Make externally snapped plugin updates more stable (#8145)

Fixes #7863.

Connect command is `sudo snap connect certbot-dns-dnsimple:certbot-metadata certbot:certbot-metadata`
Logs are `cat /var/snap/certbot-dns-dnsimple/current/debuglog`
Echos in hook are only printed to terminal when it exits 0; otherwise, check logs in `debuglog` mentioned above.

Manual tests include all iterations of connected, unconnected, installed for the first, second time, etc, with passing and failing version checks.

* Make dnsimple not update if certbot is too old

* create an interface to read cb version

* add missing newline

* fix syntax

* trying to figure out the consumer syntax

* trying to figure out the consumer syntax, again

* only check post first install

* valid setting name

* test for first install differently

* snapctl doesn't error if it fails I guess

* time to do some print debugging

* continue playing with syntax

* once again, fooled by bash int vs string comparisons!

* debugging

* if we use post and pre together we can do this

* is this how content interface syntax works

* it's a directory?

* more debug

* what's that error message again?

* try other syntax

* if it's not documented just guess at syntax

* actually, I think this is the syntax

* oops didn't set for new hook

* test passing information along connection

* interface attributes can only be set during the execution of prepare hooks

* just do it with main connection

* undo last few test changes

* Add some printing to make sure we understand what's going on

* create empty directory to bind to

* put mkdir in the correct part

* let's inspect the environment

* it can't run bash directly.

* perhaps only directories can be shared via the contente interface

* update name of folder

* echo to debug log to understand what's going on exactly. we have file access though!

* update grep for new file

* more printing

* echo to the debug log

* ok NOW all print statements are going to the log

* why does echo need two >s

* remove unnecessary extra check, just check if the init file is available

* check if certbot version will be available post-refresh after all

* pre-refresh hook is not necessary to get certbot version

* update mkdir so we don't have to clean each time

* try comparing version numbers in python

* it's python3

* we need different prints for if we succeed or if we fail.

* improve bash syntax

* remove some debugging code

* Remove debug script

* remove spaces for clarity

* consolidate parts and remove more test code

* s/certbot-version/certbot-metadata/g

* use sys.exit instead of exit

* find and save certbot version on the certbot side

* change presence test to new file

* switch to using packaging.version.parse instead of LooseVersion

* switch to requiring certbot version >= plugin version

* add plugin snap changes to generate script

* Add comment to generation file saying not to edit generated files manually

* Create post-refresh hook for all plugins with script

* generate files using new script

* update snapcraft.yaml files for plugins

* bin/sh comes first

* Add packaging to install_requires

* Check that refresh is allowed in integration test

* switch plug and slot names in integration test

* Update tools/generate_dnsplugins_postrefreshhook.sh

Co-authored-by: Brad Warren <bmw@users.noreply.github.com>

* small bash fixes

* Update snap readme with new instructions

* Run tools/generate_dnsplugins_postrefreshhook.sh

* Update tools/snap/generate_dnsplugins_postrefreshhook.sh

Co-authored-by: Brad Warren <bmw@users.noreply.github.com>

Co-authored-by: Brad Warren <bmw@users.noreply.github.com>

47 files changed, 629 insertions, 45 deletions

diff --git a/certbot-ci/snap_integration_tests/dns_tests/test_main.py b/certbot-ci/snap_integration_tests/dns_tests/test_main.py
index 8f19034b1..016355334 100644
--- a/certbot-ci/snap_integration_tests/dns_tests/test_main.py
+++ b/certbot-ci/snap_integration_tests/dns_tests/test_main.py
@@ -39,5 +39,8 @@ def test_dns_plugin_install(dns_snap_path):
 
