6720 Commits

This Branch

This Branch

All Branches

• one-click revert and ban
  neil 2026-07-06 17:39:56 +08:00
  cc64a73230
• add more events
  neil 2026-07-06 16:36:16 +08:00
  f2b37b32ff
• clean
  neil 2026-07-06 16:30:41 +08:00
  73df21abc4
• wiki-guard: use WIKI_GUARD_TOKEN (PAT with read:org) to enumerate org write members
  neil 2026-07-06 16:27:26 +08:00
  919492df13
• wiki-guard: log the number of write-access members loaded
  neil 2026-07-06 15:23:45 +08:00
  e4eaa59063
• wiki-guard: trust repo/org members with write access in all rule checks
  neil 2026-07-06 15:11:35 +08:00
  2b5a19d34a
• issue.yml: assign and label "Report bugs to" tracking issues instead of posting the upgrade boilerplate
  neil 2026-07-06 14:27:00 +08:00
  dc1b06006f
• wiki-monitor: skip notification for the maintainer's own wiki changes
  neil 2026-07-06 14:23:51 +08:00
  8585d9f4a7
• add wiki-guard workflow: auto-restore wiki pages deleted or renamed by non-maintainer
  neil 2026-07-06 13:35:37 +08:00
  ca8ab7f8b5
• Add support for Account Key Rollover (#7080)

  * add wiki
  
  * feat: add support for account key rollover
  
  * Place --update-account-key next to --update-account
  
  * fix shfmt
  
  * fix shfmt
  
  * fix shfmt
  
  * Fix from review
  
  * fix shfmt
  
  * fix from review
  
  * fix review
  
  ---------
  
  Co-authored-by: neil <gitpc@neilpang.com>

  Simon V.andneil 2026-07-06 10:22:36 +08:00
  ff9b969bdb
• deploy/ssh: return non-zero when a server deployment fails (#6795)

  ssh_deploy() ignored the result of _ssh_deploy and always returned
  success, so a failed transfer to one (or all) of the servers in
  DEPLOY_SSH_SERVER was silently swallowed. Track the return code across
  the loop and return non-zero if any server failed, letting the caller
  handle notification.
  
  Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

  Oliver MuellerandClaude Opus 4.8 2026-07-06 10:11:58 +08:00
  1f778e6ef1
• retry failed install and deploy on renew (#7083)

  * retry failed install and deploy on renew
  
  * fix notify level for renew retry failures

  PM Extra 2026-07-05 23:33:57 +08:00
  58423df3e8
• Add LaoDC DNS API (dns_laodc) (#6974)

  * Added LaoDC API Module
  
  * Cleaned up debug and info
  revised get subdomain to filter by TXT records.
  
  * Added commet to _get_root
  
  * Removed PATCH logic of updating acme records as this doesn't work for wildcard DNS.
  
  Revised rm() function to do explicit record matching.
  
  * Revised _get_root() to handle different scenarios.
  
  Fixed _laodc_api() function to check if query failed to run.
  added basic json sanitation to handle \ and " in $value
  unset _H2 _H3 after call as per request from copilot.
  
  * fixed indentation of case statement block
  
  * fixed condition checking.
  
  _get_root should start at 1 so full fqdn can be tested
  $? was being reference after export command failing response checks
  removed export txtvalue
  fixed docs link and issues link
  
  * Verify key for both add and rm
  
  * fixed dns alias condition check
  validate key returns 1 if failed.
  
