certbot-dns-teo 1.0.0__tar.gz

certbot_dns_teo-1.0.0/.gitignore

@@ -0,0 +1,265 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+*.lcov
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# uv
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi/*
+!.pixi/config.toml
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule*
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs/Zensical documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore that
+#   can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, you
+#   could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+
+# Local AI assistant instructions, configuration, sessions, and artifacts
+AGENTS.md
+AGENTS.override.md
+CLAUDE.md
+CLAUDE.local.md
+GEMINI.md
+COPILOT.md
+AI_CONTEXT.md
+SKILL.md
+.codex/
+.claude/
+.gemini/
+.cursor/
+.windsurf/
+.cline/
+.roo/
+.trae/
+.continue/
+.opencode/
+.agent/
+.agents/
+.ai/
+.skills/
+.zcode/
+.specify/
+.serena/
+.kiro/
+.junie/
+.cursorrules
+.cursorignore
+.cursorindexingignore
+.clinerules
+.windsurfrules
+.roorules
+.aider*
+.mcp.json
+mcp.json
+/ai/
+/skills/
+/.github/copilot-instructions.md
+/.github/instructions/
+/.github/prompts/
+/.github/agents/
+/.github/skills/

certbot_dns_teo-1.0.0/CHANGELOG.md

@@ -0,0 +1,13 @@
+# 更新记录
+
+## 1.0.0 — 2026-10-27
+
+- 发布 `certbot-dns-teo` 与 `certbot-dns-tencent-edgeone` 1.0.0，兼容包精确依赖同版本核心包。
+- 沿用 `dns-teo` 认证器、`dns_teo_` 凭证前缀和现有 DNS-01 验证行为。
+
+## 0.1.0
+
+- 实现腾讯云 EdgeOne (TEO) 的 Certbot DNS-01 插件 `dns-teo`。
+- 支持 NS 站点发现、泛域名、多 TXT 值、已有记录保护和临时凭证。
+- 提供 Certbot 3/4/5 兼容测试、wheel 检查与 CI/CD。
+- 新增兼容发行包 `certbot-dns-tencent-edgeone`，依赖同版本 `certbot-dns-teo`，继续使用 `dns-teo` 插件及原有配置；支持双包构建、安装验证和按依赖顺序发布。

certbot_dns_teo-1.0.0/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 iDigimon
+Copyright (c) 2025 TiyeeJiang (portions adapted from certbot-dns-tencent)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