         assert plugin_name in subprocess.check_output(['certbot', 'plugins', '--prepare'],
                                                       universal_newlines=True)
+        subprocess.check_call(['snap', 'connect', snap_name + ':certbot-metadata',
+            'certbot:certbot-metadata'])
+        subprocess.check_call(['snap', 'install', '--dangerous', dns_snap_path])
     finally:
         subprocess.call(['snap', 'remove', 'plugin_name'])
diff --git a/certbot-dns-cloudflare/setup.py b/certbot-dns-cloudflare/setup.py
index 60add8ae5..2791f423d 100644
--- a/certbot-dns-cloudflare/setup.py
+++ b/certbot-dns-cloudflare/setup.py
@@ -17,14 +17,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.29.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-cloudflare/snap/hooks/post-refresh b/certbot-dns-cloudflare/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-cloudflare/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-cloudflare/snap/snapcraft.yaml b/certbot-dns-cloudflare/snap/snapcraft.yaml
index 2466220e6..2e520dcfa 100644
--- a/certbot-dns-cloudflare/snap/snapcraft.yaml
+++ b/certbot-dns-cloudflare/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-cloudflare
 summary: Cloudflare DNS Authenticator plugin for Certbot
 description: Cloudflare DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-cloudxns/setup.py b/certbot-dns-cloudxns/setup.py
index 0e70800ce..7a5c7ff3d 100644
--- a/certbot-dns-cloudxns/setup.py
+++ b/certbot-dns-cloudxns/setup.py
@@ -17,14 +17,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.31.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-cloudxns/snap/hooks/post-refresh b/certbot-dns-cloudxns/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-cloudxns/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-cloudxns/snap/snapcraft.yaml b/certbot-dns-cloudxns/snap/snapcraft.yaml
index 22b4371c3..29a63cfa7 100644
--- a/certbot-dns-cloudxns/snap/snapcraft.yaml
+++ b/certbot-dns-cloudxns/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-cloudxns
 summary: CloudXNS DNS Authenticator plugin for Certbot
 description: CloudXNS DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-digitalocean/setup.py b/certbot-dns-digitalocean/setup.py
index 4fe54b0f8..267999217 100644
--- a/certbot-dns-digitalocean/setup.py
+++ b/certbot-dns-digitalocean/setup.py
@@ -18,14 +18,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.29.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-digitalocean/snap/hooks/post-refresh b/certbot-dns-digitalocean/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-digitalocean/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-digitalocean/snap/snapcraft.yaml b/certbot-dns-digitalocean/snap/snapcraft.yaml
index 312b715f6..17027ce16 100644
--- a/certbot-dns-digitalocean/snap/snapcraft.yaml
+++ b/certbot-dns-digitalocean/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-digitalocean
 summary: DigitalOcean DNS Authenticator plugin for Certbot
 description: DigitalOcean DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-dnsimple/setup.py b/certbot-dns-dnsimple/setup.py
index f23c42521..acb951e83 100644
--- a/certbot-dns-dnsimple/setup.py
+++ b/certbot-dns-dnsimple/setup.py
@@ -16,14 +16,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.31.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-dnsimple/snap/hooks/post-refresh b/certbot-dns-dnsimple/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-dnsimple/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-dnsimple/snap/snapcraft.yaml b/certbot-dns-dnsimple/snap/snapcraft.yaml
index 1f2ee12e9..df0c4f608 100644
--- a/certbot-dns-dnsimple/snap/snapcraft.yaml
+++ b/certbot-dns-dnsimple/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-dnsimple
 summary: DNSimple DNS Authenticator plugin for Certbot
 description: DNSimple DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-dnsmadeeasy/setup.py b/certbot-dns-dnsmadeeasy/setup.py
index a0ba4ac28..7940e9fc6 100644
--- a/certbot-dns-dnsmadeeasy/setup.py
+++ b/certbot-dns-dnsmadeeasy/setup.py
@@ -17,14 +17,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.31.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-dnsmadeeasy/snap/hooks/post-refresh b/certbot-dns-dnsmadeeasy/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-dnsmadeeasy/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-dnsmadeeasy/snap/snapcraft.yaml b/certbot-dns-dnsmadeeasy/snap/snapcraft.yaml
index b51f021e1..b7a20ce30 100644
--- a/certbot-dns-dnsmadeeasy/snap/snapcraft.yaml
+++ b/certbot-dns-dnsmadeeasy/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-dnsmadeeasy
 summary: DNS Made Easy DNS Authenticator plugin for Certbot
 description: DNS Made Easy DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-gehirn/setup.py b/certbot-dns-gehirn/setup.py
index a021bffce..d93acbe60 100644
--- a/certbot-dns-gehirn/setup.py
+++ b/certbot-dns-gehirn/setup.py
@@ -16,14 +16,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.31.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-gehirn/snap/hooks/post-refresh b/certbot-dns-gehirn/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-gehirn/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-gehirn/snap/snapcraft.yaml b/certbot-dns-gehirn/snap/snapcraft.yaml
index 2ad47cb3f..de913e894 100644
--- a/certbot-dns-gehirn/snap/snapcraft.yaml
+++ b/certbot-dns-gehirn/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-gehirn
 summary: Gehirn Infrastructure Service DNS Authenticator plugin for Certbot
 description: Gehirn Infrastructure Service DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-google/setup.py b/certbot-dns-google/setup.py
index 0c559585b..d9e508494 100644
--- a/certbot-dns-google/setup.py
+++ b/certbot-dns-google/setup.py
@@ -20,14 +20,16 @@ install_requires = [
     'httplib2'
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.29.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-google/snap/hooks/post-refresh b/certbot-dns-google/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-google/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-google/snap/snapcraft.yaml b/certbot-dns-google/snap/snapcraft.yaml
index d3f2cfaa9..7222ea83c 100644
--- a/certbot-dns-google/snap/snapcraft.yaml
+++ b/certbot-dns-google/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-google
 summary: Google Cloud DNS Authenticator plugin for Certbot
 description: Google Cloud DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-linode/setup.py b/certbot-dns-linode/setup.py
index 8e765bd8f..1a1e3f973 100644
--- a/certbot-dns-linode/setup.py
+++ b/certbot-dns-linode/setup.py
@@ -16,14 +16,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.31.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-linode/snap/hooks/post-refresh b/certbot-dns-linode/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-linode/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-linode/snap/snapcraft.yaml b/certbot-dns-linode/snap/snapcraft.yaml
index 5db7bf6e0..67090b5a2 100644
--- a/certbot-dns-linode/snap/snapcraft.yaml
+++ b/certbot-dns-linode/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-linode
 summary: Linode DNS Authenticator plugin for Certbot
 description: Linode DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-luadns/setup.py b/certbot-dns-luadns/setup.py
index 57c5011eb..0ff9fb249 100644
--- a/certbot-dns-luadns/setup.py
+++ b/certbot-dns-luadns/setup.py
@@ -17,14 +17,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.31.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-luadns/snap/hooks/post-refresh b/certbot-dns-luadns/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-luadns/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-luadns/snap/snapcraft.yaml b/certbot-dns-luadns/snap/snapcraft.yaml
index 8194a9a12..14806d44a 100644
--- a/certbot-dns-luadns/snap/snapcraft.yaml
+++ b/certbot-dns-luadns/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-luadns
 summary: LuaDNS Authenticator plugin for Certbot
 description: LuaDNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-nsone/setup.py b/certbot-dns-nsone/setup.py
index b8d33bb60..2b37a4c18 100644
--- a/certbot-dns-nsone/setup.py
+++ b/certbot-dns-nsone/setup.py
@@ -17,14 +17,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.31.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-nsone/snap/hooks/post-refresh b/certbot-dns-nsone/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-nsone/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-nsone/snap/snapcraft.yaml b/certbot-dns-nsone/snap/snapcraft.yaml
index 6780f8f37..b2d46ea36 100644
--- a/certbot-dns-nsone/snap/snapcraft.yaml
+++ b/certbot-dns-nsone/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-nsone
 summary: NS1 DNS Authenticator plugin for Certbot
 description: NS1 DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-ovh/setup.py b/certbot-dns-ovh/setup.py
index e8b2ffd1e..a8baea0f1 100644
--- a/certbot-dns-ovh/setup.py
+++ b/certbot-dns-ovh/setup.py
@@ -17,14 +17,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.31.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-ovh/snap/hooks/post-refresh b/certbot-dns-ovh/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-ovh/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-ovh/snap/snapcraft.yaml b/certbot-dns-ovh/snap/snapcraft.yaml
index b5de691c8..f9e057dc4 100644
--- a/certbot-dns-ovh/snap/snapcraft.yaml
+++ b/certbot-dns-ovh/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-ovh
 summary: OVH DNS Authenticator plugin for Certbot
 description: OVH DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-rfc2136/setup.py b/certbot-dns-rfc2136/setup.py
index 83939f796..09cce6a21 100644
--- a/certbot-dns-rfc2136/setup.py
+++ b/certbot-dns-rfc2136/setup.py
@@ -17,14 +17,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.29.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-rfc2136/snap/hooks/post-refresh b/certbot-dns-rfc2136/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-rfc2136/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-rfc2136/snap/snapcraft.yaml b/certbot-dns-rfc2136/snap/snapcraft.yaml
index 62825ab97..b247e031b 100644
--- a/certbot-dns-rfc2136/snap/snapcraft.yaml
+++ b/certbot-dns-rfc2136/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-rfc2136
 summary: RFC 2136 DNS Authenticator plugin for Certbot
 description: RFC 2136 DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-route53/setup.py b/certbot-dns-route53/setup.py
index 893f40340..5d2b0494d 100644
--- a/certbot-dns-route53/setup.py
+++ b/certbot-dns-route53/setup.py
@@ -17,14 +17,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.29.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-route53/snap/hooks/post-refresh b/certbot-dns-route53/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-route53/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-route53/snap/snapcraft.yaml b/certbot-dns-route53/snap/snapcraft.yaml
index 5056d7eda..a6cc6487a 100644
--- a/certbot-dns-route53/snap/snapcraft.yaml
+++ b/certbot-dns-route53/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-route53
 summary: Route53 DNS Authenticator plugin for Certbot
 description: Route53 DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/certbot-dns-sakuracloud/setup.py b/certbot-dns-sakuracloud/setup.py
index cb6785ecd..812be34ba 100644
--- a/certbot-dns-sakuracloud/setup.py
+++ b/certbot-dns-sakuracloud/setup.py
@@ -16,14 +16,16 @@ install_requires = [
     'zope.interface',
 ]
 
-if not os.environ.get('EXCLUDE_CERTBOT_DEPS'):
+if not os.environ.get('SNAP_BUILD'):
     install_requires.extend([
         'acme>=0.31.0',
         'certbot>=1.1.0',
     ])
 elif 'bdist_wheel' in sys.argv[1:]:
-    raise RuntimeError('Unset EXCLUDE_CERTBOT_DEPS when building wheels '
+    raise RuntimeError('Unset SNAP_BUILD when building wheels '
                        'to include certbot dependencies.')
+if os.environ.get('SNAP_BUILD'):
+    install_requires.append('packaging')
 
 setuptools_known_environment_markers = (LooseVersion(setuptools_version) >= LooseVersion('36.2'))
 if setuptools_known_environment_markers:
diff --git a/certbot-dns-sakuracloud/snap/hooks/post-refresh b/certbot-dns-sakuracloud/snap/hooks/post-refresh
new file mode 100644
index 000000000..bcb0dbbb4
--- /dev/null
+++ b/certbot-dns-sakuracloud/snap/hooks/post-refresh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=$(cat $SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=$(grep -oP "version = '\K.*(?=')" $SNAP/setup.py)
+
+
+$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if  version.parse('$cb_installed') < version.parse('$cb_required') else sys.exit(0)" || exit_code=$?
+if [ "$exit_code" -eq 1 ]; then
+  echo "Certbot is version $cb_installed but needs to be at least $cb_required before" \
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
diff --git a/certbot-dns-sakuracloud/snap/snapcraft.yaml b/certbot-dns-sakuracloud/snap/snapcraft.yaml
index e068de2db..6d87ef401 100644
--- a/certbot-dns-sakuracloud/snap/snapcraft.yaml
+++ b/certbot-dns-sakuracloud/snap/snapcraft.yaml
@@ -1,3 +1,4 @@
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: certbot-dns-sakuracloud
 summary: Sakura Cloud DNS Authenticator plugin for Certbot
 description: Sakura Cloud DNS Authenticator plugin for Certbot
@@ -15,9 +16,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version `grep ^version $SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p $SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -25,3 +33,9 @@ slots:
     content: certbot-1
     read:
       - $SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: $SNAP/certbot-shared
diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml
index 47224f59f..c2dab9180 100644
--- a/snap/snapcraft.yaml
+++ b/snap/snapcraft.yaml
@@ -82,14 +82,27 @@ parts:
         cd $SNAPCRAFT_PART_SRC
         python3 tools/strip_hashes.py letsencrypt-auto-source/pieces/dependency-requirements.txt | grep -v python-augeas > snap-constraints.txt
         snapcraftctl set-version `git describe|sed s/^v//`
-
   wrappers:
     plugin: dump
     source: .
     stage: [certbot.wrapper]
+  shared-metadata:
+    plugin: dump
+    source: .
+    override-pull: |
+      snapcraftctl pull
+      mkdir -p certbot-metadata
+      grep -oP "__version__ = '\K.*(?=')" $SNAPCRAFT_PART_SRC/certbot/certbot/__init__.py > certbot-metadata/certbot-version.txt
+    stage: [certbot-metadata/certbot-version.txt]
 
 plugs:
   plugin:
     interface: content
     content: certbot-1
     target: $SNAP/certbot-plugin
+
+slots:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    read: [$SNAP/certbot-metadata]
diff --git a/tools/snap/README.md b/tools/snap/README.md
index a631decb8..ef3bc1225 100644
--- a/tools/snap/README.md
+++ b/tools/snap/README.md
@@ -81,7 +81,8 @@ These are the steps to build and install the snaps. If you have run these steps
  6. Run `sudo snap set certbot trust-plugin-with-root=ok`.
  7. Install the generated snap with `sudo snap install --dangerous certbot-dns-dnsimple_*_amd64.snap`. Again, you can transfer the snap to a different machine to run it there instead if you prefer.
  8. Connect the plugin with `sudo snap connect certbot:plugin certbot-dns-dnsimple`.
- 9. Now you can run Certbot as normal. For example, `certbot plugins` should display the DNSimple plugin as installed.
+ 9. Connect the plugin metadata with `sudo snap connect certbot-dns-dnsimple:certbot-metadata certbot:certbot-metadata`. Install the plugin again to test refresh; logs are at `/var/snap/certbot-dns-dnsimple/current/debuglog`.
+ 10. Now you can run Certbot as normal. For example, `certbot plugins` should display the DNSimple plugin as installed.
 
