Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: replace node-forge with @peculiar/x509 #8584

Closed
wants to merge 2 commits into from

Conversation

winderica
Copy link

@winderica winderica commented Jun 14, 2022

Description

This PR replaces node-forge with @peculiar/x509 as discussed in #8532 in order to reduce the bundle size.

Additional context

I don't have a Windows development environment, but it seems that the reason why this CI task fails is irrelevant to this PR.


What is the purpose of this pull request?

  • Bug fix
  • New Feature
  • Documentation update
  • Other

Before submitting the PR, please make sure you do the following

  • Read the Contributing Guidelines.
  • Read the Pull Request Guidelines and follow the Commit Convention.
  • Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
  • Provide a description in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).
  • Ideally, include relevant tests that fail without this PR but pass with it.

Comment on lines +22 to +26
const signingAlgorithm = {
name: 'ECDSA',
namedCurve: 'P-256',
hash: 'SHA-256'
}
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ECDSA produces much shorter keys than RSA while achieving the same security level. Also, ECDSA certificates are supported by all the modern browsers (source).

extensions: [
new SubjectAlternativeNameExtension({
dns: ['localhost', 'localhost.localdomain', 'lvh.me', '*.lvh.me'],
ip: ['127.0.0.1', '::1']
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fe80::1 has been replaced with ::1 here, because the former is a link-local address rather than a loopback address.

signingKey: privateKey,
extensions: [
new SubjectAlternativeNameExtension({
dns: ['localhost', 'localhost.localdomain', 'lvh.me', '*.lvh.me'],
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[::1] is removed since it isn't a valid hostname.

@TrySound
Copy link
Contributor

Is webcrypto polyfill required by the library or used only to generate private keys?

@winderica
Copy link
Author

winderica commented Jun 15, 2022

Is webcrypto polyfill required by the library or used only to generate private keys?

It is required by the library, which needs a crypto provider that is compatible with WebCrypto API.

Fortunately, Node.js >= 15 has native support for WebCrypto, so we can remove the polyfill once Node 14 reaches its EOL.

@bluwy
Copy link
Member

bluwy commented Jul 23, 2022

We've removed node-forge in Vite 3 and moved to https://github.com/vitejs/vite-plugin-basic-ssl. It's also recommended now to manually generate the certificate, so the plugin is only now used as a convenience or as part of the migration. I'll close this for the reasons, but thanks again for implementing this alternative!

@bluwy bluwy closed this Jul 23, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants