From de692d3dcce6743641236fa0b720fbaea93648a4 Mon Sep 17 00:00:00 2001
From: Sergey Pashinin <sergey@pashinin.com>
Date: Tue, 18 Aug 2020 13:14:00 +0300
Subject: [PATCH 01/62] Vault deploy hook

---
 Dockerfile      |  1 +
 deploy/vault.sh | 62 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 deploy/vault.sh

diff --git a/Dockerfile b/Dockerfile
index f00d03bd..3109ffd2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,6 +7,7 @@ RUN apk update -f \
   coreutils \
   bind-tools \
   curl \
+  sed \
   socat \
   tzdata \
   oath-toolkit-oathtool \
diff --git a/deploy/vault.sh b/deploy/vault.sh
new file mode 100644
index 00000000..ae771967
--- /dev/null
+++ b/deploy/vault.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env sh
+
+# Here is a script to deploy cert to hashicorp vault using curl
+# (https://www.vaultproject.io/)
+#
+# it requires following environment variables:
+#
+# VAULT_PREFIX - this contains the prefix path in vault
+# VAULT_ADDR - vault requires this to find your vault server
+#
+# additionally, you need to ensure that VAULT_TOKEN is avialable
+# to access the vault server
+
+#returns 0 means success, otherwise error.
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+vault_deploy() {
+
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+
+  _debug _cdomain "$_cdomain"
+  _debug _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
+
+  # validate required env vars
+  if [ -z "$VAULT_PREFIX" ]; then
+    _err "VAULT_PREFIX needs to be defined (contains prefix path in vault)"
+    return 1
+  fi
+
+  if [ -z "$VAULT_ADDR" ]; then
+    _err "VAULT_ADDR needs to be defined (contains vault connection address)"
+    return 1
+  fi
+
+  # JSON does not allow multiline strings.
+  # So replacing new-lines with "\n" here
+  _ckey=$(sed -z 's/\n/\\n/g' <"$2")
+  _ccert=$(sed -z 's/\n/\\n/g' <"$3")
+  _cca=$(sed -z 's/\n/\\n/g' <"$4")
+  _cfullchain=$(sed -z 's/\n/\\n/g' <"$5")
+
+  URL="$VAULT_ADDR/v1/$VAULT_PREFIX/$_cdomain"
+
+  if [ -n "$FABIO" ]; then
+    curl --silent -H "X-Vault-Token: $VAULT_TOKEN" --request POST --data "{\"cert\": \"$_cfullchain\", \"key\": \"$_ckey\"}" "$URL" || return 1
+  else
+    curl --silent -H "X-Vault-Token: $VAULT_TOKEN" --request POST --data "{\"value\": \"$_ccert\"}" "$URL/cert.pem" || return 1
+    curl --silent -H "X-Vault-Token: $VAULT_TOKEN" --request POST --data "{\"value\": \"$_ckey\"}" "$URL/cert.key" || return 1
+    curl --silent -H "X-Vault-Token: $VAULT_TOKEN" --request POST --data "{\"value\": \"$_cca\"}" "$URL/chain.pem" || return 1
+    curl --silent -H "X-Vault-Token: $VAULT_TOKEN" --request POST --data "{\"value\": \"$_cfullchain\"}" "$URL/fullchain.pem" || return 1
+  fi
+
+}

From a674e410e0ec9de7a5f98e2be103b0c53307908a Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Fri, 21 Aug 2020 17:15:18 -0400
Subject: [PATCH 02/62] initial commit

---
 dnsapi/dns_edgedns.sh | 379 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 379 insertions(+)
 create mode 100755 dnsapi/dns_edgedns.sh

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
new file mode 100755
index 00000000..75ef4f9b
--- /dev/null
+++ b/dnsapi/dns_edgedns.sh
@@ -0,0 +1,379 @@
+#!/usr/bin/env sh
+
+# Akamai Edge DNS v2  API
+# User must provide Open Edgegrid API credentials to the EdgeDNS installation. The remote user in EdgeDNS must have CRUD access to
+# Edge DNS Zones and Recordsets, e.g. DNS—Zone Record Management authorization
+
+# Report bugs to https://control.akamai.com/apps/support-ui/#/contact-support
+
+# Values to export:
+# --EITHER--  
+# *** NOT IMPLEMENTED YET ***
+# specify Edgegrid credentials file and section
+# AKAMAI_EDGERC=<full file path> 
+# AKAMAI_EDGERC_SECTION="default"
+## --OR--
+# specify indiviual credentials
+# export AKAMAI_HOST = <host>
+# export AKAMAI_ACCESS_TOKEN = <access token> 
+# export AKAMAI_CLIENT_TOKEN = <client token>
+# export AKAMAI_CLIENT_SECRET = <client secret>
+
+ACME_EDGEDNS_VERSION="0.1.0"
+
+########  Public functions #####################
+
+# Usage: dns_edgedns_add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+# Used to add txt record
+#
+dns_edgedns_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _debug "ENTERING DNS_EDGEDNS_ADD"
+
+  _debug2 "fulldomain" "$fulldomain"
+  _debug2 "txtvalue" "$txtvalue"
+ 
+  if ! _EDGEDNS_credentials; then
+    _err "$@"
+    return 1
+  fi
+
+  if ! _EDGEDNS_getZoneInfo "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+  _debug2 "Add: zone" "${zone}"
+  acmeRecordURI=$(printf "%s/%s/names/%s/type/TXT" "${edge_endpoint}" "${zone}" "${fulldomain}") 
+  _debug3 "Add URL" "$acmeRecordURI"
+  # Get existing TXT record
+  _edge_result=$(_edgedns_rest GET "$acmeRecordURI")
+  _api_status="$?"
+  if [ "$_api_status" -ne 0 ] && [ "$_edge_result" != "404" ]; then
+    _err "$(printf "Failure accessing Akamai Edge DNS API Server. Error: %s" "$_edge_result")"
+    return 1
+  fi
+  rdata="\"$txtvalue\""
+  record_op="POST"
+  if [ "$_api_status" -eq 0 ]; then
+    # record already exists. Get existing record data and update
+    record_op="PUT"
+    rdlist=$(echo -n "$response" | _egrep_o "\"rdata\"\\s*:\\s*\\[\\s*\"[^\"]*\"\\s*]" | cut -d : -f 2 | tr -d "[]\"")  
+    _debug2 "existing TXT found"
+    _debug2 "record data" "$rdlist"
+    # value already there?
+    if _contains "$rdlist" "$txtvalue" ; then
+      return 0
+    fi
+    comma=","
+    rdata="$rdata$comma\"${txtvalue}\""
+  fi
+  _debug2 "new/updated rdata: " "${rdata}"
+  # Add the txtvalue TXT Record
+  body="{\"name\":\"$fulldomain\",\"type\":\"TXT\",\"ttl\":600, \"rdata\":"[${rdata}]"}"
+  _debug3 "Add body '${body}'"
+  _edge_result=$(_edgedns_rest "$record_op" "$acmeRecordURI" "$body")
+  _api_status="$?"
+  if [ "$_api_status" -eq 0 ]; then
+    _log "$(printf "Text value %s added to recordset %s" "${txtvalue}" "${fulldomain}")"
+    return 0
+  else
+    _err "$(printf "error adding TXT record for validation. Error: %s" "$_edge_result")"
+    return 1
+  fi
+}
+
+# Usage: dns_edgedns_rm   _acme-challenge.www.domain.com
+# Used to delete txt record
+#
+dns_edgedns_rm() {
+  fulldomain=$1
+}
+
+####################  Private functions below ##################################
+
+_EDGEDNS_credentials() {
+  _debug "GettingEdge DNS credentials" 
+  _log $(printf "ACME DNSAPI Edge DNS version %s" ${ACME_EDGEDNS_VERSION})
+  args_missing=0
+  if [ -z "${AKAMAI_ACCESS_TOKEN}" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_ACCESS_TOKEN is missing"
+    args_missing=1
+  fi
+  if [ -z "$AKAMAI_CLIENT_TOKEN" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_CLIENT_TOKEN is missing"
+    args_missing=1
+  fi
+  if [ -z "${AKAMAI_HOST}" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_HOST is missing"
+    args_missing=1
+  fi
+  if [ -z "${AKAMAI_CLIENT_SECRET}" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_CLIENT_SECRET is missing"
+    args_missing=1
+  fi
+
+  if [ "${args_missing}" = 1 ]; then
+    _err "You have not properly specified the EdgeDNS Open Edgegrid API credentials. Please try again."
+    return 1
+  else
+    _saveaccountconf_mutable AKAMAI_ACCESS_TOKEN "${AKAMAI_ACCESS_TOKEN}"
+    _saveaccountconf_mutable AKAMAI_CLIENT_TOKEN "${AKAMAI_CLIENT_TOKEN}"
+    _saveaccountconf_mutable AKAMAI_HOST "${AKAMAI_HOST}"
+    _saveaccountconf_mutable AKAMAI_CLIENT_SECRET "${AKAMAI_CLIENT_SECRET}"
+    # Set whether curl should use secure or insecure mode
+  fi
+  export HTTPS_INSECURE=0     # All Edgegrid API calls are secure
+  edge_endpoint=$(printf "https://%s/config-dns/v2/zones" "${AKAMAI_HOST}")
+  _debug3 "Edge API Endpoint:" "${edge_endpoint}"
+
+}
+
+_EDGEDNS_getZoneInfo() {
+  _debug "Getting Zoneinfo"
+  zoneEnd=false
+  curZone=$1
+  while [ -n "${zoneEnd}" ]; do
+    # we can strip the first part of the fulldomain, since its just the _acme-challenge string
+    curZone="${curZone#*.}"
+    # suffix . needed for zone -> domain.tld.
+    # create zone get url
+    get_zone_url=$(printf "%s/%s" "${edge_endpoint}" "${curZone}")
+    _debug3 "Zone Get: " "${get_zone_url}"
+    curResult=$(_edgedns_rest GET "$get_zone_url")
+    retVal=$?
+    if [ $retVal -ne 0 ]; then
+      if ["$curResult" != "404" ]; then
+        _err "$(printf "Managed zone validation failed. Error response: %s" "$retVal")"
+        return 1
+      fi
+    fi
+
+    if _contains "${curResult}" "\"zone\":" ; then
+      _debug2 "Zone data" "${curResult}"
+      zone=$(echo -n "${curResult}" | _egrep_o "\"zone\"\\s*:\\s*\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")
+      _debug2 "Zone" "${zone}"
+      zoneFound=""
+      zoneEnd=""
+      return 0
+    fi
+
+    if [ "${curZone#*.}" != "$curZone" ]; then
+      _debug2 $(printf "%s still contains a '.' - so we can check next higher level" "$curZone")
+    else
+      zoneEnd=true
+      _err "Couldn't retrieve zone data."
+      return 1
+    fi
+  done
+  _err "Failed to  retrieve zone data."
+  return 2
+}
+
+_edgedns_headers=""
+
+_edgedns_rest() {
+  _debug "Handling API Request"
+  m=$1
+  # Assume endpoint is complete path, including query args if applicable
+  ep=$2
+  body_data=$3
+  _edgedns_content_type=""
+  _request_url_path="$ep"
+  _request_body="$body_data"
+  _request_method="$m"
+  _edgedns_headers=""
+  tab=""
+  _edgedns_headers="${_edgedns_headers}${tab}Host: ${AKAMAI_HOST}"
+  tab="\t"
+  # Set in acme.sh _post/_get
+  #_edgedns_headers="${_edgedns_headers}${tab}User-Agent:ACME DNSAPI Edge DNS version ${ACME_EDGEDNS_VERSION}"
+  _edgedns_headers="${_edgedns_headers}${tab}Accept: application/json"
+  if [ "$m" != "GET" ] && [ "$m" != "DELETE" ] ; then
+    _edgedns_content_type="application/json;charset=UTF-8"
+    _utf8_body_data="$(echo -n "$ _request_body" | iconv -t utf-8)"
+    _utf8_body_len="$(echo -n "$_utf8_body_data"  | awk '{print length}')"
+    _edgedns_headers="${_edgedns_headers}${tab}Content-Length: ${_utf8_body_len}"
+  fi
+  _made_auth_header=$(_edgedns_make_auth_header)
+  _edgedns_headers="${_edgedns_headers}${tab}Authorization: ${_made_auth_header}"
+  _secure_debug2 "Made Auth Header" "${_made_auth_header}"
+  hdr_indx=1
+  work_header="${_edgedns_headers}${tab}"
+  _debug3 "work_header" "${work_header}"
+  while [ "${work_header}" ]; do  
+    entry="${work_header%%\\t*}"; work_header="${work_header#*\\t}"
+    export "$(printf "_H%s=%s" "${hdr_indx}" "${entry}")"
+    _debug2 "Request Header " "${entry}"
+    hdr_indx=$(( hdr_indx + 1 ))
+  done
+ 
+  # clear headers from previous request to avoid getting wrong http code on timeouts
+  :>"$HTTP_HEADER"
+  _debug "$ep"
+  if [ "$m" != "GET" ]; then
+    _debug "Method data" "$data"
+    # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
+    response="$(_post "$_utf8_body_data" "$ep" false "$m")"
+  else
+    response="$(_get "$ep")"
+  fi
+
+  _ret="$?"
+  _debug "response" "$response"
+  _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
+  _debug2 "http response code" "$_code"
+
+  if [ "$_code" = "200" ] || [ "$_code" = "201" ]; then
+    # All good
+    response="$(echo "$response" | _normalizeJson)"
+    echo -n "${response}"
+    return 0
+  fi
+
+  if [ "$_code" = "204" ]; then
+    # Success, no body
+    echo -n ""
+    return 0
+  fi
+
+  if [ "$_code" = "400" ]; then
+    _err "Bad request presented"
+    _log "$(printf "Headers: %s" "$_edgedns_headers")"
+    _log "$(printf "Method: %s" "$_request_method")"
+    _log "$(printf "URL: %s" "$ep")"
+    _log "$(printf "Data: %s" "$data")"
+  fi
+
+  if [ "$_code" = "403" ]; then
+    _err "access denied make sure your Edgegrid cedentials are correct."
+  fi
+
+  echo "$_code"
+  return 1
+}
+
+_edgedns_eg_timestamp() {
+  _eg_timestamp=$(date -u "+%Y%m%dT%H:%M:%S+0000")
+}
+
+_edgedns_new_nonce() {
+  _nonce=$(uuidgen -r)
+}
+
+_edgedns_make_auth_header() {
+  _debug "Constructing Auth Header"
+  _edgedns_eg_timestamp 
+  _edgedns_new_nonce 
+  # "Unsigned authorization header: 'EG1-HMAC-SHA256 client_token=block;access_token=block;timestamp=20200806T14:16:33+0000;nonce=72cde72c-82d9-4721-9854-2ba057929d67;'"
+  _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "${AKAMAI_CLIENT_TOKEN}" "${AKAMAI_ACCESS_TOKEN}" "${_eg_timestamp}" "${_nonce}")" 
+  _secure_debug2 "Unsigned Auth Header: " "$_auth_header"
+
+  _sig="$(_edgedns_sign_request)"
+  _signed_auth_header="$(printf "%ssignature=%s" "${_auth_header}" "${_sig}")"
+  _secure_debug2 "Signed Auth Header: " "${_signed_auth_header}" 
+  echo -n "${_signed_auth_header}"
+}
+
+_edgedns_sign_request() {
+  _debug2 "Signing http request"
+  _signed_data=$(_edgedns_make_data_to_sign "${_auth_header}")
+  _secure_debug2 "Returned signed data" "$_signed_data"
+  _key=$(_edgedns_make_signing_key "${_eg_timestamp}")
+  _signed_req=$(_edgedns_base64_hmac_sha256 "$_signed_data" "$_key")
+  _secure_debug2 "Signed Request" "${_signed_req}"
+  echo -n "${_signed_req}"
+}
+
+_edgedns_make_signing_key() {
+  _debug2 "Creating sigining key"
+  ts=$1
+  _signing_key=$(_edgedns_base64_hmac_sha256 "$ts" "${AKAMAI_CLIENT_SECRET}")
+  _secure_debug2 "Signing Key" "${_signing_key}"
+  echo -n "${_signing_key}"  
+
+}
+
+_edgedns_make_data_to_sign() {
+  _debug2 "Processing data to sign"
+  hdr=$1
+  _secure_debug2 "hdr" "$hdr"
+  content_hash=$(_edgedns_make_content_hash)
+  path="$(echo -n "${_request_url_path}" |sed 's/https\?:\/\///')"
+  path="${path#*$AKAMAI_HOST}"
+  _debug "hier path" "${path}"
+  # dont expose headers to sign so use MT string
+  data="$(printf "%s\thttps\t%s\t%s\t%s\t%s\t%s" "${_request_method}" "${AKAMAI_HOST}" "${path}" "" "${content_hash}" "$hdr")"
+  _secure_debug2 "Data to Sign" "${data}"
+  echo -n "${data}"
+}
+
+_edgedns_make_content_hash() {
+  _debug2 "Generating content hash"
+  prep_body=""
+  _hash=""
+  _debug2 "Request method" "${_request_method}"
+  if [ "${_request_method}" != "POST" ] || [ -z "${_request_body}" ]; then
+    echo -n "${prep_body}"
+    return 0
+  fi
+  prep_body="$(echo -n "${_request_body}")"
+  _debug2 "Req body" "${prep_body}"
+  _hash=$(_edgedns_base64_sha256 "${prep_body}")
+  _debug2 "Content hash" "${_hash}"
+  echo -n "${_hash}"
+}
+
+_edgedns_base64_hmac_sha256() {
+  _debug2 "Generating hmac"
+  data=$1
+  key=$2
+  encoded_data="$(echo -n "${data}" | iconv -t utf-8)"
+  encoded_key="$(echo -n "${key}" | iconv -t utf-8)"
+  _secure_debug2 "encoded data" "${encoded_data}"
+  _secure_debug2 "encoded key" "${encoded_key}"
+  #key_hex="$(_durl_replace_base64 "$key" | _dbase64 | _hex_dump | tr -d ' ')"
+  #data_sig="$(printf "%s" "$encoded_data" | _hmac sha256 "${key_hex}" | _base64 | _url_replace)"
+
+  data_sig="$(echo -n "$encoded_data" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -hmac $encoded_key -binary | _base64)"
+  _secure_debug2 "data_sig:" "${data_sig}"
+  out="$(echo -n "${data_sig}" | iconv -f utf-8)"
+  _secure_debug2 "hmac" "${out}"
+  echo -n "${out}"
+}
+
+_edgedns_base64_sha256() {
+  _debug2 "Creating sha256 digest"
+  trg=$1
+  utf8_str="$(echo -n "${trg}" | iconv -t utf-8)"
+  _secure_debug2 "digest data" "$trg"
+  _secure_debug2 "encoded digest data" "${utf8_str}"
+  digest="$(echo -n "${trg}" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -binary | _base64)"
+  out="$(echo -n "${digest}" | iconv -f utf-8)"
+  _secure_debug2 "digest decode" "${out}"
+  echo -n "${out}"
+}
+
+#_edgedns_parse_edgerc() {
+#  filepath=$1
+#  section=$2
+#}
+
+

From f511a5270590a7fc834df02470b4709629768bb7 Mon Sep 17 00:00:00 2001
From: Sergey Pashinin <sergey@pashinin.com>
Date: Mon, 24 Aug 2020 00:05:21 +0300
Subject: [PATCH 03/62] Using _post function

---
 deploy/vault.sh | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/deploy/vault.sh b/deploy/vault.sh
index ae771967..c51ceb0f 100644
--- a/deploy/vault.sh
+++ b/deploy/vault.sh
@@ -49,14 +49,15 @@ vault_deploy() {
   _cfullchain=$(sed -z 's/\n/\\n/g' <"$5")
 
   URL="$VAULT_ADDR/v1/$VAULT_PREFIX/$_cdomain"
+  export _H1="X-Vault-Token: $VAULT_TOKEN"
 
   if [ -n "$FABIO" ]; then
-    curl --silent -H "X-Vault-Token: $VAULT_TOKEN" --request POST --data "{\"cert\": \"$_cfullchain\", \"key\": \"$_ckey\"}" "$URL" || return 1
+    _post "{\"cert\": \"$_cfullchain\", \"key\": \"$_ckey\"}" "$URL"
   else
-    curl --silent -H "X-Vault-Token: $VAULT_TOKEN" --request POST --data "{\"value\": \"$_ccert\"}" "$URL/cert.pem" || return 1
-    curl --silent -H "X-Vault-Token: $VAULT_TOKEN" --request POST --data "{\"value\": \"$_ckey\"}" "$URL/cert.key" || return 1
-    curl --silent -H "X-Vault-Token: $VAULT_TOKEN" --request POST --data "{\"value\": \"$_cca\"}" "$URL/chain.pem" || return 1
-    curl --silent -H "X-Vault-Token: $VAULT_TOKEN" --request POST --data "{\"value\": \"$_cfullchain\"}" "$URL/fullchain.pem" || return 1
+    _post "{\"value\": \"$_ccert\"}" "$URL/cert.pem"
+    _post "{\"value\": \"$_ckey\"}" "$URL/cert.key"
+    _post "{\"value\": \"$_cca\"}" "$URL/chain.pem"
+    _post "{\"value\": \"$_cfullchain\"}" "$URL/fullchain.pem"
   fi
 
 }

From d66c430e46fdaa7b7180cf619361d2d96da5262c Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Wed, 26 Aug 2020 16:11:11 -0400
Subject: [PATCH 04/62] debugging and cleanup

---
 dnsapi/dns_edgedns.sh | 281 ++++++++++++++++++++++++++----------------
 1 file changed, 175 insertions(+), 106 deletions(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 75ef4f9b..7be49761 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -29,9 +29,7 @@ ACME_EDGEDNS_VERSION="0.1.0"
 dns_edgedns_add() {
   fulldomain=$1
   txtvalue=$2
-
   _debug "ENTERING DNS_EDGEDNS_ADD"
-
   _debug2 "fulldomain" "$fulldomain"
   _debug2 "txtvalue" "$txtvalue"
  
@@ -39,44 +37,53 @@ dns_edgedns_add() {
     _err "$@"
     return 1
   fi
-
   if ! _EDGEDNS_getZoneInfo "$fulldomain"; then
     _err "Invalid domain"
     return 1
   fi
-  _debug2 "Add: zone" "${zone}"
-  acmeRecordURI=$(printf "%s/%s/names/%s/type/TXT" "${edge_endpoint}" "${zone}" "${fulldomain}") 
+  _debug2 "Add: zone" "$zone"
+  acmeRecordURI=$(printf "%s/%s/names/%s/types/TXT" "$edge_endpoint" "$zone" "$fulldomain") 
   _debug3 "Add URL" "$acmeRecordURI"
   # Get existing TXT record
   _edge_result=$(_edgedns_rest GET "$acmeRecordURI")
   _api_status="$?"
-  if [ "$_api_status" -ne 0 ] && [ "$_edge_result" != "404" ]; then
-    _err "$(printf "Failure accessing Akamai Edge DNS API Server. Error: %s" "$_edge_result")"
-    return 1
+  _debug3 "_edge_result" "$_edge_result"
+  if [ "$_api_status" -ne 0 ]; then
+    if [ "$curResult" = "FATAL" ]; then
+      _err "$(printf "Fatal error: acme API function call : %s" "$retVal")"
+    fi
+    if [ "$_edge_result" != "404" ]; then
+      _err "$(printf "Failure accessing Akamai Edge DNS API Server. Error: %s" "$_edge_result")"
+      return 1
+    fi
   fi
-  rdata="\"$txtvalue\""
+  rdata="\"${txtvalue}\""
   record_op="POST"
   if [ "$_api_status" -eq 0 ]; then
     # record already exists. Get existing record data and update
     record_op="PUT"
-    rdlist=$(echo -n "$response" | _egrep_o "\"rdata\"\\s*:\\s*\\[\\s*\"[^\"]*\"\\s*]" | cut -d : -f 2 | tr -d "[]\"")  
-    _debug2 "existing TXT found"
-    _debug2 "record data" "$rdlist"
+    rdlist="${_edge_result#*\"rdata\":[}"
+    rdlist="${rdlist%%]*}"
+    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\")
+    _debug3 "existing TXT found"
+    _debug3 "record data" "$rdlist"
     # value already there?
     if _contains "$rdlist" "$txtvalue" ; then
       return 0
     fi
-    comma=","
-    rdata="$rdata$comma\"${txtvalue}\""
+    _txt_val=""
+    while [ "$_txt_val" != "$rdlist" ] && [ "${rdlist}" ]; do
+        _txt_val="${rdlist%%,*}"; rdlist="${rdlist#*,}"
+        rdata="${rdata},\"${_txt_val}\""
+    done
   fi
-  _debug2 "new/updated rdata: " "${rdata}"
   # Add the txtvalue TXT Record
   body="{\"name\":\"$fulldomain\",\"type\":\"TXT\",\"ttl\":600, \"rdata\":"[${rdata}]"}"
   _debug3 "Add body '${body}'"
   _edge_result=$(_edgedns_rest "$record_op" "$acmeRecordURI" "$body")
   _api_status="$?"
   if [ "$_api_status" -eq 0 ]; then
-    _log "$(printf "Text value %s added to recordset %s" "${txtvalue}" "${fulldomain}")"
+    _log "$(printf "Text value %s added to recordset %s" "$txtvalue" "$fulldomain")"
     return 0
   else
     _err "$(printf "error adding TXT record for validation. Error: %s" "$_edge_result")"
@@ -84,20 +91,89 @@ dns_edgedns_add() {
   fi
 }
 
-# Usage: dns_edgedns_rm   _acme-challenge.www.domain.com
+# Usage: dns_edgedns_rm   _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 # Used to delete txt record
 #
 dns_edgedns_rm() {
   fulldomain=$1
+  txtvalue=$2
+  _debug "ENTERING DNS_EDGEDNS_RM"
+  _debug2 "fulldomain" "$fulldomain"
+  _debug2 "txtvalue" "$txtvalue"
+
+  if ! _EDGEDNS_credentials; then
+    _err "$@"
+    return 1
+  fi
+  if ! _EDGEDNS_getZoneInfo "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+  _debug2 "RM: zone" "${zone}"
+  acmeRecordURI=$(printf "%s/%s/names/%s/types/TXT" "${edge_endpoint}" "$zone" "$fulldomain")
+  _debug3 "RM URL" "$acmeRecordURI"
+  # Get existing TXT record
+  _edge_result=$(_edgedns_rest GET "$acmeRecordURI")
+  _api_status="$?"
+  if [ "$_api_status" -ne 0 ]; then
+    if [ "$curResult" = "FATAL" ]; then
+      _err "$(printf "Fatal error: acme API function call : %s" "$retVal")"
+    fi
+    if [ "$_edge_result" != "404" ]; then
+      _err "$(printf "Failure accessing Akamai Edge DNS API Server. Error: %s" "$_edge_result")"
+      return 1
+    fi
+  fi
+  _debug3 "_edge_result" "$_edge_result"
+  record_op="DELETE"
+  body=""
+  if [ "$_api_status" -eq 0 ]; then
+    # record already exists. Get existing record data and update
+    rdlist="${_edge_result#*\"rdata\":[}"
+    rdlist="${rdlist%%]*}"
+    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\")
+    _debug3 "rdlist" "$rdlist"
+    if [ -n "$rdlist" ]; then
+      record_op="PUT"
+      comma=""
+      rdata=""
+      _txt_val=""
+      while [ "$_txt_val" != "$rdlist" ] && [ "$rdlist" ]; do
+        _txt_val="${rdlist%%,*}"; rdlist="${rdlist#*,}"
+        _debug3 "_txt_val" "$_txt_val"
+        _debug3 "txtvalue" "$txtvalue"
+        if ! _contains "$_txt_val" "$txtvalue" ; then
+          rdata="${rdata}${comma}\"${_txt_val}\""
+          comma=","
+        fi
+      done
+      if [ -z "$rdata" ]; then
+        record_op="DELETE"
+      else
+        # Recreate the txtvalue TXT Record
+        body="{\"name\":\"$fulldomain\",\"type\":\"TXT\",\"ttl\":600, \"rdata\":"[${rdata}]"}"
+        _debug3 "body" "$body"
+      fi
+    fi
+  fi
+  _edge_result=$(_edgedns_rest "$record_op" "$acmeRecordURI" "$body")
+  _api_status="$?"
+  if [ "$_api_status" -eq 0 ]; then
+    _log "$(printf "Text value %s removed from recordset %s" "$txtvalue" "$fulldomain")"
+    return 0
+  else
+    _err "$(printf "error removing TXT record for validation. Error: %s" "$_edge_result")"
+    return 1
+  fi
 }
 
 ####################  Private functions below ##################################
 
 _EDGEDNS_credentials() {
   _debug "GettingEdge DNS credentials" 
-  _log $(printf "ACME DNSAPI Edge DNS version %s" ${ACME_EDGEDNS_VERSION})
+  _log "$(printf "ACME DNSAPI Edge DNS version %s" ${ACME_EDGEDNS_VERSION})"
   args_missing=0
-  if [ -z "${AKAMAI_ACCESS_TOKEN}" ]; then
+  if [ -z "$AKAMAI_ACCESS_TOKEN" ]; then
     AKAMAI_ACCESS_TOKEN=""
     AKAMAI_CLIENT_TOKEN=""
     AKAMAI_HOST=""
@@ -113,7 +189,7 @@ _EDGEDNS_credentials() {
     _err "AKAMAI_CLIENT_TOKEN is missing"
     args_missing=1
   fi
-  if [ -z "${AKAMAI_HOST}" ]; then
+  if [ -z "$AKAMAI_HOST" ]; then
     AKAMAI_ACCESS_TOKEN=""
     AKAMAI_CLIENT_TOKEN=""
     AKAMAI_HOST=""
@@ -121,7 +197,7 @@ _EDGEDNS_credentials() {
     _err "AKAMAI_HOST is missing"
     args_missing=1
   fi
-  if [ -z "${AKAMAI_CLIENT_SECRET}" ]; then
+  if [ -z "$AKAMAI_CLIENT_SECRET" ]; then
     AKAMAI_ACCESS_TOKEN=""
     AKAMAI_CLIENT_TOKEN=""
     AKAMAI_HOST=""
@@ -130,19 +206,19 @@ _EDGEDNS_credentials() {
     args_missing=1
   fi
 
-  if [ "${args_missing}" = 1 ]; then
+  if [ "$args_missing" = 1 ]; then
     _err "You have not properly specified the EdgeDNS Open Edgegrid API credentials. Please try again."
     return 1
   else
-    _saveaccountconf_mutable AKAMAI_ACCESS_TOKEN "${AKAMAI_ACCESS_TOKEN}"
-    _saveaccountconf_mutable AKAMAI_CLIENT_TOKEN "${AKAMAI_CLIENT_TOKEN}"
-    _saveaccountconf_mutable AKAMAI_HOST "${AKAMAI_HOST}"
-    _saveaccountconf_mutable AKAMAI_CLIENT_SECRET "${AKAMAI_CLIENT_SECRET}"
+    _saveaccountconf_mutable AKAMAI_ACCESS_TOKEN "$AKAMAI_ACCESS_TOKEN"
+    _saveaccountconf_mutable AKAMAI_CLIENT_TOKEN "$AKAMAI_CLIENT_TOKEN"
+    _saveaccountconf_mutable AKAMAI_HOST "$AKAMAI_HOST"
+    _saveaccountconf_mutable AKAMAI_CLIENT_SECRET "$AKAMAI_CLIENT_SECRET"
     # Set whether curl should use secure or insecure mode
   fi
   export HTTPS_INSECURE=0     # All Edgegrid API calls are secure
-  edge_endpoint=$(printf "https://%s/config-dns/v2/zones" "${AKAMAI_HOST}")
-  _debug3 "Edge API Endpoint:" "${edge_endpoint}"
+  edge_endpoint=$(printf "https://%s/config-dns/v2/zones" "$AKAMAI_HOST")
+  _debug3 "Edge API Endpoint:" "$edge_endpoint"
 
 }
 
@@ -150,33 +226,34 @@ _EDGEDNS_getZoneInfo() {
   _debug "Getting Zoneinfo"
   zoneEnd=false
   curZone=$1
-  while [ -n "${zoneEnd}" ]; do
+  while [ -n "$zoneEnd" ]; do
     # we can strip the first part of the fulldomain, since its just the _acme-challenge string
     curZone="${curZone#*.}"
     # suffix . needed for zone -> domain.tld.
     # create zone get url
-    get_zone_url=$(printf "%s/%s" "${edge_endpoint}" "${curZone}")
+    get_zone_url=$(printf "%s/%s" "$edge_endpoint" "$curZone")
     _debug3 "Zone Get: " "${get_zone_url}"
     curResult=$(_edgedns_rest GET "$get_zone_url")
     retVal=$?
-    if [ $retVal -ne 0 ]; then
-      if ["$curResult" != "404" ]; then
-        _err "$(printf "Managed zone validation failed. Error response: %s" "$retVal")"
+    if [ "$retVal" -ne 0 ]; then
+      if [ "$curResult" = "FATAL" ]; then
+        _err "$(printf "Fatal error: acme API function call : %s" "$retVal")"
+      fi
+      if [ "$curResult" != "404" ]; then
+        err "$(printf "Managed zone validation failed. Error response: %s" "$retVal")"
         return 1
       fi
     fi
-
-    if _contains "${curResult}" "\"zone\":" ; then
+    if _contains "$curResult" "\"zone\":" ; then
       _debug2 "Zone data" "${curResult}"
-      zone=$(echo -n "${curResult}" | _egrep_o "\"zone\"\\s*:\\s*\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")
-      _debug2 "Zone" "${zone}"
-      zoneFound=""
+      zone=$(echo "${curResult}" | _egrep_o "\"zone\"\\s*:\\s*\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")
+      _debug3 "Zone" "${zone}"
       zoneEnd=""
       return 0
     fi
 
     if [ "${curZone#*.}" != "$curZone" ]; then
-      _debug2 $(printf "%s still contains a '.' - so we can check next higher level" "$curZone")
+      _debug3 "$(printf "%s still contains a '.' - so we can check next higher level" "$curZone")"
     else
       zoneEnd=true
       _err "Couldn't retrieve zone data."
@@ -205,52 +282,55 @@ _edgedns_rest() {
   tab="\t"
   # Set in acme.sh _post/_get
   #_edgedns_headers="${_edgedns_headers}${tab}User-Agent:ACME DNSAPI Edge DNS version ${ACME_EDGEDNS_VERSION}"
-  _edgedns_headers="${_edgedns_headers}${tab}Accept: application/json"
+  _edgedns_headers="${_edgedns_headers}${tab}Accept: application/json,*/*"
   if [ "$m" != "GET" ] && [ "$m" != "DELETE" ] ; then
-    _edgedns_content_type="application/json;charset=UTF-8"
-    _utf8_body_data="$(echo -n "$ _request_body" | iconv -t utf-8)"
-    _utf8_body_len="$(echo -n "$_utf8_body_data"  | awk '{print length}')"
-    _edgedns_headers="${_edgedns_headers}${tab}Content-Length: ${_utf8_body_len}"
+    _edgedns_content_type="application/json"
+    _debug3 "_request_body" "$_request_body"
+    _body_len=$(echo "$_request_body" | tr -d "\n\r" | awk '{print length}')
+    _edgedns_headers="${_edgedns_headers}${tab}Content-Length: ${_body_len}"
   fi
-  _made_auth_header=$(_edgedns_make_auth_header)
-  _edgedns_headers="${_edgedns_headers}${tab}Authorization: ${_made_auth_header}"
-  _secure_debug2 "Made Auth Header" "${_made_auth_header}"
+  _edgedns_make_auth_header
+  _edgedns_headers="${_edgedns_headers}${tab}Authorization: ${_signed_auth_header}"
+  _secure_debug2 "Made Auth Header" "$_signed_auth_header"
   hdr_indx=1
   work_header="${_edgedns_headers}${tab}"
-  _debug3 "work_header" "${work_header}"
-  while [ "${work_header}" ]; do  
+  _debug3 "work_header" "$work_header"
+  while [ "$work_header" ]; do  
     entry="${work_header%%\\t*}"; work_header="${work_header#*\\t}"
-    export "$(printf "_H%s=%s" "${hdr_indx}" "${entry}")"
-    _debug2 "Request Header " "${entry}"
+    export "$(printf "_H%s=%s" "$hdr_indx" "$entry")"
+    _debug2 "Request Header " "$entry"
     hdr_indx=$(( hdr_indx + 1 ))
   done
  
   # clear headers from previous request to avoid getting wrong http code on timeouts
-  :>"$HTTP_HEADER"
-  _debug "$ep"
+  : >"$HTTP_HEADER"
+  _debug2 "$ep"
   if [ "$m" != "GET" ]; then
-    _debug "Method data" "$data"
+    _debug3 "Method data" "$data"
     # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
-    response="$(_post "$_utf8_body_data" "$ep" false "$m")"
+    response=$(_post "$_request_body" "$ep" false "$m" "$_edgedns_content_type")
   else
-    response="$(_get "$ep")"
+    response=$(_get "$ep")
   fi
-
   _ret="$?"
-  _debug "response" "$response"
+  if [ "$_ret" -ne 0 ]; then
+    _err "$(printf "acme.sh API function call failed. Error: %s" "$_ret")"
+    echo "FATAL"
+    return "$_ret"
+  fi
+  _debug2 "response" "${response}"
   _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
   _debug2 "http response code" "$_code"
-
   if [ "$_code" = "200" ] || [ "$_code" = "201" ]; then
     # All good
-    response="$(echo "$response" | _normalizeJson)"
-    echo -n "${response}"
+    response="$(echo "${response}" | _normalizeJson)"
+    echo "$response"
     return 0
   fi
 
   if [ "$_code" = "204" ]; then
     # Success, no body
-    echo -n ""
+    echo "$_code"
     return 0
   fi
 
@@ -283,31 +363,30 @@ _edgedns_make_auth_header() {
   _edgedns_eg_timestamp 
   _edgedns_new_nonce 
   # "Unsigned authorization header: 'EG1-HMAC-SHA256 client_token=block;access_token=block;timestamp=20200806T14:16:33+0000;nonce=72cde72c-82d9-4721-9854-2ba057929d67;'"
-  _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "${AKAMAI_CLIENT_TOKEN}" "${AKAMAI_ACCESS_TOKEN}" "${_eg_timestamp}" "${_nonce}")" 
+  _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "$AKAMAI_CLIENT_TOKEN" "$AKAMAI_ACCESS_TOKEN" "$_eg_timestamp" "$_nonce")" 
   _secure_debug2 "Unsigned Auth Header: " "$_auth_header"
 
-  _sig="$(_edgedns_sign_request)"
-  _signed_auth_header="$(printf "%ssignature=%s" "${_auth_header}" "${_sig}")"
+  _edgedns_sign_request
+  _signed_auth_header="$(printf "%ssignature=%s" "$_auth_header" "$_signed_req")"
   _secure_debug2 "Signed Auth Header: " "${_signed_auth_header}" 
-  echo -n "${_signed_auth_header}"
 }
 
 _edgedns_sign_request() {
   _debug2 "Signing http request"
-  _signed_data=$(_edgedns_make_data_to_sign "${_auth_header}")
-  _secure_debug2 "Returned signed data" "$_signed_data"
-  _key=$(_edgedns_make_signing_key "${_eg_timestamp}")
-  _signed_req=$(_edgedns_base64_hmac_sha256 "$_signed_data" "$_key")
-  _secure_debug2 "Signed Request" "${_signed_req}"
-  echo -n "${_signed_req}"
+  _edgedns_make_data_to_sign "$_auth_header"
+  _secure_debug2 "Returned signed data" "$_mdata"
+  _edgedns_make_signing_key "$_eg_timestamp"
+  _edgedns_base64_hmac_sha256 "$_mdata" "$_signing_key"
+  _signed_req="$_hmac_out"
+  _secure_debug2 "Signed Request" "$_signed_req"
 }
 
 _edgedns_make_signing_key() {
   _debug2 "Creating sigining key"
   ts=$1
-  _signing_key=$(_edgedns_base64_hmac_sha256 "$ts" "${AKAMAI_CLIENT_SECRET}")
-  _secure_debug2 "Signing Key" "${_signing_key}"
-  echo -n "${_signing_key}"  
+  _edgedns_base64_hmac_sha256 "$ts" "$AKAMAI_CLIENT_SECRET"
+  _signing_key="$_hmac_out"
+  _secure_debug2 "Signing Key" "$_signing_key"
 
 }
 
@@ -315,60 +394,50 @@ _edgedns_make_data_to_sign() {
   _debug2 "Processing data to sign"
   hdr=$1
   _secure_debug2 "hdr" "$hdr"
-  content_hash=$(_edgedns_make_content_hash)
-  path="$(echo -n "${_request_url_path}" |sed 's/https\?:\/\///')"
+  _edgedns_make_content_hash
+  path="$(echo "$_request_url_path" | tr -d "\n\r" | sed 's/https\?:\/\///')"
   path="${path#*$AKAMAI_HOST}"
-  _debug "hier path" "${path}"
+  _debug "hier path" "$path"
   # dont expose headers to sign so use MT string
-  data="$(printf "%s\thttps\t%s\t%s\t%s\t%s\t%s" "${_request_method}" "${AKAMAI_HOST}" "${path}" "" "${content_hash}" "$hdr")"
-  _secure_debug2 "Data to Sign" "${data}"
-  echo -n "${data}"
+  _mdata="$(printf "%s\thttps\t%s\t%s\t%s\t%s\t%s" "$_request_method" "$AKAMAI_HOST" "$path" "" "$_hash" "$hdr")"
+  _secure_debug2 "Data to Sign" "$_mdata"
 }
 
 _edgedns_make_content_hash() {
   _debug2 "Generating content hash"
-  prep_body=""
   _hash=""
   _debug2 "Request method" "${_request_method}"
-  if [ "${_request_method}" != "POST" ] || [ -z "${_request_body}" ]; then
-    echo -n "${prep_body}"
+  if [ "$_request_method" != "POST" ] || [ -z "$_request_body" ]; then
     return 0
   fi
-  prep_body="$(echo -n "${_request_body}")"
-  _debug2 "Req body" "${prep_body}"
-  _hash=$(_edgedns_base64_sha256 "${prep_body}")
-  _debug2 "Content hash" "${_hash}"
-  echo -n "${_hash}"
+  _debug2 "Req body" "$_request_body"
+  _edgedns_base64_sha256 "$_request_body"
+  _hash="$_sha256_out"
+  _debug2 "Content hash" "$_hash"
 }
 
 _edgedns_base64_hmac_sha256() {
   _debug2 "Generating hmac"
   data=$1
   key=$2
-  encoded_data="$(echo -n "${data}" | iconv -t utf-8)"
-  encoded_key="$(echo -n "${key}" | iconv -t utf-8)"
-  _secure_debug2 "encoded data" "${encoded_data}"
-  _secure_debug2 "encoded key" "${encoded_key}"
-  #key_hex="$(_durl_replace_base64 "$key" | _dbase64 | _hex_dump | tr -d ' ')"
-  #data_sig="$(printf "%s" "$encoded_data" | _hmac sha256 "${key_hex}" | _base64 | _url_replace)"
+  encoded_data="$(echo "$data" | iconv -t utf-8)"
+  encoded_key="$(echo "$key" | iconv -t utf-8)"
+  _secure_debug2 "encoded data" "$encoded_data"
+  _secure_debug2 "encoded key" "$encoded_key"
 
-  data_sig="$(echo -n "$encoded_data" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -hmac $encoded_key -binary | _base64)"
-  _secure_debug2 "data_sig:" "${data_sig}"
-  out="$(echo -n "${data_sig}" | iconv -f utf-8)"
-  _secure_debug2 "hmac" "${out}"
-  echo -n "${out}"
+  data_sig="$(echo "$encoded_data" | tr -d "\n\r" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -hmac "$encoded_key" -binary | _base64)"
+  _secure_debug2 "data_sig:" "$data_sig"
+  _hmac_out="$(echo "$data_sig" | tr -d "\n\r" | iconv -f utf-8)"
+  _secure_debug2 "hmac" "$_hmac_out"
 }
 
 _edgedns_base64_sha256() {
   _debug2 "Creating sha256 digest"
   trg=$1
-  utf8_str="$(echo -n "${trg}" | iconv -t utf-8)"
   _secure_debug2 "digest data" "$trg"
-  _secure_debug2 "encoded digest data" "${utf8_str}"
-  digest="$(echo -n "${trg}" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -binary | _base64)"
-  out="$(echo -n "${digest}" | iconv -f utf-8)"
-  _secure_debug2 "digest decode" "${out}"
-  echo -n "${out}"
+  digest="$(echo "$trg" | tr -d "\n\r" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -binary | _base64)"
+  _sha256_out="$(echo "$digest" | tr -d "\n\r" | iconv -f utf-8)"
+  _secure_debug2 "digest decode" "$_sha256_out"
 }
 
