Merge pull request #3504 from github/mbg/ff/remove-ImprovedProxyCertificates

Remove FF gate for improved CA generation

lib/analyze-action-post.js

@@ -161589,11 +161589,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

lib/analyze-action.js

@@ -107701,11 +107701,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

lib/autobuild-action.js

@@ -103990,11 +103990,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

lib/init-action-post.js

@@ -165086,11 +165086,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

lib/init-action.js

@@ -105219,11 +105219,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

lib/resolve-environment-action.js

@@ -103981,11 +103981,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

lib/setup-codeql-action.js

@@ -103890,11 +103890,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

lib/start-proxy-action-post.js

@@ -160995,11 +160995,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

lib/start-proxy-action.js

@@ -120682,11 +120682,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",
@@ -121838,7 +121833,8 @@ var CERT_SUBJECT = [
     value: "San Francisco"
   }
 ];
-var extraExtensions = [
+var allExtensions = [
+  { name: "basicConstraints", cA: true },
   {
     name: "keyUsage",
     critical: true,
@@ -121849,7 +121845,7 @@ var extraExtensions = [
   { name: "subjectKeyIdentifier" },
   { name: "authorityKeyIdentifier", keyIdentifier: true }
 ];
-function generateCertificateAuthority(newCertGenFF) {
+function generateCertificateAuthority() {
   const keys = import_node_forge.pki.rsa.generateKeyPair(KEY_SIZE);
   const cert = import_node_forge.pki.createCertificate();
   cert.publicKey = keys.publicKey;
@@ -121861,16 +121857,8 @@ function generateCertificateAuthority(newCertGenFF) {
   );
   cert.setSubject(CERT_SUBJECT);
   cert.setIssuer(CERT_SUBJECT);
-  const extensions = [{ name: "basicConstraints", cA: true }];
-  if (newCertGenFF) {
-    extensions.push(...extraExtensions);
-  }
-  cert.setExtensions(extensions);
-  if (newCertGenFF) {
+  cert.setExtensions(allExtensions);
   cert.sign(keys.privateKey, import_node_forge.md.sha256.create());
-  } else {
-    cert.sign(keys.privateKey);
-  }
   const pem = import_node_forge.pki.certificateToPem(cert);
   const key = import_node_forge.pki.privateKeyToPem(keys.privateKey);
   return { cert: pem, key };
@@ -122147,9 +122135,7 @@ async function run(startedAt) {
         );
       }
     }
-    const ca = generateCertificateAuthority(
-      await features.getValue("improved_proxy_certificates" /* ImprovedProxyCertificates */)
-    );
+    const ca = generateCertificateAuthority();
     const proxyConfig = {
       all_credentials: credentials,
       ca

lib/upload-lib.js

@@ -107149,11 +107149,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

lib/upload-sarif-action-post.js

@@ -161157,11 +161157,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

lib/upload-sarif-action.js

@@ -106874,11 +106874,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
-  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: void 0
-  },
   ["java_network_debugging" /* JavaNetworkDebugging */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

src/feature-flags.ts

@@ -47,7 +47,6 @@ export enum Feature {
   ExportDiagnosticsEnabled = "export_diagnostics_enabled",
   ForceNightly = "force_nightly",
   IgnoreGeneratedFiles = "ignore_generated_files",
-  ImprovedProxyCertificates = "improved_proxy_certificates",
   JavaNetworkDebugging = "java_network_debugging",
   OverlayAnalysis = "overlay_analysis",
   OverlayAnalysisActions = "overlay_analysis_actions",
@@ -177,11 +176,6 @@ export const featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: undefined,
   },
-  [Feature.ImprovedProxyCertificates]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
-    minimumVersion: undefined,
-  },
   [Feature.JavaNetworkDebugging]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",

src/start-proxy-action.ts

@@ -90,9 +90,7 @@ async function run(startedAt: Date) {
       }
     }
 
-    const ca = generateCertificateAuthority(
-      await features.getValue(Feature.ImprovedProxyCertificates),
-    );
+    const ca = generateCertificateAuthority();
 
     const proxyConfig: ProxyConfig = {
       all_credentials: credentials,

src/start-proxy/ca.test.ts

@@ -32,33 +32,7 @@ function checkCertAttributes(
 }
 
 test("generateCertificateAuthority - generates certificates", (t) => {
-  const result = ca.generateCertificateAuthority(false);
-  const cert = pki.certificateFromPem(result.cert);
-  const key = pki.privateKeyFromPem(result.key);
-
-  t.truthy(cert);
-  t.truthy(key);
-
-  checkCertAttributes(t, cert);
-
-  // Check the validity.
-  t.true(
-    cert.validity.notBefore <= new Date(),
-    "notBefore date is in the future",
-  );
-  t.true(cert.validity.notAfter > new Date(), "notAfter date is in the past");
-
-  // Check that the extensions are set as we'd expect.
-  const exts = cert.extensions as ca.Extension[];
-  t.is(exts.length, 1);
-  t.is(exts[0].name, "basicConstraints");
-  t.is(exts[0].cA, true);
-
-  t.truthy(cert.siginfo);
-});
-
-test("generateCertificateAuthority - generates certificates with FF", (t) => {
-  const result = ca.generateCertificateAuthority(true);
+  const result = ca.generateCertificateAuthority();
   const cert = pki.certificateFromPem(result.cert);
   const key = pki.privateKeyFromPem(result.key);
 

src/start-proxy/ca.ts

@@ -37,7 +37,8 @@ export type Extension = {
   [key: string]: unknown;
 };
 
-const extraExtensions: Extension[] = [
+const allExtensions: Extension[] = [
+  { name: "basicConstraints", cA: true },
   {
     name: "keyUsage",
     critical: true,
@@ -52,12 +53,9 @@ const extraExtensions: Extension[] = [
 /**
  * Generates a CA certificate for the proxy.
  *
- * @param newCertGenFF Whether to use the updated certificate generation.
  * @returns The private and public keys.
  */
-export function generateCertificateAuthority(
-  newCertGenFF: boolean,
-): CertificateAuthority {
+export function generateCertificateAuthority(): CertificateAuthority {
   const keys = pki.rsa.generateKeyPair(KEY_SIZE);
   const cert = pki.createCertificate();
   cert.publicKey = keys.publicKey;
@@ -71,21 +69,11 @@ export function generateCertificateAuthority(
   cert.setSubject(CERT_SUBJECT);
   cert.setIssuer(CERT_SUBJECT);
 
-  const extensions: Extension[] = [{ name: "basicConstraints", cA: true }];
+  // Set the CA extensions for the certificate.
+  cert.setExtensions(allExtensions);
 
-  // Add the extra CA extensions if the FF is enabled.
-  if (newCertGenFF) {
-    extensions.push(...extraExtensions);
-  }
-
-  cert.setExtensions(extensions);
-
-  // Specifically use SHA256 when the FF is enabled.
-  if (newCertGenFF) {
+  // Specifically use SHA256 to ensure consistency and compatibility.
   cert.sign(keys.privateKey, md.sha256.create());
-  } else {
-    cert.sign(keys.privateKey);
-  }
 
   const pem = pki.certificateToPem(cert);
   const key = pki.privateKeyToPem(keys.privateKey);