Skip to content

Commit 147e3d3

Browse files
rvaggrvagg
committed
fix: new ca & server certs, bundle in .js file and unpack for testing
bundling in certs.js rather than including the raw files should avoid some false positives that low-quality security scanners keep on complaining about.
1 parent bf81cd4 commit 147e3d3

File tree

6 files changed

+167
-116
lines changed

6 files changed

+167
-116
lines changed

‎test/fixtures/ca-bundle.crt

Lines changed: 0 additions & 40 deletions
This file was deleted.

‎test/fixtures/ca.crt

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎test/fixtures/certs.js

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
module.exports['ca.key'] = `
2+
-----BEGIN RSA PRIVATE KEY-----
3+
MIIEowIBAAKCAQEAtTbG0k2UFUyCdZuip0TTEtXRHh57qosegrpHPBreSNTxt7OT
4+
KfOUZp2rToTHeN9w0ZbV2eKRI5AuFx8Cmlm73/KIHKzSNTBATGMeeHnGaxvL/W/s
5+
KJdTDRNf7/qCXHQ+gsuEWWCFzOZuHmmAQa2IBX2HAQTqXJI8+2iJ9gytFfJLxjqy
6+
6O4u9ugZVHSyQJWs49tGRcWMlNm7EMStADFvJn3S11xe/kwIA2mSI/eddDnzL0Mx
7+
AkR9dQBL66xOABLL5v3QQdhipfHluX6HLbDd/1YsFTuOpgvLRlr72rTAFrQZCokV
8+
hXPiqstn5zJFW5arHakvMR0+OPaICF5feh/4qQIDAQABAoIBAHWg6exnWUF+GY0Y
9+
CrwDS/QFASpI5UNt7M809bqJQlMKjyEMmvF3YJQ/soxUWlsWx1f1TjmR/V6VX6W4
10+
hmsE5pRXDY13jTfja0lqacQQYAD02TRY63XpzIpHUlYnSWmUN2OVkgKmShQYW9C3
11+
8P4xE4Nk2TaLJ0oRzy3uzOb/kXcVaJfknBRUnOhuaTSs+w4l4pPXueYA7xuHgVsL
12+
Qq0S4kK+PmdwCMB7gzlAAQhCM3vQ1U4cjC9JIIKSmPy7BcvD0kBfVPIFQ2byGpA1
13+
VkWBLSyeig0YxA5oIshK5cLiDIfBIiCSEzm4AMhVhGf0tbGEwiPljxKjbarYUUIi
14+
ATMk83UCgYEA7kKeOveuPbMqxmT42swfa9OU5jLUjH+VExU0Kv3BbEjv/OGt0fac
15+
/cs1Ze3vnrtCHudVajocFjydb8B4c62DbA4/T+LcUw/HaMaORbOoICQidi/zZ1Lj
16+
gjg8Ip2WKXEhSAwqUpaFd6w16NZOxiTh+NDaRKywwbe8j57eDH4uR6MCgYEAwrTS
17+
q5ra6+WDGUFMs0y3GMbL8j14PGhxBQBYSTM//NysI+EM6eeKn1cV3BbphEw//jgE
18+
0pVokkjvLAQWWEG2dZyRxRE3YAMgOAIPx5zbJCim3iBVuoqY9ckLg2jF8Fqqubsb
19+
3Rf2/Xzn/rFqsXdhsjGcJpdN66T9aEjwEkAnc0MCgYA5cOYk4UGormFJo147oaqR
20+
nFjxhp+nn7qY9yu0kajoKk1xchct337J0Qv2nv5+DjdKrArzqT7MPaDXKFfhy5s7
21+
mdO5tr/XZp50rCnws/d8iDmmtLjB2EHxSw10avmg1B1p+UTa1F8pEuOMVt529r1j
22+
9zYoCFo02c8j8PEnoeQWcQKBgQCVBCuQZu5SSM/zTkTTnU0sy0lf1qflI9IMD92B
23+
+JVqg8HDnAR0KF+x38a9MVP7ixgXCuy19t+XxfY269HmLjTlArWV671D4GCSPRGy
24+
plwZ6nr72ieCo3y57+q94jxL3jh3+bozlpnUG/q6tTKBLGs7JDjsWDSsuxOu8tO6
25+
RBttXQKBgB6LQFOTjDMfsFHKsnQXFUZId3GG/iLg3WCWxEo88T5Rq3JIR0zDpW8H
26+
cKhl/sPY+JVHsxizNCMPtp7Hn7GrB6D/v9LbO0jpG2U0BFiJ6zhiDopbP9B0EAW4
27+
5JJ+JGKRKoCxs3DmSVyns0gU4j4rVte97UWyVy5TZ8Acr/qrgOA1
28+
-----END RSA PRIVATE KEY-----
