[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
autopackage tests are also green: https://people.canonical.com/~ubuntu- archive/proposed-migration/focal/update_excuses.html#python-certbot- nginx -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
Checks (a), (b), (c), (d) passed, plus the comments from others who installed the package on their servers or test rigs. Marking the verification as succeeded. ** Tags removed: verification-needed-focal ** Tags added: verification-done-focal -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
a) Run https://wiki.ubuntu.com/StableReleaseUpdates/Certbot/TestScript. Full output attached. Package from proposed is installed: *** 0.40.0-0ubuntu0.1 500 500 http://br.archive.ubuntu.com/ubuntu focal-proposed/universe amd64 Packages 100 /var/lib/dpkg/status 0.39.0-1 500 500 http://br.archive.ubuntu.com/ubuntu focal/universe amd64 Packages Script being run with CERTBOT_PREINSTALLED=1 because not all certbot packages were updated in this SRU (...) testing roundcube-1222.conf...passed testing section-continuations-2525.conf...passed testing section-empty-continuations-2731.conf...passed testing semacode-1598.conf...passed testing two-blocks-one-line-1693.conf...passed Success! Package versions tested: certbot 0.40.0-1 letsencrypt python3-acme1.1.0-1 python3-certbot 0.40.0-1 python3-certbot-apache 0.39.0-1 python3-certbot-nginx 0.40.0-0ubuntu0.1 python3-josepy 1.2.0-2 real4m23.223s ** Attachment added: "sru-1875471-test-a-log.txt" https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+attachment/5371730/+files/sru-1875471-test-a-log.txt -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
Focal verification tests (b), (c) and (d) below: a) Running script from https://wiki.ubuntu.com/StableReleaseUpdates/Certbot/TestScript b) Request a registration with nginx sudo certbot -d certbot-test.justgohome.co.uk --agree-tos --staging --register-unsafely-without-email --nginx python3-certbot-nginx from proposed: Version table: *** 0.40.0-0ubuntu0.1 500 500 http://ports.ubuntu.com/ubuntu-ports focal-proposed/universe ppc64el Packages 100 /var/lib/dpkg/status 0.39.0-1 500 500 http://ports.ubuntu.com/ubuntu-ports focal/universe ppc64el Packages ubuntu@certbot-test:~$ sudo certbot -d certbot-test.justgohome.co.uk --agree-tos --staging --register-unsafely-without-email --nginx Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator nginx, Installer nginx Registering without email! Obtaining a new certificate Performing the following challenges: http-01 challenge for certbot-test.justgohome.co.uk Waiting for verification... Cleaning up challenges Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/default Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled/default - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations! You have successfully enabled https://certbot-test.justgohome.co.uk You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=certbot-test.justgohome.co.uk - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/certbot-test.justgohome.co.uk/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/certbot-test.justgohome.co.uk/privkey.pem Your cert will expire on 2020-08-12. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal. c) Request a registration using apache sudo certbot -d certbot-test.justgohome.co.uk --agree-tos --staging --register-unsafely-without-email --apache python3-certbot-apache from release: Version table: *** 0.39.0-1 500 500 http://ports.ubuntu.com/ubuntu-ports focal/universe ppc64el Packages 100 /var/lib/dpkg/status ubuntu@certbot-test:~$ sudo certbot -d certbot-test.justgohome.co.uk --agree-tos --staging --register-unsafely-without-email --apache Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Registering without email! Obtaining a new certificate Performing the following challenges: http-01 challenge for certbot-test.justgohome.co.uk Enabled Apache rewrite module Waiting for verification... Cleaning up challenges Created an SSL vhost at /etc/apache2/sites-available/000-default-le-ssl.conf Enabled Apache socache_shmcb module Enabled Apache ssl module Deploying Certificate to VirtualHost /etc/apache2/sites-available/000-default-le-ssl.conf Enabling available site: /etc/apache2/sites-available/000-default-le-ssl.conf Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Enabled Apache rewrite module Redirecting vhost in /etc/apache2/sites-enabled/000-default.conf to ssl vhost in /etc/apache2/sites-available/000-default-le-ssl.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations! You have successfully enabled https://
