Reach self-signed hubs with the remote's CA (0.7.0) 5888949525ec

// A hub with a self-signed certificate: plain fetch refuses it, and the

// fetch that trusts the remote's CA file reaches it.

import { test } from "node:test";

import assert from "node:assert/strict";

import { execFileSync } from "node:child_process";

import { mkdtempSync, readFileSync } from "node:fs";

import { createServer } from "node:https";

import { tmpdir } from "node:os";

import { join } from "node:path";

import { fetchTrusting, HubClient } from "../out/hub.mjs";

test("a self-signed hub is reached with its CA file", async () => {

  const dir = mkdtempSync(join(tmpdir(), "hubtls-"));

  const key = join(dir, "key.pem");

  const cert = join(dir, "cert.pem");

  execFileSync("openssl", ["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-keyout", key, "-out", cert, "-days", "1", "-subj", "/CN=127.0.0.1", "-addext", "subjectAltName=IP:127.0.0.1"], { stdio: "ignore" });

  const server = createServer({ key: readFileSync(key), cert: readFileSync(cert) }, (req, res) => {

    let body = "";

    req.on("data", (c) => (body += c));

    req.on("end", () => {

      if (req.url === "/api/v1/user") {

        res.writeHead(200, { "content-type": "application/json" });

        res.end(JSON.stringify({ username: "andy", auth: req.headers.authorization ?? "" }));

      } else if (req.url === "/echo") {

        res.writeHead(201, { "content-type": "application/json" });

        res.end(JSON.stringify({ method: req.method, body }));

      } else {

        res.writeHead(204);

        res.end();

      }

    });

  });

  await new Promise((r) => server.listen(0, "127.0.0.1", r));

  const base = `https://127.0.0.1:${server.address().port}`;

  try {

    await assert.rejects(fetch(`${base}/api/v1/user`), "plain fetch does not trust it");

    const trusting = fetchTrusting(cert);

    const me = await new HubClient(base, "tok", trusting).me();

    assert.equal(me.username, "andy");

    assert.equal(me.auth, "Bearer tok", "headers go through");

    const echo = await trusting(`${base}/echo`, { method: "POST", body: '{"a":1}', headers: { "content-type": "application/json" } });

    assert.equal(echo.status, 201);

    assert.deepEqual(await echo.json(), { method: "POST", body: '{"a":1}' });

    assert.equal((await trusting(`${base}/other`)).status, 204);

    await assert.rejects(fetchTrusting(join(dir, "missing.pem"))(`${base}/api/v1/user`), /cannot read the hub's CA file/);

  } finally {

    server.close();

  }

});

## 0.7.0 (2026-09-29)

- **Self-signed hubs work.** "OxygenHub: fetch failed" came from calling a hub whose certificate is self-signed (Earth's) with plain `fetch`, which does not trust it. The extension now uses the CA file the checkout's remote names (`remote.NAME.ca`, as `oxy` does), or one from the new `oxygenhub.caFiles` setting. It needs Oxygen extension 0.13 for the remote's CA.

| `oxygenhub.caFiles` | `{}` | CA certificate files for hubs with self-signed certificates, by base URL. A checkout whose remote names a CA (`remote.NAME.ca`, which `oxy` uses too) needs no entry: the extension takes it from the remote. |

  "version": "0.7.0",

        },

        "oxygenhub.caFiles": {

          "type": "object",

          "additionalProperties": {

            "type": "string"

          },

          "default": {},

          "description": "CA certificate files for hubs with self-signed certificates, by base URL, e.g. {\"https://earth.example:7343\": \"~/.config/oxy/earth-ca.pem\"}. Checkouts whose remote names a CA (remote.NAME.ca) need no entry."

import { fetchTrusting, HubClient, Session } from "./hub";

  /** CA files for hubs with self-signed certificates, learnt from remotes. */

  private readonly cas = new Map<string, string>();

    const b = base.replace(/\/$/, "");

    return new HubClient(b, this.sessionFor(b)?.token, this.fetchFor(b));

  }

  /** Remember the CA file a remote names for a hub (`remote.NAME.ca`). */

  setCa(base: string, caFile: string): void {

    this.cas.set(base.replace(/\/$/, ""), caFile);

  /** How to reach a hub: trusting its CA file when one is known (from a

   * checkout's remote, or the `oxygenhub.caFiles` setting), else plain fetch. */

  fetchFor(base: string): typeof fetch {

    const configured = vscode.workspace.getConfiguration("oxygenhub").get<Record<string, string>>("caFiles") ?? {};

    const ca = this.cas.get(base) ?? configured[base] ?? configured[`${base}/`];

    return ca ? fetchTrusting(ca) : fetch;

  }

    const client = new HubClient(base.replace(/\/$/, ""), token, this.fetchFor(base.replace(/\/$/, "")));

      if (m && remote.ca) {

        auth.setCa(m[1], remote.ca);

      }

import { readFileSync } from "node:fs";

import * as http from "node:http";

import * as https from "node:https";

import * as tls from "node:tls";

}

/**

 * A `fetch` that also trusts the CA certificate in `caFile`, for a hub with a

 * self-signed certificate (Node's `fetch` takes no CA). The file is read on

 * each request, so a renewed certificate needs no reload.

 */

export function fetchTrusting(caFile: string): typeof fetch {

  return ((input: string | URL | Request, init?: RequestInit) =>

    new Promise<Response>((resolve, reject) => {

      const url = new URL(typeof input === "string" || input instanceof URL ? input : input.url);

      const secure = url.protocol === "https:";

      let ca: string[] | undefined;

      if (secure) {

        try {

          ca = [...tls.rootCertificates, readFileSync(caFile, "utf8")];

        } catch (e) {

          reject(new Error(`cannot read the hub's CA file ${caFile}: ${(e as Error).message}`));

          return;

        }

      }

      const headers: Record<string, string> = {};

      new Headers(init?.headers).forEach((v, k) => (headers[k] = v));

      const req = (secure ? https : http).request(url, { method: init?.method ?? "GET", headers, ca }, (res) => {

        const chunks: Buffer[] = [];

        res.on("data", (c: Buffer) => chunks.push(c));

        res.on("error", reject);

        res.on("end", () => {

          const status = res.statusCode ?? 0;

          const out = new Headers();

          for (const [k, v] of Object.entries(res.headers)) {

            if (v !== undefined) {

              out.set(k, Array.isArray(v) ? v.join(", ") : String(v));

            }

          }

          const empty = status === 204 || status === 304;

          resolve(new Response(empty ? null : Buffer.concat(chunks), { status, headers: out }));

        });

      });

      req.on("error", (e) => reject(Object.assign(new Error(`fetch failed: ${e.message}`), { cause: e })));

      if (init?.body !== undefined && init.body !== null) {

        req.write(typeof init.body === "string" ? init.body : Buffer.from(init.body as ArrayBuffer));

      }

      req.end();

    })) as typeof fetch;

  /** With the CA file each names for a self-signed hub (Oxygen extension 0.13+). */

  remotes(): Promise<{ name: string; url: string; ca?: string }[]>;

    let remotes: { name: string; url: string; ca?: string }[] = [];

      if (p && r.ca) {

        auth.setCa(p.base, r.ca);

      }