  ---------
  
  Co-authored-by: neil <github@neilpang.com>
  Co-authored-by: LaoDC <git@laodc.com>

  3 people 2026-07-05 23:30:26 +08:00
  8f3c1701f3
• toPkcs8: support --password and re-export the pkcs8 file on renewal (#4134)
  neil 2026-07-05 18:04:24 +08:00
  2a175f97e8
• dnsapi/dns_edgedns: use the system clock for the request timestamp (#3973)
  neil 2026-07-05 18:02:34 +08:00
  d3af3315da
• migrate the legacy ACMEDNS_UPDATE_URL from the account conf (#3899)
  neil 2026-07-05 17:48:33 +08:00
  7b6d96387c
• add bash completion for commands and parameters, installed via --install (#307)
  neil 2026-07-05 17:39:50 +08:00
  cabe432539
• support multiple account emails (#1309)

  ACCOUNT_EMAIL / --email now accepts a comma- or space-separated list
  and registers all of them as ACME contact entries. The ZeroSSL EAB
  endpoint takes a single address, so the first one is used there.

  neil 2026-07-05 17:37:40 +08:00
  1746fbdb25
• deploy/panos: do not commit when the cert or key import failed (#4716)

  Committing after a failed import leaves a mismatched cert/key pair on
  the firewall (PAN-OS does not validate the pair at commit time), which
  can lock the admin out of the https management interface.

  neil 2026-07-05 17:13:59 +08:00
  d2b3772631
• _install_win_taskscheduler: zero-pad the minute in the schtasks /ST value (#4950)
  neil 2026-07-05 17:13:24 +08:00
  e964157bff
• notify/aws_ses: add container/instance IAM role auth (IMDSv2)

  aws_ses_send calls `_use_container_role || _use_instance_role` when no
  static AWS keys are set, but those functions were never defined -- only
  _use_metadata was -- so role-based auth silently fell through to the
  "no api key" error. Add both, using the current IMDSv2-capable versions
  from dns_aws.sh, and set the IMDSv2 token header in _use_metadata so the
  credential fetch works on IMDSv2-only instances.
  
  Closes #4742

  neil 2026-07-05 17:09:51 +08:00
  934711e51d
• dns_regru: require a dot boundary in root zone matching

  _get_root matched a registered domain anywhere as a substring of the
  challenge domain, so with both "test.com.ru" and "subtest.com.ru" in the
  account, issuing for subtest.com.ru wrongly picked test.com.ru as the
  root (it is a substring of "sub-test.com.ru"). Anchor the match to a '.'
  boundary so a shorter domain no longer matches a longer subdomain label.
  
  Fixes the issue reported in #5036 (thanks @koledas)
  Closes #5036

  neil 2026-07-05 16:57:59 +08:00
  7def43481a
• dnsapi/dns_namecom: probe the root zone with GetDomain instead of listing all domains

  The domain list is paginated at 1000 entries per page and only the
  first page was fetched, so accounts with more than 1000 domains never
  found the root zone.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5051

  neil 2026-07-05 16:53:14 +08:00
  defd64022d
• _regAccount: error out clearly when the eab-hmac-key cannot be base64-decoded

  An undecodable key (e.g. broken LibreSSL base64 -d -A) used to produce
  the cryptic "Usage: _hmac hashalg secret [outputhex]" and an empty EAB
  signature that the CA rejects with 403.
  
  https://github.com/acmesh-official/acme.sh/issues/4082

  neil 2026-07-05 16:32:57 +08:00
  4256e3532b
• add Apache workflow to test the --apache mode

  Runs le_test_apache from acmetest against Pebble, with Apache
  listening on Pebble's HTTP-01 validation port.

  neil 2026-07-05 16:31:51 +08:00
  1f94fd7fd5
• deploy/docker: allow setting key file mode and owner in the container

  The docker deploy hook copied the key file preserving the source mode
  (root:root 0600), so a non-root container service (uid >= 1000) could not
  read it. Add DEPLOY_DOCKER_CONTAINER_KEY_MODE and
  DEPLOY_DOCKER_CONTAINER_KEY_OWNER, applied via chmod/chown inside the
  container after the key is copied and before the reload command.
  