 ### Reset the Environment
 
diff --git a/tools/snap/generate_dnsplugins_postrefreshhook.sh b/tools/snap/generate_dnsplugins_postrefreshhook.sh
new file mode 100755
index 000000000..1b77e7866
--- /dev/null
+++ b/tools/snap/generate_dnsplugins_postrefreshhook.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+# Generate the hooks/post-refresh file for all DNS plugins
+set -eu
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+CERTBOT_DIR="$(dirname "$(dirname "${DIR}")")"
+
+for PLUGIN_PATH in "${CERTBOT_DIR}"/certbot-dns-*; do
+  PLUGIN=$(basename "${PLUGIN_PATH}")
+  mkdir -p "${PLUGIN_PATH}/snap/hooks"
+  cat <<EOF > "${PLUGIN_PATH}/snap/hooks/post-refresh"
+#!/bin/sh -e
+# This file is generated by tools/generate_dnsplugins_postrefreshhook.sh and should not be edited manually.
+
+# get certbot version
+if [ ! -f "\$SNAP/certbot-shared/certbot-version.txt" ]; then
+  echo "No certbot version available; not doing version comparison check" >> "\$SNAP_DATA/debuglog"
+  exit 0
+fi
+cb_installed=\$(cat \$SNAP/certbot-shared/certbot-version.txt)
+
+# get required certbot version for plugin. certbot version must be at least the plugin's
+# version. note that this is not the required version in setup.py, but the version number itself.
+cb_required=\$(grep -oP "version = '\K.*(?=')" \$SNAP/setup.py)
+
+
+\$SNAP/bin/python3 -c "import sys; from packaging import version; sys.exit(1) if\
+  version.parse('\$cb_installed') < version.parse('\$cb_required') else sys.exit(0)" || exit_code=\$?
+if [ "\$exit_code" -eq 1 ]; then
+  echo "Certbot is version \$cb_installed but needs to be at least \$cb_required before" \\
+    "this plugin can be updated; will try again on next refresh."
+  exit 1
+fi
+EOF
+done
diff --git a/tools/snap/generate_dnsplugins_snapcraft.sh b/tools/snap/generate_dnsplugins_snapcraft.sh
index 813827d36..4e589f846 100755
--- a/tools/snap/generate_dnsplugins_snapcraft.sh
+++ b/tools/snap/generate_dnsplugins_snapcraft.sh
@@ -10,6 +10,7 @@ for PLUGIN_PATH in "${CERTBOT_DIR}"/certbot-dns-*; do
   DESCRIPTION=$(grep description "${PLUGIN_PATH}/setup.py" | sed -E 's|\s+description="(.*)",|\1|g')
   mkdir -p "${PLUGIN_PATH}/snap"
   cat <<EOF > "${PLUGIN_PATH}/snap/snapcraft.yaml"
+# This file is generated by tools/generate_dnsplugins_snapcraft.sh and should not be edited manually.
 name: ${PLUGIN}
 summary: ${DESCRIPTION}
 description: ${DESCRIPTION}
@@ -27,9 +28,16 @@ parts:
         snapcraftctl pull
         snapcraftctl set-version \`grep ^version \$SNAPCRAFT_PART_SRC/setup.py | cut -f2 -d= | tr -d "'[:space:]"\`
     build-environment:
-      - EXCLUDE_CERTBOT_DEPS: "True"
+      - SNAP_BUILD: "True"
     # To build cryptography and cffi if needed
     build-packages: [gcc, libffi-dev, libssl-dev, python3-dev]
+  certbot-metadata:
+    plugin: dump
+    source: .
+    stage: [setup.py, certbot-shared]
+    override-pull: |
+        snapcraftctl pull
+        mkdir -p \$SNAPCRAFT_PART_SRC/certbot-shared
 
 slots:
   certbot:
@@ -37,5 +45,11 @@ slots:
     content: certbot-1
     read:
       - \$SNAP/lib/python3.8/site-packages
+
+plugs:
+  certbot-metadata:
+    interface: content
+    content: metadata-1
+    target: \$SNAP/certbot-shared
 EOF
 done