certbot_dns_teo-1.0.0/PKG-INFO

@@ -0,0 +1,145 @@
+Metadata-Version: 2.4
+Name: certbot-dns-teo
+Version: 1.0.0
+Summary: 腾讯云 EdgeOne (TEO) 插件，用于 Certbot 的 DNS-01 验证
+Project-URL: Homepage, https://github.com/iDigimon/teo
+Project-URL: Repository, https://github.com/iDigimon/teo
+Project-URL: Issues, https://github.com/iDigimon/teo/issues
+Author-email: tiyee <tiyee@live.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: acme,certbot,dns-01,edgeone,tencent,teo
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Plugins
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Requires-Dist: acme<6,>=3
+Requires-Dist: certbot<5,>=3; python_version < '3.10'
+Requires-Dist: certbot<6,>=3; python_version >= '3.10' and python_version < '3.14'
+Requires-Dist: certbot<6,>=4; python_version >= '3.14'
+Requires-Dist: importlib-metadata<9,>=4.6; python_version < '3.10'
+Requires-Dist: tencentcloud-sdk-python-teo<4,>=3.1.130
+Description-Content-Type: text/markdown
+
+# Certbot DNS EdgeOne (TEO) 插件
+
+通过腾讯云 EdgeOne API 完成 Certbot DNS-01 验证，支持普通域名和泛域名。
+
+站点必须已通过 **NS 模式接入 EdgeOne**，并完成权威 DNS 服务器切换。CNAME 接入、DNSPod 托管接入及 Pages 站点请使用实际权威 DNS 服务商的插件；本插件不会修改 DNSPod。
+
+## 功能特性
+
+- 使用官方腾讯云 TEO SDK（API 版本 `2022-09-01`）
+- 自动分页查询站点，按 DNS 标签边界选择最长匹配的站点，支持 IDN
+- 支持同名多个 TXT 验证值，仅删除本次创建的记录，保留已有记录
+- 支持临时凭证，可指定站点 ID 解决同名站点歧义
+- 支持 Certbot 3/4/5，Python 3.9–3.15
+
+Python 3.9 使用 Certbot 3/4（Certbot 4.2 起要求 Python ≥3.9.2）；Python 3.14–3.15 使用 Certbot 4/5。
+Certbot 3 环境需额外安装 `pyopenssl<25`。
+
+## 安装
+
+在本仓库目录安装，插件和 Certbot 必须处于同一个 Python 环境：
+
+```bash
+python3 -m pip install .
+# 或使用 uv 创建独立工具环境
+uv tool install --with . 'certbot>=5,<6'
+```
+
+也可安装兼容包 `certbot-dns-tencent-edgeone`，它依赖同版本的 `certbot-dns-teo`，共用实现和插件入口。在仓库根目录同时安装两个本地项目：
+
+```bash
+python3 -m pip install . ./packages/certbot-dns-tencent-edgeone
+```
+
+两个包发布到 PyPI 后，也可用 `python3 -m pip install certbot-dns-tencent-edgeone` 安装。
+使用任一包时，认证器均为 `dns-teo`，命令行参数和凭证前缀均保持 `dns-teo-` / `dns_teo_`。
+
+## 配置文件
+
+保存为 `~/teo.ini`：
+
+```ini
+dns_teo_secret_id = YOUR_SECRET_ID
+dns_teo_secret_key = YOUR_SECRET_KEY
+# 使用临时凭证时填写
+# dns_teo_token = YOUR_SESSION_TOKEN
+# 可选：仅允许操作指定的 NS 站点，同名站点有歧义时必须指定
+# dns_teo_zone_id = zone-xxxxxxxxxxxx
+```
+
+```bash
+chmod 600 ~/teo.ini
+```
+
+## 运行
+
+```bash
+certbot certonly \
+  --authenticator dns-teo \
+  --dns-teo-credentials ~/teo.ini \
+  --dns-teo-propagation-seconds 30 \
+  -d example.com \
+  -d '*.example.com'
+```
+
+TXT TTL 默认 600 秒，可用 `--dns-teo-ttl` 设置为 60–86400 秒。
+传播等待默认 30 秒，由 Certbot 在所有挑战记录创建后统一执行；如 DNS 尚未生效，可增加 `--dns-teo-propagation-seconds`。
+成功签发后可用 `certbot renew` 续期，Certbot 会保存认证器和凭证路径。
+
+## 腾讯云权限配置
+
+SecretId / SecretKey 所属账号需要以下操作权限（CAM 自定义策略）：
+
+```json
+{
+  "version": "2.0",
+  "statement": [{
+    "effect": "allow",
+    "action": [
+      "teo:DescribeZones",
+      "teo:DescribeDnsRecords",
+      "teo:CreateDnsRecord",
+      "teo:DeleteDnsRecords"
+    ],
+    "resource": ["*"]
+  }]
+}
+```
+
+使用公共端点 `teo.tencentcloudapi.com`，不需要配置 Region。
+指定 `dns_teo_zone_id` 后仍需 `DescribeZones` 权限，以校验域名范围和 NS 接入状态。
+
+## 开发与验证
+
+```bash
+uv sync --locked --all-packages --python 3.13
+uv run --no-sync ruff check .
+uv run --no-sync ruff format --check .
+uv run --no-sync pytest --cov=certbot_dns_teo --cov-report=term-missing
+uv run --no-sync tox run-parallel -p 4
+uv build --all-packages --out-dir dist --clear
+uv run --no-sync twine check --strict dist/*
+uv run --no-sync python scripts/check_alias_installation.py
+```
+
+测试使用真实 SDK 请求/响应对象和 ACME 挑战对象，mock 云端调用，不修改真实 DNS 或申请证书。
+兼容矩阵覆盖 Python 3.9–3.13 × Certbot 3、Python 3.9–3.15 × Certbot 4、Python 3.10–3.15 × Certbot 5；tox 从源码目录之外验证 wheel 和实际 Certbot CLI 插件发现。
+GitHub Actions 执行相同检查，并在全新环境中仅以兼容包为安装目标，验证其自动安装核心依赖且 Certbot 只发现一个 `dns-teo` 插件。
+两个包版本保持一致，兼容包的依赖固定为同版本核心包；升级时需同时修改根目录和 `packages/certbot-dns-tencent-edgeone/pyproject.toml` 中的版本及依赖，测试会检查一致性。
+发布 `v1.0.0` 格式的正式 GitHub Release 后，经 CI 通过使用 PyPI Trusted Publishing 先发布核心包，再发布兼容包。两个 PyPI 项目均需配置此仓库的受信任发布者（`release.yml` 工作流、GitHub `pypi` environment）。预发布仅验证和构建。
+
+参考实现：[certbot-dns-tencent](https://github.com/iDigimon/certbot-dns-tencent)。
+接口文档：[站点列表](https://cloud.tencent.com/document/api/1552/80713)、[DNS 记录列表](https://cloud.tencent.com/document/api/1552/80716)、[创建记录](https://cloud.tencent.com/document/api/1552/80720)、[删除记录](https://cloud.tencent.com/document/api/1552/80718)。

certbot_dns_teo-1.0.0/README.md

@@ -0,0 +1,112 @@
+# Certbot DNS EdgeOne (TEO) 插件
+
+通过腾讯云 EdgeOne API 完成 Certbot DNS-01 验证，支持普通域名和泛域名。
+
+站点必须已通过 **NS 模式接入 EdgeOne**，并完成权威 DNS 服务器切换。CNAME 接入、DNSPod 托管接入及 Pages 站点请使用实际权威 DNS 服务商的插件；本插件不会修改 DNSPod。
+
+## 功能特性
+
+- 使用官方腾讯云 TEO SDK（API 版本 `2022-09-01`）
+- 自动分页查询站点，按 DNS 标签边界选择最长匹配的站点，支持 IDN
+- 支持同名多个 TXT 验证值，仅删除本次创建的记录，保留已有记录
+- 支持临时凭证，可指定站点 ID 解决同名站点歧义
+- 支持 Certbot 3/4/5，Python 3.9–3.15
+
+Python 3.9 使用 Certbot 3/4（Certbot 4.2 起要求 Python ≥3.9.2）；Python 3.14–3.15 使用 Certbot 4/5。
+Certbot 3 环境需额外安装 `pyopenssl<25`。
+
+## 安装
+
+在本仓库目录安装，插件和 Certbot 必须处于同一个 Python 环境：
+
+```bash
+python3 -m pip install .
+# 或使用 uv 创建独立工具环境
+uv tool install --with . 'certbot>=5,<6'
+```
+
+也可安装兼容包 `certbot-dns-tencent-edgeone`，它依赖同版本的 `certbot-dns-teo`，共用实现和插件入口。在仓库根目录同时安装两个本地项目：
+
+```bash
+python3 -m pip install . ./packages/certbot-dns-tencent-edgeone
+```
+
+两个包发布到 PyPI 后，也可用 `python3 -m pip install certbot-dns-tencent-edgeone` 安装。
+使用任一包时，认证器均为 `dns-teo`，命令行参数和凭证前缀均保持 `dns-teo-` / `dns_teo_`。
+
+## 配置文件
+
+保存为 `~/teo.ini`：
+
+```ini
+dns_teo_secret_id = YOUR_SECRET_ID
+dns_teo_secret_key = YOUR_SECRET_KEY
+# 使用临时凭证时填写
+# dns_teo_token = YOUR_SESSION_TOKEN
+# 可选：仅允许操作指定的 NS 站点，同名站点有歧义时必须指定
+# dns_teo_zone_id = zone-xxxxxxxxxxxx
+```
+
+```bash
+chmod 600 ~/teo.ini
+```
+
+## 运行
+
+```bash
+certbot certonly \
+  --authenticator dns-teo \
+  --dns-teo-credentials ~/teo.ini \
+  --dns-teo-propagation-seconds 30 \
+  -d example.com \
+  -d '*.example.com'
+```
+
+TXT TTL 默认 600 秒，可用 `--dns-teo-ttl` 设置为 60–86400 秒。
+传播等待默认 30 秒，由 Certbot 在所有挑战记录创建后统一执行；如 DNS 尚未生效，可增加 `--dns-teo-propagation-seconds`。
+成功签发后可用 `certbot renew` 续期，Certbot 会保存认证器和凭证路径。
+
+## 腾讯云权限配置
+
+SecretId / SecretKey 所属账号需要以下操作权限（CAM 自定义策略）：
+
+```json
+{
+  "version": "2.0",
+  "statement": [{
+    "effect": "allow",
+    "action": [
+      "teo:DescribeZones",
+      "teo:DescribeDnsRecords",
+      "teo:CreateDnsRecord",
+      "teo:DeleteDnsRecords"
+    ],
+    "resource": ["*"]
+  }]
+}
+```
+
+使用公共端点 `teo.tencentcloudapi.com`，不需要配置 Region。
+指定 `dns_teo_zone_id` 后仍需 `DescribeZones` 权限，以校验域名范围和 NS 接入状态。
+
+## 开发与验证
+
+```bash
+uv sync --locked --all-packages --python 3.13
+uv run --no-sync ruff check .
+uv run --no-sync ruff format --check .
+uv run --no-sync pytest --cov=certbot_dns_teo --cov-report=term-missing
+uv run --no-sync tox run-parallel -p 4
+uv build --all-packages --out-dir dist --clear
+uv run --no-sync twine check --strict dist/*
+uv run --no-sync python scripts/check_alias_installation.py
+```
+
+测试使用真实 SDK 请求/响应对象和 ACME 挑战对象，mock 云端调用，不修改真实 DNS 或申请证书。
+兼容矩阵覆盖 Python 3.9–3.13 × Certbot 3、Python 3.9–3.15 × Certbot 4、Python 3.10–3.15 × Certbot 5；tox 从源码目录之外验证 wheel 和实际 Certbot CLI 插件发现。
+GitHub Actions 执行相同检查，并在全新环境中仅以兼容包为安装目标，验证其自动安装核心依赖且 Certbot 只发现一个 `dns-teo` 插件。
+两个包版本保持一致，兼容包的依赖固定为同版本核心包；升级时需同时修改根目录和 `packages/certbot-dns-tencent-edgeone/pyproject.toml` 中的版本及依赖，测试会检查一致性。
+发布 `v1.0.0` 格式的正式 GitHub Release 后，经 CI 通过使用 PyPI Trusted Publishing 先发布核心包，再发布兼容包。两个 PyPI 项目均需配置此仓库的受信任发布者（`release.yml` 工作流、GitHub `pypi` environment）。预发布仅验证和构建。
+
+参考实现：[certbot-dns-tencent](https://github.com/iDigimon/certbot-dns-tencent)。
+接口文档：[站点列表](https://cloud.tencent.com/document/api/1552/80713)、[DNS 记录列表](https://cloud.tencent.com/document/api/1552/80716)、[创建记录](https://cloud.tencent.com/document/api/1552/80720)、[删除记录](https://cloud.tencent.com/document/api/1552/80718)。

