Support user added CAs in android client - #224
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughAndroid startup retrieves user CA certificates, formats them as PEM bytes, and sends them to the Go-mobile Android bridge. The bundled ChangesCertificate integration
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant MyApplication
participant PlatformUtils
participant Android
MyApplication->>PlatformUtils: Extract user certificates
PlatformUtils-->>MyApplication: Return PEM bytes
MyApplication->>Android: Set Android certificates
Android-->>MyApplication: Complete certificate initialization
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
app/src/main/java/io/netbird/client/PlatformUtils.java (1)
45-47: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winPass only user-installed roots to the Go bridge.
AndroidCAStoreexposes bothuser:andsystem:aliases, so this serializes the complete Android trust store. The PR contract says Go merges user-provided roots with its system roots; filter touser:aliases before encoding to avoid duplicating or mixing the two trust-store sources. (android.googlesource.com)Proposed fix
while (aliases.hasMoreElements()) { String alias = aliases.nextElement(); + if (!alias.startsWith("user:")) { + continue; + } X509Certificate cert = (X509Certificate) keyStore.getCertificate(alias);Based on the PR objective, Go is expected to merge user-provided roots with system roots.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@app/src/main/java/io/netbird/client/PlatformUtils.java` around lines 45 - 47, Filter aliases in the AndroidCAStore iteration before retrieving certificates so only aliases beginning with “user:” are serialized for the Go bridge. Update the loop around aliases.hasMoreElements() and preserve the existing certificate encoding behavior for matching user-installed roots.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@app/src/main/java/io/netbird/client/PlatformUtils.java`:
- Around line 45-47: Filter aliases in the AndroidCAStore iteration before
retrieving certificates so only aliases beginning with “user:” are serialized
for the Go bridge. Update the loop around aliases.hasMoreElements() and preserve
the existing certificate encoding behavior for matching user-installed roots.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8a4fc7ba-b0f3-4ef9-92f7-a7552a8db970
📒 Files selected for processing (3)
app/src/main/java/io/netbird/client/MyApplication.javaapp/src/main/java/io/netbird/client/PlatformUtils.javanetbird
The android stores the Certificate Authorities separately which are installed by the user. The Golang ecosystem does not care about them by default, so there was no possibility to use them in self-hosted environment on android clients with user supplied CA. As my understanding to fix that the android code should collect the Certificates Authorities with java API, supply them to go code, and consume it combined with the system provided CAs. By default the system CAs will be used in Golang. * Bump netbird submodule to include updated golang code
1 participant
The android stores the Certificate Authorities separately which are installed by the user. The Golang ecosystem does not care about them by default, so there was no possibility to use them in self-hosted environment on android clients with user supplied CA. As my understanding to fix that the android code should collect the Certificates Authorities with java API, supply them to go code, and consume it combined with the system provided CAs.
By default the system CAs will be used in Golang.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Summary by CodeRabbit
New Features
Bug Fixes
Chores