feat: support scoped client certificates (#7626)

close #7427 --------- Co-authored-by: Zoltan Kochan <z@kochan.io>
pnpm · Feb 14, 2024 · 7733f3a · 7733f3a
1 parent 57424e7
commit 7733f3a
Show file tree

Hide file tree

Showing 30 changed files with 446 additions and 286 deletions.
diff --git a/.changeset/breezy-points-chew.md b/.changeset/breezy-points-chew.md
@@ -0,0 +1,25 @@
+---
+"@pnpm/plugin-commands-store-inspecting": minor
+"@pnpm/plugin-commands-publishing": minor
+"@pnpm/resolve-dependencies": minor
+"@pnpm/store-connection-manager": minor
+"@pnpm/plugin-commands-rebuild": minor
+"@pnpm/plugin-commands-env": minor
+"@pnpm/client": minor
+"@pnpm/core": minor
+"@pnpm/types": minor
+"@pnpm/config": minor
+"@pnpm/fetch": minor
+"pnpm": minor
+---
+
+Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported: `<registryURL>:certfile`, `<registryURL>:keyfile`, and `<registryURL>:ca`. For instance:
+
+```
+//registry.mycomp.com/:certfile=server-cert.pem
+//registry.mycomp.com/:keyfile=server-key.pem
+//registry.mycomp.com/:cafile=client-cert.pem
+```
+
+Related issue: [#7427](https://github.com/pnpm/pnpm/issues/7427).
+Related PR: [#7626](https://github.com/pnpm/pnpm/pull/7626).
diff --git a/config/config/src/Config.ts b/config/config/src/Config.ts
@@ -3,6 +3,7 @@ import {
   type ProjectManifest,
   type ProjectsGraph,
   type Registries,
+  type SslConfig,
 } from '@pnpm/types'
 import type { Hooks } from '@pnpm/pnpmfile'
 
@@ -166,6 +167,7 @@ export interface Config {
   packGzipLevel?: number
 
   registries: Registries
+  sslConfigs: Record<string, SslConfig>
   ignoreWorkspaceRootCheck: boolean
   workspaceRoot: boolean
 

diff --git a/config/config/src/getNetworkConfigs.ts b/config/config/src/getNetworkConfigs.ts
@@ -0,0 +1,36 @@
+import { type SslConfig } from '@pnpm/types'
+import normalizeRegistryUrl from 'normalize-registry-url'
+import fs from 'fs'
+
+export interface GetNetworkConfigsResult {
+  sslConfigs: Record<string, SslConfig>
+  registries: Record<string, string>
+}
+
+export function getNetworkConfigs (rawConfig: Record<string, object>): GetNetworkConfigsResult {
+  // Get all the auth options that have :certfile or :keyfile in their name
+  const sslConfigs: Record<string, SslConfig> = {}
+  const registries: Record<string, string> = {}
+  for (const [configKey, value] of Object.entries(rawConfig)) {
+    if (configKey[0] === '@' && configKey.endsWith(':registry')) {
+      registries[configKey.slice(0, configKey.indexOf(':'))] = normalizeRegistryUrl(value as unknown as string)
+    } else if (configKey.includes(':certfile') || configKey.includes(':keyfile') || configKey.includes(':cafile')) {
+      // Split by '/:' because the registry may contain a port
+      const registry = configKey.split('/:')[0] + '/'
+      if (!sslConfigs[registry]) {
+        sslConfigs[registry] = { cert: '', key: '' }
+      }
+      if (configKey.includes(':certfile')) {
+        sslConfigs[registry].cert = fs.readFileSync(value as unknown as string, 'utf8')
+      } else if (configKey.includes(':keyfile')) {
+        sslConfigs[registry].key = fs.readFileSync(value as unknown as string, 'utf8')
+      } else if (configKey.includes(':cafile')) {
+        sslConfigs[registry].ca = fs.readFileSync(value as unknown as string, 'utf8')
+      }
+    }
+  }
+  return {
+    registries,
+    sslConfigs,
+  }
+}
diff --git a/config/config/src/getScopeRegistries.ts b/config/config/src/getScopeRegistries.ts
diff --git a/config/config/src/index.ts b/config/config/src/index.ts
@@ -16,7 +16,7 @@ import realpathMissing from 'realpath-missing'
 import pathAbsolute from 'path-absolute'
 import which from 'which'
 import { checkGlobalBinDir } from './checkGlobalBinDir'
-import { getScopeRegistries } from './getScopeRegistries'
+import { getNetworkConfigs } from './getNetworkConfigs'
 import { getCacheDir, getConfigDir, getDataDir, getStateDir } from './dirs'
 import {
   type Config,
@@ -319,10 +319,12 @@ export async function getConfig (
     cliOptions,
     { 'user-agent': pnpmConfig.userAgent },
   ] as any) // eslint-disable-line @typescript-eslint/no-explicit-any
+  const networkConfigs = getNetworkConfigs(pnpmConfig.rawConfig)
   pnpmConfig.registries = {
     default: normalizeRegistryUrl(pnpmConfig.rawConfig.registry),
-    ...getScopeRegistries(pnpmConfig.rawConfig),
+    ...networkConfigs.registries,
   }
+  pnpmConfig.sslConfigs = networkConfigs.sslConfigs
   pnpmConfig.useLockfile = (() => {
     if (typeof pnpmConfig.lockfile === 'boolean') return pnpmConfig.lockfile
     if (typeof pnpmConfig.packageLock === 'boolean') return pnpmConfig.packageLock

diff --git a/cspell.json b/cspell.json
@@ -1,5 +1,6 @@
 {
   "words": [
+    "TLSV",
     "adduser",
     "adipiscing",
     "amet",
@@ -24,6 +25,7 @@
     "cafs",
     "camelcase",
     "canonicalizer",
+    "certfile",
     "clonedeep",
     "cmds",
     "colorterm",
@@ -120,6 +122,7 @@
     "mintimeout",
     "monorepolint",
     "mountpoint",
+    "mycomp",
     "mycompany",
     "myorg",
     "mypackage",

diff --git a/env/plugin-commands-env/src/node.ts b/env/plugin-commands-env/src/node.ts
@@ -31,7 +31,7 @@ export type NvmNodeCommandOptions = Pick<Config,
 | 'storeDir'
 | 'useNodeVersion'
 | 'pnpmHomeDir'
-> & Partial<Pick<Config, 'configDir' | 'cliOptions'>> & {
+> & Partial<Pick<Config, 'configDir' | 'cliOptions' | 'sslConfigs'>> & {
   remote?: boolean
 }
 

diff --git a/exec/plugin-commands-rebuild/src/implementation/extendRebuildOptions.ts b/exec/plugin-commands-rebuild/src/implementation/extendRebuildOptions.ts
@@ -6,7 +6,7 @@ import { type StoreController } from '@pnpm/store-controller-types'
 import { type Registries } from '@pnpm/types'
 import loadJsonFile from 'load-json-file'
 
-export interface StrictRebuildOptions {
+export type StrictRebuildOptions = {
   autoInstallPeers: boolean
   cacheDir: string
   childConcurrency: number
@@ -48,7 +48,7 @@ export interface StrictRebuildOptions {
   deployAllFiles: boolean
   neverBuiltDependencies?: string[]
   onlyBuiltDependencies?: string[]
-}
+} & Pick<Config, 'sslConfigs'>
 
 export type RebuildOptions = Partial<StrictRebuildOptions> &
 Pick<StrictRebuildOptions, 'storeDir' | 'storeController'> & Pick<Config, 'rootProjectManifest' | 'rootProjectManifestDir'>