29+
`
30+
31+
module.exports['ca.crt'] = `
32+
-----BEGIN CERTIFICATE-----
33+
MIIDmzCCAoOgAwIBAgIUDA0GrvcnG41XT6LYFeNwvq8YV1UwDQYJKoZIhvcNAQEL
34+
BQAwXTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRAwDgYDVQQKDAdOb2RlLmpz
35+
MREwDwYDVQQLDAhub2RlLWd5cDEcMBoGA1UEAwwTbm9kZS1neXAubm9kZWpzLm9y
36+
ZzAeFw0yMjA1MTEwNDIyMjRaFw00OTA5MjUwNDIyMjRaMF0xCzAJBgNVBAYTAlVT
37+
MQswCQYDVQQIDAJDQTEQMA4GA1UECgwHTm9kZS5qczERMA8GA1UECwwIbm9kZS1n
38+
eXAxHDAaBgNVBAMME25vZGUtZ3lwLm5vZGVqcy5vcmcwggEiMA0GCSqGSIb3DQEB
39+
AQUAA4IBDwAwggEKAoIBAQC1NsbSTZQVTIJ1m6KnRNMS1dEeHnuqix6Cukc8Gt5I
40+
1PG3s5Mp85RmnatOhMd433DRltXZ4pEjkC4XHwKaWbvf8ogcrNI1MEBMYx54ecZr
41+
G8v9b+wol1MNE1/v+oJcdD6Cy4RZYIXM5m4eaYBBrYgFfYcBBOpckjz7aIn2DK0V
42+
8kvGOrLo7i726BlUdLJAlazj20ZFxYyU2bsQxK0AMW8mfdLXXF7+TAgDaZIj9510
43+
OfMvQzECRH11AEvrrE4AEsvm/dBB2GKl8eW5foctsN3/ViwVO46mC8tGWvvatMAW
44+
tBkKiRWFc+Kqy2fnMkVblqsdqS8xHT449ogIXl96H/ipAgMBAAGjUzBRMB0GA1Ud
45+
DgQWBBT6LcYYABEOAMv4hI/5bC82rGlD/DAfBgNVHSMEGDAWgBT6LcYYABEOAMv4
46+
hI/5bC82rGlD/DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQA9
47+
D+qoKw0njub+NaFRS2DFbSiKb5JKTxVjU5aNusFONFLSXBuRpnYyjjkXpJy8JMWz
48+
g8GFDEPP6kiSb8xaPNrFcUzb4PFzJabNTuaLJpBpd2gNBj5AeYwwpRa2DPv/b4yw
49+
y2mfULuCWS09ZAguI2OcaARlAsFxYN0IuQ6pN1AvGFGee67ve9l2VF/hhwEi4lCk
50+
MM0CWlP6COJ8TX7X0MTtexVOgo9m3hBuTSYEZClYFIdSOk10xkPl8Y3Iz/x6mzfK
51+
Uu2l2ZtYvSdAX1CQMds3ZWt0ChNNEjOKPv4g2QSDhGkiqrmi4wUS81g68wKqOpqn
52+
GbN8uKxIfyMjqZKaujPR
53+
-----END CERTIFICATE-----
54+
`
55+
56+
module.exports['server.key'] = `
57+
-----BEGIN RSA PRIVATE KEY-----
58+
MIIEpAIBAAKCAQEAvPM99BkYrBcTM355dhz4XzhSDRGxa9qttUlBSgEsbu2UjsRm
59+
XjDS+60XXd66tWpPwLeUd2uvlC/ltv5ekv+EBu35j1KfA1+K1rtFzb1i40kMCsns
60+
OoXjgpsN2wvkxMdFkT2bkqKCS6X0xzlWea1t4poKh9iG7n3otk4RzPNawfwQ9W5n
61+
o9/8i6AUwDbuK4dhAId/Inw2aKrMyQ+AiSvsDM2wUMq+pV7nP46f7MhR4xiGz14z
62+
ATFdjM3Oo/1NKrr0WgVM6i0eNAtuIDqIs8YE7SfODe/SzpJySxewutfYi62OaLh/
63+
hmWByj/pF5SoNMLyJHxn4GyKK+Qle9NJAThLiwIDAQABAoIBAQCZs4h/Cvct7etZ
64+
pRUqxnAoDQl5xh28LXvGj1uD1qaNacfBxvO6xR6rSedLHcZlkqBjlTI5XqjJ85h6
65+
njrSevWsKWMrejsNpGetO1OSA+/wEVixYgY+qPEkKftAZ1Fl3O+zMRlfU8CHxuzy
66+
Lqsweap8fW/5h2JjmJp3ydPjE0aNqpQ+0LtYBBawKDIe2zPNOmTPwz3D8qJNQJKU
67+
Qdj08dO/vPZncllPagGvpqhfv4hMyNChr71eBbEFsi3O5VJxfZyj+fQG0DGocr/y
68+
sV54HtYk5j06wMxZFLQtaJn+1pOXquZMNwodSPnbrR/+CI1SZeB8N6VyqqOdmrDz
69+
5NbfGJiRAoGBAPrCuQxJwgc2MzpEtrXA4+1uuV8QWGy3+wNKxKw4lgyC7peXXrVK
70+
l9FkOOAPr8puPRABgDS9t6vo59BAP3Wrx0oJ9PA/Qn03WYLfJMepWqlK7ni9kS04
71+
