fesco/tickets
12
2
Fork 1
Code Issues 20 Pull requests Activity

Permanent Update Policy Exception for certbot #3124

New issue
Closed
opened 2023-12-21 17:20:24 +00:00 by jonathanspw · 13 comments
jonathanspw commented 2023-12-21 17:20:24 +00:00
Copy link

This ticket asks FESCo to consider whether the certbot package should be granted a permanent exception under the Updates Policy.

The certbot package is a Python package published by EFF to manage free SSL certs mostly from Let's Encrypt but others are supported as well. It has integrations for various DNS providers as well as Apache and Nginx web servers.

No package depends on the certbot package.

This request is mostly so EPEL can inherit the exception as the short lifecycle of Fedora makes it less relevant to Fedora specifically. Given EPEL's long life cycle, many things can change cert-wise over a 10-year period along with APIs of the DNS providers with which certbot integrates. This leads to folks being unable to get the most ideal (secure) certs and/or completely broken integrations which can break or otherwise leave websites vulnerable if server admins don't take action.

certbot does have breaking changes in the traditional sense of changed functionality, it generally does not require user intervention and the value of updating far outweighs the very minute chance of an obscure breakage from said update.

This ticket asks FESCo to consider whether the certbot package should be granted a permanent exception under the Updates Policy. The certbot package is a Python package published by EFF to manage free SSL certs mostly from Let's Encrypt but others are supported as well. It has integrations for various DNS providers as well as Apache and Nginx web servers. No package depends on the certbot package. This request is mostly so EPEL can inherit the exception as the short lifecycle of Fedora makes it less relevant to Fedora specifically. Given EPEL's long life cycle, many things can change cert-wise over a 10-year period along with APIs of the DNS providers with which certbot integrates. This leads to folks being unable to get the most ideal (secure) certs and/or completely broken integrations which can break or otherwise leave websites vulnerable if server admins don't take action. certbot does have breaking changes in the traditional sense of changed functionality, it generally does not require user intervention and the value of updating far outweighs the very minute chance of an obscure breakage from said update.
ngompa commented 2023-12-21 17:22:12 +00:00
Owner
Copy link

I think this is reasonable as a Fedora-wide exception.

+1

I think this is reasonable as a Fedora-wide exception. ***+1***
ngompa commented 2023-12-21 17:22:13 +00:00
Owner
Copy link

Metadata Update from @ngompa:

  • Issue tagged with: updates policy exception
**Metadata Update from @ngompa**: - Issue tagged with: updates policy exception
sgallagh commented 2024-01-02 17:33:10 +00:00
Owner
Copy link

+1 from me

Keeping certbot up to date is "critical infrastructure" in 2024.

+1 from me Keeping certbot up to date is "critical infrastructure" in 2024.
sgallagh commented 2024-01-03 20:44:15 +00:00
Owner
Copy link

We've passed the seven day mark (adjusted for the end-of-year absences) but we don't yet have +3, so voting will extend for another week,

We've passed the seven day mark (adjusted for the end-of-year absences) but we don't yet have +3, so voting will extend for another week,
mhayden commented 2024-01-03 20:54:30 +00:00
Copy link

@jonathanspw Good idea. +1 👏

@jonathanspw Good idea. +1 👏
zbyszek commented 2024-01-04 12:07:03 +00:00
Owner
Copy link

+1

+1
kevin commented 2024-01-07 21:19:40 +00:00
Owner
Copy link

+1

+1
dcantrell commented 2024-01-08 13:19:22 +00:00
Copy link

+1

+1
jistone commented 2024-01-08 18:30:08 +00:00
Copy link

+1

+1
ngompa commented 2024-01-14 13:17:54 +00:00
Owner
Copy link

This is APPROVED (+7, 0, 0)

This is APPROVED (+7, 0, 0)
ngompa commented 2024-01-14 13:17:55 +00:00
Owner
Copy link

Metadata Update from @ngompa:

  • Issue tagged with: pending announcement
**Metadata Update from @ngompa**: - Issue tagged with: pending announcement
tstellar commented 2024-01-17 02:49:32 +00:00
Copy link

Metadata Update from @tstellar:

  • Issue untagged with: pending announcement
  • Issue close_status updated to: Accepted
  • Issue status updated to: Closed (was: Open)
**Metadata Update from @tstellar**: - Issue **un**tagged with: pending announcement - Issue close_status updated to: Accepted - Issue status updated to: Closed (was: Open)
tstellar commented 2024-01-17 02:49:41 +00:00
Copy link

Announced: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/UBVG6IOTUHHY5SHXFHOISZNHK3QLXTMX/

Announced: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/UBVG6IOTUHHY5SHXFHOISZNHK3QLXTMX/
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
document it
A new policy/recommendation needs to be documented

  
fast track
A swift resolution is critical, +7,-0 immediately approves the ticket

  
meeting
This ticket will be on the meting agenda

  
next release
The Change was postponed to next release

  
nonresponsive maintainer
Tickets about nonresponsive maintainers

  
packager revocation
Tickets about revoking packager privileges

  
pending announcement
Approved/rejected tickets to be announced alongside the next meeting agenda

  
provenpackager
A request to become a provenpackager

  
python 2 exception
An exception request to continue to use Python 2 in Fedora 32+

  
self contained change
Tickets with Self Contained Change proposals

  
stalled
Tickets that are stalled, FESCo won't regularly triage them

  
Status
Accepted
 Ticket contains a proposal that was accepted

  
Status
Duplicate
 Ticket rejected for being a duplicate

  
Status
Insufficient data
 Ticket rejected due to insufficient information being available

  
Status
Invalid
 Ticket rejected due to being invalid or misfiled

  
Status
Rejected
 Ticket contains a proposal that was rejected

  
system wide change
Tickets with System Wide Change proposals

  
updates policy exception
Tickets for exceptions from the Updates Policy

  
vote-in-progress
Vote is currently in progress in the ticket

No labels
document it
fast track
meeting
next release
nonresponsive maintainer
packager revocation
pending announcement
provenpackager
python 2 exception
self contained change
stalled
Status
Accepted
Status
Duplicate
Status
Insufficient data
Status
Invalid
Status
Rejected
system wide change
updates policy exception
vote-in-progress
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
9 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
fesco/tickets#3124
No description provided.