mirror of
https://github.com/acmesh-official/acme.sh.git
synced 2026-08-13 12:33:30 +02:00
0565443622
Some checks failed
DNS / CheckToken (push) Has been cancelled
Build DockerHub / CheckToken (push) Has been cancelled
Shellcheck / ShellCheck (push) Has been cancelled
Shellcheck / shfmt (push) Has been cancelled
DNS / Fail (push) Has been cancelled
DNS / Docker (push) Has been cancelled
DNS / MacOS (push) Has been cancelled
DNS / Windows (push) Has been cancelled
DNS / FreeBSD (push) Has been cancelled
DNS / GhostBSD (push) Has been cancelled
DNS / OpenBSD (push) Has been cancelled
DNS / NetBSD (push) Has been cancelled
DNS / DragonFlyBSD (push) Has been cancelled
DNS / MidnightBSD (push) Has been cancelled
DNS / Solaris (push) Has been cancelled
DNS / Omnios (push) Has been cancelled
DNS / OpenIndiana (push) Has been cancelled
DNS / Tribblix (push) Has been cancelled
DNS / Haiku (push) Has been cancelled
DNS / Hurd (push) Has been cancelled
DNS / OpenEuler (push) Has been cancelled
Build DockerHub / build (push) Has been cancelled
* dns_yc: restore YC_SA_Key_File in dns_yc_rm before signing the JWT dns_yc_rm() never rebuilt YC_SA_Key_File from YC_SA_Key_File_PEM_b64 / YC_SA_Key_File_Path like dns_yc_add() does. Per the DNS API dev guide, add()/rm() run in separate subshells, so rm() must repeat add()'s setup steps rather than rely on variables set during add(). Without it, when _yc_login() needs a fresh JWT during removal (the IAM token from the add phase isn't available), it signs with an empty/unset key path, and openssl fails with "Unknown key file format". The resulting auth failure then surfaces misleadingly as "invalid domain" in _get_root, and the TXT record is never deleted. Verified against a real Yandex Cloud account/zone with --staging: before the fix, removal failed with the same errors reported in the issue; after adding the missing key-restoration block, add + remove both succeed and the TXT record is actually deleted. * dns_yc: preserve other TXT values when removing one at the same name dns_yc_rm previously sent the full current data array (all existing TXT values at the name) to the deletions API, wiping out the whole rrset instead of only the value being removed. This breaks wildcard + base domain issuance, where both share the same _acme-challenge name with two different values: removing the first one deleted both, leaving nothing for the second removal to find. * dns_yc: read persisted config from domain conf before account conf YC_Zone_ID, YC_Folder_ID, YC_SA_ID, YC_SA_Key_ID (zone-ID mode) and YC_SA_Key_File_PEM_b64/Path were always saved via _savedomainconf (domain.conf), but only ever read back via _readaccountconf_mutable (account.conf). Once the env vars were unset, none of these could be recovered from the saved config, so dns_yc_add/dns_yc_rm failed with "You didn't specify a YC_SA_ID or YC_SA_Key_ID or YC_SA_Key_File." even though the values had been persisted correctly on the prior run. * dns_yc: replace grep -Fxv/sed with a portable loop in dns_yc_rm Solaris's /usr/bin/grep supports neither -F nor -x, so _remaining_txtvalue was always empty there and the preserve-other- values logic silently fell back to deleting the whole rrset (with a grep usage error on stderr on every