certbot_dns_teo-1.0.0/certbot_dns_teo/__init__.py

@@ -0,0 +1,5 @@
+"""Tencent Cloud EdgeOne authenticator for Certbot 3, 4 and 5."""
+
+from certbot_dns_teo.compat import metadata
+
+__version__ = metadata.version("certbot-dns-teo")

certbot_dns_teo-1.0.0/certbot_dns_teo/compat.py

@@ -0,0 +1,24 @@
+"""Keep host compatibility in one place, using Certbot's public APIs.
+
+DNSAuthenticator already handles the annotated-challenge API changes between
+Certbot 3, 4 and 5. Inherit its public lifecycle instead of copying it or applying
+the obsolete zope.interface decorators (removed from Certbot's dependencies).
+"""
+
+import sys
+
+from certbot.plugins.dns_common import DNSAuthenticator
+
+if sys.version_info < (3, 10):
+    # Python 3.9's stdlib entry_points() does not support the group keyword.
+    import importlib_metadata as metadata
+else:
+    from importlib import metadata
+
+
+def certbot_major_version() -> int:
+    """Return the actual installed host version, not a resolver assumption."""
+    return int(metadata.version("certbot").split(".", 1)[0])
+
+
+__all__ = ["DNSAuthenticator", "certbot_major_version", "metadata"]