Up to [cvs.NetBSD.org] / pkgsrc / security / py-certbot-nginx
Request diff between arbitrary revisions
Keyword substitution: kv
Default branch: MAIN
i*: clean up after python38 removal
py-acme py-certbot*: updated to 2.11.0 2.11.0 Changed In anticipation of backwards incompatible changes, certbot-dns-cloudflare now requires less than version 2.20 of Cloudflare's python library. Fixed Fixed a bug in Certbot where a CSR's SANs did not always follow the order of the domain names that the user requested interactively. In some cases, the resulting cert's common name might seem picked up randomly from the SANs when it should be the first item the user had in mind.
py-acme py-certbot*: updated to 2.9.0 Certbot 2.9.0 Added Support for Python 3.12 was added. Fixed Updates joinpath syntax to only use one addition per call, because the multiple inputs version was causing mypy errors on Python 3.10. Makes the reconfigure verb actually use the staging server for the dry run to check the new configuration.
py-acme py-certbot*: updated to 2.8.0 Certbot 2.8.0 Added Added support for Alpine Linux distribution when is used the apache plugin Changed Support for Python 3.7 was removed. Fixed Stop using the deprecated pkg_resources API included in setuptools.
fighting a losing battle against the py-cryptography rustification, part 5 Convert py-OpenSSL users to versioned_dependencies.mk
py-acme py-certbot: updated to 1.25.0 Certbot 1.25.0 Changed Dropped 32 bit support for the Windows beta installer Windows beta installer is now distributed as "certbot-beta-installer-win_amd64.exe". Users of the Windows beta should uninstall the old version before running this. Added a check whether OCSP stapling is supported by the installer when requesting a certificate with the run subcommand in combination with the --must-staple option. If the installer does not support OCSP and the --must-staple option is used, Certbot will raise an error and quit. Certbot and its acme module now depend on josepy>=1.13.0 due to better type annotation support. Fixed Updated dependencies to use new version of cryptography that uses OpenSSL 1.1.1n, in response to https://www.openssl.org/news/secadv/20220315.txt. Certbot 1.24.0 Added When the --debug-challenges option is used in combination with -v, Certbot now displays the challenge URLs (for http-01 challenges) or FQDNs (for dns-01 challenges) and their expected return values. Changed Support for Python 3.6 was removed. All Certbot components now require setuptools>=41.6.0. The acme library now requires requests>=2.20.0. Certbot and its acme library now require pytz>=2019.3. certbot-nginx now requires pyparsing>=2.2.1. certbot-dns-route53 now requires boto3>=1.15.15. Fixed Nginx plugin now checks included files for the singleton server_names_hash_bucket_size directive.
py-acme py-certbot*: updated to 1.23.0 Certbot 1.23.0 Added Added show_account subcommand, which will fetch the account information from the ACME server and show the account details (account URL and, if applicable, email address or addresses) We deprecated support for Python 3.6 in Certbot and its ACME library. Support for Python 3.6 will be removed in the next major release of Certbot. Fixed GCP Permission list for certbot-dns-google in plugin documentation dns-digitalocean used the SOA TTL for newly created records, rather than 30 seconds. Revoking a certificate based on an ECDSA key can now be done with --key-path.
*: bump PKGREVISION for egg.mk users They now have a tool dependency on py-setuptools instead of a DEPENDS
py-acme py-certbot*: updated to 1.18.0 1.18.0 Added New functions that Certbot plugins can use to interact with the user have been added to certbot.display.util. We plan to deprecate using IDisplay with zope in favor of these new functions in the future. The Plugin, Authenticator and Installer classes are added to certbot.interfaces module as alternatives to Certbot's current zope based plugin interfaces. The API of these interfaces is identical, but they are based on Python's abc module instead of zope. Certbot will continue to detect plugins that implement either interface, but we plan to drop support for zope based interfaces in a future version of Certbot. The class certbot.configuration.NamespaceConfig is added to the Certbot's public API. Changed When self-validating HTTP-01 challenges using acme.challenges.HTTP01Response.simple_verify, we now assume that the response is composed of only ASCII characters. Previously we were relying on the default behavior of the requests library which tries to guess the encoding of the response which was error prone. acme: the .client.Client and .client.BackwardsCompatibleClientV2 classes are now deprecated in favor of .client.ClientV2. The certbot.tests.patch_get_utility* functions have been deprecated. Plugins should now patch certbot.display.util themselves in their tests or use certbot.tests.util.patch_display_util as a temporary workaround. In order to simplify the transition to Certbot's new plugin interfaces, the classes Plugin and Installer in certbot.plugins.common module and certbot.plugins.dns_common.DNSAuthenticator now implement Certbot's new plugin interfaces. The Certbot plugins based on these classes are now automatically detected as implementing these interfaces. We added a dependency on chardet to our acme library so that it will be used over charset_normalizer in newer versions of requests. Fixed The Apache authenticator no longer crashes with "Unable to insert label" when encountering a completely empty vhost. This issue affected Certbot 1.17.0. Users of the Certbot snap on Debian 9 (Stretch) should no longer encounter an "access denied" error when installing DNS plugins.
