node-opcua / node-opcua-pki / 32142601200

91%

Build Type

push

github

Committed by erossignon

Commit Message

feat(security): private-key hardening for CertificateManager and openssl calls

- own/private and private/ created and repaired as 0700, key files 0600
  (POSIX; documented no-op on Windows)
- opt-in privateKeyPassphrase (string or async fn) and privateKeyProvider
  on CertificateManager; getPrivateKey() (cached, fails closed with
  PrivateKeyPassphraseRequiredError) and reencryptPrivateKey() (locked,
  atomic); an existing plaintext key is encrypted in place on initialize
- PFX passphrases reach openssl via -passin/-passout env:, never the shell
  string or debug log; -passin always sent so an encrypted key fails fast
- openssl child: curated env allowlist shared with discovery, /dev/null
  stdin (macOS tcgetattr on a socket broke -passin key loads)
- failed initialize() is retryable; docs/private-key-protection.md holds
  the threat model; node-opcua-crypto pinned to 5.6.0
- CertificateAuthority passphrase and shell-free execFile: separate PRs

Coverage Stats

535 of 710 branches covered (75.35%)

154 of 157 new or added lines in 11 files covered. (98.09%)

1 existing line in 1 file now uncovered.

1571 of 1725 relevant lines covered (91.07%)

281.54 hits per line