node-opcua-pki 6.22.1 → 7.0.0

package/dist/lib/toolbox/with_openssl/execute_openssl.js

@@ -0,0 +1,246 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import assert from "node:assert";
+import child_process from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import byline from "byline";
+import chalk from "chalk";
+import { makePath } from "../common2.js";
+import { g_config } from "../config.js";
+import { debugLog, displayError, doDebug, warningLog } from "../debug.js";
+import { buildChildEnv, redactEnvForLog, setEnv } from "./_env.js";
+import { get_openssl_exec_path } from "./install_prerequisite.js";
+let opensslPath; // not initialized
+const n = makePath;
+// Fixed names for the per-invocation environment variables used to pass
+// passphrases to openssl via `-passin env:NAME` / `-passout env:NAME`
+// instead of placing them in argv (see ExecuteOptions.env for why). Safe to
+// reuse across concurrent calls: each call passes its own `env` object to a
+// distinct child process — nothing here touches process.env, so there is no
+// shared mutable state to race on.
+const PASSIN_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSIN";
+const PASSOUT_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSOUT";
+/**
+ * `-passin env:...` for a source passphrase (an input key or PFX bundle).
+ *
+ * Always emit this — with `""` when there is no passphrase — for any command
+ * that reads a private key which *might* be encrypted: without a `-passin`,
+ * openssl prompts on the controlling terminal for an encrypted key. An empty
+ * `-passin` on a plaintext key is a no-op; on an encrypted key it fails fast
+ * with `bad decrypt` instead.
+ */
+export function passinArg(passphrase = "") {
+    return { args: ["-passin", `env:${PASSIN_ENV_VAR}`], env: { [PASSIN_ENV_VAR]: passphrase } };
+}
+/** `-passout env:...` for an output passphrase (a PFX bundle being written). */
+export function passoutArg(passphrase = "") {
+    return { args: ["-passout", `env:${PASSOUT_ENV_VAR}`], env: { [PASSOUT_ENV_VAR]: passphrase } };
+}
+/** For logs and error messages only: a shell-like rendering of an argv. Never re-parsed. */
+function renderForDisplay(file, args) {
+    return [file, ...args].map((a) => (a === "" || /[\s"'`$\\]/.test(a) ? JSON.stringify(a) : a)).join(" ");
+}
+/**
+ * True when a string carries a character we should not hand to the openssl
+ * child. Two kinds are rejected:
+ *
+ *  - ASCII control characters, which have no place in an option or a path; and
+ *  - any *non-ASCII* punctuation, symbol, separator or format character.
+ *
+ * The second kind matters on Windows: a spawned program rebuilds its argument
+ * list from the command line through the active ANSI code page, and that
+ * conversion can "best-fit" a look-alike character onto a plain ASCII one — a
+ * full-width quotation mark onto `"`, a non-breaking space onto a space, and so
+ * on — which would change where one argument ends and the next begins. Every
+ * option and path this library passes to openssl is plain ASCII, so refusing
+ * these characters costs nothing in normal use.
+ *
+ * Non-ASCII *letters, digits and combining marks* are deliberately allowed, so
+ * a PKI folder living under an accented or non-Latin user profile (for example
+ * `C:\\Users\\José\\pki`) keeps working.
+ */
+function hasUnsafeArgChar(value) {
+    for (const ch of value) {
+        const code = ch.codePointAt(0);
+        if (code < 0x20 || code === 0x7f) {
+            return true; // ASCII control character
+        }
+        if (code < 0x80) {
+            continue; // ordinary ASCII: options, flags and paths use these
+        }
+        if (/[\p{L}\p{N}\p{M}]/u.test(ch)) {
+            continue; // real text (letters / digits / marks) in a configured path
+        }
+        return true; // non-ASCII punctuation, symbol, separator or format char
+    }
+    return false;
+}
+/**
+ * Make sure the openssl binary path and every argument are safe to pass to the
+ * child process (see {@link hasUnsafeArgChar}). Throws with the offending value
+ * rather than letting it reach openssl.
+ */
+function checkArgs(file, args) {
+    for (const value of [file, ...args]) {
+        if (typeof value === "string" && hasUnsafeArgChar(value)) {
+            throw new Error(`execute_openssl: refusing argument with an unexpected character: ${JSON.stringify(value)}`);
+        }
+    }
+}
+/**
+ * Run `file` with `args` directly (no shell): each element of `args` reaches
+ * the child as one argv entry, so a value can never be reinterpreted as a
+ * shell metacharacter, a redirection, or a second command. stdin is
+ * `/dev/null`: OpenSSL's app UI opens the console before honouring
+ * `-passin` and calls tcgetattr on stdin when there is no controlling TTY;
+ * a socket (Node's default child stdin) yields ENOTTY on Linux but
+ * EOPNOTSUPP on macOS, which OpenSSL rejects and the key load fails even
+ * with the right passphrase; /dev/null yields ENOTTY everywhere. It also
+ * removes any way for openssl to block reading a password from stdin.
+ */
+export async function execute(file, args, options) {
+    const from = new Error();
+    checkArgs(file, args);
+    options.cwd = options.cwd || process.cwd();
+    // istanbul ignore next
+    if (!g_config.silent) {
+        warningLog(chalk.cyan("                  CWD         "), options.cwd);
+    }
+    const outputs = [];
+    const errorOutputs = [];
+    const display = renderForDisplay(file, args);
+    return await new Promise((resolve, reject) => {
+        const child = child_process.spawn(file, [...args], {
+            cwd: options.cwd,
+            windowsHide: true,
+            env: buildChildEnv(options.env),
+            stdio: ["ignore", "pipe", "pipe"]
+        });
+        const fail = (message) => {
+            // istanbul ignore next
+            // The banner duplicates what the rejection already carries, and
+            // this is the one place in this module that ignored the library's
+            // own (default-on) silence. Callers that let the error propagate
+            // still get the full command and stderr from the Error itself;
+            // set VERBOSE to see it as it happens.
+            if (!options.hideErrorMessage && !g_config.silent) {
+                const fence = "###########################################";
+                console.error(chalk.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+                console.error(chalk.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
+                console.error(chalk.bgWhiteBright.redBright(message));
+                console.error(chalk.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
+                console.error(from.stack);
+            }
+            reject(new Error(message));
+        };
+        child.on("error", (err) => fail(`Command failed: ${display}\n${err.message}`));
+        child.on("close", (code, signal) => {
+            if (code === 0) {
+                resolve(outputs.join(""));
+                return;
+            }
+            const why = signal ? `signal ${signal}` : `exit code ${code}`;
+            fail(`Command failed: ${display}\n${errorOutputs.join("")}(${why})`);
+        });
+        if (child.stdout) {
+            const stream2 = byline(child.stdout);
+            stream2.on("data", (line) => {
+                outputs.push(`${line}\n`);
+            });
+            if (!g_config.silent) {
+                stream2.on("data", (line) => {
+                    line = line.toString();
+                    if (doDebug) {
+                        process.stdout.write(`${chalk.white("        stdout ") + chalk.whiteBright(line)}\n`);
+                    }
+                });
+            }
+        }
+        if (child.stderr) {
+            const stream1 = byline(child.stderr);
+            stream1.on("data", (line) => {
+                line = line.toString();
+                errorOutputs.push(`${line}\n`);
+                // istanbul ignore next
+                if (!g_config.silent && displayError) {
+                    process.stdout.write(`${chalk.white("        stderr ") + chalk.red(line)}\n`);
+                }
+            });
+        }
+    });
+}
+export async function find_openssl() {
+    return await get_openssl_exec_path();
+}
+export async function ensure_openssl_installed() {
+    if (!opensslPath) {
+        opensslPath = await find_openssl();
+        const outputs = await execute_openssl(["version"], { cwd: "." });
+        g_config.opensslVersion = outputs.trim();
+        if (doDebug) {
+            warningLog("OpenSSL version : ", g_config.opensslVersion);
+        }
+    }
+}
+export async function executeOpensslAsync(args, options) {
+    return await execute_openssl(args, options);
+}
+export async function execute_openssl_no_failure(args, options) {
+    options = options || {};
+    options.hideErrorMessage = true;
+    try {
+        return await execute_openssl(args, options);
+    }
+    catch (err) {
+        debugLog(" (ignored error =  ERROR : )", err.message);
+    }
+}
+function getTempFolder() {
+    return os.tmpdir();
+}
+/**
+ * Run `openssl` with `args` (see {@link OpensslArgs}): no shell, one argv
+ * entry per element, curated environment, /dev/null stdin.