diff --git a/modules-mounter/daemon/src/createFuseHandlers.ts b/modules-mounter/daemon/src/createFuseHandlers.ts
@@ -34,20 +34,17 @@ export function createFuseHandlersFromLockfile (lockfile: Lockfile, cafsDir: str
     open (p: string, flags: string | number, cb: (exitCode: number, fd?: number) => void) {
       const dirEnt = getDirEnt(p)
       if (dirEnt?.entryType !== 'index') {
-        // eslint-disable-next-line n/no-callback-literal
         cb(-1)
         return
       }
       const fileInfo = dirEnt.index.files[dirEnt.subPath]
       if (!fileInfo) {
-        // eslint-disable-next-line n/no-callback-literal
         cb(-1)
         return
       }
       const filePathInStore = getFilePathByModeInCafs(cafsDir, fileInfo.integrity, fileInfo.mode)
       fs.open(filePathInStore, flags, (err, fd) => {
         if (err != null) {
-        // eslint-disable-next-line n/no-callback-literal
           cb(-1)
           return
         }
@@ -57,13 +54,12 @@ export function createFuseHandlersFromLockfile (lockfile: Lockfile, cafsDir: str
     },
     release (p: string, fd: number, cb: (exitCode: number) => void) {
       fs.close(fd, (err) => {
-        cb((err != null) ? -1 : 0) // eslint-disable-line n/no-callback-literal
+        cb((err != null) ? -1 : 0)
       })
     },
     read (p: string, fd: number, buffer: Buffer, length: number, position: number, cb: (readBytes: number) => void) {
       fs.read(fd, buffer, 0, length, position, (err, bytesRead) => {
         if (err != null) {
-        // eslint-disable-next-line n/no-callback-literal
           cb(-1)
           return
         }

diff --git a/network/fetch/package.json b/network/fetch/package.json
@@ -35,12 +35,14 @@
   "dependencies": {
     "@pnpm/core-loggers": "workspace:*",
     "@pnpm/fetching-types": "workspace:*",
-    "@pnpm/network.agent": "0.1.0",
+    "@pnpm/network.agent": "^1.0.1",
+    "@pnpm/types": "workspace:*",
     "@zkochan/retry": "^0.2.0",
     "node-fetch": "npm:@pnpm/node-fetch@1.0.0"
   },
   "devDependencies": {
     "@pnpm/fetch": "workspace:*",
+    "https-proxy-server-express": "0.1.2",
     "nock": "13.3.4"
   },
   "funding": "https://opencollective.com/pnpm",

diff --git a/network/fetch/src/fetchFromRegistry.ts b/network/fetch/src/fetchFromRegistry.ts
@@ -1,4 +1,5 @@
 import { URL } from 'url'
+import { type SslConfig } from '@pnpm/types'
 import { type FetchFromRegistry } from '@pnpm/fetching-types'
 import { getAgent, type AgentOptions } from '@pnpm/network.agent'
 import { fetch, isRedirect, type Response, type RequestInfo, type RequestInit } from './fetch'
@@ -33,6 +34,7 @@ export function createFetchFromRegistry (
   defaultOpts: {
     fullMetadata?: boolean
     userAgent?: string
+    sslConfigs?: Record<string, SslConfig>
   } & AgentOptions
 ): FetchFromRegistry {
   return async (url, opts): Promise<Response> => {
@@ -59,7 +61,10 @@ export function createFetchFromRegistry (
       // We should pass a URL object to node-fetch till this is not resolved:
       // https://github.com/bitinn/node-fetch/issues/245
       const response = await fetchWithAgent(urlObject, {
-        agentOptions,
+        agentOptions: {
+          ...agentOptions,
+          clientCertificates: defaultOpts.sslConfigs,
+        },
         // if verifying integrity, node-fetch must not decompress
         compress: opts?.compress ?? false,
         headers,