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
Uploaded, waiting for SRU team. -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
** Description changed: This bug tracks an update for python-certbot from 0.39.0 to 0.40.0. This update includes bugfixes only following the SRU policy exception defined at https://wiki.ubuntu.com/StableReleaseUpdates/Certbot. [Impact] Reguesting a certificate via the nginx plugin fails: AttributeError: module 'acme.challenges' has no attribute 'TLSSNI01' The problem here is python-certbot-nginx contains references to code in python-acme that has been removed. This problem makes python-certbot- nginx completely unable to obtain certificates. [Major Changes] To fix the problem, python-certbot-nginx is being updated from 0.39.0 to 0.40.0. The diff[1] is small and is about removing TLSSNI01 support. It was also noticed that the build-time tests were never run due to a bug in how they were called in d/rules. This has been fixed, and turns out the current version in focal release (0.39.0-1) is already an FTBFS when tests are properly run during build. To have the tests run at build time (as was the original intention), the conditional in d/rules was fixed and a patch from upstream was added. I also submitted the d/rules fix to Debian via [2]. Once that is merged, groovy will have the fix as well via a standard sync. Note the extra patch isn't needed in that version. 1. see the linked MP. Getting a diff from github just for the nginx plugin is hard because it is a subdirectory of the bigger certbot project. You can try, though: https://github.com/certbot/certbot/compare/v0.39.0...v0.40.0 and search for "certbot-nginx" 2. https://salsa.debian.org/letsencrypt-team/certbot/certbot-nginx/-/merge_requests/1 [Test Plan] a) See https://wiki.ubuntu.com/StableReleaseUpdates/Certbot#SRU_Verification_Process. Run https://wiki.ubuntu.com/StableReleaseUpdates/Certbot/TestScript (script updated by Brad Warren for this update, thank you!). Sample trailer output in comment #18. b) Request a registration with nginx (example shown in comment #19): sudo certbot -d --agree-tos --staging --register-unsafely-without-email --nginx c) Request a registration using apache (example shown in comment #21): sudo certbot -d --agree-tos --staging --register-unsafely-without-email --apache - TODO: add testscript.sh run results + d) Search build logs for "dh_auto_test" and confirm it was called and + that the build-time tests were run. In launchpad, you can find these by + going to https://launchpad.net/ubuntu/+source/python-certbot-nginx and + clicking through the version of this package in focal-proposed and the + builds on the right hand side of the screen. [Regression Potential] Upstream performs extensive testing before release, giving us a high degree of confidence in the general case. There problems are most likely to manifest in Ubuntu-specific integrations, such as in relation to the versions of dependencies available and other packaging-specific matters. python-acme 1.x which removed TLSSNI01 (among other changes) shouldn't have migrated to the release pocket without also migrating a newer 1.x version of python-certbot-*. This was fixed in the development release and in Debian via an ABI provides. This situation of having a more recent python-acme in focal but not accompanying python-certbot-* version bumps to the same series also made some related packages to become FTBFS in focal release: - bug #1876933: python-certbot FTBFS due to failing build time tests - bug #1876929: python-acme FTBFS due to unsatisfied dependency on python3-idna << 2.8 - bug #1876934: python-certbot-apache FTBFS due to failing build time tests python-certbot-nginx 0.39.0 didn't become an FTBFS like python-certbot- apache just because of the d/rules error in calling those tests, which is being fixed in this update. Fixing those FTBFS issues in the other packages is not in scope for this SRU. It is expected that certbot in general will get more updates in the future during the lifecycle of Ubuntu Focal, and updating the packages at that time will fix the build problem. At the moment, they don't impact the functionality of the system. See the discussion further down here in this bug, in particular comment #12 and comment #15, the latter being what was implemented for this SRU. [Original Description] This issue only affects version 0.39.0-1 of the python-certbot-nginx package in Ubuntu 20.04. To reproduce the problem, install python3-certbot-nginx and run a command like: sudo certbot -d example.org --agree-tos --staging --register-unsafely- without-email --nginx This command will fail and the relevant output is: AttributeError: module 'acme.challenges' has no attribute 'TLSSNI01' The problem here is python-certbot-nginx contains references to code in python-acme that has been removed. This problem makes python-certbot- nginx completely unabl
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
