deprecate more attributes in acme (#9369)

* deprecate more attributes in acme

* Deprecate .Authorization.combinations by renaming the field and
  deprecating in getters/setters

* Silence deprecation warnings from our own imports of acme.mixins

Co-authored-by: Brad Warren <bmw@users.noreply.github.com>

6 files changed, 67 insertions, 8 deletions

diff --git a/acme/acme/challenges.py b/acme/acme/challenges.py
index 91c3e6f24..534a60aad 100644
--- a/acme/acme/challenges.py
+++ b/acme/acme/challenges.py
@@ -14,6 +14,7 @@ from typing import Tuple
 from typing import Type
 from typing import TypeVar
 from typing import Union
+import warnings
 
 from cryptography.hazmat.primitives import hashes
 import josepy as jose
@@ -24,8 +25,11 @@ import requests
 from acme import crypto_util
 from acme import errors
 from acme import fields
-from acme.mixins import ResourceMixin
-from acme.mixins import TypeMixin
+
+with warnings.catch_warnings():
+    warnings.filterwarnings("ignore", category=DeprecationWarning)
+    from acme.mixins import ResourceMixin
+    from acme.mixins import TypeMixin
 
 logger = logging.getLogger(__name__)
 
diff --git a/acme/acme/client.py b/acme/acme/client.py
index dbb2a23f1..be4c2e457 100644
--- a/acme/acme/client.py
+++ b/acme/acme/client.py
@@ -45,7 +45,9 @@ from acme import crypto_util
 from acme import errors
 from acme import jws
 from acme import messages
-from acme.mixins import VersionedLEACMEMixin
+with warnings.catch_warnings():
+    warnings.filterwarnings("ignore", category=DeprecationWarning)
+    from acme.mixins import VersionedLEACMEMixin
 
 logger = logging.getLogger(__name__)
 
@@ -57,6 +59,9 @@ DER_CONTENT_TYPE = 'application/pkix-cert'
 class ClientBase:
     """ACME client base object.
 
+    .. deprecated:: 1.30.0
+       Use `ClientV2` instead.
+
     :ivar messages.Directory directory:
     :ivar .ClientNetwork net: Client network.
     :ivar int acme_version: ACME protocol version. 1 or 2.
@@ -1312,7 +1317,7 @@ class _ClientDeprecationModule:
         self.__dict__['_module'] = module
 
     def __getattr__(self, attr: str) -> Any:
-        if attr in ('Client', 'BackwardsCompatibleClientV2'):
+        if attr in ('Client', 'ClientBase', 'BackwardsCompatibleClientV2'):
             warnings.warn('The {0} attribute in acme.client is deprecated '
                           'and will be removed soon.'.format(attr),
                           DeprecationWarning, stacklevel=2)
diff --git a/acme/acme/messages.py b/acme/acme/messages.py
index 9b9ef5de2..fbb7738d0 100644
--- a/acme/acme/messages.py
+++ b/acme/acme/messages.py
@@ -14,6 +14,7 @@ from typing import Type
 from typing import TYPE_CHECKING
 from typing import TypeVar
 from typing import Union
+import warnings
 
 import josepy as jose
 
@@ -22,7 +23,9 @@ from acme import errors
 from acme import fields
 from acme import jws
 from acme import util
-from acme.mixins import ResourceMixin
+with warnings.catch_warnings():
+    warnings.filterwarnings("ignore", category=DeprecationWarning)
+    from acme.mixins import ResourceMixin
 
 if TYPE_CHECKING:
     from typing_extensions import Protocol  # pragma: no cover
@@ -573,14 +576,14 @@ class Authorization(ResourceBody):
     :ivar acme.messages.Identifier identifier:
     :ivar list challenges: `list` of `.ChallengeBody`
     :ivar tuple combinations: Challenge combinations (`tuple` of `tuple`
-        of `int`, as opposed to `list` of `list` from the spec).
+        of `int`, as opposed to `list` of `list` from the spec). (deprecated since 1.30.0)
     :ivar acme.messages.Status status:
     :ivar datetime.datetime expires:
 
     """
     identifier: Identifier = jose.field('identifier', decoder=Identifier.from_json, omitempty=True)
     challenges: List[ChallengeBody] = jose.field('challenges', omitempty=True)
-    combinations: Tuple[Tuple[int, ...], ...] = jose.field('combinations', omitempty=True)
+    _combinations: Tuple[Tuple[int, ...], ...] = jose.field('combinations', omitempty=True)
 
     status: Status = jose.field('status', omitempty=True, decoder=Status.from_json)
     # TODO: 'expires' is allowed for Authorization Resources in
@@ -590,6 +593,13 @@ class Authorization(ResourceBody):
     expires: datetime.datetime = fields.rfc3339('expires', omitempty=True)
     wildcard: bool = jose.field('wildcard', omitempty=True)
 
