github / github/vscode-github-actions

Respect the OS certificate store

未关闭
#39 18 条评论 14 个 reaction 已指派 0 人 在 GitHub 查看
bug
主要语言
TypeScript
星标
660
派生
213
PR 合并指标
30 天内没有已合并 PR

描述

**Describe the bug**
The "GitHub Actions language server" doesn't use Root certificates installed on Windows, so incompatible with an SSL-inspecting firewall.

Most other extensions in VSCode work just fine and are able to access HTTPS endpoints correctly. I presume they use a different API.

**To Reproduce**
1. Be in an enterprise environment with an SSL-inspecting/MITM firewall that uses certificates issued by an internal CA.
2. Open any workflow yml file
3. In the ouptuts:
```
Failure to retrieve username: Os [HttpError]: request to https://api.github.com/user failed, reason: self signed certificate in certificate chain
at c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2783247
at process.processTicksAndRejections (node:internal/process/task_queues:96:5)
at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855206
at async fa.get (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2865045)
at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855141
at async aa (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855108)
at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2858843
at async Object.getContext (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2858799)
at async ni (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2732594)
at async ln (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2757296) {
status: 500,
request: {
method: 'GET',
url: 'https://api.github.com/user',
headers: {
accept: 'application/vnd.github.v3+json',
'user-agent': 'VS Code GitHub Actions (0.25.2) octokit-rest.js/19.0.7 octokit-core.js/4.1.0 Node.js/16.14.2 (win32; x64)',
authorization: 'token [REDACTED]'
},
request: { hook: [Function: bound bound e] }
}
}
```

**Expected behavior**
Certificates trusted by Windows are accepted.

**Extension Version**
`v0.25.2`

**Additional context**
I wonder if it's HSTS?

贡献指南

打开贡献指南

调研方向

从 server-node.js 堆栈跟踪中显示的对 https://api.github.com/user 的 HTTPS 请求开始,并使用由内部 CA 签发的证书在 Windows 上重现该请求。跟踪扩展如何处理该请求,并验证 Windows 信任的证书能够在没有 self-signed-certificate 错误的情况下被接受。

由索引模型根据 Issue 内容生成。

评估

技术栈
node.js, typescript, vscode
领域
devtools, networking
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。