Version in base suite: 4.0.0-2

Base version: python-certbot_4.0.0-2
Target version: python-certbot_4.0.0-2+deb13u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/p/python-certbot/python-certbot_4.0.0-2.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/p/python-certbot/python-certbot_4.0.0-2+deb13u1.dsc

 changelog                        |    6 ++++
 patches/0002-store-profile.patch |   53 +++++++++++++++++++++++++++++++++++++++
 patches/series                   |    1 
 3 files changed, 60 insertions(+)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpp_uousuj/python-certbot_4.0.0-2.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpp_uousuj/python-certbot_4.0.0-2+deb13u1.dsc: no acceptable signature found
diff -Nru python-certbot-4.0.0/debian/changelog python-certbot-4.0.0/debian/changelog
--- python-certbot-4.0.0/debian/changelog	2025-05-25 15:27:29.000000000 +0000
+++ python-certbot-4.0.0/debian/changelog	2026-04-05 00:36:10.000000000 +0000
@@ -1,3 +1,9 @@
+python-certbot (4.0.0-2+deb13u1) trixie; urgency=medium
+
+  * Import patch to store profile in renewal (Closes: #1125267)
+
+ -- Harlan Lieberman-Berg <hlieberman@debian.org>  Sat, 04 Apr 2026 20:36:10 -0400
+
 python-certbot (4.0.0-2) unstable; urgency=medium
 
   * autopkgtests: drop manual IP flag no longer used
diff -Nru python-certbot-4.0.0/debian/patches/0002-store-profile.patch python-certbot-4.0.0/debian/patches/0002-store-profile.patch
--- python-certbot-4.0.0/debian/patches/0002-store-profile.patch	1970-01-01 00:00:00.000000000 +0000
+++ python-certbot-4.0.0/debian/patches/0002-store-profile.patch	2026-04-05 00:33:56.000000000 +0000
@@ -0,0 +1,53 @@
+From 6a590e970efb7ba6c51bc74708c6507ae3a511d3 Mon Sep 17 00:00:00 2001
+From: Jacob Hoffman-Andrews <github@hoffman-andrews.com>
+Date: Mon, 5 May 2025 17:15:56 -0700
+Subject: [PATCH] store preferred/required_profile in renewal config
+
+This ensures that renewals of certificates will use the same profile settings.
+---
+ CHANGELOG.md                                | 2 ++
+ certbot/_internal/renewal.py            | 3 ++-
+ certbot/_internal/tests/storage_test.py | 6 ++++++
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
+Index: python-certbot/certbot/_internal/renewal.py
+===================================================================
+--- python-certbot.orig/certbot/_internal/renewal.py
++++ python-certbot/certbot/_internal/renewal.py
+@@ -45,7 +45,8 @@ logger = logging.getLogger(__name__)
+ STR_CONFIG_ITEMS = ["config_dir", "logs_dir", "work_dir", "user_agent",
+                     "server", "account", "authenticator", "installer",
+                     "renew_hook", "pre_hook", "post_hook", "http01_address",
+-                    "preferred_chain", "key_type", "elliptic_curve"]
++                    "preferred_chain", "key_type", "elliptic_curve",
++                    "preferred_profile", "required_profile"]
+ INT_CONFIG_ITEMS = ["rsa_key_size", "http01_port"]
+ BOOL_CONFIG_ITEMS = ["must_staple", "allow_subset_of_names", "reuse_key",
+                      "autorenew"]
+Index: python-certbot/certbot/_internal/tests/storage_test.py
+===================================================================
+--- python-certbot.orig/certbot/_internal/tests/storage_test.py
++++ python-certbot/certbot/_internal/tests/storage_test.py
+@@ -122,16 +122,22 @@ class RelevantValuesTest(unittest.TestCa
+         namespace = cli.prepare_and_parse_args(PLUGINS, [
+             '--allow-subset-of-names',
+             '--authenticator', 'apache',
++            '--preferred-profile', 'fancyprofile',
+         ])
+         expected_relevant_values = {
+             'server': constants.CLI_DEFAULTS['server'],
+             'key_type': 'ecdsa',
+             'allow_subset_of_names': True,
+             'authenticator': 'apache',
++            'preferred_profile': 'fancyprofile',
+         }
+ 
+         assert relevant_values(namespace) == expected_relevant_values
+ 
++    def test_with_required_profile(self):
++        self.values["required_profile"] = "shortlived"
++        expected_relevant_values = self.values.copy()
++        assert self._call(self.values) == expected_relevant_values
+ 
+ class BaseRenewableCertTest(test_util.ConfigTestCase):
+     """Base class for setting up Renewable Cert tests.
diff -Nru python-certbot-4.0.0/debian/patches/series python-certbot-4.0.0/debian/patches/series
--- python-certbot-4.0.0/debian/patches/series	2025-05-24 19:24:46.000000000 +0000
+++ python-certbot-4.0.0/debian/patches/series	2026-04-05 00:33:16.000000000 +0000
@@ -1 +1,2 @@
 0001-remove-external-images.patch
+0002-store-profile.patch