+ */
+export async function execute_openssl(args, options) {
+    // never log `options` as-is: `options.env` may carry a passphrase
+    debugLog("execute_openssl", args, redactEnvForLog(options));
+    const empty_config_file = n(getTempFolder(), "empty_config.cnf");
+    if (!fs.existsSync(empty_config_file)) {
+        await fs.promises.writeFile(empty_config_file, "# empty config file");
+    }
+    options = options || {};
+    options.openssl_conf = options.openssl_conf || empty_config_file; // "!! OPEN SLL CONF NOT DEFINED BAD FILE !!";
+    assert(options.openssl_conf);
+    setEnv("OPENSSL_CONF", options.openssl_conf);
+    // istanbul ignore next
+    if (!g_config.silent) {
+        warningLog(chalk.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
+        warningLog(chalk.cyan("                  RANDFILE    "), process.env.RANDFILE);
+        warningLog(chalk.cyan("                  CMD         "), chalk.cyanBright(renderForDisplay("openssl", args)));
+    }
+    await ensure_openssl_installed();
+    return await execute(opensslPath, args, options);
+}
+//# sourceMappingURL=execute_openssl.js.map

package/dist/lib/toolbox/with_openssl/execute_openssl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute_openssl.js","sourceRoot":"","sources":["../../../../lib/toolbox/with_openssl/execute_openssl.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AAExH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,aAAa,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,IAAI,WAA+B,CAAC,CAAC,kBAAkB;AAEvD,MAAM,CAAC,GAAG,QAAQ,CAAC;AA8BnB,wEAAwE;AACxE,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,mCAAmC;AACnC,MAAM,cAAc,GAAG,+BAA+B,CAAC;AACvD,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAQzD;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,UAAU,GAAG,EAAE;IACrC,OAAO,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC;AACjG,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,UAAU,GAAG,EAAE;IACtC,OAAO,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,eAAe,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC;AACpG,CAAC;AAED,4FAA4F;AAC5F,SAAS,gBAAgB,CAAC,IAAY,EAAE,IAAiB;IACrD,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACnC,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAW,CAAC;QACzC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,CAAC,0BAA0B;QAC3C,CAAC;QACD,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;YACd,SAAS,CAAC,qDAAqD;QACnE,CAAC;QACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,4DAA4D;QAC1E,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,0DAA0D;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,IAAiB;IAC9C,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,oEAAoE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjH,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,IAAiB,EAAE,OAAuB;IAClF,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;IAEzB,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEtB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAE3C,uBAAuB;IACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAE7C,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAC/C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;YAC/B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE;YAC7B,uBAAuB;YACvB,gEAAgE;YAChE,kEAAkE;YAClE,iEAAiE;YACjE,+DAA+D;YAC/D,uCAAuC;YACvC,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAChD,MAAM,KAAK,GAAG,6CAA6C,CAAC;gBAC5D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAChF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACrE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAEhF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,MAA6B,EAAE,EAAE;YACrE,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1B,OAAO;YACX,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,mBAAmB,OAAO,KAAK,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBAChC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;YAC9B,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;oBAChC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACvB,IAAI,OAAO,EAAE,CAAC;wBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC1F,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBAChC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvB,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;gBAC/B,uBAAuB;gBACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;oBACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClF,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAC9B,OAAO,MAAM,qBAAqB,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,WAAW,GAAG,MAAM,YAAY,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACV,UAAU,CAAC,oBAAoB,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC9D,CAAC;IACL,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAiB,EAAE,OAA8B;IACvF,OAAO,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAiB,EAAE,OAA8B;IAC9F,OAAO,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC;QACD,OAAO,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,QAAQ,CAAC,8BAA8B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;AACL,CAAC;AAED,SAAS,aAAa;IAClB,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC;AAMD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAiB,EAAE,OAA8B;IACnF,kEAAkE;IAClE,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,iBAAiB,CAAC,CAAC,8CAA8C;IAChH,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7B,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7C,uBAAuB;IACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnF,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/E,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,wBAAwB,EAAE,CAAC;IACjC,OAAO,MAAM,OAAO,CAAC,WAAqB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC"}

package/dist/lib/toolbox/with_openssl/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./_env.js";
+export * from "./create_certificate_signing_request.js";
+export * from "./execute_openssl.js";
+export * from "./install_prerequisite.js";
+export * from "./toolbox.js";

package/dist/lib/toolbox/with_openssl/index.js

@@ -0,0 +1,30 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import exp from "node:constants";
+const _exp = exp;
+export * from "./_env.js";
+export * from "./create_certificate_signing_request.js";
+export * from "./execute_openssl.js";
+export * from "./install_prerequisite.js";
+export * from "./toolbox.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/toolbox/with_openssl/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../lib/toolbox/with_openssl/index.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,iBAAiB;AACjB,wHAAwH;AACxH,gFAAgF;AAChF,yCAAyC;AACzC,wHAAwH;AACxH,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,+GAA+G;AAC/G,sHAAsH;AACtH,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,uHAAuH;AACvH,YAAY;AACZ,EAAE;AACF,uHAAuH;AACvH,wHAAwH;AACxH,mHAAmH;AACnH,mHAAmH;AACnH,wHAAwH;AACxH,OAAO,GAAG,MAAM,gBAAgB,CAAC;AAEjC,MAAM,IAAI,GAAG,GAAG,CAAC;AAEjB,cAAc,WAAW,CAAC;AAC1B,cAAc,yCAAyC,CAAC;AACxD,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,cAAc,CAAC"}

package/dist/lib/toolbox/with_openssl/install_prerequisite.d.ts

@@ -0,0 +1,7 @@
+export declare function check_system_openssl_version(): Promise<string>;
+/**
+ *
+ * return path to the openssl executable
+ */
+export declare function install_prerequisite(): Promise<string>;
+export declare function get_openssl_exec_path(): Promise<string>;

package/dist/lib/toolbox/with_openssl/install_prerequisite.js

@@ -0,0 +1,358 @@
+// ---------------------------------------------------------------------------------------------------------------------
+// node-opcua-pki
+// ---------------------------------------------------------------------------------------------------------------------
+// Copyright (c) 2014-2026 - Etienne Rossignon - etienne.rossignon (at) gadz.org
+// Copyright (c) 2022-2026 - Sterfive.com
+// ---------------------------------------------------------------------------------------------------------------------
+//
+// This  project is licensed under the terms of the MIT license.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+// documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so,  subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+// ---------------------------------------------------------------------------------------------------------------------
+import child_process from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pipeline } from "node:stream/promises";
+import byline from "byline";
+import chalk from "chalk";
+import yauzl from "yauzl";
+import { warningLog } from "../debug.js";
+import { buildChildEnv } from "./_env.js";
+const doDebug = process.env.NODEOPCUAPKIDEBUG || false;
+/**
+ * Run `file` with `args` directly (no shell), same as execute_openssl's
+ * `execute()`: the same curated environment (a binary discovered with the
+ * full parent env but run with a reduced one could otherwise be found here
+ * and then fail to load its libraries later), and /dev/null stdin.
