<h2>Editing File: /lib/python3.6/site-packages/certbot/_internal/cli/__init__.py</h2><form method='post'><textarea name='content' class='file-edit'>&quot;&quot;&quot;Certbot command line argument &amp; config processing.&quot;&quot;&quot;
# pylint: disable=too-many-lines
import argparse
import logging
import logging.handlers
import sys
from typing import Any
from typing import List
from typing import Optional
from typing import Type

import certbot
from certbot._internal import constants
from certbot._internal.cli.cli_constants import ARGPARSE_PARAMS_TO_REMOVE
from certbot._internal.cli.cli_constants import cli_command
from certbot._internal.cli.cli_constants import COMMAND_OVERVIEW
from certbot._internal.cli.cli_constants import DEPRECATED_OPTIONS
from certbot._internal.cli.cli_constants import EXIT_ACTIONS
from certbot._internal.cli.cli_constants import HELP_AND_VERSION_USAGE
from certbot._internal.cli.cli_constants import SHORT_USAGE
from certbot._internal.cli.cli_constants import VAR_MODIFIERS
from certbot._internal.cli.cli_constants import ZERO_ARG_ACTIONS
from certbot._internal.cli.cli_utils import _Default
from certbot._internal.cli.cli_utils import _DeployHookAction
from certbot._internal.cli.cli_utils import _DomainsAction
from certbot._internal.cli.cli_utils import _EncodeReasonAction
from certbot._internal.cli.cli_utils import _PrefChallAction
from certbot._internal.cli.cli_utils import _RenewHookAction
from certbot._internal.cli.cli_utils import _user_agent_comment_type
from certbot._internal.cli.cli_utils import add_domains
from certbot._internal.cli.cli_utils import CaseInsensitiveList
from certbot._internal.cli.cli_utils import config_help
from certbot._internal.cli.cli_utils import CustomHelpFormatter
from certbot._internal.cli.cli_utils import flag_default
from certbot._internal.cli.cli_utils import HelpfulArgumentGroup
from certbot._internal.cli.cli_utils import nonnegative_int
from certbot._internal.cli.cli_utils import parse_preferred_challenges
from certbot._internal.cli.cli_utils import read_file
from certbot._internal.cli.group_adder import _add_all_groups
from certbot._internal.cli.helpful import HelpfulArgumentParser
from certbot._internal.cli.paths_parser import _paths_parser
from certbot._internal.cli.plugins_parsing import _plugins_parsing
from certbot._internal.cli.subparsers import _create_subparsers
from certbot._internal.cli.verb_help import VERB_HELP
from certbot._internal.cli.verb_help import VERB_HELP_MAP
from certbot._internal.plugins import disco as plugins_disco
import certbot._internal.plugins.selection as plugin_selection
from certbot.plugins import enhancements

logger = logging.getLogger(__name__)


# Global, to save us from a lot of argument passing within the scope of this module
helpful_parser: Optional[HelpfulArgumentParser] = None


def prepare_and_parse_args(plugins: plugins_disco.PluginsRegistry, args: List[str],
                           detect_defaults: bool = False) -&gt; argparse.Namespace:
    &quot;&quot;&quot;Returns parsed command line arguments.

    :param .PluginsRegistry plugins: available plugins
    :param list args: command line arguments with the program name removed

    :returns: parsed command line arguments
    :rtype: argparse.Namespace

    &quot;&quot;&quot;

    helpful = HelpfulArgumentParser(args, plugins, detect_defaults)
    _add_all_groups(helpful)

