@small-tech/https 2.1.0 → 2.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +26 -0
  2. package/README.md +46 -76
  3. package/package.json +4 -4
  4. package/publish +3 -0
package/CHANGELOG.md CHANGED
@@ -4,6 +4,32 @@ All notable changes to this project will be documented in this file.
4
4
 
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
6
6
 
7
+ ## [2.2.0] - 2022-06-07
8
+
9
+ Dependency update.
10
+
11
+ ### Changed
12
+
13
+ - Update Auto Encrypt to version 2.3.0. This updates the certificate signing request (CSR) signature algorithm from the obsolete SHA-1 to SHA-256. (Let’s Encrypt will beging to reject certificate requests signed with SHA-1 on September 15, 2022. See https://community.letsencrypt.org/t/rejecting-sha-1-csrs-and-validation-using-tls-1-0-1-1-urls/175144)
14
+
15
+ ## [2.1.2] - 2021-03-08
16
+
17
+ Update Auto Encrypt to version 2.2.0
18
+
19
+ ## Fixed
20
+
21
+ - Bug when checking for certificate renewals.
22
+
23
+ ## Updated
24
+
25
+ - Adds latest Let’s Encrypt staging certificate authority root certificate.
26
+
27
+ ## [2.1.1] - 2021-02-16
28
+
29
+ ## Changed
30
+
31
+ - Upgrade auto-encrypt to version 2.0.6. Fixes assignment to constant that would result in a crash when a Retry-After header was received from Let’s Encrypt.
32
+
7
33
  ## [2.1.0] - 2020-11-04
8
34
 
9
35
  ### Changed
package/README.md CHANGED
@@ -2,6 +2,8 @@
2
2
 
3
3
  A drop-in standard Node.js HTTPS module replacement with both automatic development-time (localhost) certificates via Auto Encrypt Localhost and automatic production certificates via Auto Encrypt.
4
4
 
5
+ __Note:__ This is the CommonJS (CJS) version of the library. For the ECMAScript Modules (ESM) version, please see the main branch.
6
+
5
7
  Simply replace Node’s `https` module with `@small-tech/https` and get:
6
8
 
7
9
  - Automatically-provisioned TLS certificates at localhost with no browser warnings.
@@ -34,93 +36,43 @@ Works on Linux, macOS, and Windows (WSL is not supported for certificates at loc
34
36
  npm i @small-tech/https
35
37
  ```
36
38
 
37
- ## A note on Linux and the security farce that is “privileged ports”
38
-
39
- Linux has an outdated feature dating from the mainframe days that requires a process that wants to bind to ports < 1024 to have elevated privileges. While this was a security feature in the days of dumb terminals, today it is a security anti-feature. (macOS has dropped this requirement as of macOS Mojave.)
39
+ ## Examples
40
40
 
41
- On modern Linux systems, you can disable privileged ports like this:
41
+ ### At localhost with automatically-provisioned development certificates via mkcert.
42
42
 
43
- ```sh
44
- sudo sysctl -w net.ipv4.ip_unprivileged_port_start=0
45
- ```
43
+ ```js
44
+ const https = require('@small-tech/https')
46
45
 
47
- Or, if you want to cling to ancient historic relics like a conservative to a racist statue, ensure your Node process has the right to bind to so-called “privileged” ports by issuing the following command before use:
46
+ const server = https.createServer((request, response) => {
47
+ response.end('Hello, world!')
48
+ })
48
49
 
49
- ```sh
50
- sudo setcap cap_net_bind_service=+ep $(which node)
50
+ server.listen(443, () => {
51
+ console.log(' 🎉 Server running at https://localhost.')
52
+ })
51
53
  ```
52
54
 
53
- If you are wrapping your Node app into an executable binary using a module like [Nexe](https://github.com/nexe/nexe), you will have to ensure that every build of your app has that capability set. For an example of how we do this in [Site.js](https://sitejs.org), [see this listing](https://source.ind.ie/site.js/app/blob/master/bin/lib/ensure.js#L124).
54
-
55
- ## Example
56
-
57
- Here’s a basic Express “hello, world” app that shows you how this module can be used. Note that you don’t need express to use it.
58
-
59
- 1. ### Set up:
60
-
61
- ```sh
62
- # Create the project folder and switch to it.
63
- mkdir example && cd example
64
-
65
- # Create a new npm module for the example.
66
- npm init --yes
67
-
68
- # Install dependencies.
69
- npm i @small-tech/https express
70
-
71
- # Open up the main file in your default editor.
72
- $EDITOR index.js
73
- ```
74
-
75
- 2. ### Code (index.js):
76
-
77
- ```javascript
78
- const https = require('..')
79
-
80
- // Helpers
81
- function html(message) {
82
- return `<!doctype html><html lang='en'><head><meta charset='utf-8'/><title>Hello, world!</title><style>body{background-color: white; font-family: sans-serif;}</style></head><body><h1>${message}</h1></body></html>`
83
- }
84
- const contentTypeHTML = {'Content-Type': 'text/html'}
85
-
86
- let options = {}
87
-
88
- // For globally-trusted Let’s Encrypt certificates uncomment the following section.
89
- // To provision certificates, also remove “staging: true” property.
90
-
91
- // const os = require('os')
92
- // options = {
93
- // domains: [os.hostname()],
94
- // staging: true
95
- // }
55
+ Hit `https://localhost` and you should see your site with locally-trusted TLS certificates.
96
56
 
97
- // Create HTTPS server at https://localhost
98
- // with locally-trusted certificates.
99
- const server = https.createServer(options, (request, response) => {
100
- if (request.method !== 'GET') {
101
- response.writeHead(404, contentTypeHTML)
102
- response.end(html('Not found.'))
103
- return
104
- }
105
- // Respond to all routes with the same page.
106
- response.writeHead(200, contentTypeHTML)
107
- response.end(html('Hello, world!'))
108
- })
57
+ ### At hostname with automatically-provisioned Let’s Encrypt certificates.
109
58
 
110
- server.listen(443, () => {
111
- console.log(' 🎉 Server running on port 443.')
112
- })
113
- ```
59
+ ```js
60
+ const https = require('@small-tech/https')
61
+ const os = require('os')
114
62
 
115
- 3. ### Run:
63
+ const hostname = os.hostname()
64
+ const options = { domains: [hostname] }
116
65
 
117
- ```sh
118
- node index
119
- ```
66
+ const server = https.createServer((request, response) => {
67
+ response.end('Hello, world!')
68
+ })
120
69
 
121
- Hit `https://localhost` and you should see your site with locally-trusted TLS certificates.
70
+ server.listen(443, () => {
71
+ console.log(` 🎉 Server running at https://${hostname}.`)
72
+ })
73
+ ```
122
74
 
123
- To provision globally-trusted Let’s Encrypt certificates instead, uncomment the `options` object and pass it as the first argument in the `createServer()` method.
75
+ To provision globally-trusted Let’s Encrypt certificates, we additionally create an `options` object containing the domain(s) we want to support, and pass it as the first argument in the `createServer()` method.
124
76
 
125
77
  You can find a version of this example in the `/example` folder. To download and run that version:
126
78
 
@@ -138,6 +90,24 @@ npm i
138
90
  npm run example
139
91
  ```
140
92
 
93
+ ## A note on Linux and the security farce that is “privileged ports”
94
+
95
+ Linux has an outdated feature dating from the mainframe days that requires a process that wants to bind to ports < 1024 to have elevated privileges. While this was a security feature in the days of dumb terminals, today it is a security anti-feature. (macOS has dropped this requirement as of macOS Mojave.)
96
+
97
+ On modern Linux systems, you can disable privileged ports like this:
98
+
99
+ ```sh
100
+ sudo sysctl -w net.ipv4.ip_unprivileged_port_start=0
101
+ ```
102
+
103
+ Or, if you want to cling to ancient historic relics like a conservative to a racist statue, ensure your Node process has the right to bind to so-called “privileged” ports by issuing the following command before use:
104
+
105
+ ```sh
106
+ sudo setcap cap_net_bind_service=+ep $(which node)
107
+ ```
108
+
109
+ If you are wrapping your Node app into an executable binary using a module like [Nexe](https://github.com/nexe/nexe), you will have to ensure that every build of your app has that capability set. For an example of how we do this in [Site.js](https://sitejs.org), [see this listing](https://source.ind.ie/site.js/app/blob/master/bin/lib/ensure.js#L124).
110
+
141
111
  ## Related projects
142
112
 
143
113
  Lower-level:
@@ -167,7 +137,7 @@ A complete [small technology](https://small-tech.org/about/#small-technology) to
167
137
 
168
138
  ## Copyright
169
139
 
170
- &copy; 2020 [Aral Balkan](https://ar.al), [Small Technology Foundation](https://small-tech.org).
140
+ &copy; 2020-2021 [Aral Balkan](https://ar.al), [Small Technology Foundation](https://small-tech.org).
171
141
 
172
142
  Let’s Encrypt is a trademark of the Internet Security Research Group (ISRG). All rights reserved. Node.js is a trademark of Joyent, Inc. and is used with its permission. We are not endorsed by or affiliated with Joyent or ISRG.
173
143
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@small-tech/https",
3
- "version": "2.1.0",
3
+ "version": "2.2.0",
4
4
  "description": "A drop-in standard Node.js HTTPS module replacement with both automatic development-time (localhost) certificates via Auto Encrypt Localhost and automatic production certificates via Auto Encrypt.",
5
5
  "main": "index.js",
6
6
  "keywords": [
@@ -37,9 +37,9 @@
37
37
  },
38
38
  "license": "AGPL-3.0-or-later",
39
39
  "dependencies": {
40
- "fs-extra": "^9.0.1",
41
- "@small-tech/auto-encrypt": "^2.0.5",
42
- "@small-tech/auto-encrypt-localhost": "^6.1.0"
40
+ "@small-tech/auto-encrypt": "^2.3.0",
41
+ "@small-tech/auto-encrypt-localhost": "^6.1.0",
42
+ "fs-extra": "^9.0.1"
43
43
  },
44
44
  "devDependencies": {
45
45
  "@small-tech/cross-platform-hostname": "^1.0.0",
package/publish ADDED
@@ -0,0 +1,3 @@
1
+ #!/bin/bash
2
+
3
+ npm publish --tag=cjs