+ * Resolves with the exit code rather than rejecting on a non-zero exit;
+ * rejects only when the process cannot be spawned at all.
+ */
+async function execute(file, args, cwd) {
+    let output = "";
+    return await new Promise((resolve, reject) => {
+        const child = child_process.spawn(file, args, {
+            cwd,
+            windowsHide: true,
+            env: buildChildEnv(),
+            stdio: ["ignore", "pipe", "pipe"]
+        });
+        child.on("error", (err) => reject(err));
+        child.on("close", (code) => resolve({ exitCode: code ?? 1, output }));
+        const stream1 = byline(child.stdout);
+        stream1.on("data", (line) => {
+            output += `${line}\n`;
+            // istanbul ignore next
+            if (doDebug) {
+                process.stdout.write(`        stdout ${chalk.yellow(line)}\n`);
+            }
+        });
+    });
+}
+function is_expected_openssl_version(strVersion) {
+    return !!strVersion.match(/OpenSSL \d/);
+}
+async function getopensslExecPath() {
+    let result1;
+    try {
+        result1 = await execute("which", ["openssl"]);
+    }
+    catch (err) {
+        warningLog("warning: ", err.message);
+        throw new Error("Cannot find openssl");
+    }
+    const exitCode = result1?.exitCode;
+    const output = result1?.output;
+    if (exitCode !== 0) {
+        warningLog(chalk.yellow(" it seems that ") + chalk.cyan("openssl") + chalk.yellow(" is not installed on your computer "));
+        warningLog(chalk.yellow("Please install it before running this programs"));
+        throw new Error("Cannot find openssl");
+    }
+    const opensslExecPath = output.replace(/\n\r/g, "").trim();
+    return opensslExecPath;
+}
+export async function check_system_openssl_version() {
+    const opensslExecPath = await getopensslExecPath();
+    // istanbul ignore next
+    if (doDebug) {
+        warningLog(`              OpenSSL found in : ${chalk.yellow(opensslExecPath)}`);
+    }
+    // ------------------------ now verify that openssl version is the correct one
+    const result = await execute(opensslExecPath, ["version"]);
+    const exitCode = result?.exitCode;
+    const output = result?.output;
+    const version = output.trim();
+    const versionOK = exitCode === 0 && is_expected_openssl_version(version);
+    if (!versionOK) {
+        let message = chalk.whiteBright("Warning !!!!!!!!!!!! ") +
+            "\nyour version of openssl is " +
+            version +
+            ". It doesn't match the expected version";
+        if (process.platform === "darwin") {
+            message +=
+                chalk.cyan("\nplease refer to :") +
+                    chalk.yellow(" https://github.com/node-opcua/node-opcua/" + "wiki/installing-node-opcua-or-node-red-on-MacOS");
+        }
+        console.log(message);
+    }
+    return output;
+}
+async function install_and_check_win32_openssl_version() {
+    const downloadFolder = path.join(os.tmpdir(), ".");
+    function get_openssl_folder_win32() {
+        if (process.env.LOCALAPPDATA) {
+            const userProgramFolder = path.join(process.env.LOCALAPPDATA, "Programs");
+            if (fs.existsSync(userProgramFolder)) {
+                return path.join(userProgramFolder, "openssl");
+            }
+        }
+        return path.join(process.cwd(), "openssl");
+    }
+    function get_openssl_exec_path_win32() {
+        const opensslFolder = get_openssl_folder_win32();
+        return path.join(opensslFolder, "openssl.exe");
+    }
+    async function check_openssl_win32() {
+        const opensslExecPath = get_openssl_exec_path_win32();
+        const exists = fs.existsSync(opensslExecPath);
+        if (!exists) {
+            warningLog("checking presence of ", opensslExecPath);
+            warningLog(chalk.red(" cannot find file ") + opensslExecPath);
+            return {
+                opensslOk: false,
+                version: `cannot find file ${opensslExecPath}`
+            };
+        }
+        else {
+            const cwd = ".";
+            const { exitCode, output } = await execute(opensslExecPath, ["version"], cwd);
+            const version = output.trim();
+            // istanbul ignore next
+            if (doDebug) {
+                warningLog(" Version = ", version);
+            }
+            return {
+                opensslOk: exitCode === 0 && is_expected_openssl_version(version),
+                version
+            };
+        }
+    }
+    /**
+     * Try to find a system-installed openssl on Windows via `where`.
+     * Returns the path if found and version is acceptable, otherwise undefined.
+     */
+    async function find_system_openssl_win32() {
+        try {
+            const result = await execute("where", ["openssl"]);
+            if (result.exitCode !== 0) {
+                return undefined;
+            }
+            // `where` may return multiple lines; take the first one
+            const opensslPath = result.output.split(/\r?\n/)[0].trim();
+            if (!opensslPath || !fs.existsSync(opensslPath)) {
+                return undefined;
+            }
+            // verify version
+            const versionResult = await execute(opensslPath, ["version"]);
+            const version = versionResult.output.trim();
+            if (versionResult.exitCode === 0 && is_expected_openssl_version(version)) {
+                warningLog(chalk.green("Using system OpenSSL: ") + chalk.cyan(version) + chalk.green(" at ") + chalk.cyan(opensslPath));
+                return opensslPath;
+            }
+            warningLog(chalk.yellow("System OpenSSL found but version not accepted: ") + version);
+            return undefined;
+        }
+        catch (_err) {
+            return undefined;
+        }
+    }
+    /**
+     * detect whether windows OS is a 64 bits or 32 bits
+     * http://ss64.com/nt/syntax-64bit.html
+     * http://blogs.msdn.com/b/david.wang/archive/2006/03/26/howto-detect-process-bitness.aspx
+     * @return {number}
+     */
+    function win32or64() {
+        if (process.env.PROCESSOR_ARCHITECTURE === "x86" && process.env.PROCESSOR_ARCHITEW6432) {
+            return 64;
+        }
+        if (process.env.PROCESSOR_ARCHITECTURE === "AMD64") {
+            return 64;
+        }
+        // check if we are running node  x32 on a x64 arch
+        if (process.env.CURRENT_CPU === "x64") {
+            return 64;
+        }
+        return 32;
+    }
+    async function download_openssl() {
+        const url = win32or64() === 64
+            ? "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-x64_86-win64.zip"
+            : "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-i386-win32.zip";
+        // the zip file
+        const outputFilename = path.join(downloadFolder, path.basename(url));
+        warningLog(`downloading ${chalk.yellow(url)} to ${outputFilename}`);
+        if (fs.existsSync(outputFilename)) {
+            return { downloadedFile: outputFilename };
+        }
+        const response = await fetch(url, { redirect: "follow" });
+        if (!response.ok || !response.body) {
+            throw new Error(`Failed to download OpenSSL from ${url}: ${response.status} ${response.statusText}`);
+        }
+        const contentLength = parseInt(response.headers.get("content-length") || "0", 10);
+        let downloaded = 0;
+        let lastPercent = -1;
+        const fileStream = fs.createWriteStream(outputFilename);
+        // Use pipeline for proper backpressure and cleanup
+        const body = response.body;
+        body.on("data", (chunk) => {
+            downloaded += chunk.length;
+            if (contentLength > 0) {
+                const percent = Math.floor((downloaded / contentLength) * 100);
+                if (percent !== lastPercent && percent % 10 === 0) {
+                    lastPercent = percent;
+                    warningLog(`  download progress: ${percent}%`);
+                }
+            }
+        });
+        await pipeline(body, fileStream);
+        // Verify the downloaded file exists and has content
+        const stat = fs.statSync(outputFilename);
+        if (stat.size === 0) {
+            fs.unlinkSync(outputFilename);
+            throw new Error(`Downloaded file is empty: ${outputFilename}`);
+        }
+        warningLog(chalk.green("Download complete: ") + `${stat.size} bytes`);
+        return { downloadedFile: outputFilename };
+    }
+    async function unzip_openssl(zipFilename) {
+        const opensslFolder = get_openssl_folder_win32();
+        const zipFile = await new Promise((resolve, reject) => {
+            yauzl.open(zipFilename, { lazyEntries: true }, (err, zipfile) => {
