Pit https on Flatpak engines: pass the trusted names' pins at launch; write every NSS database a Chromium could open - #106
Merged
Conversation
… and write every NSS database a Chromium could open Bonita, Flathub ungoogled-chromium 152: the leaf sat in the very database strace showed Chromium opening (peer and anchor trust both tried; single-process, no-sandbox and NetworkServiceSandbox off made no difference) and the net log still said No matching issuer found. What that build honours is --ignore-certificate-errors-spki-list, verified headless on the machine. The helper now records every pin it accepts (a key the registry vouches for, for that name) in ~/.tronbrowser/pit-certs/pins.txt, and for a Flatpak engine the launcher passes those pins at start; the sidebar says a first visit needs one relaunch there. Chromium shows its unsupported-flag bar when the switch is present, so it is only passed with at least one pin. Also: Chromium opens one of two NSS databases per home, ~/.pki/nssdb or since M146 XDG_DATA_HOME/pki/nssdb, and which one a build picks has changed between versions; a Flatpak's are ~/.var/app/<app>/.pki/nssdb and .../data/pki/nssdb. Helper and launcher sync now write every candidate that exists and create the legacy one only when none does. Helper 3.4.2. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
ThreatCrush Security Scan54 finding(s) HIGH/CRITICAL: 2 | MEDIUM: 32 | LOW: 20
…and 4 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
ralyodio
added a commit
that referenced
this pull request
Sep 16, 2026
…m, prefer it, drop the pin-flag workaround (#107) The Flathub ungoogled-chromium ignores NSS user trust (bonita, 152: the leaf sat in the exact database strace showed it opening, every sandbox switch made no difference, net log said No matching issuer found), while the same 152 as a portable build accepts that database. The pin flag from #106 worked but Chromium marks it unsupported at every start. So install.sh now fetches the pinned portable ungoogled-chromium into <launcher dir>/engine on install and upgrade, the launcher prefers it after a --version probe, and https on Moshpit names goes back to the silent per-name NSS import. The helper (3.4.3) reports flatpak-engine so the sidebar points at tron upgrade when a Flatpak is still running. Verified end to end in a container: the real launcher picked the engine, the helper imported the leaf, https://chovy.hacker loaded with no flags. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
https://chovy.hacker/still warned on bonita after v3.12.1, with the leaf present in every NSS database. This makes it work on Flatpak engines by a different route, and fixes database selection for everyone.What bonita showed (Flathub ungoogled-chromium 152.0.7977.82-1)
strace: Chromium opens~/.pki/nssdb/cert9.dbinside the sandbox, i.e. the persisted database, which held the leaf asP,,and laterCP,,.--no-sandbox,--disable-features=NetworkServiceSandbox,--single-process,--no-zygote: all still "Privacy error".net_error -202,ERROR: No matching issuer found,cert_status 4. SoTrustStoreNSSreturned Unspecified for a certificate NSS had trust records for.--ignore-certificate-errors-spki-list=<registry pin>→ page loads. Chromium's own per-key allowance works where NSS trust does not.P,,andCP,,, with and without p11-kit-trust loaded, with and without the leaf in the system store. The Flatpak difference remains unexplained; this PR routes around it.Fix
~/.tronbrowser/pit-certs/pins.txt(name pin, once per pair)./pit/startreportstrust.engineandtrust.relaunch(true for Flatpak).TRON_PIT_ENGINE). For a Flatpak engine it readspins.txtand passes--ignore-certificate-errors-spki-list=<pins>at launch, only when at least one pin exists, because that switch is on Chromium's bad-flags list and shows the "unsupported command-line flag" bar at start. Junk lines are rejected, pins deduped.~/.pki/nssdbor since M146$XDG_DATA_HOME/pki/nssdb, and a Flatpak's are~/.var/app/<app>/.pki/nssdband.../data/pki/nssdb. Write every candidate that exists; create the legacy one only when none does, so a newer Chromium is never flipped onto a fresh empty store.Verified
$HOMEwith a Flatpak app dir holding both.pki/nssdbanddata/pki/nssdb, an XDG home database, a Firefox one, engineflatpak: https through the pit → leaf in the three Chromium candidates, Firefox untouched, legacy~/.pkinot created (XDG existed),pins.txthas one line, second visit adds nothing,trust: {engine: flatpak, relaunch: true}.pit_spki_flag: builds--ignore-certificate-errors-spki-list=<a>,<b>from a file with duplicates and junk lines; prints nothing for empty or missing files.sync_moshpit_trustwith a Flatpak engine writes only the existing databases.pnpm lintclean, extension tests 30/30, helper compiles, launchersh -nok.Trade-offs
On a Flatpak engine a name's first https visit needs one relaunch, and machines with pins see Chromium's one-line flag bar at start. Native engines take the NSS path and get neither.
🤖 Generated with Claude Code