2.2 KiB
RustProxy 0.27.2 implementation note
Scope
0.27.2 is a focused ACME runtime repair. It keeps SQLite schema 8 and the saved configuration format unchanged.
Managed Certbot relocation bug
0.27.1 creates the private environment under <data-dir>/acme-python.installing, installs Certbot and its DNS plugins there, validates it, and then atomically renames the directory to <data-dir>/acme-python.
Python virtual-environment console scripts created by pip contain an absolute interpreter path in their shebang. After the directory rename, bin/certbot can still point at the removed acme-python.installing/bin/python. Executing that console script can therefore fail with a local OSError; the private worker intentionally reduced such errors to acme.local_io_or_json_error, which hid the relocation detail from the UI.
Repair
Managed-environment validation now runs Certbot as:
<data-dir>/acme-python/bin/python -I -m certbot --version
ACME issuance and renewal use the same final interpreter with -m certbot. The provider worker receives the managed interpreter path from RustProxy and no longer depends on the relocated pip console-script shebang.
The existing system/distribution Certbot fallback continues to execute its discovered certbot program normally.
Upgrade behavior
No ACME profile, account, certificate or credential migration is required. An acme-python environment created by 0.27.1 can be reused as-is because 0.27.2 bypasses the stale console-script shebang and imports Certbot from the environment's installed Python modules.
0.27.3 correction
The module-based workaround described above was invalid for current Certbot packages: Certbot 5.8.0 installs a certbot console entry point but does not expose a runnable certbot.__main__, so python -m certbot fails even when installation and plugin imports are valid.
0.27.3 no longer relocates a freshly built managed environment after pip creates its console scripts. The environment is created/rebuilt directly at <data-dir>/acme-python, validation executes <data-dir>/acme-python/bin/certbot --version, and issuance/renewal use that same final console entry point. An older environment with a stale relocated shebang fails validation and is rebuilt at the final path.