Skip to content

Commit ac95c35

Browse files
bmiddhabmiddha
authored
[debug-certificate-manager] Reimplement Certificate Manager VS Code Extension (#5285)
## Summary The previous implementation needed 2 separate VS Code extensions to sync certificates. One running on the local machine ("ui" extension) and one on the remote machine ("workspace" extension). Running as 1 extension removes the ping-pong handshake and version checks that were used with the 2 extension version. This also simplifies the publishing story. Rebranded to "Debug Certificate Manager" since this also works in non-remote scenarios to trust and untrust local certificates. ## Details The new implementation only runs as a "ui" extension and uses VS Code's remote file URIs to manipulate files in the remote workspace. The new implementation now uses a config file to learn the certificate store path and filenames in the remote workspace. This change also updates `CertificateStore` to read the same config. Updated publish pipeline: - Log user id used by the service connection. - Generate a manifest which will be used to sign the extension before publishing to the marketplace. Removed `tls-sync-vscode-extensions` version policy. This was used to keep the multiple extension versions in lock-step so that the version could be verified during the ping-pong handshake. This is no longer needed with the 1 extension implementation. Removed packages: - vscode-extensions/tls-sync-vscode-ui-extension - vscode-extensions/tls-sync-vscode-workspace-extension - vscode-extensions/tls-sync-vscode-extension-pack - vscode-extensions/tls-sync-vscode-shared Added package: - vscode-extensions/debug-certificate-manager-vscode-extension Updated vscode heft plugins to handle generating the extension manifest used for signing and publishing the vsix. Update publishing pipeline to add a signing step (more work to do on the signing) and update publishing to use the heft plugin. ## How it was tested Tested `CertificateStore` config file changes with `npx heft trust-dev-cert` and `npx heft untrust-dev-cert`. Tested extension changes by running the in VS Code extension development host using the `launch.json` config.
1 parent 2af2a7f commit ac95c35

65 files changed

Lines changed: 643 additions & 962 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.vscode/launch.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,19 @@
8585
"${workspaceFolder}/vscode-extensions/rush-vscode-extension/dist/**/*.js"
8686
]
8787
// "preLaunchTask": "npm: build:watch - vscode-extensions/rush-vscode-extension"
88+
},
89+
{
90+
"name": "Launch Debug Certificate Manager VS Code Extension",
91+
"type": "extensionHost",
92+
"request": "launch",
93+
"cwd": "${workspaceFolder}/vscode-extensions/debug-certificate-manager-vscode-extension/dist/vsix/unpacked",
94+
"args": [
95+
"--extensionDevelopmentPath=${workspaceFolder}/vscode-extensions/debug-certificate-manager-vscode-extension/dist/vsix/unpacked"
96+
],
97+
"sourceMaps": true,
98+
"outFiles": [
99+
"${workspaceFolder}/vscode-extensions/debug-certificate-manager-vscode-extension/**"
100+
]
88101
}
89102
]
90103
}

‎README.md‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -218,12 +218,9 @@ These GitHub repositories provide supplementary resources for Rush Stack:
218218
| [/rigs/local-node-rig](./rigs/local-node-rig/) | A rig package for Node.js projects that build using Heft inside the RushStack repository. |
219219
| [/rigs/local-web-rig](./rigs/local-web-rig/) | A rig package for Web projects that build using Heft inside the RushStack repository. |
220220
| [/rush-plugins/rush-litewatch-plugin](./rush-plugins/rush-litewatch-plugin/) | An experimental alternative approach for multi-project watch mode |
221+
| [/vscode-extensions/debug-certificate-manager-vscode-extension](./vscode-extensions/debug-certificate-manager-vscode-extension/) | VS Code extension to manage debug TLS certificates and sync them to the VS Code workspace. Works with VS Code remote development (Codespaces, SSH, Dev Containers, WSL, VS Code Tunnels). |
221222
| [/vscode-extensions/rush-vscode-command-webview](./vscode-extensions/rush-vscode-command-webview/) | Part of the Rush Stack VSCode extension, provides a UI for invoking Rush commands |
222223
| [/vscode-extensions/rush-vscode-extension](./vscode-extensions/rush-vscode-extension/) | Enhanced experience for monorepos that use the Rush Stack toolchain |
223-
| [/vscode-extensions/tls-sync-vscode-extension-pack](./vscode-extensions/tls-sync-vscode-extension-pack/) | |
224-
| [/vscode-extensions/tls-sync-vscode-shared](./vscode-extensions/tls-sync-vscode-shared/) | |
225-
| [/vscode-extensions/tls-sync-vscode-ui-extension](./vscode-extensions/tls-sync-vscode-ui-extension/) | |
226-
| [/vscode-extensions/tls-sync-vscode-workspace-extension](./vscode-extensions/tls-sync-vscode-workspace-extension/) | |
227224
| [/vscode-extensions/vscode-shared](./vscode-extensions/vscode-shared/) | |
228225
| [/webpack/webpack-deep-imports-plugin](./webpack/webpack-deep-imports-plugin/) | This plugin creates a bundle and commonJS files in a 'lib' folder mirroring modules in another 'lib' folder. |
229226
<!-- GENERATED PROJECT SUMMARY END -->

‎common/changes/@rushstack/debug-certificate-manager/bmiddha-tls-sync-v2_2025-07-24-22-08.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"changes": [
3+
{
4+
"packageName": "@rushstack/debug-certificate-manager",
5+
"comment": "Read CertificateStore configuration from .vscode/debug-certificate-manager.json",
6+
"type": "patch"
7+
}
8+
],
9+
"packageName": "@rushstack/debug-certificate-manager"
10+
}

‎common/changes/@rushstack/heft-vscode-extension-plugin/bmiddha-tls-sync-v2_2025-07-24-22-08.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"changes": [
3+
{
4+
"packageName": "@rushstack/heft-vscode-extension-plugin",
5+
"comment": "Add support for generating extension manifest.",
6+
"type": "minor"
7+
},
8+
{
9+
"packageName": "@rushstack/heft-vscode-extension-plugin",
10+
"comment": "Add VSIX publish plugin.",
11+
"type": "minor"
12+
}
13+
],
14+
"packageName": "@rushstack/heft-vscode-extension-plugin"
15+
}

‎common/changes/@rushstack/heft-vscode-extension-rig/bmiddha-tls-sync-v2_2025-07-25-06-09.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"changes": [
3+
{
4+
"packageName": "@rushstack/heft-vscode-extension-rig",
5+
"comment": "Add publish vsix plugin configuration.",
6+
"type": "patch"
7+
}
8+
],
9+
"packageName": "@rushstack/heft-vscode-extension-rig"
10+
}

‎common/config/azure-pipelines/vscode-extension-publish.yaml‎

Lines changed: 41 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -9,17 +9,13 @@ parameters:
99
- name: ExtensionPublishConfig
1010
type: object
1111
default:
12-
- key: 'tls-sync-vscode-ui-extension'
12+
- key: 'debug-certificate-manager-vscode-extension'
1313
vsixPath: 'dist/vsix/packaged.vsix'
14-
projectPath: '$(Build.SourcesDirectory)/vscode-extensions/tls-sync-vscode-ui-extension'
15-
- key: 'tls-sync-vscode-workspace-extension'
16-
vsixPath: 'dist/vsix/packaged.vsix'
17-
projectPath: '$(Build.SourcesDirectory)/vscode-extensions/tls-sync-vscode-workspace-extension'
18-
- key: 'tls-sync-vscode-extension-pack'
19-
vsixPath: 'dist/vsix/packaged.vsix'
20-
projectPath: '$(Build.SourcesDirectory)/vscode-extensions/tls-sync-vscode-extension-pack'
14+
manifestPath: 'dist/vsix/extension-manifest.json'
15+
projectPath: '$(Build.SourcesDirectory)/vscode-extensions/debug-certificate-manager-vscode-extension'
2116
- key: 'rush-vscode-extension'
2217
vsixPath: 'dist/vsix/packaged.vsix'
18+
manifestPath: 'dist/vsix/extension-manifest.json'
2319
projectPath: '$(Build.SourcesDirectory)/vscode-extensions/rush-vscode-extension'
2420

2521
resources:
@@ -62,13 +58,49 @@ extends:
6258
--to tag:vsix
6359
6460
- ${{ if parameters.shouldPublish }}:
61+
- task: AzureCLI@2
62+
displayName: 'Get managed identity user info'
63+
inputs:
64+
azureSubscription: 'rushstack-vscode-publish'
65+
scriptType: bash
66+
scriptLocation: inlineScript
67+
inlineScript: |
68+
az rest -u https://app.vssps.visualstudio.com/_apis/profile/profiles/me --resource 499b84ac-1321-427f-aa17-267ca6975798
69+
6570
- ${{ each extension in parameters.ExtensionPublishConfig }}:
71+
- bash: cp ${{ extension.manifestPath }} ${{ extension.projectPath }}/extension.signature.p7s
72+
workingDirectory: ${{ extension.projectPath }}
73+
displayName: 'Prepare manifest for signing: ${{ extension.key }}'
74+
75+
- task: EsrpCodeSigning@5
76+
displayName: 'ESRP CodeSigning'
77+
inputs:
78+
connectedservicename: '' # TODO
79+
AppRegistrationClientId: '' # TODO
80+
AppRegistrationTenantId: '' # TODO
81+
AuthAKVName: '' # TODO
82+
AuthCertName: '' # TODO
83+
AuthSignCertName: '' # TODO
84+
FolderPath: '${{ extension.projectPath }}'
85+
Pattern: 'extension.signature.p7s'
86+
signConfigType: inlineSignParams
87+
inlineOperation: |
88+
[
89+
{
90+
"keyCode": "CP-401405",
91+
"operationSetCode": "VSCodePublisherSign",
92+
"parameters": [],
93+
"toolName": "sign",
94+
"toolVersion": "1.0"
95+
}
96+
]
97+
6698
- task: AzureCLI@2
6799
displayName: 'Publish VSIX: ${{ extension.key }}'
68100
inputs:
69101
azureSubscription: rushstack-vscode-publish
70102
scriptType: 'bash'
71103
scriptLocation: 'inlineScript'
72104
inlineScript: |
73-
node node_modules/@rushstack/heft-vscode-extension-rig/node_modules/@rushstack/heft-vscode-extension-plugin/node_modules/@vscode/vsce/vsce publish --no-dependencies --azure-credential --packagePath ${{ extension.vsixPath }}
105+
node node_modules/@rushstack/heft/lib/start.js publish-vsix --vsix-path ${{ extension.vsixPath }} --manifest-path ${{ extension.projectPath }}/extension.manifest --signature-path ${{ extension.projectPath }}/extension.signature.p7s
74106
workingDirectory: ${{ extension.projectPath }}

‎common/config/rush/version-policies.json‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -105,15 +105,5 @@
105105
"version": "5.157.0",
106106
"nextBump": "minor",
107107
"mainProject": "@microsoft/rush"
108-
},
109-
{
110-
// This policy is used for the TLS Sync VS Code extensions.
111-
// Updating them in lockstep is necessary for the UI and Workspace extensions to work together.
112-
// The Workspace and UI extensions perform a ping-pong version check to ensure they are compatible.
113-
"policyName": "tls-sync-vscode-extensions",
114-
"definitionName": "lockStepVersion",
115-
"version": "0.0.1",
116-
"nextBump": "minor",
117-
"mainProject": "tls-sync-vscode-extension-pack"
118108
}
119109
]

‎common/config/subspaces/default/pnpm-lock.yaml‎

Lines changed: 1 addition & 81 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎heft-plugins/heft-vscode-extension-plugin/heft-plugin.json‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,38 @@
11
{
22
"$schema": "https://developer.microsoft.com/json-schemas/heft/v0/heft-plugin.schema.json",
3-
43
"taskPlugins": [
54
{
65
"pluginName": "vscode-extension-package-plugin",
7-
"entryPoint": "./lib/VSCodeExtensionPackagePlugin.js"
6+
"entryPoint": "./lib/VSCodeExtensionPackagePlugin.js",
7+
"parameterScope": "package"
8+
},
9+
{
10+
"pluginName": "vscode-extension-publish-plugin",
11+
"entryPoint": "./lib/VSCodeExtensionPublishPlugin.js",
12+
"parameterScope": "publish-vsix",
13+
"parameters": [
14+
{
15+
"longName": "--vsix-path",
16+
"parameterKind": "string",
17+
"argumentName": "RELATIVE_PATH",
18+
"description": "Use this parameter to control which VSIX file will be used for publishing.",
19+
"required": true
20+
},
21+
{
22+
"longName": "--manifest-path",
23+
"parameterKind": "string",
24+
"argumentName": "RELATIVE_PATH",
25+
"description": "Use this parameter to control which manifest file will be used for publishing.",
26+
"required": true
27+
},
28+
{
29+
"longName": "--signature-path",
30+
"parameterKind": "string",
31+
"argumentName": "RELATIVE_PATH",
32+
"description": "Use this parameter to control which signature file will be used for publishing.",
33+
"required": true
34+
}
35+
]
836
}
937
]
1038
}

0 commit comments

Comments
 (0)