acme-client 2.0.33 → 2.0.35

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b7216d10cb299e96cb201b06b84dd4d37ca10c2a37b5e32bb62f508fe76c7c77
-  data.tar.gz: b27c4e177e4ae6332bff52ee4b8afe04a50157bbfcb4cc17a6a9d0bfa94d6864
+  metadata.gz: f38120a91d760cdaf3a37defaf5c100da771a656655bb9cf26276901371e89f3
+  data.tar.gz: 712b061ca7d441c0fcbb5554a21a44c1495bf0fa5a7b21010942f644f79d353b
 SHA512:
-  metadata.gz: df38f4e1c3f961aefb7d39ca86872c3816208349c9c917523b5215e988bad389a3d10133168092260f5c5c845210e4c80aad8705df13606e2c9767a88fda6c7c
-  data.tar.gz: 4960de02cea2e1fe074ea1fe6df1ba9ee62c59c6dfe7156359179f04ab6be40155f8a308676f70dc2796eef06641f6781025da7ec8fabc8ee7b36e41b446d0b6
+  metadata.gz: d830b1206e60ae98a031de5237618c3a526fdd2f29ebaed5aa018352c15c3838e30015a104de622a850846ac56e5bbe94c06b94378bab854adb961031c8548ef
+  data.tar.gz: 741e5e8b735527b1f95b630564ce0cf1729880323cb3eae7696ce7a7738570de73ab2ce0aaf3bb0bf53c2b7418d3ad56240e2373f55414bf2e112f7802443dc2

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## `2.0.35`
+
+* Expose the RFC 8555 order `error` field on `Resources::Order#error` and add `Order#typed_error`
+
+## `2.0.34`
+
+* Add badAttestationStatement error
+
 ## `2.0.33`
 
 * Add `Acme::Client::Problem` for structured RFC 7807 / RFC 8555 ACME problem documents

