Bug 2370890

Summary: Review Request: acme.sh - Pure Unix shell script implementing ACME client protocol
Product: [Fedora] Fedora Reporter: Mikel Olasagasti Uranga <mikel>
Component: Package ReviewAssignee: Nobody's working on this, feel free to take it <nobody>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: alex, decathorpe, package-review
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
URL: https://github.com/acmesh-official/acme.sh
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
The .spec file difference from Copr build 9150225 to 9150712 none

Description Mikel Olasagasti Uranga 2025-06-06 21:18:14 UTC
Spec URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh.spec
SRPM URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh-3.1.1-1.fc42.src.rpm
Description: A pure Unix shell script implementing ACME client protocol.

- An ACME protocol client written purely in Shell (Unix shell) language.
- Full ACME protocol implementation.
- Support ECDSA certs
- Support SAN and wildcard certs
- Simple, powerful and very easy to use. You only need 3 minutes to learn it.
- Bash, dash and sh compatible.
- Purely written in Shell with no dependencies on python.
- Just one script to issue, renew and install your certificates automatically.
- DOES NOT require root/sudoer access.
- Docker ready
- IPv6 ready
- Cron job notifications for renewal or error etc.
Fedora Account System Username: mikelo2

Comment 1 Alex Haydock 2025-06-09 21:25:22 UTC
Hi!

I'm new to Fedora Packaging and reviewing some packages as part of working towards sponsorship into the packager group. I use `acme.sh` quite a bit myself, so it seemed fitting to review this one. I can't perform binding reviews yet, but hopefully this helps.

I'll post some things I spotted this comment and then I can post the full fedora-review checklist in the future.

1. The License field isn't a valid SPDX expression because of the use of `GPL-3.0` based on https://spdx.org/licenses/ this needs to be either `GPL-3.0-only` or `GPL-3.0-or-later`.

2. From what I understand, the systemd_post scriptlet needs activating in the %post section too, even if the timer isn't being started by default.

Other than that, this is looking pretty good to me so far.

Comment 2 Mikel Olasagasti Uranga 2025-06-09 22:01:34 UTC
Thanks Alex for your review!

Spec URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh.spec
SRPM URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh-3.1.1-1.fc42.src.rpm

- Changed license to GPL-3.0-or-later
- Added systemd_post scriplet

Comment 3 Fedora Review Service 2025-06-10 15:54:01 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/9150225
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2370890-acme.sh/fedora-rawhide-x86_64/09150225-acme.sh/fedora-review/review.txt

Found issues:

- Systemd service file(s) in acme.sh
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_scriptlets

Please know that there can be false-positives.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 4 Mikel Olasagasti Uranga 2025-06-10 19:42:34 UTC
Spec URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh.spec
SRPM URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh-3.1.1-1.fc42.src.rpm

Another try to check if the systemd issue is gone

Comment 5 Fedora Review Service 2025-06-10 19:47:15 UTC
Created attachment 2093565 [details]
The .spec file difference from Copr build 9150225 to 9150712

Comment 6 Fedora Review Service 2025-06-10 19:47:17 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/9150712
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2370890-acme.sh/fedora-rawhide-x86_64/09150712-acme.sh/fedora-review/review.txt

Found issues:

- Systemd service file(s) in acme.sh
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_scriptlets

Please know that there can be false-positives.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 7 Fabio Valentini 2025-06-19 10:55:06 UTC
Just a few comments:

```
%post
%systemd_post acmesh-renew.timer
# Remind users to start acmesh-renew.timer if they need acme.sh to automatically renew certs
if [ "$1" -eq 1 ] ; then
  echo ""
  echo "acme.sh auto renewal timer is not started by default."
  echo "Run 'systemctl start acmesh-renew.timer' to enable automatic renewals."
fi

%preun
%systemd_preun acmesh-renew.timer

%postun
%systemd_postun_with_restart acmesh-renew.timer
```

I'm pretty sure this not what you want here. I don't think restarting a timer doesn't do anything ... and printing output in RPM scriptlets is very frowned upon.

I would just do what's documented in the Packaging Guidelines for systemd services:

```
%post
%systemd_post acmesh-renew.service

%preun
%systemd_preun acmesh-renew.service

%postun
%systemd_postun_with_restart acmesh-renew.service
```

Comment 8 Mikel Olasagasti Uranga 2025-06-26 10:10:00 UTC
Spec URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh.spec
SRPM URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh-3.1.1-1.fc42.src.rpm

I copied the way certbot package is doing:

https://src.fedoraproject.org/rpms/certbot/blob/rawhide/f/certbot.spec#_273-293

But agree that it might not be the best option, so new spec changes that.