navy 7.0.0-alpha.4 → 7.1.0

package/lib/util/https.js

@@ -7,8 +7,13 @@ Object.defineProperty(exports, "__esModule", {
 exports.createCert = createCert;
 exports.generateRootCa = generateRootCa;
 exports.getCertsPath = getCertsPath;
+exports.hostNameFromIssueUrl = hostNameFromIssueUrl;
+exports.issueLeafCertForUrl = issueLeafCertForUrl;
 exports.removeCert = removeCert;
 var _path = _interopRequireDefault(require("path"));
+var _crypto = _interopRequireDefault(require("crypto"));
+var _net = _interopRequireDefault(require("net"));
+var _url = require("url");
 var _config = require("../config");
 var _errors = require("../errors");
 var _chalk = _interopRequireDefault(require("chalk"));
@@ -16,6 +21,136 @@ var _fs = _interopRequireDefault(require("fs"));
 var _nodeForge = require("node-forge");
 var _navy = require("../navy");
 const debug = require('debug')('navy:https');
+
+/** Random positive DER INTEGER serial (hex), for unique X.509 serialNumber fields. */
+function randomSerialHex(numBytes = 16) {
+  const buf = _crypto.default.randomBytes(numBytes);
+  buf[0] &= 0x7f;
+  return buf.toString('hex');
+}
+
+/** Hostname (or IP string) from a user-supplied URL for TLS CN/SAN. */
+function hostNameFromIssueUrl(urlString) {
+  const trimmed = (urlString || '').trim();
+  if (!trimmed) {
+    throw new _errors.NavyError('URL for --issue must not be empty.');
+  }
+  const withScheme = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed) ? trimmed : `https://${trimmed}`;
+  let parsed;
+  try {
+    parsed = new _url.URL(withScheme);
+  } catch (e) {
+    throw new _errors.NavyError(`Invalid URL for --issue: ${urlString}`);
+  }
+  if (!parsed.hostname) {
+    throw new _errors.NavyError(`Could not determine a hostname from URL: ${urlString}`);
+  }
+  return parsed.hostname;
+}
+function safeCertFileBase(host) {
+  return host.replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+function subjectAltNamesForHost(host) {
+  if (_net.default.isIP(host)) {
+    return [{
+      type: 7,
+      ip: host
+    }];
+  }
+  return [{
+    type: 2,
+    value: host
+  }];
+}
+function buildSignedLeafPems(certName, tlsRootCaDir, sanAltNames) {
+  const caCertString = _fs.default.readFileSync(`${tlsRootCaDir}/ca.crt`, 'utf8');
+  const caKeyString = _fs.default.readFileSync(`${tlsRootCaDir}/ca.key`, 'utf8');
+  const privateCAKey = _nodeForge.pki.privateKeyFromPem(caKeyString);
+  const keys = _nodeForge.pki.rsa.generateKeyPair(2048);
+  const cert = _nodeForge.pki.createCertificate();
+  const caCert = _nodeForge.pki.certificateFromPem(caCertString);
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = randomSerialHex(16);
+  cert.validity.notBefore = new Date();
+  cert.validity.notBefore.setDate(cert.validity.notBefore.getDate() - 1);
+  cert.validity.notAfter = new Date();
+  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 2);
+  const attrs = [{
+    name: 'commonName',
+    value: certName
+  }, {
+    name: 'organizationName',
+    value: 'navy-dev'
+  }];
+  cert.setSubject(attrs);
+  cert.setIssuer(caCert.subject.attributes);
+  const caSubjectKeyId = caCert.generateSubjectKeyIdentifier().getBytes();
+  cert.setExtensions([{
+    name: 'basicConstraints',
+    cA: false,
+    critical: true
+  }, {
+    name: 'keyUsage',
+    digitalSignature: true,
+    keyEncipherment: true,
+    critical: true
+  }, {
+    name: 'extKeyUsage',
+    serverAuth: true
+  }, {
+    name: 'subjectAltName',
+    altNames: sanAltNames
+  }, {
+    name: 'subjectKeyIdentifier'
+  }, {
+    name: 'authorityKeyIdentifier',
+    keyIdentifier: caSubjectKeyId
+  }]);
+  cert.sign(privateCAKey, _nodeForge.md.sha256.create());
+  return {
+    privateKey: _nodeForge.pki.privateKeyToPem(keys.privateKey),
+    certificate: _nodeForge.pki.certificateToPem(cert)
+  };
+}
+
+/**
+ * Issues a leaf TLS certificate and key for an arbitrary host, signed with the Navy root CA,
+ * plus a copy of the root CA PEM for configuring trust / full chain on a non-Navy service.
+ */
+async function issueLeafCertForUrl(urlString, outputDir) {
+  const certName = hostNameFromIssueUrl(urlString);
+  const tlsRootCaDir = (0, _config.getConfig)().tlsRootCaDir || _config.DEFAULT_TLS_ROOT_CA_DIR;
+  await generateRootCa();
+  const out = _path.default.resolve(outputDir);
+  // $FlowIgnore
+  _fs.default.mkdirSync(out, {
+    recursive: true
+  });
+  const base = safeCertFileBase(certName);
+  const san = subjectAltNamesForHost(certName);
+  let pem;
+  try {
+    pem = buildSignedLeafPems(certName, tlsRootCaDir, san);
+  } catch (e) {
+    throw new _errors.NavyError(e instanceof Error ? e.message : String(e));
+  }
+  const certPath = _path.default.join(out, `${base}.crt`);
+  const keyPath = _path.default.join(out, `${base}.key`);
+  const caCertSrc = _path.default.join(tlsRootCaDir, 'ca.crt');
+  const caCopyPath = _path.default.join(out, 'navy-root-ca.crt');
+  _fs.default.writeFileSync(keyPath, pem.privateKey, {
+    mode: 0o600
+  });
+  _fs.default.writeFileSync(certPath, pem.certificate, {
+    mode: 0o644
+  });
+  _fs.default.copyFileSync(caCertSrc, caCopyPath);
+  return {
+    certPath,
+    keyPath,
+    caCopyPath
+  };
+}
 function getCertsPath(create = false) {
   const certsPath = _path.default.join((0, _config.getConfigDir)(), 'tls-certs');
   if (!_fs.default.existsSync(certsPath)) {
@@ -70,7 +205,7 @@ async function generateRootCa() {
   debug('Creating self-signed certificate...');
   const cert = _nodeForge.pki.createCertificate();
   cert.publicKey = keys.publicKey;
-  cert.serialNumber = '01';
+  cert.serialNumber = randomSerialHex(8);
   cert.validity.notBefore = new Date();
   cert.validity.notAfter = new Date();
   cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 5);
@@ -83,13 +218,24 @@ async function generateRootCa() {
   }];
   cert.setSubject(attrs);
   cert.setIssuer(attrs);
+
+  // Trust stores (macOS keychain, NSS, Windows) expect a CA to assert keyCertSign (and
+  // usually cRLSign) on the issuer; leaf certs need SAN + keyUsage for modern TLS clients.
   cert.setExtensions([{
     name: 'basicConstraints',
-    cA: true
+    cA: true,
+    critical: true,
+    pathLenConstraint: 0
+  }, {
+    name: 'keyUsage',
+    keyCertSign: true,
+    cRLSign: true,
+    critical: true
   }, {
     name: 'subjectKeyIdentifier'
   }, {
-    name: 'authorityKeyIdentifier'
+    name: 'authorityKeyIdentifier',
+    keyIdentifier: true
   }]);
   try {
     // self-sign certificate
@@ -125,45 +271,25 @@ async function createCert(opts) {
     return;
   }
   await generateRootCa();
-  const caCertString = _fs.default.readFileSync(`${tlsRootCaDir}/ca.crt`, 'utf8');
-  const caKeyString = _fs.default.readFileSync(`${tlsRootCaDir}/ca.key`, 'utf8');
   debug(`Generating cert for ${certName} in ${certsPath}`);
-  const privateCAKey = _nodeForge.pki.privateKeyFromPem(caKeyString);
-  const keys = _nodeForge.pki.rsa.generateKeyPair(2048);
-  const cert = _nodeForge.pki.createCertificate();
-  const caCert = _nodeForge.pki.certificateFromPem(caCertString);
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = Math.floor(Math.random() * (99 - 2) + 2).toString();
-  cert.validity.notBefore = new Date();
-  cert.validity.notBefore.setDate(cert.validity.notBefore.getDate() - 1);
-  cert.validity.notAfter = new Date();
-  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 2);
-  const attrs = [{
-    name: 'commonName',
-    value: certName
-  }, {
-    name: 'organizationName',
-    value: 'navy-dev'
-  }];
+  let commonName = certName;
+  if (opts.serviceUrl && !opts.hostName) {
+    try {
+      const hostname = new _url.URL(opts.serviceUrl).hostname;
+      if (hostname) {
+        commonName = hostname;
+      }
+    } catch (e) {
+      // keep commonName as certName
+    }
+  }
+  const san = subjectAltNamesForHost(commonName);
+  let pem;
   try {
-    cert.setSubject(attrs);
-    cert.setIssuer(caCert.subject.attributes);
-    cert.setExtensions([{
-      name: 'extKeyUsage',
-      serverAuth: true
-    }]);
-    cert.sign(privateCAKey, _nodeForge.md.sha256.create());
-
-    // PEM-format keys and cert
-    const pem = {
-      privateKey: _nodeForge.pki.privateKeyToPem(keys.privateKey),
-      certificate: _nodeForge.pki.certificateToPem(cert)
-      // publicKey: pki.publicKeyToPem(keys.publicKey),
-    };
-    _fs.default.writeFileSync(`${certsPath}/${certName}.key`, pem.privateKey);
-    _fs.default.writeFileSync(`${certsPath}/${certName}.crt`, pem.certificate);
-    // fs.writeFileSync(`${certsPath}/${certName}.pub.key`, pem.publicKey)
+    pem = buildSignedLeafPems(commonName, tlsRootCaDir, san);
   } catch (e) {
-    throw new _errors.NavyError(e);
+    throw new _errors.NavyError(e instanceof Error ? e.message : String(e));
   }
+  _fs.default.writeFileSync(`${certsPath}/${certName}.key`, pem.privateKey);
+  _fs.default.writeFileSync(`${certsPath}/${certName}.crt`, pem.certificate);
 }

package/lib/util/install-root-ca.js

@@ -0,0 +1,114 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.caughtErrorMessage = caughtErrorMessage;
+exports.installRootCaToTrustStore = installRootCaToTrustStore;
+var _child_process = require("child_process");
+var _fs = _interopRequireDefault(require("fs"));
+var _os = _interopRequireDefault(require("os"));
+var _path = _interopRequireDefault(require("path"));
+var _errors = require("../errors");
+function caughtErrorMessage(e) {
+  if (e == null) {
+    return String(e);
+  }
+  if (e.message != null && e.message !== '') {
+    return String(e.message);
+  }
+  return String(e);
+}
+function assertCaFile(caCrtPath) {
+  if (!_fs.default.existsSync(caCrtPath)) {
+    throw new _errors.NavyError(`CA certificate not found at ${caCrtPath}`);
+  }
+}
+function installMacOSUserTrust(caCrtPath) {
+  const home = _os.default.homedir();
+  const candidates = [_path.default.join(home, 'Library/Keychains/login.keychain-db'), _path.default.join(home, 'Library/Keychains/login.keychain')];
+  const keychain = candidates.find(p => _fs.default.existsSync(p));
+  if (!keychain) {
+    throw new _errors.NavyError('Could not find your macOS login keychain. Import the CA manually from Keychain Access:\n' + `  File → Import Items… → choose ${caCrtPath}\n` + 'Then double‑click the certificate and set “When using this certificate” to “Always Trust”.');
+  }
+  try {
+    (0, _child_process.execFileSync)('security', ['add-trusted-cert', '-d', '-r', 'trustRoot', '-k', keychain, caCrtPath], {
+      stdio: 'inherit'
+    });
+  } catch (e) {
+    const msg = caughtErrorMessage(e);
+    const hint = 'If this failed because the certificate is already installed, remove the old “navy-dev-ca” ' + 'entry from Keychain Access and run `navy https --setup` again.\n\n' + 'For a system‑wide trust store (requires an administrator password), run:\n' + `  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${caCrtPath}`;
+    throw new _errors.NavyError(`Could not add the Navy root CA to your login keychain.\n${hint}\n\n(${msg})`);
+  }
+}
+function installLinux(caCrtPath) {
+  const debianScript = '/usr/sbin/update-ca-certificates';
