Install browser certificate databases

[mendral-app]

Summary

• Install libnss3-tools and create Chrome/Chromium NSS certificate database (~/.pki/nssdb) before running mkcert -install, properly eliminating the ERROR: no Firefox and/or Chrome/Chromium security databases found warning from E2E test logs
• Replace the grep -v workaround with a proper fix that ensures mkcert can install certificates into the browser trust store

Changes

In .github/workflows/make.yaml (test-e2e job):

1. Added libnss3-tools to the apt-get install alongside mkcert
2. Added a step to create the Chrome/Chromium NSS database directory and initialize it with certutil
3. Replaced sudo mkcert -install 2>&1 | grep -v '...' || true with a clean sudo mkcert -install

Context

The mkcert certificate installation step was showing a warning in all E2E test runs:

ERROR: no Firefox and/or Chrome/Chromium security databases found

While the warning was suppressed with grep -v, this approach:

• Hid the warning rather than fixing the root cause
• Left the browser trust store without the mkcert CA certificate
• Could mask other errors from mkcert output

The fix creates the NSS database that mkcert expects, so certificates are properly installed in both the system trust store and the browser trust store.

---

Summary by cubic

Install libnss3-tools and initialize Chrome/Chromium and Firefox NSS DBs in CI so mkcert -install can add the CA to browser trust stores. Run mkcert as the runner user to avoid CA mismatch and remove the warning from E2E logs.

• Bug Fixes

  • Initialize NSS DBs in $HOME for Chrome/Chromium (~/.pki/nssdb) and Firefox (~/.mozilla/firefox/default) with certutil, then run mkcert -install as the runner user to keep a single CA.
  • Copy the runner CA to the system trust store (/usr/local/share/ca-certificates) and replace the grep -v workaround with a clean install.

• Dependencies

  • Add libnss3-tools to apt-get install.

^{Written for commit f602214. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/make.yaml">

<violation number="1" location=".github/workflows/make.yaml:224">
P1: Installing mkcert as root creates a different CA than the one later used to generate the test certificates. The warning disappears, but the Pebble certs from `make stack-up` are still signed by the runner user's CA, not the root CA you installed here.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}