+    # combinations is temporarily renamed to _combinations during its deprecation
+    # period. See https://github.com/certbot/certbot/pull/9369#issuecomment-1199849262.
+    def __init__(self, **kwargs: Any) -> None:
+        if 'combinations' in kwargs:
+            kwargs['_combinations'] = kwargs.pop('combinations')
+        super().__init__(**kwargs)
+
     # Mypy does not understand the josepy magic happening here, and falsely claims
     # that challenge is redefined. Let's ignore the type check here.
     @challenges.decoder  # type: ignore
@@ -597,8 +607,35 @@ class Authorization(ResourceBody):
         return tuple(ChallengeBody.from_json(chall) for chall in value)
 
     @property
+    def combinations(self) -> Tuple[Tuple[int, ...], ...]:
+        """Challenge combinations.
+        (`tuple` of `tuple` of `int`, as opposed to `list` of `list` from the spec).
+
+        .. deprecated: 1.30.0
+
+        """
+        warnings.warn(
+            "acme.messages.Authorization.combinations is deprecated and will be "
+            "removed in a future release.", DeprecationWarning)
+        return self._combinations
+
+    @combinations.setter
+    def combinations(self, combos: Tuple[Tuple[int, ...], ...]) -> None: # pragma: no cover
+        warnings.warn(
+            "acme.messages.Authorization.combinations is deprecated and will be "
+            "removed in a future release.", DeprecationWarning)
+        self._combinations = combos
+
+    @property
     def resolved_combinations(self) -> Tuple[Tuple[ChallengeBody, ...], ...]:
-        """Combinations with challenges instead of indices."""
+        """Combinations with challenges instead of indices.
+
+        .. deprecated: 1.30.0
+
+        """
+        warnings.warn(
+            "acme.messages.Authorization.resolved_combinations is deprecated and will be "
+            "removed in a future release.", DeprecationWarning)
         return tuple(tuple(self.challenges[idx] for idx in combo)
                      for combo in self.combinations)  # pylint: disable=not-an-iterable
 
diff --git a/acme/acme/mixins.py b/acme/acme/mixins.py
index e6e678d60..4c52957a5 100644
--- a/acme/acme/mixins.py
+++ b/acme/acme/mixins.py
@@ -1,6 +1,10 @@
 """Useful mixins for Challenge and Resource objects"""
 from typing import Any
 from typing import Dict
+import warnings
+
+warnings.warn(f'The module {__name__} is deprecated and will be removed in a future release',
+              DeprecationWarning, stacklevel=2)
 
 
 class VersionedLEACMEMixin:
diff --git a/certbot/CHANGELOG.md b/certbot/CHANGELOG.md
index 90df55e53..04b25e98d 100644
--- a/certbot/CHANGELOG.md
+++ b/certbot/CHANGELOG.md
@@ -10,6 +10,9 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
+* `acme.client.ClientBase`, `acme.messages.Authorization.resolved_combinations`,
+  `acme.messages.Authorization.combinations` and `acme.mixins` are deprecated and
+  will be removed in a future release.
 * The `certbot-dns-cloudxns` plugin is now deprecated and will be removed in the
   next major release of Certbot.
 * The `source_address` argument for `acme.client.ClientNetwork` is deprecated
diff --git a/pytest.ini b/pytest.ini
index 9e8fb5c7b..78710566b 100644
--- a/pytest.ini
+++ b/pytest.ini
@@ -24,6 +24,9 @@
 #    certbot-dns-rfc2136.
 # 6) botocore is currently using deprecated urllib3 functionality. See
 #    https://github.com/boto/botocore/issues/2744.
+# 7) ACMEv1 deprecations in acme.client which will be resolved by Certbot 2.0.
+# 8) acme.mixins deprecation in acme.client which will be resolved by Certbot 2.0.
+# 9) acme.messages.Authorization.combinations which will be resolved by Certbot 2.0.
 filterwarnings =
     error
     ignore:The external mock module:PendingDeprecationWarning
@@ -32,3 +35,6 @@ filterwarnings =
     ignore:.*attribute in certbot.display.util module is deprecated:DeprecationWarning
     ignore:decodestring\(\) is a deprecated alias:DeprecationWarning:dns
     ignore:'urllib3.contrib.pyopenssl:DeprecationWarning:botocore
+    ignore:.*attribute in acme.client is deprecated:DeprecationWarning
+    ignore:.*acme.mixins is deprecated:DeprecationWarning
+    ignore:.*Authorization.combinations is deprecated:DeprecationWarning