Export injectSystemCAs and used in main/renderer

Signed-off-by: Hung-Han (Henry) Chen <chenhungh@gmail.com>

src/common/system-ca.ts

@@ -28,17 +28,17 @@ import { promiseExec } from "./utils/promise-exec";
 // DST Root CA X3, which was expired on 9.30.2021
 export const DSTRootCAX3 = "-----BEGIN CERTIFICATE-----\nMIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/\nMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT\nDkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow\nPzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD\nEw5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\nAN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O\nrz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq\nOLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b\nxiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw\n7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD\naeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV\nHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG\nSIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69\nikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr\nAvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz\nR8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5\nJDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo\nOb8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ\n-----END CERTIFICATE-----\n";
 
-export const isCertActive = (cert: string) => {
+export function isCertActive (cert: string) {
   const isExpired = typeof cert !== "string" || cert.includes(DSTRootCAX3);
 
   return !isExpired;
-};
+}
 
 /**
  * Get root CA certificate from MacOSX system keychain
  * Only return non-expred certificates.
  */
-export const getMacRootCA = async () => {
+export async function getMacRootCA () {
   // inspired mac-ca https://github.com/jfromaniello/mac-ca
   const args = "find-certificate -a -p";
   // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions/Cheatsheet#other_assertions
@@ -49,13 +49,13 @@ export const getMacRootCA = async () => {
   const rootCA = (await promiseExec(`${bin} ${args} ${systemRootCertsPath}`)).stdout.toString().split(splitPattern);
 
   return [...new Set([...trusted, ...rootCA])].filter(isCertActive);
-};
+}
 
 /**
  * Get root CA certificate from Windows system certificate store.
  * Only return non-expred certificates.
  */
-export const getWinRootCA = (): Promise<string[]> => {
+export function getWinRootCA (): Promise<string[]> {
   return new Promise((resolve) => {
     const CAs: string[] = [];
 
@@ -70,12 +70,13 @@ export const getWinRootCA = (): Promise<string[]> => {
       }
     });
   });
-};
+}
+
 
 /**
  * Add (or merge) CAs to https.globalAgent.options.ca
  */
-export const injectCAs = (CAs: string[]) => {
+export function injectCAs (CAs: string[]) {
   for (const cert of CAs) {
     if (Array.isArray(https.globalAgent.options.ca) && !https.globalAgent.options.ca.includes(cert)) {
       https.globalAgent.options.ca.push(cert);
@@ -83,20 +84,30 @@ export const injectCAs = (CAs: string[]) => {
       https.globalAgent.options.ca = [cert];
     }
   }
-};
-
-if (isMac) {
-  getMacRootCA().then((osxRootCAs) => {
-    injectCAs(osxRootCAs);
-  }).catch((error) => {
-    console.warn(`[MAC-CA]: Error injecting root CAs from MacOSX. ${error?.message}`);
-  });
 }
 
-if (isWindows) {
-  getWinRootCA().then((winRootCAs) => {
-    wincaAPI.inject("+", winRootCAs);
-  }).catch((error) => {
-    console.warn(`[WIN-CA]: Error injecting root CAs from Windows. ${error?.message}`);
-  });
+/**
+ * Inject CAs found in OS's (Windoes/MacOSX only) root certificate store to https.globalAgent.options.ca
+ */
+export async function injectSystemCAs () {
+  if (isMac) {
+    try {
+      const osxRootCAs = await getMacRootCA();
+
+      injectCAs(osxRootCAs);
+    } catch (error) {
+      console.warn(`[MAC-CA]: Error injecting root CAs from MacOSX. ${error?.message}`);
+    }
+  }
+  
+  if (isWindows) {
+    try {
+      const winRootCAs = await getWinRootCA();
+
+      wincaAPI.inject("+", winRootCAs);
+
+    } catch (error) {
+      console.warn(`[WIN-CA]: Error injecting root CAs from Windows. ${error?.message}`);
+    }
+  }
 }

src/main/index.ts

@@ -21,7 +21,7 @@
 
 // Main process
 
-import "../common/system-ca";
+import { injectSystemCAs } from "../common/system-ca";
 import { initialize as initializeRemote } from "@electron/remote/main";
 import * as Mobx from "mobx";
 import * as LensExtensionsCommonApi from "../extensions/common-api";
@@ -121,6 +121,8 @@ app.on("second-instance", (event, argv) => {
 });
 
 app.on("ready", async () => {
+  await injectSystemCAs();
+  
   logger.info(`🚀 Starting ${productName} from "${AppPaths.get("exe")}"`);
   logger.info("🐚 Syncing shell environment");
   await shellSync();

src/renderer/lens-app.tsx

@@ -19,7 +19,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
 
-import "../common/system-ca";
+import { injectSystemCAs } from "../common/system-ca";
 import React from "react";
 import { Route, Router, Switch } from "react-router";
 import { observer } from "mobx-react";
@@ -42,6 +42,7 @@ import { unmountComponentAtNode } from "react-dom";
 @observer
 export class LensApp extends React.Component {
   static async init(rootElem: HTMLElement) {
+    await injectSystemCAs();
     catalogEntityRegistry.init();
     ExtensionLoader.getInstance().loadOnClusterManagerRenderer();
     LensProtocolRouterRenderer.createInstance().init();