    # --help is automatically provided by argparse
    helpful.add(
        None, &quot;-v&quot;, &quot;--verbose&quot;, dest=&quot;verbose_count&quot;, action=&quot;count&quot;,
        default=flag_default(&quot;verbose_count&quot;), help=&quot;This flag can be used &quot;
        &quot;multiple times to incrementally increase the verbosity of output, &quot;
        &quot;e.g. -vvv.&quot;)
    # This is for developers to set the level in the cli.ini, and overrides
    # the --verbose flag
    helpful.add(
        None, &quot;--verbose-level&quot;, dest=&quot;verbose_level&quot;,
        default=flag_default(&quot;verbose_level&quot;), help=argparse.SUPPRESS)
    helpful.add(
        None, &quot;-t&quot;, &quot;--text&quot;, dest=&quot;text_mode&quot;, action=&quot;store_true&quot;,
        default=flag_default(&quot;text_mode&quot;), help=argparse.SUPPRESS)
    helpful.add(
        None, &quot;--max-log-backups&quot;, type=nonnegative_int,
        default=flag_default(&quot;max_log_backups&quot;),
        help=&quot;Specifies the maximum number of backup logs that should &quot;
             &quot;be kept by Certbot's built in log rotation. Setting this &quot;
             &quot;flag to 0 disables log rotation entirely, causing &quot;
             &quot;Certbot to always append to the same log file.&quot;)
    helpful.add(
        None, &quot;--preconfigured-renewal&quot;, dest=&quot;preconfigured_renewal&quot;,
        action=&quot;store_true&quot;, default=flag_default(&quot;preconfigured_renewal&quot;),
        help=argparse.SUPPRESS
    )
    helpful.add(
        [None, &quot;automation&quot;, &quot;run&quot;, &quot;certonly&quot;, &quot;enhance&quot;],
        &quot;-n&quot;, &quot;--non-interactive&quot;, &quot;--noninteractive&quot;,
        dest=&quot;noninteractive_mode&quot;, action=&quot;store_true&quot;,
        default=flag_default(&quot;noninteractive_mode&quot;),
        help=&quot;Run without ever asking for user input. This may require &quot;
              &quot;additional command line flags; the client will try to explain &quot;
              &quot;which ones are required if it finds one missing&quot;)
    helpful.add(
        [None, &quot;register&quot;, &quot;run&quot;, &quot;certonly&quot;, &quot;enhance&quot;],
        constants.FORCE_INTERACTIVE_FLAG, action=&quot;store_true&quot;,
        default=flag_default(&quot;force_interactive&quot;),
        help=&quot;Force Certbot to be interactive even if it detects it's not &quot;
             &quot;being run in a terminal. This flag cannot be used with the &quot;
             &quot;renew subcommand.&quot;)
    helpful.add(
        [None, &quot;run&quot;, &quot;certonly&quot;, &quot;certificates&quot;, &quot;enhance&quot;],
        &quot;-d&quot;, &quot;--domains&quot;, &quot;--domain&quot;, dest=&quot;domains&quot;,
        metavar=&quot;DOMAIN&quot;, action=_DomainsAction,
        default=flag_default(&quot;domains&quot;),
        help=&quot;Domain names to apply. For multiple domains you can use &quot;
             &quot;multiple -d flags or enter a comma separated list of domains &quot;
             &quot;as a parameter. The first domain provided will be the &quot;
             &quot;subject CN of the certificate, and all domains will be &quot;
             &quot;Subject Alternative Names on the certificate. &quot;
             &quot;The first domain will also be used in &quot;
             &quot;some software user interfaces and as the file paths for the &quot;
             &quot;certificate and related material unless otherwise &quot;
             &quot;specified or you already have a certificate with the same &quot;
