Universal Blue•11mo ago

So investigating the steam flatpak

So investigating the steam flatpak xplane plane activation issues I'm running into, and I think I have a TLS/Handshake style bug. Or something in the realm of certs. If I recall correctly, flatpak gets its certs from system, correct? Do we potentially have not all of the root certs?

14 Replies

bsherman•11mo ago

we have all the same certs as Silverblue proper... I'm sorry I haven't tracked any earlier messages about this topic. Is the problem present on Silverblue as well as Universal Blue based images?

JeremyGraemeOP•11mo ago

I don't know, havent' really checked into that aspect. Last time I tried rebasing straight across to silverblue was unpleasant. Comparing between bazzite-arch and bluefin, though, I do notice we're missing some .. like

```
Sectigo_Public_Server_Authentication_Root_E46.pem
Sectigo_Public_Server_Authentication_Root_R46.pem

```
Sectigo_Public_Server_Authentication_Root_E46.pem
Sectigo_Public_Server_Authentication_Root_R46.pem

which for one of the planes I'm trying in xplane is where the authentication server is at xcrafts.b-cdn.net Or rather the cert for it.

bsherman•11mo ago

interesting... which image is missing the cert?

JeremyGraemeOP•11mo ago

bluefin-dx-nvidia

bsherman•11mo ago

can you see which RPM package owns that file?

JeremyGraemeOP•11mo ago

I can't see any that own it. It's not in ca-certificates Seems to have been added in here *Wed Oct 04 2023 Robert Relyea <[email protected]> 2023.2.62_v7.0.401-2 fedora 39 seems to be on version .60 of the file

bsherman•11mo ago

i'm missing something... the pem file is present but not owned by an RPM?

JeremyGraemeOP•11mo ago

The PEM file is not present in fedora 39 It's present in FC 40, though arch has had it forever bazzite-arch OCI has it present

bsherman•11mo ago

ah! i missed "bazzite-arch" and just saw bazzite

JeremyGraemeOP•11mo ago

It's in ca-certificates 2023.2.62 but not ca-certificates 2023.2.60 which is what FC39 is on

bsherman•11mo ago

that's pretty interesting

JeremyGraemeOP•11mo ago

Sadly overlaying is unhappy

error: Could not depsolve transaction; 1 problem detected:
 Problem: cannot install both ca-certificates-2023.2.62_v7.0.401-4.fc40.noarch from @commandline and ca-certificates-2023.2.60_v7.0.306-2.fc39.noarch from @System
  - conflicting requests

error: Could not depsolve transaction; 1 problem detected:
 Problem: cannot install both ca-certificates-2023.2.62_v7.0.401-4.fc40.noarch from @commandline and ca-certificates-2023.2.60_v7.0.306-2.fc39.noarch from @System
  - conflicting requests

So I guess what I'm curious about is if there's a way to add certs so that flatpak picks them up

bsherman•11mo ago

i see what you mean here: https://packages.fedoraproject.org/pkgs/ca-certificates/ca-certificates/fedora-rawhide.html

JeremyGraemeOP•11mo ago

I think there may be a way with update-ca-trust and moving the certs to /etc/pki/ca-trust/source/anchors Though this may be an incorrect rabbithole anyway. All I have found for sure is when I turn off networking when trying to fly a DRM'd plane that has already been authorized, the plane works, and that when I leave networking on, something in the call home messes things up with a bad get_ssl_peer And with a different plane, it seems to have TLS / handshake errors

Gaming

Programming

So investigating the steam flatpak