Bug#887399: stretch-pu: package python-certbot/0.10.2-1
Control: tag -1 moreinfo
On Mon, Jan 15, 2018 at 18:04:59 -0500, Harlan Lieberman-Berg wrote:
> Due to a security issue in the underlying Let's Encrypt protocol, one of the main methods of getting certificates from Let's Encrypt has been disabled (the TLS-SNI-01 protocol; https://community.letsencrypt.org/t/tls-sni-challenges-disabled-for-most-new-issuance/50316 for more info).
>
> This puts us in a bit of an awkward spot. The upstream certbot provider is preparing to do a new release that has support for HTTP-01 inside the python-certbot-apache and python-certbot-nginx plugins, as well as the required work in python-acme and python-certbot (and certbot), but I'm not sure backporting the patches is realistic. A lot of development has been done in the interim, both in the certbot packaging and in the upstream software. Without those patches, users with the apache or nginx plugins will fail to update their certificates starting 2018-04-09.
>
> I can talk to the certbot upstream to see if they'd be willing to help backport the patches (CCed), but initial conversations seem to indicate that doing so will be difficult.
>
> The other approach that we can take is to backport the next version that supports the new challenge through to s-p-u and into stable. I'm guessing that you will ask me to unwind the work I did to convert to python3 in the last release (sadface), but I can do that if that's what it needs to get this fixed in stable.
>
I'm not sure that'd be wise, if it would mean shipping something
untested. To me, the workable alternatives seem to be to either remove
those packages from stable, or update them to a current version. At
least the 0.21 packages have presumably had some testing in
stretch-backports. The switches to python 3 and debhelper 11 are
unfortunate, and at least the latter would need to be reverted. I'm
worried about local scripts or other integration using python2 and
breaking if we were to move certbot to python3; how likely is that? On
the other hand, I guess if they're still using the package from stable
it's going to break on them soon anyway.
What is the minimal set of source packages that we would need to update?
Is it python-acme, python-certbot, python-certbot-apache and
python-certbot-nginx?
Cheers,
Julien
Reply to: