certmate-cli 0.1.4__tar.gz → 0.1.6__tar.gz

{certmate_cli-0.1.4 → certmate_cli-0.1.6}/.gitignore

@@ -79,6 +79,7 @@ htmlcov/
 .pytest_cache/
 .coverage
 coverage.xml
+coverage.json
 test_results.json
 
 # Local dev / debug scripts (kept on developer machines only)
@@ -114,3 +115,9 @@ theme-baseline/
 UI_DRACONIAN_ANALYSIS.md
 UI_UX_Opinioni_CertMate.pdf
 UI_REDESIGN_PLAN.md
+
+# Local nginx reverse-proxy config: copy nginx.conf.example to nginx.conf and
+# fill in your domain. The copy is yours; the example is tracked (#576).
+nginx.conf
+tls-erros.md
+.mypy_cache/

{certmate_cli-0.1.4 → certmate_cli-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: certmate-cli
-Version: 0.1.4
+Version: 0.1.6
 Summary: CertMate command-line interface — the SSL certificate lifecycle from your terminal
 Project-URL: Homepage, https://github.com/fabriziosalmi/certmate
 Project-URL: Source, https://github.com/fabriziosalmi/certmate/tree/main/clients/certmate-cli
@@ -23,7 +23,7 @@ Classifier: Topic :: Security
 Classifier: Topic :: System :: Systems Administration
 Classifier: Topic :: Utilities
 Requires-Python: >=3.9
-Requires-Dist: certmate-sdk>=0.1.3
+Requires-Dist: certmate-sdk>=0.1.6
 Requires-Dist: rich>=13
 Requires-Dist: typer>=0.9
 Description-Content-Type: text/markdown
@@ -34,7 +34,7 @@ The [CertMate](https://github.com/fabriziosalmi/certmate) SSL certificate
 lifecycle from your terminal — built on `certmate-sdk`.
 
 ```bash
-pip install certmate-cli
+pip install certmate-cli     # or, on macOS/Linux: brew install fabriziosalmi/certmate/certmate-cli
 export CERTMATE_URL=http://localhost:8000
 export CERTMATE_TOKEN=...
 
@@ -43,9 +43,16 @@ certmate cert ls
 certmate cert info app.example.com
 certmate cert renew app.example.com --force
 certmate cert create app.example.com --dns cloudflare --dry-run
+certmate cert create app.example.com --name internal.example.com --dns cloudflare
 certmate audit verify
 ```
 
+`--name` names a second certificate for a domain apart from it: the certificate
+is issued for `app.example.com`, and every later command takes
+`internal.example.com`. The server must be on API contract 2.61 or later; an
+older one would ignore the name, so the CLI asks first and refuses, and
+`--dry-run` says whether the server takes it.
+
 ## Pulling certificates onto a host
 
 `cert download` fetches one file at a time, so a target server can pull

{certmate_cli-0.1.4 → certmate_cli-0.1.6}/README.md

@@ -4,7 +4,7 @@ The [CertMate](https://github.com/fabriziosalmi/certmate) SSL certificate
 lifecycle from your terminal — built on `certmate-sdk`.
 
 ```bash
-pip install certmate-cli
+pip install certmate-cli     # or, on macOS/Linux: brew install fabriziosalmi/certmate/certmate-cli
 export CERTMATE_URL=http://localhost:8000
 export CERTMATE_TOKEN=...
 
@@ -13,9 +13,16 @@ certmate cert ls
 certmate cert info app.example.com
 certmate cert renew app.example.com --force
 certmate cert create app.example.com --dns cloudflare --dry-run
+certmate cert create app.example.com --name internal.example.com --dns cloudflare
 certmate audit verify
 ```
 
+`--name` names a second certificate for a domain apart from it: the certificate
+is issued for `app.example.com`, and every later command takes
+`internal.example.com`. The server must be on API contract 2.61 or later; an
+older one would ignore the name, so the CLI asks first and refuses, and
+`--dry-run` says whether the server takes it.
+
 ## Pulling certificates onto a host
 
