive check_if_exists().
+    def _is_satisfied(self):
+        self._req.check_if_exists()
+        return (self._req.satisfied_by and
+                not self._is_always_unsatisfied())
+
+    def _class(self):
+        """Return the class I should be, spanning a continuum of goodness."""
+        try:
+            self._project_name()
+        except ValueError:
+            return MalformedReq
+        if self._is_satisfied():
+            return SatisfiedReq
+        if not self._expected_hashes():
+            return MissingReq
+        if self._actual_hash() not in self._expected_hashes():
+            return MismatchedReq
+        return InstallableReq
+
+    @classmethod
+    def foot(cls):
+        """Return the text to be printed once, after all of the errors from
+        classes of my type are printed.
+
+        """
+        return ''
+
+
+class MalformedReq(DownloadedReq):
+    """A requirement whose package name could not be determined"""
+
+    @classmethod
+    def head(cls):
+        return 'The following requirements could not be processed:\n'
+
+    def error(self):
+        return '* Unable to determine package name from URL %s; add #egg=' % self._url()
+
+
+class MissingReq(DownloadedReq):
+    """A requirement for which no hashes were specified in the requirements file"""
+
+    @classmethod
+    def head(cls):
+        return ('The following packages had no hashes specified in the requirements file, which\n'
+                'leaves them open to tampering. Vet these packages to your satisfaction, then\n'
+                'add these "sha256" lines like so:\n\n')
+
+    def error(self):
+        if self._url():
+            # _url() always contains an #egg= part, or this would be a
+            # MalformedRequest.
+            line = self._url()
+        else:
+            line = '%s==%s' % (self._name(), self._version())
+        return '# sha256: %s\n%s\n' % (self._actual_hash(), line)
+
+
+class MismatchedReq(DownloadedReq):
+    """A requirement for which the downloaded file didn't match any of my hashes."""
+    @classmethod
+    def head(cls):
+        return ("THE FOLLOWING PACKAGES DIDN'T MATCH THE HASHES SPECIFIED IN THE REQUIREMENTS\n"
+                "FILE. If you have updated the package versions, update the hashes. If not,\n"
+                "freak out, because someone has tampered with the packages.\n\n")
+
+    def error(self):
+        preamble = '    %s: expected' % self._project_name()
+        if len(self._expected_hashes()) > 1:
+            preamble += ' one of'
+        padding = '\n' + ' ' * (len(preamble) + 1)
+        return '%s %s\n%s got %s' % (preamble,
+                                     padding.join(self._expected_hashes()),
+                                     ' ' * (len(preamble) - 4),
+                                     self._actual_hash())
+
+    @classmethod
+    def foot(cls):
+        return '\n'
+
+
+class SatisfiedReq(DownloadedReq):
+    """A requirement which turned out to be already installed"""
+
+    @classmethod
+    def head(cls):
+        return ("These packages were already installed, so we didn't need to download or build\n"
+                "them again. If you installed them with peep in the first place, you should be\n"
+                "safe. If not, uninstall them, then re-attempt your install with peep.\n")
+
+    def error(self):
+        return '   %s' % (self._req,)
+
+
+class InstallableReq(DownloadedReq):
+    """A requirement whose hash matched and can be safely installed"""
+
+
+# DownloadedReq subclasses that indicate an error that should keep us from
+# going forward with installation, in the order in which their errors should
+# be reported:
+ERROR_CLASSES = [MismatchedReq, MissingReq, MalformedReq]
+
+
+def bucket(things, key):
+    """Return a map of key -> list of things."""
+    ret = defaultdict(list)
+    for thing in things:
+        ret[key(thing)].append(thing)
+    return ret
+
+
+def first_every_last(iterable, first, every, last):
+    """Execute something before the first item of iter, something else for each
+    item, and a third thing after the last.
+
+    If there are no items in the iterable, don't execute anything.
+
+    """
+    did_first = False
+    for item in iterable:
+        if not did_first:
+            did_first = True
+            first(item)
+        every(item)
+    if did_first:
+        last(item)
+
+
+def _parse_requirements(path, finder):
+    try:
+        # list() so the generator that is parse_requirements() actually runs
+        # far enough to report a TypeError
+        return list(parse_requirements(
+            path, options=EmptyOptions(), finder=finder))
+    except TypeError:
+        # session is a required kwarg as of pip 6.0 and will raise
+        # a TypeError if missing. It needs to be a PipSession instance,
+        # but in older versions we can't import it from pip.download
+        # (nor do we need it at all) so we only import it in this except block
+        from pip.download import PipSession
+        return list(parse_requirements(
+            path, options=EmptyOptions(), session=PipSession(), finder=finder))
+
+
+def downloaded_reqs_from_path(path, argv):
+    """Return a list of DownloadedReqs representing the requirements parsed
+    out of a given requirements file.
+
+    :arg path: The path to the requirements file
+    :arg argv: The commandline args, starting after the subcommand
+
+    """
+    finder = package_finder(argv)
+    return [DownloadedReq(req, argv, finder) for req in
+            _parse_requirements(path, finder)]
+
+
+def peep_install(argv):
+    """Perform the ``peep install`` subcommand, returning a shell status code
+    or raising a PipException.
+
+    :arg argv: The commandline args, starting after the subcommand
+
+    """
+    output = []
+    out = output.append
+    reqs = []
+    try:
+        req_paths = list(requirement_args(argv, want_paths=True))
+        if not req_paths:
+            out("You have to specify one or more requirements files with the -r option, because\n"
+                "otherwise there's nowhere for peep to look up the hashes.\n")
+            return COMMAND_LINE_ERROR
+
+        # We're a "peep install" command, and we have some requirement paths.
+        reqs = list(chain.from_iterable(
+            downloaded_reqs_from_path(path, argv)
+            for path in req_paths))
+        buckets = bucket(reqs, lambda r: r.__class__)
+
+        # Skip a line after pip's "Cleaning up..." so the important stuff
+        # stands out:
+        if any(buckets[b] for b in ERROR_CLASSES):
+            out('\n')
+
+        printers = (lambda r: out(r.head()),
+                    lambda r: out(r.error() + '\n'),
+                    lambda r: out(r.foot()))
+        for c in ERROR_CLASSES:
+            first_every_last(buckets[c], *printers)
+
+        if any(buckets[b] for b in ERROR_CLASSES):
+            out('-------------------------------\n'
+                'Not proceeding to installation.\n')
+            return SOMETHING_WENT_WRONG
+        else:
+            for req in buckets[InstallableReq]:
+                req.install()
+
+            first_every_last(buckets[SatisfiedReq], *printers)
+
+        return ITS_FINE_ITS_FINE
+    except (UnsupportedRequirementError, DownloadError) as exc:
+        out(str(exc))
+        return SOMETHING_WENT_WRONG
+    finally:
+        for req in reqs:
+            req.dispose()
+        print(''.join(output))
+
+
+def peep_port(paths):
+    """Convert a peep requirements file to one compatble with pip-8 hashing.
+
+    Loses comments and tromps on URLs, so the result will need a little manual
+    massaging, but the hard part--the hash conversion--is done for you.
+
+    """
+    if not paths:
+        print('Please specify one or more requirements files so I have '
+              'something to port.\n')
+        return COMMAND_LINE_ERROR
+    for req in chain.from_iterable(
+            _parse_requirements(path, package_finder(argv)) for path in paths):
+        hashes = [hexlify(urlsafe_b64decode((hash + '=').encode('ascii'))).decode('ascii')
+                  for hash in hashes_above(*path_and_line(req))]
+        if not hashes:
+            print(req.req)
+        elif len(hashes) == 1:
+            print('%s --hash=sha256:%s' % (req.req, hashes[0]))
+        else:
+            print('%s' % req.req, end='')
+            for hash in hashes:
+                print(' \\')
+                print('    --hash=sha256:%s' % hash, end='')
+            print()
+
+
+def main():
+    """Be the top-level entrypoint. Return a shell status code."""
+    commands = {'hash': peep_hash,
+                'install': peep_install,
+                'port': peep_port}
+    try:
+        if len(argv) >= 2 and argv[1] in commands:
+            return commands[argv[1]](argv[2:])
+        else:
+            # Fall through to top-level pip main() for everything else:
+            return pip.main()
+    except PipException as exc:
+        return exc.error_code
+
+
+def exception_handler(exc_type, exc_value, exc_tb):
+    print('Oh no! Peep had a problem while trying to do stuff. Please write up a bug report')
+    print('with the specifics so we can fix it:')
+    print()
+    print('https://github.com/erikrose/peep/issues/new')
+    print()
+    print('Here are some particulars you can copy and paste into the bug report:')
+    print()
+    print('---')
+    print('peep:', repr(__version__))
+    print('python:', repr(sys.version))
+    print('pip:', repr(getattr(pip, '__version__', 'no __version__ attr')))
+    print('Command line: ', repr(sys.argv))
+    print(
+        ''.join(traceback.format_exception(exc_type, exc_value, exc_tb)))
+    print('---')
+
+
+if __name__ == '__main__':
+    try:
+        exit(main())
+    except Exception:
+        exception_handler(*sys.exc_info())
+        exit(SOMETHING_WENT_WRONG)

letsencrypt-auto-source/tests/__init__.py

@@ -0,0 +1,7 @@
+"""Tests for letsencrypt-auto
+
+Run these locally by saying... ::
+
+    ./build.py && docker build -t lea . && docker run --rm -t -i lea
+
+"""

letsencrypt-auto-source/tests/auto_test.py

@@ -0,0 +1,343 @@
+"""Tests for letsencrypt-auto"""
+
+from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler
+from contextlib import contextmanager
+from functools import partial
+from json import dumps
+from os import chmod, environ
+from os.path import abspath, dirname, join
+import re
+from shutil import copy, rmtree
+import socket
+import ssl
+from stat import S_IRUSR, S_IXUSR
+from subprocess import CalledProcessError, check_output, Popen, PIPE
+import sys
+from tempfile import mkdtemp
+from threading import Thread
+from unittest import TestCase
+
+from nose.tools import eq_, nottest, ok_
+
+
+@nottest
+def tests_dir():
+    """Return a path to the "tests" directory."""
+    return dirname(abspath(__file__))
+
+
+sys.path.insert(0, dirname(tests_dir()))
+from build import build as build_le_auto
+
+
+class RequestHandler(BaseHTTPRequestHandler):
+    """An HTTPS request handler which is quiet and serves a specific folder."""
+
+    def __init__(self, resources, *args, **kwargs):
+        """
+        :arg resources: A dict of resource paths pointing to content bytes
+
+        """
+        self.resources = resources
+        BaseHTTPRequestHandler.__init__(self, *args, **kwargs)
+
+    def log_message(self, format, *args):
+        """Don't log each request to the terminal."""
+
+    def do_GET(self):
+        """Serve a GET request."""
+        content = self.send_head()
+        if content is not None:
+            self.wfile.write(content)
+
+    def send_head(self):
+        """Common code for GET and HEAD commands
+
+        This sends the response code and MIME headers and returns either a
+        bytestring of content or, if none is found, None.
+
+        """
+        path = self.path[1:]  # Strip leading slash.
+        content = self.resources.get(path)
+        if content is None:
+            self.send_error(404, 'Path "%s" not found in self.resources' % path)
+        else:
+            self.send_response(200)
+            self.send_header('Content-type', 'text/plain')
+            self.send_header('Content-Length', str(len(content)))
+            self.end_headers()
+            return content
+
+
+def server_and_port(resources):
+    """Return an unstarted HTTPS server and the port it will use."""
+    # Find a port, and bind to it. I can't get the OS to close the socket
+    # promptly after we shut down the server, so we typically need to try
+    # a couple ports after the first test case. Setting
+    # TCPServer.allow_reuse_address = True seems to have nothing to do
+    # with this behavior.
+    worked = False
+    for port in xrange(4443, 4543):
+        try:
+            server = HTTPServer(('localhost', port),
+                                partial(RequestHandler, resources))
+        except socket.error:
+            pass
+        else:
+            worked = True
+            server.socket = ssl.wrap_socket(
+                server.socket,
+                certfile=join(tests_dir(), 'certs', 'localhost', 'server.pem'),
+                server_side=True)
+            break
+    if not worked:
+        raise RuntimeError("Couldn't find an unused socket for the testing HTTPS server.")
+    return server, port
+
+
+@contextmanager
+def serving(resources):
+    """Spin up a local HTTPS server, and yield its base URL.
+
+    Use a self-signed cert generated as outlined by
+    https://coolaj86.com/articles/create-your-own-certificate-authority-for-
+    testing/.
+
+    """
+    server, port = server_and_port(resources)
+    thread = Thread(target=server.serve_forever)
+    try:
+        thread.start()
+        yield 'https://localhost:{port}/'.format(port=port)
+    finally:
+        server.shutdown()
+        thread.join()
+
+
+LE_AUTO_PATH = join(dirname(tests_dir()), 'letsencrypt-auto')
+
+
+@contextmanager
+def ephemeral_dir():
+    dir = mkdtemp(prefix='le-test-')
+    try:
+        yield dir
+    finally:
+        rmtree(dir)
+
+
+def out_and_err(command, input=None, shell=False, env=None):
+    """Run a shell command, and return stderr and stdout as string.
+
+    If the command returns nonzero, raise CalledProcessError.
+
+    :arg command: A list of commandline args
+    :arg input: Data to pipe to stdin. Omit for none.
+
+    Remaining args have the same meaning as for Popen.
+
+    """
+    process = Popen(command,
+                    stdout=PIPE,
+                    stdin=PIPE,
+                    stderr=PIPE,
+                    shell=shell,
+                    env=env)
+    out, err = process.communicate(input=input)
+    status = process.poll()  # same as in check_output(), though wait() sounds better
+    if status:
+        raise CalledProcessError(status, command, output=out)
+    return out, err
+
+
+def signed(content, private_key_name='signing.key'):
+    """Return the signed SHA-256 hash of ``content``, using the given key file."""
+    command = ['openssl', 'dgst', '-sha256', '-sign',
+               join(tests_dir(), private_key_name)]
+    out, err = out_and_err(command, input=content)
+    return out
+
+
+def install_le_auto(contents, venv_dir):
+    """Install some given source code as the letsencrypt-auto script at the
+    root level of a virtualenv.
+
+    :arg contents: The contents of the built letsencrypt-auto script
+    :arg venv_dir: The path under which to install the script
+
+    """
+    venv_le_auto_path = join(venv_dir, 'letsencrypt-auto')
+    with open(venv_le_auto_path, 'w') as le_auto:
+        le_auto.write(contents)
+    chmod(venv_le_auto_path, S_IRUSR | S_IXUSR)
+
+
+def run_le_auto(venv_dir, base_url, **kwargs):
+    """Run the prebuilt version of letsencrypt-auto, returning stdout and
+    stderr strings.
+
+    If the command returns other than 0, raise CalledProcessError.
+
+    """
+    env = environ.copy()
+    d = dict(XDG_DATA_HOME=venv_dir,
+             # URL to PyPI-style JSON that tell us the latest released version
+             # of LE:
+             LE_AUTO_JSON_URL=base_url + 'letsencrypt/json',
+             # URL to dir containing letsencrypt-auto and letsencrypt-auto.sig:
+             LE_AUTO_DIR_TEMPLATE=base_url + '%s/',
+             # The public key corresponding to signing.key:
+             LE_AUTO_PUBLIC_KEY="""-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsMoSzLYQ7E1sdSOkwelg
+tzKIh2qi3bpXuYtcfFC0XrvWig071NwIj+dZiT0OLZ2hPispEH0B7ISuuWg1ll7G
+hFW0VdbxL6JdGzS2ShNWkX9hE9z+j8VqwDPOBn3ZHm03qwpYkBDwQib3KqOdYbTT
+uUtJmmGcuk3a9Aq/sCT6DdfmTSdP5asdQYwIcaQreDrOosaS84DTWI3IU+UYJVgl
+LsIVPBuy9IcgHidUQ96hJnoPsDCWsHwX62495QKEarauyKQrJzFes0EY95orDM47
+Z5o/NDiQB11m91yNB0MmPYY9QSbnOA9j7IaaC97AwRLuwXY+/R2ablTcxurWou68
+iQIDAQAB
+-----END PUBLIC KEY-----""",
+             **kwargs)
+    env.update(d)
+    return out_and_err(
+        join(venv_dir, 'letsencrypt-auto') + ' --version',
+        shell=True,
+        env=env)
+
+
+def set_le_script_version(venv_dir, version):
+    """Tell the letsencrypt script to report a certain version.
+
+    We actually replace the script with a dummy version that knows only how to
+    print its version.
+
+    """
+    with open(join(venv_dir, 'letsencrypt', 'bin', 'letsencrypt'), 'w') as script:
+        script.write("#!/usr/bin/env python\n"
+                     "from sys import stderr\n"
+                     "stderr.write('letsencrypt %s\\n')" % version)
+
+
+class AutoTests(TestCase):
+    """Test the major branch points of letsencrypt-auto:
+
+    * An le-auto upgrade is needed.
+    * An le-auto upgrade is not needed.
+    * There was an out-of-date LE script installed.
+    * There was a current LE script installed.
+    * There was no LE script installed (less important).
+    * Peep verification passes.
+    * Peep has a hash mismatch.
+    * The OpenSSL sig matches.
+    * The OpenSSL sig mismatches.
+
+    For tests which get to the end, we run merely ``letsencrypt --version``.
+    The functioning of the rest of the letsencrypt script is covered by other
+    test suites.
+
+    """
+    def test_successes(self):
+        """Exercise most branches of letsencrypt-auto.
+
+        They just happen to be the branches in which everything goes well.
+
+        I violate my usual rule of having small, decoupled tests, because...
+
+        1. We shouldn't need to run a Cartesian product of the branches: the
+           phases run in separate shell processes, containing state leakage
+           pretty effectively. The only shared state is FS state, and it's
+           limited to a temp dir, assuming (if we dare) all functions properly.
+        2. One combination of branches happens to set us up nicely for testing
+           the next, saving code.
+
+        """
+        NEW_LE_AUTO = build_le_auto(
+                version='99.9.9',
+                requirements='# sha256: HMFNYatCTN7kRvUeUPESP4SC7HQFh_54YmyTO7ooc6A\n'
+                             'letsencrypt==99.9.9')
+        NEW_LE_AUTO_SIG = signed(NEW_LE_AUTO)
+
+        with ephemeral_dir() as venv_dir:
+            # This serves a PyPI page with a higher version, a GitHub-alike
+            # with a corresponding le-auto script, and a matching signature.
+            resources = {'letsencrypt/json': dumps({'releases': {'99.9.9': None}}),
+                         'v99.9.9/letsencrypt-auto': NEW_LE_AUTO,
+                         'v99.9.9/letsencrypt-auto.sig': NEW_LE_AUTO_SIG}
+            with serving(resources) as base_url:
+                run_letsencrypt_auto = partial(
+                        run_le_auto,
+                        venv_dir,
+                        base_url,
+                        PIP_FIND_LINKS=join(tests_dir(),
+                                            'fake-letsencrypt',
+                                            'dist'))
+
+                # Test when a phase-1 upgrade is needed, there's no LE binary
+                # installed, and peep verifies:
+                install_le_auto(build_le_auto(version='50.0.0'), venv_dir)
+                out, err = run_letsencrypt_auto()
+                ok_(re.match(r'letsencrypt \d+\.\d+\.\d+',
+                             err.strip().splitlines()[-1]))
+                # Make a few assertions to test the validity of the next tests:
+                self.assertIn('Upgrading letsencrypt-auto ', out)
+                self.assertIn('Creating virtual environment...', out)
+
+                # Now we have le-auto 99.9.9  and LE 99.9.9 installed. This
+                # conveniently sets us up to test the next 2 cases.
+
+                # Test when neither phase-1 upgrade nor phase-2 upgrade is
+                # needed (probably a common case):
+                out, err = run_letsencrypt_auto()
+                self.assertNotIn('Upgrading letsencrypt-auto ', out)
+                self.assertNotIn('Creating virtual environment...', out)
+
+                # Test when a phase-1 upgrade is not needed but a phase-2
+                # upgrade is:
+                set_le_script_version(venv_dir, '0.0.1')
+                out, err = run_letsencrypt_auto()
+                self.assertNotIn('Upgrading letsencrypt-auto ', out)
+                self.assertIn('Creating virtual environment...', out)
+
+    def test_openssl_failure(self):
+        """Make sure we stop if the openssl signature check fails."""
+        with ephemeral_dir() as venv_dir:
+            # Serve an unrelated hash signed with the good key (easier than
+            # making a bad key, and a mismatch is a mismatch):
+            resources = {'': '<a href="letsencrypt/">letsencrypt/</a>',
+                         'letsencrypt/json': dumps({'releases': {'99.9.9': None}}),
+                         'v99.9.9/letsencrypt-auto': build_le_auto(version='99.9.9'),
+                         'v99.9.9/letsencrypt-auto.sig': signed('something else')}
+            with serving(resources) as base_url:
+                copy(LE_AUTO_PATH, venv_dir)
+                try:
+                    out, err = run_le_auto(venv_dir, base_url)
+                except CalledProcessError as exc:
+                    eq_(exc.returncode, 1)
+                    self.assertIn("Couldn't verify signature of downloaded "
+                                  "letsencrypt-auto.",
+                                  exc.output)
+                else:
+                    self.fail('Signature check on letsencrypt-auto erroneously passed.')
+
+    def test_peep_failure(self):
+        """Make sure peep stops us if there is a hash mismatch."""
+        with ephemeral_dir() as venv_dir:
+            resources = {'': '<a href="letsencrypt/">letsencrypt/</a>',
+                         'letsencrypt/json': dumps({'releases': {'99.9.9': None}})}
+            with serving(resources) as base_url:
+                # Build a le-auto script embedding a bad requirements file:
+                install_le_auto(
+                    build_le_auto(
+                        version='99.9.9',
+                        requirements='# sha256: badbadbadbadbadbadbadbadbadbadbadbadbadbadb\n'
+                                     'configobj==5.0.6'),
+                    venv_dir)
+                try:
+                    out, err = run_le_auto(venv_dir, base_url)
+                except CalledProcessError as exc:
+                    eq_(exc.returncode, 1)
+                    self.assertIn("THE FOLLOWING PACKAGES DIDN'T MATCH THE "
+                                  "HASHES SPECIFIED IN THE REQUIREMENTS",
+                                  exc.output)
+                else:
+                    self.fail("Peep didn't detect a bad hash and stop the "
+                              "installation.")

letsencrypt-auto-source/tests/certs/ca/my-root-ca.crt.pem

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID5jCCAs6gAwIBAgIJAI1Qkfyw88REMA0GCSqGSIb3DQEBBQUAMFUxCzAJBgNV
+BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMRswGQYDVQQKExJNeSBCb2d1cyBS
+b290IENlcnQxFDASBgNVBAMTC2V4YW1wbGUuY29tMB4XDTE1MTIwNDIwNTIxNVoX
+DTQwMTIwMzIwNTIxNVowVTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3Rh
+dGUxGzAZBgNVBAoTEk15IEJvZ3VzIFJvb3QgQ2VydDEUMBIGA1UEAxMLZXhhbXBs
+ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDQVQpQ2EH4gTJB
+NJP6+ocT3xJwT8mSXYUnvzjj6iv+JxZiXRGzAPziNzrrSRKY0yDHF+UiJwuOerLa
+n8laZkLb1Ogqzs2u64rKeb0xWv90Qp+eXG0J/1xb4dw+GExqe5QFo1JUJzO/eK7m
+1S04SeFkN1qV9mD5yJUy7DGiTUzDHgCxM2tXMLusXYqkxsQQ9+2EJ7BEOK4YJGEx
+Sign5FuSxb64PiNow6OA97CaLl7tV4INP4w195ueDRIaS4poeOep4s8U7IAdMjIZ
+EryJgKNCij50xK92vPBBJSj0NOitltBlwoEqkOZpQCOZamFd6nvt78LQ6W8Am+l6
+y6oCON5JAgMBAAGjgbgwgbUwHQYDVR0OBBYEFAlrdStDhaayLLj89Whe3Gc+HE8y
+MIGFBgNVHSMEfjB8gBQJa3UrQ4Wmsiy4/PVoXtxnPhxPMqFZpFcwVTELMAkGA1UE
+BhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxGzAZBgNVBAoTEk15IEJvZ3VzIFJv
+b3QgQ2VydDEUMBIGA1UEAxMLZXhhbXBsZS5jb22CCQCNUJH8sPPERDAMBgNVHRME
+BTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQC7KAQfDTiNM3QO8Ic3x21CAPJUavkH
+zshifN+Ei0+nmseHDTCTgsGfGDOToLUpUEZ4PuiHnz08UwRfd9wotc3SgY9ZaXMe
+vRs8KUAF9EoyTvESzPyv2b6cS9NNMpj5y7KyXSyP17VoGbNavtiGQ4dwgEH6VgNl
+0RtBvcSBv/tqxIIx1tWzL74tVEm0Kbd9BAZsYpQNKL8e6WXP35/j0PvCCvtofGrA
+E8LTqMz4kCwnX+QaJIMJhBophRCsjXdAkvFbFxX0DGPztQtzIwBPcdMjsft7AFeE
+0XchhDDXxw8YsbpvPfCvrD8XiiVuBycbnB1zt0LLVwB/QsCzUW9ImpLC
+-----END CERTIFICATE-----

letsencrypt-auto-source/tests/certs/ca/my-root-ca.key.pem

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA0FUKUNhB+IEyQTST+vqHE98ScE/Jkl2FJ7844+or/icWYl0R
+swD84jc660kSmNMgxxflIicLjnqy2p/JWmZC29ToKs7NruuKynm9MVr/dEKfnlxt
+Cf9cW+HcPhhManuUBaNSVCczv3iu5tUtOEnhZDdalfZg+ciVMuwxok1Mwx4AsTNr
+VzC7rF2KpMbEEPfthCewRDiuGCRhMUooJ+RbksW+uD4jaMOjgPewmi5e7VeCDT+M
+Nfebng0SGkuKaHjnqeLPFOyAHTIyGRK8iYCjQoo+dMSvdrzwQSUo9DTorZbQZcKB
+KpDmaUAjmWphXep77e/C0OlvAJvpesuqAjjeSQIDAQABAoIBAH+qbVzneV3wxjwh
+HUHi/p3VyHXc3xh7iNq3mwRH/1eK2nPCttLsGwwBbnC64dOXJfH7maWZKcLRPAMv
+gfOM0RHn4bJB8tdrbizv91lke0DihvBDkWpb+1wvB4lh2Io0Wpwt3ojFUTfXm87G
++iQRWjbQmQlm5zyKh6uiBDSCjDTQdb9omZEBMAwlGPTZwt8TRUEtWd8QgW8FCHoB
+iLER2WBwXdvn3PBtocI3VE6IYDSeZ81Xv+d7925RtVintT8Suk4toYwX+jfSz+wZ
+sgHd5V6PSv9a7GUlWoUihD99D9wqDZE8IvMDZ5ofSAUd1KfICDtmsEyugY7u2yYZ
+tYt49AECgYEA73f7ITMHg8JsUipqb6eG10gCRtRhkqrrO1g/TNeTBh3CTrQGb56e
+y6kmUivn5gK46t3T2N4Ht4IR8fpLcJcbPYPQNulSjmWm5y6WduafXW/VCW1NA9Lc
+FyGPkMxFCIVJTLFxfLFepBVvtUzLLDKGGtQxru/GNbBzjdtmVfDPIoECgYEA3rbM
+cTfvj+jWrV1YsRbphyjy+k3OJEIVx6KA4s5d7Tp12UfYQp/B3HPhXXm5wqeo1Nos
+UAEWZIMi1VoE8iu6jjeJ6uERtbKKQVed25Us/ff0jUPbxlXgiBOtRcllq9d9Srjm
+ybHUgfjLsZ2/xpIcOl+oI5pDM9JvD8Sq4ZCFR8kCgYBK/H0tFjeiML2OtS2DLShy
+PWBJIbQ0I0Vp3eZkf5TQc30m/ASP61G6YItZa9pAElYpZbEy1cQA2MAZz9DTvt2O
+07ndmA57/KTY+6OuM+Vvctd5DjrxmZPFwoKcSvrLAkHDvETXUQtbwkKquRNeEawg
+tpWgPAELSufEYhGXk8KpAQKBgBDCqPgMQZcO6rj5QWdyVfi5+C8mE9Fet8ziSdjH
+twHXWG8VnQzGgQxaHCewtW4Ut/vsv1D2A/1kcQalU6H18IArZdGrRm3qFcV9FoAj
+5dLnChxncu6mH9Odx3htA52/BcrNx3B+VYPCeXHQcVI8RKuP71NelJgdygXhwwpe
+mekhAoGBAOUovnqylciYa9HRqo+xZk59eyX+ehhnlV8SeJ2K0PwaQkzQ0KYtCmE7
+kdSdhcv8h/IQKGaFfc/LyFMM/a26PfAeY5bj41UjkT0K5hQrYuL/52xaT401YLcb
+Xo+bZz9K0hrdP7TdZFuTY/WxojXgjsVAuAN1NwnJumqxhzPh+hfl
+-----END RSA PRIVATE KEY-----

