feat: corporate SSL proxy support via --ca-cert flag and config command#473
Merged
Conversation
Passes --ca-cert to both the scan step and the advisories sync step when the input is provided. Users can write their corporate CA cert from a GitHub Secret to a temp file in a prior step, then pass the path via the ca-cert input.
…g cert Three bugs fixed: - advisories sync did not parse --ca-cert, causing Unknown option error (broke the GitHub Action sync step when ca-cert input was set) - NODE_EXTRA_CA_CERTS was set after the advisories-sync branch exited, so saved config cert was never applied for advisory sync - stale saved cert (file deleted since config set) produced a cryptic TLS error; now validated early with a clear message and unset hint
…s from fetch hint
Adds validateCaCertFile() shared function that checks the cert is a regular file (not a directory), is non-empty, and starts with -----BEGIN to confirm PEM format. Used by both config set ca-cert and --ca-cert flag validation so both paths reject bad inputs early with clear error messages.
New corporate-proxy.md covers one-time config set ca-cert setup, per-invocation --ca-cert flag, getting the cert from IT/keychain/browser, and the offline advisory sync fallback for air-gapped networks. CLI reference gains a Network/SSL section (--ca-cert, --osv-url moved from Offline), a config subcommand table, and updated usage line. Troubleshooting gains an SSL certificate errors entry with fix steps.
… and add chalk to config output Adds ConfigAction and ConfigKey const objects to config.ts; args.ts and config-command.ts now reference those constants instead of bare string literals. config-command.ts uses chalk.green checkmark for success, chalk.bold for key names, chalk.cyan for values, and chalk.gray for secondary config file path lines.
coder-Yash886
pushed a commit
to coder-Yash886/cve-lite-cli
that referenced
this pull request
Jun 10, 2026
…nd (OWASP#473) * feat: add config file module for persistent CLI settings * fix: add type guard in readConfig to validate caCert field * feat: add config subcommand parsing and --ca-cert flag * feat: add ca-cert input to GitHub Action for corporate SSL proxy support Passes --ca-cert to both the scan step and the advisories sync step when the input is provided. Users can write their corporate CA cert from a GitHub Secret to a temp file in a prior step, then pass the path via the ca-cert input. * fix: validate --ca-cert requires a path argument * fix: apply ca-cert for advisories sync and validate stale saved config cert Three bugs fixed: - advisories sync did not parse --ca-cert, causing Unknown option error (broke the GitHub Action sync step when ca-cert input was set) - NODE_EXTRA_CA_CERTS was set after the advisories-sync branch exited, so saved config cert was never applied for advisory sync - stale saved cert (file deleted since config set) produced a cryptic TLS error; now validated early with a clear message and unset hint * feat: add config command handler (set/unset/show) * feat: route config command and apply ca-cert from config before fetch calls * fix: update SSL error hint to reference cve-lite config set ca-cert * fix: hint at ca-cert config on blocked and unclassified fetch errors * fix: validate cert file exists on config set and isolate config errors from fetch hint * feat: validate PEM format and file type when setting ca-cert Adds validateCaCertFile() shared function that checks the cert is a regular file (not a directory), is non-empty, and starts with -----BEGIN to confirm PEM format. Used by both config set ca-cert and --ca-cert flag validation so both paths reject bad inputs early with clear error messages. * docs: add corporate SSL proxy guide and config subcommand reference New corporate-proxy.md covers one-time config set ca-cert setup, per-invocation --ca-cert flag, getting the cert from IT/keychain/browser, and the offline advisory sync fallback for air-gapped networks. CLI reference gains a Network/SSL section (--ca-cert, --osv-url moved from Offline), a config subcommand table, and updated usage line. Troubleshooting gains an SSL certificate errors entry with fix steps. * refactor: replace magic strings with ConfigAction/ConfigKey constants and add chalk to config output Adds ConfigAction and ConfigKey const objects to config.ts; args.ts and config-command.ts now reference those constants instead of bare string literals. config-command.ts uses chalk.green checkmark for success, chalk.bold for key names, chalk.cyan for values, and chalk.gray for secondary config file path lines. * docs: link to adopters discussion thread in README
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds support for corporate SSL inspection proxies, which intercept HTTPS traffic and can block the OSV API calls CVE Lite CLI relies on.
What changed
--ca-cert <path>flag to pass a PEM CA certificate for a single scan or advisory synccve-lite config set/unset/show ca-certsubcommand to save the cert path once in~/.cve-lite-cli/config.jsonso every future invocation uses it automaticallyNODE_EXTRA_CA_CERTS--ca-certflag takes precedence over saved config for that run-----BEGIN- rejects DER/binary certs and wrong files early with clear error messagescorporate-proxy.mddoc page with full setup workflow, cert export instructions, and air-gapped fallbackCloses #395