So investigating the steam flatpak

So investigating the steam flatpak xplane plane activation issues I'm running into, and I think I have a TLS/Handshake style bug. Or something in the realm of certs. If I recall correctly, flatpak gets its certs from system, correct? Do we potentially have not all of the root certs?

bsherman•1/5/24, 9:22 PM

we have all the same certs as Silverblue proper...

I'm sorry I haven't tracked any earlier messages about this topic.

Is the problem present on Silverblue as well as Universal Blue based images?

JeremyGraemeOP•1/5/24, 9:23 PM

I don't know, havent' really checked into that aspect. Last time I tried rebasing straight across to silverblue was unpleasant.

JeremyGraemeOP•1/5/24, 9:27 PM

Comparing between bazzite-arch and bluefin, though, I do notice we're missing some .. like

JeremyGraemeOP•1/5/24, 9:28 PM

which for one of the planes I'm trying in xplane is where the authentication server is at xcrafts.b-cdn.net

JeremyGraemeOP•1/5/24, 9:28 PM

Or rather the cert for it.

bsherman•1/5/24, 9:28 PM

interesting... which image is missing the cert?

JeremyGraemeOP•1/5/24, 9:28 PM

bluefin-dx-nvidia

bsherman•1/5/24, 9:29 PM

can you see which RPM package owns that file?

JeremyGraemeOP•1/5/24, 9:33 PM

I can't see any that own it. It's not in ca-certificates

JeremyGraemeOP•1/5/24, 9:34 PM

Seems to have been added in here *Wed Oct 04 2023 Robert Relyea <rrelyea@redhat.com> 2023.2.62_v7.0.401-2

JeremyGraemeOP•1/5/24, 9:38 PM

fedora 39 seems to be on version .60 of the file

bsherman•1/5/24, 9:38 PM

i'm missing something... the pem file is present but not owned by an RPM?

JeremyGraemeOP•1/5/24, 9:40 PM

The PEM file is not present in fedora 39

JeremyGraemeOP•1/5/24, 9:40 PM

It's present in FC 40, though arch has had it forever

JeremyGraemeOP•1/5/24, 9:40 PM

bazzite-arch OCI has it present

JJeremyGraeme Comparing between bazzite-arch and bluefin, though, I do notice we're missing so...

bsherman•1/5/24, 9:40 PM

ah! i missed "bazzite-arch" and just saw bazzite

JeremyGraemeOP•1/5/24, 9:41 PM

It's in ca-certificates 2023.2.62 but not ca-certificates 2023.2.60 which is what FC39 is on

bsherman•1/5/24, 9:41 PM

that's pretty interesting

JeremyGraemeOP•1/5/24, 9:41 PM

Sadly overlaying is unhappy

JeremyGraemeOP•1/5/24, 9:42 PM

So I guess what I'm curious about is if there's a way to add certs so that flatpak picks them up

bsherman•1/5/24, 9:42 PM

i see what you mean here: https://packages.fedoraproject.org/pkgs/ca-certificates/ca-certificates/fedora-rawhide.html

JeremyGraemeOP•1/5/24, 9:45 PM

I think there may be a way with update-ca-trust and moving the certs to /etc/pki/ca-trust/source/anchors

JeremyGraemeOP•1/5/24, 10:01 PM

Though this may be an incorrect rabbithole anyway. All I have found for sure is when I turn off networking when trying to fly a DRM'd plane that has already been authorized, the plane works, and that when I leave networking on, something in the call home messes things up with a bad get_ssl_peer

JeremyGraemeOP•1/5/24, 10:03 PM

And with a different plane, it seems to have TLS / handshake errors