** Description changed: This bug tracks an update for python-certbot from 0.39.0 to 0.40.0. This update includes bugfixes only following the SRU policy exception defined at https://wiki.ubuntu.com/StableReleaseUpdates/Certbot. [Impact] Reguesting a certificate via the nginx plugin fails: AttributeError: module 'acme.challenges' has no attribute 'TLSSNI01' The problem here is python-certbot-nginx contains references to code in python-acme that has been removed. This problem makes python-certbot- nginx completely unable to obtain certificates. [Major Changes] To fix the problem, python-certbot-nginx is being updated from 0.39.0 to 0.40.0. The diff[1] is small and is about removing TLSSNI01 support. It was also noticed that the build-time tests were never run due to a bug in how they were called in d/rules. This has been fixed, and turns out the current version in focal release (0.39.0-1) is already an FTBFS when tests are properly run during build. To have the tests run at build time (as was the original intention), the conditional in d/rules was fixed and a patch from upstream was added. I also submitted the d/rules fix to Debian via [2]. Once that is merged, groovy will have the fix as well via a standard sync. Note the extra patch isn't needed in that version. - 1. see the linked MP. Getting a diff from github just for the nginx plugin is hard because it is a subdirectory of the bigger certbot project. + 1. see the linked MP. Getting a diff from github just for the nginx plugin is hard because it is a subdirectory of the bigger certbot project. You can try, though: https://github.com/certbot/certbot/compare/v0.39.0...v0.40.0 and search for "certbot-nginx" 2. https://salsa.debian.org/letsencrypt-team/certbot/certbot-nginx/-/merge_requests/1 [Test Plan] a) See https://wiki.ubuntu.com/StableReleaseUpdates/Certbot#SRU_Verification_Process. Run https://wiki.ubuntu.com/StableReleaseUpdates/Certbot/TestScript (script updated by Brad Warren for this update, thank you!). Sample trailer output in comment #18. b) Request a registration with nginx (example shown in comment #19): sudo certbot -d --agree-tos --staging --register-unsafely-without-email --nginx c) Request a registration using apache (example shown in comment #21): sudo certbot -d --agree-tos --staging --register-unsafely-without-email --apache TODO: add testscript.sh run results [Regression Potential] Upstream performs extensive testing before release, giving us a high degree of confidence in the general case. There problems are most likely to manifest in Ubuntu-specific integrations, such as in relation to the versions of dependencies available and other packaging-specific matters. python-acme 1.x which removed TLSSNI01 (among other changes) shouldn't have migrated to the release pocket without also migrating a newer 1.x version of python-certbot-*. This was fixed in the development release and in Debian via an ABI provides. This situation of having a more recent python-acme in focal but not accompanying python-certbot-* version bumps to the same series also made some related packages to become FTBFS in focal release: - bug #1876933: python-certbot FTBFS due to failing build time tests - bug #1876929: python-acme FTBFS due to unsatisfied dependency on python3-idna << 2.8 - bug #1876934: python-certbot-apache FTBFS due to failing build time tests python-certbot-nginx 0.39.0 didn't become an FTBFS like python-certbot- apache just because of the d/rules error in calling those tests, which is being fixed in this update. Fixing those FTBFS issues in the other packages is not in scope for this SRU. It is expected that certbot in general will get more updates in the future during the lifecycle of Ubuntu Focal, and updating the packages at that time will fix the build problem. At the moment, they don't impact the functionality of the system. See the discussion further down here in this bug, in particular comment #12 and comment #15, the latter being what was implemented for this SRU. [Original Description] This issue only affects version 0.39.0-1 of the python-certbot-nginx package in Ubuntu 20.04. To reproduce the problem, install python3-certbot-nginx and run a command like: sudo certbot -d example.org --agree-tos --staging --register-unsafely- without-email --nginx This command will fail and the relevant output is: AttributeError: module 'acme.challenges' has no attribute 'TLSSNI01' The problem here is python-certbot-nginx contains references to code in python-acme that has been removed. This problem makes python-certbot- nginx completely unable to obtain certificates. As the upstream maintainer of this package, I'll suggest two ways to fix this problem: 1. Update python-certbot-nginx to our 0.40.0 release. The benefit of
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
