devnomads 0.4.1__tar.gz → 0.5.0__tar.gz

{devnomads-0.4.1 → devnomads-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads
-Version: 0.4.1
+Version: 0.5.0
 Summary: Python client library for the DevNomads API (transport, DNS, ACME)
 Project-URL: Homepage, https://devnomads.nl
 Author-email: DevNomads <support@devnomads.nl>

{devnomads-0.4.1 → devnomads-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "devnomads"
-version = "0.4.1"
+version = "0.5.0"
 description = "Python client library for the DevNomads API (transport, DNS, ACME)"
 readme = "README.md"
 requires-python = ">=3.10"

{devnomads-0.4.1 → devnomads-0.5.0}/src/devnomads/acme/client.py

@@ -12,6 +12,8 @@ from acme import challenges
 from acme import client as acme_client
 from acme import errors as acme_errors
 from acme import messages
+from cryptography import x509
+from cryptography.x509.oid import NameOID
 
 from .dns01 import DnsProvider
 from .errors import AcmeError, TransientAcmeError
@@ -410,8 +412,12 @@ class AcmeClient:
                     if hasattr(alt, "text"):
                         candidates.append(alt.text)
             for candidate in candidates:
-                if self.preferred_chain in candidate:
+                if _chain_terminates_at(candidate, self.preferred_chain):
                     return candidate
+            log.warning(
+                "no offered chain terminates at %r; using the default chain",
+                self.preferred_chain,
+            )
         except Exception as exc:  # noqa: BLE001
             log.warning("preferred chain selection failed (%s), using default", exc)
         return fullchain_pem
@@ -492,6 +498,29 @@ def _authz_failure(authz_body) -> str:
     return "authorization failed: " + ("; ".join(parts) if parts else "unknown")
 
 
+def _chain_terminates_at(chain_pem: str, root_name: str) -> bool:
+    """Return whether ``chain_pem`` chains up to a root named ``root_name``.
+
+    An ACME server never includes the trust anchor itself in the chain it
+    serves, so the terminating root is identified by the *issuer* of the
+    topmost (last) certificate. ``root_name`` is matched as a substring of that
+    issuer's common name, mirroring the ``--preferred-chain`` semantics of
+    certbot and dehydrated (e.g. ``"ISRG Root X1"``).
+    """
+
+    try:
+        certs = x509.load_pem_x509_certificates(chain_pem.encode())
+    except Exception:  # noqa: BLE001
+        return False
+    if not certs:
+        return False
+    attrs = certs[-1].issuer.get_attributes_for_oid(NameOID.COMMON_NAME)
+    issuer_cn: str | bytes = attrs[0].value if attrs else ""
+    if isinstance(issuer_cn, bytes):
+        issuer_cn = issuer_cn.decode("utf-8", "replace")
+    return root_name in issuer_cn
+
+
 def _split_fullchain(fullchain_pem: str) -> tuple[str, str]:
     marker = "-----END CERTIFICATE-----"
     end = fullchain_pem.find(marker)

{devnomads-0.4.1 → devnomads-0.5.0}/tests/test_acme_client.py

@@ -2,12 +2,18 @@
 
 from __future__ import annotations
 
+from datetime import datetime, timezone
 from types import SimpleNamespace
 
 import pytest
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.x509.oid import NameOID
 
 from devnomads.acme import AcmeError, TransientAcmeError
 from devnomads.acme.client import (
+    _chain_terminates_at,
     _challenge_for_authz,
     _normalize_challenge_types,
     _normalize_identifiers,
@@ -16,6 +22,23 @@ from devnomads.acme.client import (
 )
 
 
+def _cert_pem(subject_cn: str, issuer_cn: str) -> str:
+    """Build a throwaway certificate PEM with the given subject and issuer CN."""
+
+    key = ec.generate_private_key(ec.SECP256R1())
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, subject_cn)]))
+        .issuer_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, issuer_cn)]))
+        .public_key(key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(datetime(2020, 1, 1, tzinfo=timezone.utc))
+        .not_valid_after(datetime(2030, 1, 1, tzinfo=timezone.utc))
+        .sign(key, hashes.SHA256())
+    )
+    return cert.public_bytes(serialization.Encoding.PEM).decode()
+
+
 def test_normalize_identifiers_dedup_preserves_order():
     assert _normalize_identifiers(["a.com", "b.com", "a.com", ""]) == ["a.com", "b.com"]
 
@@ -380,3 +403,29 @@ def test_answer_dns_challenges_txt_timeout_is_transient(monkeypatch, tmp_path):
     with pytest.raises(TransientAcmeError) as ei:
         ac._answer_dns_challenges(client=None, dns_challenges=dns_challenges, delay=0)
     assert "TXT record not found" in str(ei.value)
+
+
+def test_chain_terminates_at_matches_topmost_issuer():
+    """The terminating root is the issuer of the last cert in the chain."""
+
+    leaf = _cert_pem("example.com", "Example E5")
+    intermediate = _cert_pem("Example E5", "ISRG Root X1")
+    chain = leaf + intermediate
+
+    assert _chain_terminates_at(chain, "ISRG Root X1")
+    assert not _chain_terminates_at(chain, "ISRG Root X2")
+
+
+def test_chain_terminates_at_ignores_lower_certs():
+    """Only the topmost cert's issuer counts, not the leaf's."""
+
+    leaf = _cert_pem("example.com", "ISRG Root X2")
+    intermediate = _cert_pem("Example E5", "ISRG Root X1")
+    chain = leaf + intermediate
+
+    assert _chain_terminates_at(chain, "ISRG Root X1")
+    assert not _chain_terminates_at(chain, "ISRG Root X2")
+
+
+def test_chain_terminates_at_bad_pem_is_false():
+    assert not _chain_terminates_at("not a certificate", "ISRG Root X1")

{devnomads-0.4.1 → devnomads-0.5.0}/uv.lock

@@ -469,7 +469,7 @@ wheels = [
 
 [[package]]
 name = "devnomads"
-version = "0.4.0"
+version = "0.5.0"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },