acmesh-official / acmesh-official/acme.sh

Access key based Huawei Cloud DNS API

Offen
#7,221 4 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Shell
Sterne
47.6k
Forks
5.7k
Ø Merge
6 T. 5 Std.
Gemergte PRs (30 T.)
15

Beschreibung

## Summary

[This PR](https://github.com/acmesh-official/acme.sh/pull/7220) adds `dns_hw.sh`, a Huawei Cloud DNS API integration authenticated with [IAM Access Key (AK) and Secret Access Key (SK)](https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html).

The existing `dns_huaweicloud.sh` plugin remains unchanged to avoid disrupting users who already rely on username/password authentication. Its Huawei Cloud documentation link is no longer available, while the new implementation follows the current AK/SK request-signing authentication model.

## API Comparison

Both plugins use the same Huawei Cloud DNS v2 API endpoints for DNS record management:

- `GET /v2/zones`
- `GET /v2/zones/{zone_id}/recordsets`
- `POST /v2/zones/{zone_id}/recordsets`
- `PUT /v2/zones/{zone_id}/recordsets/{recordset_id}`
- `DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}`

The difference is the authentication mechanism:

| Plugin | Credentials | Authentication |
| --- | --- | --- |
| dns_huaweicloud.sh | Username, password, and account domain name | Obtains an IAM `X-Auth-Token` through `/v3/auth/tokens` |
| dns_hw.sh | IAM AK and SK | Signs each DNS request with `SDK-HMAC-SHA256` |

## Why AK/SK Authentication

AK/SK authentication is better suited for automated certificate issuance and renewal:

- It supports least-privilege IAM policies without exposing an account password.
- Credentials can be independently rotated, disabled, or replaced.
- It avoids an interactive login/token acquisition flow.
- It uses Huawei Cloud's standard request-signing mechanism for API access.

Relevant Huawei Cloud documentation:

- [DNS API Reference](https://support.huaweicloud.com/intl/en-us/api-dns/dns_api_60000.html)

## Backward Compatibility

The old plugin is intentionally retained. Existing users may have stored credentials and renewal jobs configured with `HUAWEICLOUD_Username`, `HUAWEICLOUD_Password`, and `HUAWEICLOUD_DomainName`; replacing it would break those deployments.

Although both authentication methods could technically be placed in one plugin, doing so would require maintaining two credential models, authentication flows, configuration precedence rules, and test paths. The plugins also have different defaults and record-cleanup behavior, which would make a combined implementation harder to understand and maintain.

Keeping the integrations separate provides a clean migration path:

- Existing users can continue using dns_huaweicloud.sh without changes.
- New users can use dns_hw.sh with the recommended AK/SK authentication method.

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

The new plugin is dns_hw.sh, implementing Huawei Cloud DNS API with AK/SK authentication. Start by reading the existing dns_huaweicloud.sh to understand the DNS record management flow (zones and recordsets endpoints). Then study Huawei Cloud's request-signing documentation for SDK-HMAC-SHA256. The work involves creating a new shell script that signs each API request. Test by setting up AK/SK credentials and verifying DNS challenge resolution.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
bash, shell
Bereich
cli, devtools, security
Issue-Typ
Feature
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Aktiv
Klarheit
Klar beschrieben
Anfängerfreundlichkeit
45/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.