rm). The sed trailing-comma strip had a matching issue on Solaris, whose sed drops an unterminated last line. CI didn't catch this because the fallback path also returns "done: true". Use a plain for-loop with word splitting instead. * dns_yc: use upsertRecordSets.deletions to remove a single TXT value updateRecordSets has no "merges" field (only deletions/additions), so the previous preserve-other-values logic silently did nothing -- the TXT record was never actually removed, a regression from before that change (which at least deleted the whole rrset). CI didn't catch it because _clearupdns runs dns_yc_rm in a subshell and ignores its exit code. upsertRecordSets.deletions removes only the specified value from the rrset directly, so the getRecordSet read and the remaining-value recomputation are no longer needed at all. Verified against a real zone (base + wildcard domain sharing one _acme-challenge name): adding both values then removing one leaves the other in place, and removing the second cleans up fully. * dns_yc: don't delete the user's own key file in YC_SA_Key_File_Path mode _yc_login unconditionally rm'd $YC_SA_Key_File after signing. That's fine for the PEM_b64 path, where it's a decoded temp file, but in YC_SA_Key_File_Path mode it's the user's own persistent key file -- the first successful login permanently deleted it, so every subsequent dns_yc_rm/renewal hit "Unknown key file format" (the exact symptom this PR is about, just from a different cause). Track whether the key file is our own temp copy and only delete it in that case. Verified with a stubbed _yc_login: a temp-mode key gets removed after login, a path-mode key survives. * dns_yc: clear both domain and account conf on invalid config The failure branch in dns_yc_add only ever called _clearaccountconf, but YC_Zone_ID/YC_Folder_ID/YC_SA_Key_File_PEM_b64/Path are persisted via _savedomainconf, and YC_SA_ID/YC_SA_Key_ID may have been saved via _saveaccountconf_mutable (Folder_ID mode, which stores under a SAVED_ prefix read back by _readaccountconf_mutable). Clearing only one store left stale values behind in whichever one wasn't touched. Verified by seeding both domain.conf and account.conf with leftover values, then triggering this branch and confirming both config files end up empty. |
||
|---|---|---|
| .. | ||
| dns_1984hosting.sh | ||
| dns_acmedns.sh | ||
| dns_acmeproxy.sh | ||
| dns_active24.sh | ||
| dns_ad.sh | ||
| dns_ali.sh | ||
| dns_alviy.sh | ||
| dns_anx.sh | ||
| dns_artfiles.sh | ||
| dns_arubabusiness.sh | ||
| dns_arvan.sh | ||
| dns_aurora.sh | ||
| dns_autodns.sh | ||
| dns_aws.sh | ||
| dns_azion.sh | ||
| dns_azure.sh | ||
| dns_baidu.sh | ||
| dns_beget.sh | ||
| dns_bh.sh | ||
| dns_bhosted.sh | ||
| dns_bookmyname.sh | ||
| dns_bunny.sh | ||
| dns_calrissia.sh | ||
| dns_cdmon.sh | ||
| dns_cf.sh | ||
| dns_clouddns.sh | ||
| dns_cloudns.sh | ||
| dns_cn.sh | ||
| dns_comlaude.sh | ||
| dns_conoha.sh | ||
| dns_constellix.sh | ||
| dns_cpanel.sh | ||
| dns_cpanel_uapi.sh | ||
| dns_creoline.sh | ||
| dns_curanet.sh | ||
| dns_cyon.sh | ||
| dns_czechia.sh | ||
| dns_da.sh | ||
| dns_ddnss.sh | ||
| dns_desec.sh | ||
| dns_df.sh | ||
| dns_dgon.sh | ||
| dns_dnsexit.sh | ||
| dns_dnshome.sh | ||
| dns_dnsimple.sh | ||
| dns_dnsservices.sh | ||
| dns_doapi.sh | ||
| dns_domeneshop.sh | ||
| dns_dp.sh | ||
| dns_dpi.sh | ||
| dns_dreamhost.sh | ||
| dns_duckdns.sh | ||
| dns_durabledns.sh | ||
| dns_dyn.sh | ||
| dns_dynu.sh | ||
| dns_dynv6.sh | ||
| dns_easydns.sh | ||
| dns_edgecenter.sh | ||
| dns_edgedns.sh | ||
| dns_efficientip.sh | ||
| dns_eurodns.sh | ||
| dns_euserv.sh | ||
| dns_exoscale.sh | ||
| dns_firestorm.sh | ||
| dns_fornex.sh | ||
| dns_freedns.sh | ||
| dns_freemyip.sh | ||
| dns_gandi_livedns.sh | ||
| dns_gcloud.sh | ||
| dns_gcore.sh | ||
| dns_gd.sh | ||
| dns_geoscaling.sh | ||
| dns_glesys.sh | ||
| dns_gname.sh | ||
| dns_googledomains.sh | ||
| dns_he.sh | ||
| dns_he_ddns.sh | ||
| dns_hestiacp.sh | ||
| dns_hetznercloud.sh | ||
| dns_hexonet.sh | ||
| dns_hostingde.sh | ||
| dns_hostinger.sh | ||
| dns_hostup.sh | ||
| dns_huaweicloud.sh | ||
| dns_infoblox.sh | ||
| dns_infoblox_uddi.sh | ||
| dns_infomaniak.sh | ||
| dns_internetbs.sh | ||
| dns_inwx.sh | ||
| dns_ionos.sh | ||
| dns_ionos_cloud.sh | ||
| dns_ipprojects.sh | ||
| dns_ipv64.sh | ||
| dns_ispconfig.sh | ||
| dns_jd.sh | ||
| dns_joker.sh | ||
| dns_kappernet.sh | ||
| dns_kas.sh | ||
| dns_kinghost.sh | ||
| dns_knot.sh | ||
| dns_la.sh | ||
| dns_laodc.sh | ||
| dns_leaseweb.sh | ||
| dns_level27.sh | ||
| dns_lexicon.sh | ||
| dns_limacity.sh | ||
| dns_linode.sh | ||
| dns_linode_v4.sh | ||
| dns_loopia.sh | ||
| dns_lua.sh | ||
| dns_maradns.sh | ||
| dns_me.sh | ||
| dns_mgwm.sh | ||
| dns_miab.sh | ||
| dns_mijnhost.sh | ||
| dns_misaka.sh | ||
| dns_muumuu.sh | ||
| dns_myapi.sh | ||
| dns_mydevil.sh | ||
| dns_mydnsjp.sh | ||
| dns_mythic_beasts.sh | ||
| dns_namecheap.sh | ||
| dns_namecom.sh | ||
| dns_namesilo.sh | ||
| dns_nanelo.sh | ||
| dns_nederhost.sh | ||
| dns_neodigit.sh | ||
| dns_netcup.sh | ||
| dns_netlify.sh | ||
| dns_nic.sh | ||
| dns_njalla.sh | ||
| dns_nm.sh | ||
| dns_nsd.sh | ||
| dns_nsone.sh | ||
| dns_nsupdate.sh | ||
| dns_nw.sh | ||
| dns_oci.sh | ||
| dns_omglol.sh | ||
| dns_one.sh | ||
| dns_online.sh | ||
| dns_openprovider.sh | ||
| dns_openprovider_rest.sh | ||
| dns_openstack.sh | ||
| dns_opnsense.sh | ||
| dns_opusdns.sh | ||
| dns_ovh.sh | ||
| dns_pdns.sh | ||
| dns_pleskxml.sh | ||
| dns_pointhq.sh | ||
| dns_porkbun.sh | ||
| dns_poweradmin.sh | ||
| dns_qc.sh | ||
| dns_rackcorp.sh | ||
| dns_rackspace.sh | ||
| dns_rage4.sh | ||
| dns_rcode0.sh | ||
| dns_regru.sh | ||
| dns_rltx.sh | ||
| dns_scaleway.sh | ||
| dns_schlundtech.sh | ||
| dns_selectel.sh | ||
| dns_selfhost.sh | ||
| dns_servercow.sh | ||
| dns_simply.sh | ||
| dns_sitehost.sh | ||
| dns_sotoon.sh | ||
| dns_spaceship.sh | ||
| dns_subreg.sh | ||
| dns_technitium.sh | ||
| dns_tele3.sh | ||
| dns_tencent.sh | ||
| dns_timeweb.sh | ||
| dns_transip.sh | ||
| dns_udr.sh | ||
| dns_ultra.sh | ||
| dns_unoeuro.sh | ||
| dns_variomedia.sh | ||
| dns_veesp.sh | ||
| dns_vercel.sh | ||
| dns_virakcloud.sh | ||
| dns_volcengine.sh | ||
| dns_vscale.sh | ||
| dns_vultr.sh | ||
| dns_websupport.sh | ||
| dns_wedos.sh | ||
| dns_west_cn.sh | ||
| dns_world4you.sh | ||
| dns_yandex360.sh | ||
| dns_yc.sh | ||
| dns_zilore.sh | ||
| dns_zone.sh | ||
| dns_zoneedit.sh | ||
| dns_zonomi.sh | ||
| README.md | ||