app-builder-lib
Version:
electron-builder lib
55 lines (54 loc) • 2.59 kB
TypeScript
/**
* Decrypt `data` using RC2-CBC with PKCS#7 padding removal (RFC 2268).
*
* Used for pbeWithSHAAnd40BitRC2CBC (OID 1.2.840.113549.1.12.1.6) and
* pbeWithSHAAnd128BitRC2CBC (OID 1.2.840.113549.1.12.1.5).
*
* These OIDs are commonly used to encrypt certificate bags in PKCS#12
* files produced by OpenSSL and Windows with default settings. Node.js 22+
* (OpenSSL 3 default provider) does not support RC2 via `createDecipheriv`.
*/
declare function rc2CbcDecrypt(key: Buffer, iv: Buffer, data: Buffer, effectiveBits: number): Buffer;
/**
* PKCS#12 key/IV derivation function from RFC 7292 Appendix B (SHA-1 variant).
* id = 1 to derive a key, id = 2 to derive an IV.
*
* Throws if `iterations` is outside [1, MAX_PKCS12_PBE_ITERATIONS] to prevent
* CPU exhaustion from a crafted PFX file.
*/
declare function pkcs12PbeDeriveKey(password: Buffer, salt: Buffer, iterations: number, id: number, length: number): Buffer;
/**
* Encode a password as UTF-16 Big Endian with a null terminator, which is the
* format required by PKCS#12 PBE key derivation (RFC 7292).
* An empty string yields [0x00, 0x00] (just the null terminator).
*/
declare function pkcs12PasswordToUtf16(password: string): Buffer;
/**
* Reads certificate info from a PKCS#12 (.pfx) file using pkijs (unobfuscated TypeScript).
* Mirrors the `certificate-info` subcommand of app-builder-bin.
* https://github.com/develar/app-builder/blob/master/pkg/codesign/p12.go
*
* Returns { commonName, bloodyMicrosoftSubjectDn } on success.
*
* Known divergences from the Go binary:
* - No OpenSSL fallback when the pure PKCS#12 decoder fails for a non-password reason.
* - Unknown OIDs are rendered using the raw numeric OID as the type name (e.g. `2.5.4.100=value`); Go uses `OID=#hexbytes` when ASN.1 marshal succeeds.
* - RDN ordering uses DER order; Go normalizes via pkix.Name.ToRDNSequence then reverses via
* BloodyMsString. These coincide for pkijs-generated certs (CN-first DER) but may
* differ for real CA-issued certs stored in traditional C-first DER order.
*/
export declare function readCertInfo(file: string, password: string): Promise<{
commonName: string;
bloodyMicrosoftSubjectDn: string;
}>;
/**
* Internal functions exported exclusively for unit testing.
* Not part of the public API — do not use outside of test files.
*/
export declare const _testingOnly: {
pkcs12PbeDeriveKey: typeof pkcs12PbeDeriveKey;
pkcs12PasswordToUtf16: typeof pkcs12PasswordToUtf16;
rc2CbcDecrypt: typeof rc2CbcDecrypt;
MAX_PKCS12_PBE_ITERATIONS: number;
};
export {};