devnomads-cli 0.11.1__tar.gz → 0.12.0__tar.gz

{devnomads_cli-0.11.1 → devnomads_cli-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.11.1
+Version: 0.12.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -46,16 +46,20 @@ devnomads-cli`) work as well.
 
 ### Updates
 
-Update with:
+Upgrade with:
 
 ```sh
-uv tool upgrade devnomads-cli
+dncli upgrade
 ```
 
+It uses the tool you installed dncli with (uv, pipx, or pip in a
+virtualenv); where it can't, such as a system-wide pip install or on
+Windows, it prints the command to run instead. `dncli upgrade --dry-run`
+shows what it would do.
+
 dncli checks PyPI at most once a day and tells you when a new version
-is out, with the command to update the way you installed it. It only
-does so on an interactive terminal, never in pipes, scripts or CI; set
-`DN_NO_UPDATE_CHECK=1` to turn it off.
+is out. It only does so on an interactive terminal, never in pipes,
+scripts or CI; set `DN_NO_UPDATE_CHECK=1` to turn it off.
 
 dncli also warns when the DevNomads API reports a major version it was
 not built for, and tells you when the API no longer supports your
@@ -241,9 +245,9 @@ DNS-01 challenge records would not be visible to the CA.
 
 The certificate is always written to `~/.config/dncli/certs/<domain>/`
 as `cert.pem`, `fullchain.pem`, `chain.pem`, and `privkey.pem` (0600).
-Pass `--out <file>` to additionally export a single PEM bundle of
-exactly three blocks - the key, the certificate, and the issuing
-intermediate, in that order. Add `-v`/`--verbose` for detailed ACME
+Pass `--out <file>` to additionally export a single PEM bundle of the
+key, the certificate, and the full chain (intermediate plus any
+cross-signed roots), in that order. Add `-v`/`--verbose` for detailed ACME
 progress.
 
 Keys are ECDSA P-384 by default. Pick another with `--key-type`
@@ -285,8 +289,11 @@ dncli certs export example.com --format pfx --out bundle.pfx --passphrase secret
 ```
 
 The `.pfx` is unencrypted unless you pass `--passphrase` (alias
-`--password`). Both bundle formats carry the same three items: key,
-certificate, and the issuing intermediate.
+`--password`). Both bundle formats carry the same items: key,
+certificate, and the full chain. The chain includes the cross-signs:
+with Let's Encrypt's current hierarchy the path to a trusted root runs
+through the intermediate (e.g. YE2), Root YE (cross-signed by ISRG
+Root X2) and ISRG Root X2 (cross-signed by ISRG Root X1).
 
 `dncli certs delete <domain>` removes a stored certificate and its
 private key from disk (after confirmation; `--yes` skips it). By

{devnomads_cli-0.11.1 → devnomads_cli-0.12.0}/README.md

@@ -30,16 +30,20 @@ devnomads-cli`) work as well.
 
 ### Updates
 
-Update with:
+Upgrade with:
 
 ```sh
-uv tool upgrade devnomads-cli
+dncli upgrade
 ```
 
+It uses the tool you installed dncli with (uv, pipx, or pip in a
+virtualenv); where it can't, such as a system-wide pip install or on
+Windows, it prints the command to run instead. `dncli upgrade --dry-run`
+shows what it would do.
+
 dncli checks PyPI at most once a day and tells you when a new version
-is out, with the command to update the way you installed it. It only
-does so on an interactive terminal, never in pipes, scripts or CI; set
-`DN_NO_UPDATE_CHECK=1` to turn it off.
+is out. It only does so on an interactive terminal, never in pipes,
+scripts or CI; set `DN_NO_UPDATE_CHECK=1` to turn it off.
 
 dncli also warns when the DevNomads API reports a major version it was
 not built for, and tells you when the API no longer supports your
@@ -225,9 +229,9 @@ DNS-01 challenge records would not be visible to the CA.
 
 The certificate is always written to `~/.config/dncli/certs/<domain>/`
 as `cert.pem`, `fullchain.pem`, `chain.pem`, and `privkey.pem` (0600).
-Pass `--out <file>` to additionally export a single PEM bundle of
-exactly three blocks - the key, the certificate, and the issuing
-intermediate, in that order. Add `-v`/`--verbose` for detailed ACME
+Pass `--out <file>` to additionally export a single PEM bundle of the
+key, the certificate, and the full chain (intermediate plus any
+cross-signed roots), in that order. Add `-v`/`--verbose` for detailed ACME
 progress.
 
 Keys are ECDSA P-384 by default. Pick another with `--key-type`
@@ -269,8 +273,11 @@ dncli certs export example.com --format pfx --out bundle.pfx --passphrase secret
 ```
 
 The `.pfx` is unencrypted unless you pass `--passphrase` (alias
-`--password`). Both bundle formats carry the same three items: key,
-certificate, and the issuing intermediate.
+`--password`). Both bundle formats carry the same items: key,
+certificate, and the full chain. The chain includes the cross-signs:
+with Let's Encrypt's current hierarchy the path to a trusted root runs
+through the intermediate (e.g. YE2), Root YE (cross-signed by ISRG
+Root X2) and ISRG Root X2 (cross-signed by ISRG Root X1).
 
 `dncli certs delete <domain>` removes a stored certificate and its
 private key from disk (after confirmation; `--yes` skips it). By

{devnomads_cli-0.11.1 → devnomads_cli-0.12.0}/devnomads_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.11.1
+Version: 0.12.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -46,16 +46,20 @@ devnomads-cli`) work as well.
 
 ### Updates
 
-Update with:
+Upgrade with:
 
 ```sh
-uv tool upgrade devnomads-cli
+dncli upgrade
 ```
 
+It uses the tool you installed dncli with (uv, pipx, or pip in a
+virtualenv); where it can't, such as a system-wide pip install or on
+Windows, it prints the command to run instead. `dncli upgrade --dry-run`
+shows what it would do.
+
 dncli checks PyPI at most once a day and tells you when a new version
-is out, with the command to update the way you installed it. It only
-does so on an interactive terminal, never in pipes, scripts or CI; set
-`DN_NO_UPDATE_CHECK=1` to turn it off.
+is out. It only does so on an interactive terminal, never in pipes,
+scripts or CI; set `DN_NO_UPDATE_CHECK=1` to turn it off.
 
 dncli also warns when the DevNomads API reports a major version it was
 not built for, and tells you when the API no longer supports your
@@ -241,9 +245,9 @@ DNS-01 challenge records would not be visible to the CA.
 
 The certificate is always written to `~/.config/dncli/certs/<domain>/`
 as `cert.pem`, `fullchain.pem`, `chain.pem`, and `privkey.pem` (0600).
-Pass `--out <file>` to additionally export a single PEM bundle of
-exactly three blocks - the key, the certificate, and the issuing
-intermediate, in that order. Add `-v`/`--verbose` for detailed ACME
+Pass `--out <file>` to additionally export a single PEM bundle of the
+key, the certificate, and the full chain (intermediate plus any
+cross-signed roots), in that order. Add `-v`/`--verbose` for detailed ACME
 progress.
 
 Keys are ECDSA P-384 by default. Pick another with `--key-type`
@@ -285,8 +289,11 @@ dncli certs export example.com --format pfx --out bundle.pfx --passphrase secret
 ```
 
 The `.pfx` is unencrypted unless you pass `--passphrase` (alias
-`--password`). Both bundle formats carry the same three items: key,
-certificate, and the issuing intermediate.
+`--password`). Both bundle formats carry the same items: key,
+certificate, and the full chain. The chain includes the cross-signs:
+with Let's Encrypt's current hierarchy the path to a trusted root runs
+through the intermediate (e.g. YE2), Root YE (cross-signed by ISRG
+Root X2) and ISRG Root X2 (cross-signed by ISRG Root X1).
 
 `dncli certs delete <domain>` removes a stored certificate and its
 private key from disk (after confirmation; `--yes` skips it). By