Hacker News Reader

Comment by Havoc | Hacker News Reader

Literally just switched from Ubuntu to Debian to get away from snaps

Hello there! As the maintainer of certbot for Debian, I promise you that there's no intention of deprecating the certbot packages that exist in the archive. We will still maintain them going forward in line with standard Debian practices, including security backports to stable as necessary.

Upstream fully supports this decision and has promised to continue to assist. Their recommendation for snaps is meant to target new and inexperienced users who may not understand why they are not getting the latest software when they see it was updated "on the website".

>Hello there! As the maintainer of certbot for Debian

Thank you for the good work!

That's good news & will have a go at the apt version then.

Linux Mint has even removed snap, which is impressive since they're downstream from Ubuntu.

After hearing some of the issues with it (here and elsewhere), I'm kinda grateful to them for making the effort.

Though this concerns me -- I use certbot on some debian servers, I hope that at least stays up to date.

Debian is still on version 0.x when the snap is at 1.1 ... this is one of those cases where the Debian stable branch is too stable when you need to ship software that interacts with a lot of remote APIs the way the certbot-dns packages do. It’s impossible to use the old Debian versions with the more secure API tokens from CloudFlare, for example.

The certbot-dns packages are certainly the most fragile part of the process -- however, I don't have any bug reports showing that the version in stable is currently broken for any of the dns plugins.

If you're experiencing that, please file a bug against them and I can look into having a stable backport done for them.

I’ll see what I can do, I’m not familiar with Debian package bug tracking. For reference, the incompatibility I faced was for the CloudFlare DNS plugin, which added support for API Tokens that had granular permissions somewhere between version 0.23 distributed in stable and 1.11 distributed via snap. Certbot docs and CloudFlare docs both encourage you to use API tokens instead of account-wide API secrets and the previous install instructions for wildcard DNS support suggested installing the CloudFlare DNS plugin by default on the Certbot site. As CloudFlare is used by a lot of folks for DNS, and was a suggested default install, I’m probably not the only one that encountered problems setting it up, without a backport available for a newer package of Certbot.

Same here but Let’s Encrypt suggests you install snap on Debian and use snap to install certbot.

Reply on news.ycombinator.com