diff --git a/network/fetch/test/__certs__/ca-crt.pem b/network/fetch/test/__certs__/ca-crt.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDpzCCAo+gAwIBAgIUBfn11L/8a6yyGNPKT+wsjQXxkJwwDQYJKoZIhvcNAQEL
+BQAwYzELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE5ldyBZb3JrMREwDwYDVQQHDAhO
+ZXcgWW9yazENMAsGA1UECgwEcG5wbTELMAkGA1UECwwCSVQxEjAQBgNVBAMMCWxv
+Y2FsaG9zdDAeFw0yNDAxMTcxMDQxMTdaFw00NDAxMTIxMDQxMTdaMGMxCzAJBgNV
+BAYTAlVTMREwDwYDVQQIDAhOZXcgWW9yazERMA8GA1UEBwwITmV3IFlvcmsxDTAL
+BgNVBAoMBHBucG0xCzAJBgNVBAsMAklUMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCJw+DkWokdplyEWDi/AYbT7XeP
+ytgKdUJ2bfJBrj6G2JU6MAOZ/fzlZ1c2mD5U+gKIvr7rvsWKsLZohXIGsE5EjL7s
+/ruoYJo4jTD+gmdPaFCNXuDp6XmH1htf/msPo3Kv0eNL29Dx1l5pFvVrj96R+gsQ
+6V/ydqXxqgC3v89CUgjScApfjcCsnxqYp4Y+TtHUEzvHRgmHNpxXjJGrkjroofKi
+PkACxLSG8CIC+btIytwmjLyCfdqYtHaYpoIQwTK2ui7BAZ1Kl4LYBgfvNqfkr0uZ
+v4nwmB3z4RTWyBDL7xrfH5gR9f+d49ZwskZ2ztmMcRbGxbiAMjHzOPjiFLLPAgMB
+AAGjUzBRMB0GA1UdDgQWBBRFxjUWfdYIom50aQHSxft/r0/fNDAfBgNVHSMEGDAW
+gBRFxjUWfdYIom50aQHSxft/r0/fNDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+DQEBCwUAA4IBAQAT4cgBafJA/KNBXLoOM5bixKn/Q1Rdef9ZkbTe0zPYu8+hfquc
+yVkk7o0VMYdT4JqdNsqJLHCe3fU4Ns7qXeumECUyW81L/PaFMYP4o5/02iTgcvSO
+7uEG5rJEQ4p3dPtgz4kP1Vkt5G+tMHsKY5okk9iaWNA7TxiG0avqFKIT8tFm1wMx
+VJ33DNM6jC55b5Z/zeiB7cxp+NrEmCHcyFwwpGNuPmQvBWOXttz0oriYjqRXc78Y
+fqOcQc1I8PaliLkJ5e5XUTtVCjMEU7pwz2LyhA7tGLTIx+skEltKQAxVgksQStxV
+ZWk1RfHDSczvFFzn57eAxpt8lohkf2Votsii
+-----END CERTIFICATE-----
diff --git a/network/fetch/test/__certs__/ca-crt.srl b/network/fetch/test/__certs__/ca-crt.srl
@@ -0,0 +1 @@
+28412AF275E88F449B30A1071D25827F67DB59AE
diff --git a/network/fetch/test/__certs__/ca-key.pem b/network/fetch/test/__certs__/ca-key.pem
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFJDBWBgkqhkiG9w0BBQ0wSTAxBgkqhkiG9w0BBQwwJAQQsj4+WcsErreSm8GA
+usXR8AICCAAwDAYIKoZIhvcNAgkFADAUBggqhkiG9w0DBwQI2Ze4AnQo+8sEggTI
