Gate updated cert gen behind FF

lib/analyze-action-post.js

@@ -161565,6 +161565,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

lib/analyze-action.js

@@ -107633,6 +107633,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

lib/autobuild-action.js

@@ -103966,6 +103966,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

lib/init-action-post.js

@@ -164959,6 +164959,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

lib/init-action.js

@@ -105166,6 +105166,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

lib/resolve-environment-action.js

@@ -103957,6 +103957,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

lib/setup-codeql-action.js

@@ -103867,6 +103867,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

lib/start-proxy-action-post.js

@@ -160971,6 +160971,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

lib/start-proxy-action.js

@@ -120659,6 +120659,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -121742,7 +121747,18 @@ var CERT_SUBJECT = [
     value: "San Francisco"
   }
 ];
-function generateCertificateAuthority() {
+var extraExtensions = [
+  {
+    name: "keyUsage",
+    critical: true,
+    keyCertSign: true,
+    cRLSign: true,
+    digitalSignature: true
+  },
+  { name: "subjectKeyIdentifier" },
+  { name: "authorityKeyIdentifier", keyIdentifier: true }
+];
+function generateCertificateAuthority(newCertGenFF) {
   const keys = import_node_forge.pki.rsa.generateKeyPair(KEY_SIZE);
   const cert = import_node_forge.pki.createCertificate();
   cert.publicKey = keys.publicKey;
@@ -121754,19 +121770,16 @@ function generateCertificateAuthority() {
   );
   cert.setSubject(CERT_SUBJECT);
   cert.setIssuer(CERT_SUBJECT);
-  cert.setExtensions([
+  const extensions = [{ name: "basicConstraints", cA: true }];
-    { name: "basicConstraints", cA: true },
+  if (newCertGenFF) {
-    {
+    extensions.push(...extraExtensions);
-      name: "keyUsage",
+  }
-      critical: true,
+  cert.setExtensions(extensions);
-      keyCertSign: true,
+  if (newCertGenFF) {
-      cRLSign: true,
+    cert.sign(keys.privateKey, import_node_forge.md.sha256.create());
-      digitalSignature: true
+  } else {
-    },
+    cert.sign(keys.privateKey);
-    { name: "subjectKeyIdentifier" },
+  }
-    { name: "authorityKeyIdentifier", keyIdentifier: true }
-  ]);
-  cert.sign(keys.privateKey, import_node_forge.md.sha256.create());
   const pem = import_node_forge.pki.certificateToPem(cert);
   const key = import_node_forge.pki.privateKeyToPem(keys.privateKey);
   return { cert: pem, key };
@@ -121892,7 +121905,9 @@ async function run(startedAt) {
       `Credentials loaded for the following registries:
  ${credentials.map((c) => credentialToStr(c)).join("\n")}`
     );
-    const ca = generateCertificateAuthority();
+    const ca = generateCertificateAuthority(
+      await features.getValue("improved_proxy_certificates" /* ImprovedProxyCertificates */)
+    );
     const proxyConfig = {
       all_credentials: credentials,
       ca

lib/upload-lib.js

@@ -107026,6 +107026,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

lib/upload-sarif-action-post.js

@@ -161133,6 +161133,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

lib/upload-sarif-action.js

@@ -106821,6 +106821,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: void 0
   },
+  ["improved_proxy_certificates" /* ImprovedProxyCertificates */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: void 0
+  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

src/feature-flags.ts

@@ -46,6 +46,7 @@ export enum Feature {
   DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
   ExportDiagnosticsEnabled = "export_diagnostics_enabled",
   IgnoreGeneratedFiles = "ignore_generated_files",
+  ImprovedProxyCertificates = "improved_proxy_certificates",
   OverlayAnalysis = "overlay_analysis",
   OverlayAnalysisActions = "overlay_analysis_actions",
   OverlayAnalysisCodeScanningActions = "overlay_analysis_code_scanning_actions",
@@ -167,6 +168,11 @@ export const featureConfig = {
     envVar: "CODEQL_ACTION_IGNORE_GENERATED_FILES",
     minimumVersion: undefined,
   },
+  [Feature.ImprovedProxyCertificates]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_IMPROVED_PROXY_CERTIFICATES",
+    minimumVersion: undefined,
+  },
   [Feature.OverlayAnalysis]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",

src/start-proxy-action.ts

@@ -76,7 +76,9 @@ async function run(startedAt: Date) {
         .join("\n")}`,
     );
 
-    const ca = generateCertificateAuthority();
+    const ca = generateCertificateAuthority(
+      await features.getValue(Feature.ImprovedProxyCertificates),
+    );
 
     const proxyConfig: ProxyConfig = {
       all_credentials: credentials,

src/start-proxy/ca.ts

@@ -32,7 +32,32 @@ const CERT_SUBJECT = [
   },
 ];
 
-export function generateCertificateAuthority(): CertificateAuthority {
+type Extension = {
+  name: string;
+  [key: string]: unknown;
+};
+
+const extraExtensions: Extension[] = [
+  {
+    name: "keyUsage",
+    critical: true,
+    keyCertSign: true,
+    cRLSign: true,
+    digitalSignature: true,
+  },
+  { name: "subjectKeyIdentifier" },
+  { name: "authorityKeyIdentifier", keyIdentifier: true },
+];
+
+/**
+ * Generates a CA certificate for the proxy.
+ *
+ * @param newCertGenFF Whether to use the updated certificate generation.
+ * @returns The private and public keys.
+ */
+export function generateCertificateAuthority(
+  newCertGenFF: boolean,
+): CertificateAuthority {
   const keys = pki.rsa.generateKeyPair(KEY_SIZE);
   const cert = pki.createCertificate();
   cert.publicKey = keys.publicKey;
@@ -45,19 +70,22 @@ export function generateCertificateAuthority(): CertificateAuthority {
 
   cert.setSubject(CERT_SUBJECT);
   cert.setIssuer(CERT_SUBJECT);
-  cert.setExtensions([
+
-    { name: "basicConstraints", cA: true },
+  const extensions: Extension[] = [{ name: "basicConstraints", cA: true }];
-    {
+
-      name: "keyUsage",
+  // Add the extra CA extensions if the FF is enabled.
-      critical: true,
+  if (newCertGenFF) {
-      keyCertSign: true,
+    extensions.push(...extraExtensions);
-      cRLSign: true,
+  }
-      digitalSignature: true,
+
-    },
+  cert.setExtensions(extensions);
-    { name: "subjectKeyIdentifier" },
+
-    { name: "authorityKeyIdentifier", keyIdentifier: true },
+  // Specifically use SHA256 when the FF is enabled.
-  ]);
+  if (newCertGenFF) {
-  cert.sign(keys.privateKey, md.sha256.create());
+    cert.sign(keys.privateKey, md.sha256.create());
+  } else {
+    cert.sign(keys.privateKey);
+  }
 
   const pem = pki.certificateToPem(cert);
   const key = pki.privateKeyToPem(keys.privateKey);