letsencrypt-auto-source/tests/certs/ca/my-root-ca.srl

@@ -0,0 +1 @@
+D613482D0EF95DD0

letsencrypt-auto-source/tests/certs/localhost/cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDKjCCAhICCQDWE0gtDvld0DANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJB
+VTETMBEGA1UECBMKU29tZS1TdGF0ZTEbMBkGA1UEChMSTXkgQm9ndXMgUm9vdCBD
+ZXJ0MRQwEgYDVQQDEwtleGFtcGxlLmNvbTAeFw0xNTEyMDQyMDU0MzFaFw00MDEy
+MDMyMDU0MzFaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEw
+HwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMTCWxvY2Fs
+aG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK2WIIi86Mis4UQH
+a5PrFbX2PBtQHbI3t3ekN1CewRsgQ/2X3lCeWhKmr3CJYXVgA7q/23PORQAiuV6y
+DG2dQIrjeahWCXaCptTi49ljfVRTW2IxrHke/iA8TkDuZbWGzVLb8TB83ipBOD41
+SjuomoN4A/ktnIfbNqRqgjjHs2wwJHDfxPiCQlwyOayjHmdlh8cqfVE8rWEm5/3T
+Iu0X1J53SammR1SbUmsLJNofxFYMK1ogHb0CaFEG9QuuUDPJl5K74Rr6InMQZKPn
+ne4W3cGoALxPHAca7yicpSMSmdsmd6pqylc2Fdua7o/wf0SwShxS4A1DqA/HWLEM
+V6MSEF8CAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAz5sMAFG6W/ZEULZITkBTCU6P
+NttpGiKufnqyBW5HyNylaczfnHnClvQjr8f/84xvKVcfC3xP0lz+92aIQqo+5L/n
+v7gLhBFR4Vr2XwMt2qz2FpkaxmVwnhVAHaaC05WIKQ6W2gDwWT0u1K8YdTh+7mvN
+AT9FW4vDgtNZWq4W/PePh9QCiOOQhGOuBYj/7zqLtz4XPifhi66ILIRDHiu0kond
+3YMFcECIAf4MPT9vT0iNcWX+c8CfAixPt8nMD6bzOo3oTcfuZh/2enfgLbMqOlOi
+uk72FM5VVPXTWAckJvL/vVjqsvDuJQKqbr0oUc3bdWbS36xtWZUycp4IQLguAQ==
+-----END CERTIFICATE-----

letsencrypt-auto-source/tests/certs/localhost/localhost.csr.pem

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICnjCCAYYCAQAwWTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUx
+ITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDESMBAGA1UEAxMJbG9j
+YWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZYgiLzoyKzh
+RAdrk+sVtfY8G1Adsje3d6Q3UJ7BGyBD/ZfeUJ5aEqavcIlhdWADur/bc85FACK5
+XrIMbZ1AiuN5qFYJdoKm1OLj2WN9VFNbYjGseR7+IDxOQO5ltYbNUtvxMHzeKkE4
+PjVKO6iag3gD+S2ch9s2pGqCOMezbDAkcN/E+IJCXDI5rKMeZ2WHxyp9UTytYSbn
+/dMi7RfUnndJqaZHVJtSawsk2h/EVgwrWiAdvQJoUQb1C65QM8mXkrvhGvoicxBk
+o+ed7hbdwagAvE8cBxrvKJylIxKZ2yZ3qmrKVzYV25ruj/B/RLBKHFLgDUOoD8dY
+sQxXoxIQXwIDAQABoAAwDQYJKoZIhvcNAQEFBQADggEBAFbg3WrAokoPx7iAYG6z
+PqeDd4/XanXjeL4Ryxv6LoGhu69mmBAd3N5ILPyQJjnkWpIjEmJDzEcPMzhQjRh5
+GlWTyvKWO4zClYU840KZk7crVkpzNZ+HP0YeM/Agz6sab00ffRcq5m1wEF9MCvDE
+8FUXk1HBHRAb/6t9QV/7axsPOkGT8SjQ1v2SCaiB0HQL3sYChYLi5zu4dfmQNPGq
+ar9Xm5a0YqOQIFfmy8RSwxk0Q/ipNFTGN1uvlIRkgbT9zPnodxjWZsSI9BF+q5Af
+uiE/oAk7MxfJ0LyLfhOWB+T98bKIOVtFT3wMLS1IIgMogwqCEXFf30Q9p2iTEzqT
+6UE=
+-----END CERTIFICATE REQUEST-----

letsencrypt-auto-source/tests/certs/localhost/privkey.pem

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEArZYgiLzoyKzhRAdrk+sVtfY8G1Adsje3d6Q3UJ7BGyBD/Zfe
+UJ5aEqavcIlhdWADur/bc85FACK5XrIMbZ1AiuN5qFYJdoKm1OLj2WN9VFNbYjGs
+eR7+IDxOQO5ltYbNUtvxMHzeKkE4PjVKO6iag3gD+S2ch9s2pGqCOMezbDAkcN/E
++IJCXDI5rKMeZ2WHxyp9UTytYSbn/dMi7RfUnndJqaZHVJtSawsk2h/EVgwrWiAd
+vQJoUQb1C65QM8mXkrvhGvoicxBko+ed7hbdwagAvE8cBxrvKJylIxKZ2yZ3qmrK
+VzYV25ruj/B/RLBKHFLgDUOoD8dYsQxXoxIQXwIDAQABAoIBAG8bVJ+xKt6nqVg9
+16HKKw9ZGIfy888K0qgFuFImCzwtntdGycmYUdb2Uf0aMgNK/ZgfDXxGXuwDTdtK
+46GVsaY0i74vs8bjQZ2pzGVsxN+gqzFi0h6Es+w2LXBqJzfVnL6YgPykMB+jtzg6
+K9Wbyaq0uvZXN4XNzl/WvJtTV4i7Cff1MOd5EhKFdqxrZvB/SRBCr/SMMafRtB9P
+EvMneNKzhmlrutHAxuyxEKZR32Kkx7ydAdTjGgn+rE+NL5BweXfeWhLU4Bv14bn9
+Mkneu3w5o1ryJfE2YnVajUP//jeopUT0nTQ3MpEusBQCLBlvFXjjM9uCaFX+5+MP
+0H4xVcECgYEA1Q+wR3GHbk37vIGSlbENyUsri5WlMt8IVAHsDsTOpxAjYB0yyo+x
+h9RS+RJZQECJlA6H72peUl3GM7RgdWIcKOT3nZ12XqYKG57rr/N5zlUuxbdS8KBk
+JhyZeJdYjq/Jrno1ZP+OSmc7VvBLcM7irY7LHlvK0o8W1W0TNJ8jrZkCgYEA0JHX
+lJd+fiezcUS7g4moHtzJp0JKquQiXLX+c2urmpyhb3ZrTuQ8OUjSy6DlwHlgDx8K
+Hg2sdx/ZCuDaGjR4IY/Qs5RFt9WUqlK9gi9V3nYVrzBOQkdFOf/Ad3j4pQ8/aeCX
+nP6snHXz1WqPpbCXG6l6GzFGbQU473GfuKsDuLcCgYAWQaNKc0OQdDj9whNL68ji
+5CVSWXl+TOoTzHeaO1jS/s6TNbmei1AiPj3EovQL0DIO802j5tqfhAg2UntZB7yl
+UPXE0zQQQwv/QqSgJrDsqt1N7g6N8FNF3+rwO+8WSKqqvT1ipYd5ojsCo+tdh18K
+fkYdj70qLaRW+yPsdUtG0QKBgEYc8NqbvsML94+ZKmwCh4iwcf2PFGi0PjTqXTpR
+tKNKCh7dMR+ZLAGZ0HrxgKqeYsNSjOUjdZmqFB1LDyaGAuhNXzwvGOy+mLZVEC3G
+Wdhp28pDs9sl+EiSCBJhkTxzjr656F23YzFJmYlhxB5P6cw7wbeIbgNSIRylFqtO
+mfarAoGBAICsAEWypOctxtmtOcjxgJ7jMbOA7rrsGlXpiy1/WlwIwRGF5LMvIIFX
+qFAfiPcZn05ZgdAGzaFYowdjmQB10FW0jZbDf+nIHfOF5YmfmfWjsaweEGALJmqB
+okGu/lGNGf3XoYzy0/hC3WAqk3znSZtQLUq8jEWF7dLNUizUeUow
+-----END RSA PRIVATE KEY-----

letsencrypt-auto-source/tests/certs/localhost/server.pem

@@ -0,0 +1,46 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEArZYgiLzoyKzhRAdrk+sVtfY8G1Adsje3d6Q3UJ7BGyBD/Zfe
+UJ5aEqavcIlhdWADur/bc85FACK5XrIMbZ1AiuN5qFYJdoKm1OLj2WN9VFNbYjGs
+eR7+IDxOQO5ltYbNUtvxMHzeKkE4PjVKO6iag3gD+S2ch9s2pGqCOMezbDAkcN/E
++IJCXDI5rKMeZ2WHxyp9UTytYSbn/dMi7RfUnndJqaZHVJtSawsk2h/EVgwrWiAd
+vQJoUQb1C65QM8mXkrvhGvoicxBko+ed7hbdwagAvE8cBxrvKJylIxKZ2yZ3qmrK
+VzYV25ruj/B/RLBKHFLgDUOoD8dYsQxXoxIQXwIDAQABAoIBAG8bVJ+xKt6nqVg9
+16HKKw9ZGIfy888K0qgFuFImCzwtntdGycmYUdb2Uf0aMgNK/ZgfDXxGXuwDTdtK
+46GVsaY0i74vs8bjQZ2pzGVsxN+gqzFi0h6Es+w2LXBqJzfVnL6YgPykMB+jtzg6
+K9Wbyaq0uvZXN4XNzl/WvJtTV4i7Cff1MOd5EhKFdqxrZvB/SRBCr/SMMafRtB9P
+EvMneNKzhmlrutHAxuyxEKZR32Kkx7ydAdTjGgn+rE+NL5BweXfeWhLU4Bv14bn9
+Mkneu3w5o1ryJfE2YnVajUP//jeopUT0nTQ3MpEusBQCLBlvFXjjM9uCaFX+5+MP
+0H4xVcECgYEA1Q+wR3GHbk37vIGSlbENyUsri5WlMt8IVAHsDsTOpxAjYB0yyo+x
+h9RS+RJZQECJlA6H72peUl3GM7RgdWIcKOT3nZ12XqYKG57rr/N5zlUuxbdS8KBk
+JhyZeJdYjq/Jrno1ZP+OSmc7VvBLcM7irY7LHlvK0o8W1W0TNJ8jrZkCgYEA0JHX
+lJd+fiezcUS7g4moHtzJp0JKquQiXLX+c2urmpyhb3ZrTuQ8OUjSy6DlwHlgDx8K
+Hg2sdx/ZCuDaGjR4IY/Qs5RFt9WUqlK9gi9V3nYVrzBOQkdFOf/Ad3j4pQ8/aeCX
+nP6snHXz1WqPpbCXG6l6GzFGbQU473GfuKsDuLcCgYAWQaNKc0OQdDj9whNL68ji
+5CVSWXl+TOoTzHeaO1jS/s6TNbmei1AiPj3EovQL0DIO802j5tqfhAg2UntZB7yl
+UPXE0zQQQwv/QqSgJrDsqt1N7g6N8FNF3+rwO+8WSKqqvT1ipYd5ojsCo+tdh18K
+fkYdj70qLaRW+yPsdUtG0QKBgEYc8NqbvsML94+ZKmwCh4iwcf2PFGi0PjTqXTpR
+tKNKCh7dMR+ZLAGZ0HrxgKqeYsNSjOUjdZmqFB1LDyaGAuhNXzwvGOy+mLZVEC3G
+Wdhp28pDs9sl+EiSCBJhkTxzjr656F23YzFJmYlhxB5P6cw7wbeIbgNSIRylFqtO
+mfarAoGBAICsAEWypOctxtmtOcjxgJ7jMbOA7rrsGlXpiy1/WlwIwRGF5LMvIIFX
+qFAfiPcZn05ZgdAGzaFYowdjmQB10FW0jZbDf+nIHfOF5YmfmfWjsaweEGALJmqB
+okGu/lGNGf3XoYzy0/hC3WAqk3znSZtQLUq8jEWF7dLNUizUeUow
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIDKjCCAhICCQDWE0gtDvld0DANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJB
+VTETMBEGA1UECBMKU29tZS1TdGF0ZTEbMBkGA1UEChMSTXkgQm9ndXMgUm9vdCBD
+ZXJ0MRQwEgYDVQQDEwtleGFtcGxlLmNvbTAeFw0xNTEyMDQyMDU0MzFaFw00MDEy
+MDMyMDU0MzFaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEw
+HwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMTCWxvY2Fs
+aG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK2WIIi86Mis4UQH
+a5PrFbX2PBtQHbI3t3ekN1CewRsgQ/2X3lCeWhKmr3CJYXVgA7q/23PORQAiuV6y
+DG2dQIrjeahWCXaCptTi49ljfVRTW2IxrHke/iA8TkDuZbWGzVLb8TB83ipBOD41
+SjuomoN4A/ktnIfbNqRqgjjHs2wwJHDfxPiCQlwyOayjHmdlh8cqfVE8rWEm5/3T
+Iu0X1J53SammR1SbUmsLJNofxFYMK1ogHb0CaFEG9QuuUDPJl5K74Rr6InMQZKPn
+ne4W3cGoALxPHAca7yicpSMSmdsmd6pqylc2Fdua7o/wf0SwShxS4A1DqA/HWLEM
+V6MSEF8CAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAz5sMAFG6W/ZEULZITkBTCU6P
+NttpGiKufnqyBW5HyNylaczfnHnClvQjr8f/84xvKVcfC3xP0lz+92aIQqo+5L/n
+v7gLhBFR4Vr2XwMt2qz2FpkaxmVwnhVAHaaC05WIKQ6W2gDwWT0u1K8YdTh+7mvN
+AT9FW4vDgtNZWq4W/PePh9QCiOOQhGOuBYj/7zqLtz4XPifhi66ILIRDHiu0kond
+3YMFcECIAf4MPT9vT0iNcWX+c8CfAixPt8nMD6bzOo3oTcfuZh/2enfgLbMqOlOi
+uk72FM5VVPXTWAckJvL/vVjqsvDuJQKqbr0oUc3bdWbS36xtWZUycp4IQLguAQ==
+-----END CERTIFICATE-----

letsencrypt-auto-source/tests/fake-letsencrypt/letsencrypt.py

@@ -0,0 +1,8 @@
+from sys import argv, stderr
+
+
+def main():
+    """Act like letsencrypt --version insofar as printing the version number to
+    stderr."""
+    if '--version' in argv:
+        stderr.write('letsencrypt 99.9.9\n')

letsencrypt-auto-source/tests/fake-letsencrypt/setup.py

@@ -0,0 +1,12 @@
+from setuptools import setup
+
+
+setup(
+    name='letsencrypt',
+    version='99.9.9',
+    description='A mock version of letsencrypt that just prints its version',
+    py_modules=['letsencrypt'],
+    entry_points={
+        'console_scripts': ['letsencrypt = letsencrypt:main']
+    }
+)

letsencrypt-auto-source/tests/signing.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAsMoSzLYQ7E1sdSOkwelgtzKIh2qi3bpXuYtcfFC0XrvWig07
+1NwIj+dZiT0OLZ2hPispEH0B7ISuuWg1ll7GhFW0VdbxL6JdGzS2ShNWkX9hE9z+
+j8VqwDPOBn3ZHm03qwpYkBDwQib3KqOdYbTTuUtJmmGcuk3a9Aq/sCT6DdfmTSdP
+5asdQYwIcaQreDrOosaS84DTWI3IU+UYJVglLsIVPBuy9IcgHidUQ96hJnoPsDCW
+sHwX62495QKEarauyKQrJzFes0EY95orDM47Z5o/NDiQB11m91yNB0MmPYY9QSbn
+OA9j7IaaC97AwRLuwXY+/R2ablTcxurWou68iQIDAQABAoIBAQCJE3W2Mqk2f+XL
+geKa1BjAkzcXQJCduYGRhUQlw/HGzoBPtGki56Tf53MeHTAkIGfIq3CAr1zRhiNv
+8SQzvrLQIx/buvhxhcQJdzqsfwgNcqXT3/OliF34P3LMx8GUfPy/6xq2Qdv4fvwA
+nLJH8wyDTKP6RxtdvUY7GSZ+Ln2QQv/3Nco7tax4GHNGom8iSgeH/YKTDnvitdqh
+a0fr930QzU39TfOftLmasdmKUOIg8G2wr4Sy6Kn060+OUoQr1fZF5mnLvvQeILCK
+uav91JkIeMLggzk+t88IJUFWdOoxv5hWTnNzHyt+/GYfovyRz2fKQMwzdh1F8iM5
++867rEb9AoGBANn1ncemJBedDshStdCBUH0+2ExPrawveaXOZKnx8/VGFXNi0hAf
+KzkntMWd5g5kB077FtKO9CYTBvK4pZBWIFLcJEqAz88JeXME6dfUbRucDr72ko+l
+rcLHXj7F0IDVzj/9CphMGAhC9J/4YW9SPcSbMw6dQ6xOk73f1Vowve0DAoGBAM+k
+/F+hVqCS3f22Bg9KuDtx+zCydaZxC842DgIkV1SO2iFhNHjnpQ5EIR0WrSYeV2n+
+rD7kVs5OH1HvnGScHaQKtAVqZClSwF14jzE+Aj8XDwxiHLSOhJgKlzfVX7h1ymMh
+7fsslDl6xNGQ+40gubhkCLT5qABFKy1mrZ8b+3yDAoGAGLGUI6d2FVrM7vM3+Bx+
+gwIYvWSVl5l1XcypaPupmRNMoNsEU6FEY2BVQcJm6yB4F4GpD0f0709ejSdQUq7/
+UIPydKJtaNZ49QgMelBt4B/pJ8eFyVKLAjNWQSRmQAJ5MJS5m5Gbc2wqjOk2GMen
+idvPiAtXPHFWmb9/S42UJwMCgYEAjymAe2qgcGtyNNfIC8kHhqzKdEPGi/ALJKzu
+MZnewEURrcv4QpfrnA9rCUQ2Mz7eJA1bsqz6EJmaTIK4wEFGynA6uDUnQ7pzOL7D
+cz7+i4MZc/89LVvJnY5Hvk4WBfboiDq/etq8g3jatGaSmTYD9la6DhTHORB3eYD+
+meHQHYMCgYEA18y9hnx2k4vNeBei4YXF4pAvKdwKLQD+CcP9ljb3VT+kXktjRA1C
+aWj3HhMwvcxtttfkQzEnwwGRAkTEtNewJ8KFxhmc9nYElZTNZ+SuHD5Dkv8xqoj8
+NvG8rU1eiEyPwE2wQxpM5JLqbo7IWtR0dmptjKoF1gRxn6Wh4TwEiHA=
+-----END RSA PRIVATE KEY-----

letsencrypt-compatibility-test/setup.py

@@ -4,7 +4,7 @@ from setuptools import setup
 from setuptools import find_packages
 
 
-version = '0.2.0.dev0'
+version = '0.4.0.dev0'
 
 install_requires = [
     'letsencrypt=={0}'.format(version),

letsencrypt-nginx/letsencrypt_nginx/configurator.py

@@ -5,7 +5,6 @@ import re
 import shutil
 import socket
 import subprocess
-import sys
 import time
 
 import OpenSSL
@@ -106,11 +105,18 @@ class NginxConfigurator(common.Plugin):
 
     # This is called in determine_authenticator and determine_installer
     def prepare(self):
-        """Prepare the authenticator/installer."""
+        """Prepare the authenticator/installer.
+
+        :raises .errors.NoInstallationError: If Nginx ctl cannot be found
+        :raises .errors.MisconfigurationError: If Nginx is misconfigured
+        """
         # Verify Nginx is installed
         if not le_util.exe_exists(self.conf('ctl')):
             raise errors.NoInstallationError
 
+        # Make sure configuration is valid
+        self.config_test()
+
         self.parser = parser.NginxParser(
             self.conf('server-root'), self.mod_ssl_conf)
 
@@ -233,6 +239,7 @@ class NginxConfigurator(common.Plugin):
 
     def _get_ranked_matches(self, target_name):
         """Returns a ranked list of vhosts that match target_name.
+        The ranking gives preference to SSL vhosts.
 
         :param str target_name: The name to match
         :returns: list of dicts containing the vhost, the matching name, and
@@ -409,26 +416,13 @@ class NginxConfigurator(common.Plugin):
     def config_test(self):  # pylint: disable=no-self-use
         """Check the configuration of Nginx for errors.
 
-        :returns: Success
-        :rtype: bool
+        :raises .errors.MisconfigurationError: If config_test fails
 
         """
         try:
-            proc = subprocess.Popen(
-                [self.conf('ctl'), "-c", self.nginx_conf, "-t"],
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE)
-            stdout, stderr = proc.communicate()
-        except (OSError, ValueError):
-            logger.fatal("Unable to run nginx config test")
-            sys.exit(1)
-
-        if proc.returncode != 0:
-            # Enter recovery routine...
-            logger.error("Config test failed\n%s\n%s", stdout, stderr)
-            return False
-
-        return True
+            le_util.run_script([self.conf('ctl'), "-c", self.nginx_conf, "-t"])
+        except errors.SubprocessError as err:
+            raise errors.MisconfigurationError(str(err))
 
     def _verify_setup(self):
         """Verify the setup to ensure safe operating environment.

letsencrypt-nginx/letsencrypt_nginx/tests/configurator_test.py

@@ -54,6 +54,7 @@ class NginxConfiguratorTest(util.NginxTest):
         mock_exe_exists.return_value = True
 
         self.config.version = None
+        self.config.config_test = mock.Mock()
         self.config.prepare()
         self.assertEquals((1, 6, 2), self.config.version)
 
@@ -361,12 +362,14 @@ class NginxConfiguratorTest(util.NginxTest):
         mock_popen.side_effect = OSError("Can't find program")
         self.assertRaises(errors.MisconfigurationError, self.config.restart)
 
-    @mock.patch("letsencrypt_nginx.configurator.subprocess.Popen")
-    def test_config_test(self, mock_popen):
-        mocked = mock_popen()
-        mocked.communicate.return_value = ('', '')
-        mocked.returncode = 0
-        self.assertTrue(self.config.config_test())
+    @mock.patch("letsencrypt.le_util.run_script")
+    def test_config_test(self, _):
+        self.config.config_test()
+
+    @mock.patch("letsencrypt.le_util.run_script")
+    def test_config_test_bad_process(self, mock_run_script):
+        mock_run_script.side_effect = errors.SubprocessError
+        self.assertRaises(errors.MisconfigurationError, self.config.config_test)
 
     def test_get_snakeoil_paths(self):
         # pylint: disable=protected-access

letsencrypt-nginx/letsencrypt_nginx/tests/util.py

@@ -49,25 +49,26 @@ def get_nginx_configurator(
 
     backups = os.path.join(work_dir, "backups")
 
-    with mock.patch("letsencrypt_nginx.configurator.le_util."
-                    "exe_exists") as mock_exe_exists:
-        mock_exe_exists.return_value = True
-
-        config = configurator.NginxConfigurator(
-            config=mock.MagicMock(
-                nginx_server_root=config_path,
-                le_vhost_ext="-le-ssl.conf",
-                config_dir=config_dir,
-                work_dir=work_dir,
-                backup_dir=backups,
-                temp_checkpoint_dir=os.path.join(work_dir, "temp_checkpoints"),
-                in_progress_dir=os.path.join(backups, "IN_PROGRESS"),
-                server="https://acme-server.org:443/new",
-                tls_sni_01_port=5001,
-            ),
-            name="nginx",
-            version=version)
-        config.prepare()
+    with mock.patch("letsencrypt_nginx.configurator.NginxConfigurator."
+                    "config_test"):
+        with mock.patch("letsencrypt_nginx.configurator.le_util."
+                        "exe_exists") as mock_exe_exists:
+            mock_exe_exists.return_value = True
+            config = configurator.NginxConfigurator(
+                config=mock.MagicMock(
+                    nginx_server_root=config_path,
+                    le_vhost_ext="-le-ssl.conf",
+                    config_dir=config_dir,
+                    work_dir=work_dir,
+                    backup_dir=backups,
+                    temp_checkpoint_dir=os.path.join(work_dir, "temp_checkpoints"),
+                    in_progress_dir=os.path.join(backups, "IN_PROGRESS"),
+                    server="https://acme-server.org:443/new",
+                    tls_sni_01_port=5001,
+                ),
+                name="nginx",
+                version=version)
+            config.prepare()
 
     # Provide general config utility.
     nsconfig = configuration.NamespaceConfig(config.config)

letsencrypt-nginx/setup.py

@@ -4,7 +4,7 @@ from setuptools import setup
 from setuptools import find_packages
 
 
-version = '0.2.0.dev0'
+version = '0.4.0.dev0'
 
 # Please update tox.ini when modifying dependency version requirements
 install_requires = [
@@ -63,4 +63,5 @@ setup(
             'nginx = letsencrypt_nginx.configurator:NginxConfigurator',
         ],
     },
+    test_suite='letsencrypt_nginx',
 )

letsencrypt/__init__.py

@@ -1,4 +1,4 @@
 """Let's Encrypt client."""
 