 #_edgedns_parse_edgerc() {

From 281ee1a853936e6decbc755c5298f7551c8b52ac Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Wed, 26 Aug 2020 18:07:46 -0400
Subject: [PATCH 05/62] vetted by shfmt

---
 dnsapi/dns_edgedns.sh | 49 ++++++++++++++++++++++---------------------
 1 file changed, 25 insertions(+), 24 deletions(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 7be49761..2072637a 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -7,15 +7,15 @@
 # Report bugs to https://control.akamai.com/apps/support-ui/#/contact-support
 
 # Values to export:
-# --EITHER--  
+# --EITHER--
 # *** NOT IMPLEMENTED YET ***
 # specify Edgegrid credentials file and section
-# AKAMAI_EDGERC=<full file path> 
+# AKAMAI_EDGERC=<full file path>
 # AKAMAI_EDGERC_SECTION="default"
 ## --OR--
 # specify indiviual credentials
 # export AKAMAI_HOST = <host>
-# export AKAMAI_ACCESS_TOKEN = <access token> 
+# export AKAMAI_ACCESS_TOKEN = <access token>
 # export AKAMAI_CLIENT_TOKEN = <client token>
 # export AKAMAI_CLIENT_SECRET = <client secret>
 
@@ -32,7 +32,7 @@ dns_edgedns_add() {
   _debug "ENTERING DNS_EDGEDNS_ADD"
   _debug2 "fulldomain" "$fulldomain"
   _debug2 "txtvalue" "$txtvalue"
- 
+
   if ! _EDGEDNS_credentials; then
     _err "$@"
     return 1
@@ -42,7 +42,7 @@ dns_edgedns_add() {
     return 1
   fi
   _debug2 "Add: zone" "$zone"
-  acmeRecordURI=$(printf "%s/%s/names/%s/types/TXT" "$edge_endpoint" "$zone" "$fulldomain") 
+  acmeRecordURI=$(printf "%s/%s/names/%s/types/TXT" "$edge_endpoint" "$zone" "$fulldomain")
   _debug3 "Add URL" "$acmeRecordURI"
   # Get existing TXT record
   _edge_result=$(_edgedns_rest GET "$acmeRecordURI")
@@ -68,13 +68,14 @@ dns_edgedns_add() {
     _debug3 "existing TXT found"
     _debug3 "record data" "$rdlist"
     # value already there?
-    if _contains "$rdlist" "$txtvalue" ; then
+    if _contains "$rdlist" "$txtvalue"; then
       return 0
     fi
     _txt_val=""
     while [ "$_txt_val" != "$rdlist" ] && [ "${rdlist}" ]; do
-        _txt_val="${rdlist%%,*}"; rdlist="${rdlist#*,}"
-        rdata="${rdata},\"${_txt_val}\""
+      _txt_val="${rdlist%%,*}"
+      rdlist="${rdlist#*,}"
+      rdata="${rdata},\"${_txt_val}\""
     done
   fi
   # Add the txtvalue TXT Record
@@ -139,10 +140,11 @@ dns_edgedns_rm() {
       rdata=""
       _txt_val=""
       while [ "$_txt_val" != "$rdlist" ] && [ "$rdlist" ]; do
-        _txt_val="${rdlist%%,*}"; rdlist="${rdlist#*,}"
+        _txt_val="${rdlist%%,*}"
+        rdlist="${rdlist#*,}"
         _debug3 "_txt_val" "$_txt_val"
         _debug3 "txtvalue" "$txtvalue"
-        if ! _contains "$_txt_val" "$txtvalue" ; then
+        if ! _contains "$_txt_val" "$txtvalue"; then
           rdata="${rdata}${comma}\"${_txt_val}\""
           comma=","
         fi
@@ -170,7 +172,7 @@ dns_edgedns_rm() {
 ####################  Private functions below ##################################
 
 _EDGEDNS_credentials() {
-  _debug "GettingEdge DNS credentials" 
+  _debug "GettingEdge DNS credentials"
   _log "$(printf "ACME DNSAPI Edge DNS version %s" ${ACME_EDGEDNS_VERSION})"
   args_missing=0
   if [ -z "$AKAMAI_ACCESS_TOKEN" ]; then
@@ -216,7 +218,7 @@ _EDGEDNS_credentials() {
     _saveaccountconf_mutable AKAMAI_CLIENT_SECRET "$AKAMAI_CLIENT_SECRET"
     # Set whether curl should use secure or insecure mode
   fi
-  export HTTPS_INSECURE=0     # All Edgegrid API calls are secure
+  export HTTPS_INSECURE=0 # All Edgegrid API calls are secure
   edge_endpoint=$(printf "https://%s/config-dns/v2/zones" "$AKAMAI_HOST")
   _debug3 "Edge API Endpoint:" "$edge_endpoint"
 
@@ -244,7 +246,7 @@ _EDGEDNS_getZoneInfo() {
         return 1
       fi
     fi
-    if _contains "$curResult" "\"zone\":" ; then
+    if _contains "$curResult" "\"zone\":"; then
       _debug2 "Zone data" "${curResult}"
       zone=$(echo "${curResult}" | _egrep_o "\"zone\"\\s*:\\s*\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")
       _debug3 "Zone" "${zone}"
@@ -283,7 +285,7 @@ _edgedns_rest() {
   # Set in acme.sh _post/_get
   #_edgedns_headers="${_edgedns_headers}${tab}User-Agent:ACME DNSAPI Edge DNS version ${ACME_EDGEDNS_VERSION}"
   _edgedns_headers="${_edgedns_headers}${tab}Accept: application/json,*/*"
-  if [ "$m" != "GET" ] && [ "$m" != "DELETE" ] ; then
+  if [ "$m" != "GET" ] && [ "$m" != "DELETE" ]; then
     _edgedns_content_type="application/json"
     _debug3 "_request_body" "$_request_body"
     _body_len=$(echo "$_request_body" | tr -d "\n\r" | awk '{print length}')
@@ -295,13 +297,14 @@ _edgedns_rest() {
   hdr_indx=1
   work_header="${_edgedns_headers}${tab}"
   _debug3 "work_header" "$work_header"
-  while [ "$work_header" ]; do  
-    entry="${work_header%%\\t*}"; work_header="${work_header#*\\t}"
+  while [ "$work_header" ]; do
+    entry="${work_header%%\\t*}"
+    work_header="${work_header#*\\t}"
     export "$(printf "_H%s=%s" "$hdr_indx" "$entry")"
     _debug2 "Request Header " "$entry"
-    hdr_indx=$(( hdr_indx + 1 ))
+    hdr_indx=$((hdr_indx + 1))
   done
- 
+
   # clear headers from previous request to avoid getting wrong http code on timeouts
   : >"$HTTP_HEADER"
   _debug2 "$ep"
@@ -360,15 +363,15 @@ _edgedns_new_nonce() {
 
 _edgedns_make_auth_header() {
   _debug "Constructing Auth Header"
-  _edgedns_eg_timestamp 
-  _edgedns_new_nonce 
+  _edgedns_eg_timestamp
+  _edgedns_new_nonce
   # "Unsigned authorization header: 'EG1-HMAC-SHA256 client_token=block;access_token=block;timestamp=20200806T14:16:33+0000;nonce=72cde72c-82d9-4721-9854-2ba057929d67;'"
-  _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "$AKAMAI_CLIENT_TOKEN" "$AKAMAI_ACCESS_TOKEN" "$_eg_timestamp" "$_nonce")" 
+  _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "$AKAMAI_CLIENT_TOKEN" "$AKAMAI_ACCESS_TOKEN" "$_eg_timestamp" "$_nonce")"
   _secure_debug2 "Unsigned Auth Header: " "$_auth_header"
 
   _edgedns_sign_request
   _signed_auth_header="$(printf "%ssignature=%s" "$_auth_header" "$_signed_req")"
-  _secure_debug2 "Signed Auth Header: " "${_signed_auth_header}" 
+  _secure_debug2 "Signed Auth Header: " "${_signed_auth_header}"
 }
 
 _edgedns_sign_request() {
@@ -444,5 +447,3 @@ _edgedns_base64_sha256() {
 #  filepath=$1
 #  section=$2
 #}
-
-

From cf7334eb7dc8293f321ebf5bb7123764d28279e0 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Thu, 27 Aug 2020 17:40:07 -0400
Subject: [PATCH 06/62] add alt nonce generation logic

---
 dnsapi/dns_edgedns.sh | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 2072637a..f5705ee8 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -64,7 +64,7 @@ dns_edgedns_add() {
     record_op="PUT"
     rdlist="${_edge_result#*\"rdata\":[}"
     rdlist="${rdlist%%]*}"
-    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\")
+    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\\\")
     _debug3 "existing TXT found"
     _debug3 "record data" "$rdlist"
     # value already there?
@@ -132,7 +132,7 @@ dns_edgedns_rm() {
     # record already exists. Get existing record data and update
     rdlist="${_edge_result#*\"rdata\":[}"
     rdlist="${rdlist%%]*}"
-    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\")
+    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\\\")
     _debug3 "rdlist" "$rdlist"
     if [ -n "$rdlist" ]; then
       record_op="PUT"
@@ -355,10 +355,16 @@ _edgedns_rest() {
 
 _edgedns_eg_timestamp() {
   _eg_timestamp=$(date -u "+%Y%m%dT%H:%M:%S+0000")
+  _debug3 "_eg_timestamp" "$_eg_timestamp"
 }
 
 _edgedns_new_nonce() {
   _nonce=$(uuidgen -r)
+  _ret="$?"
+  if [ "$_ret" -ne 0 ]; then                            
+    _nonce=$(echo "EDGEDNS$(_time)" | _digest sha1 hex | cut -c 1-32)
+  fi                                                                                                    
+  _debug3 "_nonce" "$_nonce"
 }
 
 _edgedns_make_auth_header() {

From 339218508d2fd6ef34a2db283c0dea4dc123e8f4 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Fri, 28 Aug 2020 09:55:20 -0400
Subject: [PATCH 07/62] shfmt fixes

---
 dnsapi/dns_edgedns.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index f5705ee8..94cf809c 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -361,9 +361,9 @@ _edgedns_eg_timestamp() {
 _edgedns_new_nonce() {
   _nonce=$(uuidgen -r)
   _ret="$?"
-  if [ "$_ret" -ne 0 ]; then                            
+  if [ "$_ret" -ne 0 ]; then
     _nonce=$(echo "EDGEDNS$(_time)" | _digest sha1 hex | cut -c 1-32)
-  fi                                                                                                    
+  fi
   _debug3 "_nonce" "$_nonce"
 }
 

From ea3e6dae93e76dfe79272c6cb9dd0c6b9acbb297 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Wed, 14 Oct 2020 14:49:09 -0400
Subject: [PATCH 08/62] remove uuidgen

---
 dnsapi/dns_edgedns.sh | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 94cf809c..89e77936 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -359,11 +359,7 @@ _edgedns_eg_timestamp() {
 }
 
 _edgedns_new_nonce() {
-  _nonce=$(uuidgen -r)
-  _ret="$?"
-  if [ "$_ret" -ne 0 ]; then
-    _nonce=$(echo "EDGEDNS$(_time)" | _digest sha1 hex | cut -c 1-32)
-  fi
+  _nonce=$(echo "EDGEDNS$(_time)" | _digest sha1 hex | cut -c 1-32)
   _debug3 "_nonce" "$_nonce"
 }
 

From 6ad5ea169679e22de4f0314b312e886b03ac6bc7 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Fri, 16 Oct 2020 10:16:25 -0400
Subject: [PATCH 09/62] use _digest instead of openssl

---
 dnsapi/dns_edgedns.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 89e77936..7ab448d2 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -440,7 +440,7 @@ _edgedns_base64_sha256() {
   _debug2 "Creating sha256 digest"
   trg=$1
   _secure_debug2 "digest data" "$trg"
-  digest="$(echo "$trg" | tr -d "\n\r" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -binary | _base64)"
+  digest="$(echo "$trg" | tr -d "\n\r" | _digest "sha256")" 
   _sha256_out="$(echo "$digest" | tr -d "\n\r" | iconv -f utf-8)"
   _secure_debug2 "digest decode" "$_sha256_out"
 }

From c61495df5239f7034531fc787bcd91d5deb42372 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Fri, 16 Oct 2020 10:32:01 -0400
Subject: [PATCH 10/62] fix format

---
 dnsapi/dns_edgedns.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 7ab448d2..05c8e886 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -440,7 +440,7 @@ _edgedns_base64_sha256() {
   _debug2 "Creating sha256 digest"
   trg=$1
   _secure_debug2 "digest data" "$trg"
-  digest="$(echo "$trg" | tr -d "\n\r" | _digest "sha256")" 
+  digest="$(echo "$trg" | tr -d "\n\r" | _digest "sha256")"
   _sha256_out="$(echo "$digest" | tr -d "\n\r" | iconv -f utf-8)"
   _secure_debug2 "digest decode" "$_sha256_out"
 }

From d5674c85d7735f2f3cdf6e44c2f9f1059d844d20 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Fri, 21 Aug 2020 17:15:18 -0400
Subject: [PATCH 11/62] initial commit

---
 dnsapi/dns_edgedns.sh | 379 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 379 insertions(+)
 create mode 100755 dnsapi/dns_edgedns.sh

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
new file mode 100755
index 00000000..75ef4f9b
--- /dev/null
+++ b/dnsapi/dns_edgedns.sh
@@ -0,0 +1,379 @@
+#!/usr/bin/env sh
+
+# Akamai Edge DNS v2  API
+# User must provide Open Edgegrid API credentials to the EdgeDNS installation. The remote user in EdgeDNS must have CRUD access to
+# Edge DNS Zones and Recordsets, e.g. DNS—Zone Record Management authorization
+
+# Report bugs to https://control.akamai.com/apps/support-ui/#/contact-support
+
+# Values to export:
+# --EITHER--  
+# *** NOT IMPLEMENTED YET ***
+# specify Edgegrid credentials file and section
+# AKAMAI_EDGERC=<full file path> 
+# AKAMAI_EDGERC_SECTION="default"
+## --OR--
+# specify indiviual credentials
+# export AKAMAI_HOST = <host>
+# export AKAMAI_ACCESS_TOKEN = <access token> 
+# export AKAMAI_CLIENT_TOKEN = <client token>
+# export AKAMAI_CLIENT_SECRET = <client secret>
+
+ACME_EDGEDNS_VERSION="0.1.0"
+
+########  Public functions #####################
+
+# Usage: dns_edgedns_add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+# Used to add txt record
+#
+dns_edgedns_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _debug "ENTERING DNS_EDGEDNS_ADD"
+
+  _debug2 "fulldomain" "$fulldomain"
+  _debug2 "txtvalue" "$txtvalue"
+ 
+  if ! _EDGEDNS_credentials; then
+    _err "$@"
+    return 1
+  fi
+
+  if ! _EDGEDNS_getZoneInfo "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+  _debug2 "Add: zone" "${zone}"
+  acmeRecordURI=$(printf "%s/%s/names/%s/type/TXT" "${edge_endpoint}" "${zone}" "${fulldomain}") 
+  _debug3 "Add URL" "$acmeRecordURI"
+  # Get existing TXT record
+  _edge_result=$(_edgedns_rest GET "$acmeRecordURI")
+  _api_status="$?"
+  if [ "$_api_status" -ne 0 ] && [ "$_edge_result" != "404" ]; then
+    _err "$(printf "Failure accessing Akamai Edge DNS API Server. Error: %s" "$_edge_result")"
+    return 1
+  fi
+  rdata="\"$txtvalue\""
+  record_op="POST"
+  if [ "$_api_status" -eq 0 ]; then
+    # record already exists. Get existing record data and update
+    record_op="PUT"
+    rdlist=$(echo -n "$response" | _egrep_o "\"rdata\"\\s*:\\s*\\[\\s*\"[^\"]*\"\\s*]" | cut -d : -f 2 | tr -d "[]\"")  
+    _debug2 "existing TXT found"
+    _debug2 "record data" "$rdlist"
+    # value already there?
+    if _contains "$rdlist" "$txtvalue" ; then
+      return 0
+    fi
+    comma=","
+    rdata="$rdata$comma\"${txtvalue}\""
+  fi
+  _debug2 "new/updated rdata: " "${rdata}"
+  # Add the txtvalue TXT Record
+  body="{\"name\":\"$fulldomain\",\"type\":\"TXT\",\"ttl\":600, \"rdata\":"[${rdata}]"}"
+  _debug3 "Add body '${body}'"
+  _edge_result=$(_edgedns_rest "$record_op" "$acmeRecordURI" "$body")
+  _api_status="$?"
+  if [ "$_api_status" -eq 0 ]; then
+    _log "$(printf "Text value %s added to recordset %s" "${txtvalue}" "${fulldomain}")"
+    return 0
+  else
+    _err "$(printf "error adding TXT record for validation. Error: %s" "$_edge_result")"
+    return 1
+  fi
+}
+
+# Usage: dns_edgedns_rm   _acme-challenge.www.domain.com
+# Used to delete txt record
+#
+dns_edgedns_rm() {
+  fulldomain=$1
+}
+
+####################  Private functions below ##################################
+
+_EDGEDNS_credentials() {
+  _debug "GettingEdge DNS credentials" 
+  _log $(printf "ACME DNSAPI Edge DNS version %s" ${ACME_EDGEDNS_VERSION})
+  args_missing=0
+  if [ -z "${AKAMAI_ACCESS_TOKEN}" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_ACCESS_TOKEN is missing"
+    args_missing=1
+  fi
+  if [ -z "$AKAMAI_CLIENT_TOKEN" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_CLIENT_TOKEN is missing"
+    args_missing=1
+  fi
+  if [ -z "${AKAMAI_HOST}" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_HOST is missing"
+    args_missing=1
+  fi
+  if [ -z "${AKAMAI_CLIENT_SECRET}" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_CLIENT_SECRET is missing"
+    args_missing=1
+  fi
+
+  if [ "${args_missing}" = 1 ]; then
+    _err "You have not properly specified the EdgeDNS Open Edgegrid API credentials. Please try again."
+    return 1
+  else
+    _saveaccountconf_mutable AKAMAI_ACCESS_TOKEN "${AKAMAI_ACCESS_TOKEN}"
+    _saveaccountconf_mutable AKAMAI_CLIENT_TOKEN "${AKAMAI_CLIENT_TOKEN}"
+    _saveaccountconf_mutable AKAMAI_HOST "${AKAMAI_HOST}"
+    _saveaccountconf_mutable AKAMAI_CLIENT_SECRET "${AKAMAI_CLIENT_SECRET}"
+    # Set whether curl should use secure or insecure mode
+  fi
+  export HTTPS_INSECURE=0     # All Edgegrid API calls are secure
+  edge_endpoint=$(printf "https://%s/config-dns/v2/zones" "${AKAMAI_HOST}")
+  _debug3 "Edge API Endpoint:" "${edge_endpoint}"
+
+}
+
+_EDGEDNS_getZoneInfo() {
+  _debug "Getting Zoneinfo"
+  zoneEnd=false
+  curZone=$1
+  while [ -n "${zoneEnd}" ]; do
+    # we can strip the first part of the fulldomain, since its just the _acme-challenge string
+    curZone="${curZone#*.}"
+    # suffix . needed for zone -> domain.tld.
+    # create zone get url
+    get_zone_url=$(printf "%s/%s" "${edge_endpoint}" "${curZone}")
+    _debug3 "Zone Get: " "${get_zone_url}"
+    curResult=$(_edgedns_rest GET "$get_zone_url")
+    retVal=$?
+    if [ $retVal -ne 0 ]; then
+      if ["$curResult" != "404" ]; then
+        _err "$(printf "Managed zone validation failed. Error response: %s" "$retVal")"
+        return 1
+      fi
+    fi
+
+    if _contains "${curResult}" "\"zone\":" ; then
+      _debug2 "Zone data" "${curResult}"
+      zone=$(echo -n "${curResult}" | _egrep_o "\"zone\"\\s*:\\s*\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")
+      _debug2 "Zone" "${zone}"
+      zoneFound=""
+      zoneEnd=""
+      return 0
+    fi
+
+    if [ "${curZone#*.}" != "$curZone" ]; then
+      _debug2 $(printf "%s still contains a '.' - so we can check next higher level" "$curZone")
+    else
+      zoneEnd=true
+      _err "Couldn't retrieve zone data."
+      return 1
+    fi
+  done
+  _err "Failed to  retrieve zone data."
+  return 2
+}
+
+_edgedns_headers=""
+
+_edgedns_rest() {
+  _debug "Handling API Request"
+  m=$1
+  # Assume endpoint is complete path, including query args if applicable
+  ep=$2
+  body_data=$3
+  _edgedns_content_type=""
+  _request_url_path="$ep"
+  _request_body="$body_data"
+  _request_method="$m"
+  _edgedns_headers=""
+  tab=""
+  _edgedns_headers="${_edgedns_headers}${tab}Host: ${AKAMAI_HOST}"
+  tab="\t"
+  # Set in acme.sh _post/_get
+  #_edgedns_headers="${_edgedns_headers}${tab}User-Agent:ACME DNSAPI Edge DNS version ${ACME_EDGEDNS_VERSION}"
+  _edgedns_headers="${_edgedns_headers}${tab}Accept: application/json"
+  if [ "$m" != "GET" ] && [ "$m" != "DELETE" ] ; then
+    _edgedns_content_type="application/json;charset=UTF-8"
+    _utf8_body_data="$(echo -n "$ _request_body" | iconv -t utf-8)"
+    _utf8_body_len="$(echo -n "$_utf8_body_data"  | awk '{print length}')"
+    _edgedns_headers="${_edgedns_headers}${tab}Content-Length: ${_utf8_body_len}"
+  fi
+  _made_auth_header=$(_edgedns_make_auth_header)
+  _edgedns_headers="${_edgedns_headers}${tab}Authorization: ${_made_auth_header}"
+  _secure_debug2 "Made Auth Header" "${_made_auth_header}"
+  hdr_indx=1
+  work_header="${_edgedns_headers}${tab}"
+  _debug3 "work_header" "${work_header}"
+  while [ "${work_header}" ]; do  
+    entry="${work_header%%\\t*}"; work_header="${work_header#*\\t}"
+    export "$(printf "_H%s=%s" "${hdr_indx}" "${entry}")"
+    _debug2 "Request Header " "${entry}"
+    hdr_indx=$(( hdr_indx + 1 ))
+  done
+ 
+  # clear headers from previous request to avoid getting wrong http code on timeouts
+  :>"$HTTP_HEADER"
+  _debug "$ep"
+  if [ "$m" != "GET" ]; then
+    _debug "Method data" "$data"
+    # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
+    response="$(_post "$_utf8_body_data" "$ep" false "$m")"
+  else
+    response="$(_get "$ep")"
+  fi
+
+  _ret="$?"
+  _debug "response" "$response"
+  _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
+  _debug2 "http response code" "$_code"
+
+  if [ "$_code" = "200" ] || [ "$_code" = "201" ]; then
+    # All good
+    response="$(echo "$response" | _normalizeJson)"
+    echo -n "${response}"
+    return 0
+  fi
+
+  if [ "$_code" = "204" ]; then
+    # Success, no body
+    echo -n ""
+    return 0
+  fi
+
+  if [ "$_code" = "400" ]; then
+    _err "Bad request presented"
+    _log "$(printf "Headers: %s" "$_edgedns_headers")"
+    _log "$(printf "Method: %s" "$_request_method")"
+    _log "$(printf "URL: %s" "$ep")"
+    _log "$(printf "Data: %s" "$data")"
+  fi
+
+  if [ "$_code" = "403" ]; then
+    _err "access denied make sure your Edgegrid cedentials are correct."
+  fi
+
+  echo "$_code"
+  return 1
+}
+
+_edgedns_eg_timestamp() {
+  _eg_timestamp=$(date -u "+%Y%m%dT%H:%M:%S+0000")
+}
+
+_edgedns_new_nonce() {
+  _nonce=$(uuidgen -r)
+}
+
+_edgedns_make_auth_header() {
+  _debug "Constructing Auth Header"
+  _edgedns_eg_timestamp 
+  _edgedns_new_nonce 
+  # "Unsigned authorization header: 'EG1-HMAC-SHA256 client_token=block;access_token=block;timestamp=20200806T14:16:33+0000;nonce=72cde72c-82d9-4721-9854-2ba057929d67;'"
+  _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "${AKAMAI_CLIENT_TOKEN}" "${AKAMAI_ACCESS_TOKEN}" "${_eg_timestamp}" "${_nonce}")" 
+  _secure_debug2 "Unsigned Auth Header: " "$_auth_header"
+
+  _sig="$(_edgedns_sign_request)"
+  _signed_auth_header="$(printf "%ssignature=%s" "${_auth_header}" "${_sig}")"
+  _secure_debug2 "Signed Auth Header: " "${_signed_auth_header}" 
+  echo -n "${_signed_auth_header}"
+}
+
+_edgedns_sign_request() {
+  _debug2 "Signing http request"
+  _signed_data=$(_edgedns_make_data_to_sign "${_auth_header}")
+  _secure_debug2 "Returned signed data" "$_signed_data"
+  _key=$(_edgedns_make_signing_key "${_eg_timestamp}")
+  _signed_req=$(_edgedns_base64_hmac_sha256 "$_signed_data" "$_key")
+  _secure_debug2 "Signed Request" "${_signed_req}"
+  echo -n "${_signed_req}"
+}
+
+_edgedns_make_signing_key() {
+  _debug2 "Creating sigining key"
+  ts=$1
+  _signing_key=$(_edgedns_base64_hmac_sha256 "$ts" "${AKAMAI_CLIENT_SECRET}")
+  _secure_debug2 "Signing Key" "${_signing_key}"
+  echo -n "${_signing_key}"  
+
+}
+
+_edgedns_make_data_to_sign() {
+  _debug2 "Processing data to sign"
+  hdr=$1
+  _secure_debug2 "hdr" "$hdr"
+  content_hash=$(_edgedns_make_content_hash)
+  path="$(echo -n "${_request_url_path}" |sed 's/https\?:\/\///')"
+  path="${path#*$AKAMAI_HOST}"
+  _debug "hier path" "${path}"
+  # dont expose headers to sign so use MT string
+  data="$(printf "%s\thttps\t%s\t%s\t%s\t%s\t%s" "${_request_method}" "${AKAMAI_HOST}" "${path}" "" "${content_hash}" "$hdr")"
+  _secure_debug2 "Data to Sign" "${data}"
+  echo -n "${data}"
+}
+
+_edgedns_make_content_hash() {
+  _debug2 "Generating content hash"
+  prep_body=""
+  _hash=""
+  _debug2 "Request method" "${_request_method}"
+  if [ "${_request_method}" != "POST" ] || [ -z "${_request_body}" ]; then
+    echo -n "${prep_body}"
+    return 0
+  fi
+  prep_body="$(echo -n "${_request_body}")"
+  _debug2 "Req body" "${prep_body}"
+  _hash=$(_edgedns_base64_sha256 "${prep_body}")
+  _debug2 "Content hash" "${_hash}"
+  echo -n "${_hash}"
+}
+
+_edgedns_base64_hmac_sha256() {
+  _debug2 "Generating hmac"
+  data=$1
+  key=$2
+  encoded_data="$(echo -n "${data}" | iconv -t utf-8)"
+  encoded_key="$(echo -n "${key}" | iconv -t utf-8)"
+  _secure_debug2 "encoded data" "${encoded_data}"
+  _secure_debug2 "encoded key" "${encoded_key}"
+  #key_hex="$(_durl_replace_base64 "$key" | _dbase64 | _hex_dump | tr -d ' ')"
+  #data_sig="$(printf "%s" "$encoded_data" | _hmac sha256 "${key_hex}" | _base64 | _url_replace)"
+
+  data_sig="$(echo -n "$encoded_data" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -hmac $encoded_key -binary | _base64)"
+  _secure_debug2 "data_sig:" "${data_sig}"
+  out="$(echo -n "${data_sig}" | iconv -f utf-8)"
+  _secure_debug2 "hmac" "${out}"
+  echo -n "${out}"
+}
+
+_edgedns_base64_sha256() {
+  _debug2 "Creating sha256 digest"
+  trg=$1
+  utf8_str="$(echo -n "${trg}" | iconv -t utf-8)"
+  _secure_debug2 "digest data" "$trg"
+  _secure_debug2 "encoded digest data" "${utf8_str}"
+  digest="$(echo -n "${trg}" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -binary | _base64)"
+  out="$(echo -n "${digest}" | iconv -f utf-8)"
+  _secure_debug2 "digest decode" "${out}"
+  echo -n "${out}"
+}
+
+#_edgedns_parse_edgerc() {
+#  filepath=$1
+#  section=$2
+#}
+
+

From 8e09e1b248ec77ae4954e6928b22dc083c9174be Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Wed, 26 Aug 2020 16:11:11 -0400
Subject: [PATCH 12/62] debugging and cleanup

---
 dnsapi/dns_edgedns.sh | 281 ++++++++++++++++++++++++++----------------
 1 file changed, 175 insertions(+), 106 deletions(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 75ef4f9b..7be49761 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -29,9 +29,7 @@ ACME_EDGEDNS_VERSION="0.1.0"
 dns_edgedns_add() {
   fulldomain=$1
   txtvalue=$2
-
   _debug "ENTERING DNS_EDGEDNS_ADD"
-
   _debug2 "fulldomain" "$fulldomain"
   _debug2 "txtvalue" "$txtvalue"
  
@@ -39,44 +37,53 @@ dns_edgedns_add() {
     _err "$@"
     return 1
   fi
-
   if ! _EDGEDNS_getZoneInfo "$fulldomain"; then
     _err "Invalid domain"
     return 1
   fi
-  _debug2 "Add: zone" "${zone}"
-  acmeRecordURI=$(printf "%s/%s/names/%s/type/TXT" "${edge_endpoint}" "${zone}" "${fulldomain}") 
+  _debug2 "Add: zone" "$zone"
+  acmeRecordURI=$(printf "%s/%s/names/%s/types/TXT" "$edge_endpoint" "$zone" "$fulldomain") 
   _debug3 "Add URL" "$acmeRecordURI"
   # Get existing TXT record
   _edge_result=$(_edgedns_rest GET "$acmeRecordURI")
   _api_status="$?"
-  if [ "$_api_status" -ne 0 ] && [ "$_edge_result" != "404" ]; then
-    _err "$(printf "Failure accessing Akamai Edge DNS API Server. Error: %s" "$_edge_result")"
-    return 1
+  _debug3 "_edge_result" "$_edge_result"
+  if [ "$_api_status" -ne 0 ]; then
+    if [ "$curResult" = "FATAL" ]; then
+      _err "$(printf "Fatal error: acme API function call : %s" "$retVal")"
+    fi
+    if [ "$_edge_result" != "404" ]; then
+      _err "$(printf "Failure accessing Akamai Edge DNS API Server. Error: %s" "$_edge_result")"
+      return 1
+    fi
   fi
-  rdata="\"$txtvalue\""
+  rdata="\"${txtvalue}\""
   record_op="POST"
   if [ "$_api_status" -eq 0 ]; then
     # record already exists. Get existing record data and update
     record_op="PUT"
-    rdlist=$(echo -n "$response" | _egrep_o "\"rdata\"\\s*:\\s*\\[\\s*\"[^\"]*\"\\s*]" | cut -d : -f 2 | tr -d "[]\"")  
-    _debug2 "existing TXT found"
-    _debug2 "record data" "$rdlist"
+    rdlist="${_edge_result#*\"rdata\":[}"
+    rdlist="${rdlist%%]*}"
+    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\")
+    _debug3 "existing TXT found"
+    _debug3 "record data" "$rdlist"
     # value already there?
     if _contains "$rdlist" "$txtvalue" ; then
       return 0
     fi
-    comma=","
-    rdata="$rdata$comma\"${txtvalue}\""
+    _txt_val=""
+    while [ "$_txt_val" != "$rdlist" ] && [ "${rdlist}" ]; do
+        _txt_val="${rdlist%%,*}"; rdlist="${rdlist#*,}"
+        rdata="${rdata},\"${_txt_val}\""
+    done
   fi
-  _debug2 "new/updated rdata: " "${rdata}"
   # Add the txtvalue TXT Record
   body="{\"name\":\"$fulldomain\",\"type\":\"TXT\",\"ttl\":600, \"rdata\":"[${rdata}]"}"
   _debug3 "Add body '${body}'"
   _edge_result=$(_edgedns_rest "$record_op" "$acmeRecordURI" "$body")
   _api_status="$?"
   if [ "$_api_status" -eq 0 ]; then
-    _log "$(printf "Text value %s added to recordset %s" "${txtvalue}" "${fulldomain}")"
+    _log "$(printf "Text value %s added to recordset %s" "$txtvalue" "$fulldomain")"
     return 0
   else
     _err "$(printf "error adding TXT record for validation. Error: %s" "$_edge_result")"
@@ -84,20 +91,89 @@ dns_edgedns_add() {
   fi
 }
 
-# Usage: dns_edgedns_rm   _acme-challenge.www.domain.com
+# Usage: dns_edgedns_rm   _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 # Used to delete txt record
 #
 dns_edgedns_rm() {
   fulldomain=$1
+  txtvalue=$2
+  _debug "ENTERING DNS_EDGEDNS_RM"
+  _debug2 "fulldomain" "$fulldomain"
+  _debug2 "txtvalue" "$txtvalue"
+
+  if ! _EDGEDNS_credentials; then
+    _err "$@"
+    return 1
+  fi
+  if ! _EDGEDNS_getZoneInfo "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+  _debug2 "RM: zone" "${zone}"
+  acmeRecordURI=$(printf "%s/%s/names/%s/types/TXT" "${edge_endpoint}" "$zone" "$fulldomain")
+  _debug3 "RM URL" "$acmeRecordURI"
+  # Get existing TXT record
+  _edge_result=$(_edgedns_rest GET "$acmeRecordURI")
+  _api_status="$?"
+  if [ "$_api_status" -ne 0 ]; then
+    if [ "$curResult" = "FATAL" ]; then
+      _err "$(printf "Fatal error: acme API function call : %s" "$retVal")"
+    fi
+    if [ "$_edge_result" != "404" ]; then
+      _err "$(printf "Failure accessing Akamai Edge DNS API Server. Error: %s" "$_edge_result")"
+      return 1
+    fi
+  fi
+  _debug3 "_edge_result" "$_edge_result"
+  record_op="DELETE"
+  body=""
+  if [ "$_api_status" -eq 0 ]; then
+    # record already exists. Get existing record data and update
+    rdlist="${_edge_result#*\"rdata\":[}"
+    rdlist="${rdlist%%]*}"
+    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\")
+    _debug3 "rdlist" "$rdlist"
+    if [ -n "$rdlist" ]; then
+      record_op="PUT"
+      comma=""
+      rdata=""
+      _txt_val=""
+      while [ "$_txt_val" != "$rdlist" ] && [ "$rdlist" ]; do
+        _txt_val="${rdlist%%,*}"; rdlist="${rdlist#*,}"
+        _debug3 "_txt_val" "$_txt_val"
+        _debug3 "txtvalue" "$txtvalue"
+        if ! _contains "$_txt_val" "$txtvalue" ; then
+          rdata="${rdata}${comma}\"${_txt_val}\""
+          comma=","
+        fi
+      done
+      if [ -z "$rdata" ]; then
+        record_op="DELETE"
+      else
+        # Recreate the txtvalue TXT Record
+        body="{\"name\":\"$fulldomain\",\"type\":\"TXT\",\"ttl\":600, \"rdata\":"[${rdata}]"}"
+        _debug3 "body" "$body"
+      fi
+    fi
+  fi
+  _edge_result=$(_edgedns_rest "$record_op" "$acmeRecordURI" "$body")
+  _api_status="$?"
+  if [ "$_api_status" -eq 0 ]; then
+    _log "$(printf "Text value %s removed from recordset %s" "$txtvalue" "$fulldomain")"
+    return 0
+  else
+    _err "$(printf "error removing TXT record for validation. Error: %s" "$_edge_result")"
+    return 1
+  fi
 }
 
 ####################  Private functions below ##################################
 
 _EDGEDNS_credentials() {
   _debug "GettingEdge DNS credentials" 
-  _log $(printf "ACME DNSAPI Edge DNS version %s" ${ACME_EDGEDNS_VERSION})
+  _log "$(printf "ACME DNSAPI Edge DNS version %s" ${ACME_EDGEDNS_VERSION})"
   args_missing=0
-  if [ -z "${AKAMAI_ACCESS_TOKEN}" ]; then
+  if [ -z "$AKAMAI_ACCESS_TOKEN" ]; then
     AKAMAI_ACCESS_TOKEN=""
     AKAMAI_CLIENT_TOKEN=""
     AKAMAI_HOST=""
@@ -113,7 +189,7 @@ _EDGEDNS_credentials() {
     _err "AKAMAI_CLIENT_TOKEN is missing"
     args_missing=1
   fi
-  if [ -z "${AKAMAI_HOST}" ]; then
+  if [ -z "$AKAMAI_HOST" ]; then
     AKAMAI_ACCESS_TOKEN=""
     AKAMAI_CLIENT_TOKEN=""
     AKAMAI_HOST=""
@@ -121,7 +197,7 @@ _EDGEDNS_credentials() {
     _err "AKAMAI_HOST is missing"
     args_missing=1
   fi
-  if [ -z "${AKAMAI_CLIENT_SECRET}" ]; then
+  if [ -z "$AKAMAI_CLIENT_SECRET" ]; then
     AKAMAI_ACCESS_TOKEN=""
     AKAMAI_CLIENT_TOKEN=""
     AKAMAI_HOST=""
@@ -130,19 +206,19 @@ _EDGEDNS_credentials() {
     args_missing=1
   fi
 
-  if [ "${args_missing}" = 1 ]; then
+  if [ "$args_missing" = 1 ]; then
     _err "You have not properly specified the EdgeDNS Open Edgegrid API credentials. Please try again."
     return 1
   else
-    _saveaccountconf_mutable AKAMAI_ACCESS_TOKEN "${AKAMAI_ACCESS_TOKEN}"
-    _saveaccountconf_mutable AKAMAI_CLIENT_TOKEN "${AKAMAI_CLIENT_TOKEN}"
-    _saveaccountconf_mutable AKAMAI_HOST "${AKAMAI_HOST}"
-    _saveaccountconf_mutable AKAMAI_CLIENT_SECRET "${AKAMAI_CLIENT_SECRET}"
+    _saveaccountconf_mutable AKAMAI_ACCESS_TOKEN "$AKAMAI_ACCESS_TOKEN"
+    _saveaccountconf_mutable AKAMAI_CLIENT_TOKEN "$AKAMAI_CLIENT_TOKEN"
+    _saveaccountconf_mutable AKAMAI_HOST "$AKAMAI_HOST"
+    _saveaccountconf_mutable AKAMAI_CLIENT_SECRET "$AKAMAI_CLIENT_SECRET"
     # Set whether curl should use secure or insecure mode
   fi
   export HTTPS_INSECURE=0     # All Edgegrid API calls are secure
-  edge_endpoint=$(printf "https://%s/config-dns/v2/zones" "${AKAMAI_HOST}")
-  _debug3 "Edge API Endpoint:" "${edge_endpoint}"
+  edge_endpoint=$(printf "https://%s/config-dns/v2/zones" "$AKAMAI_HOST")
+  _debug3 "Edge API Endpoint:" "$edge_endpoint"
 
 }
 
@@ -150,33 +226,34 @@ _EDGEDNS_getZoneInfo() {
   _debug "Getting Zoneinfo"
   zoneEnd=false
   curZone=$1
-  while [ -n "${zoneEnd}" ]; do
+  while [ -n "$zoneEnd" ]; do
     # we can strip the first part of the fulldomain, since its just the _acme-challenge string
     curZone="${curZone#*.}"
     # suffix . needed for zone -> domain.tld.
     # create zone get url
-    get_zone_url=$(printf "%s/%s" "${edge_endpoint}" "${curZone}")
+    get_zone_url=$(printf "%s/%s" "$edge_endpoint" "$curZone")
     _debug3 "Zone Get: " "${get_zone_url}"
     curResult=$(_edgedns_rest GET "$get_zone_url")
     retVal=$?
-    if [ $retVal -ne 0 ]; then
-      if ["$curResult" != "404" ]; then
-        _err "$(printf "Managed zone validation failed. Error response: %s" "$retVal")"
+    if [ "$retVal" -ne 0 ]; then
+      if [ "$curResult" = "FATAL" ]; then
+        _err "$(printf "Fatal error: acme API function call : %s" "$retVal")"
+      fi
+      if [ "$curResult" != "404" ]; then
+        err "$(printf "Managed zone validation failed. Error response: %s" "$retVal")"
         return 1
       fi
     fi
-
-    if _contains "${curResult}" "\"zone\":" ; then
+    if _contains "$curResult" "\"zone\":" ; then
       _debug2 "Zone data" "${curResult}"
-      zone=$(echo -n "${curResult}" | _egrep_o "\"zone\"\\s*:\\s*\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")
-      _debug2 "Zone" "${zone}"
-      zoneFound=""
+      zone=$(echo "${curResult}" | _egrep_o "\"zone\"\\s*:\\s*\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")
+      _debug3 "Zone" "${zone}"
       zoneEnd=""
       return 0
     fi
 
     if [ "${curZone#*.}" != "$curZone" ]; then
-      _debug2 $(printf "%s still contains a '.' - so we can check next higher level" "$curZone")
+      _debug3 "$(printf "%s still contains a '.' - so we can check next higher level" "$curZone")"
     else
       zoneEnd=true
       _err "Couldn't retrieve zone data."
@@ -205,52 +282,55 @@ _edgedns_rest() {
   tab="\t"
   # Set in acme.sh _post/_get
   #_edgedns_headers="${_edgedns_headers}${tab}User-Agent:ACME DNSAPI Edge DNS version ${ACME_EDGEDNS_VERSION}"
-  _edgedns_headers="${_edgedns_headers}${tab}Accept: application/json"
+  _edgedns_headers="${_edgedns_headers}${tab}Accept: application/json,*/*"
   if [ "$m" != "GET" ] && [ "$m" != "DELETE" ] ; then
-    _edgedns_content_type="application/json;charset=UTF-8"
-    _utf8_body_data="$(echo -n "$ _request_body" | iconv -t utf-8)"
-    _utf8_body_len="$(echo -n "$_utf8_body_data"  | awk '{print length}')"
-    _edgedns_headers="${_edgedns_headers}${tab}Content-Length: ${_utf8_body_len}"
+    _edgedns_content_type="application/json"
+    _debug3 "_request_body" "$_request_body"
+    _body_len=$(echo "$_request_body" | tr -d "\n\r" | awk '{print length}')
+    _edgedns_headers="${_edgedns_headers}${tab}Content-Length: ${_body_len}"
   fi
-  _made_auth_header=$(_edgedns_make_auth_header)
-  _edgedns_headers="${_edgedns_headers}${tab}Authorization: ${_made_auth_header}"
-  _secure_debug2 "Made Auth Header" "${_made_auth_header}"
+  _edgedns_make_auth_header
+  _edgedns_headers="${_edgedns_headers}${tab}Authorization: ${_signed_auth_header}"
+  _secure_debug2 "Made Auth Header" "$_signed_auth_header"
   hdr_indx=1
   work_header="${_edgedns_headers}${tab}"
-  _debug3 "work_header" "${work_header}"
-  while [ "${work_header}" ]; do  
+  _debug3 "work_header" "$work_header"
+  while [ "$work_header" ]; do  
     entry="${work_header%%\\t*}"; work_header="${work_header#*\\t}"
-    export "$(printf "_H%s=%s" "${hdr_indx}" "${entry}")"
-    _debug2 "Request Header " "${entry}"
+    export "$(printf "_H%s=%s" "$hdr_indx" "$entry")"
+    _debug2 "Request Header " "$entry"
     hdr_indx=$(( hdr_indx + 1 ))
   done
  
