@geogirafe/lib-geoportal 1.2.0-dev.2751114005 → 1.2.0-dev.2754564983

package/buildtools/generate-dev-certs.sh

@@ -1,15 +1,12 @@
 # SPDX-License-Identifier: Apache-2.0
 set +x
 
-# Ensure that certutil is installed
-if ! command -v certutil &> /dev/null; then
-    echo "certutil not found. Please install it first (e.g. libnss3-tools on Ubuntu)"
-    exit 1
-fi
+YELLOW='\033[1;33m'
+NC='\033[0m'
 
-# Ensure that Docker est installed
-if ! command -v docker &> /dev/null; then
-    echo "Docker not found. Please install it first (https://docs.docker.com/get-docker/)"
+# Ensure that openssl is installed (it ships by default on virtually every Linux distribution)
+if ! command -v openssl &> /dev/null; then
+    echo "openssl not found. Please install it first (e.g. 'sudo apt install openssl' on Ubuntu)"
     exit 1
 fi
 
@@ -21,24 +18,63 @@ TARGET_DIR="${1:-buildtools/certs}"
 mkdir -p "$TARGET_DIR"
 cd "$TARGET_DIR"
 
-# Generate certificates
+DOMAINS="app.localhost,localhost"
+IPS="127.0.0.1"
+
 echo Generating development certificates
-docker run --rm -v "$(pwd)":/root/.local/share/mkcert alpine/mkcert -install
-docker run --rm -v "$(pwd)":/root/.local/share/mkcert alpine/mkcert -cert-file /root/.local/share/mkcert/app.localhost.cert.pem -key-file /root/.local/share/mkcert/app.localhost.key.pem app.localhost localhost 127.0.0.1
-sudo chmod a+r app.localhost.*
+
+# Generate a local root CA (self-signed), reused across runs if it already exists
+if [ ! -f rootCA.pem ] || [ ! -f rootCA-key.pem ]; then
+    openssl genrsa -out rootCA-key.pem 4096 2> /dev/null
+    openssl req -x509 -new -nodes -key rootCA-key.pem -sha256 -days 3650 \
+        -subj "/O=GeoGirafe Development CA/CN=GeoGirafe Local Dev Root CA" \
+        -addext "basicConstraints=critical,CA:TRUE" \
+        -addext "keyUsage=critical,keyCertSign,cRLSign" \
+        -out rootCA.pem
+fi
+
+# Build the Subject Alternative Name list for the leaf (server) certificate
+SAN=$(echo "$DOMAINS" | tr ',' '\n' | sed 's/^/DNS:/' | paste -sd,)
+SAN="$SAN,$(echo "$IPS" | tr ',' '\n' | sed 's/^/IP:/' | paste -sd,)"
+
+# Generate the leaf certificate for the dev server, signed by the local root CA
+openssl genrsa -out app.localhost.key.pem 2048 2> /dev/null
+openssl req -new -key app.localhost.key.pem \
+    -subj "/CN=app.localhost" \
+    -out app.localhost.csr.pem
+
+openssl x509 -req -in app.localhost.csr.pem \
+    -CA rootCA.pem -CAkey rootCA-key.pem -CAcreateserial \
+    -days 825 -sha256 \
+    -extfile <(printf "subjectAltName=%s\nextendedKeyUsage=serverAuth" "$SAN") \
+    -out app.localhost.cert.pem
+
+rm -f app.localhost.csr.pem
+
+sudo chmod a+r app.localhost.* rootCA.pem
 
 # Add root certificate to system trusted store
 echo Trusting development certificates at the system level
 sudo cp rootCA.pem /usr/local/share/ca-certificates/geogirafe-dev.crt
 sudo update-ca-certificates
 
-# Trust certificate in chrome
-echo Trusting development certificates in Chrome
-certutil -d sql:$HOME/.pki/nssdb -A -t TC -n "GeoGirafe LocalDevCert" -i rootCA.pem
-# Trust the certificate in firefox
-echo Trusting development certificates in Firefox
-FIREFOX_PROFILE=$(grep -E 'Path=' ~/.mozilla/firefox/profiles.ini | grep default-release | cut -d'=' -f2)
-certutil -d sql:$HOME/.mozilla/firefox/$FIREFOX_PROFILE -A -t "C,,C" -n "GeoGirafe LocalDevCert" -i rootCA.pem
+# Firefox, and older Chrome builds, keep their own certificate store (NSS) instead of relying on
+# the system one. Importing into it requires certutil, which is optional: if it isn't installed
+# we just skip this step and let the user trust the certificate manually in their browser.
+if command -v certutil &> /dev/null; then
+    echo Trusting development certificates in Chrome
+    certutil -d sql:$HOME/.pki/nssdb -A -t TC -n "GeoGirafe LocalDevCert" -i rootCA.pem
+
+    echo Trusting development certificates in Firefox
+    FIREFOX_PROFILE=$(grep -E 'Path=' ~/.mozilla/firefox/profiles.ini 2> /dev/null | grep default-release | cut -d'=' -f2)
+    if [ -n "$FIREFOX_PROFILE" ]; then
+        certutil -d sql:$HOME/.mozilla/firefox/$FIREFOX_PROFILE -A -t "C,,C" -n "GeoGirafe LocalDevCert" -i rootCA.pem
+    fi
+else
+    echo -e "${YELLOW}certutil not found (optional, part of the libnss3-tools package on Ubuntu/Debian).${NC}"
+    echo -e "${YELLOW}Skipping automatic trust in Firefox/Chrome's own certificate store.${NC}"
+    echo -e "${YELLOW}Install libnss3-tools and re-run this script, or manually import $TARGET_DIR/rootCA.pem as a trusted authority in your browser settings.${NC}"
+fi
 
 echo Certificate was added successfully.
 echo Please restart your browser to take it into account.

package/package.json

@@ -5,7 +5,7 @@
     "name": "GeoGirafe PSC",
     "url": "https://doc.geogirafe.org"
   },
-  "version": "1.2.0-dev.2751114005",
+  "version": "1.2.0-dev.2754564983",
   "type": "module",
   "engines": {
     "node": ">=20.19.0"

package/templates/public/about.json

@@ -1 +1 @@
-{"version":"1.2.0-dev.2751114005", "build":"2751114005", "date":"11/08/2026"}
+{"version":"1.2.0-dev.2754564983", "build":"2754564983", "date":"12/08/2026"}