             &quot;name. In the case of a name collision it will append a number &quot;
             &quot;like 0001 to the file path name. (default: Ask)&quot;)
    helpful.add(
        [None, &quot;run&quot;, &quot;certonly&quot;, &quot;register&quot;],
        &quot;--eab-kid&quot;, dest=&quot;eab_kid&quot;,
        metavar=&quot;EAB_KID&quot;,
        help=&quot;Key Identifier for External Account Binding&quot;
    )
    helpful.add(
        [None, &quot;run&quot;, &quot;certonly&quot;, &quot;register&quot;],
        &quot;--eab-hmac-key&quot;, dest=&quot;eab_hmac_key&quot;,
        metavar=&quot;EAB_HMAC_KEY&quot;,
        help=&quot;HMAC key for External Account Binding&quot;
    )
    helpful.add(
        [None, &quot;run&quot;, &quot;certonly&quot;, &quot;manage&quot;, &quot;delete&quot;, &quot;certificates&quot;,
         &quot;renew&quot;, &quot;enhance&quot;], &quot;--cert-name&quot;, dest=&quot;certname&quot;,
        metavar=&quot;CERTNAME&quot;, default=flag_default(&quot;certname&quot;),
        help=&quot;Certificate name to apply. This name is used by Certbot for housekeeping &quot;
             &quot;and in file paths; it doesn't affect the content of the certificate itself. &quot;
             &quot;To see certificate names, run 'certbot certificates'. &quot;
             &quot;When creating a new certificate, specifies the new certificate's name. &quot;
             &quot;(default: the first provided domain or the name of an existing &quot;
             &quot;certificate on your system for the same domains)&quot;)
    helpful.add(
        [None, &quot;testing&quot;, &quot;renew&quot;, &quot;certonly&quot;],
        &quot;--dry-run&quot;, action=&quot;store_true&quot;, dest=&quot;dry_run&quot;,
        default=flag_default(&quot;dry_run&quot;),
        help=&quot;Perform a test run of the client, obtaining test (invalid) certificates&quot;
             &quot; but not saving them to disk. This can currently only be used&quot;
             &quot; with the 'certonly' and 'renew' subcommands. \nNote: Although --dry-run&quot;
             &quot; tries to avoid making any persistent changes on a system, it &quot;
             &quot; is not completely side-effect free: if used with webserver authenticator plugins&quot;
             &quot; like apache and nginx, it makes and then reverts temporary config changes&quot;
             &quot; in order to obtain test certificates, and reloads webservers to deploy and then&quot;
             &quot; roll back those changes.  It also calls --pre-hook and --post-hook commands&quot;
             &quot; if they are defined because they may be necessary to accurately simulate&quot;
             &quot; renewal. --deploy-hook commands are not called.&quot;)
    helpful.add(
        [&quot;register&quot;, &quot;automation&quot;], &quot;--register-unsafely-without-email&quot;, action=&quot;store_true&quot;,
        default=flag_default(&quot;register_unsafely_without_email&quot;),
        help=&quot;Specifying this flag enables registering an account with no &quot;
             &quot;email address. This is strongly discouraged, because you will be &quot;
             &quot;unable to receive notice about impending expiration or &quot;
             &quot;revocation of your certificates or problems with your Certbot &quot;
             &quot;installation that will lead to failure to renew.&quot;)
    helpful.add(
        [&quot;register&quot;, &quot;update_account&quot;, &quot;unregister&quot;, &quot;automation&quot;], &quot;-m&quot;, &quot;--email&quot;,
        default=flag_default(&quot;email&quot;),
        help=config_help(&quot;email&quot;))