+                if (err) {
+                    reject(err);
+                }
+                else {
+                    if (!zipfile) {
+                        reject(new Error("zipfile is null"));
+                    }
+                    else {
+                        resolve(zipfile);
+                    }
+                }
+            });
+        });
+        zipFile.readEntry();
+        await new Promise((resolve, reject) => {
+            zipFile.on("end", (err) => {
+                setImmediate(() => {
+                    // istanbul ignore next
+                    if (doDebug) {
+                        warningLog("unzip done");
+                    }
+                    if (err) {
+                        reject(err);
+                    }
+                    else {
+                        resolve();
+                    }
+                });
+            });
+            zipFile.on("entry", (entry) => {
+                zipFile.openReadStream(entry, (err, readStream) => {
+                    if (err) {
+                        return reject(err);
+                    }
+                    const file = path.join(opensslFolder, entry.fileName);
+                    // istanbul ignore next
+                    if (doDebug) {
+                        warningLog(" unzipping :", file);
+                    }
+                    const writeStream = fs.createWriteStream(file, "binary");
+                    // ensure parent directory exists
+                    readStream?.pipe(writeStream);
+                    writeStream.on("close", () => {
+                        zipFile.readEntry();
+                    });
+                });
+            });
+        });
+    }
+    // 1. Try system-installed OpenSSL first (e.g. on CI runners)
+    const systemOpenssl = await find_system_openssl_win32();
+    if (systemOpenssl) {
+        return systemOpenssl;
+    }
+    // 2. Check bundled OpenSSL at the expected local path
+    const opensslFolder = get_openssl_folder_win32();
+    const opensslExecPath = get_openssl_exec_path_win32();
+    if (!fs.existsSync(opensslFolder)) {
+        // istanbul ignore next
+        if (doDebug) {
+            warningLog("creating openssl_folder", opensslFolder);
+        }
+        fs.mkdirSync(opensslFolder);
+    }
+    const { opensslOk, version: _version } = await check_openssl_win32();
+    if (!opensslOk) {
+        // 3. Download as last resort
+        warningLog(chalk.yellow("openssl seems to be missing and need to be installed"));
+        const { downloadedFile } = await download_openssl();
+        // istanbul ignore next
+        if (doDebug) {
+            warningLog("deflating ", chalk.yellow(downloadedFile));
+        }
+        await unzip_openssl(downloadedFile);
+        const opensslExists = !!fs.existsSync(opensslExecPath);
+        // istanbul ignore next
+        if (doDebug) {
+            warningLog("verifying ", opensslExists, opensslExists ? chalk.green("OK ") : chalk.red(" Error"), opensslExecPath);
+        }
+        const _opensslExecPath2 = await check_openssl_win32();
+        return opensslExecPath;
+    }
+    else {
+        // istanbul ignore next
+        if (doDebug) {
+            warningLog(chalk.green("openssl is already installed and have the expected version."));
+        }
+        return opensslExecPath;
+    }
+}
+/**
+ *
+ * return path to the openssl executable
+ */
+export async function install_prerequisite() {
+    // istanbul ignore else
+    if (process.platform !== "win32") {
+        return await check_system_openssl_version();
+    }
+    else {
+        return await install_and_check_win32_openssl_version();
+    }
+}
+export async function get_openssl_exec_path() {
+    if (process.platform === "win32") {
+        const opensslExecPath = await install_prerequisite();
+        if (!fs.existsSync(opensslExecPath)) {
+            throw new Error(`internal error cannot find ${opensslExecPath}`);
+        }
+        return opensslExecPath;
+    }
+    else {
+        return "openssl";
+    }
+}
+//# sourceMappingURL=install_prerequisite.js.map