   # clear headers from previous request to avoid getting wrong http code on timeouts
-  :>"$HTTP_HEADER"
-  _debug "$ep"
+  : >"$HTTP_HEADER"
+  _debug2 "$ep"
   if [ "$m" != "GET" ]; then
-    _debug "Method data" "$data"
+    _debug3 "Method data" "$data"
     # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
-    response="$(_post "$_utf8_body_data" "$ep" false "$m")"
+    response=$(_post "$_request_body" "$ep" false "$m" "$_edgedns_content_type")
   else
-    response="$(_get "$ep")"
+    response=$(_get "$ep")
   fi
-
   _ret="$?"
-  _debug "response" "$response"
+  if [ "$_ret" -ne 0 ]; then
+    _err "$(printf "acme.sh API function call failed. Error: %s" "$_ret")"
+    echo "FATAL"
+    return "$_ret"
+  fi
+  _debug2 "response" "${response}"
   _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
   _debug2 "http response code" "$_code"
-
   if [ "$_code" = "200" ] || [ "$_code" = "201" ]; then
     # All good
-    response="$(echo "$response" | _normalizeJson)"
-    echo -n "${response}"
+    response="$(echo "${response}" | _normalizeJson)"
+    echo "$response"
     return 0
   fi
 
   if [ "$_code" = "204" ]; then
     # Success, no body
-    echo -n ""
+    echo "$_code"
     return 0
   fi
 
@@ -283,31 +363,30 @@ _edgedns_make_auth_header() {
   _edgedns_eg_timestamp 
   _edgedns_new_nonce 
   # "Unsigned authorization header: 'EG1-HMAC-SHA256 client_token=block;access_token=block;timestamp=20200806T14:16:33+0000;nonce=72cde72c-82d9-4721-9854-2ba057929d67;'"
-  _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "${AKAMAI_CLIENT_TOKEN}" "${AKAMAI_ACCESS_TOKEN}" "${_eg_timestamp}" "${_nonce}")" 
+  _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "$AKAMAI_CLIENT_TOKEN" "$AKAMAI_ACCESS_TOKEN" "$_eg_timestamp" "$_nonce")" 
   _secure_debug2 "Unsigned Auth Header: " "$_auth_header"
 
-  _sig="$(_edgedns_sign_request)"
-  _signed_auth_header="$(printf "%ssignature=%s" "${_auth_header}" "${_sig}")"
+  _edgedns_sign_request
+  _signed_auth_header="$(printf "%ssignature=%s" "$_auth_header" "$_signed_req")"
   _secure_debug2 "Signed Auth Header: " "${_signed_auth_header}" 
-  echo -n "${_signed_auth_header}"
 }
 
 _edgedns_sign_request() {
   _debug2 "Signing http request"
-  _signed_data=$(_edgedns_make_data_to_sign "${_auth_header}")
-  _secure_debug2 "Returned signed data" "$_signed_data"
-  _key=$(_edgedns_make_signing_key "${_eg_timestamp}")
-  _signed_req=$(_edgedns_base64_hmac_sha256 "$_signed_data" "$_key")
-  _secure_debug2 "Signed Request" "${_signed_req}"
-  echo -n "${_signed_req}"
+  _edgedns_make_data_to_sign "$_auth_header"
+  _secure_debug2 "Returned signed data" "$_mdata"
+  _edgedns_make_signing_key "$_eg_timestamp"
+  _edgedns_base64_hmac_sha256 "$_mdata" "$_signing_key"
+  _signed_req="$_hmac_out"
+  _secure_debug2 "Signed Request" "$_signed_req"
 }
 
 _edgedns_make_signing_key() {
   _debug2 "Creating sigining key"
   ts=$1
-  _signing_key=$(_edgedns_base64_hmac_sha256 "$ts" "${AKAMAI_CLIENT_SECRET}")
-  _secure_debug2 "Signing Key" "${_signing_key}"
-  echo -n "${_signing_key}"  
+  _edgedns_base64_hmac_sha256 "$ts" "$AKAMAI_CLIENT_SECRET"
+  _signing_key="$_hmac_out"
+  _secure_debug2 "Signing Key" "$_signing_key"
 
 }
 
@@ -315,60 +394,50 @@ _edgedns_make_data_to_sign() {
   _debug2 "Processing data to sign"
   hdr=$1
   _secure_debug2 "hdr" "$hdr"
-  content_hash=$(_edgedns_make_content_hash)
-  path="$(echo -n "${_request_url_path}" |sed 's/https\?:\/\///')"
+  _edgedns_make_content_hash
+  path="$(echo "$_request_url_path" | tr -d "\n\r" | sed 's/https\?:\/\///')"
   path="${path#*$AKAMAI_HOST}"
-  _debug "hier path" "${path}"
+  _debug "hier path" "$path"
   # dont expose headers to sign so use MT string
-  data="$(printf "%s\thttps\t%s\t%s\t%s\t%s\t%s" "${_request_method}" "${AKAMAI_HOST}" "${path}" "" "${content_hash}" "$hdr")"
-  _secure_debug2 "Data to Sign" "${data}"
-  echo -n "${data}"
+  _mdata="$(printf "%s\thttps\t%s\t%s\t%s\t%s\t%s" "$_request_method" "$AKAMAI_HOST" "$path" "" "$_hash" "$hdr")"
+  _secure_debug2 "Data to Sign" "$_mdata"
 }
 
 _edgedns_make_content_hash() {
   _debug2 "Generating content hash"
-  prep_body=""
   _hash=""
   _debug2 "Request method" "${_request_method}"
-  if [ "${_request_method}" != "POST" ] || [ -z "${_request_body}" ]; then
-    echo -n "${prep_body}"
+  if [ "$_request_method" != "POST" ] || [ -z "$_request_body" ]; then
     return 0
   fi
-  prep_body="$(echo -n "${_request_body}")"
-  _debug2 "Req body" "${prep_body}"
-  _hash=$(_edgedns_base64_sha256 "${prep_body}")
-  _debug2 "Content hash" "${_hash}"
-  echo -n "${_hash}"
+  _debug2 "Req body" "$_request_body"
+  _edgedns_base64_sha256 "$_request_body"
+  _hash="$_sha256_out"
+  _debug2 "Content hash" "$_hash"
 }
 
 _edgedns_base64_hmac_sha256() {
   _debug2 "Generating hmac"
   data=$1
   key=$2
-  encoded_data="$(echo -n "${data}" | iconv -t utf-8)"
-  encoded_key="$(echo -n "${key}" | iconv -t utf-8)"
-  _secure_debug2 "encoded data" "${encoded_data}"
-  _secure_debug2 "encoded key" "${encoded_key}"
-  #key_hex="$(_durl_replace_base64 "$key" | _dbase64 | _hex_dump | tr -d ' ')"
-  #data_sig="$(printf "%s" "$encoded_data" | _hmac sha256 "${key_hex}" | _base64 | _url_replace)"
+  encoded_data="$(echo "$data" | iconv -t utf-8)"
+  encoded_key="$(echo "$key" | iconv -t utf-8)"
+  _secure_debug2 "encoded data" "$encoded_data"
+  _secure_debug2 "encoded key" "$encoded_key"
 
-  data_sig="$(echo -n "$encoded_data" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -hmac $encoded_key -binary | _base64)"
-  _secure_debug2 "data_sig:" "${data_sig}"
-  out="$(echo -n "${data_sig}" | iconv -f utf-8)"
-  _secure_debug2 "hmac" "${out}"
-  echo -n "${out}"
+  data_sig="$(echo "$encoded_data" | tr -d "\n\r" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -hmac "$encoded_key" -binary | _base64)"
+  _secure_debug2 "data_sig:" "$data_sig"
+  _hmac_out="$(echo "$data_sig" | tr -d "\n\r" | iconv -f utf-8)"
+  _secure_debug2 "hmac" "$_hmac_out"
 }
 
 _edgedns_base64_sha256() {
   _debug2 "Creating sha256 digest"
   trg=$1
-  utf8_str="$(echo -n "${trg}" | iconv -t utf-8)"
   _secure_debug2 "digest data" "$trg"
-  _secure_debug2 "encoded digest data" "${utf8_str}"
-  digest="$(echo -n "${trg}" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -binary | _base64)"
-  out="$(echo -n "${digest}" | iconv -f utf-8)"
-  _secure_debug2 "digest decode" "${out}"
-  echo -n "${out}"
+  digest="$(echo "$trg" | tr -d "\n\r" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -binary | _base64)"
+  _sha256_out="$(echo "$digest" | tr -d "\n\r" | iconv -f utf-8)"
+  _secure_debug2 "digest decode" "$_sha256_out"
 }
 
 #_edgedns_parse_edgerc() {

From 596a1764ef799eb08f8004f0ea68a15fc977376e Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Wed, 26 Aug 2020 18:07:46 -0400
Subject: [PATCH 13/62] vetted by shfmt

---
 dnsapi/dns_edgedns.sh | 49 ++++++++++++++++++++++---------------------
 1 file changed, 25 insertions(+), 24 deletions(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 7be49761..2072637a 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -7,15 +7,15 @@
 # Report bugs to https://control.akamai.com/apps/support-ui/#/contact-support
 
 # Values to export:
-# --EITHER--  
+# --EITHER--
 # *** NOT IMPLEMENTED YET ***
 # specify Edgegrid credentials file and section
-# AKAMAI_EDGERC=<full file path> 
+# AKAMAI_EDGERC=<full file path>
 # AKAMAI_EDGERC_SECTION="default"
 ## --OR--
 # specify indiviual credentials
 # export AKAMAI_HOST = <host>
-# export AKAMAI_ACCESS_TOKEN = <access token> 
+# export AKAMAI_ACCESS_TOKEN = <access token>
 # export AKAMAI_CLIENT_TOKEN = <client token>
 # export AKAMAI_CLIENT_SECRET = <client secret>
 
@@ -32,7 +32,7 @@ dns_edgedns_add() {
   _debug "ENTERING DNS_EDGEDNS_ADD"
   _debug2 "fulldomain" "$fulldomain"
   _debug2 "txtvalue" "$txtvalue"
- 
+
   if ! _EDGEDNS_credentials; then
     _err "$@"
     return 1
@@ -42,7 +42,7 @@ dns_edgedns_add() {
     return 1
   fi
   _debug2 "Add: zone" "$zone"
-  acmeRecordURI=$(printf "%s/%s/names/%s/types/TXT" "$edge_endpoint" "$zone" "$fulldomain") 
+  acmeRecordURI=$(printf "%s/%s/names/%s/types/TXT" "$edge_endpoint" "$zone" "$fulldomain")
   _debug3 "Add URL" "$acmeRecordURI"
   # Get existing TXT record
   _edge_result=$(_edgedns_rest GET "$acmeRecordURI")
@@ -68,13 +68,14 @@ dns_edgedns_add() {
     _debug3 "existing TXT found"
     _debug3 "record data" "$rdlist"
     # value already there?
-    if _contains "$rdlist" "$txtvalue" ; then
+    if _contains "$rdlist" "$txtvalue"; then
       return 0
     fi
     _txt_val=""
     while [ "$_txt_val" != "$rdlist" ] && [ "${rdlist}" ]; do
-        _txt_val="${rdlist%%,*}"; rdlist="${rdlist#*,}"
-        rdata="${rdata},\"${_txt_val}\""
+      _txt_val="${rdlist%%,*}"
+      rdlist="${rdlist#*,}"
+      rdata="${rdata},\"${_txt_val}\""
     done
   fi
   # Add the txtvalue TXT Record
@@ -139,10 +140,11 @@ dns_edgedns_rm() {
       rdata=""
       _txt_val=""
       while [ "$_txt_val" != "$rdlist" ] && [ "$rdlist" ]; do
-        _txt_val="${rdlist%%,*}"; rdlist="${rdlist#*,}"
+        _txt_val="${rdlist%%,*}"
+        rdlist="${rdlist#*,}"
         _debug3 "_txt_val" "$_txt_val"
         _debug3 "txtvalue" "$txtvalue"
-        if ! _contains "$_txt_val" "$txtvalue" ; then
+        if ! _contains "$_txt_val" "$txtvalue"; then
           rdata="${rdata}${comma}\"${_txt_val}\""
           comma=","
         fi
@@ -170,7 +172,7 @@ dns_edgedns_rm() {
 ####################  Private functions below ##################################
 
 _EDGEDNS_credentials() {
-  _debug "GettingEdge DNS credentials" 
+  _debug "GettingEdge DNS credentials"
   _log "$(printf "ACME DNSAPI Edge DNS version %s" ${ACME_EDGEDNS_VERSION})"
   args_missing=0
   if [ -z "$AKAMAI_ACCESS_TOKEN" ]; then
@@ -216,7 +218,7 @@ _EDGEDNS_credentials() {
     _saveaccountconf_mutable AKAMAI_CLIENT_SECRET "$AKAMAI_CLIENT_SECRET"
     # Set whether curl should use secure or insecure mode
   fi
-  export HTTPS_INSECURE=0     # All Edgegrid API calls are secure
+  export HTTPS_INSECURE=0 # All Edgegrid API calls are secure
   edge_endpoint=$(printf "https://%s/config-dns/v2/zones" "$AKAMAI_HOST")
   _debug3 "Edge API Endpoint:" "$edge_endpoint"
 
@@ -244,7 +246,7 @@ _EDGEDNS_getZoneInfo() {
         return 1
       fi
     fi
-    if _contains "$curResult" "\"zone\":" ; then
+    if _contains "$curResult" "\"zone\":"; then
       _debug2 "Zone data" "${curResult}"
       zone=$(echo "${curResult}" | _egrep_o "\"zone\"\\s*:\\s*\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")
       _debug3 "Zone" "${zone}"
@@ -283,7 +285,7 @@ _edgedns_rest() {
   # Set in acme.sh _post/_get
   #_edgedns_headers="${_edgedns_headers}${tab}User-Agent:ACME DNSAPI Edge DNS version ${ACME_EDGEDNS_VERSION}"
   _edgedns_headers="${_edgedns_headers}${tab}Accept: application/json,*/*"
-  if [ "$m" != "GET" ] && [ "$m" != "DELETE" ] ; then
+  if [ "$m" != "GET" ] && [ "$m" != "DELETE" ]; then
     _edgedns_content_type="application/json"
     _debug3 "_request_body" "$_request_body"
     _body_len=$(echo "$_request_body" | tr -d "\n\r" | awk '{print length}')
@@ -295,13 +297,14 @@ _edgedns_rest() {
   hdr_indx=1
   work_header="${_edgedns_headers}${tab}"
   _debug3 "work_header" "$work_header"
-  while [ "$work_header" ]; do  
-    entry="${work_header%%\\t*}"; work_header="${work_header#*\\t}"
+  while [ "$work_header" ]; do
+    entry="${work_header%%\\t*}"
+    work_header="${work_header#*\\t}"
     export "$(printf "_H%s=%s" "$hdr_indx" "$entry")"
     _debug2 "Request Header " "$entry"
-    hdr_indx=$(( hdr_indx + 1 ))
+    hdr_indx=$((hdr_indx + 1))
   done
- 
+
   # clear headers from previous request to avoid getting wrong http code on timeouts
   : >"$HTTP_HEADER"
   _debug2 "$ep"
@@ -360,15 +363,15 @@ _edgedns_new_nonce() {
 
 _edgedns_make_auth_header() {
   _debug "Constructing Auth Header"
-  _edgedns_eg_timestamp 
-  _edgedns_new_nonce 
+  _edgedns_eg_timestamp
+  _edgedns_new_nonce
   # "Unsigned authorization header: 'EG1-HMAC-SHA256 client_token=block;access_token=block;timestamp=20200806T14:16:33+0000;nonce=72cde72c-82d9-4721-9854-2ba057929d67;'"
-  _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "$AKAMAI_CLIENT_TOKEN" "$AKAMAI_ACCESS_TOKEN" "$_eg_timestamp" "$_nonce")" 
+  _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "$AKAMAI_CLIENT_TOKEN" "$AKAMAI_ACCESS_TOKEN" "$_eg_timestamp" "$_nonce")"
   _secure_debug2 "Unsigned Auth Header: " "$_auth_header"
 
   _edgedns_sign_request
   _signed_auth_header="$(printf "%ssignature=%s" "$_auth_header" "$_signed_req")"
-  _secure_debug2 "Signed Auth Header: " "${_signed_auth_header}" 
+  _secure_debug2 "Signed Auth Header: " "${_signed_auth_header}"
 }
 
 _edgedns_sign_request() {
@@ -444,5 +447,3 @@ _edgedns_base64_sha256() {
 #  filepath=$1
 #  section=$2
 #}
-
-

From 9c28a04c65435b6f801f313b26c4633791d5cb94 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Thu, 27 Aug 2020 17:40:07 -0400
Subject: [PATCH 14/62] add alt nonce generation logic

---
 dnsapi/dns_edgedns.sh | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 2072637a..f5705ee8 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -64,7 +64,7 @@ dns_edgedns_add() {
     record_op="PUT"
     rdlist="${_edge_result#*\"rdata\":[}"
     rdlist="${rdlist%%]*}"
-    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\")
+    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\\\")
     _debug3 "existing TXT found"
     _debug3 "record data" "$rdlist"
     # value already there?
@@ -132,7 +132,7 @@ dns_edgedns_rm() {
     # record already exists. Get existing record data and update
     rdlist="${_edge_result#*\"rdata\":[}"
     rdlist="${rdlist%%]*}"
-    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\")
+    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\\\")
     _debug3 "rdlist" "$rdlist"
     if [ -n "$rdlist" ]; then
       record_op="PUT"
@@ -355,10 +355,16 @@ _edgedns_rest() {
 
 _edgedns_eg_timestamp() {
   _eg_timestamp=$(date -u "+%Y%m%dT%H:%M:%S+0000")
+  _debug3 "_eg_timestamp" "$_eg_timestamp"
 }
 
 _edgedns_new_nonce() {
   _nonce=$(uuidgen -r)
+  _ret="$?"
+  if [ "$_ret" -ne 0 ]; then                            
+    _nonce=$(echo "EDGEDNS$(_time)" | _digest sha1 hex | cut -c 1-32)
+  fi                                                                                                    
+  _debug3 "_nonce" "$_nonce"
 }
 
 _edgedns_make_auth_header() {

From 9801876a2f3d07f2fa7eba0f7e8cc07a09fe7ef4 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Fri, 28 Aug 2020 09:55:20 -0400
Subject: [PATCH 15/62] shfmt fixes

---
 dnsapi/dns_edgedns.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index f5705ee8..94cf809c 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -361,9 +361,9 @@ _edgedns_eg_timestamp() {
 _edgedns_new_nonce() {
   _nonce=$(uuidgen -r)
   _ret="$?"
-  if [ "$_ret" -ne 0 ]; then                            
+  if [ "$_ret" -ne 0 ]; then
     _nonce=$(echo "EDGEDNS$(_time)" | _digest sha1 hex | cut -c 1-32)
-  fi                                                                                                    
+  fi
   _debug3 "_nonce" "$_nonce"
 }
 

From 491842ea3431d645dae2022999a9a953385d3748 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Sat, 12 Sep 2020 08:47:46 +0800
Subject: [PATCH 16/62] fix
 https://github.com/acmesh-official/acme.sh/issues/3159

---
 dnsapi/dns_ovh.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_ovh.sh b/dnsapi/dns_ovh.sh
index dda47dda..f6f9689a 100755
--- a/dnsapi/dns_ovh.sh
+++ b/dnsapi/dns_ovh.sh
@@ -248,7 +248,7 @@ _ovh_authentication() {
 # _domain=domain.com
 _get_root() {
   domain=$1
-  i=2
+  i=1
   p=1
   while true; do
     h=$(printf "%s" "$domain" | cut -d . -f $i-100)

From 369cfc24138be9a0fb0c1227d17f4922e6043831 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Sat, 12 Sep 2020 14:22:18 +0800
Subject: [PATCH 17/62] use testall target

---
 .github/workflows/DNS.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 0f60ace2..0274afcf 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -67,7 +67,7 @@ jobs:
     - name: Set env file
       run: cd ../acmetest && echo "${{ secrets.TokenName1 }}" >> env.list && echo "${{ secrets.TokenName2 }}" >> env.list && echo "TEST_DNS_NO_WILDCARD" >> env.list && echo "TEST_DNS_SLEEP" >> env.list
     - name: Run acmetest
-      run: cd ../acmetest && ./rundocker.sh  _cron
+      run: cd ../acmetest && ./rundocker.sh  testall
 
   MacOS:
     runs-on: macos-latest

From 4875ef045af0c2ef1d8f8442a12821df404ca16c Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Sun, 13 Sep 2020 00:16:04 +0800
Subject: [PATCH 18/62] support more dns tokens

---
 .github/workflows/DNS.yml | 71 ++++++++++++++++++++++++++++++---------
 1 file changed, 56 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 0274afcf..ae71d594 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -19,13 +19,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       hasToken: ${{ steps.step_one.outputs.hasToken }}
-    env: 
-      _ACME_CHECK_TOKEN_${{ secrets.TokenName1 }} : ${{ secrets.TokenValue1 }}
     steps:
       - name: Set the value
         id: step_one
         run: |
-          if [ "$_ACME_CHECK_TOKEN_${{ secrets.TokenName1}}" ] ; then
+          if [ "${{secrets.TokenName1}}" ] ; then
             echo "::set-output name=hasToken::true"
           else
             echo "::set-output name=hasToken::false"
@@ -50,11 +48,8 @@ jobs:
     needs: CheckToken
     if: "contains(needs.CheckToken.outputs.hasToken, 'true')"
     env:
-      ${{ secrets.TokenName1 }} : ${{ secrets.TokenValue1 }}
-      ${{ secrets.TokenName2 }} : ${{ secrets.TokenValue2 }}
       TEST_DNS : ${{ secrets.TEST_DNS }}
       TestingDomain: ${{ secrets.TestingDomain }}
-      
       TEST_DNS_NO_WILDCARD: ${{ secrets.TEST_DNS_NO_WILDCARD }}
       TEST_DNS_SLEEP: ${{ secrets.TEST_DNS_SLEEP }}
       CASE: le_test_dnsapi
@@ -65,7 +60,25 @@ jobs:
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - name: Set env file
-      run: cd ../acmetest && echo "${{ secrets.TokenName1 }}" >> env.list && echo "${{ secrets.TokenName2 }}" >> env.list && echo "TEST_DNS_NO_WILDCARD" >> env.list && echo "TEST_DNS_SLEEP" >> env.list
+      run: |
+        cd ../acmetest 
+        if [ "${{ secrets.TokenName1}}" ] ; then
+          echo "${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}" >> env.list
+        fi
+        if [ "${{ secrets.TokenName2}}" ] ; then
+          echo "${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}" >> env.list
+        fi
+        if [ "${{ secrets.TokenName3}}" ] ; then
+          echo "${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}" >> env.list
+        fi
+        if [ "${{ secrets.TokenName4}}" ] ; then
+          echo "${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}" >> env.list
+        fi
+        if [ "${{ secrets.TokenName5}}" ] ; then
+          echo "${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}" >> env.list
+        fi
+        echo "TEST_DNS_NO_WILDCARD" >> env.list 
+        echo "TEST_DNS_SLEEP" >> env.list
     - name: Run acmetest
       run: cd ../acmetest && ./rundocker.sh  testall
 
