Add DENO_CERT environment variable for Deno TLS support

[magurotuna]

This adds DENO_CERT environment variable to make Deno programs trust httpjail's proxy CA certificate.

httpjail sets environment variables like SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, etc. to make programs trust the proxy's CA. However, Deno uses its own DENO_CERT variable, causing Deno programs to fail with certificate errors:

root@86de9af35c35:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"03:44:15.504 ERROR httpjail::proxy_tls: TLS handshake failed: received fatal alert: UnknownCA03:44:15.504 ERROR httpjail::proxy: Error handling HTTPS connection: received fatal alert: UnknownCAerror: Uncaught (in promise) TypeError: error sending request for url (https://example.com/): client error (Connect): invalid peer certificate: UnknownIssuerconst r = await fetch('https://example.com'); console.log(r.status); await r.bytes(); ^ at async mainFetch (ext:deno_fetch/26_fetch.js:192:12) at async fetch (ext:deno_fetch/26_fetch.js:475:11) at async file:///test/$deno$eval.mts:1:11 hint: Run again with the `--unsafely-ignore-certificate-errors` flag to bypass certificate errors.

To fix this issue, DENO_CERT is added to the list of environment variables set by httpjail. With this patch, Deno throws no errors anymore:

root@905d9a57c5be:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"200

This manual testing was performed using the Dockerfile below.

FROM rust:1.92.0-bookworm AS builder
WORKDIR /build
COPY . .
RUN cargo build --profile fast
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y \
curl \
ca-certificates \
nftables \
iproute2 \
procps \
unzip \
&& rm -rf /var/lib/apt/lists/*
# Install Node.js 24RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
&& apt-get install -y nodejs
# Install DenoRUN curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh
# Copy httpjail binaryCOPY --from=builder /build/target/fast/httpjail /usr/local/bin/httpjail
WORKDIR /
CMD ["/bin/bash"]

Closes#96

[magurotuna]

This adds DENO_CERT environment variable to make Deno programs trust httpjail's proxy CA certificate.

httpjail sets environment variables like SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, etc. to make programs trust the proxy's CA. However, Deno uses its own DENO_CERT variable, causing Deno programs to fail with certificate errors:

root@86de9af35c35:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"03:44:15.504 ERROR httpjail::proxy_tls: TLS handshake failed: received fatal alert: UnknownCA03:44:15.504 ERROR httpjail::proxy: Error handling HTTPS connection: received fatal alert: UnknownCAerror: Uncaught (in promise) TypeError: error sending request for url (https://example.com/): client error (Connect): invalid peer certificate: UnknownIssuerconst r = await fetch('https://example.com'); console.log(r.status); await r.bytes(); ^ at async mainFetch (ext:deno_fetch/26_fetch.js:192:12) at async fetch (ext:deno_fetch/26_fetch.js:475:11) at async file:///test/$deno$eval.mts:1:11 hint: Run again with the `--unsafely-ignore-certificate-errors` flag to bypass certificate errors.

To fix this issue, DENO_CERT is added to the list of environment variables set by httpjail. With this patch, Deno throws no errors anymore:

root@905d9a57c5be:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"200

This manual testing was performed using the Dockerfile below.

FROM rust:1.92.0-bookworm AS builder
WORKDIR /build
COPY . .
RUN cargo build --profile fast
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y \
curl \
ca-certificates \
nftables \
iproute2 \
procps \
unzip \
&& rm -rf /var/lib/apt/lists/*
# Install Node.js 24RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
&& apt-get install -y nodejs
# Install DenoRUN curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh
# Copy httpjail binaryCOPY --from=builder /build/target/fast/httpjail /usr/local/bin/httpjail
WORKDIR /
CMD ["/bin/bash"]

Closes#96

[magurotuna]

This adds DENO_CERT environment variable to make Deno programs trust httpjail's proxy CA certificate.

httpjail sets environment variables like SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, etc. to make programs trust the proxy's CA. However, Deno uses its own DENO_CERT variable, causing Deno programs to fail with certificate errors:

root@86de9af35c35:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"03:44:15.504 ERROR httpjail::proxy_tls: TLS handshake failed: received fatal alert: UnknownCA03:44:15.504 ERROR httpjail::proxy: Error handling HTTPS connection: received fatal alert: UnknownCAerror: Uncaught (in promise) TypeError: error sending request for url (https://example.com/): client error (Connect): invalid peer certificate: UnknownIssuerconst r = await fetch('https://example.com'); console.log(r.status); await r.bytes(); ^ at async mainFetch (ext:deno_fetch/26_fetch.js:192:12) at async fetch (ext:deno_fetch/26_fetch.js:475:11) at async file:///test/$deno$eval.mts:1:11 hint: Run again with the `--unsafely-ignore-certificate-errors` flag to bypass certificate errors.

To fix this issue, DENO_CERT is added to the list of environment variables set by httpjail. With this patch, Deno throws no errors anymore:

root@905d9a57c5be:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"200

This manual testing was performed using the Dockerfile below.