py-acme py-certbot*: updated to 1.12.0 1.12.0 Changed The --preferred-chain flag now only checks the Issuer Common Name of the topmost (closest to the root) certificate in the chain, instead of checking every certificate in the chain. Support for Python 2 has been removed. In previous releases, we caused certbot-auto to stop updating its Certbot installation. In this release, we are beginning to disable updates to the certbot-auto script itself. This release includes Amazon Linux users, and all other systems that are not based on Debian or RHEL. We plan to make this change to the certbot-auto script for all users in the coming months. Fixed Fixed the apache component on openSUSE Tumbleweed which no longer provides an apache2ctl symlink and uses apachectl instead. Fixed a typo in certbot/crypto_util.py causing an error upon attempting secp521r1 key generation
py-acme py-certbot*: updated to 1.8.0 Certbot 1.8.0 Added Added the ability to remove email and phone contact information from an account using update_account --register-unsafely-without-email Changed Support for Python 3.5 has been removed. Fixed The problem causing the Apache plugin in the Certbot snap on ARM systems to fail to load the Augeas library it depends on has been fixed. The acme library can now tell the ACME server to clear contact information by passing an empty tuple to the contact field of a Registration message. Fixed the *** stack smashing detected *** error in the Certbot snap on some systems. More details about these changes can be found on our GitHub repo.
*: switch to versioned_dependencies.mk for py-setuptools
py-acme,py-certbot: updated to 1.6.0 1.6.0 Added Certbot snaps are now available for the arm64 and armhf architectures. Add minimal code to run Nginx plugin on NetBSD. Make Certbot snap find externally snapped plugins Function certbot.compat.filesystem.umask is a drop-in replacement for os.umask implementing umask for both UNIX and Windows systems. Support for alternative certificate chains in the acme module. Added --preferred-chain <issuer CN>. If a CA offers multiple certificate chains, it may be used to indicate to Certbot which chain should be preferred. e.g. --preferred-chain "DST Root CA X3" Changed Allow session tickets to be disabled in Apache when mod_ssl is statically linked. Generalize UI warning message on renewal rate limits Certbot behaves similarly on Windows to on UNIX systems regarding umask, and the umask 022 is applied by default: all files/directories are not writable by anyone other than the user running Certbot and the system/admin users. Read acmev1 Let's Encrypt server URL from renewal config as acmev2 URL to prepare for impending acmev1 deprecation. Fixed Cloudflare API Tokens may now be restricted to individual zones. Don't use StrictVersion, but LooseVersion to check version requirements with setuptools, to fix some packaging issues with libraries respecting PEP404 for version string, with doesn't match StrictVersion requirements. Certbot output doesn't refer to SSL Labs due to confusing scoring behavior. Fix paths when calling to programs outside of the Certbot Snap, fixing the apache and nginx plugins on, e.g., CentOS 7.
Look for nginx.conf in PKG_SYSCONFDIR.nginx
py-acme/py-certbot*: updated to 1.4.0 1.4.0: Added * Turn off session tickets for apache plugin by default when appropriate. * Added serial number of certificate to the output of `certbot certificates` * Expose two new environment variables in the authenticator and cleanup scripts used by the `manual` plugin: `CERTBOT_REMAINING_CHALLENGES` is equal to the number of challenges remaining after the current challenge, `CERTBOT_ALL_DOMAINS` is a comma-separated list of all domains challenged for the current certificate. * Added TLS-ALPN-01 challenge support in the `acme` library. Support of this challenge in the Certbot client is planned to be added in a future release. * Added minimal proxy support for OCSP verification. * On Windows, hooks are now executed in a Powershell shell instead of a CMD shell, allowing both `*.ps1` and `*.bat` as valid scripts for Certbot. Changed * Reorganized error message when a user entered an invalid email address. * Stop asking interactively if the user would like to add a redirect. * `mock` dependency is now conditional on Python 2 in all of our packages. * Deprecate certbot-auto on Gentoo, macOS, and FreeBSD. Fixed * When using an RFC 8555 compliant endpoint, the `acme` library no longer sends the `resource` field in any requests or the `type` field when responding to challenges. * Fix nginx plugin crash when non-ASCII configuration file is being read (instead, the user will be warned that UTF-8 must be used). * Fix hanging OCSP queries during revocation checking - added a 10 second timeout. * Standalone servers now have a default socket timeout of 30 seconds, fixing cases where an idle connection can cause the standalone plugin to hang. * Parsing of the RFC 8555 application/pem-certificate-chain now tolerates CRLF line endings. This should fix interoperability with Buypass' services. More details about these changes can be found on our GitHub repo.
