Draft: Make Firefox, Thunderbird and Chromium trust system root certificate store

This works by making libnssckbi.so consumers like the mentioned applications use p11-kit.

The change consists of two parts:

1. A workaround for #704180 p11-kit which unfortunately still does not provide a package which replaces/diverts libnssckbi.so. This can be reverted and replaced with a dependency on such a package as soon as that becomes available.
2. The removal of the pre-poulation of ~/.pki/nssdb/ in different places as well as policies for Firefox and Thunderbird with the same effect.

Due to the diversion in 1.) the package becomes architecture dependent.

assigned to @sunweaver

marked this merge request as draft

added 2 commits

• 15638508 - Make libnssckbi.so consumers trust system root certificate store
• 24bd34d8 - Stop adding the DebianEdu root CA to NSS shared database

Compare with previous version

marked this merge request as ready

For Debian 12 we can't switch the package from arch-indep to arch-dep. So, this MR / change will have to wait until we move over to Debina Edu 13 development. I'll draft this MR for now to make it obvious that this branch / MR is not ready for merging, yet.

marked this merge request as draft

Re: 2. The removal of the pre-poulation of ~/.pki/nssdb/ in different places as well as policies for Firefox and Thunderbird with the same effect.

Please note that ~/.pki/nssdb has been mainly introduced for Chromium. Have you tested the removals with Chromium?

Yes, it works.

I'd rather add a separate bin:pkg to src:debian-edu-config (e.g. debian-edu-config-libnssckb-provider) and move all p11-kit-modules related logic into there.

However, this will also be a hacky work-around.

How about a much simpler approach, see: https://code.it-zukunft-schule.de/cgit/itzks-systems/tree/etc/skel/.mozilla/firefox/debian-edu.default/pkcs11.txt

I'd rather add a separate bin:pkg to src:debian-edu-config (e.g. debian-edu-config-libnssckb-provider) and move all p11-kit-modules related logic into there.

However, this will also be a hacky work-around.

It would be a subpackage that actually belongs in p11-kit. There is a branch available with it since 2019 linked from #704180, it just need to be updated and merged.

How about a much simpler approach, see: https://code.it-zukunft-schule.de/cgit/itzks-systems/tree/etc/skel/.mozilla/firefox/debian-edu.default/pkcs11.txt

IMHO it is better to have this configured in one place, system-wide for all consumers of libnssckbi.so, but I agree that this is a workaround and it would be better if it were a subpackage of p11-kit and even installed on Debian by default, not only DebianEdu (it has been e.g. in Fedora/RHEL since 2013). But your call how you want to go about this? Any way can we get progress on #704180 and #741005?

changed this line in version 3 of the diff

DEB_HOST_MULTIARCH is available via dpkg-architecture -q DEB_HOST_MULTIARCH

Is it OK to pre-depend on dpkg-dev?

changed this line in version 3 of the diff

same here: dpkg-architecture -q DEB_HOST_MULTIARCH

changed this line in version 3 of the diff

not needed when using dpkg-architecture call in the script

move into separate bin:pkg

OK.

changed this line in version 3 of the diff

Several changes I'd propose here, most important: introduce an arch-dep bin:pkg which ships the p11-kit-modules related changes.

Furthermore, please consider shipping a simple /etc/skel file instead.

added 2 commits

• 55073797 - Make libnssckbi.so consumers trust system root certificate store
• 124070c6 - Stop adding the DebianEdu root CA to NSS shared database

Compare with previous version

added 15 commits

• 124070c6...01e201ca - 13 commits from branch master
• dda7b262 - Make libnssckbi.so consumers trust system root certificate store
• 4b63838a - Stop adding the DebianEdu root CA to NSS shared database

Compare with previous version

added 35 commits

• 4b63838a...1373cfcc - 33 commits from branch master
• 608af78c - Make libnssckbi.so consumers trust system root certificate store
• 909c45c1 - Stop adding the DebianEdu root CA to NSS shared database

Compare with previous version