internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: certbot/certbot

Issue:
Store version string in logs
It will help us in debugging, in particular `letsencrypt-auto` users that run versioned PyPI releases. That's probably good candidate for `logging.INFO` level.



Discussion:

Resolving patch:
diff --git a/acme/acme/standalone.py b/acme/acme/standalone.py
--- a/acme/acme/standalone.py
+++ b/acme/acme/standalone.py
@@ -55,6 +55,8 @@ def __init__(self):
 
     def serve_forever2(self):
         """Serve forever, until other thread calls `shutdown2`."""
+        logger.debug("Starting server at %s:%d...",
+                     *self.socket.getsockname()[:2])
         while not self._stopped:
             self.handle_request()
 
diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -1042,6 +1042,7 @@ def main(cli_args=sys.argv[1:]):
         args.logs_dir, 0o700, os.geteuid(), "--strict-permissions" in cli_args)
     setup_logging(args, _cli_log_handler, logfile='letsencrypt.log')
 
+    logger.debug("letsencrypt version: %s", letsencrypt.__version__)
     # do not log `args`, as it contains sensitive data (e.g. revoke --key)!
     logger.debug("Arguments: %r", cli_args)
     logger.debug("Discovered plugins: %r", plugins)
diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py
--- a/letsencrypt/plugins/standalone.py
+++ b/letsencrypt/plugins/standalone.py
@@ -72,13 +72,12 @@ def run(self, port, challenge_type):
         except socket.error as error:
             raise errors.StandaloneBindError(error, port)
 
-        # if port == 0, then random free port on OS is taken
-        # pylint: disable=no-member
-        host, real_port = server.socket.getsockname()
         thread = threading.Thread(target=server.serve_forever2)
-        logger.debug("Starting server at %s:%d", host, real_port)
         thread.start()
 
+        # if port == 0, then random free port on OS is taken
+        # pylint: disable=no-member
+        real_port = server.socket.getsockname()[1]
         self._instances[real_port] = self._Instance(server, thread)
         return server
 
@@ -89,6 +88,8 @@ def stop(self, port):
 
         """
         instance = self._instances[port]
+        logger.debug("Stopping server at %s:%d...",
+                     *instance.server.socket.getsockname()[:2])
         instance.server.shutdown2()
         instance.thread.join()
         del self._instances[port]


Test patch:
diff --git a/acme/acme/standalone_test.py b/acme/acme/standalone_test.py
--- a/acme/acme/standalone_test.py
+++ b/acme/acme/standalone_test.py
@@ -101,8 +101,8 @@ def test_init(self):
         self.assertFalse(self.server._stopped)
 
     def test_dvsni(self):
-        cert = crypto_util.probe_sni(
-            b'localhost', *self.server.socket.getsockname())
+        host, port = self.server.socket.getsockname()[:2]
+        cert = crypto_util.probe_sni(b'localhost', host=host, port=port)
         self.assertEqual(jose.ComparableX509(cert),
                          jose.ComparableX509(self.certs[b'localhost'][1]))
Repository: certbot/certbot

Issue:
On verification failure don't suggest to check AAAA
Boulder doesn't support IPv6 validation and hence any suggestions to check AAAA should probably be removed not to confuse people.

Thanks @rolandshoemaker for reporting!



Discussion:

Resolving patch:
diff --git a/letsencrypt/auth_handler.py b/letsencrypt/auth_handler.py
--- a/letsencrypt/auth_handler.py
+++ b/letsencrypt/auth_handler.py
@@ -486,7 +486,7 @@ def is_preferred(offered_challb, satisfied,
 
 _ERROR_HELP_COMMON = (
     "To fix these errors, please make sure that your domain name was entered "
-    "correctly and the DNS A/AAAA record(s) for that domain contains the "
+    "correctly and the DNS A record(s) for that domain contains the "
     "right IP address.")
 
 


Test patch:
Repository: certbot/certbot

Issue:
Apache install fails with two vhosts
When I run `letsencrypt install --cert-path /etc/letsencrypt/live/example.com/cert.pem --key-path /etc/letsencrypt/live/example.com/privkey.pem --chain-path /etc/letsencrypt/live/example.com/chain.pem` with the following configuration https://drive.google.com/file/d/0B9CrBQYK660GRm1EVVFoQzdIRFE/view?usp=sharing, installation fails. The reason for this is the dummy directives including things like `insert_cert_file_path` and `insert_key_file_path` are not removed before restarting Apache, causing it to fail.



