Aws dns imdsv2

[derytim]

This uses IMDSv2 on EC2 instances, if available. (I don't think you can launch an instance that ONLY supports IMDSv1. If you had an instance running for years, maybe it doesn't support IMDSv2).

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
https://aws.amazon.com/blogs/security/get-the-full-benefits-of-imdsv2-and-disable-imdsv1-across-your-aws-infrastructure/

Tested this on an EC2 instance using just IMDSv2, using both, and using both (but forcing it to use IMDSv1).

#4960

[github-actions]

Welcome
Please make sure you've read our DNS API Dev Guide and DNS-API-Test.
Then reply on this message, otherwise, your code will not be reviewed or merged.
We look forward to reviewing your Pull request shortly ✨
注意: 必须通过了 DNS-API-Test 才会被 review. 无论是修改, 还是新加的 dns api, 都必须确保通过这个测试.

[derytim]

Welcome Please make sure you've read our DNS API Dev Guide and DNS-API-Test. Then reply on this message, otherwise, your code will not be reviewed or merged. We look forward to reviewing your Pull request shortly ✨ 注意: 必须通过了 DNS-API-Test 才会被 review. 无论是修改, 还是新加的 dns api, 都必须确保通过这个测试.

I've read the docs. This isn't a new DNS API integration, just an addition to an already-existing integration.
EDIT: working out the DNS API testing

[derytim]

The OpenBSD tests are failing. Relevant output is:

  [Thu Feb  1 22:48:32 UTC 2024] Found domain api file: /root/.acme.sh/dnsapi/***.sh
  [Thu Feb  1 22:48:32 UTC 2024] Load file /root/.acme.sh/dnsapi/***.sh error. Please check your api file and try again.
  [Thu Feb  1 22:48:32 UTC 2024] _on_issue_err
  [Thu Feb  1 22:48:32 UTC 2024] Please check log file for more details: le_test_dnsapi.log

In one of my re-runs, it looked like it did actually complete:

  [Thu Feb  1 22:48:33 UTC 2024] _ACME_SERVER_HOST='acme-staging-v02.api.letsencrypt.org'
  [Thu Feb  1 22:48:33 UTC 2024] _ACME_SERVER_PATH='directory'
  [Thu Feb  1 22:48:33 UTC 2024] Uninstalling alias from: '/root/.profile'
  [Thu Feb  1 22:48:33 UTC 2024] Uninstalling alias from: '/root/.cshrc'
  [Thu Feb  1 22:48:33 UTC 2024] The keys and certs are in "/root/.acme.sh", you can remove them by yourself.

The tests have passed on Docker, MacOS, Windows, and FreeBSD.
Can you point me in a next direction?

[derytim]

https://github.com/derytim/acme.sh/actions/runs/7734909136

[Neilpang]

you can get a openbad vm here to debug:
https://github.com/vmactions/shell-openbsd

[derytim]

I ran the tests against the bare fork (without my changes), and the OpenBSD automated tests appear to have failed in the same way - output looks like cert was generated, but the test still fails.
https://github.com/derytim/acme.sh/actions/runs/7924505475/job/21638722100
I think the test is bad, or something else is broken unrelated to my changes.

[j-c-m]

_use_metadata() is broken on OpenBSD, I don't think many DNS APIs were originally tested at all under OpenBSD (ksh).

[j-c-m]

j-c-m@e2de58a

That might fix it? I don't have any test environment available for route53/aws.

[derytim]

j-c-m@e2de58a

That might fix it? I don't have any test environment available for route53/aws.

Thanks @j-c-m , that change did get me past the OpenBSD tests.

It then failed on NetBSD tests :(

Run onInitialized in VM
  exec shell: bash run.sh onInitialized
  /usr/bin/bash
  Config file: netbsd-9.3.conf
Run 'prepare' in VM
  Running prepare: pkg_add curl socat
  
  exec ssh: pkg_add curl socat
  /usr/bin/bash /home/runner/work/_actions/vmactions/netbsd-vm/v1/run.sh execSSHSH
  Config file: netbsd-9.3.conf
  sh: pkg_add: not found
  Error: The process '/usr/bin/bash' failed with exit code 127

[j-c-m]

That looks like an error in the vm setup, from the actions just re-run the failed jobs, should pass.

…

On Mar 11, 2024, at 5:19 PM, derytim ***@***.***> wrote: ***@***.*** <j-c-m@e2de58a> That might fix it? I don't have any test environment available for route53/aws. Thanks @j-c-m <https://github.com/j-c-m> , that change did get me past the OpenBSD tests. It then failed on NetBSD tests :( exec shell: bash run.sh onInitialized /usr/bin/bash Config file: netbsd-9.3.conf Run 'prepare' in VM Running prepare: pkg_add curl socat exec ssh: pkg_add curl socat /usr/bin/bash /home/runner/work/_actions/vmactions/netbsd-vm/v1/run.sh execSSHSH Config file: netbsd-9.3.conf sh: pkg_add: not found Error: The process '/usr/bin/bash' failed with exit code 127 ``` — Reply to this email directly, view it on GitHub <#4979 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABLFTFYAYMEVKTK4B3LGUUDYXZC2NAVCNFSM6AAAAABCT56POSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOBZGYZDKMZWGE>. You are receiving this because you were mentioned.

[derytim]

No dice, same error. Setup can't find pkg_add. It's called in the tests here https://github.com/acmesh-official/acmetest/blob/master/.github/workflows/NetBSD.yml#L47
From the error I'm guessing it isn't at /usr/sbin/pkg_add, but I'm not familiar with BSD so that's just a guess.

[Neilpang]

rebase your code to the latest dev branch first.

[j-c-m]

Yep that’s it, his feature branch is missing b79c3f5

…

On Mar 13, 2024, at 11:58 AM, neil ***@***.***> wrote: rebase your code to the latest dev branch first. — Reply to this email directly, view it on GitHub <#4979 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABLFTF7IL7OVJZQBFFVTN6TYYCHVFAVCNFSM6AAAAABCT56POSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOJVGE4TGMZRGQ>. You are receiving this because you were mentioned.

[derytim]

Thanks, that seemed to do it.

[Neilpang]

do you need to update the usage here?
https://github.com/acmesh-official/acme.sh/wiki/dnsapi#10-use-amazon-route53-domain-api

[pipozzz]

Hi, I upgraded acme.sh and try rerun --renew command but no luck. I'm getting this error:

[Wed Apr 10 11:27:27 UTC 2024] Response error:<?xml version="1.0"?>
<ErrorResponse xmlns="https://route53.amazonaws.com/doc/2013-04-01/"><Error><Type>Sender</Type><Code>InvalidClientTokenId</Code><Message>The security token included in the request is invalid.</Message></Error><RequestId>3e91a42b-8398-4a6b-96e6-f3105b08eb21</RequestId></ErrorResponse>

When I try to get role credentials manually from metadata service it works but using acme.sh