 # version number like 1.2.3a0, must have at least 2 parts, like 1.2
-__version__ = '0.2.0.dev0'
+__version__ = '0.4.0.dev0'

letsencrypt/cli.py

@@ -44,6 +44,15 @@ from letsencrypt.plugins import disco as plugins_disco
 
 logger = logging.getLogger(__name__)
 
+# For help strings, figure out how the user ran us.
+# When invoked from letsencrypt-auto, sys.argv[0] is something like:
+# "/home/user/.local/share/letsencrypt/bin/letsencrypt"
+# Note that this won't work if the user set VENV_PATH or XDG_DATA_HOME before running
+# letsencrypt-auto (and sudo stops us from seeing if they did), so it should only be used
+# for purposes where inability to detect letsencrypt-auto fails safely
+
+fragment = os.path.join(".local", "share", "letsencrypt")
+cli_command = "letsencrypt-auto" if fragment in sys.argv[0] else "letsencrypt"
 
 # Argparse's help formatting has a lot of unhelpful peculiarities, so we want
 # to replace as much of it as we can...
@@ -51,7 +60,7 @@ logger = logging.getLogger(__name__)
 # This is the stub to include in help generated by argparse
 
 SHORT_USAGE = """
-  letsencrypt [SUBCOMMAND] [options] [-d domain] [-d domain] ...
+  {0} [SUBCOMMAND] [options] [-d domain] [-d domain] ...
 
 The Let's Encrypt agent can obtain and install HTTPS/TLS/SSL certificates.  By
 default, it will attempt to use a webserver both for obtaining and installing
@@ -65,7 +74,7 @@ the cert. Major SUBCOMMANDS are:
   config_changes       Show changes made to server config during installation
   plugins              Display information about installed plugins
 
-"""
+""".format(cli_command)
 
 # This is the short help for letsencrypt --help, where we disable argparse
 # altogether
@@ -155,12 +164,14 @@ def _determine_account(args, config):
                        "must agree in order to register with the ACME "
                        "server at {1}".format(
                            regr.terms_of_service, config.server))
-                return zope.component.getUtility(interfaces.IDisplay).yesno(
-                    msg, "Agree", "Cancel")
+                obj = zope.component.getUtility(interfaces.IDisplay)
+                return obj.yesno(msg, "Agree", "Cancel", cli_flag="--agree-tos")
 
             try:
                 acc, acme = client.register(
                     config, account_storage, tos_cb=_tos_cb)
+            except errors.MissingCommandlineFlag:
+                raise
             except errors.Error as error:
                 logger.debug(error, exc_info=True)
                 raise errors.Error(
@@ -194,6 +205,8 @@ def _find_duplicative_certs(config, domains):
     le_util.make_or_verify_dir(configs_dir, mode=0o755, uid=os.geteuid())
 
     for renewal_file in os.listdir(configs_dir):
+        if not renewal_file.endswith(".conf"):
+            continue
         try:
             full_path = os.path.join(configs_dir, renewal_file)
             candidate_lineage = storage.RenewableCert(full_path, cli_config)
@@ -280,7 +293,7 @@ def _handle_identical_cert_request(config, cert):
                "Cancel this operation and do nothing"]
 
     display = zope.component.getUtility(interfaces.IDisplay)
-    response = display.menu(question, choices, "OK", "Cancel")
+    response = display.menu(question, choices, "OK", "Cancel", default=0)
     if response[0] == "cancel" or response[1] == 2:
         # TODO: Add notification related to command-line options for
         #       skipping the menu for this case.
@@ -315,7 +328,8 @@ def _handle_subset_cert_request(config, domains, cert):
              ", ".join(domains),
              br=os.linesep)
     if config.expand or config.renew_by_default or zope.component.getUtility(
-            interfaces.IDisplay).yesno(question, "Expand", "Cancel"):
+            interfaces.IDisplay).yesno(question, "Expand", "Cancel",
+                                       cli_flag="--expand (or in some cases, --duplicate)"):
         return "renew", cert
     else:
         reporter_util = zope.component.getUtility(interfaces.IReporter)
@@ -382,7 +396,7 @@ def _auth_from_domains(le_client, config, domains):
     if action == "reinstall":
         # The lineage already exists; allow the caller to try installing
         # it without getting a new certificate at all.
-        return lineage
+        return lineage, "reinstall"
     elif action == "renew":
         original_server = lineage.configuration["renewalparams"]["server"]
         _avoid_invalidating_lineage(config, lineage, original_server)
@@ -407,7 +421,7 @@ def _auth_from_domains(le_client, config, domains):
 
     _report_new_cert(lineage.cert, lineage.fullchain)
 
-    return lineage
+    return lineage, action
 
 def _avoid_invalidating_lineage(config, lineage, original_server):
     "Do not renew a valid cert with one from a staging server!"
@@ -431,21 +445,6 @@ def _avoid_invalidating_lineage(config, lineage, original_server):
                     "a test certificate (domains: {0}). We will not do that "
                     "unless you use the --break-my-certs flag!".format(names))
 
-def set_configurator(previously, now):
-    """
-    Setting configurators multiple ways is okay, as long as they all agree
-    :param str previously: previously identified request for the installer/authenticator
-    :param str requested: the request currently being processed
-    """
-    if now is None:
-        # we're not actually setting anything
-        return previously
-    if previously:
-        if previously != now:
-            msg = "Too many flags setting configurators/installers/authenticators {0} -> {1}"
-            raise errors.PluginSelectionError(msg.format(repr(previously), repr(now)))
-    return now
-
 
 def diagnose_configurator_problem(cfg_type, requested, plugins):
     """
@@ -479,22 +478,28 @@ def diagnose_configurator_problem(cfg_type, requested, plugins):
     raise errors.PluginSelectionError(msg)
 
 
-def choose_configurator_plugins(args, config, plugins, verb):  # pylint: disable=too-many-branches
+def set_configurator(previously, now):
     """
-    Figure out which configurator we're going to use
-    :raises error.PluginSelectionError if there was a problem
+    Setting configurators multiple ways is okay, as long as they all agree
+    :param str previously: previously identified request for the installer/authenticator
+    :param str requested: the request currently being processed
     """
+    if now is None:
+        # we're not actually setting anything
+        return previously
+    if previously:
+        if previously != now:
+            msg = "Too many flags setting configurators/installers/authenticators {0} -> {1}"
+            raise errors.PluginSelectionError(msg.format(repr(previously), repr(now)))
+    return now
 
-    # Which plugins do we need?
-    need_inst = need_auth = (verb == "run")
-    if verb == "certonly":
-        need_auth = True
-    if verb == "install":
-        need_inst = True
-        if args.authenticator:
-            logger.warn("Specifying an authenticator doesn't make sense in install mode")
+def cli_plugin_requests(args):
+    """
+    Figure out which plugins the user requested with CLI and config options
 
-    # Which plugins did the user request?
+    :returns: (requested authenticator string or None, requested installer string or None)
+    :rtype: tuple
+    """
     req_inst = req_auth = args.configurator
     req_inst = set_configurator(req_inst, args.installer)
     req_auth = set_configurator(req_auth, args.authenticator)
@@ -511,6 +516,40 @@ def choose_configurator_plugins(args, config, plugins, verb):  # pylint: disable
     if args.manual:
         req_auth = set_configurator(req_auth, "manual")
     logger.debug("Requested authenticator %s and installer %s", req_auth, req_inst)
+    return req_auth, req_inst
+
+
+noninstaller_plugins = ["webroot", "manual", "standalone"]
+
+def choose_configurator_plugins(args, config, plugins, verb):
+    """
+    Figure out which configurator we're going to use
+    :raises errors.PluginSelectionError if there was a problem
+    """
+
+    req_auth, req_inst = cli_plugin_requests(args)
+
+    # Which plugins do we need?
+    if verb == "run":
+        need_inst = need_auth = True
+        if req_auth in noninstaller_plugins and not req_inst:
+            msg = ('With the {0} plugin, you probably want to use the "certonly" command, eg:{1}'
+                   '{1}    {2} certonly --{0}{1}{1}'
+                   '(Alternatively, add a --installer flag. See https://eff.org/letsencrypt-plugins'
+                   '{1} and "--help plugins" for more information.)'.format(
+                   req_auth, os.linesep, cli_command))
+
+            raise errors.MissingCommandlineFlag, msg
+    else:
+        need_inst = need_auth = False
+    if verb == "certonly":
+        need_auth = True
+    if verb == "install":
+        need_inst = True
+        if args.authenticator:
+            logger.warn("Specifying an authenticator doesn't make sense in install mode")
+
+
 
     # Try to meet the user's request and/or ask them to pick plugins
     authenticator = installer = None
@@ -556,7 +595,7 @@ def run(args, config, plugins):  # pylint: disable=too-many-branches,too-many-lo
     # TODO: Handle errors from _init_le_client?
     le_client = _init_le_client(args, config, authenticator, installer)
 
-    lineage = _auth_from_domains(le_client, config, domains)
+    lineage, action = _auth_from_domains(le_client, config, domains)
 
     le_client.deploy_certificate(
         domains, lineage.privkey, lineage.cert,
@@ -567,7 +606,7 @@ def run(args, config, plugins):  # pylint: disable=too-many-branches,too-many-lo
     if len(lineage.available_versions("cert")) == 1:
         display_ops.success_installation(domains)
     else:
-        display_ops.success_renewal(domains)
+        display_ops.success_renewal(domains, action)
 
     _suggest_donate()
 
@@ -605,6 +644,8 @@ def obtain_cert(args, config, plugins):
 def install(args, config, plugins):
     """Install a previously obtained cert in a server."""
     # XXX: Update for renewer/RenewableCert
+    # FIXME: be consistent about whether errors are raised or returned from
+    # this function ...
 
     try:
         installer, _ = choose_configurator_plugins(args, config,
@@ -946,6 +987,12 @@ def prepare_and_parse_args(plugins, args):
     helpful.add(
         None, "-t", "--text", dest="text_mode", action="store_true",
         help="Use the text output instead of the curses UI.")
+    helpful.add(
+        None, "-n", "--non-interactive", "--noninteractive",
+        dest="noninteractive_mode", action="store_true",
+        help="Run without ever asking for user input. This may require "
+              "additional command line flags; the client will try to explain "
+              "which ones are required if it finds one missing")
     helpful.add(
         None, "--register-unsafely-without-email", action="store_true",
         help="Specifying this flag enables registering an account with no "
@@ -998,6 +1045,13 @@ def prepare_and_parse_args(plugins, args):
         "automation", "--duplicate", dest="duplicate", action="store_true",
         help="Allow making a certificate lineage that duplicates an existing one "
              "(both can be renewed in parallel)")
+    helpful.add(
+        "automation", "--os-packages-only", action="store_true",
+        help="(letsencrypt-auto only) install OS package dependencies and then stop")
+    helpful.add(
+        "automation", "--no-self-upgrade", action="store_true",
+        help="(letsencrypt-auto only) prevent the letsencrypt-auto script from"
+             " upgrading itself to newer released versions")
 
     helpful.add_group(
         "testing", description="The following flags are meant for "
@@ -1086,7 +1140,8 @@ def _create_subparsers(helpful):
                 "--csr", type=read_file,
                 help="Path to a Certificate Signing Request (CSR) in DER"
                 " format; note that the .csr file *must* contain a Subject"
-                " Alternative Name field for each domain you want certified.")
+                " Alternative Name field for each domain you want certified."
+                " Currently --csr only works with the 'certonly' subcommand'")
     helpful.add("rollback",
                 "--checkpoints", type=int, metavar="N",
                 default=flag_default("rollback_checkpoints"),
@@ -1159,9 +1214,8 @@ def _plugins_parsing(helpful, plugins):
         "plugins", description="Let's Encrypt client supports an "
         "extensible plugins architecture. See '%(prog)s plugins' for a "
         "list of all installed plugins and their names. You can force "
-        "a particular plugin by setting options provided below. Further "
-        "down this help message you will find plugin-specific options "
-        "(prefixed by --{plugin_name}).")
+        "a particular plugin by setting options provided below. Running "
+        "--help <plugin_name> will list flags specific to that plugin.")
     helpful.add(
         "plugins", "-a", "--authenticator", help="Authenticator plugin name.")
     helpful.add(
@@ -1373,7 +1427,9 @@ def main(cli_args=sys.argv[1:]):
     sys.excepthook = functools.partial(_handle_exception, args=args)
 
     # Displayer
-    if args.text_mode:
+    if args.noninteractive_mode:
+        displayer = display_util.NoninteractiveDisplay(sys.stdout)
+    elif args.text_mode:
         displayer = display_util.FileDisplay(sys.stdout)
     else:
         displayer = display_util.NcursesDisplay()

letsencrypt/display/enhancements.py

@@ -48,7 +48,7 @@ def redirect_by_default():
 
     code, selection = util(interfaces.IDisplay).menu(
         "Please choose whether HTTPS access is required or optional.",
-        choices)
+        choices, default=0, cli_flag="--redirect / --no-redirect")
 
     if code != display_util.OK:
         return False

letsencrypt/display/ops.py

@@ -31,8 +31,8 @@ def choose_plugin(prepared, question):
             for plugin_ep in prepared]
 
     while True:
-        code, index = util(interfaces.IDisplay).menu(
-            question, opts, help_label="More Info")
+        disp = util(interfaces.IDisplay)
+        code, index = disp.menu(question, opts, help_label="More Info")
 
         if code == display_util.OK:
             plugin_ep = prepared[index]
@@ -74,6 +74,16 @@ def pick_plugin(config, default, plugins, question, ifaces):
         # throw more UX-friendly error if default not in plugins
         filtered = plugins.filter(lambda p_ep: p_ep.name == default)
     else:
+        if config.noninteractive_mode:
+            # it's really bad to auto-select the single available plugin in
+            # non-interactive mode, because an update could later add a second
+            # available plugin
+            raise errors.MissingCommandlineFlag, ("Missing command line flags. For non-interactive "
+                "execution, you will need to specify a plugin on the command line.  Run with "
+                "'--help plugins' to see a list of options, and see "
+                " https://eff.org/letsencrypt-plugins for more detail on what the plugins "
+                "do and how to use them.")
+
         filtered = plugins.visible().ifaces(ifaces)
 
     filtered.init(config)
@@ -143,7 +153,12 @@ def get_email(more=False, invalid=False):
         msg += ('\n\nIf you really want to skip this, you can run the client with '
                 '--register-unsafely-without-email but make sure you backup your '
                 'account key from /etc/letsencrypt/accounts\n\n')
-    code, email = zope.component.getUtility(interfaces.IDisplay).input(msg)
+    try:
+        code, email = zope.component.getUtility(interfaces.IDisplay).input(msg)
+    except errors.MissingCommandlineFlag:
+        msg = ("You should register before running non-interactively, or provide --agree-tos"
+               " and --email <email_address> flags")
+        raise errors.MissingCommandlineFlag, msg
 
     if code == display_util.OK:
         if le_util.safe_email(email):
@@ -197,7 +212,8 @@ def choose_names(installer):
             "specify ServerNames in your config files in order to allow for "
             "accurate installation of your certificate.{0}"
             "If you do use the default vhost, you may specify the name "
-            "manually. Would you like to continue?{0}".format(os.linesep))
+            "manually. Would you like to continue?{0}".format(os.linesep),
+            default=True)
 
         if manual:
             return _choose_names_manually()
@@ -242,7 +258,7 @@ def _filter_names(names):
     """
     code, names = util(interfaces.IDisplay).checklist(
         "Which names would you like to activate HTTPS for?",
-        tags=names)
+        tags=names, cli_flag="--domains")
     return code, [str(s) for s in names]
 
 
@@ -250,7 +266,8 @@ def _choose_names_manually():
     """Manually input names for those without an installer."""
 
     code, input_ = util(interfaces.IDisplay).input(
-        "Please enter in your domain name(s) (comma and/or space separated) ")
+        "Please enter in your domain name(s) (comma and/or space separated) ",
+        cli_flag="--domains")
 
     if code == display_util.OK:
         invalid_domains = dict()
@@ -309,22 +326,24 @@ def success_installation(domains):
         pause=False)
 
 
-def success_renewal(domains):
+def success_renewal(domains, action):
     """Display a box confirming the renewal of an existing certificate.
 
     .. todo:: This should be centered on the screen
 
     :param list domains: domain names which were renewed
+    :param str action: can be "reinstall" or "renew"
 
     """
     util(interfaces.IDisplay).notification(
-        "Your existing certificate has been successfully renewed, and the "
+        "Your existing certificate has been successfully {3}ed, and the "
         "new certificate has been installed.{1}{1}"
         "The new certificate covers the following domains: {0}{1}{1}"
         "You should test your configuration at:{1}{2}".format(
             _gen_https_names(domains),
             os.linesep,
-            os.linesep.join(_gen_ssl_lab_urls(domains))),
+            os.linesep.join(_gen_ssl_lab_urls(domains)),
+            action),
         height=(14 + len(domains)),
         pause=False)
 

letsencrypt/display/util.py

@@ -6,7 +6,7 @@ import dialog
 import zope.interface
 
 from letsencrypt import interfaces
-
+from letsencrypt import errors
 
 WIDTH = 72
 HEIGHT = 20
@@ -21,6 +21,20 @@ CANCEL = "cancel"
 HELP = "help"
 """Display exit code when for when the user requests more help."""
 
+def _wrap_lines(msg):
+    """Format lines nicely to 80 chars.
+
+    :param str msg: Original message
+
+    :returns: Formatted message respecting newlines in message
+    :rtype: str
+
+    """
+    lines = msg.splitlines()
+    fixed_l = []
+    for line in lines:
+        fixed_l.append(textwrap.fill(line, 80))
+    return os.linesep.join(fixed_l)
 
 class NcursesDisplay(object):
     """Ncurses-based display."""
@@ -49,8 +63,8 @@ class NcursesDisplay(object):
         """
         self.dialog.msgbox(message, height, width=self.width)
 
-    def menu(self, message, choices,
-             ok_label="OK", cancel_label="Cancel", help_label=""):
+    def menu(self, message, choices, ok_label="OK", cancel_label="Cancel",
+             help_label="", **unused_kwargs):
         """Display a menu.
 
         :param str message: title of menu
@@ -61,10 +75,11 @@ class NcursesDisplay(object):
 
         :param str ok_label: label of the OK button
         :param str help_label: label of the help button
+        :param dict unused_kwargs: absorbs default / cli_args
 
-        :returns: tuple of the form (`code`, `tag`) where
-            `code` - `str` display_util exit code
-            `tag` - `int` index corresponding to the item chosen
+        :returns: tuple of the form (`code`, `index`) where
+            `code` - int display exit code
+            `int` - index of the selected item
         :rtype: tuple
 
         """
@@ -97,20 +112,21 @@ class NcursesDisplay(object):
                 (str(i), choice) for i, choice in enumerate(choices, 1)
             ]
             # pylint: disable=star-args
-            code, tag = self.dialog.menu(message, **menu_options)
+            code, index = self.dialog.menu(message, **menu_options)
 
             if code == CANCEL:
                 return code, -1
 
-            return code, int(tag) - 1
+            return code, int(index) - 1
 
 
-    def input(self, message):
+    def input(self, message, **unused_kwargs):
         """Display an input box to the user.
 
         :param str message: Message to display that asks for input.
+        :param dict _kwargs: absorbs default / cli_args
 
-        :returns: tuple of the form (code, string) where
+        :returns: tuple of the form (`code`, `string`) where
             `code` - int display exit code
             `string` - input entered by the user
 
@@ -122,7 +138,7 @@ class NcursesDisplay(object):
         return self.dialog.inputbox(message, width=self.width, height=height)
 
 
-    def yesno(self, message, yes_label="Yes", no_label="No"):
+    def yesno(self, message, yes_label="Yes", no_label="No", **unused_kwargs):
         """Display a Yes/No dialog box.
 
         Yes and No label must begin with different letters.
@@ -130,6 +146,7 @@ class NcursesDisplay(object):
         :param str message: message to display to user
         :param str yes_label: label on the "yes" button
         :param str no_label: label on the "no" button
+        :param dict _kwargs: absorbs default / cli_args
 
         :returns: if yes_label was selected
         :rtype: bool
@@ -139,16 +156,17 @@ class NcursesDisplay(object):
             message, self.height, self.width,
             yes_label=yes_label, no_label=no_label)
 
-    def checklist(self, message, tags, default_status=True):
+    def checklist(self, message, tags, default_status=True, **unused_kwargs):
         """Displays a checklist.
 
         :param message: Message to display before choices
         :param list tags: where each is of type :class:`str` len(tags) > 0
         :param bool default_status: If True, items are in a selected state by
             default.
+        :param dict _kwargs: absorbs default / cli_args
 
 
-        :returns: tuple of the form (code, list_tags) where
+        :returns: tuple of the form (`code`, `list_tags`) where
             `code` - int display exit code
             `list_tags` - list of str tags selected by the user
 
@@ -178,15 +196,15 @@ class FileDisplay(object):
 
         """
         side_frame = "-" * 79
-        message = self._wrap_lines(message)
+        message = _wrap_lines(message)
         self.outfile.write(
             "{line}{frame}{line}{msg}{line}{frame}{line}".format(
                 line=os.linesep, frame=side_frame, msg=message))
         if pause:
             raw_input("Press Enter to Continue")
 
-    def menu(self, message, choices,
-             ok_label="", cancel_label="", help_label=""):
+    def menu(self, message, choices, ok_label="", cancel_label="",
+             help_label="", **unused_kwargs):
         # pylint: disable=unused-argument
         """Display a menu.
 
@@ -197,10 +215,12 @@ class FileDisplay(object):
         :param choices: Menu lines, len must be > 0
         :type choices: list of tuples (tag, item) or
             list of descriptions (tags will be enumerated)
+        :param dict _kwargs: absorbs default / cli_args
+
+        :returns: tuple of (`code`, `index`) where
+            `code` - str display exit code
+            `index` - int index of the user's selection
 
-        :returns: tuple of the form (code, tag) where
-            code - int display exit code
-            tag - str corresponding to the item chosen
         :rtype: tuple
 
         """
@@ -210,11 +230,12 @@ class FileDisplay(object):
 
         return code, selection - 1
 
-    def input(self, message):
+    def input(self, message, **unused_kwargs):
         # pylint: disable=no-self-use
         """Accept input from the user.
 
         :param str message: message to display to the user
+        :param dict _kwargs: absorbs default / cli_args
 
         :returns: tuple of (`code`, `input`) where
             `code` - str display exit code
@@ -230,7 +251,7 @@ class FileDisplay(object):
         else:
             return OK, ans
 
-    def yesno(self, message, yes_label="Yes", no_label="No"):
+    def yesno(self, message, yes_label="Yes", no_label="No", **unused_kwargs):
         """Query the user with a yes/no question.
 
         Yes and No label must begin with different letters, and must contain at
@@ -239,6 +260,7 @@ class FileDisplay(object):
         :param str message: question for the user
         :param str yes_label: Label of the "Yes" parameter
         :param str no_label: Label of the "No" parameter
+        :param dict _kwargs: absorbs default / cli_args
 
         :returns: True for "Yes", False for "No"
         :rtype: bool
@@ -246,7 +268,7 @@ class FileDisplay(object):
         """
         side_frame = ("-" * 79) + os.linesep
 
-        message = self._wrap_lines(message)
+        message = _wrap_lines(message)
 
         self.outfile.write("{0}{frame}{msg}{0}{frame}".format(
             os.linesep, frame=side_frame, msg=message))
@@ -265,13 +287,14 @@ class FileDisplay(object):
                     ans.startswith(no_label[0].upper())):
                 return False
 
-    def checklist(self, message, tags, default_status=True):
+    def checklist(self, message, tags, default_status=True, **unused_kwargs):
         # pylint: disable=unused-argument
         """Display a checklist.
 
         :param str message: Message to display to user
         :param list tags: `str` tags to select, len(tags) > 0
         :param bool default_status: Not used for FileDisplay
+        :param dict _kwargs: absorbs default / cli_args
 
         :returns: tuple of (`code`, `tags`) where
             `code` - str display exit code
@@ -352,21 +375,6 @@ class FileDisplay(object):
 
         self.outfile.write(side_frame)
 
-    def _wrap_lines(self, msg):  # pylint: disable=no-self-use
-        """Format lines nicely to 80 chars.
-
-        :param str msg: Original message
-
-        :returns: Formatted message respecting newlines in message
-        :rtype: str
-
-        """
-        lines = msg.splitlines()
-        fixed_l = []
-        for line in lines:
-            fixed_l.append(textwrap.fill(line, 80))
-
-        return os.linesep.join(fixed_l)
 
     def _get_valid_int_ans(self, max_):
         """Get a numerical selection.
@@ -403,6 +411,118 @@ class FileDisplay(object):
 
         return OK, selection
 
+class NoninteractiveDisplay(object):
+    """An iDisplay implementation that never asks for interactive user input"""
+
+    zope.interface.implements(interfaces.IDisplay)
+
+    def __init__(self, outfile):
+        super(NoninteractiveDisplay, self).__init__()
+        self.outfile = outfile
+
+    def _interaction_fail(self, message, cli_flag, extra=""):
+        "Error out in case of an attempt to interact in noninteractive mode"
+        msg = "Missing command line flag or config entry for this setting:\n"
+        msg += message
+        if extra:
+            msg += "\n" + extra
+        if cli_flag:
+            msg += "\n\n(You can set this with the {0} flag)".format(cli_flag)
+        raise errors.MissingCommandlineFlag, msg
+
+    def notification(self, message, height=10, pause=False):
+        # pylint: disable=unused-argument
+        """Displays a notification without waiting for user acceptance.
+
+        :param str message: Message to display to stdout
+        :param int height: No effect for NoninteractiveDisplay
+        :param bool pause: The NoninteractiveDisplay waits for no keyboard
+
+        """
+        side_frame = "-" * 79
+        message = _wrap_lines(message)
+        self.outfile.write(
+            "{line}{frame}{line}{msg}{line}{frame}{line}".format(
+                line=os.linesep, frame=side_frame, msg=message))
+
+    def menu(self, message, choices, ok_label=None, cancel_label=None,
+             default=None, cli_flag=None):
+        # pylint: disable=unused-argument,too-many-arguments
+        """Avoid displaying a menu.
+
+        :param str message: title of menu
+        :param choices: Menu lines, len must be > 0
+        :type choices: list of tuples (tag, item) or
+            list of descriptions (tags will be enumerated)
+        :param int default: the default choice
+        :param dict kwargs: absorbs various irrelevant labelling arguments
+
+        :returns: tuple of (`code`, `index`) where
+            `code` - str display exit code
+            `index` - int index of the user's selection
+        :rtype: tuple
+        :raises errors.MissingCommandlineFlag: if there was no default
+
+        """
+        if default is None:
+            self._interaction_fail(message, cli_flag, "Choices: " + repr(choices))
+
+        return OK, default
+
+    def input(self, message, default=None, cli_flag=None):
+        """Accept input from the user.
+
+        :param str message: message to display to the user
+
+        :returns: tuple of (`code`, `input`) where
+            `code` - str display exit code
+            `input` - str of the user's input
+        :rtype: tuple
+        :raises errors.MissingCommandlineFlag: if there was no default
+
+        """
+        if default is None:
+            self._interaction_fail(message, cli_flag)
+        else:
+            return OK, default
+
+
+    def yesno(self, message, yes_label=None, no_label=None, default=None, cli_flag=None):
+        # pylint: disable=unused-argument
+        """Decide Yes or No, without asking anybody
+
+        :param str message: question for the user
+        :param dict kwargs: absorbs yes_label, no_label
+
+        :raises errors.MissingCommandlineFlag: if there was no default
+        :returns: True for "Yes", False for "No"
+        :rtype: bool
+
+        """
+        if default is None:
+            self._interaction_fail(message, cli_flag)
+        else:
+            return default
+
+    def checklist(self, message, tags, default=None, cli_flag=None, **kwargs):
+        # pylint: disable=unused-argument
+        """Display a checklist.
+
+        :param str message: Message to display to user
+        :param list tags: `str` tags to select, len(tags) > 0
+        :param dict kwargs: absorbs default_status arg
+
+        :returns: tuple of (`code`, `tags`) where
+            `code` - str display exit code
+            `tags` - list of selected tags
+        :rtype: tuple
+
+        """
+        if default is None:
+            self._interaction_fail(message, cli_flag, "? ".join(tags))
+        else:
+            return OK, default
+
 
 def separate_list_input(input_):
     """Separate a comma or space separated list.

letsencrypt/errors.py

@@ -102,3 +102,8 @@ class StandaloneBindError(Error):
 
 class ConfigurationError(Error):
     """Configuration sanity error."""
+
+# NoninteractiveDisplay iDisplay plugin error:
+
+class MissingCommandlineFlag(Error):
+    """A command line argument was missing in noninteractive usage"""

letsencrypt/interfaces.py

@@ -365,8 +365,8 @@ class IDisplay(zope.interface.Interface):
 
         """
 
-    def menu(message, choices,
-             ok_label="OK", cancel_label="Cancel", help_label=""):
+    def menu(message, choices, ok_label="OK",      # pylint: disable=too-many-arguments
+             cancel_label="Cancel", help_label="", default=None, cli_flag=None):
         """Displays a generic menu.
 
