feat!: remove the trustNss feature option

README.md

@@ -147,15 +147,14 @@ Set under the feature entry in `devcontainer.json`:
 {
     "features": {
         "ghcr.io/dnegstad/devcontainer-dev-certs/devcontainer-dev-certs:1": {
-            "trustNss": true
+            "syncContainerCert": true
         }
     }
 }
 ```
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `trustNss` | `false` | Install NSS tools for Chromium/Firefox trust inside the container. |
 | `sslCertDirs` | Standard distro paths | System CA directories for `SSL_CERT_DIR`. Override for non-standard base images. |
 | `pruneMissingCertDirs` | `true` | Filter out non-existent directories from `sslCertDirs` before writing `SSL_CERT_DIR` (some TLS stacks error on a missing entry). Set to `false` to use `sslCertDirs` verbatim — e.g. for a directory created after install but before it's needed. |
 | `generateDotNetCert` | `true` | Auto-generate the ASP.NET / Aspire compatible HTTPS dev cert. Set to `false` to skip generation (useful when you only want to sync user-managed certs). |

src/devcontainer-feature/src/devcontainer-dev-certs/devcontainer-feature.json

@@ -14,11 +14,6 @@
     "remote"
   ],
   "options": {
-    "trustNss": {
-      "type": "boolean",
-      "default": false,
-      "description": "Install NSS tools (certutil) for Chromium/Firefox certificate trust inside the container"
-    },
     "sslCertDirs": {
       "type": "string",
       "default": "/etc/ssl/certs:/usr/lib/ssl/certs:/etc/pki/tls/certs:/var/lib/ca-certificates/openssl",

src/devcontainer-feature/src/devcontainer-dev-certs/install.sh

@@ -2,7 +2,6 @@
 set -e
 
 # Options from devcontainer-feature.json (uppercased)
-TRUST_NSS="${TRUSTNSS:-false}"
 # Keep this literal in sync with the `sslCertDirs` default in
 # devcontainer-feature.json (asserted by test/validate-feature.mjs).
 DEFAULT_SSL_CERT_DIRS="/etc/ssl/certs:/usr/lib/ssl/certs:/etc/pki/tls/certs:/var/lib/ca-certificates/openssl"
@@ -55,7 +54,7 @@ fi
 # Validate that no feature option contains a newline. We append these to
 # /etc/environment, and an embedded newline would inject an extra env line
 # (potentially with a name the operator didn't intend).
-for varname in TRUST_NSS SSL_CERT_DIRS PRUNE_MISSING_CERT_DIRS GENERATE_DOTNET_CERT SYNC_USER_CERTIFICATES SYNC_CONTAINER_CERT EXTRA_CERT_DESTINATIONS; do
+for varname in SSL_CERT_DIRS PRUNE_MISSING_CERT_DIRS GENERATE_DOTNET_CERT SYNC_USER_CERTIFICATES SYNC_CONTAINER_CERT EXTRA_CERT_DESTINATIONS; do
     case "${!varname}" in
         *$'\n'*)
             echo "Error: feature option ${varname} must not contain newlines." >&2
@@ -93,20 +92,6 @@ if [ "${PRUNE_MISSING_CERT_DIRS}" = "true" ]; then
     SSL_CERT_DIRS="${PRUNED_SSL_CERT_DIRS}"
 fi
 
-# Install NSS tools if requested (for Chromium/Firefox trust)
-if [ "${TRUST_NSS}" = "true" ]; then
-    if command -v apt-get &>/dev/null; then
-        apt-get update -y
-        apt-get install -y --no-install-recommends libnss3-tools
-        rm -rf /var/lib/apt/lists/*
-    elif command -v apk &>/dev/null; then
-        apk add --no-cache nss-tools
-    elif command -v dnf &>/dev/null; then
-        dnf install -y nss-tools
-        dnf clean all
-    fi
-fi
-
 # Create .NET X509Store CurrentUser\My directory
 # This is where Kestrel discovers dev certs via X509Store fallback
 DOTNET_STORE_DIR="${REMOTE_USER_HOME}/.dotnet/corefx/cryptography/x509stores/my"

src/vscode-ui-extension/README.md

@@ -196,7 +196,6 @@ These options are set on the feature in your project's `devcontainer.json` (not
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `trustNss` | `false` | Install NSS tools for Chromium/Firefox trust inside the container. |
 | `sslCertDirs` | Standard distro paths | System CA directories for `SSL_CERT_DIR`. Override if your base image uses non-standard paths. |
 | `pruneMissingCertDirs` | `true` | Filter out directories that don't exist on this image from `sslCertDirs` before writing `SSL_CERT_DIR` (some TLS stacks error on a missing entry). Set to `false` to use `sslCertDirs` verbatim — e.g. when a directory is created after install but before it's needed. |
 | `generateDotNetCert` | `true` | Pull the host-generated ASP.NET dev cert into this container. Set to `false` if you're only using user-managed certs in this container. |

src/vscode-workspace-extension/README.md

@@ -123,7 +123,6 @@ When using the Dev Container feature, these options are available:
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `trustNss` | `false` | Install NSS tools for Chromium/Firefox trust inside the container. |
 | `sslCertDirs` | Standard distro paths | System CA directories for `SSL_CERT_DIR`. Override if your base image uses non-standard paths. |
 | `pruneMissingCertDirs` | `true` | Filter out directories that don't exist on this image from `sslCertDirs` before writing `SSL_CERT_DIR` (some TLS stacks error on a missing entry). Set to `false` to use `sslCertDirs` verbatim — e.g. when a directory is created after install but before it's needed. |
 | `generateDotNetCert` | `true` | Pull the host-generated ASP.NET dev cert into this container. Set to `false` if you're only using user-managed certs in this container. |

test/install-sh.test.mjs

@@ -70,7 +70,6 @@ function runInstall({ env = {}, sysrootSeed = () => {} } = {}) {
       // a temp dir we own.
       _REMOTE_USER: "devcerts-test-nouser",
       _REMOTE_USER_HOME: home,
-      TRUSTNSS: "false",
       ...env,
     },
     stdio: "pipe",
@@ -231,7 +230,6 @@ console.log("install.sh: SSL_CERT_DIR management\n");
         DEVCERTS_SYSROOT: r.sysroot,
         _REMOTE_USER: "devcerts-test-nouser",
         _REMOTE_USER_HOME: r.home,
-        TRUSTNSS: "false",
         SSLCERTDIRS: DEFAULT,
       },
       stdio: "pipe",