 `cert download` fetches one file at a time, so a target server can pull

{certmate_cli-0.1.4 → certmate_cli-0.1.6}/certmate_cli/__init__.py

@@ -1,2 +1,2 @@
 """certmate-cli — the CertMate SSL lifecycle from your terminal (built on certmate-sdk)."""
-__version__ = "0.1.4"
+__version__ = "0.1.6"

{certmate_cli-0.1.4 → certmate_cli-0.1.6}/certmate_cli/main.py

@@ -21,7 +21,7 @@ import typer
 from rich.console import Console
 from rich.table import Table
 
-from certmate import Client, CertMateError, Job
+from certmate import CertMateError, Client, Job, UnsupportedByServer
 
 app = typer.Typer(no_args_is_help=True, add_completion=False,
                   help="CertMate — the SSL certificate lifecycle from your terminal.")
@@ -166,11 +166,31 @@ def cert_ls(ctx: typer.Context):
     table.add_column("DAYS", justify="right")
     table.add_column("CA")
     table.add_column("AUTO-RENEW")
-    for c in sorted(certs, key=lambda x: (x.days_until_expiry if x.days_until_expiry is not None else 1 << 30)):
+    # Sort by seconds where the server sends them: a certificate with 23 hours
+    # left and one that lapsed an hour ago are both 0 or -1 in whole days, and
+    # would otherwise land next to each other in either order.
+    def _remaining(cert):
+        if cert.seconds_left is not None:
+            return cert.seconds_left
+        if cert.days_until_expiry is not None:
+            return cert.days_until_expiry * 86400
+        return 1 << 40
+
+    for c in sorted(certs, key=_remaining):
         days = c.days_until_expiry
-        days_str = "-" if days is None else str(days)
-        colour = "green"
-        if days is not None:
+        expired = c.has_expired()
+        # "0" for a certificate with 23 hours left was read as expired by
+        # everything that saw it, including CertMate's own dashboard until
+        # server 2.32.2. Say which of the two it is instead of printing the
+        # number that cannot tell them apart.
+        if expired is True:
+            days_str, colour = "expired", "red"
+        elif days is None:
+            days_str, colour = "-", "green"
+        elif days == 0:
+            days_str, colour = ("<1" if expired is False else "?"), "red"
+        else:
+            days_str = str(days)
             colour = "red" if days < 7 else ("yellow" if days < 30 else "green")
         table.add_row(
             c.domain,
@@ -187,8 +207,20 @@ def cert_info(ctx: typer.Context, domain: str):
     """Show a certificate's details."""
     c = _run(lambda: _client(ctx).get_certificate(domain))
     out.print(f"[bold]{c.domain}[/]")
-    out.print(f"  expires:     {c.expiry_date or '-'}  "
-              f"({c.days_until_expiry if c.days_until_expiry is not None else '?'} days)")
+    if c.host and c.host != c.domain:
+        # Where it is served, when that is not its name: an IP certificate's
+        # address, or the host a certificate named apart from it is for.
+        out.print(f"  host:        {c.host}")
+    if c.has_expired() is True:
+        remaining = "[red]expired[/]"
+    elif c.days_until_expiry is None:
+        remaining = "? days"
+    elif c.days_until_expiry == 0:
+        # Under a day, and not expired, or the server is too old to say.
+        remaining = "less than a day" if c.has_expired() is False else "? days"
+    else:
+        remaining = f"{c.days_until_expiry} days"
+    out.print(f"  expires:     {c.expiry_date or '-'}  ({remaining})")
     out.print(f"  CA:          {c.ca_provider or '-'}")
     out.print(f"  DNS:         {c.dns_provider or '-'}")
     out.print(f"  auto-renew:  {c.auto_renew}")
@@ -205,6 +237,12 @@ def cert_create(
     dns: Optional[str] = typer.Option(None, "--dns", help="DNS provider (e.g. cloudflare)."),
     ca: Optional[str] = typer.Option(None, "--ca", help="CA provider (e.g. letsencrypt)."),
     san: Optional[str] = typer.Option(None, "--san", help="Comma-separated SAN domains."),
+    # A str with an empty default, not Optional: typer reads the annotation at
+    # runtime, and `str | None` is not one on Python 3.9.
+    name: str = typer.Option(
+        "", "--name",
+        help="Name the certificate apart from its domain, for a second certificate for it "
+             "(server API contract 2.61 or later)."),
     wait: bool = typer.Option(True, "--wait/--no-wait", help="Wait for issuance to finish."),
     dry_run: bool = typer.Option(False, "--dry-run",
                                  help="Validate inputs and preflight the DNS provider WITHOUT issuing."),
@@ -214,6 +252,8 @@ def cert_create(
     # bogus "" SAN entry — mirrors cert_reissue.
     sans: List[str] = [s.strip() for s in san.split(",") if s.strip()] if san else []
     client = _client(ctx)
+    # What it is issued as: the domain, and the name it is given apart from it.
+    issued_as = f"{domain} as {name}" if name else domain
 