Discussion:

Resolving patch:
diff --git a/letsencrypt/client.py b/letsencrypt/client.py
--- a/letsencrypt/client.py
+++ b/letsencrypt/client.py
@@ -334,6 +334,7 @@ def deploy_certificate(self, domains, privkey_path,
                     key_path=os.path.abspath(privkey_path),
                     chain_path=chain_path,
                     fullchain_path=fullchain_path)
+                self.installer.save()
 
             self.installer.save("Deployed Let's Encrypt Certificate")
             # sites may have been enabled / final cleanup


Test patch:
diff --git a/letsencrypt/tests/client_test.py b/letsencrypt/tests/client_test.py
--- a/letsencrypt/tests/client_test.py
+++ b/letsencrypt/tests/client_test.py
@@ -159,7 +159,7 @@ def test_deploy_certificate(self):
             domain='foo.bar',
             fullchain_path='fullchain',
             key_path=os.path.abspath("key"))
-        self.assertEqual(installer.save.call_count, 1)
+        self.assertEqual(installer.save.call_count, 2)
         installer.restart.assert_called_once_with()
 
     @mock.patch("letsencrypt.client.enhancements")
Repository: certbot/certbot

Issue:
Stray "False False" in help output
```
$ letsencrypt --server https://acme-v01.api.letsencrypt.org/directory --installer nginx --authenticator nginx --text --agree-eula -d 44.le-test.hoffman-andrews.com run -vvvv
False False
usage: 
  letsencrypt [SUBCOMMAND] [options] [-d domain] [-d domain] ...
```



Discussion:

Resolving patch:
diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -549,7 +549,6 @@ def plugins_cmd(args, config, plugins):  # TODO: Use IDisplay rather than print
     logger.debug("Filtered plugins: %r", filtered)
 
     if not args.init and not args.prepare:
-        print str(filtered)
         return
 
     filtered.init(config)
@@ -557,13 +556,11 @@ def plugins_cmd(args, config, plugins):  # TODO: Use IDisplay rather than print
     logger.debug("Verified plugins: %r", verified)
 
     if not args.prepare:
-        print str(verified)
         return
 
     verified.prepare()
     available = verified.available()
     logger.debug("Prepared plugins: %s", available)
-    print str(available)
 
 
 def read_file(filename, mode="rb"):
@@ -935,7 +932,6 @@ def _paths_parser(helpful):
     section = "paths"
     if verb in ("install", "revoke"):
         section = verb
-    print helpful.help_arg, helpful.help_arg == "install"
     # revoke --key-path reads a file, install --key-path takes a string
     add(section, "--key-path", type=((verb == "revoke" and read_file) or str),
         required=(verb == "install"),


Test patch:
Repository: certbot/certbot

Issue:
letsencrypt-auto could handle the Python packages in debian squeeze/oldstable
Currently things [error out](https://gist.github.com/bmw/ac4f1364062b0f4af8ef) because that OS does not default to python2.7.



Discussion:
Current [documentation](https://letsencrypt.readthedocs.org/en/latest/contributing.html#debian) says to use `--python python` with `virtualenv` on squeeze instead of `--python python2`. Unfortunately, this is Python 2.6 which isn't currently supported.


Resolving patch:
diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -843,7 +843,8 @@ def prepare_and_parse_args(plugins, args):
         "really know what you're doing!")
     helpful.add(
         "testing", "--debug", action="store_true",
-        help="Show tracebacks if the program exits abnormally")
+        help="Show tracebacks in case of errors, and allow letsencrypt-auto "
+             "execution on experimental platforms")
     helpful.add(
         "testing", "--no-verify-ssl", action="store_true",
         help=config_help("no_verify_ssl"),


Test patch:
Repository: certbot/certbot

Issue:
Fix --key-path help
```
$ letsencrypt --help paths
usage: 

...

  --key-path KEY_PATH   Path to private key for cert creation or revocation
                        (if account key is missing) (default: None)

...
```

Currently, `--key-path` can not be used to specify a private key for cert creation.



Discussion:
For launch, we should just fix the help, but in the future we should have the functionality. I'm creating another issue to track that problem.