+  const fedoraScript = '/usr/bin/update-ca-trust';
+  if (_fs.default.existsSync(debianScript)) {
+    const dest = '/usr/local/share/ca-certificates/navy-dev-ca.crt';
+    try {
+      (0, _child_process.execFileSync)('sudo', ['cp', caCrtPath, dest], {
+        stdio: 'inherit'
+      });
+      (0, _child_process.execFileSync)('sudo', [debianScript], {
+        stdio: 'inherit'
+      });
+    } catch (e) {
+      const msg = caughtErrorMessage(e);
+      throw new _errors.NavyError('Could not install the Navy root CA using update-ca-certificates.\n' + `Copy ${caCrtPath} to ${dest} (with sudo) and run \`sudo update-ca-certificates\`, or consult your distro’s docs.\n\n(${msg})`);
+    }
+    return;
+  }
+  if (_fs.default.existsSync(fedoraScript)) {
+    const dest = '/etc/pki/ca-trust/source/anchors/navy-dev-ca.crt';
+    try {
+      (0, _child_process.execFileSync)('sudo', ['cp', caCrtPath, dest], {
+        stdio: 'inherit'
+      });
+      (0, _child_process.execFileSync)('sudo', [fedoraScript, 'extract'], {
+        stdio: 'inherit'
+      });
+    } catch (e) {
+      const msg = caughtErrorMessage(e);
+      throw new _errors.NavyError('Could not install the Navy root CA using update-ca-trust.\n' + `Copy ${caCrtPath} to ${dest} (with sudo) and run \`sudo update-ca-trust extract\`.\n\n(${msg})`);
+    }
+    return;
+  }
+  throw new _errors.NavyError('Automatic Linux install needs `update-ca-certificates` (Debian/Ubuntu) or `update-ca-trust` (Fedora/RHEL).\n' + 'Install the CA yourself, for example:\n' + `  sudo cp ${caCrtPath} /usr/local/share/ca-certificates/navy-dev-ca.crt && sudo update-ca-certificates`);
+}
+function installWindows(caCrtPath) {
+  const systemRoot = process.env.SystemRoot || 'C:\\Windows';
+  const certutil = _path.default.join(systemRoot, 'System32', 'certutil.exe');
+  if (!_fs.default.existsSync(certutil)) {
+    throw new _errors.NavyError(`certutil.exe not found under ${systemRoot}. Import ${caCrtPath} manually:\n` + '  certmgr.msc → Trusted Root Certification Authorities → Certificates → right‑click → All Tasks → Import');
+  }
+  try {
+    (0, _child_process.execFileSync)(certutil, ['-user', '-addstore', 'Root', caCrtPath], {
+      stdio: 'inherit'
+    });
+  } catch (e) {
+    const msg = caughtErrorMessage(e);
+    throw new _errors.NavyError('Could not add the Navy root CA to the current user’s Trusted Root store.\n' + `Open certmgr.msc and import ${caCrtPath} under Trusted Root Certification Authorities.\n\n(${msg})`);
+  }
+}
+
+/**
+ * Installs the Navy development root CA into the OS trust store where supported
+ * (macOS login keychain, Debian/Ubuntu update-ca-certificates, Fedora/RHEL update-ca-trust,
+ * Windows per-user Trusted Roots). May invoke sudo on Linux.
+ */
+function installRootCaToTrustStore(caCrtPath) {
+  const abs = _path.default.resolve(caCrtPath);
+  assertCaFile(abs);
+  const platform = process.platform;
+  if (platform === 'darwin') {
+    installMacOSUserTrust(abs);
+  } else if (platform === 'linux') {
+    installLinux(abs);
+  } else if (platform === 'win32') {
+    installWindows(abs);
+  } else {
+    throw new _errors.NavyError(`Automatic root CA install is not supported on ${platform}. Trust ${abs} manually as a root CA.`);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "navy",
-  "version": "7.0.0-alpha.4",
+  "version": "7.1.0",
   "description": "Quick and powerful development environments using Docker and Docker Compose",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",