Make node-forge an optional dependency

[patak-dev]

Clear and concise description of the problem

@sapphi-red made Terser an optional dep with:

• chore: make terser an optional dependency #8049

@TrySound suggested that we do the same with node-forge. It is a big dependency (1.5MB) and it is only needed when creating an HTTP cert:

• https://packagephobia.com/result?p=node-forge

Suggested solution

We have two options:

1. Make the dep optional leaving the functionality as-is. If the user doesn't include a cert, we'll ask them to install node-forge.
2. Move the auto-generated HTTP cert logic to a new @vitejs/plugin-basic-ssl. See comment from @dominikg here fix: pregenerate https certificate #6173 (comment). Add documentation to explain how to properly generate certs and do a proper SSL setup (and link to the basic SSL plugin as an option, but not even the best)

I think 2. is better here. Opening the issue in case someone wants to work on it, I'll get to it if not before v3.

Alternative

No response

Additional context

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that request the same feature to avoid creating a duplicate.

[winderica]

What about the third option - migrate from node-forge to @peculiar/x509? The latter

1. has a much smaller publish size (379 KB),
   • for node 14, webcrypto is not natively supported, and an additional dependency @peculiar/webcrypto (192 KB) is required
2. is written in TypeScript and comes with first-party type definitions,
3. provides friendlier APIs.

If this makes sense, I am willing to submit a PR.

Of course, this option can be taken together with option 1 or option 2, but I am afraid I don't have much time to work on them :(

[patak-dev]

Interesting. It looks like the library is quite actively maintained. @winderica this seems like a good option to reduce the size, we could discuss it in a PR to see how it works.
For v3, it is still important to do option 1 or 2 so we also avoid the extra 570kb (it is half of node-forge) but still big compared to the current size of Vite. So the priority should be to do that, but you can work in parallel to improve 1 or 2 if you would like to do that.

[sapphi-red]

I took some data.

before #8584 (d1ba059)

npm notice === Tarball Details ===
npm notice name:          vite
npm notice version:       3.0.0-alpha.11
npm notice filename:      vite-3.0.0-alpha.11.tgz
npm notice package size:  888.4 kB
npm notice unpacked size: 3.7 MB
npm notice shasum:        fb4e7177d4f88b1bf964b91eb3bb6a10e8945245
npm notice integrity:     sha512-HsuLVUIG9I21P[...]Z7a+LbmnRU2Pg==
npm notice total files:   42

with #8584 (ac680a1)

npm notice === Tarball Details ===
npm notice name:          vite
npm notice version:       3.0.0-alpha.11
npm notice filename:      vite-3.0.0-alpha.11.tgz
npm notice package size:  835.8 kB
npm notice unpacked size: 3.7 MB
npm notice shasum:        54092e618b46cbff501ac9dc0b068abaacb49403
npm notice integrity:     sha512-57bVTQhMFlmLI[...]mWxKiL2j4biHw==
npm notice total files:   43

with #8584 (ac680a1) and removed @peculiar/webcrypto

npm notice === Tarball Details ===
npm notice name:          vite
npm notice version:       3.0.0-alpha.11
npm notice filename:      vite-3.0.0-alpha.11.tgz
npm notice package size:  814.2 kB
npm notice unpacked size: 3.6 MB
npm notice shasum:        839a3344541b26c99ffd909e7c38f3521961189b
npm notice integrity:     sha512-4VFC8lq7KiWx2[...]CxAI4D0f+BV2Q==
npm notice total files:   42

removed src/node/certificate.ts completely

npm notice === Tarball Details ===
npm notice name:          vite
npm notice version:       3.0.0-alpha.11
npm notice filename:      vite-3.0.0-alpha.11.tgz
npm notice package size:  743.2 kB
npm notice unpacked size: 3.1 MB
npm notice shasum:        1687d6312174b69bf0d0526b7b462d5698726a05
npm notice integrity:     sha512-YZK8iXRWgZDl4[...]DPuDUhydhCP/Q==
npm notice total files:   42

[patak-dev]

Thanks for this data @sapphi-red. Maybe we should wait for swapping node-forge once we can drop Node 14? The package size diff is still not bad though (a ~6% drop).
I think I would feel a lot more comfortable with doing this change if we move certificate.ts to its own plugin, and swap node-forge there.

[winderica]

Maybe we should wait for swapping node-forge once we can drop Node 14?

That makes sense to me.

[tan9]

+1 for making node-forge optional or migrating to another implementation.

node-forge is dual-licensed under BSD and GPLv2, and because of the presence of GPL, the use of vite may be prohibited under some organizations like mine.