Bug 2466655

Summary: certbot fails to build with Python 3.15: FutureWarning: invalid character '+' in URL-safe Base64 data will be discarded in future Python versions
Product: [Fedora] Fedora Reporter: Karolina Surma <ksurma>
Component: certbotAssignee: Nick Bebout <nb>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: anon.amish, certbot-sig, ksurma, luk.claes, mhroncok, nb
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2412434    

Description Karolina Surma 2026-05-05 07:09:28 UTC
certbot fails to build with Python 3.15.0a8.

11 tests fail with the same FutureWarning:

_____________________________ HTTP01Test.test_uri ______________________________

self = <acme._internal.tests.challenges_test.HTTP01Test testMethod=test_uri>

    def setUp(self):
        from acme.challenges import HTTP01
        self.msg = HTTP01(
>           token=jose.decode_b64jose(
                'evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ+PCt92wr+oA'))

src/acme/_internal/tests/challenges_test.py:233: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
/usr/lib/python3.15/site-packages/josepy/json_util.py:402: in decode_b64jose
    decoded = b64.b64decode(data.encode())
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/usr/lib/python3.15/site-packages/josepy/b64.py:57: in b64decode
    return base64.urlsafe_b64decode(data + b"=" * (4 - (len(data) % 4)))
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

s = b'evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ+PCt92wr+oA='

    def urlsafe_b64decode(s, *, padded=False):
        """Decode bytes using the URL- and filesystem-safe Base64 alphabet.
    
        Argument s is a bytes-like object or ASCII string to decode.  The result
        is returned as a bytes object.  A binascii.Error is raised if the input
        is incorrectly padded.  Characters that are not in the URL-safe base-64
        alphabet, and are not a plus '+' or slash '/', are discarded prior to the
        padding check.
    
        If padded is false, padding in input is not required.
    
        The alphabet uses '-' instead of '+' and '_' instead of '/'.
        """
        s = _bytes_from_decode_data(s)
        badchar = None
        for b in b'+/':
            if b in s:
                badchar = b
                break
        s = s.translate(_urlsafe_decode_translation)
        result = binascii.a2b_base64(s, strict_mode=False, padded=padded)
        if badchar is not None:
            import warnings
>           warnings.warn(f'invalid character {chr(badchar)!a} in URL-safe Base64 data '
                          f'will be discarded in future Python versions',
                          FutureWarning, stacklevel=2)
E           FutureWarning: invalid character '+' in URL-safe Base64 data will be discarded in future Python versions

https://docs.python.org/3.15/whatsnew/3.15.html

For the build logs, see:
https://copr-be.cloud.fedoraproject.org/results/@python/python3.15/fedora-rawhide-x86_64/10398126-certbot/

For all our attempts to build certbot with Python 3.15, see:
https://copr.fedorainfracloud.org/coprs/g/python/python3.15/package/certbot/

Testing and mass rebuild of packages is happening in copr.
You can follow these instructions to test locally in mock if your package builds with Python 3.15:
https://copr.fedorainfracloud.org/coprs/g/python/python3.15/

Let us know here if you have any questions.

Python 3.15 is planned to be included in Fedora 45.
To make that update smoother, we're building Fedora packages with all pre-releases of Python 3.15.
A build failure prevents us from testing all dependent packages (transitive [Build]Requires),
so if this package is required a lot, it's important for us to get it fixed soon.

We'd appreciate help from the people who know this package best,
but if you don't want to work on this now, let us know so we can try to work around it on our side.