Successful run with apache: ubuntu@certbot-test:~$ sudo certbot -d certbot-test.justgohome.co.uk --agree-tos --staging --register-unsafely-without-email --apache Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Obtaining a new certificate Created an SSL vhost at /etc/apache2/sites-available/000-default-le-ssl.conf Enabled Apache socache_shmcb module Enabled Apache ssl module Deploying Certificate to VirtualHost /etc/apache2/sites-available/000-default-le-ssl.conf Enabling available site: /etc/apache2/sites-available/000-default-le-ssl.conf Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Enabled Apache rewrite module Redirecting vhost in /etc/apache2/sites-enabled/000-default.conf to ssl vhost in /etc/apache2/sites-available/000-default-le-ssl.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations! You have successfully enabled https://certbot-test.justgohome.co.uk You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=certbot-test.justgohome.co.uk - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/certbot-test.justgohome.co.uk/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/certbot-test.justgohome.co.uk/privkey.pem Your cert will expire on 2020-08-04. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" ** Description changed: This bug tracks an update for python-certbot from 0.39.0 to 0.40.0. This update includes bugfixes only following the SRU policy exception defined at https://wiki.ubuntu.com/StableReleaseUpdates/Certbot. [Impact] Not directly applicable; see the exception policy document at https://wiki.ubuntu.com/StableReleaseUpdates/Certbot Reguesting a certificate via the nginx plugin fails: AttributeError: module 'acme.challenges' has no attribute 'TLSSNI01' The problem here is python-certbot-nginx contains references to code in python-acme that has been removed. This problem makes python-certbot- nginx completely unable to obtain certificates. [Major Changes] To fix the problem, python-certbot-nginx is being updated from 0.39.0 to 0.40.0. The diff[1] is small and is about removing TLSSNI01 support. It was also noticed that the build-time tests were never run due to a bug in how they were called in d/rules. This has been fixed, and turns out the current version in focal release (0.39.0-1) is already an FTBFS when tests are properly run during build. To have the tests run at build time (as was the original intention), the conditional in d/rules was fixed and a patch from upstream was added. I also submitted the d/rules fix to Debian via [2]. Once that is merged, groovy will have the fix as well via a standard sync. Note the extra patch isn't needed in that version. 1. see the linked MP. Getting a diff from github just for the nginx plugin is hard because it is a subdirectory of the bigger certbot project. 2. https://salsa.debian.org/letsencrypt-team/certbot/certbot-nginx/-/merge_requests/1 [Test Plan] - See + a) See https://wiki.ubuntu.com/StableReleaseUpdates/Certbot#SRU_Verification_Process + + b) Request a registration with nginx: + sudo certbot -d --agree-tos --staging --register-unsafely-without-email --nginx + + c) Request a registration using apache: + sudo certbot -d --agree-tos --staging --register-unsafely-without-email --apache + + Comment #19 shows a successful manual registration using nginx and + packages from a test PPA TODO: add testscript.sh run results TODO: add manual registration results with nginx and apache against staging [Regression Potential] Upstream performs extensive testing before release, giving us a high degree of confidence in the general case. There problems are most likely to manifest in Ubuntu-specific integrations, such as in relation to the versions of dependencies available and other packaging-specific matters. python-acme 1.x which removed TLSSNI01 (among other changes) shouldn't have migrated to the release pocket witho
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
