✨ Add NODE_EXTRA_CA_CERT support for fetch

[ibolton336]

• Fix: Binary Download Failures Behind Corporate Firewalls/Proxies

Problem

Users behind corporate firewalls with SSL-inspecting proxies were experiencing binary download failures during extension activation:

UNABLE_TO_VERIFY_LEAF_SIGNATURE
UND_ERR_ABORTED
407 Proxy Authentication Required

Root Causes

1. No Proxy Support in Binary Downloads: The ensureKaiAnalyzerBinary() function in paths.ts was using plain fetch() without any proxy configuration, causing downloads to fail when users had HTTPS_PROXY environment variables set.

2. Custom CA Certificates Not Respected: When enterprises use SSL-inspecting proxies, they issue their own certificates. The download code wasn't loading custom CA certificates specified via NODE_EXTRA_CA_CERTS.

3. Proxy Authentication Ignored: Due to undici issue #1674, credentials in proxy URLs like http://username:[email protected]:8080 were being ignored, causing 407 Proxy Authentication Required errors.

Solution

1. Added Proxy Support to Binary Downloads (paths.ts)

• Import and use getDispatcherWithCertBundle() and getFetchWithDispatcher() from utilities/tls.ts
• Create a dispatcher that respects both HTTPS_PROXY environment variables and NODE_EXTRA_CA_CERTS
• Apply the dispatcher to both SHA256 checksum and binary downloads

Before:

const response = await fetch(downloadUrl);

After:

const certBundlePath = process.env.NODE_EXTRA_CA_CERTS;
const dispatcher = await getDispatcherWithCertBundle(certBundlePath, false, false);
const fetchWithDispatcher = getFetchWithDispatcher(dispatcher);
const response = await fetchWithDispatcher(downloadUrl);

2. Added Proxy Authentication Support (utilities/tls.ts)

Implemented the workaround from undici issue #1674 to handle credentials in proxy URLs:

• Parse proxy URL to extract username and password
• Base64 encode credentials
• Pass to ProxyAgent via the auth option

const parsedUrl = new URL(proxyUrl);
let auth: string | undefined;

if (parsedUrl.username || parsedUrl.password) {
  const credentials = `${parsedUrl.username}:${parsedUrl.password}`;
  auth = Buffer.from(credentials).toString('base64');
}

return new ProxyAgent({
  uri: proxyUrl,
  auth, // Proxy authentication now works!
  connect: {
    ca: allCerts,
    rejectUnauthorized: !insecure,
  },
});

Supported Proxy Configurations

This fix now supports:

✅ Explicit Proxy (most common):

export HTTPS_PROXY=http://proxy.company.com:8080
export NODE_EXTRA_CA_CERTS=/path/to/corporate-ca.pem

✅ Proxy with Authentication:

export HTTPS_PROXY=http://username:[email protected]:8080
export NODE_EXTRA_CA_CERTS=/path/to/corporate-ca.pem

✅ Transparent Proxy (WireGuard/network-level):

export NODE_EXTRA_CA_CERTS=/path/to/proxy-ca.pem
# No HTTPS_PROXY needed - traffic routes through proxy at network level

Impact

This fix resolves download failures for users in:

• Corporate environments with HTTP/HTTPS proxies
• Networks with SSL-inspecting firewalls
• Environments requiring custom CA certificates
• Proxies requiring authentication

Related Issues

• Fixes binary download failures with UNABLE_TO_VERIFY_LEAF_SIGNATURE
• Fixes UND_ERR_ABORTED errors behind proxies

Files Changed

• editor-extensions/vscode/src/paths.ts: Added proxy support to binary downloads
• editor-extensions/vscode/src/utilities/tls.ts: Added proxy authentication support

Breaking Changes

None. This is a backward-compatible fix that adds support for proxy configurations without affecting existing functionality.

[snyk-io]

⛔ Snyk checks have failed. 1 issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (1)
⛔	Open Source Security	0	0	1	0	1 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[djzager]

@ibolton336 Shouldn't this also be on main?

[ibolton336]

@ibolton336 Shouldn't this also be on main?

Opened https://github.com/konveyor/editor-extensions/pull/1060/files