Trust bundled root certificates in workerd outbound TLS

workerd's built-in internet service cannot read the Windows system trust store, so npm installs inside the publish worker failed TLS verification. Declare the internet service explicitly with the runtime's bundled Mozilla roots, surface workerd stderr in startup failures, and fail the bundle when a dependency install warning is present instead of publishing a broken bundle.

Rhys Sullivan committed 4 months ago

Commit bb54fa91 parent 4be58bc2 files · +23 −2Browse files

Unified · Split

2 files

packages/kernel/runtime-workerd-subprocess/src/index.ts +19 −2
packages/plugins/apps/src/pipeline/worker-bundler.ts +4 −0

packages/kernel/runtime-workerd-subprocess/src/index.ts+19−2

 import type { Readable } from "node:stream";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
+import { rootCertificates } from "node:tls";
 import { fileURLToPath } from "node:url";
 import {
       return `( name = ${capnpString(name)}, ${field} = embed ${capnpString(name)} )`;
     })
     .join(",\n    ");
+  // workerd's built-in `internet` service relies on the platform TLS trust
+  // store, which kj/tls cannot read on Windows ("unable to get local issuer
+  // certificate"). Declaring our own internet service with the runtime's
+  // bundled Mozilla roots gives every platform the same trust behavior.
+  const trustedCertificates = rootCertificates.map(capnpString).join(",\n      ");
   const services = [
     '( name = "main", worker = .mainWorker )',
     '( name = "blocked", worker = .blockedWorker )',
+    ...(input.globalOutbound === "internet"
+      ? [
+          `( name = "internet", network = ( allow = ["public"], tlsOptions = ( trustedCertificates = [\n      ${trustedCertificates}\n    ] ) ) )`,
+        ]
+      : []),
     ...(input.hostPort === null
       ? []
       : [`( name = "host", external = ( address = "127.0.0.1:${input.hostPort}", http = () ) )`]),
       });
       proc.stderr.setEncoding("utf8");
       proc.stdout.resume();
-      proc.stderr.resume();
+      let stderrTail = "";
+      proc.stderr.on("data", (chunk: string) => {
+        stderrTail = (stderrTail + chunk).slice(-4000);
+      });
       proc.on("exit", (code, signal) => {
         lastExitAt = Date.now();
         if (processState?.proc === proc) {
         await waitReady(listenPort, token, startupTimeoutMs);
       } catch (cause) {
         await disposeState(true);
-        throw cause;
+        const detail = stderrTail.trim();
+        throw detail.length === 0
+          ? cause
+          : new Error(`${normalizeError(cause).message}\nworkerd stderr:\n${detail}`);
       }
     })();

packages/plugins/apps/src/pipeline/worker-bundler.ts+4−0

       if (code === null) {
         return json({ ok: false, message: "worker-bundler did not return JavaScript for " + result.mainModule });
       }
+      const installFailure = (result.warnings ?? []).find((warning) => /failed to install/i.test(String(warning)));
+      if (installFailure) {
+        return json({ ok: false, message: String(installFailure) });
+      }
       for (const [path, module] of Object.entries(result.modules)) {
         const source = moduleCode(module) ?? "";
         if (/\\.node(?:$|[?#])|node-gyp|prebuild-install|node-pre-gyp/.test(path) || /\\.node(?:$|[?#])|node-gyp|prebuild-install|node-pre-gyp/.test(source)) {