** Description changed: This bug tracks an update for python-certbot from 0.39.0 to 0.40.0. This update includes bugfixes only following the SRU policy exception defined at https://wiki.ubuntu.com/StableReleaseUpdates/Certbot. [Impact] Not directly applicable; see the exception policy document at https://wiki.ubuntu.com/StableReleaseUpdates/Certbot Reguesting a certificate via the nginx plugin fails: AttributeError: module 'acme.challenges' has no attribute 'TLSSNI01' The problem here is python-certbot-nginx contains references to code in python-acme that has been removed. This problem makes python-certbot- nginx completely unable to obtain certificates. [Major Changes] To fix the problem, python-certbot-nginx is being updated from 0.39.0 to 0.40.0. The diff[1] is small and is about removing TLSSNI01 support. It was also noticed that the build-time tests were never run due to a bug in how they were called in d/rules. This has been fixed, and turns out the current version in focal release (0.39.0-1) is already an FTBFS when tests are properly run during build. To have the tests run at build time (as was the original intention), the conditional in d/rules was fixed and a patch from upstream was added. I also submitted the d/rules fix to Debian via [2]. Once that is merged, groovy will have the fix as well via a standard sync. Note the extra patch isn't needed in that version. - 1. see the linked MP. Getting a diff from github just for the nginx plugin is hard because it is a subdirectory of the bigger certbot project. 2. https://salsa.debian.org/letsencrypt-team/certbot/certbot-nginx/-/merge_requests/1 [Test Plan] See https://wiki.ubuntu.com/StableReleaseUpdates/Certbot#SRU_Verification_Process TODO: add testscript.sh run results TODO: add manual registration results with nginx and apache against staging [Regression Potential] Upstream performs extensive testing before release, giving us a high degree of confidence in the general case. There problems are most likely to manifest in Ubuntu-specific integrations, such as in relation to the versions of dependencies available and other packaging-specific matters. python-acme 1.x which removed TLSSNI01 (among other changes) shouldn't have migrated to the release pocket without also migrating a newer 1.x version of python-certbot-*. This was fixed in the development release and in Debian via an ABI provides. This situation of having a more recent python-acme in focal but not accompanying python-certbot-* version bumps to the same series also made some related packages to become FTBFS in focal release: - bug #1876933: python-certbot FTBFS due to failing build time tests - bug #1876929: python-acme FTBFS due to unsatisfied dependency on python3-idna << 2.8 - bug #1876934: python-certbot-apache FTBFS due to failing build time tests python-certbot-nginx 0.39.0 didn't become an FTBFS like python-certbot- apache just because of the d/rules error in calling those tests, which is being fixed in this update. Fixing those FTBFS issues in the other packages is not in scope for this SRU. It is expected that certbot in general will get more updates in the future during the lifecycle of Ubuntu Focal, and updating the packages at that time will fix the build problem. At the moment, they don't impact the functionality of the system. See the discussion further down - here in this bug. + here in this bug, in particular comment #12 and comment #15, the latter + being what was implemented for this SRU. [Original Description] This issue only affects version 0.39.0-1 of the python-certbot-nginx package in Ubuntu 20.04. To reproduce the problem, install python3-certbot-nginx and run a command like: sudo certbot -d example.org --agree-tos --staging --register-unsafely- without-email --nginx This command will fail and the relevant output is: AttributeError: module 'acme.challenges' has no attribute 'TLSSNI01' The problem here is python-certbot-nginx contains references to code in python-acme that has been removed. This problem makes python-certbot- nginx completely unable to obtain certificates. As the upstream maintainer of this package, I'll suggest two ways to fix this problem: 1. Update python-certbot-nginx to our 0.40.0 release. The benefit of this is it sticks to well tested versions of our software rather than making potentially error prone backports. Certbot has an SRU exception which can be seen at https://wiki.ubuntu.com/StableReleaseUpdates/Certbot. The diff of code upstream between 0.39.0 and 0.40.0 if you all want to take this route can be see at https://gist.github.com/bmw/a88429687f4aed13e300fafdad85ce30. 2. You can manually backport minimal fixes. The only changes that should required from the above gist are the changes to: * cer
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