  Closes #5333

  neil 2026-07-05 16:30:46 +08:00
  507baff2ef
• dnsapi/dns_autodns: escape XML special characters in credentials (#5317)
  neil 2026-07-05 16:29:58 +08:00
  504540e67c
• add Nginx workflow to test the --nginx mode

  Runs le_test_nginx from acmetest against Pebble: nginx listens on
  Pebble's HTTP-01 validation port with an aaPanel/BT style
  "location ^~ /" reverse proxy block, the regression case of #6125.

  neil 2026-07-05 16:18:37 +08:00
  cacafc9c23
• Add dns_muumuu: muumuu-domain.com DNS API (#7012)

  * Add dns_muumuu: muumuu-domain.com DNS API
  
  * Fix: remove local keyword for POSIX sh compatibility
  
  * Fix: lowercase fulldomain for API compatibility
  
  * Style: use echo instead of printf for lower_case (consistent with other plugins)
  
  * Fix: prefix rest vars, clear _H4/_H5, guard record_id, update Issues URL

  laineus 2026-07-05 16:05:33 +08:00
  24895a15c8
• _createcsr: omit CN from the CSR subject when it exceeds 64 characters (#4867)
  neil 2026-07-05 16:02:52 +08:00
  1cd63e1480
• DNS.yml: fix workflow warnings

  - replace deprecated set-output with GITHUB_OUTPUT
  - untap aws/tap before brew install to silence tap trust warning
  - inject safe.directory=* for cygwin git so the checkout post step
    no longer fails with dubious ownership (exit 128)

  neil 2026-07-05 15:51:38 +08:00
  31b13caf8b
• deploy/haproxy: use printf instead of "echo -e" for the stats socket payload

  dash's echo has no -e flag and sends a literal "-e " prefix to the
  socket, so haproxy rejects the command and the hot update always fails
  on Debian/Ubuntu (/bin/sh = dash). Also accept "Transaction updated",
  which haproxy replies when an uncommitted transaction already exists.
  
  fix https://github.com/acmesh-official/acme.sh/issues/6165

  neil 2026-07-05 15:44:26 +08:00
  1e2cd50fc9
• Add WEDOS WAPI DNS API (dns_wedos) (#7072)

  * Add WEDOS WAPI DNS API (dns_wedos)
  
  * dns_wedos: fix response parsing on systems without egrep -o
  
  * dns_wedos: report WAPI auth errors, UTC fallback for hosts ignoring TZ

  Jan Forman 2026-07-05 12:44:07 +08:00
  524d96a3a8
• dns_desec: fix advertised token variable name (#7081)

  This must've been a copy-paste error from `dns_ddnss`.
  
  Fixes: 6b7b5caf54 ("DNS provider API: structured description")

  Foster Snowhill 2026-07-05 12:03:48 +08:00
  0eb5cc8384
• fix CSR reading on systems without a default openssl.cnf (e.g. NetBSD)

  "openssl req -noout -in" aborts when the default config file is missing;
  reading a CSR needs no config, so pass -config /dev/null explicitly.
  
  Stock NetBSD does not install /etc/openssl/openssl.cnf, so --signcsr
  never worked there.

  neil 2026-07-04 23:55:16 +08:00
  77047eb0ef
• renewAll: error out if CERT_HOME is not a directory

  With a misconfigured $HOME / CERT_HOME the glob over "$CERT_HOME"/*.*
  matches nothing, so renewAll silently does nothing and returns success --
  --renew-all / --cron appears to work while renewing no certificates.
  Check that CERT_HOME is a directory up front and return 1 with a clear
  error instead.
  
  Closes #4508

  neil 2026-07-04 23:40:31 +08:00
  4978782fb8
• dns_cn: convert IDN domain to punycode before API calls

  Core-Networks' API rejects Unicode domain names with "invalid domain";
  it requires punycode. dns_cn_add / dns_cn_rm passed the raw challenge
  domain straight through, so IDN certs failed at the TXT add step
  (issue #4804). Run fulldomain through _idn() in both functions. For
  ASCII/punycode input _idn() is a pass-through, so non-IDN domains are
  unaffected.
  
