From 5ec7633937d9685a1eabb37b687863b877c4f3a6 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 28 Jul 2026 04:37:47 +0000 Subject: [PATCH] feat!: remove the trustNss feature option MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit trustNss only ever installed the libnss3-tools/nss-tools package. It never imported anything into a container browser's NSS database — install.sh has never invoked certutil, setup-cert.sh is openssl-only, and the workspace extension has no NSS code at all. The "for Chromium/Firefox trust" framing dates to the initial import and conflated it with the host-side NSS trust in nssTrust.ts, which does perform a real import and is unaffected by this change. Installing a package into the container is the devcontainer's job. Anyone who set trustNss: true gets identical behavior from their Dockerfile: RUN apt-get update && apt-get install -y --no-install-recommends libnss3-tools or from devcontainer.json: "postCreateCommand": "sudo apt-get update && sudo apt-get install -y libnss3-tools" Removes the option from devcontainer-feature.json, the TRUST_NSS variable and its install block from install.sh, the fixture entries from the install.sh test, and the option rows from the three READMEs. Side effect: install.sh no longer runs a package manager at all, so it no longer does distro detection or apt-get update. The buildah /tmp workaround stays — that bug is triggered by the devcontainer CLI's RUN --mount pattern, not by our own apt-get, and still protects subsequent features. BREAKING CHANGE: the trustNss feature option is removed. Configurations that set it will have the option ignored by the devcontainer CLI; install libnss3-tools from your Dockerfile or postCreateCommand instead. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01KjJpJFDYwZTq7oYF7zLAkH --- README.md | 3 +-- .../devcontainer-feature.json | 5 ----- .../src/devcontainer-dev-certs/install.sh | 17 +---------------- src/vscode-ui-extension/README.md | 1 - src/vscode-workspace-extension/README.md | 1 - test/install-sh.test.mjs | 2 -- 6 files changed, 2 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index 40b398b..6971a24 100644 --- a/README.md +++ b/README.md @@ -147,7 +147,7 @@ Set under the feature entry in `devcontainer.json`: { "features": { "ghcr.io/dnegstad/devcontainer-dev-certs/devcontainer-dev-certs:1": { - "trustNss": true + "syncContainerCert": true } } } @@ -155,7 +155,6 @@ Set under the feature entry in `devcontainer.json`: | Option | Default | Description | |--------|---------|-------------| -| `trustNss` | `false` | Install NSS tools for Chromium/Firefox trust inside the container. | | `sslCertDirs` | Standard distro paths | System CA directories for `SSL_CERT_DIR`. Override for non-standard base images. | | `pruneMissingCertDirs` | `true` | Filter out non-existent directories from `sslCertDirs` before writing `SSL_CERT_DIR` (some TLS stacks error on a missing entry). Set to `false` to use `sslCertDirs` verbatim — e.g. for a directory created after install but before it's needed. | | `generateDotNetCert` | `true` | Auto-generate the ASP.NET / Aspire compatible HTTPS dev cert. Set to `false` to skip generation (useful when you only want to sync user-managed certs). | diff --git a/src/devcontainer-feature/src/devcontainer-dev-certs/devcontainer-feature.json b/src/devcontainer-feature/src/devcontainer-dev-certs/devcontainer-feature.json index cf8ea10..ef94e3c 100644 --- a/src/devcontainer-feature/src/devcontainer-dev-certs/devcontainer-feature.json +++ b/src/devcontainer-feature/src/devcontainer-dev-certs/devcontainer-feature.json @@ -14,11 +14,6 @@ "remote" ], "options": { - "trustNss": { - "type": "boolean", - "default": false, - "description": "Install NSS tools (certutil) for Chromium/Firefox certificate trust inside the container" - }, "sslCertDirs": { "type": "string", "default": "/etc/ssl/certs:/usr/lib/ssl/certs:/etc/pki/tls/certs:/var/lib/ca-certificates/openssl", diff --git a/src/devcontainer-feature/src/devcontainer-dev-certs/install.sh b/src/devcontainer-feature/src/devcontainer-dev-certs/install.sh index 1919231..a960c70 100755 --- a/src/devcontainer-feature/src/devcontainer-dev-certs/install.sh +++ b/src/devcontainer-feature/src/devcontainer-dev-certs/install.sh @@ -2,7 +2,6 @@ set -e # Options from devcontainer-feature.json (uppercased) -TRUST_NSS="${TRUSTNSS:-false}" # Keep this literal in sync with the `sslCertDirs` default in # devcontainer-feature.json (asserted by test/validate-feature.mjs). DEFAULT_SSL_CERT_DIRS="/etc/ssl/certs:/usr/lib/ssl/certs:/etc/pki/tls/certs:/var/lib/ca-certificates/openssl" @@ -55,7 +54,7 @@ fi # Validate that no feature option contains a newline. We append these to # /etc/environment, and an embedded newline would inject an extra env line # (potentially with a name the operator didn't intend). -for varname in TRUST_NSS SSL_CERT_DIRS PRUNE_MISSING_CERT_DIRS GENERATE_DOTNET_CERT SYNC_USER_CERTIFICATES SYNC_CONTAINER_CERT EXTRA_CERT_DESTINATIONS; do +for varname in SSL_CERT_DIRS PRUNE_MISSING_CERT_DIRS GENERATE_DOTNET_CERT SYNC_USER_CERTIFICATES SYNC_CONTAINER_CERT EXTRA_CERT_DESTINATIONS; do case "${!varname}" in *$'\n'*) echo "Error: feature option ${varname} must not contain newlines." >&2 @@ -93,20 +92,6 @@ if [ "${PRUNE_MISSING_CERT_DIRS}" = "true" ]; then SSL_CERT_DIRS="${PRUNED_SSL_CERT_DIRS}" fi -# Install NSS tools if requested (for Chromium/Firefox trust) -if [ "${TRUST_NSS}" = "true" ]; then - if command -v apt-get &>/dev/null; then - apt-get update -y - apt-get install -y --no-install-recommends libnss3-tools - rm -rf /var/lib/apt/lists/* - elif command -v apk &>/dev/null; then - apk add --no-cache nss-tools - elif command -v dnf &>/dev/null; then - dnf install -y nss-tools - dnf clean all - fi -fi - # Create .NET X509Store CurrentUser\My directory # This is where Kestrel discovers dev certs via X509Store fallback DOTNET_STORE_DIR="${REMOTE_USER_HOME}/.dotnet/corefx/cryptography/x509stores/my" diff --git a/src/vscode-ui-extension/README.md b/src/vscode-ui-extension/README.md index ae8751f..f5cce1b 100644 --- a/src/vscode-ui-extension/README.md +++ b/src/vscode-ui-extension/README.md @@ -196,7 +196,6 @@ These options are set on the feature in your project's `devcontainer.json` (not | Option | Default | Description | |--------|---------|-------------| -| `trustNss` | `false` | Install NSS tools for Chromium/Firefox trust inside the container. | | `sslCertDirs` | Standard distro paths | System CA directories for `SSL_CERT_DIR`. Override if your base image uses non-standard paths. | | `pruneMissingCertDirs` | `true` | Filter out directories that don't exist on this image from `sslCertDirs` before writing `SSL_CERT_DIR` (some TLS stacks error on a missing entry). Set to `false` to use `sslCertDirs` verbatim — e.g. when a directory is created after install but before it's needed. | | `generateDotNetCert` | `true` | Pull the host-generated ASP.NET dev cert into this container. Set to `false` if you're only using user-managed certs in this container. | diff --git a/src/vscode-workspace-extension/README.md b/src/vscode-workspace-extension/README.md index 0b3344d..285a9ea 100644 --- a/src/vscode-workspace-extension/README.md +++ b/src/vscode-workspace-extension/README.md @@ -123,7 +123,6 @@ When using the Dev Container feature, these options are available: | Option | Default | Description | |--------|---------|-------------| -| `trustNss` | `false` | Install NSS tools for Chromium/Firefox trust inside the container. | | `sslCertDirs` | Standard distro paths | System CA directories for `SSL_CERT_DIR`. Override if your base image uses non-standard paths. | | `pruneMissingCertDirs` | `true` | Filter out directories that don't exist on this image from `sslCertDirs` before writing `SSL_CERT_DIR` (some TLS stacks error on a missing entry). Set to `false` to use `sslCertDirs` verbatim — e.g. when a directory is created after install but before it's needed. | | `generateDotNetCert` | `true` | Pull the host-generated ASP.NET dev cert into this container. Set to `false` if you're only using user-managed certs in this container. | diff --git a/test/install-sh.test.mjs b/test/install-sh.test.mjs index d0b505d..9ffc6ce 100644 --- a/test/install-sh.test.mjs +++ b/test/install-sh.test.mjs @@ -70,7 +70,6 @@ function runInstall({ env = {}, sysrootSeed = () => {} } = {}) { // a temp dir we own. _REMOTE_USER: "devcerts-test-nouser", _REMOTE_USER_HOME: home, - TRUSTNSS: "false", ...env, }, stdio: "pipe", @@ -231,7 +230,6 @@ console.log("install.sh: SSL_CERT_DIR management\n"); DEVCERTS_SYSROOT: r.sysroot, _REMOTE_USER: "devcerts-test-nouser", _REMOTE_USER_HOME: r.home, - TRUSTNSS: "false", SSLCERTDIRS: DEFAULT, }, stdio: "pipe",