Merge ~ahasenack/ubuntu/+source/python-certbot-nginx:focal-certbot-nginx-1875471 into ubuntu/+source/python-certbot-nginx:ubuntu/devel

[Andreas Hasenack]

The bug has details on what happened, and how it was fixed. The options we had were outlined in https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/comments/12 and upstream suggested a fourth alternative in https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/comments/15 which is what I adopted.

Test PPA: https://launchpad.net/~ahasenack/+archive/ubuntu/certbot-tlssni01-1875471-d

Running all the tests properly needs a specific setup, which I suggest to leave for the SRU verification. I have done those with my test PPA already prior to submitting this.

What can easily be tested is the python error which originated this:

AttributeError: module 'acme.challenges' has no attribute 'TLSSNI01'

Just run this, on any host/container (no need to replace the fake domain):

sudo apt install python3-certbot-nginx
sudo certbot -d example.org --agree-tos --staging --register-unsafely-without-email --nginx

The fixed version won't fail with AttributeError, but will try to fetch a certificate for example.org, and that will of course fail and is fine.

The second check to make is to confirm that the build-time tests were run. Search build logs for "dh_auto_test".

Unmerged commits

723b055... by Andreas Hasenack on 2020-05-05

changelog

5653982... by Andreas Hasenack on 2020-05-05

    - d/p/fix-tests-with-newer-acme.patch: fix tests with newer python-acme
      that has no TLSSNI01. Thanks to Brad Warren <email address hidden>

0b77cca... by Andreas Hasenack on 2020-04-28

    - d/rules: actually run the tests by fixing the expression that looks
      for nocheck in DEB_BUILD_OPTIONS

f2ccbb2... by Andreas Hasenack on 2020-04-28

  * Cope with newer python-acme that dropped TLSSNI01 (LP: #1875471):
    - new upstream version: 0.40.0

diff --git a/PKG-INFO b/PKG-INFO
index 16469ad..a3ecea3 100644
--- a/PKG-INFO
+++ b/PKG-INFO
@@ -1,6 +1,10 @@
 Metadata-Version: 1.2
 Name: certbot-nginx
+<<<<<<< PKG-INFO
 Version: 1.4.0
+=======
+Version: 0.40.0
+>>>>>>> PKG-INFO
 Summary: Nginx plugin for Certbot
 Home-page: https://github.com/letsencrypt/letsencrypt
 Author: Certbot Project
diff --git a/certbot_nginx.egg-info/PKG-INFO b/certbot_nginx.egg-info/PKG-INFO
index 16469ad..a36d314 100644
--- a/certbot_nginx.egg-info/PKG-INFO
+++ b/certbot_nginx.egg-info/PKG-INFO
@@ -1,6 +1,10 @@
 Metadata-Version: 1.2
 Name: certbot-nginx
+<<<<<<< certbot_nginx.egg-info/PKG-INFO
 Version: 1.4.0
+=======
+Version: 0.40.0
+>>>>>>> certbot_nginx.egg-info/PKG-INFO
 Summary: Nginx plugin for Certbot
 Home-page: https://github.com/letsencrypt/letsencrypt
 Author: Certbot Project
diff --git a/certbot_nginx.egg-info/SOURCES.txt b/certbot_nginx.egg-info/SOURCES.txt
index 9d2fa54..e0d5c71 100644
--- a/certbot_nginx.egg-info/SOURCES.txt
+++ b/certbot_nginx.egg-info/SOURCES.txt
@@ -10,6 +10,7 @@ certbot_nginx.egg-info/dependency_links.txt
 certbot_nginx.egg-info/entry_points.txt
 certbot_nginx.egg-info/requires.txt
 certbot_nginx.egg-info/top_level.txt
+<<<<<<< certbot_nginx.egg-info/SOURCES.txt
 certbot_nginx/_internal/__init__.py
 certbot_nginx/_internal/configurator.py
 certbot_nginx/_internal/constants.py
@@ -66,4 +67,61 @@ tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/scgi_params
 tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/uwsgi_params
 tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/win-utf
 tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/sites-available/default
-tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/sites-enabled/default
\ No newline at end of file
+tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/sites-enabled/default
+=======
+certbot_nginx/tests/__init__.py
+certbot_nginx/tests/configurator_test.py
+certbot_nginx/tests/display_ops_test.py
+certbot_nginx/tests/http_01_test.py
+certbot_nginx/tests/nginxparser_test.py
+certbot_nginx/tests/obj_test.py
+certbot_nginx/tests/parser_obj_test.py
+certbot_nginx/tests/parser_test.py
+certbot_nginx/tests/util.py
+certbot_nginx/tests/testdata/etc_nginx/broken.conf
+certbot_nginx/tests/testdata/etc_nginx/comment_in_file.conf
+certbot_nginx/tests/testdata/etc_nginx/edge_cases.conf
+certbot_nginx/tests/testdata/etc_nginx/foo.conf
+certbot_nginx/tests/testdata/etc_nginx/mime.types
+certbot_nginx/tests/testdata/etc_nginx/minimalistic_comments.conf
+certbot_nginx/tests/testdata/etc_nginx/multiline_quotes.conf
+certbot_nginx/tests/testdata/etc_nginx/nginx.conf
+certbot_nginx/tests/testdata/etc_nginx/server.conf
+certbot_nginx/tests/testdata/etc_nginx/sites-enabled/default
+certbot_nginx/tests/testdata/etc_nginx/sites-enabled/example.com
+certbot_nginx/tests/testdata/etc_nginx/sites-enabled/globalssl.com
+certbot_nginx/tests/testdata/etc_nginx/sites-enabled/headers.com
+certbot_nginx/tests/testdata/etc_nginx/sites-enabled/ipv6.com
+certbot_nginx/tests/testdata/etc_nginx/sites-enabled/ipv6ssl.com
+certbot_nginx/tests/testdata/etc_nginx/sites-enabled/migration.com
+certbot_nginx/tests/testdata/etc_nginx/sites-enabled/sslon.com
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/fastcgi_params
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/koi-utf
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/koi-win
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/mime.types
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/naxsi-ui.conf.1.4.1
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/naxsi.rules
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/naxsi_core.rules
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/nginx.conf
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/proxy_params
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/scgi_params
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/uwsgi_params
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/win-utf
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/sites-available/default
+certbot_nginx/tests/testdata/etc_nginx/ubuntu_nginx_1_4_6/default_vhost/nginx/sites-enabled/default
+certbot_nginx/tls_configs/options-ssl-nginx-old.conf
+certbot_nginx/tls_configs/options-ssl-nginx-tls12-only.conf
+certbot_nginx/tls_configs/options-ssl-nginx-tls13-session-tix-on.conf
+certbot_nginx/tls_configs/options-ssl-nginx.conf
+docs/.gitignore
+docs/Makefile
+docs/api.rst
+docs/conf.py
+docs/index.rst
+docs/make.bat
+docs/_static/.gitignore
+docs/_templates/.gitignore
+docs/api/nginxparser.rst
+docs/api/obj.rst
+docs/api/parser.rst
+>>>>>>> certbot_nginx.egg-info/SOURCES.txt
diff --git a/debian/changelog b/debian/changelog
index 3948f9d..6782663 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,4 @@
+<<<<<<< debian/changelog
 python-certbot-nginx (1.4.0-1) unstable; urgency=medium
 
   * New upstream version 1.4.0
@@ -35,6 +36,18 @@ python-certbot-nginx (1.1.0-1) unstable; urgency=medium
   * Drop docs package removed by upstream.
 