py-acme/py-cerbot-*: updated to 1.0.0 Certbot 1.0.0 Removed: * The docs extras for the certbot-apache and certbot-nginx packages have been removed. Changed: * certbot-auto has deprecated support for systems using OpenSSL 1.0.1 that are not running on x86-64. This primarily affects RHEL 6 based systems. * Certbot's config_changes subcommand has been removed * certbot.plugins.common.TLSSNI01 has been removed. * Deprecated attributes related to the TLS-SNI-01 challenge in acme.challenges and acme.standalone have been removed. * The functions certbot.client.view_config_changes, certbot.main.config_changes, certbot.plugins.common.Installer.view_config_changes, certbot.reverter.Reverter.view_config_changes, and certbot.util.get_systemd_os_info have been removed * Certbot's register --update-registration subcommand has been removed * When possible, default to automatically configuring the webserver so all requests redirect to secure HTTPS access. This is mostly relevant when running Certbot in non-interactive mode. Previously, the default was to not redirect all requests.
py-acme/py-certbot: updated to 0.39.0 0.39.0: Added Support for Python 3.8 was added to Certbot and all of its components. Support for CentOS 8 was added to certbot-auto. Changed Don't send OCSP requests for expired certificates Return to using platform.linux_distribution instead of distro.linux_distribution in OS fingerprinting for Python < 3.8 Updated the Nginx plugin's TLS configuration to keep support for some versions of IE11. Fixed Fixed OS detection in the Apache plugin on RHEL 6.
py-certbot: updated to 0.37.2 0.37.2: Stop disabling TLS session tickets in Nginx as it caused TLS failures on some systems. 0.37.1: Fixed Stop disabling TLS session tickets in Apache as it caused TLS failures on some systems. 0.37.0: Added Turn off session tickets for apache plugin by default acme: Authz deactivation added to acme module. Changed Follow updated Mozilla recommendations for Nginx ssl_protocols, ssl_ciphers, and ssl_prefer_server_ciphers Fixed Fix certbot-auto failures on RHEL 8.
py-acme: update to 0.35.0 py-certbot: update to 0.35.0 py-certbot-apache: update to 0.35.0 py-certbot-dns-luadns: update to 0.35.0 py-certbot-dns-nsone: update to 0.35.0 py-certbot-dns-ovh: update to 0.35.0 py-certbot-dns-rfc2136: update to 0.35.0 py-certbot-dns-route53: update to 0.35.0 py-certbot-dns-sakuracloud: update to 0.35.0 py-certbot-nginx: update to 0.35.0 pkgsrc changes: --------------- * Add py-certbot/Makefile.common to make version number coherent upstream changes: ----------------- - Added o dns_rfc2136 plugin now supports explicitly specifing an authorative base domain for cases when the automatic method does not work (e.g. Split horizon DNS) - Fixed o Renewal parameter webroot_path is always saved, avoiding some regressions when webroot authenticator plugin is invoked with no challenge to perform. o Certbot now accepts OCSP responses when an explicit authorized responder, different from the issuer, is used to sign OCSP responses. o Scripts in Certbot hook directories are no longer executed when their filenames end in a tilde. - Despite us having broken lockstep, we are continuing to release new versions of all Certbot components during releases for the time being, however, the only package with changes other than its version number was: o certbot o certbot-dns-rfc2136
py-acme py-certbot*: updated to 0.34.2 0.34.2: Fixed certbot-auto no longer writes a check_permissions.py script at the root of the filesystem. Despite us having broken lockstep, we are continuing to release new versions of all Certbot components during releases for the time being, however, the only changes in this release were to certbot-auto.
py-acme,py-cerbot*: updated to 0.34.1 0.34.1: Fixed certbot-auto no longer prints a blank line when there are no permissions problems. Despite us having broken lockstep, we are continuing to release new versions of all Certbot components during releases for the time being, however, the only changes in this release were to certbot-auto. More details about these changes can be found on our GitHub repo. 0.34.0: Changed Apache plugin now tries to restart httpd on Fedora using systemctl if a configuration test error is detected. This has to be done due to the way Fedora now generates the self signed certificate files upon first restart. Updated Certbot and its plugins to improve the handling of file system permissions on Windows as a step towards adding proper Windows support to Certbot. Updated urllib3 to 1.24.2 in certbot-auto. Removed the fallback introduced with 0.32.0 in acme to retry a challenge response with a keyAuthorization if sending the response without this field caused a malformed error to be received from the ACME server. Linode DNS plugin now supports api keys created from their new panel at cloud.linode.com Adding a warning noting that future versions of Certbot will automatically configure the webserver so that all requests redirect to secure HTTPS access. You can control this behavior and disable this warning with the --redirect and --no-redirect flags. certbot-auto now prints warnings when run as root with insecure file system permissions. If you see these messages, you should fix the problem by following the instructions at https://community.letsencrypt.org/t/certbot-auto-deployment-best-practices/91979/, however, these warnings can be disabled as necessary with the flag --no-permissions-check. acme module uses now a POST-as-GET request to retrieve the registration from an ACME v2 server Convert the tsig algorithm specified in the certbot_dns_rfc2136 configuration file to all uppercase letters before validating. This makes the value in the config case insensitive.
