certapi 1.1.7__tar.gz → 1.1.9__tar.gz

{certapi-1.1.7/src/certapi.egg-info → certapi-1.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.7
+Version: 1.1.9
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-1.1.7 → certapi-1.1.9}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="1.1.7",
+    version="1.1.9",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-1.1.7 → certapi-1.1.9}/src/certapi/client/renewal_manager.py

@@ -476,7 +476,8 @@ class RenewalManager:
                 "key_type": self.key_type,
                 "expiry_days": self.expiry_days,
                 "renew_threshold_days": renew_threshold_days,
-                "skip_failing": False,
+                # Renewal should obtain whatever can be issued, then self-sign unresolved domains.
+                "skip_failing": True,
                 "batch_domains": True,
                 "self_verify": self.self_verify,
                 "country": self.country,
@@ -492,7 +493,16 @@ class RenewalManager:
             )
             if res is None:
                 return
-            self._update_expiry_cache(res.issued + res.existing)
+            certs = res.issued + res.existing
+            self._update_expiry_cache(certs)
+            covered_domains = self._covered_domains_from_response(certs)
+            unresolved_domains = [domain for domain in domains if domain not in covered_domains]
+            for domain in unresolved_domains:
+                self._add_to_blacklist(domain, now)
+                if domain in domains_with_cached_entries or self._has_local_certificate(domain):
+                    self._schedule_existing_certificate_retry(domain, now)
+                else:
+                    self._register_self_signed(domain)
         except Exception as e:
             self._set_error(e)
             for domain in domains:
@@ -563,6 +573,14 @@ class RenewalManager:
             self._cache = {d: exp for d, exp in self._cache.items() if d in self._watch_domains}
             self._lock.notify_all()
 
+    def _covered_domains_from_response(self, certs) -> Set[str]:
+        covered: Set[str] = set()
+        for cert in certs:
+            for domain in cert.domains:
+                if domain:
+                    covered.add(domain)
+        return covered
+
     def _add_to_blacklist(self, domain: str, now: datetime):
         with self._lock:
             self._blacklist[domain] = now + timedelta(seconds=self.blacklist_duration_seconds)

{certapi-1.1.7 → certapi-1.1.9}/src/certapi/domain_batching.py

@@ -36,19 +36,6 @@ def would_trigger(labels: list[str], blocked: set[str]) -> bool:
     return False
 
 
-def split_domain_to_safe_groups(domain: str, blocked_labels: list[str] | None = None) -> list[list[str]]:
-    """
-    Split labels into contiguous chunks of at most 3 labels.
-    This mirrors the "3 labels are always safe for this specific LE heuristic"
-    invariant, but these label groups are not used directly as issuance domains.
-    """
-    labels = _split_labels(domain)
-    n = len(labels)
-    if n == 0:
-        return []
-    return [labels[i : i + 3] for i in range(0, n, 3)]
-
-
 def create_safe_domain_batches(domains: list[str], blocked_labels: list[str] | None = None) -> list[list[str]]:
     """
     Create compact issuance batches without any blocked-label list assumptions.
@@ -74,8 +61,7 @@ def create_safe_domain_batches(domains: list[str], blocked_labels: list[str] | N
             compact_batch.append(normalized)
             continue
 
-        for i in range(0, len(labels), 3):
-            singleton_batches.append([".".join(labels[i : i + 3])])
+        singleton_batches.append([normalized])
 
     if compact_batch:
         return [compact_batch, *singleton_batches]

{certapi-1.1.7 → certapi-1.1.9/src/certapi.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.7
+Version: 1.1.9
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-1.1.7 → certapi-1.1.9}/tests/test_acme_cert_manager_batching.py

@@ -1,4 +1,4 @@
-from certapi.domain_batching import create_safe_domain_batches, split_domain_to_safe_groups, would_trigger
+from certapi.domain_batching import create_safe_domain_batches, would_trigger
 from certapi.manager.acme_cert_manager import AcmeCertManager
 
 
@@ -42,14 +42,6 @@ def test_would_trigger_exact_rule():
     assert would_trigger(["x", "abc", "abc", "example", "com"], blocked) is True
 