  -- Harlan Lieberman-Berg <[e-mail]>  Fri, 24 Jan 2020 20:12:20 -0500
+=======
+python-certbot-nginx (0.40.0-0ubuntu0.1) focal; urgency=medium
+
+  * Cope with newer python-acme that dropped TLSSNI01 (LP: #1875471):
+    - new upstream version: 0.40.0
+    - d/rules: actually run the tests by fixing the expression that looks
+      for nocheck in DEB_BUILD_OPTIONS
+    - d/p/fix-tests-with-newer-acme.patch: fix tests with newer python-acme
+      that has no TLSSNI01. Thanks to Brad Warren <[e-mail]>
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 05 May 2020 15:39:00 -0300
+>>>>>>> debian/changelog
 
 python-certbot-nginx (0.39.0-1) unstable; urgency=medium
 
diff --git a/debian/patches/fix-tests-with-newer-acme.patch b/debian/patches/fix-tests-with-newer-acme.patch
new file mode 100644
index 0000000..2cdd71d
--- /dev/null
+++ b/debian/patches/fix-tests-with-newer-acme.patch
@@ -0,0 +1,45 @@
+Description: fix tests with newer python-acme that has no TLSSNI01
+ This extracts the minimal pieces from upstream's bigger refactoring
+ necessary to cope with python-acme's removal of TLSSNI01 in the version shipped
+ in Focal.
+Author: Brad Warren <[e-mail]>
+Origin: upstream, https://gist.github.com/bmw/e4f13e17d1f4647c9d6be730c7ec3512
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471
+Applied-Upstream: https://github.com/certbot/certbot/commit/4abd81e2186eddc67551d61a8260440bd177d18d
+Last-Update: 2020-05-05
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+diff --git a/certbot-nginx/certbot_nginx/tests/http_01_test.py b/certbot-nginx/certbot_nginx/tests/http_01_test.py
+index d05370c68..8e0450f6a 100644
+--- a/certbot_nginx/tests/http_01_test.py
++++ b/certbot_nginx/tests/http_01_test.py
+@@ -1,6 +1,7 @@
+ """Tests for certbot_nginx.http_01"""
+ import unittest
+ 
++import josepy as jose
+ import mock
+ import six
+ 
+@@ -8,17 +9,19 @@ from acme import challenges
+ 
+ from certbot import achallenges
+ 
+-from certbot.plugins import common_test
+ from certbot.tests import acme_util
++from certbot.tests import util as test_util
+ 
+ from certbot_nginx.obj import Addr
+ from certbot_nginx.tests import util
+ 
++AUTH_KEY = jose.JWKRSA.load(test_util.load_vector("rsa512_key.pem"))
++
+ 
+ class HttpPerformTest(util.NginxTest):
+     """Test the NginxHttp01 challenge."""
+ 
+-    account_key = common_test.AUTH_KEY
++    account_key = AUTH_KEY
+     achalls = [
+         achallenges.KeyAuthorizationAnnotatedChallenge(
+             challb=acme_util.chall_to_challb(
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..86c7057
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1 @@
+fix-tests-with-newer-acme.patch
diff --git a/debian/rules b/debian/rules
index a664a06..10211c0 100755
--- a/debian/rules
+++ b/debian/rules
@@ -10,6 +10,6 @@ override_dh_auto_install:
 	rm -rf $(CURDIR)/debian/python3-certbot-nginx/usr/lib/python*/dist-packages/certbot_nginx/tests/testdata
 
 override_dh_auto_test:
-ifdef (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
+ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
 	python3 setup.py test
 endif
diff --git a/setup.py b/setup.py
index 42ea077..7fb7d50 100644
--- a/setup.py
+++ b/setup.py
@@ -6,7 +6,11 @@ from setuptools import find_packages
 from setuptools import setup
 from setuptools.command.test import test as TestCommand
 
+<<<<<<< setup.py
 version = '1.4.0'
+=======
+version = '0.40.0'
+>>>>>>> setup.py
 
 # Remember to update local-oldest-requirements.txt when changing the minimum
 # acme/certbot version.