data/README.md

@@ -224,6 +224,15 @@ end
 order.certificate # => PEM-formatted certificate
 ```
 
+When the server fails issuance after accepting the finalize request, the order moves to `invalid` and carries a problem document explaining why.
+
+```ruby
+if order.status == 'invalid'
+  order.error       # => { "type" => "urn:ietf:params:acme:error:rateLimited", "detail" => "..." }
+  order.typed_error # => Acme::Client::Error::RateLimited
+end
+```
+
 ### Ordering an alternative certificate
 
 The provider may provide alternate certificate with different certificate chain. You can specify the required chain and the client will automatically download alternate certificate and match the chain by name.

data/Rakefile

@@ -3,4 +3,9 @@ require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new(:spec)
 
+desc 'Check the gem against the live IANA ACME error registry'
+task :spec_iana_registry do
+  sh({ 'RUN_IANA_REGISTRY_SPEC' => '1' }, 'bundle exec rspec spec/iana_registry_spec.rb')
+end
+
 task default: [:spec]

data/lib/acme/client/error.rb

@@ -97,6 +97,7 @@ class Acme::Client::Error < StandardError
   class AutoRenewalRevocationNotSupported < ServerError; end
   class UnknownDelegation < ServerError; end
   class OnionCAARequired < ServerError; end
+  class BadAttestationStatement < ServerError; end
 
   ACME_ERRORS = {
     'urn:ietf:params:acme:error:alreadyReplaced' => AlreadyReplaced,
@@ -129,6 +130,7 @@ class Acme::Client::Error < StandardError
     'urn:ietf:params:acme:error:autoRenewalCancellationInvalid' => AutoRenewalCancellationInvalid,
     'urn:ietf:params:acme:error:autoRenewalRevocationNotSupported' => AutoRenewalRevocationNotSupported,
     'urn:ietf:params:acme:error:unknownDelegation' => UnknownDelegation,
-    'urn:ietf:params:acme:error:onionCAARequired' => OnionCAARequired
+    'urn:ietf:params:acme:error:onionCAARequired' => OnionCAARequired,
+    'urn:ietf:params:acme:error:badAttestationStatement' => BadAttestationStatement,
   }
 end

data/lib/acme/client/problem.rb

@@ -38,7 +38,8 @@ class Acme::Client::Problem
     'autoRenewalRevocationNotSupported' => 'A request to revoke an auto-renewal Order has been received',
     'unknownDelegation' => 'An unknown configuration is listed in the delegation attribute of the order request',
     'onionCAARequired' => 'The CA only supports checking the CAA for Hidden Services in-band, but the client has not provided an in-band CAA',
-    'alreadyReplaced' => 'The request specified a predecessor certificate that has already been marked as replaced'
+    'alreadyReplaced' => 'The request specified a predecessor certificate that has already been marked as replaced',
+    'badAttestationStatement' => 'The attestation statement is unacceptable (e.g. not signed by an attestation authority trusted by the CA)'
   }.freeze
 
   def self.from(value)

data/lib/acme/client/resources/order.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class Acme::Client::Resources::Order
-  attr_reader :url, :status, :contact, :finalize_url, :identifiers, :authorization_urls, :expires, :certificate_url, :profile, :replaces, :retry_after, :retry_after_time
+  attr_reader :url, :status, :contact, :finalize_url, :identifiers, :authorization_urls, :expires, :certificate_url, :profile, :replaces, :error, :retry_after, :retry_after_time
 
   def initialize(client, **arguments)
     @client = client
@@ -46,6 +46,16 @@ class Acme::Client::Resources::Order
     @client.renewal_info(certificate:, ari_id:)
   end
 
+  def typed_error
+    return nil unless error
+
+    problem = Acme::Client::Problem.from(error)
+    error_type = problem&.type
+    error_detail = problem&.detail || 'Unknown error'
+    error_class = Acme::Client::Error::ACME_ERRORS.fetch(error_type, Acme::Client::Error)
+    error_class.new(error_detail, problem: problem)
+  end
+
   def to_h
     {
       url: url,
@@ -57,13 +67,14 @@ class Acme::Client::Resources::Order
       certificate_url: certificate_url,
       profile: profile,
       replaces: replaces,
+      error: error,
       retry_after: retry_after
     }
   end
 
   private
 
-  def assign_attributes(url: nil, status:, expires:, finalize_url:, authorization_urls:, identifiers:, certificate_url: nil, profile: nil, replaces: nil, retry_after: nil) # rubocop:disable Layout/LineLength,Metrics/ParameterLists
+  def assign_attributes(url: nil, status:, expires:, finalize_url:, authorization_urls:, identifiers:, certificate_url: nil, profile: nil, replaces: nil, error: nil, retry_after: nil) # rubocop:disable Layout/LineLength,Metrics/ParameterLists
     @url = url unless url.nil?
     @status = status
     @expires = expires
@@ -73,6 +84,7 @@ class Acme::Client::Resources::Order
     @certificate_url = certificate_url
     @profile = profile
     @replaces = replaces
+    @error = error
     @retry_after = retry_after
     @retry_after_time = Acme::Client::Util.parse_retry_after(retry_after)
   end

data/lib/acme/client/version.rb

@@ -2,6 +2,6 @@
 
 module Acme
   class Client
-    VERSION = '2.0.33'.freeze
+    VERSION = '2.0.35'.freeze
   end
 end

data/lib/acme/client.rb

@@ -323,7 +323,8 @@ class Acme::Client
       [:certificate_url, 'certificate'],
       :identifiers,
       :profile,
-      :replaces
+      :replaces,
+      :error
     )
 
     attributes[:url] = response.headers[:location] if response.headers[:location]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: acme-client
 version: !ruby/object:Gem::Version
-  version: 2.0.33
+  version: 2.0.35
 platform: ruby
 authors:
 - Charles Barbier