+MxH2IntXHK6TjTubMqpuwm/uaz4oPnz22nsXx3ZynqEV7I9lCisVqRGe/BmlSahD
+LnEnbjyqTxhpT/29wHVhVTvTLbHdQ+Zeasl67FRVtZGldNy1eWXQ/fcynvFOt5De
+Zk2OZ8ynW6bLdDn697UNGs8zXUSug9yYk3lF/R1//uluOCEhNLLI1+++8dgmoiD6
+9hxNt4O0/aU2xQVzy/7IalF+8yRCgWDO5lBJg1sYXpFrxU+zXN27r5pb1fQ3UFTj
+d6ihjifP4agMjdA7ubIbBsfI20+IQ3aI4zK2Se057DXMlaMJI7YIcB2E13B81zuw
+Tx8TBnYcNiWRMCdPdW4iNsaLGJBWIYE6gND6wSPFdJxDN3K5MuvsvD/zHi7HEpOW
+ry7o030Q4XNN/y9ZL5rH1bitVnO8GljZF2d4913iS70vbabXqZLuR59qfKfUv1/+
+ddly17oLhwoXxkowut8PCG0CejxToOSkD0rkvHl7wBhDPuiCcUGRaZKR69kuxO/d
+lPDDgDpDCRN3xAlHfBI+lB2nyICxk7/mJnOYi+uhg6X9lpD2EnryS46FZ5EllB+H
+pbgXiNFPGCulnREXyLOyD7sqmpuCYHehAIv6qiK3aFHk0F29SKJV0JI7yEYDDSYV
+2hna3aa7I8lf92oslAJp7DPjh9WmTKELRLoGElYzkYMlJLtMWMLJMqQt0lyzpW24
+fFDeQWjraZ0CfrpuftXwqvdrLhqwmLRUYFBFa0Y/gScsKGwiG8mX5It236oYcRAV
+yQS6d1SWkZ01PUEs8zryvOkErUd1WTxLz91ivVpizcg2I/gNYJYU4y9IAJrrw+nY
+hqDjZrvKl2lfxTHWViZRQ2a2sLQqrmquB+nee9/05XkQmwPKAzDIzYVBy3JOfMP5
+0UvdyHpGR3HsFIvguMmOzxetAWF1W5pYHyIzkMgWB4u/3WY4DooRejljEQ1s4pDS
+EE+SYNXNhb3z/lvsymYnUXzrZb1cVWSK9e638UOsvl7zXzLfK6LxX856HdobyS9q
+FK7CkKacxpgLw1IHa5Lh9ELCyWoKM21Cvx+PRKWPCy3qOTWKS5wbJLvU/0Occnvp
+0qnDBuqdX6oKGiL8Nl8vaY1PZ7I07P23cw5jcEK/zf6E6OFLuVU3fCuJvJ1MZWhk
+h/hJPoZQsOhFR24GmqZoZXj+H3iMvjos5OoX/itB1KmNvKWeQY6q7/ke7fA+ennR
+2ESV/zCthzRDL/1bs9ZePu9eKOc+2qpJZusJSMjip/KCapNCjis9huu3ri97+IBT
+brvIAX4rFupqmGQELtZGMqe7cktEc31NoAGNf+UWGfqqEWxgTzaPcXBsz3xBWfwJ
+wX1xcswMpTHoRDv3OpxG2Uo9Ff2ZxA7r2ZsLqZV8+p20fD70CwvZhhz4mPPjlTFo
+nRXoE10Sri5jwzjy/fb+mXj1oOYftMvbnRxhB6MBB+R5vFmvHtVMFP2q6L3cGvEj
+dBEcLElyN210Ybhp2JuvhJ+93LyjF93QQN7HYwLO9dqDJPFUjWBFduMy+EmdzCCr
+yR5knsEFkjXIqbuDgSIqdkljpTRKQuiXQQMl52YmiQMb4AEeJFhxW8RmPKWVwxTz
+9BzxrLP3jf6eWsWG6bUi+CI51Kmb8Oqk
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/network/fetch/test/__certs__/client-crt.pem b/network/fetch/test/__certs__/client-crt.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDlTCCAn2gAwIBAgIUKEEq8nXoj0SbMKEHHSWCf2fbWa4wDQYJKoZIhvcNAQEL
+BQAwYzELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE5ldyBZb3JrMREwDwYDVQQHDAhO
+ZXcgWW9yazENMAsGA1UECgwEcG5wbTELMAkGA1UECwwCSVQxEjAQBgNVBAMMCWxv
+Y2FsaG9zdDAeFw0yNDAxMTcxMDQxNDFaFw00NDAxMTIxMDQxNDFaMGIxCzAJBgNV
+BAYTAlVTMREwDwYDVQQIDAhOZXcgWW9yazERMA8GA1UEBwwITmV3IFlvcmsxDTAL
+BgNVBAoMBHBucG0xCzAJBgNVBAsMAklUMREwDwYDVQQDDAhKb2huIERvZTCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALSL84hy3lcdWgmXr8zhErwpemVA
+gneW4JH4leYneuSztkOMEyXegExNY4mjYcPX75N0X7oJyK+sIdpMCU6JN2AttU8h
+BmSGd5cuDQ/ZgfMs36hnmUIrOL67QAsLa7MU7pG9XrZHpbG/MLP0fCO7+4aF3LCh
+7nt0aR1mFjhHJFn5CSgF0fuoSrvIzpSIjtdnX6ivF16AfU71UhhuW4aAlZPfybh7
+PzICBeIs6Qx8J7lICJUOaL+dIdGem+/oOHN0Td3V58enVfFGwbtJMzrjaeiGTNnU
+xv2WfnDThsXParTZ+rTBT0qL8LrUIYDgaPkeDum83EUvoHQO4g31xsxoTPsCAwEA
+AaNCMEAwHQYDVR0OBBYEFLJGGqvXCUyoGjMyaWPFNT55jIUBMB8GA1UdIwQYMBaA
+FEXGNRZ91giibnRpAdLF+3+vT980MA0GCSqGSIb3DQEBCwUAA4IBAQAa+0WrCAxF
+vahes28wJdmy38I9qc60P6ye6fcADCNqQYszC8Y6rAau65eKjorO/ypA3qPm7d8t
+9zydxYpScejE792G5UiWnFeWRLDfl2xaEElfIELdIzEvXDslrXRalIn1vakTTYXG
+cIGc5GgKN1Wq1aehQOKo5kwRuwd63hbnG0x3TrIx1BWUURa8J2R8gKbp9QNfgHmf
+EM66R+QwrLmboEKtB+3uVGxJUPugpfEPcwbhCdcyKNF9MgNzECjSn8jCkduqIHv5
+Mv9e6Cs1zjjksbknsrHW+Se9VfWEm0mcZw+xs5FAJ8fUBFcyouyHxqTGLSThbwAK
+JbIqq5FLFOco
+-----END CERTIFICATE-----
diff --git a/network/fetch/test/__certs__/client-csr.pem b/network/fetch/test/__certs__/client-csr.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICpzCCAY8CAQAwYjELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE5ldyBZb3JrMREw
+DwYDVQQHDAhOZXcgWW9yazENMAsGA1UECgwEcG5wbTELMAkGA1UECwwCSVQxETAP
+BgNVBAMMCEpvaG4gRG9lMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+tIvziHLeVx1aCZevzOESvCl6ZUCCd5bgkfiV5id65LO2Q4wTJd6ATE1jiaNhw9fv
+k3RfugnIr6wh2kwJTok3YC21TyEGZIZ3ly4ND9mB8yzfqGeZQis4vrtACwtrsxTu
+kb1etkelsb8ws/R8I7v7hoXcsKHue3RpHWYWOEckWfkJKAXR+6hKu8jOlIiO12df
+qK8XXoB9TvVSGG5bhoCVk9/JuHs/MgIF4izpDHwnuUgIlQ5ov50h0Z6b7+g4c3RN
+3dXnx6dV8UbBu0kzOuNp6IZM2dTG/ZZ+cNOGxc9qtNn6tMFPSovwutQhgOBo+R4O
+6bzcRS+gdA7iDfXGzGhM+wIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBABQOQj2X
+ox/SXBdBqPNhAM1TH0R0J+/83Du/nQmj2xPOTlIq35h0ZUzCS04SGK0dXBJnrRLs
+fTiZsYmuDLf3n5ggB84d1kljldZFnJyDXWU0gzbF04cBuA0+lvjTBSKHFahijndV
+dp/HHID9qhJiMIsf+moL/KU1UI/mMaQIf+59QSPlHngKol1yZuwiEtfBzPITL4qY
+nkDu9JlfRks+4q8ICnj3PlBNuMgVF+9cOe/QMmPP+JyT1YsWqINczJLHN1Mnj+yg
+GVZxqBmN6OTeWcFrZrHssSB/RCvec+0fD9/wwSvGwPDqECDhhgcFBBzV+jCISfP9
+MqLCYYYRWplklvk=
+-----END CERTIFICATE REQUEST-----
diff --git a/network/fetch/test/__certs__/client-key.pem b/network/fetch/test/__certs__/client-key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC0i/OIct5XHVoJ
+l6/M4RK8KXplQIJ3luCR+JXmJ3rks7ZDjBMl3oBMTWOJo2HD1++TdF+6CcivrCHa
+TAlOiTdgLbVPIQZkhneXLg0P2YHzLN+oZ5lCKzi+u0ALC2uzFO6RvV62R6WxvzCz
+9Hwju/uGhdywoe57dGkdZhY4RyRZ+QkoBdH7qEq7yM6UiI7XZ1+orxdegH1O9VIY
+bluGgJWT38m4ez8yAgXiLOkMfCe5SAiVDmi/nSHRnpvv6DhzdE3d1efHp1XxRsG7
+STM642nohkzZ1Mb9ln5w04bFz2q02fq0wU9Ki/C61CGA4Gj5Hg7pvNxFL6B0DuIN
+9cbMaEz7AgMBAAECggEABHafQc92gAMplNTLU6POzEMJk745W3kp5RdBpsEcGyeh
+iQr0oDo0xBjNA1E8MKoXx0vttTzaWWlxJCM+vv0fwYDFG4cupXE4505hTp6AcBa7
+Er/jkeIH/ZhweArDZ1fMTA25QoVZQHXVtOUwOnaXvGwhGBFwwrGOiwZZOfFG90ho
+9uHO1gaWhrRJ4P07DJHxfwWGcFUbsmd88rExXS/I/ifu/zVE73no/J9kXlnscYig
+FNT9EbhXnd3cZ2Zfkfak/cLD/MMwCOTpq+T5YpK29bUsUySwGJiSB4h45jw69Zkm
+3qLy98y3vILlKoraXD6+sV4MH0WULvY/zoRjJa54bQKBgQDsZEO4Wyr6JerXHGSv
+mALXNVdOKWZp2tLD1cUY9772BDvXJ0vlE8EOoxlKjpHCt2/XR6uXZFOlgqZF/Lbz
+f0MWMIkIQNrPMWnudKBCbOnz1PZ3m81TAvx2TYFafqcldz8q/NTTYGvKYQ1ClyLT
+viehMhDoRpHMG0WEesEQ6iGJjQKBgQDDhdQa3VWy+n66JPvqjOWkSrs7cZXYOZBK
+IVoQA5R7yA+h6GPQgbfYvt824P5PSay/mHtMYse1Gxga+LtLYQaxrKds6dD00NSZ
+Nkh1azrRoNOjyc/ZUqOE0Q0OEMgrq50bixP4OlaT+OxX55q7KcaWkj0IaACyeVIU
+UoYBldxapwKBgQCAAF7HEd64qxV5u28twdMv8zs+IJ7LDOl5j2R1e5lUn8BDZYzs
+EwFDyr8kJwT4edm+qZlZlcLRaWhdl1T9jtilyEw7Qtr4vFoO++nXbiBUnumCpMPO
+glxwNtGnTdN2LxbuUQ9xEdHsORc0CqCaJWpSF8kd7TB/Y/kFnm6ymQTl9QKBgQCP
+3kaPKfPoSXe8QoB3Owuy0yZn/BE1VE3+rgHWLLwyRKh0C0p+3yRHQVN/zxhxgRWy
+uWFoeHrYoUIgfotaUN+bFx7u/jE6Ivt8bTvt4mQaYcu5BkOBdtRJY4XGpsSTlah5
+3uFn0o1oPk6x9AKf24J7wslUCSsSKEEkIQDn47yLmwKBgDbhGWZdGAL8r5SQy/76
+MKj+kvGQeGuH32OtnAP1z5yT8tDQ3XN5q1/nYXHqos/VACHcp/FaY3Dck+UeLobw
+5lRHq7GG2tXCTXIFVJ4WNqNGhTQV+woqpZ5UgZhHlkI9ni8Zy6VcP9OJeLZpwchl
+MBIuC60QuxBeGZNOcJyG3k5+
+-----END PRIVATE KEY-----
diff --git a/network/fetch/test/__certs__/server-crt.pem b/network/fetch/test/__certs__/server-crt.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDljCCAn6gAwIBAgIUKEEq8nXoj0SbMKEHHSWCf2fbWa0wDQYJKoZIhvcNAQEL
+BQAwYzELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE5ldyBZb3JrMREwDwYDVQQHDAhO
+ZXcgWW9yazENMAsGA1UECgwEcG5wbTELMAkGA1UECwwCSVQxEjAQBgNVBAMMCWxv
+Y2FsaG9zdDAeFw0yNDAxMTcxMDQxMzFaFw00NDAxMTIxMDQxMzFaMGMxCzAJBgNV
+BAYTAlVTMREwDwYDVQQIDAhOZXcgWW9yazERMA8GA1UEBwwITmV3IFlvcmsxDTAL
+BgNVBAoMBHBucG0xCzAJBgNVBAsMAklUMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDTnJiL8joJ931yrZ5Z7oImjRw9
+u0Aq7WVuwxDPPJURIeCd6RRW5lggiCz05uhNlKYNb7R5OaXDMSSVKc62y7y6/H3J
+Tmw2oaC1H869d2h04ohUMkVYOvVeealGQqmszKIy0RbqnVLRPDtdqpMouSxFNWe2
+ieBtWCuuR5tgomcg6ohioWArGP2gChab1WI9vqPzaQRbmO1FkDyUZlxMD+WLCqKV
+ULBtCW4Stfwne1DjWJu23yibTAZ8vrJavfWW0+MqjkG6TQroYaVTiHD0DXAWD4wl
+JFTe5cQfjR4QCn7JdlJZmnOFfuY3pIM8YTm18bqgUTg0VssySczOiISgabT9AgMB
+AAGjQjBAMB0GA1UdDgQWBBSlNwhSYvQgXSwu7tbabU15/QRz1TAfBgNVHSMEGDAW
+gBRFxjUWfdYIom50aQHSxft/r0/fNDANBgkqhkiG9w0BAQsFAAOCAQEAab/pE+zR
+JSNJg2OrurXlEdLgjpmczrbe3AddeLRxE6mEiNQADS66QmAMpNKNAyprYY+229VT
+SDFap37EXgtBMvbqFugXhhclT5lckVHwAt1tNxhaeiUZnyDa/nGghdQgX2UqwZ0t
+S35/lGKt8RA1Z1SRiT5Hnldp46mb5Hgkfe/yKQKtU0weCVR0JEHJ4MA3Mv2A+Pge
+NiKGf019ZuhmsaX5i1NC8HM9DvhH0MeTd07FDSLmyILdu6Ai+ebKnano3RVMFcnk
+pIu+qMnnhdp/sNw2C5KZ2QNjE1XHCXDGJtDGRPtHrvHGqVDsRGtW2MPK2Uda/a6o
+sZhEFANmSRKUkg==
+-----END CERTIFICATE-----