fabriziosalmi/certmate v2.50.2

v2.50.2 (an image without pip, a plain log that redacts, and documentation rewritten from the code)

on GitHub

v2.50.2 (an image without pip, a plain log that redacts, and documentation rewritten from the code)

A patch release. The Docker image no longer ships pip, which removes 14 vulnerability findings and every one that had a fix but two. The plain log format now redacts secrets as the JSON one does. Most of the documentation was checked against the code and rewritten, and the README is now a front page of 208 lines instead of 2,571. The API contract stays at 2.49.

Read this before upgrading

If you add packages to the running container

The image has no pip any more (#1267). docker exec certmate pip install ... no longer works; it never survived a container being recreated anyway. To add a DNS plugin or a storage backend's SDK, build an image of your own:

• with --build-arg EXTRA_REQUIREMENTS=requirements-extended.txt (or a storage requirements file) when you build CertMate;
• or derived from the published image, as DNS providers and Storage describe.

A missing DNS plugin now says which of the two applies to it (#1273).

If you set CERTMATE_LOG_JSON=false

Read the Security section below. Nothing needs to change on your side.

If you follow links into the README

Its long sections moved to pages under docs/, and their anchors no longer exist in the README. The documentation table lists every page.

Security

• The plain log format wrote secrets as it received them (#1269). With CERTMATE_LOG_JSON=false, a token, a bearer credential or a private key that reached a log message went to stdout and to CERTMATE_LOG_FILE in clear: the redaction lived in the JSON formatter alone. Measured with a fake token before the fix: [REDACTED] in the JSON format, in clear in the plain one. The plain format now applies the same rules to the message and to the traceback. The default configuration (JSON) was not affected. The audit log file is unchanged.

Fixed

• The image shipped pip, and the findings of what pip vendors (#1267, #403). pip was pinned and upgraded in the runtime stage, which kept its own CVEs out but left the ones in what it carries: urllib3, msgpack and setuptools made 6 of the 16 findings that had a fix, 4 of them HIGH. CertMate runs from its virtual environment and never calls pip, so the build removes it from both places once the dependencies are in. Measured with Trivy 0.70.0: 312 findings on the 2.50.1 image and 298 without pip; HIGH from 58 to 48; findings with a fix from 16 to 2, both in liblzma5, until the next base image digest. CI reads the shipped dependency set with importlib.metadata instead of pip freeze, and found the same 125 packages.
• A missing DNS plugin named a remedy that only fits one case (#1273). The error said "rebuild with REQUIREMENTS_FILE=requirements.txt" for every plugin, which is the default build. It now reads the requirements files the image ships and names the one that applies: the default image, the extended build, or a derived image.
• The downgrade warning pointed at the wrong backup (#1277). DOWNGRADE DETECTED said to restore the latest backup; on an instance that never had CERTMATE_BACKUP_PASSPHRASE, the latest is a share-safe archive that cannot restore. It now says to run the newer version again, or to restore an archive that GET /api/backups reports with can_restore.

Documentation

Each page below was checked against the code, and what the code does not do was taken out rather than moved.

• The README is a front page: what CertMate is, why 47-day certificates make it matter now, what it does, the single-instance constraint, the quick start, and every page (#1282).
• New pages: troubleshooting (#1268), monitoring (#1270), storage (#1272), single sign-on (#1275), backups (#1279) and configuration (#1281).
• The API reference gains the entry for POST /api/certificates/create, which it did not have, the download roles, the contract version, deprecation and request validation sections, and four routes that were named only in the README (#1268, #1275, #1276, #1279).
• Corrected along the way, among others:
  • the README's systemd recipe, which did not reach a running service (#1278);
  • Ansible playbooks that never renewed anything (#1276);
  • "nothing is deprecated", when two routes are (#1276);
  • "managed identity" for Azure Key Vault, and LDAP or Kubernetes auth for Vault, which CertMate does not support (#1272);
  • a multi-account column that said "Single" for 21 providers the account model does not restrict (#1280);
  • an nginx example that failed nginx -t (#1279);
  • /redoc/, which answers 404; the route is /redoc (#1282).
• The Helm chart says why its readiness probe polls /health and not /health/ready (#1271).

How it was checked

• The end-to-end bench, rebuilt from main at 4e5f037, so running the image this release builds: no pip in the container or on PATH, certbot 5.8.0, healthy. A new certificate was issued from the private CA over HTTP-01, and the scheduler's real renewal job renewed the 13 certificates that were due and left alone the one issued a minute earlier; the webhook receiver got 13 certificate_renewed.
• Images built and run locally from this Dockerfile: one derived with certbot-dns-scaleway, whose certbot plugins lists dns-scaleway, and one with the HashiCorp Vault, Azure Key Vault and Infisical SDKs, which import, keep the base image's requests and cryptography, and report healthy.
• Deliberate breakages. Taking the change back out failed its tests in #1269 (the token in clear, in the message and the traceback), #1273 (the old hint), #1277 (the old message), #1268 and #1276 (an invented field in an API example), #1280 (a wrong availability) and #1281 (the tests' old document lists).
• The examples the documentation now gives were run where they could be: the download script against a local instance (installs once, then changes nothing until the certificate changes); nginx -t on the old example; git clone into a populated home; two accounts for a provider marked "Single".
• The suite (8,998 tests) on main at 4e5f037. The release gate runs the suite, the browser tests and real certificates from Let's Encrypt staging on the release commit.

Not verified

• A manual systemd setup on a fresh host. The installer has its own test; the manual section describes what it does, read from deploy/install.sh and certmate.service, and was not run by hand.
• The plain log format in a running container. The fix was measured through the logging configuration the application installs, in the test suite and in a script; no container was started with CERTMATE_LOG_JSON=false.