5owRTduK7P190sp0m6iicsnchGSSOchECwB5UmtHysEFiuY0T+0pdNbjAoGBAMDl
72+
57lwZDfNTGGDxLQYVzbrXgKcD60DW9MhvH3uso6cw5NYs3tmENCh9D6YrCNN4PmL
73+
zdp4dKbOFoGJdy22TK31nrezUuNKSK+QKH2gsmNVI+a5QokNO1Cfk+PMLoOR5du2
74+
nwyVvzdaBwuXU4fhmwvLv/SCFNEJ0EgUILeMETE5AoGBAIwLXf9v3e3bJkb/gy8E
75+
mAbNVLez0D5/ja9r/WTVgW9hXFDLF/iVvS4TE/SGrj2WzYF35RsPbVmUDIrwpsBX
76+
/EfsQaA/JCn8VIBTkR31Bg4QLBjAfijMY22MaHgZIXv83lF1SE2o1ATKpCHqzFx9
77+
K8vK9e22PZUJPGaOhqjEA13TAoGAEPipSJFw38/6NmInfkjd84EFxmkAoBI5k/vV
78+
36aOoyl7s40MTYEPXavCF3fLPVfuwUXhmKUcbkiXhlIX4De3y15e1n66fjDc8EVY
79+
qqTmzQKCpBwMlI5Ld65yjoo6VW0SsiABIlRSfIY5NHXd7YiV4ZXNj6+aMUIRxyWu
80+
Mzfpk1ECgYBZw8lML+F8XbcmCLGYuicf0V/wgFaJr8nnPeW7AiQrv13Ju1ItEaC8
81+
Tz8F7OfC+FoUb0MGjXHKquDVBDs4xSuS+Ol+rlZEK68ALpm8sUgp6YjARYiXlprs
82+
6o4kN0P5F+DVU2SP6fo9zKLCxaTH9VAQ9C3VUViGAFLBt4DVDmj77g==
83+
-----END RSA PRIVATE KEY-----
84+
`
85+
86+
module.exports['server.crt'] = `
87+
-----BEGIN CERTIFICATE-----
88+
MIIDNzCCAh8CFBg1Ph5t5rBlAbCrEn/PexNy9WunMA0GCSqGSIb3DQEBCwUAMF0x
89+
CzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEQMA4GA1UECgwHTm9kZS5qczERMA8G
90+
A1UECwwIbm9kZS1neXAxHDAaBgNVBAMME25vZGUtZ3lwLm5vZGVqcy5vcmcwHhcN
91+
MjIwNTExMDQyMjI0WhcNMjMwOTIzMDQyMjI0WjBTMQswCQYDVQQGEwJVUzELMAkG
92+
A1UECAwCQ0ExEDAOBgNVBAoMB05vZGUuanMxETAPBgNVBAsMCG5vZGUtZ3lwMRIw
93+
EAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
94+
AQC88z30GRisFxMzfnl2HPhfOFINEbFr2q21SUFKASxu7ZSOxGZeMNL7rRdd3rq1
95+
ak/At5R3a6+UL+W2/l6S/4QG7fmPUp8DX4rWu0XNvWLjSQwKyew6heOCmw3bC+TE
96+
x0WRPZuSooJLpfTHOVZ5rW3imgqH2Ibufei2ThHM81rB/BD1bmej3/yLoBTANu4r
97+
h2EAh38ifDZoqszJD4CJK+wMzbBQyr6lXuc/jp/syFHjGIbPXjMBMV2Mzc6j/U0q
98+
uvRaBUzqLR40C24gOoizxgTtJ84N79LOknJLF7C619iLrY5ouH+GZYHKP+kXlKg0
99+
wvIkfGfgbIor5CV700kBOEuLAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAEhaNEye
100+
JsE4eG1xaGmHq7w9eV0neOaZ58XCuF1sSEMIy9uMnl3aOdctxh/1SYkqJyMct79q
101+
Ra2UZ6mauRlOeqdHb+HZKrFYYUOtd1HOWWJ44Gaya2EQMiTbd/Ns9Th2KTbTOCbL
102+
CHFNska9Ty2ioT7VcrVuIEXFPMua5T4lnCkNJQla800pHHOak2baN/c66Io+8XI2
103+
xiqaVrLT3qvpzdiiEjo4POeRnWMIgJJshy77Am5JlhaJiAqP1AHfh/tYpliGkjXF
104+
8DSgSoLHSQfalJ4VQvP4XLc/XnmF5Zt6bvwUxCllEBFRneU74bW7/euYX/TpYobr
105+
Y+YM7fGiCqwHdUs=
106+
-----END CERTIFICATE-----
107+
`
108+
109+
module.exports['ca-bundle.crt'] = `
110+
-----BEGIN CERTIFICATE-----
111+
MIIDJjCCAg4CAhnOMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAlVTMQswCQYD
112+
VQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEZMBcGA1UECgwQU3Ryb25n
113+
