From fc4fae45811dd87a8e34e31ca2a06fc0b5cc6909 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@debian.org>
Date: Fri, 28 Apr 2023 10:06:27 +0200
Subject: =?UTF-8?q?client:=20Handle=20"ready"=20=E2=86=92=20"processing"?=
 =?UTF-8?q?=20=E2=86=92=20"valid"=20status=20change=20during=20newOrder.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of just "ready" → "valid", which may be what we observe when the
server is fast enough, but according to RFC 8555 sec. 7.1.6 the state
actually transitions via "processing" state and we need to account for
that.

It appears Let's Encrypt staging environment now has different timing
conditions and lacme is unable to request certificates due to this
issue.

Cherry-picked from 53238c70f7a12e233a6ca83cf2b50168e5b9592e.

Closes: #1034834
---
 ...ady-processing-valid-status-change-during.patch | 76 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 2 files changed, 77 insertions(+)
 create mode 100644 debian/patches/client-Handle-ready-processing-valid-status-change-during.patch

(limited to 'debian/patches')

diff --git a/debian/patches/client-Handle-ready-processing-valid-status-change-during.patch b/debian/patches/client-Handle-ready-processing-valid-status-change-during.patch
new file mode 100644
index 0000000..daeffad
--- /dev/null
+++ b/debian/patches/client-Handle-ready-processing-valid-status-change-during.patch
@@ -0,0 +1,76 @@
+From: Guilhem Moulin <guilhem@fripost.org>
+Date: Tue, 25 Apr 2023 10:51:36 +0200
+Subject: =?utf-8?q?client=3A_Handle_=22ready=22_=E2=86=92_=22processing=22_?=
+ =?utf-8?q?=E2=86=92_=22valid=22_status_change_during_newOrder=2E?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+Instead of just "ready" → "valid", which may be what we observe when the
+server is fast enough, but according to RFC 8555 sec. 7.1.6 the state
+actually transitions via "processing" state and we need to account for
+that.
+
+It appears Let's Encrypt staging environment now has different timing
+conditions and lacme is unable to request certificates due to this
+issue.
+
+Thanks to Alexander Borkowski for the report!
+
+Bug-Debian: https://bugs.debian.org/1034834
+---
+ client | 29 ++++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/client b/client
+index fdef865..4d4d129 100755
+--- a/client
++++ b/client
+@@ -351,11 +351,12 @@ elsif ($COMMAND eq 'newOrder') {
+     }
+ 
+     # poll the order URL (to get the status of all challenges at once)
+-    # until the status become 'valid'
++    # until the status become 'valid'; see RFC 8555 sec. 7.1.6 for the
++    # the status change flow
+     my $orderstr = join(', ', map {uc($_->{type}) .":". $_->{value}} @identifiers);
+     my $certuri;
+-    for (my $i = 0;;) {
+-        my $r = acme($orderurl);
++    for (my $i = 0, my $url = $orderurl, my $payload;;) {
++        my $r = acme($url => $payload);
+         my $resp = request_json_decode($r);
+         if (defined (my $problem = $resp->{error})) { # problem document (RFC 7807)
+             my $msg = $problem->{status};
+@@ -366,19 +367,21 @@ elsif ($COMMAND eq 'newOrder') {
+         my $status = $resp->{status};
+         if (!defined $status or $status eq "invalid") {
+             die "Error: Invalid order $orderstr\n";
+-        }
+-        elsif ($status eq "ready") {
+-            my $r = acme($order->{finalize}, {csr => encode_base64url($csr)});
+-            my $resp = request_json_decode($r);
+-            $certuri = $resp->{certificate};
+-            last;
+-        }
+-        elsif ($status eq "valid") {
++        } elsif ($status eq "pending") {
++            # keep retrying
++        } elsif ($status eq "ready") {
++            $url = $order->{finalize};
++            $payload = {csr => encode_base64url($csr)};
++            # retry after moving to "processing" or "valid" state
++            next;
++        } elsif ($status eq "processing") {
++            $url = $orderurl;
++            undef $payload;
++        } elsif ($status eq "valid") {
+             $certuri = $resp->{certificate} //
+                 die "Error: Missing \"certificate\" field in \"valid\" order\n";
+             last;
+-        }
+-        elsif ($status ne "pending" and $status ne "processing") {
++        } else {
+             warn "Unknown order status: $status\n";
+         }
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 1c2191a..70709e0 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
 Mention-the-Debian-BTS-in-the-manpages.patch
+client-Handle-ready-processing-valid-status-change-during.patch
-- 
cgit v1.2.3