** Description changed: - This issue only affects version 0.39.0-1 of the python-certbot-nginx - package in Ubuntu 20.04. + This bug tracks an update for python-certbot from 0.39.0 to 0.40.0. + + This update includes bugfixes only following the SRU policy exception + defined at https://wiki.ubuntu.com/StableReleaseUpdates/Certbot. + + [Impact] + + Not directly applicable; see the exception policy document at + https://wiki.ubuntu.com/StableReleaseUpdates/Certbot + + Reguesting a certificate via the nginx plugin fails: + + AttributeError: module 'acme.challenges' has no attribute 'TLSSNI01' + + The problem here is python-certbot-nginx contains references to code in + python-acme that has been removed. This problem makes python-certbot- + nginx completely unable to obtain certificates. + + [Major Changes] + + To fix the problem, python-certbot-nginx is being updated from 0.39.0 to + 0.40.0. The diff[1] is small and is about removing TLSSNI01 support. + + It was also noticed that the build-time tests were never run due to a + bug in how they were called in d/rules. This has been fixed, and turns + out the current version in focal release (0.39.0-1) is already an FTBFS + when tests are properly run during build. + + To have the tests run at build time (as was the original intention), the + conditional in d/rules was fixed and a patch from upstream was added. I + also submitted the d/rules fix to Debian via [2]. Once that is merged, + groovy will have the fix as well via a standard sync. Note the extra + patch isn't needed in that version. + + + 1. see the linked MP. Getting a diff from github just for the nginx plugin is hard because it is a subdirectory of the bigger certbot project. + 2. https://salsa.debian.org/letsencrypt-team/certbot/certbot-nginx/-/merge_requests/1 + + [Test Plan] + + See + https://wiki.ubuntu.com/StableReleaseUpdates/Certbot#SRU_Verification_Process + + TODO: add testscript.sh run results + TODO: add manual registration results with nginx and apache against staging + + [Regression Potential] + + Upstream performs extensive testing before release, giving us a high + degree of confidence in the general case. There problems are most likely + to manifest in Ubuntu-specific integrations, such as in relation to the + versions of dependencies available and other packaging-specific matters. + + python-acme 1.x which removed TLSSNI01 (among other changes) shouldn't + have migrated to the release pocket without also migrating a newer 1.x + version of python-certbot-*. This was fixed in the development release + and in Debian via an ABI provides. + + This situation of having a more recent python-acme in focal but not accompanying python-certbot-* version bumps to the same series also made some related packages to become FTBFS in focal release: + - bug #1876933: python-certbot FTBFS due to failing build time tests + - bug #1876929: python-acme FTBFS due to unsatisfied dependency on python3-idna << 2.8 + - bug #1876934: python-certbot-apache FTBFS due to failing build time tests + + python-certbot-nginx 0.39.0 didn't become an FTBFS like python-certbot- + apache just because of the d/rules error in calling those tests, which + is being fixed in this update. + + Fixing those FTBFS issues in the other packages is not in scope for this + SRU. It is expected that certbot in general will get more updates in the + future during the lifecycle of Ubuntu Focal, and updating the packages + at that time will fix the build problem. At the moment, they don't + impact the functionality of the system. See the discussion further down + here in this bug. + + [Original Description] + This issue only affects version 0.39.0-1 of the python-certbot-nginx package in Ubuntu 20.04. To reproduce the problem, install python3-certbot-nginx and run a command like: sudo certbot -d example.org --agree-tos --staging --register-unsafely- without-email --nginx This command will fail and the relevant output is: AttributeError: module 'acme.challenges' has no attribute 'TLSSNI01' The problem here is python-certbot-nginx contains references to code in python-acme that has been removed. This problem makes python-certbot- nginx completely unable to obtain certificates. As the upstream maintainer of this package, I'll suggest two ways to fix this problem: 1. Update python-certbot-nginx to our 0.40.0 release. The benefit of this is it sticks to well tested versions of our software rather than making potentially error prone backports. Certbot has an SRU exception which can be seen at https://wiki.ubuntu.com/StableReleaseUpdates/Certbot. The diff of code upstream between 0.39.0 and 0.40.0 if you all want to take this route can be see at https://gist.github.com/bmw/a88429687f4aed13e300fafdad85ce30. 2. You can manually backport minimal fixes. The only changes that should required from the above gist are the changes to: * certbot_nginx/configur
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