Resolving patch:
diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -970,7 +970,8 @@ def _paths_parser(helpful):
     # revoke --key-path reads a file, install --key-path takes a string
     add(section, "--key-path", required=(verb == "install"),
         type=((verb == "revoke" and read_file) or os.path.abspath),
-        help="Path to private key for cert creation or revocation (if account key is missing)")
+        help="Path to private key for cert installation "
+             "or revocation (if account key is missing)")
 
     default_cp = None
     if verb == "certonly":


Test patch:
Repository: certbot/certbot

Issue:
Implement --manual-public-ip-logging-ok
Not having such flags slows down my development considerably.

https://github.com/letsencrypt/letsencrypt/pull/1125#issuecomment-150897419



Discussion:

Resolving patch:
diff --git a/letsencrypt/plugins/manual.py b/letsencrypt/plugins/manual.py
--- a/letsencrypt/plugins/manual.py
+++ b/letsencrypt/plugins/manual.py
@@ -90,6 +90,8 @@ def __init__(self, *args, **kwargs):
     def add_parser_arguments(cls, add):
         add("test-mode", action="store_true",
             help="Test mode. Executes the manual command in subprocess.")
+        add("public-ip-logging-ok", action="store_true",
+            help="Automatically allows public IP logging.")
 
     def prepare(self):  # pylint: disable=missing-docstring,no-self-use
         pass  # pragma: no cover
@@ -164,9 +166,10 @@ def _perform_single(self, achall):
             if self._httpd.poll() is not None:
                 raise errors.Error("Couldn't execute manual command")
         else:
-            if not zope.component.getUtility(interfaces.IDisplay).yesno(
-                    self.IP_DISCLAIMER, "Yes", "No"):
-                raise errors.PluginError("Must agree to IP logging to proceed")
+            if not self.conf("public-ip-logging-ok"):
+                if not zope.component.getUtility(interfaces.IDisplay).yesno(
+                        self.IP_DISCLAIMER, "Yes", "No"):
+                    raise errors.PluginError("Must agree to IP logging to proceed")
 
             self._notify_and_wait(self.MESSAGE_TEMPLATE.format(
                 validation=validation, response=response,


Test patch:
diff --git a/letsencrypt/plugins/manual_test.py b/letsencrypt/plugins/manual_test.py
--- a/letsencrypt/plugins/manual_test.py
+++ b/letsencrypt/plugins/manual_test.py
@@ -23,7 +23,7 @@ class AuthenticatorTest(unittest.TestCase):
     def setUp(self):
         from letsencrypt.plugins.manual import Authenticator
         self.config = mock.MagicMock(
-            http01_port=8080, manual_test_mode=False)
+            http01_port=8080, manual_test_mode=False, manual_public_ip_logging_ok=False)
         self.auth = Authenticator(config=self.config, name="manual")
         self.achalls = [achallenges.KeyAuthorizationAnnotatedChallenge(
             challb=acme_util.HTTP01_P, domain="foo.com", account_key=KEY)]
Repository: certbot/certbot

Issue:
Misconfigured plugins should not be selectable
It's possible to select a misconfigured plugin and proceed with the auth/install/run. This is a bug, not a feature. Stuff should be displayed, but not selectable.



Discussion:
I don't believe there is a way to make non-selectable dialog entries.  We could hide the plugin, but that's probably less informative than what we have now.  We could move the plugin into the description (saying something like, "you have the nginx and webroot plugins installed, but they are presently misconfigured") but I'm not sure that would be more helpful either.

This is why I suggested that after picking the plugin we should verify it's not misconfigured and error out before we try to use it. That's a simple fix (3 lines + tests) and I think it should be still in 1.0.

Or, instead of erroring, we can redisplay the dialog until "well-configured" plugin is chosen. Though this might require more coding.


Resolving patch:
diff --git a/letsencrypt/display/ops.py b/letsencrypt/display/ops.py
--- a/letsencrypt/display/ops.py
+++ b/letsencrypt/display/ops.py
@@ -34,7 +34,15 @@ def choose_plugin(prepared, question):
             question, opts, help_label="More Info")
 
         if code == display_util.OK:
-            return prepared[index]
+            plugin_ep = prepared[index]
+            if plugin_ep.misconfigured:
+                util(interfaces.IDisplay).notification(
+                    "The selected plugin encountered an error while parsing "
+                    "your server configuration and cannot be used. The error "
+                    "was:\n\n{0}".format(plugin_ep.prepare()),
+                    height=display_util.HEIGHT, pause=False)
+            else:
+                return plugin_ep
         elif code == display_util.HELP:
             if prepared[index].misconfigured:
                 msg = "Reported Error: %s" % prepared[index].prepare()


Test patch:
diff --git a/letsencrypt/tests/display/ops_test.py b/letsencrypt/tests/display/ops_test.py
--- a/letsencrypt/tests/display/ops_test.py
+++ b/letsencrypt/tests/display/ops_test.py
@@ -41,9 +41,11 @@ def _call(self):
         return choose_plugin(self.plugins, "Question?")
 