  Fixes #4804

  neil 2026-07-04 21:58:57 +08:00
  9764f67619
• _isIPv4: do not glob segments, require exactly 4 octets

  The unquoted splitting let a "*" segment expand against files in the
  current directory, so "*.*.*.*" could pass as a valid IPv4 address
  (issue 4971). The old code also accepted "", "1.2.3", "1.2.3.4.5",
  "1..2.3" and bare numbers. Split with IFS under set -f, require 4
  octets, and validate each as a 1-3 digit number <= 255.
  
  Based on https://github.com/acmesh-official/acme.sh/pull/4974
  fix https://github.com/acmesh-official/acme.sh/issues/4971

  neil 2026-07-04 21:34:46 +08:00
  988afd0f59
• add application/json to acmedns (#5066)
  Ramon 2026-07-04 21:07:18 +08:00
  b92516f79e
• dns_inwx: fix _get_root false zone match for single-letter subdomains

  _get_root matched the candidate zone with _contains (grep), which treats
  the domain as a regex. For "-d g.<zone>" the candidate "g.<zone>" matched
  "<string>...<zone>" because '.' matches the '>' after "string" and the 'g'
  comes from the "<string>" tag, so "g.<zone>" was wrongly taken as the root
  zone (sub=_acme-challenge instead of _acme-challenge.g). Anchor the match
  to <string>$h</string> and escape dots so the zone is compared literally.
  
  Fixes #5129

  neil 2026-07-04 20:28:56 +08:00
  fbf3b41c54
• Accept both 401 and 403 for deactivated account detection

  RFC 8555 sec 7.3.6 requires 401 (Unauthorized) when a request is
  signed by a deactivated account, which ZeroSSL follows, while
  Boulder (Let's Encrypt) historically returns 403. Check both codes
  in _regAccount and deactivateaccount.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5138

  neil 2026-07-04 20:21:27 +08:00
  ede9a86d46
• fix(gcore_cdn): renew login api url (#5143)

  https://api.gcore.com/docs/iam#tag/Account

  xiaopc 2026-07-04 20:14:32 +08:00
  843a7efa7d
• fix "identifiers are duplicated" when signing a CSR with a wildcard CN also present in SAN

  _contains matches with grep regex, so the '*' in "DNS:*.example.com," never
  matched and the subject was appended to the identifiers a second time.
  Escape the wildcard before the check, the same way the sed removal already does.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5251

  neil 2026-07-04 19:56:37 +08:00
  d3e12694b9
• _date2time: pass date via argv to python to prevent code injection (#6463)

  https://github.com/acmesh-official/acme.sh/issues/6463

  neil 2026-07-04 19:14:36 +08:00
  a105126063
• dns_huaweicloud: add optional HUAWEICLOUD_Region (default ap-southeast-1)

  The DNS endpoint and IAM token scope project were hardcoded to
  ap-southeast-1, which fails for accounts without that region enabled.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5302

  neil 2026-07-04 19:06:46 +08:00
  917bebd460
• Allow creation of ACME account with EAB directly from --issue command (#5087)

  * formalized _eab_id and _eab_kid and added EAB parameters to _regAccount on --issue
  
  * Update acme.sh
  
  * Update acme.sh

  Clément Gouin 2026-07-04 18:54:07 +08:00
  33704fc274
• haproxy.sh: use two-argument -header form for LibreSSL (#3438)
  neil 2026-07-04 18:50:29 +08:00
  bcbfe25d08
• deploy/cpanel_uapi: strip YAML double quotes around wildcard domains in list_domains output

  fix https://github.com/acmesh-official/acme.sh/issues/6115

  neil 2026-07-04 18:46:59 +08:00
  bbfb6f50ae
• dns_da: document that special characters in DA_Api credentials must be percent-encoded

  https://github.com/acmesh-official/acme.sh/issues/3468

  neil 2026-07-04 18:19:45 +08:00
  6df2d9e451
• https://github.com/acmesh-official/acme.sh/issues/3201
  neil 2026-07-04 16:55:49 +08:00
  1a36823461