    helpful.add([&quot;register&quot;, &quot;update_account&quot;, &quot;automation&quot;], &quot;--eff-email&quot;, action=&quot;store_true&quot;,
                default=flag_default(&quot;eff_email&quot;), dest=&quot;eff_email&quot;,
                help=&quot;Share your e-mail address with EFF&quot;)
    helpful.add([&quot;register&quot;, &quot;update_account&quot;, &quot;automation&quot;], &quot;--no-eff-email&quot;,
                action=&quot;store_false&quot;, default=flag_default(&quot;eff_email&quot;), dest=&quot;eff_email&quot;,
                help=&quot;Don't share your e-mail address with EFF&quot;)
    helpful.add(
        [&quot;automation&quot;, &quot;certonly&quot;, &quot;run&quot;],
        &quot;--keep-until-expiring&quot;, &quot;--keep&quot;, &quot;--reinstall&quot;,
        dest=&quot;reinstall&quot;, action=&quot;store_true&quot;, default=flag_default(&quot;reinstall&quot;),
        help=&quot;If the requested certificate matches an existing certificate, always keep the &quot;
             &quot;existing one until it is due for renewal (for the &quot;
             &quot;'run' subcommand this means reinstall the existing certificate). (default: Ask)&quot;)
    helpful.add(
        &quot;automation&quot;, &quot;--expand&quot;, action=&quot;store_true&quot;, default=flag_default(&quot;expand&quot;),
        help=&quot;If an existing certificate is a strict subset of the requested names, &quot;
             &quot;always expand and replace it with the additional names. (default: Ask)&quot;)
    helpful.add(
        &quot;automation&quot;, &quot;--version&quot;, action=&quot;version&quot;,
        version=&quot;%(prog)s {0}&quot;.format(certbot.__version__),
        help=&quot;show program's version number and exit&quot;)
    helpful.add(
        [&quot;automation&quot;, &quot;renew&quot;],
        &quot;--force-renewal&quot;, &quot;--renew-by-default&quot;, dest=&quot;renew_by_default&quot;,
        action=&quot;store_true&quot;, default=flag_default(&quot;renew_by_default&quot;),
        help=&quot;If a certificate &quot;
             &quot;already exists for the requested domains, renew it now, &quot;
             &quot;regardless of whether it is near expiry. (Often &quot;
             &quot;--keep-until-expiring is more appropriate). Also implies &quot;
             &quot;--expand.&quot;)
    helpful.add(
        &quot;automation&quot;, &quot;--renew-with-new-domains&quot;, dest=&quot;renew_with_new_domains&quot;,
        action=&quot;store_true&quot;, default=flag_default(&quot;renew_with_new_domains&quot;),
        help=&quot;If a &quot;
             &quot;certificate already exists for the requested certificate name &quot;
             &quot;but does not match the requested domains, renew it now, &quot;
             &quot;regardless of whether it is near expiry.&quot;)
    helpful.add(
        &quot;automation&quot;, &quot;--reuse-key&quot;, dest=&quot;reuse_key&quot;,
        action=&quot;store_true&quot;, default=flag_default(&quot;reuse_key&quot;),
        help=&quot;When renewing, use the same private key as the existing &quot;
             &quot;certificate.&quot;)
    helpful.add(
        &quot;automation&quot;, &quot;--no-reuse-key&quot;, dest=&quot;reuse_key&quot;,
        action=&quot;store_false&quot;, default=flag_default(&quot;reuse_key&quot;),
        help=&quot;When renewing, do not use the same private key as the existing &quot;
             &quot;certificate. Not reusing private keys is the default behavior of &quot;
             &quot;Certbot. This option may be used to unset --reuse-key on an &quot;
             &quot;existing certificate.&quot;)

