navy/lib/util/install-root-ca.js

Quick and powerful development environments using Docker and Docker Compose

"use strict";

var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
Object.defineProperty(exports, "__esModule", {
  value: true
});
exports.caughtErrorMessage = caughtErrorMessage;
exports.installRootCaToTrustStore = installRootCaToTrustStore;
var _child_process = require("child_process");
var _fs = _interopRequireDefault(require("fs"));
var _os = _interopRequireDefault(require("os"));
var _path = _interopRequireDefault(require("path"));
var _errors = require("../errors");
function caughtErrorMessage(e) {
  if (e == null) {
    return String(e);
  }
  if (e.message != null && e.message !== '') {
    return String(e.message);
  }
  return String(e);
}
function assertCaFile(caCrtPath) {
  if (!_fs.default.existsSync(caCrtPath)) {
    throw new _errors.NavyError(`CA certificate not found at ${caCrtPath}`);
  }
}
function installMacOSUserTrust(caCrtPath) {
  const home = _os.default.homedir();
  const candidates = [_path.default.join(home, 'Library/Keychains/login.keychain-db'), _path.default.join(home, 'Library/Keychains/login.keychain')];
  const keychain = candidates.find(p => _fs.default.existsSync(p));
  if (!keychain) {
    throw new _errors.NavyError('Could not find your macOS login keychain. Import the CA manually from Keychain Access:\n' + `  File → Import Items… → choose ${caCrtPath}\n` + 'Then double‑click the certificate and set “When using this certificate” to “Always Trust”.');
  }
  try {
    (0, _child_process.execFileSync)('security', ['add-trusted-cert', '-d', '-r', 'trustRoot', '-k', keychain, caCrtPath], {
      stdio: 'inherit'
    });
  } catch (e) {
    const msg = caughtErrorMessage(e);
    const hint = 'If this failed because the certificate is already installed, remove the old “navy-dev-ca” ' + 'entry from Keychain Access and run `navy https --setup` again.\n\n' + 'For a system‑wide trust store (requires an administrator password), run:\n' + `  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${caCrtPath}`;
    throw new _errors.NavyError(`Could not add the Navy root CA to your login keychain.\n${hint}\n\n(${msg})`);
  }
}
function installLinux(caCrtPath) {
  const debianScript = '/usr/sbin/update-ca-certificates';
  const fedoraScript = '/usr/bin/update-ca-trust';
  if (_fs.default.existsSync(debianScript)) {
    const dest = '/usr/local/share/ca-certificates/navy-dev-ca.crt';
    try {
      (0, _child_process.execFileSync)('sudo', ['cp', caCrtPath, dest], {
        stdio: 'inherit'
      });
      (0, _child_process.execFileSync)('sudo', [debianScript], {
        stdio: 'inherit'
      });
    } catch (e) {
      const msg = caughtErrorMessage(e);
      throw new _errors.NavyError('Could not install the Navy root CA using update-ca-certificates.\n' + `Copy ${caCrtPath} to ${dest} (with sudo) and run \`sudo update-ca-certificates\`, or consult your distro’s docs.\n\n(${msg})`);
    }
    return;
  }
  if (_fs.default.existsSync(fedoraScript)) {
    const dest = '/etc/pki/ca-trust/source/anchors/navy-dev-ca.crt';
    try {
      (0, _child_process.execFileSync)('sudo', ['cp', caCrtPath, dest], {
        stdio: 'inherit'
      });
      (0, _child_process.execFileSync)('sudo', [fedoraScript, 'extract'], {
        stdio: 'inherit'
      });
    } catch (e) {
      const msg = caughtErrorMessage(e);
      throw new _errors.NavyError('Could not install the Navy root CA using update-ca-trust.\n' + `Copy ${caCrtPath} to ${dest} (with sudo) and run \`sudo update-ca-trust extract\`.\n\n(${msg})`);
    }
    return;
  }
  throw new _errors.NavyError('Automatic Linux install needs `update-ca-certificates` (Debian/Ubuntu) or `update-ca-trust` (Fedora/RHEL).\n' + 'Install the CA yourself, for example:\n' + `  sudo cp ${caCrtPath} /usr/local/share/ca-certificates/navy-dev-ca.crt && sudo update-ca-certificates`);
}
function installWindows(caCrtPath) {
  const systemRoot = process.env.SystemRoot || 'C:\\Windows';
  const certutil = _path.default.join(systemRoot, 'System32', 'certutil.exe');
  if (!_fs.default.existsSync(certutil)) {
    throw new _errors.NavyError(`certutil.exe not found under ${systemRoot}. Import ${caCrtPath} manually:\n` + '  certmgr.msc → Trusted Root Certification Authorities → Certificates → right‑click → All Tasks → Import');
  }
  try {
    (0, _child_process.execFileSync)(certutil, ['-user', '-addstore', 'Root', caCrtPath], {
      stdio: 'inherit'
    });
  } catch (e) {
    const msg = caughtErrorMessage(e);
    throw new _errors.NavyError('Could not add the Navy root CA to the current user’s Trusted Root store.\n' + `Open certmgr.msc and import ${caCrtPath} under Trusted Root Certification Authorities.\n\n(${msg})`);
  }
}

/**
 * Installs the Navy development root CA into the OS trust store where supported
 * (macOS login keychain, Debian/Ubuntu update-ca-certificates, Fedora/RHEL update-ca-trust,
 * Windows per-user Trusted Roots). May invoke sudo on Linux.
 */
function installRootCaToTrustStore(caCrtPath) {
  const abs = _path.default.resolve(caCrtPath);
  assertCaFile(abs);
  const platform = process.platform;
  if (platform === 'darwin') {
    installMacOSUserTrust(abs);
  } else if (platform === 'linux') {
    installLinux(abs);
  } else if (platform === 'win32') {
    installWindows(abs);
  } else {
    throw new _errors.NavyError(`Automatic root CA install is not supported on ${platform}. Trust ${abs} manually as a root CA.`);
  }
}