Pit https: import trust into the NSS database the Flatpak engine actually reads - #105
Merged
Merged
Conversation
…ally reads Still an invalid certificate on bonita after v3.12.0. The launcher runs the Flathub ungoogled-chromium when it is the newest engine, and that Flatpak is sandboxed with --persist=.pki: inside it ~/.pki is ~/.var/app/io.github.ungoogled_software.ungoogled_chromium/.pki, so the helper's import into the real ~/.pki/nssdb never reached the browser. The launcher's own Local CA sync had the same blind spot. The helper now imports each leaf into every database a Chromium could read: ~/.pki/nssdb, the database the launcher names for the engine it started (TRON_PIT_NSSDB_EXTRA, created if missing), and any ~/.var/app/*chromium*/.pki/nssdb. The launcher passes the Flatpak engine's database to the helper and its sync writes both. /pit/status lists the databases. Helper 3.4.1. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
ThreatCrush Security Scan54 finding(s) HIGH/CRITICAL: 2 | MEDIUM: 32 | LOW: 20
…and 4 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
https://chovy.hacker/was still an invalid certificate on bonita after v3.12.0, with the leaf-trust code in place.Why
The launcher runs the Flathub ungoogled-chromium when it is the newest engine, and that Flatpak's manifest has
--persist=.pki. Inside the sandbox~/.pkiis~/.var/app/io.github.ungoogled_software.ungoogled_chromium/.pki, so the helper's import into the real~/.pki/nssdbwas never seen by the browser. The launcher's existing Local CA sync (sync_moshpit_trust) had the same blind spot since v3.9.12.Fix
tron-tor-helper(3.4.1): each leaf is imported into every database a Chromium here could read:~/.pki/nssdb, the database the launcher names for the engine it started (TRON_PIT_NSSDB_EXTRA, created if missing), and any existing~/.var/app/*chromium*/.pki/nssdb. Non-Chromium Flatpak databases are left alone./pit/statusand/pit/startlist the databases undertrust.nssdbs.launcher/tronbrowser: passes the Flatpak engine's database to the helper, andsync_moshpit_trustnow writes both~/.pki/nssdband the Flatpak one when the engine is a Flatpak.HELPER_VERSION3.4.1 so the running helper is replaced on next launch.Verified
$HOMEwith a pre-created ungoogled-chromium Flatpak database and a Firefox one, primary and extra databases set to scratch paths (extra nonexistent): afterhttps://chovy.hacker/through the pit, the leaf is in the primary, the extra (created), and the ungoogled-chromium database; the Firefox one has nothing. Second connect is a cache hit.sync_moshpit_trustextracted and run with a fake$HOME,BROWSER=flatpak: the four Moshpit certificates on this box land in both~/.pki/nssdband~/.var/app/<app>/.pki/nssdb; with a native engine only~/.pki/nssdbis created.sh -nok. No JS changes.Not reproduced on bonita (no SSH from here); the Flatpak
--persist=.pkiis read from the Flathub manifest and matches the launcher's "run the newest engine" rule.🤖 Generated with Claude Code