Support self signed certificates in GitHub Copilot

Author: intitni

Core/Sources/HostApp/AccountSettings/GitHubCopilotView.swift

@@ -22,6 +22,8 @@ struct GitHubCopilotView: View {
         @AppStorage(\.gitHubCopilotEnterpriseURI) var gitHubCopilotEnterpriseURI
         @AppStorage(\.disableGitHubCopilotSettingsAutoRefreshOnAppear)
         var disableGitHubCopilotSettingsAutoRefreshOnAppear
+        @AppStorage(\.gitHubCopilotLoadKeyChainCertificates)
+        var gitHubCopilotLoadKeyChainCertificates
         init() {}
     }
 
@@ -196,6 +198,10 @@ struct GitHubCopilotView: View {
                         .foregroundColor(.secondary)
                         .font(.callout)
                         .dynamicHeightTextInFormWorkaround()
+                        
+                        Toggle(isOn: $settings.gitHubCopilotLoadKeyChainCertificates) {
+                            Text("Load certificates in keychain")
+                        }
                     }
                 }
 

Tool/Package.swift

@@ -316,7 +316,8 @@ let package = Package(
                 "BuiltinExtension",
                 .product(name: "LanguageServerProtocol", package: "LanguageServerProtocol"),
                 .product(name: "CopilotForXcodeKit", package: "CopilotForXcodeKit"),
-            ]
+            ],
+            resources: [.copy("Resources/load-self-signed-cert.js")]
         ),
         .testTarget(
             name: "GitHubCopilotServiceTests",

Tool/Sources/GitHubCopilotService/LanguageServer/GitHubCopilotService.swift

@@ -42,11 +42,14 @@ protocol GitHubCopilotLSP {
 enum GitHubCopilotError: Error, LocalizedError {
     case languageServerNotInstalled
     case languageServerError(ServerError)
+    case failedToInstallStartScript
 
     var errorDescription: String? {
         switch self {
         case .languageServerNotInstalled:
             return "Language server is not installed."
+        case .failedToInstallStartScript:
+            return "Failed to install start script."
         case let .languageServerError(error):
             switch error {
             case let .handlerUnavailable(handler):
@@ -109,12 +112,32 @@ public class GitHubCopilotBaseService {
                 throw GitHubCopilotError.languageServerNotInstalled
             }
 
+            let indexJSURL: URL = try {
+                if UserDefaults.shared.value(for: \.gitHubCopilotLoadKeyChainCertificates) {
+                    let url = urls.executableURL.appendingPathComponent("load-self-signed-cert.js")
+                    if !FileManager.default.fileExists(atPath: url.path) {
+                        let file = Bundle.module.url(
+                            forResource: "load-self-signed-cert",
+                            withExtension: "js"
+                        )!
+                        do {
+                            try FileManager.default.copyItem(at: file, to: url)
+                        } catch {
+                            throw GitHubCopilotError.failedToInstallStartScript
+                        }
+                    }
+                    return url
+                } else {
+                    return agentJSURL
+                }
+            }()
+
             switch runner {
             case .bash:
                 let nodePath = UserDefaults.shared.value(for: \.nodePath)
                 let command = [
                     nodePath.isEmpty ? "node" : nodePath,
-                    "\"\(agentJSURL.path)\"",
+                    "\"\(indexJSURL.path)\"",
                     "--stdio",
                 ].joined(separator: " ")
                 executionParams = Process.ExecutionParameters(
@@ -128,7 +151,7 @@ public class GitHubCopilotBaseService {
                 let nodePath = UserDefaults.shared.value(for: \.nodePath)
                 let command = [
                     nodePath.isEmpty ? "node" : nodePath,
-                    "\"\(agentJSURL.path)\"",
+                    "\"\(indexJSURL.path)\"",
                     "--stdio",
                 ].joined(separator: " ")
                 executionParams = Process.ExecutionParameters(
@@ -146,7 +169,7 @@ public class GitHubCopilotBaseService {
                         path: "/usr/bin/env",
                         arguments: [
                             nodePath.isEmpty ? "node" : nodePath,
-                            agentJSURL.path,
+                            indexJSURL.path,
                             "--stdio",
                         ],
                         environment: [

Tool/Sources/GitHubCopilotService/Resources/load-self-signed-cert.js

@@ -0,0 +1,40 @@
+function initialize() {
+  if (process.platform !== "darwin") {
+    return;
+  }
+
+  const splitPattern = /(?=-----BEGIN\sCERTIFICATE-----)/g;
+  const systemRootCertsPath =
+    "/System/Library/Keychains/SystemRootCertificates.keychain";
+  const args = ["find-certificate", "-a", "-p"];
+
+  const childProcess = require("child_process");
+  const allTrusted = childProcess
+    .spawnSync("/usr/bin/security", args)
+    .stdout.toString()
+    .split(splitPattern);
+
+  const allRoot = childProcess
+    .spawnSync("/usr/bin/security", args.concat(systemRootCertsPath))
+    .stdout.toString()
+    .split(splitPattern);
+  const all = allTrusted.concat(allRoot);
+
+  const tls = require("tls");
+  const origCreateSecureContext = tls.createSecureContext;
+  tls.createSecureContext = (options) => {
+    const ctx = origCreateSecureContext(options);
+    all.filter(duplicated).forEach((cert) => {
+      ctx.context.addCACert(cert.trim());
+    });
+    return ctx;
+  };
+}
+
+function duplicated(cert, index, arr) {
+  return arr.indexOf(cert) === index;
+}
+
+initialize();
+
+require("./copilot/dist/agent.js");

Tool/Sources/Preferences/Keys.swift

@@ -187,6 +187,10 @@ public extension UserDefaultPreferenceKeys {
     var runNodeWith: PreferenceKey<NodeRunner> {
         .init(defaultValue: .env, key: "RunNodeWith")
     }
+    
+    var gitHubCopilotLoadKeyChainCertificates: PreferenceKey<Bool> {
+        .init(defaultValue: false, key: "GitHubCopilotLoadKeyChainCertificates")
+    }
 }
 
 // MARK: - Codeium Settings