    helpful.add(
        [&quot;automation&quot;, &quot;renew&quot;, &quot;certonly&quot;],
        &quot;--allow-subset-of-names&quot;, action=&quot;store_true&quot;,
        default=flag_default(&quot;allow_subset_of_names&quot;),
        help=&quot;When performing domain validation, do not consider it a failure &quot;
             &quot;if authorizations can not be obtained for a strict subset of &quot;
             &quot;the requested domains. This may be useful for allowing renewals for &quot;
             &quot;multiple domains to succeed even if some domains no longer point &quot;
             &quot;at this system. This option cannot be used with --csr.&quot;)
    helpful.add(
        &quot;automation&quot;, &quot;--agree-tos&quot;, dest=&quot;tos&quot;, action=&quot;store_true&quot;,
        default=flag_default(&quot;tos&quot;),
        help=&quot;Agree to the ACME Subscriber Agreement (default: Ask)&quot;)
    helpful.add(
        [&quot;unregister&quot;, &quot;automation&quot;], &quot;--account&quot;, metavar=&quot;ACCOUNT_ID&quot;,
        default=flag_default(&quot;account&quot;),
        help=&quot;Account ID to use&quot;)
    helpful.add(
        &quot;automation&quot;, &quot;--duplicate&quot;, dest=&quot;duplicate&quot;, action=&quot;store_true&quot;,
        default=flag_default(&quot;duplicate&quot;),
        help=&quot;Allow making a certificate lineage that duplicates an existing one &quot;
             &quot;(both can be renewed in parallel)&quot;)
    helpful.add(
        [&quot;automation&quot;, &quot;renew&quot;, &quot;certonly&quot;, &quot;run&quot;],
        &quot;-q&quot;, &quot;--quiet&quot;, dest=&quot;quiet&quot;, action=&quot;store_true&quot;,
        default=flag_default(&quot;quiet&quot;),
        help=&quot;Silence all output except errors. Useful for automation via cron.&quot;
             &quot; Implies --non-interactive.&quot;)
    # overwrites server, handled in HelpfulArgumentParser.parse_args()
    helpful.add([&quot;testing&quot;, &quot;revoke&quot;, &quot;run&quot;], &quot;--test-cert&quot;, &quot;--staging&quot;,
        dest=&quot;staging&quot;, action=&quot;store_true&quot;, default=flag_default(&quot;staging&quot;),
        help=&quot;Use the staging server to obtain or revoke test (invalid) certificates; equivalent&quot;
             &quot; to --server &quot; + constants.STAGING_URI)
    helpful.add(
        &quot;testing&quot;, &quot;--debug&quot;, action=&quot;store_true&quot;, default=flag_default(&quot;debug&quot;),
        help=&quot;Show tracebacks in case of errors&quot;)
    helpful.add(
        [None, &quot;certonly&quot;, &quot;run&quot;], &quot;--debug-challenges&quot;, action=&quot;store_true&quot;,
        default=flag_default(&quot;debug_challenges&quot;),
        help=&quot;After setting up challenges, wait for user input before &quot;
             &quot;submitting to CA&quot;)
    helpful.add(
        &quot;testing&quot;, &quot;--no-verify-ssl&quot;, action=&quot;store_true&quot;,
        help=config_help(&quot;no_verify_ssl&quot;),
        default=flag_default(&quot;no_verify_ssl&quot;))
    helpful.add(
        [&quot;testing&quot;, &quot;standalone&quot;, &quot;manual&quot;], &quot;--http-01-port&quot;, type=int,
        dest=&quot;http01_port&quot;,
        default=flag_default(&quot;http01_port&quot;), help=config_help(&quot;http01_port&quot;))
    helpful.add(
        [&quot;testing&quot;, &quot;standalone&quot;], &quot;--http-01-address&quot;,
        dest=&quot;http01_address&quot;,
        default=flag_default(&quot;http01_address&quot;), help=config_help(&quot;http01_address&quot;))
    helpful.add(
        [&quot;testing&quot;, &quot;nginx&quot;], &quot;--https-port&quot;, type=int,
        default=flag_default(&quot;https_port&quot;),
        help=config_help(&quot;https_port&quot;))
    helpful.add(
        &quot;testing&quot;, &quot;--break-my-certs&quot;, action=&quot;store_true&quot;,
        default=flag_default(&quot;break_my_certs&quot;),
        help=&quot;Be willing to replace or renew valid certificates with invalid &quot;
             &quot;(testing/staging) certificates&quot;)
    helpful.add(
        &quot;security&quot;, &quot;--rsa-key-size&quot;, type=int, metavar=&quot;N&quot;,
        default=flag_default(&quot;rsa_key_size&quot;), help=config_help(&quot;rsa_key_size&quot;))
    helpful.add(
        &quot;security&quot;, &quot;--key-type&quot;, choices=['rsa', 'ecdsa'], type=str,
        default=flag_default(&quot;key_type&quot;), help=config_help(&quot;key_type&quot;))
    helpful.add(
        &quot;security&quot;, &quot;--elliptic-curve&quot;, type=str, choices=[
            'secp256r1',
            'secp384r1',
            'secp521r1',
        ], metavar=&quot;N&quot;,
        default=flag_default(&quot;elliptic_curve&quot;), help=config_help(&quot;elliptic_curve&quot;))
    helpful.add(
        &quot;security&quot;, &quot;--must-staple&quot;, action=&quot;store_true&quot;,
        dest=&quot;must_staple&quot;, default=flag_default(&quot;must_staple&quot;),
        help=config_help(&quot;must_staple&quot;))
    helpful.add(
        [&quot;security&quot;, &quot;enhance&quot;],
        &quot;--redirect&quot;, action=&quot;store_true&quot;, dest=&quot;redirect&quot;,
        default=flag_default(&quot;redirect&quot;),
        help=&quot;Automatically redirect all HTTP traffic to HTTPS for the newly &quot;
             &quot;authenticated vhost. (default: redirect enabled for install and run, &quot;
             &quot;disabled for enhance)&quot;)
    helpful.add(
        &quot;security&quot;, &quot;--no-redirect&quot;, action=&quot;store_false&quot;, dest=&quot;redirect&quot;,
        default=flag_default(&quot;redirect&quot;),
        help=&quot;Do not automatically redirect all HTTP traffic to HTTPS for the newly &quot;
             &quot;authenticated vhost. (default: redirect enabled for install and run, &quot;
             &quot;disabled for enhance)&quot;)
    helpful.add(
        [&quot;security&quot;, &quot;enhance&quot;],
        &quot;--hsts&quot;, action=&quot;store_true&quot;, dest=&quot;hsts&quot;, default=flag_default(&quot;hsts&quot;),
        help=&quot;Add the Strict-Transport-Security header to every HTTP response.&quot;
             &quot; Forcing browser to always use SSL for the domain.&quot;
             &quot; Defends against SSL Stripping.&quot;)
    helpful.add(
        &quot;security&quot;, &quot;--no-hsts&quot;, action=&quot;store_false&quot;, dest=&quot;hsts&quot;,
        default=flag_default(&quot;hsts&quot;), help=argparse.SUPPRESS)
    helpful.add(
        [&quot;security&quot;, &quot;enhance&quot;],
        &quot;--uir&quot;, action=&quot;store_true&quot;, dest=&quot;uir&quot;, default=flag_default(&quot;uir&quot;),
        help='Add the &quot;Content-Security-Policy: upgrade-insecure-requests&quot;'
             ' header to every HTTP response. Forcing the browser to use'
             ' https:// for every http:// resource.')
    helpful.add(
        &quot;security&quot;, &quot;--no-uir&quot;, action=&quot;store_false&quot;, dest=&quot;uir&quot;, default=flag_default(&quot;uir&quot;),
        help=argparse.SUPPRESS)
    helpful.add(
        &quot;security&quot;, &quot;--staple-ocsp&quot;, action=&quot;store_true&quot;, dest=&quot;staple&quot;,
        default=flag_default(&quot;staple&quot;),
        help=&quot;Enables OCSP Stapling. A valid OCSP response is stapled to&quot;
        &quot; the certificate that the server offers during TLS.&quot;)
    helpful.add(
        &quot;security&quot;, &quot;--no-staple-ocsp&quot;, action=&quot;store_false&quot;, dest=&quot;staple&quot;,
        default=flag_default(&quot;staple&quot;), help=argparse.SUPPRESS)
    helpful.add(
        &quot;security&quot;, &quot;--strict-permissions&quot;, action=&quot;store_true&quot;,
        default=flag_default(&quot;strict_permissions&quot;),
        help=&quot;Require that all configuration files are owned by the current &quot;
             &quot;user; only needed if your config is somewhere unsafe like /tmp/&quot;)
    helpful.add(
        [None, &quot;certonly&quot;, &quot;renew&quot;, &quot;run&quot;],
        &quot;--preferred-chain&quot;, dest=&quot;preferred_chain&quot;,
        default=flag_default(&quot;preferred_chain&quot;), help=config_help(&quot;preferred_chain&quot;)
    )
    helpful.add(
        [&quot;manual&quot;, &quot;standalone&quot;, &quot;certonly&quot;, &quot;renew&quot;],
        &quot;--preferred-challenges&quot;, dest=&quot;pref_challs&quot;,
        action=_PrefChallAction, default=flag_default(&quot;pref_challs&quot;),
        help='A sorted, comma delimited list of the preferred challenge to '
             'use during authorization with the most preferred challenge '
             'listed first (Eg, &quot;dns&quot; or &quot;http,dns&quot;). '
             'Not all plugins support all challenges. See '
             'https://certbot.eff.org/docs/using.html#plugins for details. '
             'ACME Challenges are versioned, but if you pick &quot;http&quot; rather '
             'than &quot;http-01&quot;, Certbot will select the latest version '
             'automatically.')
    helpful.add(
        [None, &quot;certonly&quot;, &quot;run&quot;], &quot;--issuance-timeout&quot;, type=nonnegative_int,
        dest=&quot;issuance_timeout&quot;,
        default=flag_default(&quot;issuance_timeout&quot;),
        help=config_help(&quot;issuance_timeout&quot;))
    helpful.add(
        &quot;renew&quot;, &quot;--pre-hook&quot;,
        help=&quot;Command to be run in a shell before obtaining any certificates.&quot;
        &quot; Intended primarily for renewal, where it can be used to temporarily&quot;
        &quot; shut down a webserver that might conflict with the standalone&quot;
        &quot; plugin. This will only be called if a certificate is actually to be&quot;
        &quot; obtained/renewed. When renewing several certificates that have&quot;
        &quot; identical pre-hooks, only the first will be executed.&quot;)
    helpful.add(
        &quot;renew&quot;, &quot;--post-hook&quot;,
        help=&quot;Command to be run in a shell after attempting to obtain/renew&quot;
        &quot; certificates. Can be used to deploy renewed certificates, or to&quot;
        &quot; restart any servers that were stopped by --pre-hook. This is only&quot;
        &quot; run if an attempt was made to obtain/renew a certificate. If&quot;
        &quot; multiple renewed certificates have identical post-hooks, only&quot;
        &quot; one will be run.&quot;)
    helpful.add(&quot;renew&quot;, &quot;--renew-hook&quot;,
                action=_RenewHookAction, help=argparse.SUPPRESS)
    helpful.add(
        &quot;renew&quot;, &quot;--no-random-sleep-on-renew&quot;, action=&quot;store_false&quot;,
        default=flag_default(&quot;random_sleep_on_renew&quot;), dest=&quot;random_sleep_on_renew&quot;,
        help=argparse.SUPPRESS)
    helpful.add(
        &quot;renew&quot;, &quot;--deploy-hook&quot;, action=_DeployHookAction,
        help='Command to be run in a shell once for each successfully'
        ' issued certificate. For this command, the shell variable'
        ' $RENEWED_LINEAGE will point to the config live subdirectory'
        ' (for example, &quot;/etc/letsencrypt/live/example.com&quot;) containing'
        ' the new certificates and keys; the shell variable'
        ' $RENEWED_DOMAINS will contain a space-delimited list of'
        ' renewed certificate domains (for example, &quot;example.com'
        ' www.example.com&quot;')
    helpful.add(
        &quot;renew&quot;, &quot;--disable-hook-validation&quot;,
        action=&quot;store_false&quot;, dest=&quot;validate_hooks&quot;,
        default=flag_default(&quot;validate_hooks&quot;),
        help=&quot;Ordinarily the commands specified for&quot;
        &quot; --pre-hook/--post-hook/--deploy-hook will be checked for&quot;
        &quot; validity, to see if the programs being run are in the $PATH,&quot;
        &quot; so that mistakes can be caught early, even when the hooks&quot;
        &quot; aren't being run just yet. The validation is rather&quot;
        &quot; simplistic and fails if you use more advanced shell&quot;
        &quot; constructs, so you can use this switch to disable it.&quot;
        &quot; (default: False)&quot;)
    helpful.add(
        &quot;renew&quot;, &quot;--no-directory-hooks&quot;, action=&quot;store_false&quot;,
        default=flag_default(&quot;directory_hooks&quot;), dest=&quot;directory_hooks&quot;,
        help=&quot;Disable running executables found in Certbot's hook directories&quot;
        &quot; during renewal. (default: False)&quot;)
    helpful.add(
        &quot;renew&quot;, &quot;--disable-renew-updates&quot;, action=&quot;store_true&quot;,
        default=flag_default(&quot;disable_renew_updates&quot;), dest=&quot;disable_renew_updates&quot;,
        help=&quot;Disable automatic updates to your server configuration that&quot;
        &quot; would otherwise be done by the selected installer plugin, and triggered&quot;
        &quot; when the user executes \&quot;certbot renew\&quot;, regardless of if the certificate&quot;
        &quot; is renewed. This setting does not apply to important TLS configuration&quot;
        &quot; updates.&quot;)
    helpful.add(
        &quot;renew&quot;, &quot;--no-autorenew&quot;, action=&quot;store_false&quot;,
        default=flag_default(&quot;autorenew&quot;), dest=&quot;autorenew&quot;,
        help=&quot;Disable auto renewal of certificates.&quot;)

    # Deprecated arguments
    helpful.add_deprecated_argument(&quot;--os-packages-only&quot;, 0)
    helpful.add_deprecated_argument(&quot;--no-self-upgrade&quot;, 0)
    helpful.add_deprecated_argument(&quot;--no-bootstrap&quot;, 0)
    helpful.add_deprecated_argument(&quot;--no-permissions-check&quot;, 0)

    # Populate the command line parameters for new style enhancements
    enhancements.populate_cli(helpful.add)

    _create_subparsers(helpful)
    _paths_parser(helpful)
    # _plugins_parsing should be the last thing to act upon the main
    # parser (--help should display plugin-specific options last)
    _plugins_parsing(helpful, plugins)

    if not detect_defaults:
        global helpful_parser # pylint: disable=global-statement
        helpful_parser = helpful
    return helpful.parse_args()


def set_by_cli(var: str) -&gt; bool:
    &quot;&quot;&quot;
    Return True if a particular config variable has been set by the user
    (CLI or config file) including if the user explicitly set it to the
    default.  Returns False if the variable was assigned a default value.
    &quot;&quot;&quot;
    # We should probably never actually hit this code. But if we do,
    # a deprecated option has logically never been set by the CLI.
    if var in DEPRECATED_OPTIONS:
        return False

    detector = set_by_cli.detector  # type: ignore
    if detector is None and helpful_parser is not None:
        # Setup on first run: `detector` is a weird version of config in which
        # the default value of every attribute is wrangled to be boolean-false
        plugins = plugins_disco.PluginsRegistry.find_all()
        # reconstructed_args == sys.argv[1:], or whatever was passed to main()
        reconstructed_args = helpful_parser.args + [helpful_parser.verb]

        detector = set_by_cli.detector = prepare_and_parse_args(  # type: ignore
            plugins, reconstructed_args, detect_defaults=True)
        # propagate plugin requests: eg --standalone modifies config.authenticator
        detector.authenticator, detector.installer = (
            plugin_selection.cli_plugin_requests(detector))

    if not isinstance(getattr(detector, var), _Default):
        logger.debug(&quot;Var %s=%s (set by user).&quot;, var, getattr(detector, var))
        return True

    for modifier in VAR_MODIFIERS.get(var, []):
        if set_by_cli(modifier):
            logger.debug(&quot;Var %s=%s (set by user).&quot;,
                var, VAR_MODIFIERS.get(var, []))
            return True

    return False


# static housekeeping var
# functions attributed are not supported by mypy
# https://github.com/python/mypy/issues/2087
set_by_cli.detector = None  # type: ignore


def has_default_value(option: str, value: Any) -&gt; bool:
    &quot;&quot;&quot;Does option have the default value?

    If the default value of option is not known, False is returned.

    :param str option: configuration variable being considered
    :param value: value of the configuration variable named option

    :returns: True if option has the default value, otherwise, False
    :rtype: bool

    &quot;&quot;&quot;
    if helpful_parser is not None:
        return (option in helpful_parser.defaults and
                helpful_parser.defaults[option] == value)
    return False


def option_was_set(option: str, value: Any) -&gt; bool:
    &quot;&quot;&quot;Was option set by the user or does it differ from the default?

    :param str option: configuration variable being considered
    :param value: value of the configuration variable named option

    :returns: True if the option was set, otherwise, False
    :rtype: bool

    &quot;&quot;&quot;
    # If an option is deprecated, it was effectively not set by the user.
    if option in DEPRECATED_OPTIONS:
        return False
    return set_by_cli(option) or not has_default_value(option, value)


def argparse_type(variable: Any) -&gt; Type:
    &quot;&quot;&quot;Return our argparse type function for a config variable (default: str)&quot;&quot;&quot;
    # pylint: disable=protected-access
    if helpful_parser is not None:
        for action in helpful_parser.parser._actions:
            if action.type is not None and action.dest == variable:
                return action.type
    return str
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Flib%2Fpython3.6%2Fsite-packages%2Fcertbot%2F_internal%2Fcli'>Back to Directory</a>