24.04 and 24.10 Ubuntu Issues

[choman]

There are technically two (2) issues that my team and I are seeing, and would absolutely love to help have these solved. First off, love the updated script and moving to the use of opensc.

Issue 1

On both 24.04 and 24.10, chrome randomly crashes. Currently, using chrome 131.0.6778.264, which as of 2025-01-13 is the latest stable for linux and ubuntu.

Issue 2

On both 24.04 and 24.10, when using the script to de-snapify firefox and move to the deb package of firefox, 134.0 as of 2025-01-13. the cac software does not read the card info. So when visiting things like DoD safe, everyone on the team is a guest.

• verified the in-use profile
• verified the pkcs11.txt looked correct for opensc

Update 2025-01-14

Issue appears that the card reader is not seen. The loading the pkcs modules into the following it worked and the reader was seen. Personal note, it's like the deb packaging is missing a library that the tar'balls contain.

• testing tar'ball from Mozilla, everything appears fine
  - 128.6esr
  - 129.0 standard
  - 134.0 standard
  - 134.0.1 standard
• purged firefox deb (ubuntu version)
• testing firefox deb from Mozilla next

Additional plug for known pkcs11-register issue

During another test with chrome and using the newer cac_setup.sh script, I noticed that there was lines in the pkcs11.txt that
had commented out opensc libraries and already specified cackey lines. In reference to your known issue that pkcs11-regsister does not always run correctly. I have to remove the cackey and the commented opensc lines for it to work correctly. My speculation is that it (pkcs11-register "greps" for opensc and not if it's commented out.

[jdjaxon]

@choman, thank you. It had been on the agenda for a while. @malvidin helped a ton while I was slacking.

I typically only run and test on LTS versions, but I am currently on 22.04. I will try to get a test environment of 24.04 running soon to look into this more, but I will post my initial thoughts.

Issue 1

When I first started working on this project, I always ran into odd issues with Chrome until I started using this PPA:

deb [arch=amd64] https://dl.google.com/linux/chrome/deb/ stable main

However, I'm not sure if it's still necessary since I am on Google Chrome 132.0.6834.110, so you will likely be on the same version as me after an upgrade. Though I am on Ubuntu 22.04, this version of Chrome using this PPA remains stable and functional.

Issue 2

This certainly could be an issue with the deb package that Canonical is using. Like Chrome, I also use a PPA, which may or may not be helpful:

deb https://ppa.launchpadcontent.net/mozillateam/ppa/ubuntu/ jammy main

Canonical runs this PPA, so I can't guarantee that it will be helpful in any way.

I used these PPAs to isolate issues in the initial development of this project. Most folks I work with do not use these, and everything works fine.

WARNING: I don't mean to insult your intelligence if you already know, but please be careful about the PPAs you use, if you choose to, since malicious individuals can host them.

pkcs11-register Issue

Also, I appreciate the insight here:

During another test with chrome and using the newer cac_setup.sh script, I noticed that there was lines in the pkcs11.txt that
had commented out opensc libraries and already specified cackey lines. In reference to your known issue that pkcs11-regsister does not always run correctly. I have to remove the cackey and the commented opensc lines for it to work correctly. My speculation is that it (pkcs11-register "greps" for opensc and not if it's commented out.

I know the register command will write the files if they aren't present, so the nuclear strategy of removing the pkcs11.txt files and running the command would likely solve this if it does effectively grep. I would rather not arbitrarily nuke people's configuration files, so I'll have to find another way around this.

[choman]

@jdjaxon Thanks for the reminder on PPAs. I am always careful with PPAs. So no worries. But it's always good to see those reminders.

Also In case you didn't see it. on Jan 14, I got the card reader to work for firefox.

And last note. seems like Canonical is working to resolve the snap image with a firedox:pcscd starting in Ubuntu 25.04

[bengooch7]

@choman It's good to hear they are working to fix the snap Firefox bug. I found an issue with the PPA for Firefox in the script not working anymore. It seems Mozilla has moved to a signed PPA, which I'm looking at implementing into the script. If they can fix the bug in 25.04, maybe all of the nonsense of removing the snap version and replacing it with the apt version can be removed at that point.

[choman]

@bengooch7 yeah, for sure. Guess that also depends on if it's back ported. But yes, sticking with the snap is my current way forward

@choman It's good to hear they are working to fix the snap Firefox bug. I found an issue with the PPA for Firefox in the script not working anymore. It seems Mozilla has moved to a signed PPA, which I'm looking at implementing into the script. If they can fix the bug in 25.04, maybe all of the nonsense of removing the snap version and replacing it with the apt version can be removed at that point.

[SmdmGdzla]

Issue 1
On both 24.04 and 24.10, chrome randomly crashes. Currently, using chrome 131.0.6778.264, which as of 2025-01-13 is the latest stable for linux and ubuntu.

I tracked this issue down to OpenSC version 0.25.0. Updating it to the current version 0.26.1 from 14 Jan 2025 seems to have solved that problem. There is not an updated package, last I checked, but the source is on their github.

[jdjaxon]

@choman, if you happen to have success with this script using the snap version of firefox, please let me know. You'll need to remove or comment out the portions of the script that ignore cert databases with snap in the path and that remove the snap-installed firefox. If you need help with this, I'm happy to assist. I am unlikely to catch the snap fixes since i don't use it.

[jdjaxon]

Issue 1
On both 24.04 and 24.10, chrome randomly crashes. Currently, using chrome 131.0.6778.264, which as of 2025-01-13 is the latest stable for linux and ubuntu.

I tracked this issue down to OpenSC version 0.25.0. Updating it to the current version 0.26.1 from 14 Jan 2025 seems to have solved that problem. There is not an updated package, last I checked, but the source is on their github.

Thanks for tracking this down!

[choman]

@choman, if you happen to have success with this script using the snap version of firefox, please let me know. You'll need to remove or comment out the portions of the script that ignore cert databases with snap in the path and that remove the snap-installed firefox. If you need help with this, I'm happy to assist. I am unlikely to catch the snap fixes since i don't use it.

I will certainly report back. although it will take me time to get there as I have a full plate and fighting deadlines

[choman]

Sorry for the delay, but here is an update.

• fresh install of 25.04
• enabled the snap connection firefox:pcscd # don't remember if sudo was needed
• verified with snap connections firefox
• also verified it through gnome settings => apps => firefox, that pcscd was enabled
• manually loaded the AllCerts content into the snap cert9.db
• verified the certs where there in the firefox UI settings => privacy and security => manage certificates

Couple of things to note

• sudo journalctl -u pcscd -f showed version mismatch protocol error
• snap run --shell firefox the pcsc libraries appeared older than what was on the system, at least different via md5sum
• according to "documentation", this should've worked, no joy
• this is when I set up the security device, and still no joy
• All testing was against DOD Safe
• cac was recognized via pcsc_scan on host
• also tested against firefox "edge" snap
• Also noticed a "login" via the deb package under security devices, this never appear under snap
• Feel like I missed something

Currently, rolled back to firefox debian file

[choman]

Side note, I was having issues with pkcs11-register, basically it wasn't updating firefox nor chrome's pkcs11.txt file

I ran help and this came back

❯ /usr/bin/pkcs11-register --help
Usage: pkcs11-register [OPTION]...

Install a PKCS#11 module to known applications.

  -h, --help              Print help and exit
  -V, --version           Print version and exit
  -m, --module=FILENAME   Specify the module to load  (default=`OpenSC's
                            PKCS#11 module')
      --skip-chrome       Don't install module to Chrome  (default=on)
      --skip-firefox      Don't install module to Firefox  (default=on)
      --skip-thunderbird  Don't install module to Thunderbird  (default=off)
      --skip-seamonkey    Don't install module to SeaMonkey  (default=off)

Report bugs to https://github.com/OpenSC/OpenSC/issues

Written by Frank Morgner <frankmorgner@gmail.com>

Notice that the defaults for chrome and firefox are "on"

So when I run with the --skip options

❯ /usr/bin/pkcs11-register --skip-firefox
Added OpenSC smartcard framework (0.26) to /home/chad.homan/.mozilla/firefox/fbbeo1fq.default/pkcs11.txt

~ took 2s 
❯ /usr/bin/pkcs11-register --skip-firefox --skip-chrome
Added OpenSC smartcard framework (0.26) to /home/chad.homan/.pki/nssdb/pkcs11.txt

IMHO Totally backwards!!!! cheers!

[choman]

BTW the version is

❯ pkcs11-register -V
pkcs11-register 0.26.1

[jdjaxon]

@choman, I appreciate your help! I also thought using the skip flags would set them to on. That's a bit confusing. I definitely missed that one. 😆 Oh well.

[choman]

FYI, While testing for something non-related, other than I need the card read to work. I ran into an issue on ubuntu 25.04 with firefox 142.0 (non-snap). Does not see the card reader, I only rolled back firefox to 141.0.3 and it started working again. also note opensc is 0.26.1

More then likely caught by the pkcs11-register issue