 
-def test_split_domain_to_safe_groups_greedy():
-    groups = split_domain_to_safe_groups(
-        "x.abc.def.ghi.example.com",
-        blocked_labels=["abc", "def", "ghi"],
-    )
-    assert groups == [["x", "abc", "def"], ["ghi", "example", "com"]]
-
-
 def test_create_safe_domain_batches_compacts_non_triggering_domains():
     domains = ["x.example.com", "y.example.com", "y.example.com"]
     assert create_safe_domain_batches(domains) == [["x.example.com", "y.example.com"]]
@@ -91,10 +83,9 @@ def test_issue_certificate_in_batches_uses_custom_batch_generator():
 
     assert issuer.calls == [
         ["root.example.com"],
-        ["x.abc.def"],
-        ["ghi.example.com"],
+        ["x.abc.def.ghi.example.com"],
     ]
-    assert len(response.issued) == 3
+    assert len(response.issued) == 2
     assert [issued.domains for issued in response.issued] == issuer.calls
 
 
@@ -112,10 +103,9 @@ def test_obtain_batch_domains_uses_safe_batches():
 
     assert issuer.calls == [
         ["root.example.com"],
-        ["x.abc.def"],
-        ["ghi.example.com"],
+        ["x.abc.def.ghi.example.com"],
     ]
-    assert len(response.issued) == 3
+    assert len(response.issued) == 2
 
 
 def test_issue_certificate_self_verify_false_skips_strict_solver_check():

{certapi-1.1.7 → certapi-1.1.9}/tests/test_renewal_manager.py

@@ -425,7 +425,7 @@ def test_renewal_manager_passes_typed_obtain_options_into_renewal_calls():
     assert len(client.calls) == 1
     assert client.calls[0]["kwargs"]["batch_domains"] is True
     assert client.calls[0]["kwargs"]["self_verify"] is False
-    assert client.calls[0]["kwargs"]["skip_failing"] is False
+    assert client.calls[0]["kwargs"]["skip_failing"] is True
     assert client.calls[0]["kwargs"]["renew_threshold_days"] == 30
     assert client.calls[0]["kwargs"]["organization"] == "certapi-tests"
 
@@ -523,6 +523,25 @@ def test_new_domain_failure_selfsigns_and_blacklists():
     assert len(client.calls) == 2
 
 
+def test_partial_renewal_success_selfsigns_uncovered_domains():
+    now = datetime(2026, 1, 1, tzinfo=UTC)
+    client = DummyClient()
+    client.key_store = DummyKeyStore()
+    ok_cert = _make_cert_pem("ok.example.com", now, valid_for_days=60)
+    client.set_handler(
+        "ok.example.com",
+        CertificateResponse(issued=[IssuedCert(cert=ok_cert, domains=["ok.example.com"])], existing=[]),
+    )
+
+    mgr = RenewalManager(client, renew_threshold_days=30, clock_fn=lambda: now)
+    mgr._renew_domains(["ok.example.com", "missing.example.com"], now)
+
+    with mgr._lock:
+        assert "ok.example.com" in mgr._cache
+    assert len(client.key_store.saved_certs) == 1
+    assert client.key_store.saved_certs[0][2] == "missing.example.com.selfsigned"
+
+
 def test_update_watch_domains_blocks_until_running_worker_processes_domains():
     now = datetime(2026, 1, 1, tzinfo=UTC)
     started = threading.Event()
@@ -672,7 +691,7 @@ def test_remote_certapi_polling_prints_waiting_message(capsys):
     assert len(client.obtain_calls) == 1
 
 
-def test_remote_renewal_disables_skip_failing_so_unverified_domain_fails():
+def test_remote_renewal_uses_skip_failing_and_selfsigns_unresolved_domain():
     now = datetime(2026, 1, 1, tzinfo=UTC)
     client = DummyRemoteSkipFailingClient()
     client.key_store = DummyKeyStore()
@@ -681,9 +700,9 @@ def test_remote_renewal_disables_skip_failing_so_unverified_domain_fails():
     mgr.update_watch_domains(["missing.example.com"])
 
     assert len(client.obtain_calls) == 1
-    assert client.obtain_calls[0]["kwargs"]["skip_failing"] is False
+    assert client.obtain_calls[0]["kwargs"]["skip_failing"] is True
     assert "missing.example.com" in mgr.get_state()["blacklisted_domains"]
-    assert "None of the domains are owned" in mgr.get_state()["last_error_message"]
+    assert mgr.get_state()["last_error_message"] is None
     assert len(client.key_store.saved_certs) == 1
     assert client.key_store.saved_certs[0][2] == "missing.example.com.selfsigned"