@ggcode-cli/ggcode 1.1.96 → 1.2.1

package/README.md

@@ -56,6 +56,26 @@ or:
 GGCODE_INSTALL_VERSION=X.Y.Z ggcode
 ```
 
+## TLS / Corporate proxy
+
+The installer verifies TLS certificates by default.
+
+If you are behind a corporate proxy with a custom CA certificate that Node.js does not trust, you have two options:
+
+1. **Recommended** — add your CA to Node's trust store:
+
+   ```bash
+   NODE_EXTRA_CA_CERTS=/path/to/corporate-ca.pem npm install -g @ggcode-cli/ggcode
+   ```
+
+2. **Not recommended** — disable TLS verification entirely:
+
+   ```bash
+   GGCODE_INSECURE_TLS=1 npm install -g @ggcode-cli/ggcode
+   ```
+
+   This prints a security warning and makes the download vulnerable to man-in-the-middle attacks.
+
 ## Native installers
 
 Prefer a native package? Download directly from [GitHub Releases](https://github.com/topcheer/ggcode/releases/latest):

package/lib/install.js

@@ -375,10 +375,23 @@ function getProxyURL() {
   );
 }
 
+// GGCODE_INSECURE_TLS=1 disables TLS certificate verification.
+// Use ONLY behind a corporate proxy with a custom CA.
+const INSECURE_TLS = process.env.GGCODE_INSECURE_TLS === "1";
+if (INSECURE_TLS) {
+  console.warn(
+    "\x1b[31mWARNING: GGCODE_INSECURE_TLS=1 is set. TLS certificate verification is DISABLED.\x1b[0m\n" +
+    "This makes the download vulnerable to man-in-the-middle attacks.\n" +
+    "Only use this in trusted networks with a corporate proxy.\n" +
+    "For custom CAs, prefer NODE_EXTRA_CA_CERTS=/path/to/ca.pem instead."
+  );
+}
+const TLS_OPTS = { rejectUnauthorized: !INSECURE_TLS };
+
 function httpsGetViaProxy(targetUrl, callback) {
   const proxyURL = getProxyURL();
   if (!proxyURL) {
-    return https.get(targetUrl, { rejectUnauthorized: false }, callback);
+    return https.get(targetUrl, TLS_OPTS, callback);
   }
 
   const parsed = new URL(targetUrl);
@@ -401,7 +414,7 @@ function httpsGetViaProxy(targetUrl, callback) {
     const tlsSocket = tls.connect({
       socket: socket,
       servername: parsed.hostname,
-      rejectUnauthorized: false,
+      rejectUnauthorized: !INSECURE_TLS,
     }, () => {
       const req = https.request(
         {
@@ -409,7 +422,7 @@ function httpsGetViaProxy(targetUrl, callback) {
           port: 443,
           path: parsed.pathname + (parsed.search || ""),
           method: "GET",
-          rejectUnauthorized: false,
+          rejectUnauthorized: !INSECURE_TLS,
           createConnection: () => tlsSocket,
         },
         callback,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggcode-cli/ggcode",
-  "version": "1.1.96",
+  "version": "1.2.1",
   "description": "Thin npm wrapper that installs the ggcode GitHub Release binary",
   "license": "MIT",
   "repository": {