py-acme,py-certbot*: updated to 0.33.1 0.33.1: Fixed A bug causing certbot-auto to print warnings or crash on some RHEL based systems has been resolved. Despite us having broken lockstep, we are continuing to release new versions of all Certbot components during releases for the time being, however, the only changes in this release were to certbot-auto. 0.33.0: Added Fedora 29+ is now supported by certbot-auto. Since Python 2.x is on a deprecation path in Fedora, certbot-auto will install and use Python 3.x on Fedora 29+. CLI flag --https-port has been added for Nginx plugin exclusively, and replaces --tls-sni-01-port. It defines the HTTPS port the Nginx plugin will use while setting up a new SSL vhost. By default the HTTPS port is 443. Changed Support for TLS-SNI-01 has been removed from all official Certbot plugins. Attributes related to the TLS-SNI-01 challenge in acme.challenges and acme.standalone modules are deprecated and will be removed soon. CLI flags --tls-sni-01-port and --tls-sni-01-address are now no-op, will generate a deprecation warning if used, and will be removed soon. Options tls-sni and tls-sni-01 in --preferred-challenges flag are now no-op, will generate a deprecation warning if used, and will be removed soon. CLI flag --standalone-supported-challenges has been removed. Fixed Certbot uses the Python library cryptography for OCSP when cryptography>=2.5 is installed. We fixed a bug in Certbot causing it to interpret timestamps in the OCSP response as being in the local timezone rather than UTC. Issue causing the default CentOS 6 TLS configuration to ignore some of the HTTPS VirtualHosts created by Certbot. mod_ssl loading is now moved to main http.conf for this environment where possible.
py-certbot: updated to 0.32.0 Added If possible, Certbot uses built-in support for OCSP from recent cryptography versions instead of the OpenSSL binary: as a consequence Certbot does not need the OpenSSL binary to be installed anymore if cryptography>=2.5 is installed. Changed Certbot and its acme module now depend on josepy>=1.1.0 to avoid printing the warnings described at https://github.com/certbot/josepy/issues/13. Apache plugin now respects CERTBOT_DOCS environment variable when adding command line defaults. The running of manual plugin hooks is now always included in Certbot's log output. Tests execution for certbot, certbot-apache and certbot-nginx packages now relies on pytest. An ACME CA server may return a "Retry-After" HTTP header on authorization polling, as specified in the ACME protocol, to indicate when the next polling should occur. Certbot now reads this header if set and respect its value. The acme module avoids sending the keyAuthorization field in the JWS payload when responding to a challenge as the field is not included in the current ACME protocol. To ease the migration path for ACME CA servers, Certbot and its acme module will first try the request without the keyAuthorization field but will temporarily retry the request with the field included if a malformed error is received. This fallback will be removed in version 0.34.0.
py-acme,py-certbot*: updated to 0.31.0 0.31.0: Added Avoid reprocessing challenges that are already validated when a certificate is issued. Support for initiating (but not solving end-to-end) TLS-ALPN-01 challenges with the acme module. Changed Certbot's official Docker images are now based on Alpine Linux 3.9 rather than 3.7. The new version comes with OpenSSL 1.1.1. Lexicon-based DNS plugins are now fully compatible with Lexicon 3.x (support on 2.x branch is maintained). Apache plugin now attempts to configure all VirtualHosts matching requested domain name instead of only a single one when answering the HTTP-01 challenge. Fixed Fixed accessing josepy contents through acme.jose when the full acme.jose path is used. Clarify behavior for deleting certs as part of revocation. Despite us having broken lockstep, we are continuing to release new versions of all Certbot components during releases for the time being, however, the only package with changes other than its version number was: acme certbot certbot-apache certbot-dns-cloudxns certbot-dns-dnsimple certbot-dns-dnsmadeeasy certbot-dns-gehirn certbot-dns-linode certbot-dns-luadns certbot-dns-nsone certbot-dns-ovh certbot-dns-sakuracloud More details about these changes can be found on our GitHub repo.
py-certbot-nginx: add nginx certbot plugin