Staging server test worked just fine. I'll prepare the SRU paperwork. ubuntu@certbot-test:~$ sudo certbot -d certbot-test.justgohome.co.uk --agree-tos --staging --register-unsafely-without-email --nginx Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator nginx, Installer nginx Obtaining a new certificate Performing the following challenges: http-01 challenge for certbot-test.justgohome.co.uk Waiting for verification... Cleaning up challenges Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/default Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled/default - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations! You have successfully enabled https://certbot-test.justgohome.co.uk You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=certbot-test.justgohome.co.uk - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/certbot-test.justgohome.co.uk/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/certbot-test.justgohome.co.uk/privkey.pem Your cert will expire on 2020-08-04. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
Thanks for the test update, worked great: (...) testing section-continuations-2525.conf...passed testing section-empty-continuations-2731.conf...passed testing semacode-1598.conf...passed testing two-blocks-one-line-1693.conf...passed Success! Package versions tested: certbot 0.40.0-1 letsencrypt python3-acme1.1.0-1 python3-certbot 0.40.0-1 python3-certbot-apache 0.39.0-1 python3-certbot-nginx 0.40.0-0ubuntu0.1~ppa1 python3-josepy 1.2.0-2 Looks like we can proceed with (d). I'll do a real test with the staging server tomorrow. -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
https://launchpad.net/~ahasenack/+archive/ubuntu/certbot- tlssni01-1875471-d -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
That sounds good, let me prepare a separate ppa for (d) -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
The testscript at https://wiki.ubuntu.com/StableReleaseUpdates/Certbot/TestScript no longer works: Cloning into '/root/gopath/src/github.com/letsencrypt/boulder'... remote: Enumerating objects: 2676, done. remote: Counting objects: 100% (2676/2676), done. remote: Compressing objects: 100% (2106/2106), done. remote: Total 2676 (delta 577), reused 1597 (delta 425), pack-reused 0 Receiving objects: 100% (2676/2676), 4.68 MiB | 6.77 MiB/s, done. Resolving deltas: 100% (577/577), done. sed: can't read tests/boulder-integration.sh: No such file or directory -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
Ok, I filed bugs for the FTBFS issues, but per policy, we won't do an update just to fix failed-to-build-from-source bugs: these should be updated together with something else. Thanks for all the options you outlined in comment #8, and for the check in comment #11. So to keep things simple: a) update just python-certbot-nginx to 0.40.0, and gloss over the fact that the build-time tests are being skipped; b) fix the build-time tests call in python-certbot-nginx, which will require these other changes: - bump python-certbot-apache to 0.40.0 - drop TLSSNI01 from python-certbot 0.40.0 - preferably fix python-acme's idna build-deps and update it together, as that would also run tests with the current idna in focal I didn't check if the version bumps have the commits you mentioned, but the tests and a minimal run worked. If this looks feasable, the next step would be to run the full test suite, and also try this on a live server with proper DNS setup. c) bump everything to what we have in groovy, so that the versions match expectations and we don't have this big mismatch we are seeing in focal right now There is a feeling we should go with (a) to fix the immediate problem, and (b) can be done over time, or even (c). I have the (b) scenario done in my ppa at https://launchpad.net/~ahasenack/+archive/ubuntu/certbot- tlssni01-1875471 -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