TG9vcCwgSW5jLjESMBAGA1UECwwJU3Ryb25nT3BzMRowGAYDVQQDDBFjYS5zdHJv
114+
bmdsb29wLmNvbTAeFw0xNTEyMDgyMzM1MzNaFw00MzA0MjQyMzM1MzNaMBkxFzAV
115+
BgNVBAMMDnN0cm9uZ2xvb3AuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
116+
CgKCAQEAwOYI7OZ2FX/YjRgLZoDQlbPc5UZXU/j0e1wwiJNPtPEax9Y5Uoza0Pnt
117+
Ikzkc2SfvQ+IJrhXo385tI0W5juuqbHnE7UrjUuPjUX6NHevkxcs/flmjan5wnZM
118+
cPsGhH71WDuUEEflvZihf2Se2x+xgZtMhc5XGmVmRuZFYKvkgUhA2/w8/QrK+jPT
119+
n9QRJxZjWNh2RBdC1B7u4jffSmOSUljYFH1I2eTeY+Rdi6YUIYSU9gEoZxsv3Tia
120+
SomfMF5jt2Mouo6MzA+IhLvvFjcrcph1Qxgi9RkfdCMMd+Ipm9YWELkyG1bDRpQy
121+
0iyHD4gvVsAqz1Y2KdRSdc3Kt+nTqwIDAQABoxkwFzAVBgNVHREEDjAMhwQAAAAA
122+
hwR/AAABMA0GCSqGSIb3DQEBBQUAA4IBAQAhy4J0hML3NgmDRHdL5/iTucBe22Mf
123+
jJjg2aifD1S187dHm+Il4qZNO2plWwAhN0h704f+8wpsaALxUvBIu6nvlvcMP5PH
124+
jGN5JLe2Km3UaPvYOQU2SgacLilu+uBcIo2JSHLV6O7ziqUj5Gior6YxDLCtEZie
125+
Ea8aX5/YjuACtEMJ1JjRqjgkM66XAoUe0E8onOK3FgTIO3tGoTJwRp0zS50pFuP0
126+
PsZtT04ck6mmXEXXknNoAyBCvPypfms9OHqcUIW9fiQnrGbS/Ri4QSQYj0DtFk/1
127+
na4fY1gf3zTHxH8259b/TOOaPfTnCEsOQtjUrWNR4xhmVZ+HJy4yytUW
128+
-----END CERTIFICATE-----
129+
-----BEGIN CERTIFICATE-----
130+
MIIDbzCCAlcCAmm6MA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYTAlVTMQswCQYD
131+
VQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEZMBcGA1UECgwQU3Ryb25n
132+
TG9vcCwgSW5jLjESMBAGA1UECwwJU3Ryb25nT3BzMRowGAYDVQQDDBFjYS5zdHJv
133+
bmdsb29wLmNvbTAeFw0xNTEyMDgyMzM1MzNaFw00MzA0MjQyMzM1MzNaMH0xCzAJ
134+
BgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEZ
135+
MBcGA1UECgwQU3Ryb25nTG9vcCwgSW5jLjESMBAGA1UECwwJU3Ryb25nT3BzMRow
136+
GAYDVQQDDBFjYS5zdHJvbmdsb29wLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
137+
ADCCAQoCggEBANfj86jkvvYDjHBgiqWhk9Cj+bqiMq3MqnV0CBO4iuK33Fo6XssE
138+
H+yVdXlIBFbFe6t655MdBVOR2Sfj7WqNh96vhu6PyDHiwcQlTaiLU6nhIed1J4Wv
139+
lvnJHFmp8Wbtx5AgLT4UYu03ftvXEl2DLi3vhSL2tRM1ebXHB/KPbRWkb25DPX0P
140+
foOHot3f2dgNe2x6kponf7E/QDmAu3s7Nlkfh+ryDhgGU7wocXEhXbprNqRqOGNo
141+
xbXgUI+/9XDxYT/7Gn5LF/fPjtN+aB0SKMnTsDhprVlZie83mlqJ46fOOrR+vrsQ
142+
mi/1m/TadrARtZoIExC/cQRdVM05EK4tUa8CAwEAATANBgkqhkiG9w0BAQsFAAOC
143+
AQEAQ7k5WhyhDTIGYCNzRnrMHWSzGqa1y4tJMW06wafJNRqTm1cthq1ibc6Hfq5a
144+
K10K0qMcgauRTfQ1MWrVCTW/KnJ1vkhiTOH+RvxapGn84gSaRmV6KZen0+gMsgae
145+
KEGe/3Hn+PmDVV+PTamHgPACfpTww38WHIe/7Ce9gHfG7MZ8cKHNZhDy0IAYPln+
146+
YRwMLd7JNQffHAbWb2CE1mcea4H/12U8JZW5tHCF6y9V+7IuDzqwIrLKcW3lG17n
147+
VUG6ODF/Ryqn3V5X+TL91YyXi6c34y34IpC7MQDV/67U7+5Bp5CfeDPWW2wVSrW+
148+
uGZtfEvhbNm6m2i4UNmpCXxUZQ==
149+
-----END CERTIFICATE-----
150+
`