@@ -73,11 +86,8 @@ jobs:
     runs-on: macos-latest
     needs: Docker
     env:
-      ${{ secrets.TokenName1 }} : ${{ secrets.TokenValue1 }}
-      ${{ secrets.TokenName2 }} : ${{ secrets.TokenValue2 }}
       TEST_DNS : ${{ secrets.TEST_DNS }}
       TestingDomain: ${{ secrets.TestingDomain }}
-      
       TEST_DNS_NO_WILDCARD: ${{ secrets.TEST_DNS_NO_WILDCARD }}
       TEST_DNS_SLEEP: ${{ secrets.TEST_DNS_SLEEP }}
       CASE: le_test_dnsapi
@@ -90,17 +100,31 @@ jobs:
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - name: Run acmetest
-      run: cd ../acmetest && ./letest.sh
+      run: |
+        if [ "${{ secrets.TokenName1}}" ] ; then
+          export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
+        fi
+        if [ "${{ secrets.TokenName2}}" ] ; then
+          export ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
+        fi
+        if [ "${{ secrets.TokenName3}}" ] ; then
+          export ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
+        fi
+        if [ "${{ secrets.TokenName4}}" ] ; then
+          export ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
+        fi
+        if [ "${{ secrets.TokenName5}}" ] ; then
+          export ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
+        fi
+        cd ../acmetest
+        ./letest.sh
 
   Windows:
     runs-on: windows-latest
     needs: MacOS
     env:
-      ${{ secrets.TokenName1 }} : ${{ secrets.TokenValue1 }}
-      ${{ secrets.TokenName2 }} : ${{ secrets.TokenValue2 }}
       TEST_DNS : ${{ secrets.TEST_DNS }}
       TestingDomain: ${{ secrets.TestingDomain }}
-
       TEST_DNS_NO_WILDCARD: ${{ secrets.TEST_DNS_NO_WILDCARD }}
       TEST_DNS_SLEEP: ${{ secrets.TEST_DNS_SLEEP }}
       CASE: le_test_dnsapi
@@ -127,6 +151,23 @@ jobs:
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - name: Run acmetest
       shell: cmd
-      run: cd ../acmetest && bash.exe -c ./letest.sh
+      run: |
+        if [ "${{ secrets.TokenName1}}" ] ; then
+          set ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
+        fi
+        if [ "${{ secrets.TokenName2}}" ] ; then
+          set ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
+        fi
+        if [ "${{ secrets.TokenName3}}" ] ; then
+          set ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
+        fi
+        if [ "${{ secrets.TokenName4}}" ] ; then
+          set ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
+        fi
+        if [ "${{ secrets.TokenName5}}" ] ; then
+          set ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
+        fi
+        cd ../acmetest
+        bash.exe -c ./letest.sh
 
 

From 69c5291e52c7fe59721e5224f69cab9df12ac41e Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Mon, 14 Sep 2020 21:51:21 +0800
Subject: [PATCH 19/62] fix for Windows

---
 .github/workflows/DNS.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index ae71d594..5591b8f1 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -150,24 +150,24 @@ jobs:
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - name: Run acmetest
-      shell: cmd
+      shell: bash
       run: |
         if [ "${{ secrets.TokenName1}}" ] ; then
-          set ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
+          export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
         fi
         if [ "${{ secrets.TokenName2}}" ] ; then
-          set ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
+          export ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
         fi
         if [ "${{ secrets.TokenName3}}" ] ; then
-          set ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
+          export ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
         fi
         if [ "${{ secrets.TokenName4}}" ] ; then
-          set ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
+          export ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
         fi
         if [ "${{ secrets.TokenName5}}" ] ; then
-          set ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
+          export ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
         fi
         cd ../acmetest
-        bash.exe -c ./letest.sh
+        ./letest.sh
 
 

From 576a146ed223f06cdf5dcbd3c984a6ae2cfe1873 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Mon, 14 Sep 2020 22:22:36 +0800
Subject: [PATCH 20/62] add debug info for duckdns

---
 dnsapi/dns_duckdns.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dnsapi/dns_duckdns.sh b/dnsapi/dns_duckdns.sh
index 11b685c0..7c2ecfb2 100755
--- a/dnsapi/dns_duckdns.sh
+++ b/dnsapi/dns_duckdns.sh
@@ -112,6 +112,9 @@ _duckdns_rest() {
   param="$2"
   _debug param "$param"
   url="$DuckDNS_API?$param"
+  if [ "$DEBUG" -gt 0 ]; then
+    url="$url&verbose=true"
+  fi
   _debug url "$url"
 
   # DuckDNS uses GET to update domain info

From 85736d697cf9068fb79fd53fdb67519b24c13b08 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Mon, 14 Sep 2020 22:29:23 +0800
Subject: [PATCH 21/62] fix debug info

---
 dnsapi/dns_duckdns.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_duckdns.sh b/dnsapi/dns_duckdns.sh
index 7c2ecfb2..f0af2741 100755
--- a/dnsapi/dns_duckdns.sh
+++ b/dnsapi/dns_duckdns.sh
@@ -120,11 +120,13 @@ _duckdns_rest() {
   # DuckDNS uses GET to update domain info
   if [ "$method" = "GET" ]; then
     response="$(_get "$url")"
+    _debug2 response "$response"
+    if [ "$DEBUG" -gt 0 ] && _contains "$response" "UPDATED" && _contains "$response" "OK"; then
+      response="OK"
+    fi
   else
     _err "Unsupported method"
     return 1
   fi
-
-  _debug2 response "$response"
   return 0
 }

From ea724e343bab76850d8d3f5a76d700af451864b7 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Mon, 21 Sep 2020 19:57:10 +0800
Subject: [PATCH 22/62] enable for any branches.

---
 .github/workflows/DNS.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 5591b8f1..3ad9506b 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -1,8 +1,6 @@
 name: DNS
 on:
   push:
-    branches:
-      - 'dev'
     paths:
       - 'dnsapi/*.sh'
       - '.github/workflows/DNS.yml'

From 098ef976f7ce3c99052c0984359515ab95fde04e Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Thu, 24 Sep 2020 21:37:51 +0800
Subject: [PATCH 23/62] add freebsd

---
 .github/workflows/LetsEncrypt.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index 9a0175b5..69ff35ff 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -96,4 +96,20 @@ jobs:
       shell: cmd
       run: cd ../acmetest && bash.exe -c ./letest.sh
 
+  FreeBSD:
+    runs-on: macos-latest
+    needs: Windows
+    env:
+      NGROK_TOKEN : ${{ secrets.NGROK_TOKEN }}
+      TEST_LOCAL: 1
+    steps:
+    - uses: actions/checkout@v2
+    - name: Clone acmetest
+      run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
+    - uses: vmactions/freebsd@main
+      with:
+        envs: 'NGROK_TOKEN TEST_LOCAL'
+        prepare: pkg install -y socat
+        run: |
+          cd ../acmetest && ./letest.sh
 

From 182d150eaa0a48b1ebe5b0d1fd13bd175d16eee9 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Thu, 24 Sep 2020 22:18:38 +0800
Subject: [PATCH 24/62] add curl to freebsd

---
 .github/workflows/LetsEncrypt.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index 69ff35ff..4a8d4336 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -109,7 +109,7 @@ jobs:
     - uses: vmactions/freebsd@main
       with:
         envs: 'NGROK_TOKEN TEST_LOCAL'
-        prepare: pkg install -y socat
+        prepare: pkg install -y socat curl
         run: |
           cd ../acmetest && ./letest.sh
 

From 27ec69fb97260b180ab919314d8cced1d062a2ab Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Thu, 24 Sep 2020 22:57:26 +0800
Subject: [PATCH 25/62] add FreeBSD

---
 .github/workflows/DNS.yml | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 3ad9506b..fd9a98b3 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -168,4 +168,42 @@ jobs:
         cd ../acmetest
         ./letest.sh
 
+  FreeBSD:
+    runs-on: macos-latest
+    needs: Windows
+    env:
+      TEST_DNS : ${{ secrets.TEST_DNS }}
+      TestingDomain: ${{ secrets.TestingDomain }}
+      TEST_DNS_NO_WILDCARD: ${{ secrets.TEST_DNS_NO_WILDCARD }}
+      TEST_DNS_SLEEP: ${{ secrets.TEST_DNS_SLEEP }}
+      CASE: le_test_dnsapi
+      TEST_LOCAL: 1
+      DEBUG: 1
+    steps:
+    - uses: actions/checkout@v2
+    - name: Clone acmetest
+      run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
+    - uses: vmactions/freebsd@main
+      with:
+        envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
+        prepare: pkg install -y socat curl
+        run: |
+          if [ "${{ secrets.TokenName1}}" ] ; then
+            export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
+          fi
+          if [ "${{ secrets.TokenName2}}" ] ; then
+            export ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
+          fi
+          if [ "${{ secrets.TokenName3}}" ] ; then
+            export ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
+          fi
+          if [ "${{ secrets.TokenName4}}" ] ; then
+            export ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
+          fi
+          if [ "${{ secrets.TokenName5}}" ] ; then
+            export ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
+          fi
+          cd ../acmetest
+          ./letest.sh
 
+        

From 7616e94fd313025cc6c0386ee0997b1e1981cd76 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Mon, 28 Sep 2020 21:50:20 +0800
Subject: [PATCH 26/62] fix message

---
 .github/workflows/DNS.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index fd9a98b3..191ae8c9 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -36,10 +36,10 @@ jobs:
     steps:
     - name: "Read this:   https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Test"
       run: |
-        echo "Plese see this page to fix the error: https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Test"
-    - name: Fail
-      if: "github.actor != 'Neilpang'"
-      run: false
+        echo "Read this:   https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Test"
+        if [ "${{github.actor}}" != "Neilpang" ]; then
+          false
+        fi
 
   Docker:
     runs-on: ubuntu-latest

From 967096f01ce2daa819ae082c2d9fba098af8a752 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Fri, 2 Oct 2020 16:17:16 +0800
Subject: [PATCH 27/62] update freebsd-vm

---
 .github/workflows/DNS.yml         | 2 +-
 .github/workflows/LetsEncrypt.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 191ae8c9..1c0165c0 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -183,7 +183,7 @@ jobs:
     - uses: actions/checkout@v2
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/freebsd@main
+    - uses: vmactions/freebsd-vm@v0.0.4
       with:
         envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
         prepare: pkg install -y socat curl
diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index 4a8d4336..ba5e933d 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -106,7 +106,7 @@ jobs:
     - uses: actions/checkout@v2
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/freebsd@main
+    - uses: vmactions/freebsd-vm@v0.0.4
       with:
         envs: 'NGROK_TOKEN TEST_LOCAL'
         prepare: pkg install -y socat curl

From 71f00a9efd5d458b03a96a98f5718bd9d12899b3 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Fri, 2 Oct 2020 16:20:27 +0800
Subject: [PATCH 28/62] minor

---
 .github/workflows/DNS.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 1c0165c0..976aff56 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -206,4 +206,5 @@ jobs:
           cd ../acmetest
           ./letest.sh
 
+
         

From a160b798cac43e8cc7cda355b3ef5e58b9e56b28 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Fri, 2 Oct 2020 17:11:04 +0800
Subject: [PATCH 29/62] update badge

---
 README.md | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/README.md b/README.md
index 953c44a5..6fb88daf 100644
--- a/README.md
+++ b/README.md
@@ -57,26 +57,26 @@ Twitter: [@neilpangxa](https://twitter.com/neilpangxa)
 
 | NO | Status| Platform|
 |----|-------|---------|
-|1|[![](https://acmesh-official.github.io/acmetest/status/ubuntu-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)| Ubuntu
-|2|[![](https://acmesh-official.github.io/acmetest/status/debian-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)| Debian
-|3|[![](https://acmesh-official.github.io/acmetest/status/centos-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|CentOS
-|4|[![](https://acmesh-official.github.io/acmetest/status/windows-cygwin.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Windows (cygwin with curl, openssl and crontab included)
-|5|[![](https://acmesh-official.github.io/acmetest/status/freebsd.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|FreeBSD
-|6|[![](https://acmesh-official.github.io/acmetest/status/pfsense.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|pfsense
-|7|[![](https://acmesh-official.github.io/acmetest/status/opensuse-leap-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|openSUSE
-|8|[![](https://acmesh-official.github.io/acmetest/status/alpine-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Alpine Linux (with curl)
-|9|[![](https://acmesh-official.github.io/acmetest/status/archlinux-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Archlinux
-|10|[![](https://acmesh-official.github.io/acmetest/status/fedora-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|fedora
-|11|[![](https://acmesh-official.github.io/acmetest/status/kalilinux-kali.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Kali Linux
-|12|[![](https://acmesh-official.github.io/acmetest/status/oraclelinux-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Oracle Linux
-|13|[![](https://acmesh-official.github.io/acmetest/status/proxmox.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)| Proxmox: See Proxmox VE Wiki. Version [4.x, 5.0, 5.1](https://pve.proxmox.com/wiki/HTTPS_Certificate_Configuration_(Version_4.x,_5.0_and_5.1)#Let.27s_Encrypt_using_acme.sh), version [5.2 and up](https://pve.proxmox.com/wiki/Certificate_Management)
-|14|-----| Cloud Linux  https://github.com/acmesh-official/acme.sh/issues/111
-|15|[![](https://acmesh-official.github.io/acmetest/status/openbsd.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|OpenBSD
-|16|[![](https://acmesh-official.github.io/acmetest/status/mageia.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Mageia
-|17|-----| OpenWRT: Tested and working. See [wiki page](https://github.com/acmesh-official/acme.sh/wiki/How-to-run-on-OpenWRT)
-|18|[![](https://acmesh-official.github.io/acmetest/status/solaris.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|SunOS/Solaris
-|19|[![](https://acmesh-official.github.io/acmetest/status/gentoo-stage3-amd64.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Gentoo Linux
-|20|[![Build Status](https://github.com/acmesh-official/acme.sh/workflows/LetsEncrypt/badge.svg)](https://github.com/acmesh-official/acme.sh/actions?query=workflow%3ALetsEncrypt)|Mac OSX
+|1|[![MacOS](https://github.com/acmesh-official/acme.sh/workflows/LetsEncrypt/badge.svg)](https://github.com/acmesh-official/acme.sh/actions?query=workflow%3ALetsEncrypt)|Mac OSX
+|2|[![Windows](https://github.com/acmesh-official/acme.sh/workflows/LetsEncrypt/badge.svg)](https://github.com/acmesh-official/acme.sh/actions?query=workflow%3ALetsEncrypt)|Windows (cygwin with curl, openssl and crontab included)
+|3|[![FreeBSD](https://github.com/acmesh-official/acme.sh/workflows/LetsEncrypt/badge.svg)](https://github.com/acmesh-official/acme.sh/actions?query=workflow%3ALetsEncrypt)|FreeBSD
+|4|[![](https://acmesh-official.github.io/acmetest/status/pfsense.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|pfsense
+|5|[![](https://acmesh-official.github.io/acmetest/status/openbsd.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|OpenBSD
+|6|[![](https://acmesh-official.github.io/acmetest/status/solaris.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|SunOS/Solaris
+|7|[![](https://acmesh-official.github.io/acmetest/status/ubuntu-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)| Ubuntu
+|8|[![](https://acmesh-official.github.io/acmetest/status/debian-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)| Debian
+|9|[![](https://acmesh-official.github.io/acmetest/status/centos-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|CentOS
+|10|[![](https://acmesh-official.github.io/acmetest/status/opensuse-leap-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|openSUSE
+|11|[![](https://acmesh-official.github.io/acmetest/status/alpine-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Alpine Linux (with curl)
+|12|[![](https://acmesh-official.github.io/acmetest/status/archlinux-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Archlinux
+|13|[![](https://acmesh-official.github.io/acmetest/status/fedora-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|fedora
+|14|[![](https://acmesh-official.github.io/acmetest/status/kalilinux-kali.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Kali Linux
+|15|[![](https://acmesh-official.github.io/acmetest/status/oraclelinux-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Oracle Linux
+|16|[![](https://acmesh-official.github.io/acmetest/status/proxmox.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)| Proxmox: See Proxmox VE Wiki. Version [4.x, 5.0, 5.1](https://pve.proxmox.com/wiki/HTTPS_Certificate_Configuration_(Version_4.x,_5.0_and_5.1)#Let.27s_Encrypt_using_acme.sh), version [5.2 and up](https://pve.proxmox.com/wiki/Certificate_Management)
+|17|-----| Cloud Linux  https://github.com/acmesh-official/acme.sh/issues/111
+|18|[![](https://acmesh-official.github.io/acmetest/status/mageia.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Mageia
+|19|-----| OpenWRT: Tested and working. See [wiki page](https://github.com/acmesh-official/acme.sh/wiki/How-to-run-on-OpenWRT)
+|20|[![](https://acmesh-official.github.io/acmetest/status/gentoo-stage3-amd64.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|Gentoo Linux
 |21|[![](https://acmesh-official.github.io/acmetest/status/clearlinux-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|ClearLinux
 
 For all build statuses, check our [weekly build project](https://github.com/acmesh-official/acmetest):

From 13c1f4ab19c1f2ff6f9f8335425de8d18861ad45 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Fri, 2 Oct 2020 17:17:31 +0800
Subject: [PATCH 30/62] update badge

---
 README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 6fb88daf..7215785c 100644
--- a/README.md
+++ b/README.md
@@ -60,10 +60,10 @@ Twitter: [@neilpangxa](https://twitter.com/neilpangxa)
 |1|[![MacOS](https://github.com/acmesh-official/acme.sh/workflows/LetsEncrypt/badge.svg)](https://github.com/acmesh-official/acme.sh/actions?query=workflow%3ALetsEncrypt)|Mac OSX
 |2|[![Windows](https://github.com/acmesh-official/acme.sh/workflows/LetsEncrypt/badge.svg)](https://github.com/acmesh-official/acme.sh/actions?query=workflow%3ALetsEncrypt)|Windows (cygwin with curl, openssl and crontab included)
 |3|[![FreeBSD](https://github.com/acmesh-official/acme.sh/workflows/LetsEncrypt/badge.svg)](https://github.com/acmesh-official/acme.sh/actions?query=workflow%3ALetsEncrypt)|FreeBSD
-|4|[![](https://acmesh-official.github.io/acmetest/status/pfsense.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|pfsense
-|5|[![](https://acmesh-official.github.io/acmetest/status/openbsd.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|OpenBSD
-|6|[![](https://acmesh-official.github.io/acmetest/status/solaris.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|SunOS/Solaris
-|7|[![](https://acmesh-official.github.io/acmetest/status/ubuntu-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)| Ubuntu
+|4|[![Ubuntu](https://github.com/acmesh-official/acme.sh/workflows/LetsEncrypt/badge.svg)](https://github.com/acmesh-official/acme.sh/actions?query=workflow%3ALetsEncrypt)| Ubuntu
+|5|[![](https://acmesh-official.github.io/acmetest/status/pfsense.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|pfsense
+|6|[![](https://acmesh-official.github.io/acmetest/status/openbsd.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|OpenBSD
+|7|[![](https://acmesh-official.github.io/acmetest/status/solaris.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|SunOS/Solaris
 |8|[![](https://acmesh-official.github.io/acmetest/status/debian-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)| Debian
 |9|[![](https://acmesh-official.github.io/acmetest/status/centos-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|CentOS
 |10|[![](https://acmesh-official.github.io/acmetest/status/opensuse-leap-latest.svg)](https://github.com/acmesh-official/acmetest#here-are-the-latest-status)|openSUSE

From 2340c55d762269c06cae13f310649c758d739729 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Fri, 9 Oct 2020 22:33:21 +0800
Subject: [PATCH 31/62] update freebsd

---
 .github/workflows/DNS.yml         | 3 ++-
 .github/workflows/LetsEncrypt.yml | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 976aff56..b06db229 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -183,10 +183,11 @@ jobs:
     - uses: actions/checkout@v2
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/freebsd-vm@v0.0.4
+    - uses: vmactions/freebsd-vm@v0.0.5
       with:
         envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
         prepare: pkg install -y socat curl
+        usesh: true
         run: |
           if [ "${{ secrets.TokenName1}}" ] ; then
             export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index ba5e933d..d71f3ac1 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -106,10 +106,11 @@ jobs:
     - uses: actions/checkout@v2
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/freebsd-vm@v0.0.4
+    - uses: vmactions/freebsd-vm@v0.0.5
       with:
         envs: 'NGROK_TOKEN TEST_LOCAL'
         prepare: pkg install -y socat curl
+        usesh: true
         run: |
           cd ../acmetest && ./letest.sh
 

From 25468f55ffbca9a78330221404571786f9f229a5 Mon Sep 17 00:00:00 2001
From: Rene Luria <rene.luria@infomaniak.com>
Date: Mon, 21 Sep 2020 14:17:23 +0200
Subject: [PATCH 32/62] Added dnsapi/dns_infomaniak.sh

