Spaces:
Paused
Paused
File size: 4,580 Bytes
35743bd | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 | import fs from "fs";
import crypto from "crypto";
import {
execFileText,
execFileWithPassword,
getErrorMessage,
quotePowerShell,
runElevatedPowerShell,
} from "../systemCommands.ts";
const IS_WIN = process.platform === "win32";
// Get SHA1 fingerprint from cert file using Node.js crypto
function getCertFingerprint(certPath: string): string {
const pem = fs.readFileSync(certPath, "utf-8");
const der = Buffer.from(pem.replace(/-----[^-]+-----/g, "").replace(/\s/g, ""), "base64");
const pairs = crypto.createHash("sha1").update(der).digest("hex").toUpperCase().match(/.{2}/g);
if (!pairs) {
throw new Error(`Unable to compute certificate fingerprint for ${certPath}`);
}
return pairs.join(":");
}
/**
* Check if certificate is already installed in system store
*/
export async function checkCertInstalled(certPath: string): Promise<boolean> {
if (IS_WIN) {
return checkCertInstalledWindows(certPath);
}
return checkCertInstalledMac(certPath);
}
async function checkCertInstalledMac(certPath: string): Promise<boolean> {
try {
const fingerprint = getCertFingerprint(certPath);
const output = await execFileText("security", [
"find-certificate",
"-a",
"-Z",
"/Library/Keychains/System.keychain",
]);
return output.toUpperCase().includes(fingerprint);
} catch {
return false;
}
}
async function checkCertInstalledWindows(_certPath: string): Promise<boolean> {
try {
await execFileText("certutil", ["-store", "Root", "daily-cloudcode-pa.googleapis.com"]);
return true;
} catch {
return false;
}
}
/**
* Install SSL certificate to system trust store
*/
export async function installCert(sudoPassword: string, certPath: string): Promise<void> {
if (!fs.existsSync(certPath)) {
throw new Error(`Certificate file not found: ${certPath}`);
}
const isInstalled = await checkCertInstalled(certPath);
if (isInstalled) {
console.log("✅ Certificate already installed");
return;
}
if (IS_WIN) {
await installCertWindows(certPath);
} else {
await installCertMac(sudoPassword, certPath);
}
}
async function installCertMac(sudoPassword: string, certPath: string): Promise<void> {
try {
await execFileWithPassword(
"sudo",
[
"-S",
"security",
"add-trusted-cert",
"-d",
"-r",
"trustRoot",
"-k",
"/Library/Keychains/System.keychain",
certPath,
],
sudoPassword
);
console.log(`✅ Installed certificate to system keychain: ${certPath}`);
} catch (error) {
const message = getErrorMessage(error);
const msg = message.includes("canceled")
? "User canceled authorization"
: "Certificate install failed";
throw new Error(msg);
}
}
async function installCertWindows(certPath: string): Promise<void> {
await runElevatedPowerShell(`
$certPath = ${quotePowerShell(certPath)};
$proc = Start-Process certutil -ArgumentList @('-addstore','Root',$certPath) -Verb RunAs -Wait -PassThru;
if ($proc.ExitCode -ne 0) { throw "certutil exited with code $($proc.ExitCode)" }
`);
console.log(`✅ Installed certificate to Windows Root store`);
}
/**
* Uninstall SSL certificate from system store
*/
export async function uninstallCert(sudoPassword: string, certPath: string): Promise<void> {
const isInstalled = await checkCertInstalled(certPath);
if (!isInstalled) {
console.log("Certificate not found in system store");
return;
}
if (IS_WIN) {
await uninstallCertWindows();
} else {
await uninstallCertMac(sudoPassword, certPath);
}
}
async function uninstallCertMac(sudoPassword: string, certPath: string): Promise<void> {
const fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
try {
await execFileWithPassword(
"sudo",
[
"-S",
"security",
"delete-certificate",
"-Z",
fingerprint,
"/Library/Keychains/System.keychain",
],
sudoPassword
);
console.log("✅ Uninstalled certificate from system keychain");
} catch (err) {
throw new Error("Failed to uninstall certificate");
}
}
async function uninstallCertWindows(): Promise<void> {
await runElevatedPowerShell(`
$proc = Start-Process certutil -ArgumentList @('-delstore','Root','daily-cloudcode-pa.googleapis.com') -Verb RunAs -Wait -PassThru;
if ($proc.ExitCode -ne 0) { throw "certutil exited with code $($proc.ExitCode)" }
`);
console.log("✅ Uninstalled certificate from Windows Root store");
}
|