‎test/fixtures/server.crt

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎test/fixtures/server.key

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎test/test-download.js

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ const devDir = require('./common').devDir()
1212
const rimraf = require('rimraf')
1313
const gyp = require('../lib/node-gyp')
1414
const log = require('npmlog')
15+
const certs = require('./fixtures/certs')
1516

1617
log.level = 'warn'
1718

@@ -40,12 +41,12 @@ test('download over http', async (t) => {
4041
test('download over https with custom ca', async (t) => {
4142
t.plan(3)
4243

43-
const cafile = path.join(__dirname, '/fixtures/ca.crt')
44-
const [cert, key, ca] = await Promise.all([
45-
fs.promises.readFile(path.join(__dirname, 'fixtures/server.crt'), 'utf8'),
46-
fs.promises.readFile(path.join(__dirname, 'fixtures/server.key'), 'utf8'),
47-
install.test.readCAFile(cafile)
48-
])
44+
const cafile = path.join(__dirname, 'fixtures/ca.crt')
45+
const cacontents = certs['ca.crt']
46+
const cert = certs['server.crt']
47+
const key = certs['server.key']
48+
await fs.promises.writeFile(cafile, cacontents, 'utf8')
49+
const ca = await install.test.readCAFile(cafile)
4950

5051
t.strictEqual(ca.length, 1)
5152

@@ -55,7 +56,10 @@ test('download over https with custom ca', async (t) => {
5556
res.end('ok')
5657
})
5758

58-
t.tearDown(() => new Promise((resolve) => server.close(resolve)))
59+
t.tearDown(async () => {
60+
await new Promise((resolve) => server.close(resolve))
61+
await fs.promises.unlink(cafile)
62+
})
5963

6064
server.on('clientError', (err) => { throw err })
6165

@@ -150,6 +154,12 @@ test('download with missing cafile', async (t) => {
150154
})
151155

152156
test('check certificate splitting', async (t) => {
157+
const cafile = path.join(__dirname, 'fixtures/ca-bundle.crt')
158+
const cacontents = certs['ca-bundle.crt']
159+
await fs.promises.writeFile(cafile, cacontents, 'utf8')
160+
t.tearDown(async () => {
161+
await fs.promises.unlink(cafile)
162+
})
153163
const cas = await install.test.readCAFile(path.join(__dirname, 'fixtures/ca-bundle.crt'))
154164
t.plan(2)
155165
t.strictEqual(cas.length, 2)

0 commit comments

Comments
 (0)