Quick update on the current focal situation regarding some of these packages: These are currently an FTBFS in focal: - python-certbot 0.40.0-1 (build-time tests fail) - python-acme 1.1.0-1 (build-dep python3-idna <<2.8 not satisfied. When it was last built in focal, python3-idna was at 2.6) - python-certbot-apache 0.39.0-1 (build-time tests fail) python-certbot-nginx 0.39.0-1 builds, but just because the tests are incorrectly skipped in d/rules. If they run, they fail, and that would FTBFS this package as well. If I change python-acme to accept python3-idna 2.8 as a build-dep (changing d/control do python3-idna << 2.9), then it builds. I don't know if this change is acceptable. Upstream python-idna made a 2.9 release in February 17th 2020, which we have in groovy and debian unstable. Will continue tomorrow. -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
Sorry for having gone radio silent in the past few days. I'm back on this tomorrow. -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
PPA with test packages: https://launchpad.net/~ahasenack/+archive/ubuntu /certbot-tlssni01-1875471 It has python-certbot with TLSSNI01 removed, probably not necessary for this bugfix, but it allowed me to re-introduce the build-time tests for the python-certbot-nginx package. Will continue tomorrow. -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
Would this commit be correct to apply on top of 0.40.0 to at least match python-acme 1.1.0-1 that is in focal w.r.t. TLSSNI01's removal? https://github.com/certbot/certbot/commit/4b488614cf7749c8139c11f0983fe4b71e29827f * Remove tls sni common (#7527) * fixes #7478 * add changelog entry If it's hard to check, then never mind. It just feels we could still be open to problems by having python-acme *without* TLSSNI01 but python-certbot *with* it somewhere in the code. -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
So python-certbot 0.40.0 still has TLSSNI01, but not acme, and so far only python-certbot-nginx is triggering the error. Probably not worth bumping python-certbot just to be able to run its tests correctly. -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
> In the current state in Focal/Groovy, the tests we include in our packages > are broken > for at least python-certbot, python-certbot-apache, and python-certbot-nginx. > The python-certbot-dns-* packages themselves are working, but I didn't verify > whether > or not the tests are. I can if people think that's important. I just saw that, when I fixed the tests to actually run at package build time (a problem still present in the 1.3.0-2 packages): diff --git a/debian/rules b/debian/rules index c057a16..154080a 100755 --- a/debian/rules +++ b/debian/rules @@ -21,6 +21,6 @@ override_dh_installdocs: dh_installdocs -p python3-certbot-nginx override_dh_auto_test: -ifdef (,$(filter nocheck,$(DEB_BUILD_OPTIONS))) +ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS))) python3 setup.py test endif The 0.40.0 tests fail with: = test session starts == platform linux -- Python 3.8.2, pytest-4.6.9, py-1.8.1, pluggy-0.13.0 rootdir: /home/ubuntu/git/packages/python-certbot-nginx/python-certbot-nginx collected 167 items / 1 errors / 166 selected ERRORS _ ERROR collecting certbot_nginx/tests/http_01_test.py _ certbot_nginx/tests/http_01_test.py:11: in from certbot.plugins import common_test :991: in _find_and_load ??? :975: in _find_and_load_unlocked ??? :655: in _load_unlocked ??? :618: in _load_backward_compatible ??? /usr/lib/python3/dist-packages/_pytest/assertion/rewrite.py:304: in load_module exec(co, mod.__dict__) /usr/lib/python3/dist-packages/certbot/plugins/common_test.py:26: in challenges.TLSSNI01(token=b'token1'), "pending"), E AttributeError: module 'acme.challenges' has no attribute 'TLSSNI01' I'll check latest upstream, maybe the diff to fix this test is simple enough to incorporate. I'd like to re-enable the tests at build time if possible. -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
The groovy packages are being updated, there are just too many packages being handled and the machines are very busy. For focal, we should take the path of updating the nginx subpackage to 0.40.0. I'll handle that and check the tests. -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1875471] Re: python3-certbot-nginx is incompatible with its dependencies
** Changed in: python-certbot-nginx (Ubuntu) Assignee: (unassigned) => Andreas Hasenack (ahasenack) ** Changed in: python-certbot-nginx (Ubuntu) Importance: Undecided => High ** Changed in: python-certbot-nginx (Ubuntu) Status: Confirmed => In Progress -- You received this bug notification because you are a member of Ubuntu Server, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1875471 Title: python3-certbot-nginx is incompatible with its dependencies To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-certbot-nginx/+bug/1875471/+subscriptions -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