     @mock.patch("letsencrypt.display.ops.util")
-    def test_successful_choice(self, mock_util):
-        mock_util().menu.return_value = (display_util.OK, 0)
-        self.assertEqual(self.mock_apache, self._call())
+    def test_selection(self, mock_util):
+        mock_util().menu.side_effect = [(display_util.OK, 0),
+                                        (display_util.OK, 1)]
+        self.assertEqual(self.mock_stand, self._call())
+        self.assertEqual(mock_util().notification.call_count, 1)
 
     @mock.patch("letsencrypt.display.ops.util")
     def test_more_info(self, mock_util):
Repository: certbot/certbot

Issue:
Log when simple-verify fails
Half #1409. When we fail to self verify a challenge, we should log the problem and continue instead of exiting.



Discussion:

Resolving patch:
diff --git a/letsencrypt/plugins/manual.py b/letsencrypt/plugins/manual.py
--- a/letsencrypt/plugins/manual.py
+++ b/letsencrypt/plugins/manual.py
@@ -173,17 +173,12 @@ def _perform_single(self, achall):
                 uri=achall.chall.uri(achall.domain),
                 ct=achall.CONTENT_TYPE, command=command))
 
-        if response.simple_verify(
+        if not response.simple_verify(
                 achall.chall, achall.domain,
                 achall.account_key.public_key(), self.config.http01_port):
-            return response
-        else:
-            logger.error(
-                "Self-verify of challenge failed, authorization abandoned.")
-            if self.conf("test-mode") and self._httpd.poll() is not None:
-                # simply verify cause command failure...
-                return False
-            return None
+            logger.warning("Self-verify of challenge failed.")
+
+        return response
 
     def _notify_and_wait(self, message):  # pylint: disable=no-self-use
         # TODO: IDisplay wraps messages, breaking the command


Test patch:
diff --git a/letsencrypt/plugins/manual_test.py b/letsencrypt/plugins/manual_test.py
--- a/letsencrypt/plugins/manual_test.py
+++ b/letsencrypt/plugins/manual_test.py
@@ -61,7 +61,9 @@ def test_perform(self, mock_raw_input, mock_verify, mock_stdout, mock_interactio
         self.assertTrue(self.achalls[0].chall.encode("token") in message)
 
         mock_verify.return_value = False
-        self.assertEqual([None], self.auth.perform(self.achalls))
+        with mock.patch("letsencrypt.plugins.manual.logger") as mock_logger:
+            self.auth.perform(self.achalls)
+            mock_logger.warning.assert_called_once_with(mock.ANY)
 
     @mock.patch("letsencrypt.plugins.manual.zope.component.getUtility")
     @mock.patch("letsencrypt.plugins.manual.Authenticator._notify_and_wait")
@@ -87,20 +89,6 @@ def test_perform_test_command_run_failure(
         self.assertRaises(
             errors.Error, self.auth_test_mode.perform, self.achalls)
 
-    @mock.patch("letsencrypt.plugins.manual.socket.socket")
-    @mock.patch("letsencrypt.plugins.manual.time.sleep", autospec=True)
-    @mock.patch("acme.challenges.HTTP01Response.simple_verify",
-                autospec=True)
-    @mock.patch("letsencrypt.plugins.manual.subprocess.Popen", autospec=True)
-    def test_perform_test_mode(self, mock_popen, mock_verify, mock_sleep,
-                               mock_socket):
-        mock_popen.return_value.poll.side_effect = [None, 10]
-        mock_popen.return_value.pid = 1234
-        mock_verify.return_value = False
-        self.assertEqual([False], self.auth_test_mode.perform(self.achalls))
-        self.assertEqual(1, mock_sleep.call_count)
-        self.assertEqual(1, mock_socket.call_count)
-
     def test_cleanup_test_mode_already_terminated(self):
         # pylint: disable=protected-access
         self.auth_test_mode._httpd = httpd = mock.Mock()
Repository: certbot/certbot

Issue:
Fix README.md
Currently README.md is totally out of date, but many people encounter it.  Let's fix it!