---
 dnsapi/dns_infomaniak.sh | 199 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 199 insertions(+)
 create mode 100755 dnsapi/dns_infomaniak.sh

diff --git a/dnsapi/dns_infomaniak.sh b/dnsapi/dns_infomaniak.sh
new file mode 100755
index 00000000..e2328a36
--- /dev/null
+++ b/dnsapi/dns_infomaniak.sh
@@ -0,0 +1,199 @@
+#!/usr/bin/env sh
+
+###############################################################################
+# Infomaniak API integration
+#
+# To use this API you need visit the API dashboard of your account
+# once logged into https://manager.infomaniak.com add /api/dashboard to the URL
+#
+# Please report bugs to
+# https://github.com/acmesh-official/acme.sh/issues/3188
+#
+# Note: the URL looks like this:
+# https://manager.infomaniak.com/v3/<account_id>/api/dashboard
+# Then generate a token with the scope Domain
+# this is given as an environment variable INFOMANIAK_API_TOKEN
+###############################################################################
+
+# base variables
+
+DEFAULT_INFOMANIAK_API_URL="https://api.infomaniak.com"
+DEFAULT_INFOMANIAK_TTL=300
+
+########  Public functions #####################
+
+#Usage: dns_infomaniak_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_infomaniak_add() {
+
+  INFOMANIAK_API_TOKEN="${INFOMANIAK_API_TOKEN:-$(_readaccountconf_mutable INFOMANIAK_API_TOKEN)}"
+  INFOMANIAK_API_URL="${INFOMANIAK_API_URL:-$(_readaccountconf_mutable INFOMANIAK_API_URL)}"
+  INFOMANIAK_TTL="${INFOMANIAK_TTL:-$(_readaccountconf_mutable INFOMANIAK_TTL)}"
+
+  if [ -z "$INFOMANIAK_API_TOKEN" ]; then
+    INFOMANIAK_API_TOKEN=""
+    _err "Please provide a valid Infomaniak API token in variable INFOMANIAK_API_TOKEN"
+    return 1
+  fi
+
+  if [ -z "$INFOMANIAK_API_URL" ]; then
+    INFOMANIAK_API_URL="$DEFAULT_INFOMANIAK_API_URL"
+  fi
+
+  if [ -z "$INFOMANIAK_TTL" ]; then
+    INFOMANIAK_TTL="$DEFAULT_INFOMANIAK_TTL"
+  fi
+
+  #save the token to the account conf file.
+  _saveaccountconf_mutable INFOMANIAK_API_TOKEN "$INFOMANIAK_API_TOKEN"
+
+  if [ "$INFOMANIAK_API_URL" != "$DEFAULT_INFOMANIAK_API_URL" ]; then
+    _saveaccountconf_mutable INFOMANIAK_API_URL "$INFOMANIAK_API_URL"
+  fi
+
+  if [ "$INFOMANIAK_TTL" != "$DEFAULT_INFOMANIAK_TTL" ]; then
+    _saveaccountconf_mutable INFOMANIAK_TTL "$INFOMANIAK_TTL"
+  fi
+
+  export _H1="Authorization: Bearer $INFOMANIAK_API_TOKEN"
+  export _H2="Content-Type: application/json"
+
+  fulldomain="$1"
+  txtvalue="$2"
+
+  _info "Infomaniak DNS API"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  fqdn=${fulldomain#_acme-challenge.}
+
+  # guess which base domain to add record to
+  zone_and_id=$(_find_zone "$fqdn")
+  if [ -z "$zone_and_id" ]; then
+    _err "cannot find zone to modify"
+    return 1
+  fi
+  zone=${zone_and_id% *}
+  domain_id=${zone_and_id#* }
+
+  # extract first part of domain
+  key=${fulldomain%.$zone}
+
+  _debug "zone:$zone id:$domain_id key:$key"
+
+  # payload
+  data="{\"type\": \"TXT\", \"source\": \"$key\", \"target\": \"$txtvalue\", \"ttl\": $INFOMANIAK_TTL}"
+
+  # API call
+  response=$(_post "$data" "${INFOMANIAK_API_URL}/1/domain/$domain_id/dns/record")
+  if [ -n "$response" ] && echo "$response" | grep -qF '"result":"success"'; then
+    _info "Record added"
+    _debug "Response: $response"
+    return 0
+  fi
+  _err "could not create record"
+  _debug "Response: $response"
+  return 1
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_infomaniak_rm() {
+
+  INFOMANIAK_API_TOKEN="${INFOMANIAK_API_TOKEN:-$(_readaccountconf_mutable INFOMANIAK_API_TOKEN)}"
+  INFOMANIAK_API_URL="${INFOMANIAK_API_URL:-$(_readaccountconf_mutable INFOMANIAK_API_URL)}"
+  INFOMANIAK_TTL="${INFOMANIAK_TTL:-$(_readaccountconf_mutable INFOMANIAK_TTL)}"
+
+  if [ -z "$INFOMANIAK_API_TOKEN" ]; then
+    INFOMANIAK_API_TOKEN=""
+    _err "Please provide a valid Infomaniak API token in variable INFOMANIAK_API_TOKEN"
+    return 1
+  fi
+
+  if [ -z "$INFOMANIAK_API_URL" ]; then
+    INFOMANIAK_API_URL="$DEFAULT_INFOMANIAK_API_URL"
+  fi
+
+  if [ -z "$INFOMANIAK_TTL" ]; then
+    INFOMANIAK_TTL="$DEFAULT_INFOMANIAK_TTL"
+  fi
+
+  #save the token to the account conf file.
+  _saveaccountconf_mutable INFOMANIAK_API_TOKEN "$INFOMANIAK_API_TOKEN"
+
+  if [ "$INFOMANIAK_API_URL" != "$DEFAULT_INFOMANIAK_API_URL" ]; then
+    _saveaccountconf_mutable INFOMANIAK_API_URL "$INFOMANIAK_API_URL"
+  fi
+
+  if [ "$INFOMANIAK_TTL" != "$DEFAULT_INFOMANIAK_TTL" ]; then
+    _saveaccountconf_mutable INFOMANIAK_TTL "$INFOMANIAK_TTL"
+  fi
+
+  export _H1="Authorization: Bearer $INFOMANIAK_API_TOKEN"
+  export _H2="ContentType: application/json"
+
+  fulldomain=$1
+  txtvalue=$2
+  _info "Infomaniak DNS API"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  fqdn=${fulldomain#_acme-challenge.}
+
+  # guess which base domain to add record to
+  zone_and_id=$(_find_zone "$fqdn")
+  if [ -z "$zone_and_id" ]; then
+    _err "cannot find zone to modify"
+    return 1
+  fi
+  zone=${zone_and_id% *}
+  domain_id=${zone_and_id#* }
+
+  # extract first part of domain
+  key=${fulldomain%.$zone}
+
+  _debug "zone:$zone id:$domain_id key:$key"
+
+  # find previous record
+  # shellcheck disable=SC1004
+  record_id=$(_get "${INFOMANIAK_API_URL}/1/domain/$domain_id/dns/record" | sed 's/.*"data":\[\(.*\)\]}/\1/; s/},{/}\
+{/g' | sed -n 's/.*"id":"*\([0-9]*\)"*.*"source_idn":"'"$fulldomain"'".*"target_idn":"'"$txtvalue"'".*/\1/p')
+  if [ -z "$record_id" ]; then
+    _err "could not find record to delete"
+    return 1
+  fi
+  _debug "record_id: $record_id"
+
+  # API call
+  response=$(_post "" "${INFOMANIAK_API_URL}/1/domain/$domain_id/dns/record/$record_id" "" DELETE)
+  if [ -n "$response" ] && echo "$response" | grep -qF '"result":"success"'; then
+    _info "Record deleted"
+    return 0
+  fi
+  _err "could not delete record"
+  return 1
+}
+
+####################  Private functions below ##################################
+
+_get_domain_id() {
+  domain="$1"
+
+  # shellcheck disable=SC1004
+  _get "${INFOMANIAK_API_URL}/1/product?service_name=domain&customer_name=$domain" | sed 's/.*"data":\[{\(.*\)}\]}/\1/; s/,/\
+/g' | sed -n 's/^"id":\(.*\)/\1/p'
+}
+
+_find_zone() {
+  zone="$1"
+
+  # find domain in list, removing . parts sequentialy
+  while echo "$zone" | grep -q '\.'; do
+    _debug "testing $zone"
+    id=$(_get_domain_id "$zone")
+    if [ -n "$id" ]; then
+      echo "$zone $id"
+      return
+    fi
+    zone=${zone#*.}
+  done
+}

From 15fa0c264f7cfd8bc9542ec18a1c7cb407e7404e Mon Sep 17 00:00:00 2001
From: Rene Luria <rene.luria@infomaniak.com>
Date: Fri, 2 Oct 2020 12:47:33 +0200
Subject: [PATCH 33/62] dnsapi/dns_infomaniak.sh: Replace grep by _contains

---
 dnsapi/dns_infomaniak.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_infomaniak.sh b/dnsapi/dns_infomaniak.sh
index e2328a36..765cf39d 100755
--- a/dnsapi/dns_infomaniak.sh
+++ b/dnsapi/dns_infomaniak.sh
@@ -85,7 +85,7 @@ dns_infomaniak_add() {
 
   # API call
   response=$(_post "$data" "${INFOMANIAK_API_URL}/1/domain/$domain_id/dns/record")
-  if [ -n "$response" ] && echo "$response" | grep -qF '"result":"success"'; then
+  if [ -n "$response" ] && echo "$response" | _contains '"result":"success"'; then
     _info "Record added"
     _debug "Response: $response"
     return 0
@@ -165,7 +165,7 @@ dns_infomaniak_rm() {
 
   # API call
   response=$(_post "" "${INFOMANIAK_API_URL}/1/domain/$domain_id/dns/record/$record_id" "" DELETE)
-  if [ -n "$response" ] && echo "$response" | grep -qF '"result":"success"'; then
+  if [ -n "$response" ] && echo "$response" | _contains '"result":"success"'; then
     _info "Record deleted"
     return 0
   fi
@@ -187,7 +187,7 @@ _find_zone() {
   zone="$1"
 
   # find domain in list, removing . parts sequentialy
-  while echo "$zone" | grep -q '\.'; do
+  while _contains "$zone" '\.'; do
     _debug "testing $zone"
     id=$(_get_domain_id "$zone")
     if [ -n "$id" ]; then

From c6617ebc9faf47e08ee21f23dee9ce839974af27 Mon Sep 17 00:00:00 2001
From: Rene Luria <rene.luria@infomaniak.com>
Date: Thu, 8 Oct 2020 23:42:05 +0200
Subject: [PATCH 34/62] Fix DNS workflow use variables TEST_DNS_SLEEP and
 TEST_DNS_NO_WILDCARD

---
 .github/workflows/DNS.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index b06db229..1909cb03 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -75,8 +75,8 @@ jobs:
         if [ "${{ secrets.TokenName5}}" ] ; then
           echo "${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}" >> env.list
         fi
-        echo "TEST_DNS_NO_WILDCARD" >> env.list 
-        echo "TEST_DNS_SLEEP" >> env.list
+        echo "TEST_DNS_NO_WILDCARD=$TEST_DNS_NO_WILDCARD" >> env.list 
+        echo "TEST_DNS_SLEEP=$TEST_DNS_SLEEP" >> env.list
     - name: Run acmetest
       run: cd ../acmetest && ./rundocker.sh  testall
 

From ff8fe7e01857afd3c18d94e4a529ddefac85da4e Mon Sep 17 00:00:00 2001
From: Rene Luria <rene.luria@infomaniak.com>
Date: Sat, 10 Oct 2020 18:20:26 +0200
Subject: [PATCH 35/62] Revert "Fix DNS workflow use variables TEST_DNS_SLEEP
 and TEST_DNS_NO_WILDCARD"

This reverts commit f864416e39753b66f26d8d3fa19cbb094493731a.
---
 .github/workflows/DNS.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 1909cb03..b06db229 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -75,8 +75,8 @@ jobs:
         if [ "${{ secrets.TokenName5}}" ] ; then
           echo "${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}" >> env.list
         fi
-        echo "TEST_DNS_NO_WILDCARD=$TEST_DNS_NO_WILDCARD" >> env.list 
-        echo "TEST_DNS_SLEEP=$TEST_DNS_SLEEP" >> env.list
+        echo "TEST_DNS_NO_WILDCARD" >> env.list 
+        echo "TEST_DNS_SLEEP" >> env.list
     - name: Run acmetest
       run: cd ../acmetest && ./rundocker.sh  testall
 

From 5aff548794a9569a38a439014cc36073c0ff38b8 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Wed, 14 Oct 2020 14:49:09 -0400
Subject: [PATCH 36/62] remove uuidgen

---
 dnsapi/dns_edgedns.sh | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 94cf809c..89e77936 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -359,11 +359,7 @@ _edgedns_eg_timestamp() {
 }
 
 _edgedns_new_nonce() {
-  _nonce=$(uuidgen -r)
-  _ret="$?"
-  if [ "$_ret" -ne 0 ]; then
-    _nonce=$(echo "EDGEDNS$(_time)" | _digest sha1 hex | cut -c 1-32)
-  fi
+  _nonce=$(echo "EDGEDNS$(_time)" | _digest sha1 hex | cut -c 1-32)
   _debug3 "_nonce" "$_nonce"
 }
 

From 054a62de6073492457bf35e406f743d2c1eb5477 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 16 Oct 2020 18:47:02 +0800
Subject: [PATCH 37/62] Update DNS.yml

---
 .github/workflows/DNS.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index b06db229..25d92137 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -183,7 +183,7 @@ jobs:
     - uses: actions/checkout@v2
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/freebsd-vm@v0.0.5
+    - uses: vmactions/freebsd-vm@v0.0.7
       with:
         envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
         prepare: pkg install -y socat curl

From 23088bc89778d48b183a9c26789b4d4f4ee53b4c Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 16 Oct 2020 18:47:27 +0800
Subject: [PATCH 38/62] Update LetsEncrypt.yml

---
 .github/workflows/LetsEncrypt.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index d71f3ac1..39e91161 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -106,7 +106,7 @@ jobs:
     - uses: actions/checkout@v2
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/freebsd-vm@v0.0.5
+    - uses: vmactions/freebsd-vm@v0.0.7
       with:
         envs: 'NGROK_TOKEN TEST_LOCAL'
         prepare: pkg install -y socat curl

From 9ab16bdbb36462db2b63b0a2362369e1d1f5e91b Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Fri, 16 Oct 2020 10:16:25 -0400
Subject: [PATCH 39/62] use _digest instead of openssl

---
 dnsapi/dns_edgedns.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 89e77936..7ab448d2 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -440,7 +440,7 @@ _edgedns_base64_sha256() {
   _debug2 "Creating sha256 digest"
   trg=$1
   _secure_debug2 "digest data" "$trg"
-  digest="$(echo "$trg" | tr -d "\n\r" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -binary | _base64)"
+  digest="$(echo "$trg" | tr -d "\n\r" | _digest "sha256")" 
   _sha256_out="$(echo "$digest" | tr -d "\n\r" | iconv -f utf-8)"
   _secure_debug2 "digest decode" "$_sha256_out"
 }

From 6b20993d2a54b30642ef4987a0370307c4d6dfd4 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Fri, 16 Oct 2020 10:32:01 -0400
Subject: [PATCH 40/62] fix format

---
 dnsapi/dns_edgedns.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 7ab448d2..05c8e886 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -440,7 +440,7 @@ _edgedns_base64_sha256() {
   _debug2 "Creating sha256 digest"
   trg=$1
   _secure_debug2 "digest data" "$trg"
-  digest="$(echo "$trg" | tr -d "\n\r" | _digest "sha256")" 
+  digest="$(echo "$trg" | tr -d "\n\r" | _digest "sha256")"
   _sha256_out="$(echo "$digest" | tr -d "\n\r" | iconv -f utf-8)"
   _secure_debug2 "digest decode" "$_sha256_out"
 }

From 27a54bcbaa666da69eea8256d73fe6ce4648ba64 Mon Sep 17 00:00:00 2001
From: Adrian Fedoreanu <adrian.fedoreanu@gmail.com>
Date: Mon, 19 Oct 2020 20:45:52 +0200
Subject: [PATCH 41/62] fix dnsapi/dns_1984hosting

---
 dnsapi/dns_1984hosting.sh | 84 +++++++++++++++------------------------
 1 file changed, 33 insertions(+), 51 deletions(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index bcb675ab..d720c1c5 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -40,8 +40,35 @@ dns_1984hosting_add() {
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
 
-  _1984hosting_add_txt_record "$_domain" "$_sub_domain" "$txtvalue"
-  return $?
+  _debug "Add TXT record $fulldomain with value '$txtvalue'"
+  value="$(printf '%s' "$txtvalue" | _url_encode)"
+  url="https://management.1984hosting.com/domains/entry/"
+
+  postdata="entry=new"
+  postdata="$postdata&type=TXT"
+  postdata="$postdata&ttl=3600"
+  postdata="$postdata&zone=$_domain"
+  postdata="$postdata&host=$_sub_domain"
+  postdata="$postdata&rdata=%22$value%22"
+  _debug2 postdata "$postdata"
+
+  _authpost "$postdata" "$url"
+  response="$(echo "$_response" | _normalizeJson)"
+  _debug2 response "$response"
+
+  if _contains "$response" '"haserrors": true'; then
+    _err "1984Hosting failed to add TXT record for $_sub_domain bad RC from _post"
+    return 1
+  elif _contains "$response" "<html>"; then
+    _err "1984Hosting failed to add TXT record for $_sub_domain. Check $HTTP_HEADER file"
+    return 1
+  elif _contains "$response" '"auth": false'; then
+    _err "1984Hosting failed to add TXT record for $_sub_domain. Invalid or expired cookie"
+    return 1
+  fi
+
+  _info "Added acme challenge TXT record for $fulldomain at 1984Hosting"
+  return 0
 }
 
 #Usage: fulldomain txtvalue
@@ -67,57 +94,10 @@ dns_1984hosting_rm() {
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
 
-  _1984hosting_delete_txt_record "$_domain" "$_sub_domain"
-  return $?
-}
-
-####################  Private functions below ##################################
-
-# usage _1984hosting_add_txt_record domain subdomain value
-# returns 0 success
-_1984hosting_add_txt_record() {
-  _debug "Add TXT record $1 with value '$3'"
-  domain="$1"
-  subdomain="$2"
-  value="$(printf '%s' "$3" | _url_encode)"
-  url="https://management.1984hosting.com/domains/entry/"
-
-  postdata="entry=new"
-  postdata="$postdata&type=TXT"
-  postdata="$postdata&ttl=3600"
-  postdata="$postdata&zone=$domain"
-  postdata="$postdata&host=$subdomain"
-  postdata="$postdata&rdata=%22$value%22"
-  _debug2 postdata "$postdata"
-
-  _authpost "$postdata" "$url"
-  response="$(echo "$_response" | _normalizeJson)"
-  _debug2 response "$response"
-
-  if _contains "$response" '"haserrors": true'; then
-    _err "1984Hosting failed to add TXT record for $subdomain bad RC from _post"
-    return 1
-  elif _contains "$response" "<html>"; then
-    _err "1984Hosting failed to add TXT record for $subdomain. Check $HTTP_HEADER file"
-    return 1
-  elif _contains "$response" '"auth": false'; then
-    _err "1984Hosting failed to add TXT record for $subdomain. Invalid or expired cookie"
-    return 1
-  fi
-
-  _info "Added acme challenge TXT record for $fulldomain at 1984Hosting"
-  return 0
-}
-
-# usage _1984hosting_delete_txt_record entry_id
-# returns 0 success
-_1984hosting_delete_txt_record() {
   _debug "Delete $fulldomain TXT record"
-  domain="$1"
-  subdomain="$2"
   url="https://management.1984hosting.com/domains"
 
-  _htmlget "$url" "$domain"
+  _htmlget "$url" "$_domain"
   _debug2 _response "$_response"
   zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+')"
   _debug2 zone_id "$zone_id"
@@ -126,7 +106,7 @@ _1984hosting_delete_txt_record() {
     return 1
   fi
 
-  _htmlget "$url/$zone_id" "$subdomain"
+  _htmlget "$url/$zone_id" "$_sub_domain"
   _debug2 _response "$_response"
   entry_id="$(echo "$_response" | _egrep_o 'entry_[0-9]+' | sed 's/entry_//')"
   _debug2 entry_id "$entry_id"
@@ -148,6 +128,8 @@ _1984hosting_delete_txt_record() {
   return 0
 }
 
+####################  Private functions below ##################################
+
 # usage: _1984hosting_login username password
 # returns 0 success
 _1984hosting_login() {

From b025ed60579e194140a75062e8bb6ef5d42b6c00 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Wed, 21 Oct 2020 15:00:33 +0800
Subject: [PATCH 42/62] Update LetsEncrypt.yml

---
 .github/workflows/LetsEncrypt.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index 39e91161..5f0bba72 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -58,7 +58,7 @@ jobs:
     steps:
     - uses: actions/checkout@v2
     - name: Install tools
-      run:  brew update && brew install socat;
+      run:  brew install socat
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - name: Run acmetest

From aa85d0ffeba66fd438a2f1d5312b919e731cb8be Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Wed, 28 Oct 2020 09:05:14 -0400
Subject: [PATCH 43/62] trigger commit

---
 dnsapi/dns_edgedns.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 05c8e886..1b3996cf 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -8,7 +8,7 @@
 
 # Values to export:
 # --EITHER--
-# *** NOT IMPLEMENTED YET ***
+# *** TBD. NOT IMPLEMENTED YET ***
 # specify Edgegrid credentials file and section
 # AKAMAI_EDGERC=<full file path>
 # AKAMAI_EDGERC_SECTION="default"

From df60a2248a6ce4f1f3c7675be0305feb3b88cf7d Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Wed, 28 Oct 2020 15:20:24 -0400
Subject: [PATCH 44/62] fix typo

---
 dnsapi/dns_edgedns.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 1b3996cf..8ed6e5d2 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -242,7 +242,7 @@ _EDGEDNS_getZoneInfo() {
         _err "$(printf "Fatal error: acme API function call : %s" "$retVal")"
       fi
       if [ "$curResult" != "404" ]; then
-        err "$(printf "Managed zone validation failed. Error response: %s" "$retVal")"
+        _err "$(printf "Managed zone validation failed. Error response: %s" "$retVal")"
         return 1
       fi
     fi

From 7cc30c268b6c1f79be55fa3a8d31ec50892a4a78 Mon Sep 17 00:00:00 2001
From: ma331 <59875686+ma331@users.noreply.github.com>
Date: Thu, 29 Oct 2020 11:14:44 +0100
Subject: [PATCH 45/62] Script to use with Anexia CloudDNS

---
 dnsapi/dns_anx.sh | 157 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 157 insertions(+)
 create mode 100644 dnsapi/dns_anx.sh

diff --git a/dnsapi/dns_anx.sh b/dnsapi/dns_anx.sh
new file mode 100644
index 00000000..9865adc2
--- /dev/null
+++ b/dnsapi/dns_anx.sh
@@ -0,0 +1,157 @@
+#!/usr/bin/env sh
+
+#ANX_Token="xxxx"
+
+ANX_API='https://engine.anexia-it.com/api/clouddns/v1'
+
+########  Public functions #####################
+
+dns_anx_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "Using ANX CDNS API"
+
+  ANX_Token="${ANX_Token:-$(_readaccountconf_mutable ANX_Token)}"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  if [ "$ANX_Token" ]; then
+    _saveaccountconf_mutable ANX_Token "$ANX_Token"
+  else
+   _err "You didn't specify a ANEXIA Engine API token."
+   return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  # Always add records, wildcard need two records with the same name
+  _anx_rest POST "zone.json/${_domain}/records" "{\"name\":\"$_sub_domain\",\"type\":\"TXT\",\"rdata\":\"$txtvalue\"}"
+  if _contains "$response" "$txtvalue"; then
+    return 0
+  else
+    return 1
+  fi
+}
+
+dns_anx_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "Using ANX CDNS API"
+
+  ANX_Token="${ANX_Token:-$(_readaccountconf_mutable ANX_Token)}"
+
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _get_record_id
+
+  if _is_uuid "$_record_id"; then
+    if ! _anx_rest DELETE "zone.json/${_domain}/records/$_record_id"; then
+      _err "Delete record"
+      return 1
+    fi
+  else
+    _info "No record found."
+  fi
+  echo "$response" | tr -d " " | grep \"status\":\"OK\" >/dev/null
+}
+
+####################  Private functions below ##################################
+
+_is_uuid() {
+  pattern='^\{?[A-Z0-9a-z]{8}-[A-Z0-9a-z]{4}-[A-Z0-9a-z]{4}-[A-Z0-9a-z]{4}-[A-Z0-9a-z]{12}\}?$'
+  if echo "$1" | _egrep_o "$pattern" >/dev/null; then
+    return 0
+  fi
+  return 1
+}
+
+_get_record_id() {
+  _debug subdomain "$_sub_domain"
+  _debug domain "$_domain"
+
+  if _anx_rest GET "zone.json/${_domain}/records?name=$_sub_domain&type=TXT"; then
+    _debug response "$response"
+    if _contains "$response" "\"name\":\"$_sub_domain\"" >/dev/null; then
+      _record_id=$(printf "%s\n" "$response" | _egrep_o "\[.\"identifier\":\"[^\"]*\"" | head -n 1 | cut -d : -f 2 | tr -d \")
+    else
+      _record_id=''
+    fi
+  else
+    _err "Search existing record"
+  fi
+}
+
+_anx_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  export _H1="Content-Type: application/json"
+  export _H2="Authorization: Token $ANX_Token"
+
+  if [ "$m" != "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "${ANX_API}/$ep" "" "$m")"
+  else
+    response="$(_get "${ANX_API}/$ep")"
+  fi
+
+  # shellcheck disable=SC2181
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug response "$response"
+  return 0
+}
+
+
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+_get_root() {
+  domain=$1
+  i=1
+  p=1
+
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+
+    # Does a zone with that name exist?
+    _anx_rest GET "zone.json/$h"
+    # shellcheck disable=SC2154
+    if [ "$code" -ne 200 ]; then
+      continue
+    fi
+
+    if _contains "$response" "\"name\":\"$h\""; then
+      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain=$h
+      return 0
+    fi
+
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}

From fe54d5b8aeef06a7244e08c380af68eaea9884bc Mon Sep 17 00:00:00 2001
From: ma331 <59875686+ma331@users.noreply.github.com>
Date: Thu, 29 Oct 2020 12:51:49 +0100
Subject: [PATCH 46/62] fixed spacing in two lines

---
 dnsapi/dns_anx.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_anx.sh b/dnsapi/dns_anx.sh
index 9865adc2..66430d3e 100644
--- a/dnsapi/dns_anx.sh
+++ b/dnsapi/dns_anx.sh
@@ -19,8 +19,8 @@ dns_anx_add() {
   if [ "$ANX_Token" ]; then
     _saveaccountconf_mutable ANX_Token "$ANX_Token"
   else
-   _err "You didn't specify a ANEXIA Engine API token."
-   return 1
+    _err "You didn't specify a ANEXIA Engine API token."
+    return 1
   fi
 
   _debug "First detect the root zone"

From bc62d49fc900e2f5b31881e02c432433435ae245 Mon Sep 17 00:00:00 2001
From: ma331 <59875686+ma331@users.noreply.github.com>
Date: Thu, 29 Oct 2020 13:04:29 +0100
Subject: [PATCH 47/62] removed empty line to make shfmt happy

---
 dnsapi/dns_anx.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_anx.sh b/dnsapi/dns_anx.sh
index 66430d3e..b84fac8c 100644
--- a/dnsapi/dns_anx.sh
+++ b/dnsapi/dns_anx.sh
@@ -119,7 +119,6 @@ _anx_rest() {
   return 0
 }
 
-
 #_acme-challenge.www.domain.com
 #returns
 # _sub_domain=_acme-challenge.www

From 92bbdce4351028909e83c189dc77ab313b3684d4 Mon Sep 17 00:00:00 2001
From: ma331 <59875686+ma331@users.noreply.github.com>
Date: Thu, 29 Oct 2020 13:35:53 +0100
Subject: [PATCH 48/62] changed comment

---
 dnsapi/dns_anx.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_anx.sh b/dnsapi/dns_anx.sh
index b84fac8c..027f6820 100644
--- a/dnsapi/dns_anx.sh
+++ b/dnsapi/dns_anx.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env sh
 
+### Anexia CloudDNS acme.sh hook
 #ANX_Token="xxxx"
 
 ANX_API='https://engine.anexia-it.com/api/clouddns/v1'

From 812333e9aef404d3b5e7b5f0cdfa935b20c3895c Mon Sep 17 00:00:00 2001
From: ma331 <59875686+ma331@users.noreply.github.com>
Date: Thu, 29 Oct 2020 14:01:08 +0100
Subject: [PATCH 49/62] Changed comment once more

---
 dnsapi/dns_anx.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_anx.sh b/dnsapi/dns_anx.sh
index 027f6820..8c46e405 100644
--- a/dnsapi/dns_anx.sh
+++ b/dnsapi/dns_anx.sh
@@ -1,6 +1,8 @@
 #!/usr/bin/env sh
 
-### Anexia CloudDNS acme.sh hook
+# Anexia CloudDNS acme.sh hook
+# Author: MA
+
 #ANX_Token="xxxx"
 
 ANX_API='https://engine.anexia-it.com/api/clouddns/v1'

From d58fb2bbc01f8d2596c5365db9e644d1fc99773a Mon Sep 17 00:00:00 2001
From: ma331 <59875686+ma331@users.noreply.github.com>
Date: Fri, 30 Oct 2020 14:13:32 +0100
Subject: [PATCH 50/62] Speedup for _get_root function

---
 dnsapi/dns_anx.sh | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/dnsapi/dns_anx.sh b/dnsapi/dns_anx.sh
index 8c46e405..c1a1130a 100644
--- a/dnsapi/dns_anx.sh
+++ b/dnsapi/dns_anx.sh
@@ -122,15 +122,13 @@ _anx_rest() {
   return 0
 }
 
-#_acme-challenge.www.domain.com
-#returns
-# _sub_domain=_acme-challenge.www
-# _domain=domain.com
 _get_root() {
   domain=$1
   i=1
   p=1
 
+  _anx_rest GET "zone.json"
+
   while true; do
     h=$(printf "%s" "$domain" | cut -d . -f $i-100)
     _debug h "$h"
@@ -139,13 +137,6 @@ _get_root() {
       return 1
     fi
 
-    # Does a zone with that name exist?
-    _anx_rest GET "zone.json/$h"
-    # shellcheck disable=SC2154
-    if [ "$code" -ne 200 ]; then
-      continue
-    fi
-
     if _contains "$response" "\"name\":\"$h\""; then
       _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
       _domain=$h

From cc40110d7e339fe2d314776142266bda7d870ba5 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Fri, 30 Oct 2020 13:12:45 -0400
Subject: [PATCH 51/62] refactored sig timestamp generation

---
 dnsapi/dns_edgedns.sh | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 8ed6e5d2..7c47cc0b 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -41,6 +41,7 @@ dns_edgedns_add() {
     _err "Invalid domain"
     return 1
   fi
+
   _debug2 "Add: zone" "$zone"
   acmeRecordURI=$(printf "%s/%s/names/%s/types/TXT" "$edge_endpoint" "$zone" "$fulldomain")
   _debug3 "Add URL" "$acmeRecordURI"
@@ -354,19 +355,31 @@ _edgedns_rest() {
 }
 
 _edgedns_eg_timestamp() {
-  _eg_timestamp=$(date -u "+%Y%m%dT%H:%M:%S+0000")
-  _debug3 "_eg_timestamp" "$_eg_timestamp"
+  _debug "Generating signature Timestamp"
+  _debug3 "Retriving ntp time"
+  _timeheaders="$(_get "https://www.ntp.org" "onlyheader")"
+  _debug3 "_timeheaders" "$_timeheaders"
+  _ntpdate="$(echo "$_timeheaders" | grep -i "Date:" | _head_n 1 | cut -d ':' -f 2- | tr -d "\r\n")"
+  _debug3 "_ntpdate" "$_ntpdate"
+  _ntpdate="$(echo "${_ntpdate}" | sed -e 's/^[[:space:]]*//')"
+  _debug3 "_NTPDATE" "$_ntpdate"
+  _ntptime="$(echo "${_ntpdate}" | _head_n 1 | cut -d " " -f 5 | tr -d "\r\n")"
+  _debug3 "_ntptime" "$_ntptime"
+  _eg_timestamp=$(date -u "+%Y%m%dT")
+  _eg_timestamp="$(printf "%s%s+0000" "$_eg_timestamp" "$_ntptime")"
+  _debug "_eg_timestamp" "$_eg_timestamp"
 }
 
 _edgedns_new_nonce() {
+  _debug "Generating Nonce"
   _nonce=$(echo "EDGEDNS$(_time)" | _digest sha1 hex | cut -c 1-32)
   _debug3 "_nonce" "$_nonce"
 }
 
 _edgedns_make_auth_header() {
   _debug "Constructing Auth Header"
-  _edgedns_eg_timestamp
   _edgedns_new_nonce
+  _edgedns_eg_timestamp
   # "Unsigned authorization header: 'EG1-HMAC-SHA256 client_token=block;access_token=block;timestamp=20200806T14:16:33+0000;nonce=72cde72c-82d9-4721-9854-2ba057929d67;'"
   _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "$AKAMAI_CLIENT_TOKEN" "$AKAMAI_ACCESS_TOKEN" "$_eg_timestamp" "$_nonce")"
   _secure_debug2 "Unsigned Auth Header: " "$_auth_header"

From 9fcd1040650b80e2799e048e7089882f48a804a7 Mon Sep 17 00:00:00 2001
From: Sergey Pashinin <sergey@pashinin.com>
Date: Mon, 2 Nov 2020 13:35:12 +0300
Subject: [PATCH 52/62] Use _getdeployconf for env vars

---
 deploy/vault.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/deploy/vault.sh b/deploy/vault.sh
index c51ceb0f..e742b0fb 100644
--- a/deploy/vault.sh
+++ b/deploy/vault.sh
@@ -31,11 +31,13 @@ vault_deploy() {
   _debug _cfullchain "$_cfullchain"
 
   # validate required env vars
+  _getdeployconf VAULT_PREFIX
   if [ -z "$VAULT_PREFIX" ]; then
     _err "VAULT_PREFIX needs to be defined (contains prefix path in vault)"
     return 1
   fi
 
+  _getdeployconf VAULT_ADDR
   if [ -z "$VAULT_ADDR" ]; then
     _err "VAULT_ADDR needs to be defined (contains vault connection address)"
     return 1

From e203e9837577cf2b8f976baf19a29a1ed1ef2654 Mon Sep 17 00:00:00 2001
From: Sergey Pashinin <sergey@pashinin.com>
Date: Mon, 2 Nov 2020 16:46:09 +0300
Subject: [PATCH 53/62] Use _savedeployconf

---
 deploy/vault.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/deploy/vault.sh b/deploy/vault.sh
index e742b0fb..70c80444 100644
--- a/deploy/vault.sh
+++ b/deploy/vault.sh
@@ -36,12 +36,14 @@ vault_deploy() {
     _err "VAULT_PREFIX needs to be defined (contains prefix path in vault)"
     return 1
   fi
+  _savedeployconf VAULT_PREFIX "$VAULT_PREFIX"
 
   _getdeployconf VAULT_ADDR
   if [ -z "$VAULT_ADDR" ]; then
     _err "VAULT_ADDR needs to be defined (contains vault connection address)"
     return 1
   fi
+  _savedeployconf VAULT_ADDR "$VAULT_ADDR"
 
   # JSON does not allow multiline strings.
   # So replacing new-lines with "\n" here

From 075dc1e4e95f3668eeee94ad916a3e7142e7282e Mon Sep 17 00:00:00 2001
From: MaxPeal <30347730+MaxPeal@users.noreply.github.com>
Date: Thu, 5 Nov 2020 01:25:07 +0100
Subject: [PATCH 54/62] add linux/ppc64le and linux/s390x

---
 .github/workflows/dockerhub.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dockerhub.yml b/.github/workflows/dockerhub.yml
index 92308218..89915af7 100644
--- a/.github/workflows/dockerhub.yml
+++ b/.github/workflows/dockerhub.yml
@@ -63,4 +63,4 @@ jobs:
             --tag ${DOCKER_IMAGE}:${DOCKER_IMAGE_TAG} \
             --output "type=image,push=true" \
             --build-arg AUTO_UPGRADE=${AUTO_UPGRADE} \
-            --platform linux/arm64/v8,linux/amd64,linux/arm/v6,linux/arm/v7,linux/386 .
+            --platform linux/arm64/v8,linux/amd64,linux/arm/v6,linux/arm/v7,linux/386,linux/ppc64le,linux/s390x .

From 7530266330afcf09f2cebfc8b8775dec5dbe8f03 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Mon, 9 Nov 2020 20:14:22 +0800
Subject: [PATCH 55/62] remove dependency to md5 and awk

---
 deploy/fritzbox.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/fritzbox.sh b/deploy/fritzbox.sh
index 21ea6cfd..89b19806 100644
--- a/deploy/fritzbox.sh
+++ b/deploy/fritzbox.sh
@@ -64,9 +64,9 @@ fritzbox_deploy() {
   _info "Log in to the FRITZ!Box"
   _fritzbox_challenge="$(_get "${_fritzbox_url}/login_sid.lua" | sed -e 's/^.*<Challenge>//' -e 's/<\/Challenge>.*$//')"
   if _exists iconv; then
-    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | iconv -f ASCII -t UTF16LE | md5sum | awk '{print $1}')"
+    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | iconv -f ASCII -t UTF16LE | _digest md5 hex)"
   else
-    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | perl -p -e 'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";' | md5sum | awk '{print $1}')"
+    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | perl -p -e 'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";' | _digest md5 hex)"
   fi
   _fritzbox_sid="$(_get "${_fritzbox_url}/login_sid.lua?sid=0000000000000000&username=${_fritzbox_username}&response=${_fritzbox_challenge}-${_fritzbox_hash}" | sed -e 's/^.*<SID>//' -e 's/<\/SID>.*$//')"
 

From d866b3df1f1342794e428975e489a7a942ab6941 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Mon, 9 Nov 2020 10:16:57 -0500
Subject: [PATCH 56/62] convert key to hex before calling _hmac

---
 dnsapi/dns_edgedns.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 7c47cc0b..3b9e0032 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -443,7 +443,9 @@ _edgedns_base64_hmac_sha256() {
   _secure_debug2 "encoded data" "$encoded_data"
   _secure_debug2 "encoded key" "$encoded_key"
 
-  data_sig="$(echo "$encoded_data" | tr -d "\n\r" | ${ACME_OPENSSL_BIN:-openssl} dgst -sha256 -hmac "$encoded_key" -binary | _base64)"
+  encoded_key_hex=$(printf "%s" "$encoded_key" | _hex_dump | tr -d ' ')
+  data_sig="$(echo "$encoded_data" | tr -d "\n\r" | _hmac sha256 $encoded_key_hex | _base64)"
+
   _secure_debug2 "data_sig:" "$data_sig"
   _hmac_out="$(echo "$data_sig" | tr -d "\n\r" | iconv -f utf-8)"
   _secure_debug2 "hmac" "$_hmac_out"

From c490dd1563d9d069221a0bcf946722cb9a5038a0 Mon Sep 17 00:00:00 2001
From: Ed Lynes <elynes@akamai.com>
Date: Mon, 9 Nov 2020 10:36:12 -0500
Subject: [PATCH 57/62] add quotes to resolve shell check failure

---
 dnsapi/dns_edgedns.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_edgedns.sh b/dnsapi/dns_edgedns.sh
index 3b9e0032..2e5c7d30 100755
--- a/dnsapi/dns_edgedns.sh
+++ b/dnsapi/dns_edgedns.sh
@@ -444,7 +444,7 @@ _edgedns_base64_hmac_sha256() {
   _secure_debug2 "encoded key" "$encoded_key"
 
   encoded_key_hex=$(printf "%s" "$encoded_key" | _hex_dump | tr -d ' ')
-  data_sig="$(echo "$encoded_data" | tr -d "\n\r" | _hmac sha256 $encoded_key_hex | _base64)"
+  data_sig="$(echo "$encoded_data" | tr -d "\n\r" | _hmac sha256 "$encoded_key_hex" | _base64)"
 
   _secure_debug2 "data_sig:" "$data_sig"
   _hmac_out="$(echo "$data_sig" | tr -d "\n\r" | iconv -f utf-8)"

From 6ee38ceaba06e3ba9da63bb480f4b53cc4c76aa5 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Tue, 17 Nov 2020 22:50:40 +0800
Subject: [PATCH 58/62] fix
 https://github.com/acmesh-official/acme.sh/issues/3252

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 3be3849d..456383bd 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3993,7 +3993,7 @@ _check_dns_entries() {
 #file
 _get_cert_issuers() {
   _cfile="$1"
-  if _contains "$(${ACME_OPENSSL_BIN:-openssl} help crl2pkcs7 2>&1)" "Usage: crl2pkcs7"; then
+  if _contains "$(${ACME_OPENSSL_BIN:-openssl} help crl2pkcs7 2>&1)" "Usage: crl2pkcs7" || _contains "$(${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 help 2>&1)" "unknown option help"; then
     ${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 -nocrl -certfile $_cfile | ${ACME_OPENSSL_BIN:-openssl} pkcs7 -print_certs -text -noout | grep 'Issuer:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2
   else
     ${ACME_OPENSSL_BIN:-openssl} x509 -in $_cfile -text -noout | grep 'Issuer:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2

From c349e9aabe5a3affa35d8c18292427edb0067b9d Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Wed, 18 Nov 2020 21:19:10 +0800
Subject: [PATCH 59/62] fix set-env

---
 .github/workflows/LetsEncrypt.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index 5f0bba72..c4d3167c 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -88,7 +88,7 @@ jobs:
       shell: cmd
     - name: Set ENV
       run: |
-          echo '::set-env name=PATH::C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin'
+          echo "PATH=C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin" >> $GITHUB_ENV
     - name: Clone acmetest
       shell: cmd
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/

From 2b8561f27d2376f4e7b1a8f45783e62227cadf35 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Wed, 18 Nov 2020 22:23:36 +0800
Subject: [PATCH 60/62] fix set-env

---
 .github/workflows/DNS.yml         | 2 +-
 .github/workflows/LetsEncrypt.yml | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index b7153506..c41851b8 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -144,7 +144,7 @@ jobs:
       shell: cmd
     - name: Set ENV
       run: |
-          echo '::set-env name=PATH::C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin'
+          echo "PATH=C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin" >> $GITHUB_ENV
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - name: Run acmetest
diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index c4d3167c..b5468ff6 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -89,6 +89,9 @@ jobs:
     - name: Set ENV
       run: |
           echo "PATH=C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin" >> $GITHUB_ENV
+    - name: Check ENV
+      run: |
+          echo "PATH=$PATH"
     - name: Clone acmetest
       shell: cmd
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/

From 11b980f574c567361d720ea3421b68b668240b39 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Wed, 18 Nov 2020 23:16:36 +0800
Subject: [PATCH 61/62] fix set-env

---
 .github/workflows/DNS.yml         | 3 ++-
 .github/workflows/LetsEncrypt.yml | 6 ++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index c41851b8..748628dd 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -143,8 +143,9 @@ jobs:
           C:\tools\cygwin\cygwinsetup.exe -qgnNdO -R C:/tools/cygwin -s http://mirrors.kernel.org/sourceware/cygwin/ -P socat,curl,cron,unzip,git
       shell: cmd
     - name: Set ENV
+      shell: cmd
       run: |
-          echo "PATH=C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin" >> $GITHUB_ENV
+          echo PATH=C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin >> %GITHUB_ENV%
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - name: Run acmetest
diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index b5468ff6..16b7e779 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -87,11 +87,13 @@ jobs:
           C:\tools\cygwin\cygwinsetup.exe -qgnNdO -R C:/tools/cygwin -s http://mirrors.kernel.org/sourceware/cygwin/ -P socat,curl,cron,unzip,git
       shell: cmd
     - name: Set ENV
+      shell: cmd
       run: |
-          echo "PATH=C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin" >> $GITHUB_ENV
+          echo PATH=C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin >> %GITHUB_ENV%
     - name: Check ENV
+      shell: cmd
       run: |
-          echo "PATH=$PATH"
+          echo "PATH=%PATH%"
     - name: Clone acmetest
       shell: cmd
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/

From 199ca77c2a07dc6821df516f8cba7662c018ba4e Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Thu, 19 Nov 2020 20:14:28 +0800
Subject: [PATCH 62/62] fix for PebbleStrict mode test.

---
 acme.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index 456383bd..1e4b1152 100755
--- a/acme.sh
+++ b/acme.sh
@@ -5823,7 +5823,7 @@ _deactivate() {
     _URL_NAME="uri"
   fi
 
-  entries="$(echo "$response" | _egrep_o "[^{]*\"type\":\"[^\"]*\", *\"status\": *\"valid\", *\"$_URL_NAME\"[^}]*")"
+  entries="$(echo "$response" | tr '][' '=' | _egrep_o "challenges\": *=[^=]*=" | tr '}{' '\n' | grep "\"status\": *\"valid\"")"
   if [ -z "$entries" ]; then
     _info "No valid entries found."
     if [ -z "$thumbprint" ]; then
@@ -5866,7 +5866,7 @@ _deactivate() {
     _debug _vtype "$_vtype"
     _info "Found $_vtype"
 
-    uri="$(echo "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
+    uri="$(echo "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*\"" | tr -d '" ' | cut -d : -f 2-)"
     _debug uri "$uri"
 
     if [ "$_d_type" ] && [ "$_d_type" != "$_vtype" ]; then