signing-enclave
Version:
A code signing and notarization tool for macOS and Windows applications. Uses Azure Key Vault for secret and certificate management.
55 lines • 2.21 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.getSecretClient = getSecretClient;
exports.downloadCertificateFile = downloadCertificateFile;
exports.getSecret = getSecret;
const keyVaultCredentials_1 = require("./keyVaultCredentials");
const identity_1 = require("@azure/identity");
const keyvault_secrets_1 = require("@azure/keyvault-secrets");
const promises_1 = require("fs/promises");
const tmp_promise_1 = require("tmp-promise");
async function getSecretClient() {
const credentials = (0, keyVaultCredentials_1.getKeyVaultCredentials)();
const clientSecretCredential = new identity_1.ClientSecretCredential(credentials.tenantId, credentials.id, credentials.secret);
return new keyvault_secrets_1.SecretClient(credentials.url, clientSecretCredential);
}
async function downloadCertificateFile(secretName, { postfix = ".p12", filePath }) {
const secretClient = await getSecretClient();
const secret = await secretClient.getSecret(secretName);
const base64EncodedSecret = secret.value;
if (!base64EncodedSecret) {
throw new Error(`No certificate found for ${secretName}`);
}
const pfxBuffer = Buffer.from(base64EncodedSecret, "base64");
let resolvedFilePath;
let cleanup;
if (!filePath) {
const tmp = await (0, tmp_promise_1.file)({ postfix });
resolvedFilePath = tmp.path;
cleanup = tmp.cleanup;
console.info(`Writing secret to ${resolvedFilePath}`);
}
else {
resolvedFilePath = filePath;
cleanup = async () => {
await (0, promises_1.rm)(resolvedFilePath);
};
}
await (0, promises_1.writeFile)(resolvedFilePath, pfxBuffer);
return {
secretFilePath: resolvedFilePath,
async cleanup() {
await cleanup();
console.info(`Secret file for ${secretName} deleted`);
},
};
}
async function getSecret(secretName) {
const secretClient = await getSecretClient();
const secret = await secretClient.getSecret(secretName);
if (!secret.value) {
throw new Error(`No secret found for ${secretName}`);
}
return secret.value;
}
//# sourceMappingURL=secretClient.js.map