feat!: remove the trustNss feature option - #82
Merged
Conversation
trustNss only ever installed the libnss3-tools/nss-tools package. It never
imported anything into a container browser's NSS database — install.sh has
never invoked certutil, setup-cert.sh is openssl-only, and the workspace
extension has no NSS code at all. The "for Chromium/Firefox trust" framing
dates to the initial import and conflated it with the host-side NSS trust in
nssTrust.ts, which does perform a real import and is unaffected by this change.
Installing a package into the container is the devcontainer's job. Anyone who
set trustNss: true gets identical behavior from their Dockerfile:
RUN apt-get update && apt-get install -y --no-install-recommends libnss3-tools
or from devcontainer.json:
"postCreateCommand": "sudo apt-get update && sudo apt-get install -y libnss3-tools"
Removes the option from devcontainer-feature.json, the TRUST_NSS variable and
its install block from install.sh, the fixture entries from the install.sh
test, and the option rows from the three READMEs.
Side effect: install.sh no longer runs a package manager at all, so it no
longer does distro detection or apt-get update. The buildah /tmp workaround
stays — that bug is triggered by the devcontainer CLI's RUN --mount pattern,
not by our own apt-get, and still protects subsequent features.
BREAKING CHANGE: the trustNss feature option is removed. Configurations that
set it will have the option ignored by the devcontainer CLI; install
libnss3-tools from your Dockerfile or postCreateCommand instead.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KjJpJFDYwZTq7oYF7zLAkH
dnegstad
pushed a commit
that referenced
this pull request
Jul 28, 2026
#82 removed the trustNss feature option. The three READMEs on this branch had been restructured heavily, so git mis-anchored its one-line deletion against them — resolved by keeping this branch's content and applying the removal by hand: - Main README: dropped the option row, switched the feature-options example from trustNss to syncContainerCert, and rewrote the in-container browser trust note to point at the Dockerfile / postCreateCommand instead of the removed option. - Both extension READMEs: dropped trustNss from the "feature also accepts" sentences. Net change vs main is docs-only; the feature and test files match main exactly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KjJpJFDYwZTq7oYF7zLAkH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
trustNssonly ever installed thelibnss3-tools/nss-toolspackage. It never imported anything into a container browser's NSS database, so the option never delivered what its name and description promised. Installing a package into the container belongs in the devcontainer's own Dockerfile or config, not in this feature.Why it never worked
install.shhas never invokedcertutil—git log -S certutilover the feature directory returns one commit, and that hit is the word "certutil" inside the option description, not an invocation.setup-cert.shis openssl-only.The "for Chromium/Firefox trust" framing dates to the initial import, where it was written alongside the host-side NSS trust in
nssTrust.ts. That one does perform a realcertutilimport and is unaffected by this change — host browser trust on Linux continues to work exactly as before.Migration
Anyone who set
"trustNss": truegets identical behavior from their Dockerfile:RUN apt-get update && apt-get install -y --no-install-recommends libnss3-toolsor from
devcontainer.json:Changes
devcontainer-feature.json— option removedinstall.sh—TRUST_NSSvariable, its entry in the newline-validation loop, and the package-install block removedtest/install-sh.test.mjs— twoTRUSTNSS: "false"fixture entries removedsyncContainerCertinsteadSide effect worth noting:
install.shno longer runs a package manager at all, so it no longer does distro detection orapt-get update. The buildah/tmpworkaround stays — that bug is triggered by the devcontainer CLI'sRUN --mountpattern rather than by our ownapt-get, and the workaround still protects features that install after this one.No version bump here;
bump-version.ymlhandles that on release tags.Breaking change
The
trustNssoption is removed. Existing configurations that set it will have the option ignored by the devcontainer CLI (a warning, not a build failure, on current CLI versions). See Migration above.Verification
node test/validate-feature.mjs— all checks pass, including the assertion that every declared option is referenced ininstall.shnode --test test/install-sh.test.mjs— passesbash -n install.sh— clean (shellcheck isn't available in this environment; CI runs it)npm run lint— cleangrep -ri trustnssacross the repo — no references remainNote on #80
#80 also edits these three READMEs, including the
trustNssrows this PR deletes, so whichever merges second will need a rebase with a small conflict in the option tables. Happy to handle that once merge order is settled.🤖 Generated with Claude Code
https://claude.ai/code/session_01KjJpJFDYwZTq7oYF7zLAkH
Generated by Claude Code