0.27.2

scripts/acme_provider.py

@@ -165,8 +165,20 @@ def credentials(value: dict) -> bytes:
     return "".join(f"dns_rfc2136_{k} = {v}\n" for k, v in lines.items()).encode("ascii")
 
 
-def certbot_command(value: dict, work: Path, credential_file: Path, executable: str) -> list[str]:
-    args = [executable, "certonly", "--non-interactive", "--agree-tos", "--no-eff-email",
+def certbot_prefix(executable: str | None = None) -> list[str]:
+    if executable:
+        return [executable]
+    managed_python = os.environ.get("RUSTPROXY_CERTBOT_PYTHON")
+    if managed_python:
+        return [managed_python, "-I", "-m", "certbot"]
+    discovered = shutil.which("certbot")
+    if discovered:
+        return [discovered]
+    raise AcmeError("acme.certbot_not_installed")
+
+
+def certbot_command(value: dict, work: Path, credential_file: Path, command_prefix: list[str]) -> list[str]:
+    args = [*command_prefix, "certonly", "--non-interactive", "--agree-tos", "--no-eff-email",
             "--email", value["email"], "--server", DIRECTORIES[value["environment"]],
             "--cert-name", "rustproxy", "--keep-until-expiring", "--key-type", "ecdsa",
             "--config-dir", str(work / "config"), "--work-dir", str(work / "work"),
@@ -203,9 +215,7 @@ def read_generated(work: Path, name: str) -> bytes:
 
 def issue(raw: dict, certificate_directory: Path, executable: str | None = None) -> dict:
     value = validate(raw)
-    executable = executable or shutil.which("certbot")
-    if not executable:
-        raise AcmeError("acme.certbot_not_installed")
+    command_prefix = certbot_prefix(executable)
     certificate_directory = certificate_directory.absolute()
     private_directory(certificate_directory)
     root = certificate_directory / "acme"
@@ -242,7 +252,7 @@ def issue(raw: dict, certificate_directory: Path, executable: str | None = None)
             temporary = work / ("profile-" + uuid.uuid4().hex)
             write_new(temporary, json.dumps(profile).encode())
             os.replace(temporary, work / "profile.json")
-            args = certbot_command(value, work, credential_file, executable)
+            args = certbot_command(value, work, credential_file, command_prefix)
             try:
                 result = subprocess.run(args, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
                                         stderr=subprocess.DEVNULL, timeout=1200 + value["propagation_seconds"], check=False)
@@ -354,9 +364,7 @@ def renew(raw: dict, certificate_directory: Path, executable: str | None = None)
     Dry-run validates challenge access but never stages/deploys its test output.
     """
     value = renewal_request(raw)
-    executable = executable or shutil.which("certbot")
-    if not executable:
-        raise AcmeError("acme.certbot_not_installed")
+    command_prefix = certbot_prefix(executable)
     certificate_directory = certificate_directory.absolute()
     private_directory(certificate_directory)
     work = profile_directory(certificate_directory, value["provider"], value["environment"], value["certificate_id"])
@@ -400,7 +408,7 @@ def renew(raw: dict, certificate_directory: Path, executable: str | None = None)
             installed_key = read_private(certificate_directory / value["key_file"], MAX_PEM)
             # Check dependencies/installed PEM before invoking a CA operation.
             old_dates = certificate_dates(installed_cert)
-            args = [executable, "renew", "--cert-name", "rustproxy", "--non-interactive",
+            args = [*command_prefix, "renew", "--cert-name", "rustproxy", "--non-interactive",
                     "--no-random-sleep-on-renew", "--no-directory-hooks",
                     "--config-dir", str(work / "config"), "--work-dir", str(work / "work"), "--logs-dir", str(work / "logs")]
             if value["dry_run"]: