fix(launcher): trust Moshpit certificates in the store Chromium reads - #90
Merged
Conversation
`curl https://chovy.hacker` returns the page while the same URL in TronBrowser fails with ERR_CERT_AUTHORITY_INVALID. Not a Moshpit regression and not a resolver problem: the two read different trust stores. curl/OpenSSL reads /etc/ssl/certs, which is the only store Moshpit writes. Chromium on Linux takes user-added trust from the per-user NSS database at ~/.pki/nssdb and nowhere else — a path keyed off $HOME, not off --user-data-dir, so no TronBrowser profile could ever have carried it and reinstalling never helped. The launcher now mirrors whatever Moshpit installed into ~/.pki/nssdb on every start. Every start rather than once at install, because names get pointed and trusted long after the browser is installed; an entry already present is skipped by nickname, so the steady state costs one `certutil -L`. The trust flag is the part that is easy to get wrong. The Moshpit Local CA is CA:TRUE and goes in as an anchor ("C,,"); a per-name origin leaf is CA:FALSE, self-signed, and must go in as a trusted peer ("P,,"). Importing a leaf as "C,," fails, because Chromium will not anchor a CA:FALSE certificate — the same wall the old CA:TRUE origin certificates hit from the other side. basicConstraints is read rather than guessed from the filename, since getting it backwards fails exactly like doing nothing. The Local CA keeps the nickname `moshcode dns enable` uses, so a database it already wrote is recognised as done. install.sh installs certutil (libnss3-tools / nss-tools / nss / mozilla-nss-tools) on install and upgrade, but only on a machine that actually has Moshpit certificates — a package nobody needs is not ours to install. That is the one part of the job needing root, and without it the launcher can only print a command for the user to run. Also guards both ensure_ calls with `|| true`. They return 1 when they could not install their tool and the script runs under `set -eu`, so on a machine with no supported package manager `ensure_tor` was aborting an install that had already put the browser on disk. Verified on Linux against real Moshpit certificates: a Chromium whose NSS database was built only by this code loads https://chovy.hacker and https://seo.rank at 200, where the same Chromium with an empty database fails ERR_CERT_AUTHORITY_INVALID. Import is idempotent, the certutil-missing path prints the hint and writes no database, the opt-out (TRONBROWSER_NO_MOSHPIT_TRUST=1) returns early, and the full launcher still reaches the browser with rc=0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P2zwGvXnFseRtrDWH9khxn
ThreatCrush Security Scan49 finding(s) MEDIUM: 31 | LOW: 18
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
curl https://chovy.hackerreturns the page. The same URL in TronBrowser fails withERR_CERT_AUTHORITY_INVALID.Not a Moshpit regression and not a resolver problem — the two read different trust stores:
/etc/ssl/certs/usr/local/share/ca-certificates/moshpit-*.crt+update-ca-certificates)~/.pki/nssdbThat NSS path is keyed off
$HOME, not off--user-data-dir, so no TronBrowser profile could ever have carried it and reinstalling never helped. From inside the browser there is nothing the user can do about it, which is why it reads as a TronBrowser bug.The fix
Launcher mirrors whatever Moshpit installed into
~/.pki/nssdb. On every start, not once at install: names get pointed and trusted long after the browser is installed. An entry already present is skipped by nickname, so the steady state costs onecertutil -L.TRONBROWSER_NO_MOSHPIT_TRUST=1opts out.The trust flag is the part that is easy to get wrong:
CA:TRUE, an anchor,C,,. What a machine behind the pinned-TLS proxy is served.CA:FALSE, self-signed, SAN = the name,P,,(trusted peer).Importing a leaf as
C,,fails: Chromium will not anchor aCA:FALSEcertificate — the same wall the oldCA:TRUEorigin certificates hit from the other side.basicConstraintsis read rather than guessed from the filename, because getting it backwards fails exactly like doing nothing. The Local CA keeps the nicknamemoshcode dns enableuses, so a database it already wrote is recognised as done rather than written twice.install.sh installs
certutil(libnss3-tools/nss-tools/nss/mozilla-nss-tools) on install and upgrade — that is the one part of the job needing root, and without it the launcher can only print a command for the user to run. Gated on the machine actually having Moshpit certificates: a package nobody needs is not ours to install. macOS returns early; Chromium there reads the system keychain, whichmoshcode dns enablealready writes.Drive-by, and worth a look
Both
ensure_calls are now|| true. They return 1 when they could not install their tool, and the script runs underset -eu— so on a machine with no supported package manager,ensure_torwas aborting an install that had already put the browser on disk. Pre-existing; it sits on the lines this PR touches.Verified
On Linux, against the real Moshpit certificates on the dev box:
https://chovy.hackerandhttps://seo.rankat 200ERR_CERT_AUTHORITY_INVALID(the control)P,,, the Local CAC,,TRONBROWSER_NO_MOSHPIT_TRUST=1returns earlysh -nclean on both files, plus the extractedtronCLI heredoc; shellcheck reports nothing new🤖 Generated with Claude Code
https://claude.ai/code/session_01P2zwGvXnFseRtrDWH9khxn