FROM rust:1.92.0-bookworm AS builder
WORKDIR /build
COPY . .
RUN cargo build --profile fast
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y \
curl \
ca-certificates \
nftables \
iproute2 \
procps \
unzip \
&& rm -rf /var/lib/apt/lists/*
# Install Node.js 24RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
&& apt-get install -y nodejs
# Install DenoRUN curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh
# Copy httpjail binaryCOPY --from=builder /build/target/fast/httpjail /usr/local/bin/httpjail
WORKDIR /
CMD ["/bin/bash"]

Closes#96

[magurotuna]

This adds DENO_CERT environment variable to make Deno programs trust httpjail's proxy CA certificate.

httpjail sets environment variables like SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, etc. to make programs trust the proxy's CA. However, Deno uses its own DENO_CERT variable, causing Deno programs to fail with certificate errors:

root@86de9af35c35:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"03:44:15.504 ERROR httpjail::proxy_tls: TLS handshake failed: received fatal alert: UnknownCA03:44:15.504 ERROR httpjail::proxy: Error handling HTTPS connection: received fatal alert: UnknownCAerror: Uncaught (in promise) TypeError: error sending request for url (https://example.com/): client error (Connect): invalid peer certificate: UnknownIssuerconst r = await fetch('https://example.com'); console.log(r.status); await r.bytes(); ^ at async mainFetch (ext:deno_fetch/26_fetch.js:192:12) at async fetch (ext:deno_fetch/26_fetch.js:475:11) at async file:///test/$deno$eval.mts:1:11 hint: Run again with the `--unsafely-ignore-certificate-errors` flag to bypass certificate errors.

To fix this issue, DENO_CERT is added to the list of environment variables set by httpjail. With this patch, Deno throws no errors anymore:

root@905d9a57c5be:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"200

This manual testing was performed using the Dockerfile below.

FROM rust:1.92.0-bookworm AS builder
WORKDIR /build
COPY . .
RUN cargo build --profile fast
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y \
curl \
ca-certificates \
nftables \
iproute2 \
procps \
unzip \
&& rm -rf /var/lib/apt/lists/*
# Install Node.js 24RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
&& apt-get install -y nodejs
# Install DenoRUN curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh
# Copy httpjail binaryCOPY --from=builder /build/target/fast/httpjail /usr/local/bin/httpjail
WORKDIR /
CMD ["/bin/bash"]

Closes#96

[magurotuna]

This adds DENO_CERT environment variable to make Deno programs trust httpjail's proxy CA certificate.

httpjail sets environment variables like SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, etc. to make programs trust the proxy's CA. However, Deno uses its own DENO_CERT variable, causing Deno programs to fail with certificate errors:

root@86de9af35c35:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"03:44:15.504 ERROR httpjail::proxy_tls: TLS handshake failed: received fatal alert: UnknownCA03:44:15.504 ERROR httpjail::proxy: Error handling HTTPS connection: received fatal alert: UnknownCAerror: Uncaught (in promise) TypeError: error sending request for url (https://example.com/): client error (Connect): invalid peer certificate: UnknownIssuerconst r = await fetch('https://example.com'); console.log(r.status); await r.bytes(); ^ at async mainFetch (ext:deno_fetch/26_fetch.js:192:12) at async fetch (ext:deno_fetch/26_fetch.js:475:11) at async file:///test/$deno$eval.mts:1:11 hint: Run again with the `--unsafely-ignore-certificate-errors` flag to bypass certificate errors.

To fix this issue, DENO_CERT is added to the list of environment variables set by httpjail. With this patch, Deno throws no errors anymore:

root@905d9a57c5be:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"200

This manual testing was performed using the Dockerfile below.

FROM rust:1.92.0-bookworm AS builder
WORKDIR /build
COPY . .
RUN cargo build --profile fast
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y \
curl \
ca-certificates \
nftables \
iproute2 \
procps \
unzip \
&& rm -rf /var/lib/apt/lists/*
# Install Node.js 24RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
&& apt-get install -y nodejs
# Install DenoRUN curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh
# Copy httpjail binaryCOPY --from=builder /build/target/fast/httpjail /usr/local/bin/httpjail
WORKDIR /
CMD ["/bin/bash"]

Closes#96

[magurotuna]

This adds DENO_CERT environment variable to make Deno programs trust httpjail's proxy CA certificate.

httpjail sets environment variables like SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, etc. to make programs trust the proxy's CA. However, Deno uses its own DENO_CERT variable, causing Deno programs to fail with certificate errors:

root@86de9af35c35:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"03:44:15.504 ERROR httpjail::proxy_tls: TLS handshake failed: received fatal alert: UnknownCA03:44:15.504 ERROR httpjail::proxy: Error handling HTTPS connection: received fatal alert: UnknownCAerror: Uncaught (in promise) TypeError: error sending request for url (https://example.com/): client error (Connect): invalid peer certificate: UnknownIssuerconst r = await fetch('https://example.com'); console.log(r.status); await r.bytes(); ^ at async mainFetch (ext:deno_fetch/26_fetch.js:192:12) at async fetch (ext:deno_fetch/26_fetch.js:475:11) at async file:///test/$deno$eval.mts:1:11 hint: Run again with the `--unsafely-ignore-certificate-errors` flag to bypass certificate errors.

To fix this issue, DENO_CERT is added to the list of environment variables set by httpjail. With this patch, Deno throws no errors anymore:

root@905d9a57c5be:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"200

This manual testing was performed using the Dockerfile below.

FROM rust:1.92.0-bookworm AS builder
WORKDIR /build
COPY . .
RUN cargo build --profile fast
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y \
curl \
ca-certificates \
nftables \
iproute2 \
procps \
unzip \
&& rm -rf /var/lib/apt/lists/*
# Install Node.js 24RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
&& apt-get install -y nodejs
# Install DenoRUN curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh
# Copy httpjail binaryCOPY --from=builder /build/target/fast/httpjail /usr/local/bin/httpjail
WORKDIR /
CMD ["/bin/bash"]

Closes#96

[magurotuna]

This adds DENO_CERT environment variable to make Deno programs trust httpjail's proxy CA certificate.

httpjail sets environment variables like SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, etc. to make programs trust the proxy's CA. However, Deno uses its own DENO_CERT variable, causing Deno programs to fail with certificate errors:

root@86de9af35c35:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"03:44:15.504 ERROR httpjail::proxy_tls: TLS handshake failed: received fatal alert: UnknownCA03:44:15.504 ERROR httpjail::proxy: Error handling HTTPS connection: received fatal alert: UnknownCAerror: Uncaught (in promise) TypeError: error sending request for url (https://example.com/): client error (Connect): invalid peer certificate: UnknownIssuerconst r = await fetch('https://example.com'); console.log(r.status); await r.bytes(); ^ at async mainFetch (ext:deno_fetch/26_fetch.js:192:12) at async fetch (ext:deno_fetch/26_fetch.js:475:11) at async file:///test/$deno$eval.mts:1:11 hint: Run again with the `--unsafely-ignore-certificate-errors` flag to bypass certificate errors.

To fix this issue, DENO_CERT is added to the list of environment variables set by httpjail. With this patch, Deno throws no errors anymore:

root@905d9a57c5be:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"200

This manual testing was performed using the Dockerfile below.

FROM rust:1.92.0-bookworm AS builder
WORKDIR /build
COPY . .
RUN cargo build --profile fast
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y \
curl \
ca-certificates \
nftables \
iproute2 \
procps \
unzip \
&& rm -rf /var/lib/apt/lists/*
# Install Node.js 24RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
&& apt-get install -y nodejs
# Install DenoRUN curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh
# Copy httpjail binaryCOPY --from=builder /build/target/fast/httpjail /usr/local/bin/httpjail
WORKDIR /
CMD ["/bin/bash"]

Closes#96

[magurotuna]

This adds DENO_CERT environment variable to make Deno programs trust httpjail's proxy CA certificate.

httpjail sets environment variables like SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, etc. to make programs trust the proxy's CA. However, Deno uses its own DENO_CERT variable, causing Deno programs to fail with certificate errors:

root@86de9af35c35:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"03:44:15.504 ERROR httpjail::proxy_tls: TLS handshake failed: received fatal alert: UnknownCA03:44:15.504 ERROR httpjail::proxy: Error handling HTTPS connection: received fatal alert: UnknownCAerror: Uncaught (in promise) TypeError: error sending request for url (https://example.com/): client error (Connect): invalid peer certificate: UnknownIssuerconst r = await fetch('https://example.com'); console.log(r.status); await r.bytes(); ^ at async mainFetch (ext:deno_fetch/26_fetch.js:192:12) at async fetch (ext:deno_fetch/26_fetch.js:475:11) at async file:///test/$deno$eval.mts:1:11 hint: Run again with the `--unsafely-ignore-certificate-errors` flag to bypass certificate errors.

To fix this issue, DENO_CERT is added to the list of environment variables set by httpjail. With this patch, Deno throws no errors anymore:

root@905d9a57c5be:/# httpjail --js "r.host === 'example.com'" -- deno eval"const r = await fetch('https://example.com'); console.log(r.status); await r.bytes();"200

This manual testing was performed using the Dockerfile below.

FROM rust:1.92.0-bookworm AS builder
WORKDIR /build
COPY . .
RUN cargo build --profile fast
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y \
curl \
ca-certificates \
nftables \
iproute2 \
procps \
unzip \
&& rm -rf /var/lib/apt/lists/*
# Install Node.js 24RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
&& apt-get install -y nodejs
# Install DenoRUN curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh
# Copy httpjail binaryCOPY --from=builder /build/target/fast/httpjail /usr/local/bin/httpjail
WORKDIR /
CMD ["/bin/bash"]

Closes#96