         :param str message: message to display
@@ -377,14 +377,19 @@ class IDisplay(zope.interface.Interface):
         :param str ok_label: label for OK button
         :param str cancel_label: label for Cancel button
         :param str help_label: label for Help button
+        :param int default: default (non-interactive) choice from the menu
+        :param str cli_flag: to automate choice from the menu, eg "--keep"
 
         :returns: tuple of (`code`, `index`) where
             `code` - str display exit code
             `index` - int index of the user's selection
 
+        :raises errors.MissingCommandlineFlag: if called in non-interactive
+            mode without a default set
+
         """
 
-    def input(message):
+    def input(message, default=None, cli_args=None):
         """Accept input from the user.
 
         :param str message: message to display to the user
@@ -394,27 +399,45 @@ class IDisplay(zope.interface.Interface):
             `input` - str of the user's input
         :rtype: tuple
 
+        :raises errors.MissingCommandlineFlag: if called in non-interactive
+            mode without a default set
+
         """
 
-    def yesno(message, yes_label="Yes", no_label="No"):
+    def yesno(message, yes_label="Yes", no_label="No", default=None,
+              cli_args=None):
         """Query the user with a yes/no question.
 
         Yes and No label must begin with different letters.
 
         :param str message: question for the user
+        :param str default: default (non-interactive) choice from the menu
+        :param str cli_flag: to automate choice from the menu, eg "--redirect / --no-redirect"
 
         :returns: True for "Yes", False for "No"
         :rtype: bool
 
+        :raises errors.MissingCommandlineFlag: if called in non-interactive
+            mode without a default set
+
         """
 
-    def checklist(message, tags, default_state):
+    def checklist(message, tags, default_state, default=None, cli_args=None):
         """Allow for multiple selections from a menu.
 
         :param str message: message to display to the user
         :param list tags: where each is of type :class:`str` len(tags) > 0
-        :param bool default_status: If True, items are in a selected state by
-            default.
+        :param bool default_status: If True, items are in a selected state by default.
+        :param str default: default (non-interactive) state of the checklist
+        :param str cli_flag: to automate choice from the menu, eg "--domains"
+
+        :returns: tuple of the form (code, list_tags) where
+            `code` - int display exit code
+            `list_tags` - list of str tags selected by the user
+        :rtype: tuple
+
+        :raises errors.MissingCommandlineFlag: if called in non-interactive
+            mode without a default set
 
         """
 

letsencrypt/plugins/manual.py

@@ -165,7 +165,8 @@ s.serve_forever()" """
         else:
             if not self.conf("public-ip-logging-ok"):
                 if not zope.component.getUtility(interfaces.IDisplay).yesno(
-                        self.IP_DISCLAIMER, "Yes", "No"):
+                        self.IP_DISCLAIMER, "Yes", "No",
+                        cli_flag="--manual-public-ip-logging-ok"):
                     raise errors.PluginError("Must agree to IP logging to proceed")
 
             self._notify_and_wait(self.MESSAGE_TEMPLATE.format(

letsencrypt/plugins/webroot.py

@@ -98,8 +98,8 @@ to serve all files under specified web root ({0})."""
     def _path_for_achall(self, achall):
         try:
             path = self.full_roots[achall.domain]
-        except IndexError:
-            raise errors.PluginError("Missing --webroot-path for domain: {1}"
+        except KeyError:
+            raise errors.PluginError("Missing --webroot-path for domain: {0}"
                                      .format(achall.domain))
         if not os.path.exists(path):
             raise errors.PluginError("Mysteriously missing path {0} for domain: {1}"

letsencrypt/plugins/webroot_test.py

@@ -111,6 +111,18 @@ class AuthenticatorTest(unittest.TestCase):
         self.assertEqual(os.stat(self.validation_path).st_gid, parent_gid)
         self.assertEqual(os.stat(self.validation_path).st_uid, parent_uid)
 
+    def test_perform_missing_path(self):
+        self.auth.prepare()
+
+        missing_achall = achallenges.KeyAuthorizationAnnotatedChallenge(
+            challb=acme_util.HTTP01_P, domain="thing2.com", account_key=KEY)
+        self.assertRaises(
+            errors.PluginError, self.auth.perform, [missing_achall])
+
+        self.auth.full_roots[self.achall.domain] = 'null'
+        self.assertRaises(
+            errors.PluginError, self.auth.perform, [self.achall])
+
     def test_perform_cleanup(self):
         self.auth.prepare()
         responses = self.auth.perform([self.achall])

letsencrypt/renewer.py

@@ -172,6 +172,8 @@ def main(cli_args=sys.argv[1:]):
                                constants.CONFIG_DIRS_MODE, uid)
 
     for renewal_file in os.listdir(cli_config.renewal_configs_dir):
+        if not renewal_file.endswith(".conf"):
+            continue
         print("Processing " + renewal_file)
         try:
             # TODO: Before trying to initialize the RenewableCert object,

letsencrypt/tests/cli_test.py

@@ -81,7 +81,7 @@ class CLITest(unittest.TestCase):  # pylint: disable=too-many-public-methods
             self.assertEqual(1, mock_run.call_count)
 
     def _help_output(self, args):
-        "Run a help command, and return the help string for scrutiny"
+        "Run a command, and return the ouput string for scrutiny"
         output = StringIO.StringIO()
         with mock.patch('letsencrypt.cli.sys.stdout', new=output):
             self.assertRaises(SystemExit, self._call_stdout, args)
@@ -105,6 +105,7 @@ class CLITest(unittest.TestCase):  # pylint: disable=too-many-public-methods
         self.assertTrue("--checkpoints" not in out)
 
         out = self._help_output(['-h'])
+        self.assertTrue("letsencrypt-auto" not in out) # test cli.cli_command
         if "nginx" in plugins:
             self.assertTrue("Use the Nginx plugin" in out)
         else:
@@ -130,16 +131,39 @@ class CLITest(unittest.TestCase):  # pylint: disable=too-many-public-methods
         out = self._help_output(['-h'])
         self.assertTrue(cli.usage_strings(plugins)[0] in out)
 
+
+    def _cli_missing_flag(self, args, message):
+        "Ensure that a particular error raises a missing cli flag error containing message"
+        exc = None
+        try:
+            with mock.patch('letsencrypt.cli.sys.stderr'):
+                cli.main(self.standard_args + args[:])  # NOTE: parser can alter its args!
+        except errors.MissingCommandlineFlag, exc:
+            self.assertTrue(message in str(exc))
+        self.assertTrue(exc is not None)
+
+    def test_noninteractive(self):
+        args = ['-n', 'certonly']
+        self._cli_missing_flag(args, "specify a plugin")
+        args.extend(['--standalone', '-d', 'eg.is'])
+        self._cli_missing_flag(args, "register before running")
+        with mock.patch('letsencrypt.cli._auth_from_domains'):
+            with mock.patch('letsencrypt.cli.client.acme_from_config_key'):
+                args.extend(['--email', 'io@io.is'])
+                self._cli_missing_flag(args, "--agree-tos")
+
     @mock.patch('letsencrypt.cli.client.acme_client.Client')
     @mock.patch('letsencrypt.cli._determine_account')
     @mock.patch('letsencrypt.cli.client.Client.obtain_and_enroll_certificate')
     @mock.patch('letsencrypt.cli._auth_from_domains')
-    def test_user_agent(self, _afd, _obt, det, _client):
+    def test_user_agent(self, afd, _obt, det, _client):
         # Normally the client is totally mocked out, but here we need more
         # arguments to automate it...
         args = ["--standalone", "certonly", "-m", "none@none.com",
                 "-d", "example.com", '--agree-tos'] + self.standard_args
         det.return_value = mock.MagicMock(), None
+        afd.return_value = mock.MagicMock(), "newcert"
+
         with mock.patch('letsencrypt.cli.client.acme_client.ClientNetwork') as acme_net:
             self._call_no_clientmock(args)
             os_ver = " ".join(le_util.get_os_info())
@@ -202,13 +226,14 @@ class CLITest(unittest.TestCase):  # pylint: disable=too-many-public-methods
             # (we can only do that if letsencrypt-nginx is actually present)
             ret, _, _, _ = self._call(args)
             self.assertTrue("The nginx plugin is not working" in ret)
-            self.assertTrue("Could not find configuration root" in ret)
-            self.assertTrue("NoInstallationError" in ret)
+            self.assertTrue("MisconfigurationError" in ret)
 
         args = ["certonly", "--webroot"]
         ret, _, _, _ = self._call(args)
         self.assertTrue("--webroot-path must be set" in ret)
 
+        self._cli_missing_flag(["--standalone"], "With the standalone plugin, you probably")
+
         with mock.patch("letsencrypt.cli._init_le_client") as mock_init:
             with mock.patch("letsencrypt.cli._auth_from_domains"):
                 self._call(["certonly", "--manual", "-d", "foo.bar"])

letsencrypt/tests/display/ops_test.py

@@ -69,7 +69,7 @@ class PickPluginTest(unittest.TestCase):
     """Tests for letsencrypt.display.ops.pick_plugin."""
 
     def setUp(self):
-        self.config = mock.Mock()
+        self.config = mock.Mock(noninteractive_mode=False)
         self.default = None
         self.reg = mock.MagicMock()
         self.question = "Question?"
@@ -407,10 +407,11 @@ class ChooseNamesTest(unittest.TestCase):
                                           "uniçodé.com")
         self.assertEqual(_choose_names_manually(), [])
         # IDN exception with previous mocks
-        with mock.patch("letsencrypt.display.util") as mock_sl:
-            uerror = UnicodeEncodeError('mock', u'',
-                                        0, 1, 'mock')
-            mock_sl.separate_list_input.side_effect = uerror
+        with mock.patch(
+                "letsencrypt.display.ops.display_util.separate_list_input"
+        ) as mock_sli:
+            unicode_error = UnicodeEncodeError('mock', u'', 0, 1, 'mock')
+            mock_sli.side_effect = unicode_error
             self.assertEqual(_choose_names_manually(), [])
         # Punycode and no retry
         mock_util().input.return_value = (display_util.OK,
@@ -464,7 +465,7 @@ class SuccessRenewalTest(unittest.TestCase):
     @classmethod
     def _call(cls, names):
         from letsencrypt.display.ops import success_renewal
-        success_renewal(names)
+        success_renewal(names, "renew")
 
     @mock.patch("letsencrypt.display.ops.util")
     def test_success_renewal(self, mock_util):

letsencrypt/tests/display/util_test.py

@@ -4,6 +4,8 @@ import unittest
 
 import mock
 
+import letsencrypt.errors as errors
+
 from letsencrypt.display import util as display_util
 
 
@@ -250,7 +252,7 @@ class FileOutputDisplayTest(unittest.TestCase):
                "This function is only meant to be for easy viewing{0}"
                "Test a really really really really really really really really "
                "really really really really long line...".format(os.linesep))
-        text = self.displayer._wrap_lines(msg)
+        text = display_util._wrap_lines(msg)
 
         self.assertEqual(text.count(os.linesep), 3)
 
@@ -278,6 +280,46 @@ class FileOutputDisplayTest(unittest.TestCase):
                     self.displayer._get_valid_int_ans(3),
                     (display_util.CANCEL, -1))
 
+class NoninteractiveDisplayTest(unittest.TestCase):
+    """Test non-interactive display.
+
+    These tests are pretty easy!
+
+    """
+    def setUp(self):
+        super(NoninteractiveDisplayTest, self).setUp()
+        self.mock_stdout = mock.MagicMock()
+        self.displayer = display_util.NoninteractiveDisplay(self.mock_stdout)
+
+    def test_notification_no_pause(self):
+        self.displayer.notification("message", 10)
+        string = self.mock_stdout.write.call_args[0][0]
+
+        self.assertTrue("message" in string)
+
+    def test_input(self):
+        d = "an incomputable value"
+        ret = self.displayer.input("message", default=d)
+        self.assertEqual(ret, (display_util.OK, d))
+        self.assertRaises(errors.MissingCommandlineFlag, self.displayer.input, "message")
+
+    def test_menu(self):
+        ret = self.displayer.menu("message", CHOICES, default=1)
+        self.assertEqual(ret, (display_util.OK, 1))
+        self.assertRaises(errors.MissingCommandlineFlag, self.displayer.menu, "message", CHOICES)
+
+    def test_yesno(self):
+        d = False
+        ret = self.displayer.yesno("message", default=d)
+        self.assertEqual(ret, d)
+        self.assertRaises(errors.MissingCommandlineFlag, self.displayer.yesno, "message")
+
+    def test_checklist(self):
+        d = [1, 3]
+        ret = self.displayer.checklist("message", TAGS, default=d)
+        self.assertEqual(ret, (display_util.OK, d))
+        self.assertRaises(errors.MissingCommandlineFlag, self.displayer.checklist, "message", TAGS)
+
 
 class SeparateListInputTest(unittest.TestCase):
     """Test Module functions."""

letsencrypt/tests/renewer_test.py

@@ -68,6 +68,13 @@ class BaseRenewableCertTest(unittest.TestCase):
         config.write()
         self.config = config
 
+        # We also create a file that isn't a renewal config in the same
+        # location to test that logic that reads in all-and-only renewal
+        # configs will ignore it and NOT attempt to parse it.
+        junk = open(os.path.join(self.tempdir, "renewal", "IGNORE.THIS"), "w")
+        junk.write("This file should be ignored!")
+        junk.close()
+
         self.defaults = configobj.ConfigObj()
         self.test_rc = storage.RenewableCert(config.filename, self.cli_config)
 
@@ -381,6 +388,10 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.assertEqual(self.test_rc.names(12),
                          ["example.com", "www.example.com"])
 
+        # Trying missing cert
+        os.unlink(self.test_rc.cert)
+        self.assertRaises(errors.CertStorageError, self.test_rc.names)
+
     @mock.patch("letsencrypt.storage.datetime")
     def test_time_interval_judgments(self, mock_datetime):
         """Test should_autodeploy() and should_autorenew() on the basis

letsencrypt/tests/reverter_test.py

@@ -385,6 +385,15 @@ class TestFullCheckpointsReverter(unittest.TestCase):
         self.assertRaises(
             errors.ReverterError, self.reverter.view_config_changes)
 
+    def test_view_config_changes_for_logging(self):
+        self._setup_three_checkpoints()
+
+        config_changes = self.reverter.view_config_changes(for_logging=True)
+
+        self.assertTrue("First Checkpoint" in config_changes)
+        self.assertTrue("Second Checkpoint" in config_changes)
+        self.assertTrue("Third Checkpoint" in config_changes)
+
     def _setup_three_checkpoints(self):
         """Generate some finalized checkpoints."""
         # Checkpoint1 - config1

letshelp-letsencrypt/setup.py

@@ -4,7 +4,7 @@ from setuptools import setup
 from setuptools import find_packages
 
 
-version = '0.2.0.dev0'
+version = '0.4.0.dev0'
 
 install_requires = [
     'setuptools',  # pkg_resources
@@ -55,4 +55,5 @@ setup(
             'letshelp-letsencrypt-apache = letshelp_letsencrypt.apache:main',
         ],
     },
+    test_suite='letshelp_letsencrypt',
 )

setup.py

@@ -33,6 +33,10 @@ version = meta['version']
 # Please update tox.ini when modifying dependency version requirements
 install_requires = [
     'acme=={0}'.format(version),
+    # We technically need ConfigArgParse 0.10.0 for Python 2.6 support, but
+    # saying so here causes a runtime error against our temporary fork of 0.9.3
+    # in which we added 2.6 support (see #2243), so we relax the requirement.
+    'ConfigArgParse>=0.9.3',
     'configobj',
     'cryptography>=0.7',  # load_pem_x509_certificate
     'parsedatetime',
@@ -48,18 +52,15 @@ install_requires = [
 ]
 
 # env markers in extras_require cause problems with older pip: #517
+# Keep in sync with conditional_requirements.py.
 if sys.version_info < (2, 7):
     install_requires.extend([
         # only some distros recognize stdlib argparse as already satisfying
         'argparse',
-        'ConfigArgParse>=0.10.0',  # python2.6 support, upstream #17
         'mock<1.1.0',
     ])
 else:
-    install_requires.extend([
-        'ConfigArgParse',
-        'mock',
-    ])
+    install_requires.append('mock')
 
 dev_extras = [
     # Pin astroid==1.3.5, pylint==1.4.2 as a workaround for #289
@@ -122,7 +123,6 @@ setup(
         'testing': testing_extras,
     },
 
-    tests_require=install_requires,
     # to test all packages run "python setup.py test -s
     # {acme,letsencrypt_apache,letsencrypt_nginx}"
     test_suite='letsencrypt',

tests/letstest/multitester.py

@@ -139,7 +139,15 @@ def make_instance(instance_name,
     time.sleep(1.0)
 
     # give instance a name
-    new_instance.create_tags(Tags=[{'Key': 'Name', 'Value': instance_name}])
+    try:
+        new_instance.create_tags(Tags=[{'Key': 'Name', 'Value': instance_name}])
+    except botocore.exceptions.ClientError, e:
+        if "InvalidInstanceID.NotFound" in str(e):
+            # This seems to be ephemeral... retry
+            time.sleep(1)
+            new_instance.create_tags(Tags=[{'Key': 'Name', 'Value': instance_name}])
+        else:
+            raise
     return new_instance
 
 def terminate_and_clean(instances):

tests/letstest/scripts/test_leauto_upgrades.sh

@@ -8,12 +8,28 @@ cd letsencrypt
 SAVE="$PIP_EXTRA_INDEX_URL"
 unset PIP_EXTRA_INDEX_URL
 export PIP_INDEX_URL="https://isnot.org/pip/0.1.0/"
-./letsencrypt-auto -v --debug --version 
+
+#OLD_LEAUTO="https://raw.githubusercontent.com/letsencrypt/letsencrypt/5747ab7fd9641986833bad474d71b46a8c589247/letsencrypt-auto"
+
+
+if ! command -v git ; then
+    if [ "$OS_TYPE" = "ubuntu" ] ; then
+        sudo apt-get update
+    fi
+    if ! (  sudo apt-get install -y git || sudo yum install -y git-all || sudo yum install -y git || sudo dnf install -y git ) ; then
+        echo git installation failed!
+        exit 1
+    fi
+fi
+BRANCH=`git rev-parse --abbrev-ref HEAD`
+git checkout v0.1.0
+./letsencrypt-auto -v --debug --version
 unset PIP_INDEX_URL
 
 export PIP_EXTRA_INDEX_URL="$SAVE"
 
-if ! ./letsencrypt-auto -v --debug --version | grep 0.1.1 ; then
+git checkout -f "$BRANCH"
+if ! ./letsencrypt-auto -v --debug --version | grep 0.3.0 ; then
     echo upgrade appeared to fail
     exit 1
 fi

tools/half-sign.c

@@ -9,18 +9,21 @@
 // This program can be used to perform RSA public key signatures given only
 // the hash of the file to be signed as input.
 
-// Sign with SHA1
-#define HASH_SIZE 20
+// To compile:
+// gcc half-sign.c -lssl -lcrypto -o half-sign
+
+// Sign with SHA256
+#define HASH_SIZE 32
 
 void usage() {
 	printf("half-sign <private key file> [binary hash file]\n");
 	printf("\n");
-	printf("    Computes and prints a binary RSA signature over data given the SHA1 hash of\n");
+	printf("    Computes and prints a binary RSA signature over data given the SHA256 hash of\n");
 	printf("    the data as input.\n");
 	printf("\n");
 	printf("    <private key file> should be PEM encoded.\n");
 	printf("\n");
-	printf("    The input SHA1 hash should be %d bytes in length. If no binary hash file is\n", HASH_SIZE);
+	printf("    The input SHA256 hash should be %d bytes in length. If no binary hash file is\n", HASH_SIZE);
 	printf("    specified, it will be read from stdin.\n");
 	exit(1);
 }
@@ -38,7 +41,7 @@ void sign_hashed_data(EVP_PKEY *signing_key, unsigned char *md, size_t mdlen) {
 	if ((!ctx) 
 	|| (EVP_PKEY_sign_init(ctx) <= 0) 
 	|| (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
-	|| (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha1()) <= 0)) {
+	|| (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0)) {
 		fprintf(stderr, "Failure establishing ctx for signature\n");
 		exit(1);
 	}
@@ -105,7 +108,7 @@ int main(int argc, char *argv[]) {
 		exit(1);
 	}
 	if (fread(buffer, HASH_SIZE, 1, input) != 1) {
-		perror("half-sign: Failed to read SHA1 from input\n");
+		perror("half-sign: Failed to read SHA256 from input\n");
 		exit(1);
 	}
 

tools/offline-sigrequest.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+
+set -o errexit
+
+if ! `which festival > /dev/null` ; then
+    echo Please install \'festival\'!
+    exit 1
+fi
+
+function sayhash { # $1 <-- HASH ; $2 <---SIGFILEBALL
+  while read -p "Press Enter to read the hash aloud or type 'done':  " INP && [ "$INP" = "" ] ; do
+    cat $1 | (echo "(Parameter.set 'Duration_Stretch 1.5)"; \
+                echo -n '(SayText "'; \
+                sha1sum | cut -c1-40 | fold -1 | sed 's/^a$/alpha/; s/^b$/bravo/; s/^c$/charlie/; s/^d$/delta/; s/^e$/echo/; s/^f$/foxtrot/'; \
+                echo '")' ) | festival
+  done
+
+  echo 'Paste in the data from the QR code, then type Ctrl-D:'
+  cat > $2
+}
+
+function offlinesign {  # $1 <-- INPFILE ; $2 <---SIGFILE
+  echo HASH FOR SIGNING:
+  SIGFILEBALL="$2.lzma.base64"
+  #echo "(place the resulting raw binary signature in $SIGFILEBALL)"
+  sha1sum $1 
+  echo metahash for confirmation only $(sha1sum $1   |cut -d' ' -f1 | tr -d '\n' | sha1sum  | cut -c1-6) ...
+  echo
+  sayhash $1 $SIGFILEBALL
+}
+
+function oncesigned { # $1 <-- INPFILE ; $2 <--SIGFILE
+  SIGFILEBALL="$2.lzma.base64"
+  cat $SIGFILEBALL | tr -d '\r' | base64 -d | unlzma -c > $2 || exit 1
+  if ! [ -f $2 ] ; then
+    echo "Failed to find $2"'!'
+    exit 1
+  fi
+
+  if file $2 | grep -qv " data" ; then
+    echo "WARNING WARNING $2 does not look like a binary signature:"
+    echo `file $2`
+    exit 1
+  fi
+}
+
+HERE=`dirname $0`
+LEAUTO="`realpath $HERE`/../letsencrypt-auto-source/letsencrypt-auto"
+SIGFILE="$LEAUTO".sig
+offlinesign $LEAUTO $SIGFILE
+oncesigned $LEAUTO $SIGFILE

tools/release.sh

@@ -34,6 +34,9 @@ else
     echo Releasing developer version "$version"...
 fi
 
+if [ "$RELEASE_OPENSSL_PUBKEY" = "" ] ; then
+    RELEASE_OPENSSL_PUBKEY="`realpath \`dirname $0\``/eff-pubkey.pem"
+fi
 RELEASE_GPG_KEY=${RELEASE_GPG_KEY:-A2CFB51FA275A7286234E7B24D17C995CD9775F2}
 # Needed to fix problems with git signatures and pinentry
 export GPG_TTY=$(tty)
@@ -80,18 +83,18 @@ git checkout "$RELEASE_BRANCH"
 
 SetVersion() {
     ver="$1"
-    for pkg_dir in $SUBPKGS
+    for pkg_dir in $SUBPKGS letsencrypt-compatibility-test
     do
       sed -i "s/^version.*/version = '$ver'/" $pkg_dir/setup.py
     done
     sed -i "s/^__version.*/__version__ = '$ver'/" letsencrypt/__init__.py
+    
+    # interactive user input
+    git add -p letsencrypt $SUBPKGS letsencrypt-compatibility-test 
 
-    git add -p letsencrypt $SUBPKGS # interactive user input
 }
+
 SetVersion "$version"
-git commit --gpg-sign="$RELEASE_GPG_KEY" -m "Release $version"
-git tag --local-user "$RELEASE_GPG_KEY" \
-    --sign --message "Release $version" "$tag"
 
 echo "Preparing sdists and wheels"
 for pkg_dir in . $SUBPKGS
@@ -112,6 +115,7 @@ do
   cd -
 done
 
+
 mkdir "dist.$version"
 mv dist "dist.$version/letsencrypt"
 for pkg_dir in $SUBPKGS
@@ -153,6 +157,21 @@ for module in letsencrypt $subpkgs_modules ; do
 done
 deactivate
 
+# ensure we have the latest built version of leauto
+letsencrypt-auto-source/build.py
+
+# and that it's signed correctly
+while ! openssl dgst -sha256 -verify $RELEASE_OPENSSL_PUBKEY -signature \
+        letsencrypt-auto-source/letsencrypt-auto.sig \
+        letsencrypt-auto-source/letsencrypt-auto            ; do
+   read -p "Please correctly sign letsencrypt-auto with offline-signrequest.sh"
+done
+
+git diff --cached
+git commit --gpg-sign="$RELEASE_GPG_KEY" -m "Release $version"
+git tag --local-user "$RELEASE_GPG_KEY" \
+    --sign --message "Release $version" "$tag"
+
 cd ..
 echo Now in $PWD
 name=${root_without_le%.*}

tox.ini

@@ -12,7 +12,7 @@ envlist = py{26,27,33,34,35},py{26,27}-oldest,cover,lint
 # loops, especially on Travis
 
 [testenv]
-# packages installed separately to ensure that dowstream deps problems
+# packages installed separately to ensure that downstream deps problems
 # are detected, c.f. #1002
 commands =
     pip install -e acme[testing]
@@ -82,3 +82,13 @@ setenv =
 commands =
     pip install -e acme -e .[dev] -e letsencrypt-apache -e letsencrypt-nginx -e letsencrypt-compatibility-test -e letshelp-letsencrypt
     sudo ./letsencrypt-apache/letsencrypt_apache/tests/apache-conf-files/apache-conf-test --debian-modules
+
+[testenv:le_auto]
+# At the moment, this tests under Python 2.7 only, as only that version is
+# readily available on the Trusty Docker image.
+commands =
+    docker build -t lea letsencrypt-auto-source
+    docker run --rm -t -i lea
+whitelist_externals =
+    docker
+passenv = DOCKER_*