gowalk-cicd 1.0.161 → 1.0.163
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/action/.daemux-version
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
1.0.
|
|
1
|
+
1.0.163
|
|
@@ -1 +1 @@
|
|
|
1
|
-
1.0.
|
|
1
|
+
1.0.163
|
|
@@ -1 +1 @@
|
|
|
1
|
-
1.0.
|
|
1
|
+
1.0.163
|
|
@@ -6,6 +6,37 @@ certbot_lock_busy() {
|
|
|
6
6
|
"$CERTBOT_WORK/stdout" "$CERTBOT_WORK/stderr"
|
|
7
7
|
}
|
|
8
8
|
|
|
9
|
+
# Fixed cause codes for a failed Certbot command. Certbot's own text stays private: only these
|
|
10
|
+
# tokens and a three-digit HTTP status from the CA's validation report reach the log.
|
|
11
|
+
certbot_failure_causes() {
|
|
12
|
+
local causes="" code pattern http=""
|
|
13
|
+
while IFS='|' read -r code pattern; do
|
|
14
|
+
if grep -Eiq -- "$pattern" "$CERTBOT_WORK/stdout" "$CERTBOT_WORK/stderr"; then
|
|
15
|
+
causes="${causes:+$causes,}$code"
|
|
16
|
+
fi
|
|
17
|
+
done <<'CAUSES'
|
|
18
|
+
rate_limited|rateLimited|too many (certificates|new orders|failed authorizations|registrations)
|
|
19
|
+
rejected_identifier|rejectedIdentifier|forbidden by policy
|
|
20
|
+
caa|CAA record
|
|
21
|
+
dns|Type: +dns|acme:error:dns|DNS problem
|
|
22
|
+
connection|Type: +connection|acme:error:connection|Timeout during (connect|read)|Connection refused
|
|
23
|
+
unauthorized|Type: +unauthorized|acme:error:unauthorized
|
|
24
|
+
incorrect_response|Invalid response from|incorrectResponse
|
|
25
|
+
secondary_validation|During secondary validation
|
|
26
|
+
tls|Type: +tls|acme:error:tls
|
|
27
|
+
account|accountDoesNotExist|Account (is not valid|does not exist)
|
|
28
|
+
ca_unavailable|serverInternal|Service busy|down for maintenance
|
|
29
|
+
nginx_restart|nginx restart failed|Error while running nginx
|
|
30
|
+
nginx_vhost|Could not automatically find a matching server block
|
|
31
|
+
nginx_parse|Could not parse file
|
|
32
|
+
nginx_plugin|nginx plugin is not working|Could not find a usable .nginx. binary
|
|
33
|
+
CAUSES
|
|
34
|
+
http="$(grep -Eoh -- 'Invalid response from [^ ]+( \[[^]]+\])?: [1-5][0-9]{2}' "$CERTBOT_WORK/stdout" \
|
|
35
|
+
"$CERTBOT_WORK/stderr" | grep -Eo '[1-5][0-9]{2}$' | head -1)" || http=""
|
|
36
|
+
[ -z "$http" ] || causes="${causes:+$causes,}http_$http"
|
|
37
|
+
printf '%s' "${causes:-unclassified}"
|
|
38
|
+
}
|
|
39
|
+
|
|
9
40
|
certbot_attempt() {
|
|
10
41
|
local phase="$1" attempt="$2" status
|
|
11
42
|
shift 2
|
|
@@ -18,7 +49,7 @@ certbot_attempt() {
|
|
|
18
49
|
if certbot_lock_busy; then
|
|
19
50
|
log "certificate phase=$phase attempt=$attempt state=lock_busy exit=$status"
|
|
20
51
|
else
|
|
21
|
-
log "certificate phase=$phase attempt=$attempt state=error exit=$status"
|
|
52
|
+
log "certificate phase=$phase attempt=$attempt state=error exit=$status cause=$(certbot_failure_causes)"
|
|
22
53
|
fi
|
|
23
54
|
return "$status"
|
|
24
55
|
}
|
|
@@ -80,7 +111,11 @@ certificate_present() {
|
|
|
80
111
|
|
|
81
112
|
request_certificate() {
|
|
82
113
|
local domain="$1" email="$2" attempt="$3" account
|
|
83
|
-
|
|
114
|
+
# Certbot tells the CA to validate one second after reloading nginx by default. A host with
|
|
115
|
+
# hundreds of vhosts and certificates takes longer to load a new configuration, so the CA
|
|
116
|
+
# reached old workers still serving the token-gated edge and HTTP-01 failed with 403
|
|
117
|
+
# (2026-09-24). Certbot also stores this wait for renewals of the certificate.
|
|
118
|
+
set -- --nginx --nginx-sleep-seconds 10 -d "$domain" --non-interactive --agree-tos --email "$email" --redirect
|
|
84
119
|
account="$(select_certbot_account)" || return $?
|
|
85
120
|
if [ -n "$account" ]; then
|
|
86
121
|
log "using an existing Let's Encrypt account"
|