certapi 1.1.6__tar.gz → 1.1.8__tar.gz

{certapi-1.1.6/src/certapi.egg-info → certapi-1.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.6
+Version: 1.1.8
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -10,7 +10,7 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.6
 Description-Content-Type: text/markdown
-Requires-Dist: cryptography
+Requires-Dist: cryptography>=39.0.0
 Requires-Dist: requests
 Dynamic: author
 Dynamic: author-email

{certapi-1.1.6 → certapi-1.1.8}/setup.py

@@ -2,11 +2,11 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="1.1.6",
+    version="1.1.8",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[
-        "cryptography",
+        "cryptography>=39.0.0",
         "requests",
     ],
     include_package_data=True,

{certapi-1.1.6 → certapi-1.1.8}/src/certapi/client/renewal_manager.py

@@ -419,8 +419,8 @@ class RenewalManager:
             if (expiry - now).total_seconds() < due_window:
                 due_domains.append(domain)
 
-        for domain in due_domains:
-            self._renew_domain(domain, now)
+        if due_domains:
+            self._renew_domains(due_domains, now)
 
         return len(due_domains)
 
@@ -463,10 +463,12 @@ class RenewalManager:
                     self._cache[domain] = expiry
             self._lock.notify_all()
 
-    def _renew_domain(self, domain: str, now: datetime):
-        domain_had_cached_entry = False
+    def _renew_domains(self, domains: List[str], now: datetime):
+        domains_with_cached_entries = []
         with self._lock:
-            domain_had_cached_entry = domain in self._cache
+            for domain in domains:
+                if domain in self._cache:
+                    domains_with_cached_entries.append(domain)
 
         try:
             renew_threshold_days = self.cert_min_renew_threshold_secs // (24 * 3600)
@@ -475,7 +477,7 @@ class RenewalManager:
                 "expiry_days": self.expiry_days,
                 "renew_threshold_days": renew_threshold_days,
                 "skip_failing": False,
-                "batch_domains": self.batch_domains,
+                "batch_domains": True,
                 "self_verify": self.self_verify,
                 "country": self.country,
                 "state": self.state,
@@ -485,7 +487,7 @@ class RenewalManager:
             }
             res = self._call_certificate_backend(
                 self.cert_manager_client.obtain,
-                [domain],
+                domains,
                 obtain_options,
             )
             if res is None:
@@ -493,11 +495,12 @@ class RenewalManager:
             self._update_expiry_cache(res.issued + res.existing)
         except Exception as e:
             self._set_error(e)
-            self._add_to_blacklist(domain, now)
-            if domain_had_cached_entry or self._has_local_certificate(domain):
-                self._schedule_existing_certificate_retry(domain, now)
-            else:
-                self._register_self_signed(domain)
+            for domain in domains:
+                self._add_to_blacklist(domain, now)
+                if domain in domains_with_cached_entries or self._has_local_certificate(domain):
+                    self._schedule_existing_certificate_retry(domain, now)
+                else:
+                    self._register_self_signed(domain)
 
     def _schedule_existing_certificate_retry(self, domain: str, now: datetime):
         retry_interval_seconds = min(self.renew_retry_interval_seconds, 24 * 3600)

{certapi-1.1.6 → certapi-1.1.8}/src/certapi/domain_batching.py

@@ -36,19 +36,6 @@ def would_trigger(labels: list[str], blocked: set[str]) -> bool:
     return False
 
 
-def split_domain_to_safe_groups(domain: str, blocked_labels: list[str] | None = None) -> list[list[str]]:
-    """
-    Split labels into contiguous chunks of at most 3 labels.
-    This mirrors the "3 labels are always safe for this specific LE heuristic"
-    invariant, but these label groups are not used directly as issuance domains.
-    """
-    labels = _split_labels(domain)
-    n = len(labels)
-    if n == 0:
-        return []
-    return [labels[i : i + 3] for i in range(0, n, 3)]
-
-
 def create_safe_domain_batches(domains: list[str], blocked_labels: list[str] | None = None) -> list[list[str]]:
     """
     Create compact issuance batches without any blocked-label list assumptions.
@@ -74,8 +61,7 @@ def create_safe_domain_batches(domains: list[str], blocked_labels: list[str] | N
             compact_batch.append(normalized)
             continue
 
-        for i in range(0, len(labels), 3):
-            singleton_batches.append([".".join(labels[i : i + 3])])
+        singleton_batches.append([normalized])
 
     if compact_batch:
         return [compact_batch, *singleton_batches]

