milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Move pipCaBundle to central location

Browse source
This commit is contained in:
Reinier Criel 2025-10-31 07:51:26 -07:00
parent b1c09c6ff1
commit c2a9cc2733
4 changed files with 12 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

2
packages/safe-chain/src/packagemanager/pip/runPipCommand.js
View file

@ -1,7 +1,7 @@
import { ui } from "../../environment/userInteraction.js"; import { ui } from "../../environment/userInteraction.js";
import { safeSpawn } from "../../utils/safeSpawn.js"; import { safeSpawn } from "../../utils/safeSpawn.js";
import { mergeSafeChainProxyEnvironmentVariables } from "../../registryProxy/registryProxy.js"; import { mergeSafeChainProxyEnvironmentVariables } from "../../registryProxy/registryProxy.js";
import { getCombinedCaBundlePath } from "./utils/pipCaBundle.js"; import { getCombinedCaBundlePath } from "../../registryProxy/certBundle.js";
export async function runPip(command, args) { export async function runPip(command, args) {
try { try {

4
packages/safe-chain/src/packagemanager/pip/runPipCommand.spec.js
View file

@ -28,8 +28,8 @@ describe("runPipCommand environment variable handling", () => {
}, },
}); });
// Mock pipCaBundle to return a test combined bundle path // Mock certBundle to return a test combined bundle path
mock.module("./utils/pipCaBundle.js", { mock.module("../../registryProxy/certBundle.js", {
namedExports: { namedExports: {
getCombinedCaBundlePath: () => "/tmp/test-combined-ca.pem", getCombinedCaBundlePath: () => "/tmp/test-combined-ca.pem",
}, },

6
packages/safe-chain/src/packagemanager/pip/utils/pipCaBundle.js → packages/safe-chain/src/registryProxy/certBundle.js
View file

@ -4,7 +4,7 @@ import path from "node:path";
import certifi from "certifi"; import certifi from "certifi";
import tls from "node:tls"; import tls from "node:tls";
import { X509Certificate } from "node:crypto"; import { X509Certificate } from "node:crypto";
import { getCaCertPath } from "../../../registryProxy/certUtils.js"; import { getCaCertPath } from "./certUtils.js";
/** /**
* Check if a PEM string contains only parsable cert blocks. * Check if a PEM string contains only parsable cert blocks.
@ -41,11 +41,11 @@ function isParsable(pem) {
let cachedPath = null; let cachedPath = null;
/** /**
* Build a combined CA bundle specifically for pip flows. * Build a combined CA bundle for Python and Node HTTPS flows.
* - Includes Safe Chain CA (for MITM of known registries) * - Includes Safe Chain CA (for MITM of known registries)
* - Includes Mozilla roots via npm `certifi` (public HTTPS) * - Includes Mozilla roots via npm `certifi` (public HTTPS)
* - Includes Node's built-in root certificates as a portable fallback * - Includes Node's built-in root certificates as a portable fallback
* */ */
export function getCombinedCaBundlePath() { export function getCombinedCaBundlePath() {
if (cachedPath && fs.existsSync(cachedPath)) return cachedPath; if (cachedPath && fs.existsSync(cachedPath)) return cachedPath;

12
packages/safe-chain/src/packagemanager/pip/utils/pipCaBundle.spec.js → packages/safe-chain/src/registryProxy/certBundle.spec.js
View file

@ -7,7 +7,7 @@ import tls from "node:tls";
// Utility to remove the generated bundle so the module rebuilds it on demand // Utility to remove the generated bundle so the module rebuilds it on demand
function removeBundleIfExists() { function removeBundleIfExists() {
const target = path.join(os.tmpdir(), "safe-chain-python-ca-bundle.pem"); const target = path.join(os.tmpdir(), "safe-chain-ca-bundle.pem");
try { try {
if (fs.existsSync(target)) fs.unlinkSync(target); if (fs.existsSync(target)) fs.unlinkSync(target);
} catch { } catch {
@ -15,7 +15,7 @@ function removeBundleIfExists() {
} }
} }
describe("pipCaBundle.getCombinedCaBundlePath", () => { describe("certBundle.getCombinedCaBundlePath", () => {
beforeEach(() => { beforeEach(() => {
mock.restoreAll(); mock.restoreAll();
removeBundleIfExists(); removeBundleIfExists();
@ -31,13 +31,13 @@ describe("pipCaBundle.getCombinedCaBundlePath", () => {
fs.writeFileSync(safeChainPath, `${marker}\n${rootPem}`, "utf8"); fs.writeFileSync(safeChainPath, `${marker}\n${rootPem}`, "utf8");
// Mock the certUtils.getCaCertPath to return our temp file // Mock the certUtils.getCaCertPath to return our temp file
mock.module("../../../registryProxy/certUtils.js", { mock.module("./certUtils.js", {
namedExports: { namedExports: {
getCaCertPath: () => safeChainPath, getCaCertPath: () => safeChainPath,
}, },
}); });
const { getCombinedCaBundlePath } = await import("./pipCaBundle.js"); const { getCombinedCaBundlePath } = await import("./certBundle.js");
const bundlePath = getCombinedCaBundlePath(); const bundlePath = getCombinedCaBundlePath();
assert.ok(fs.existsSync(bundlePath), "Bundle path should exist"); assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
const contents = fs.readFileSync(bundlePath, "utf8"); const contents = fs.readFileSync(bundlePath, "utf8");
@ -53,7 +53,7 @@ describe("pipCaBundle.getCombinedCaBundlePath", () => {
fs.writeFileSync(safeChainPath, invalidMarker, "utf8"); fs.writeFileSync(safeChainPath, invalidMarker, "utf8");
// Mock the certUtils.getCaCertPath to return our invalid file // Mock the certUtils.getCaCertPath to return our invalid file
mock.module("../../../registryProxy/certUtils.js", { mock.module("./certUtils.js", {
namedExports: { namedExports: {
getCaCertPath: () => safeChainPath, getCaCertPath: () => safeChainPath,
}, },
@ -61,7 +61,7 @@ describe("pipCaBundle.getCombinedCaBundlePath", () => {
// Ensure fresh build // Ensure fresh build
removeBundleIfExists(); removeBundleIfExists();
const { getCombinedCaBundlePath } = await import("./pipCaBundle.js"); const { getCombinedCaBundlePath } = await import("./certBundle.js");
const bundlePath = getCombinedCaBundlePath(); const bundlePath = getCombinedCaBundlePath();
assert.ok(fs.existsSync(bundlePath), "Bundle path should exist"); assert.ok(fs.existsSync(bundlePath), "Bundle path should exist");
const contents = fs.readFileSync(bundlePath, "utf8"); const contents = fs.readFileSync(bundlePath, "utf8");