     if dry_run:
         problems = []
@@ -222,6 +262,16 @@ def cert_create(
         for s in sans:
             if not _DOMAIN_RE.match(s):
                 problems.append(f"SAN {s!r} does not look valid")
+        if name:
+            # The server's rule (#1149): the shape of a DNS name, never a wildcard.
+            if not _DOMAIN_RE.match(name) or name.startswith("*."):
+                problems.append(f"name {name!r} is not a DNS name")
+            try:
+                client.require_contract("2.61", "name")
+            except UnsupportedByServer as e:
+                problems.append(str(e))
+            except CertMateError as e:
+                _die(str(e))
         if dns:
             res = _run(lambda: client.test_dns_provider(dns))
             ok = bool(res.get("success", res.get("ok", True)))
@@ -233,23 +283,23 @@ def cert_create(
             out.print("[dim]No --dns given; skipping provider preflight.[/]")
         if problems:
             _die("dry-run found issues:\n  - " + "\n  - ".join(problems))
-        out.print(f"[green]dry-run OK[/] — would issue [bold]{domain}[/]"
+        out.print(f"[green]dry-run OK[/] — would issue [bold]{issued_as}[/]"
                   f"{(' (+' + str(len(sans)) + ' SAN)') if sans else ''}"
                   f"{(' via ' + dns) if dns else ''}{(' on ' + ca) if ca else ''}. Nothing issued.")
         return
 
     def _issue():
-        with out.status(f"Issuing [bold]{domain}[/] …") as status:
+        with out.status(f"Issuing [bold]{issued_as}[/] …") as status:
             def _progress(j: Job):
                 if j.status:
-                    status.update(f"Issuing [bold]{domain}[/] … [{j.status}]")
+                    status.update(f"Issuing [bold]{issued_as}[/] … [{j.status}]")
             return client.create_certificate(
                 domain, dns_provider=dns, ca_provider=ca, san_domains=sans or None,
-                wait=wait, on_progress=_progress)
+                name=name or None, wait=wait, on_progress=_progress)
 
     job = _run(_issue)
     if wait:
-        out.print(f"[green]issued[/] [bold]{domain}[/]"
+        out.print(f"[green]issued[/] [bold]{issued_as}[/]"
                   f"{(' (' + job.status + ')') if job.status else ''}.")
     else:
         out.print(f"[yellow]accepted[/] — job [bold]{job.job_id}[/] "

{certmate_cli-0.1.4 → certmate_cli-0.1.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "certmate-cli"
-version = "0.1.4"
+version = "0.1.6"
 description = "CertMate command-line interface — the SSL certificate lifecycle from your terminal"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -30,10 +30,13 @@ classifiers = [
 ]
 # Built ON the SDK (never the reverse). typer for the command surface, rich
 # for tables/spinners. Still light — no server deps.
-# The SDK floor tracks the CLI release: 0.1.2 needs TransportError and the
-# renew/audit semantics introduced in certmate-sdk 0.1.2.
+# The SDK floor tracks the CLI release, and now something enforces that:
+# tests/test_version_consistency.py fails if this floor falls behind the SDK
+# in the tree. It had already drifted once, sitting at 0.1.3 while both
+# packages were 0.1.4. 0.1.6 is needed for Client.require_contract(), which
+# `cert create --name --dry-run` calls, and create_certificate(name=...).
 dependencies = [
-    "certmate-sdk>=0.1.3",
+    "certmate-sdk>=0.1.6",
     "typer>=0.9",
     "rich>=13",
 ]