0.27.2

scripts/release_smoke.py

@@ -7,6 +7,7 @@ then checks the 0.24.1 shared-statistics/runtime/settings contracts and retained
 from __future__ import annotations
 
 import hashlib
+import importlib.util
 import json
 import os
 import re
@@ -123,7 +124,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.27.1"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.27.2"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
@@ -134,7 +135,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert (target / "docker-agent/certificate.go").is_file()
     assert (target / "docker-agent/server.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.27.1"
+    assert manifest["to_version"] == "0.27.2"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -604,7 +605,7 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.27.1"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.27.2"' in openapi_0241
     assert 'id="panel-logging"' not in html
     for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
         assert marker in html, marker
@@ -1087,7 +1088,7 @@ def source_contract_smoke() -> None:
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
     assert '"/api/config/history/restore"' in openapi
-    for marker in ['"version": "0.27.1"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.27.2"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1238,6 +1239,52 @@ def reproducible_archive_smoke(tmp: Path) -> None:
         assert len(timestamps) == 1
 
 
+def managed_acme_relocation_smoke(tmp: Path) -> None:
+    """Reproduce the 0.27.1 relocated console-script shebang failure."""
+    stage = tmp / "acme-python.installing"
+    final = tmp / "acme-python"
+    bindir = stage / "bin"
+    bindir.mkdir(parents=True)
+    python = bindir / "python"
+    python.write_text(
+        "#!/bin/sh\n"
+        "test \"$1\" = -I && test \"$2\" = -m && test \"$3\" = certbot && test \"$4\" = --version || exit 2\n"
+        "echo 'certbot 5.8.0'\n",
+        encoding="utf-8",
+    )
+    python.chmod(0o755)
+    console = bindir / "certbot"
+    console.write_text(f"#!{python}\necho 'certbot 5.8.0'\n", encoding="utf-8")
+    console.chmod(0o755)
+    stage.rename(final)
+
+    relocated_console = final / "bin/certbot"
+    try:
+        subprocess.run([str(relocated_console), "--version"], check=True, capture_output=True, text=True)
+    except OSError:
+        pass
+    else:
+        raise AssertionError("relocated pip console script unexpectedly kept a valid staging shebang")
+
+    worker_path = ROOT / "scripts/acme_provider.py"
+    spec = importlib.util.spec_from_file_location("rustproxy_acme_provider", worker_path)
+    assert spec and spec.loader
+    module = importlib.util.module_from_spec(spec)
+    old = os.environ.get("RUSTPROXY_CERTBOT_PYTHON")
+    os.environ["RUSTPROXY_CERTBOT_PYTHON"] = str(final / "bin/python")
+    try:
+        spec.loader.exec_module(module)
+        prefix = module.certbot_prefix()
+        assert prefix == [str(final / "bin/python"), "-I", "-m", "certbot"]
+        result = subprocess.run(prefix + ["--version"], check=True, capture_output=True, text=True)
+        assert result.stdout.strip() == "certbot 5.8.0"
+    finally:
+        if old is None:
+            os.environ.pop("RUSTPROXY_CERTBOT_PYTHON", None)
+        else:
+            os.environ["RUSTPROXY_CERTBOT_PYTHON"] = old
+
+
 def main() -> None:
     subprocess.run(["python3", str(ROOT / "scripts/rust_module_contracts.py")], check=True)
     subprocess.run(["python3", str(ROOT / "scripts/source_module_contracts.py")], check=True)
@@ -1245,6 +1292,7 @@ def main() -> None:
         tmp = Path(directory)
         sql_and_backup_smoke(tmp / "sql")
         upgrade_smoke(tmp / "upgrade")
+        managed_acme_relocation_smoke(tmp / "acme-relocation")
         reproducible_archive_smoke(tmp / "archives")
         deployment_gate_smoke(tmp)
         npm_migration_smoke(tmp)
@@ -1252,7 +1300,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     grafana_contract_smoke()
-    print("PASS: 0.27.1 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.27.2 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":