{certapi-1.1.6 → certapi-1.1.8}/src/certapi/issuers/AcmeCertIssuer.py

@@ -95,7 +95,7 @@ class AcmeCertIssuer(CertIssuer):
                     return order.get_certificate()
                 return None
             elif order.status == "processing":
-                return obtain_cert()
+                return obtain_cert(count - 1)
             return None  # TODO: error throwing here
 
         return obtain_cert()

{certapi-1.1.6 → certapi-1.1.8/src/certapi.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.6
+Version: 1.1.8
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -10,7 +10,7 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.6
 Description-Content-Type: text/markdown
-Requires-Dist: cryptography
+Requires-Dist: cryptography>=39.0.0
 Requires-Dist: requests
 Dynamic: author
 Dynamic: author-email

certapi-1.1.8/src/certapi.egg-info/requires.txt

@@ -0,0 +1,2 @@
+cryptography>=39.0.0
+requests

{certapi-1.1.6 → certapi-1.1.8}/tests/test_acme_cert_manager_batching.py

@@ -1,4 +1,4 @@
-from certapi.domain_batching import create_safe_domain_batches, split_domain_to_safe_groups, would_trigger
+from certapi.domain_batching import create_safe_domain_batches, would_trigger
 from certapi.manager.acme_cert_manager import AcmeCertManager
 
 
@@ -42,14 +42,6 @@ def test_would_trigger_exact_rule():
     assert would_trigger(["x", "abc", "abc", "example", "com"], blocked) is True
 
 
-def test_split_domain_to_safe_groups_greedy():
-    groups = split_domain_to_safe_groups(
-        "x.abc.def.ghi.example.com",
-        blocked_labels=["abc", "def", "ghi"],
-    )
-    assert groups == [["x", "abc", "def"], ["ghi", "example", "com"]]
-
-
 def test_create_safe_domain_batches_compacts_non_triggering_domains():
     domains = ["x.example.com", "y.example.com", "y.example.com"]
     assert create_safe_domain_batches(domains) == [["x.example.com", "y.example.com"]]
@@ -91,10 +83,9 @@ def test_issue_certificate_in_batches_uses_custom_batch_generator():
 
     assert issuer.calls == [
         ["root.example.com"],
-        ["x.abc.def"],
-        ["ghi.example.com"],
+        ["x.abc.def.ghi.example.com"],
     ]
-    assert len(response.issued) == 3
+    assert len(response.issued) == 2
     assert [issued.domains for issued in response.issued] == issuer.calls
 
 
@@ -112,10 +103,9 @@ def test_obtain_batch_domains_uses_safe_batches():
 
     assert issuer.calls == [
         ["root.example.com"],
-        ["x.abc.def"],
-        ["ghi.example.com"],
+        ["x.abc.def.ghi.example.com"],
     ]
-    assert len(response.issued) == 3
+    assert len(response.issued) == 2
 
 
 def test_issue_certificate_self_verify_false_skips_strict_solver_check():

{certapi-1.1.6 → certapi-1.1.8}/tests/test_renewal_manager.py

@@ -25,7 +25,7 @@ class DummyClient:
 
     def obtain(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
-        self.calls.append({"host": host, "kwargs": kwargs})
+        self.calls.append({"host": host, "hosts": hosts, "kwargs": kwargs})
         handler = self._handlers.get(host)
         if handler is None:
             return CertificateResponse()
@@ -47,12 +47,12 @@ class DummyClientWithObtain(DummyClient):
 
     def obtain(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
-        self.obtain_calls.append({"host": host, "kwargs": kwargs})
+        self.obtain_calls.append({"host": host, "hosts": hosts, "kwargs": kwargs})
         return super().obtain(hosts, **kwargs)
 
     def issue_certificate(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
-        self.issue_calls.append({"host": host, "kwargs": kwargs})
+        self.issue_calls.append({"host": host, "hosts": hosts, "kwargs": kwargs})
         return super().obtain(hosts, **kwargs)
 
 
@@ -702,3 +702,16 @@ def test_stop_does_not_wait_for_hung_remote_request_thread():
 
     assert not mgr._thread.is_alive()
     release.set()
+
+
+def test_renewal_manager_batches_due_domains():
+    now = datetime(2026, 1, 1, tzinfo=UTC)
+    client = DummyClientWithObtain()
+    client.set_handler("domain1.com", CertificateResponse())
+
+    mgr = RenewalManager(client, renew_threshold_days=30, clock_fn=lambda: now, batch_domains=True)
+    mgr.update_watch_domains(["domain1.com", "domain2.com"])
+
+    assert len(client.obtain_calls) == 1
+    assert "domain1.com" in client.obtain_calls[0]["hosts"]
+    assert "domain2.com" in client.obtain_calls[0]["hosts"]

certapi-1.1.6/src/certapi.egg-info/requires.txt

@@ -1,2 +0,0 @@
-cryptography
-requests