Discussion:
And also https://letsencrypt.readthedocs.org/en/latest/intro.html


Resolving patch:
diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -59,6 +59,7 @@
   revoke               Revoke a previously obtained certificate
   rollback             Rollback server configuration changes made during install
   config_changes       Show changes made to server config during installation
+  plugins              Display information about installed plugins
 
 """
 
@@ -71,7 +72,7 @@
   %s
   --webroot         Place files in a server's webroot folder for authentication
 
-OR use different servers to obtain (authenticate) the cert and then install it:
+OR use different plugins to obtain (authenticate) the cert and then install it:
 
   --authenticator standalone --installer apache
 
@@ -1041,7 +1042,7 @@ def _plugins_parsing(helpful, plugins):
     helpful.add_group(
         "plugins", description="Let's Encrypt client supports an "
         "extensible plugins architecture. See '%(prog)s plugins' for a "
-        "list of all available plugins and their names. You can force "
+        "list of all installed plugins and their names. You can force "
         "a particular plugin by setting options provided below. Further "
         "down this help message you will find plugin-specific options "
         "(prefixed by --{plugin_name}).")


Test patch:
Repository: certbot/certbot

Issue:
Mistake in grammar of donation suggestion text
"If like Let's Encrypt, please consider supporting our work by" is incorrect English.



Discussion:

Resolving patch:
diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -306,7 +306,7 @@ def _report_new_cert(cert_path, fullchain_path):
 def _suggest_donate():
     "Suggest a donation to support Let's Encrypt"
     reporter_util = zope.component.getUtility(interfaces.IReporter)
-    msg = ("If like Let's Encrypt, please consider supporting our work by:\n\n"
+    msg = ("If you like Let's Encrypt, please consider supporting our work by:\n\n"
            "Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate\n"
            "Donating to EFF:                    https://eff.org/donate-le\n\n")
     reporter_util.add_message(msg, reporter_util.LOW_PRIORITY)


Test patch:
Repository: certbot/certbot

Issue:
Error messages use confusing acronym DV
Two error messages use the acronym "DV" to mean "Domain Verification" which may be confusing to the user (it was to me).



Discussion:

Resolving patch:
diff --git a/acme/acme/messages.py b/acme/acme/messages.py
--- a/acme/acme/messages.py
+++ b/acme/acme/messages.py
@@ -22,12 +22,14 @@ class Error(jose.JSONObjectWithFields, errors.Error):
         ('urn:acme:error:' + name, description) for name, description in (
             ('badCSR', 'The CSR is unacceptable (e.g., due to a short key)'),
             ('badNonce', 'The client sent an unacceptable anti-replay nonce'),
-            ('connection', 'The server could not connect to the client for DV'),
+            ('connection', 'The server could not connect to the client to '
+                'verify the domain'),
             ('dnssec', 'The server could not validate a DNSSEC signed domain'),
             ('malformed', 'The request message was malformed'),
             ('rateLimited', 'There were too many requests of a given type'),
             ('serverInternal', 'The server experienced an internal error'),
-            ('tls', 'The server experienced a TLS error during DV'),
+            ('tls', 'The server experienced a TLS error during domain '
+                'verification'),
             ('unauthorized', 'The client lacks sufficient authorization'),
             ('unknownHost', 'The server could not resolve a domain name'),
         )


Test patch:
Repository: certbot/certbot

Issue:
don't add includeSubDomains for Strict-Transport-Security header
Hi,

I think the letsencrypt client shouldn’t add `includeSubDomains` to the Strict-Transport-Security header by default.

If you let the letsencrypt client modify the configuration for a webserver which hosts example.com, this would make it only possible to reach subdomain hosts (foo.example.com) with https. If you forgot only one webserver which serves a subdomain by http only, you can't reach this one any more.
And as browsers actually don't have an option to clear the HSTS cache, It won't help you to remove the includeSubDomains later from the webserver config.

includeSubDomains is something, that an admin should only add if he truly knows, that all subdomains are reachable by https. So I think this should never be added by an automatic tool, like the letsencrypt client.

RFC 6797 section 11.1 [1] also describes some implications of includeSubDomains

Chris

[1] https://tools.ietf.org/html/rfc6797#section-11.4



Discussion:
@sagi I think this is right...

I should definitely have caught this while reviewing the HSTS PR...


Resolving patch:
diff --git a/letsencrypt-apache/letsencrypt_apache/constants.py b/letsencrypt-apache/letsencrypt_apache/constants.py
--- a/letsencrypt-apache/letsencrypt_apache/constants.py
+++ b/letsencrypt-apache/letsencrypt_apache/constants.py
@@ -33,7 +33,7 @@
     https vhost"""
 
 HSTS_ARGS = ["always", "set", "Strict-Transport-Security",
-    "\"max-age=31536000; includeSubDomains\""]
+    "\"max-age=31536000\""]
 """Apache header arguments for HSTS"""
 
 UIR_ARGS = ["always", "set", "Content-Security-Policy",


Test patch: