The settings page gets a Proxy section (Advanced) and a Certificates section (Security),
cavekit-proxies-certs.md:
- Proxy: No proxy (now the default), webOS's own proxy setting, the Riverstone Relay,
WebOne, my own proxy (HTTP/HTTPS/SOCKS, direct list) and a PAC URL, read from and written
to the engine's network.proxy.* prefs. The engine's "system proxy" (type 5) reads GNOME's
settings and does nothing in the headless build; it is gone from the page.
- webOS's proxy setting: the daemon reads com.palm.connectionmanager/getNwProxiesConfig on
its own Luna connection at start, at every card connect and on request, and
components/jihadProxy.js applies it when the user chose to follow it.
- components/jihadCerts.js: at the first page (the daemon announces "jihad-nss-ready"), the
CA certificates in webOS's stores that are not HP's 3.0.5 roots, not removed by Mozilla,
not Jihad's own and not expired are trusted in memory (NSS temporary certificates). The
lists come from HP's doctor image and CCADB (render/goanna/certs/make-cert-lists.py).
Switching the setting off takes the trust away at once and clears TLS sessions and idle
connections that were checked under it.
- The Relay's CA is carried and pinned; trusted only when the user turns it on while the
Relay is in use, never through a store or a link.
- Opening a CA certificate asks on the card (a JS nsICertificateDialogs), including one sent
as a download (WebOne's); the added CAs are listed in Settings with Remove.
- A proxy's 407 names the proxy; Enyo and Mochi say "The proxy ... requires a username and
password".
Found on the way: JS components are read as Latin-1, so non-ASCII in their strings came out
garbled (the print status's ellipsis, the persona importer's BOM strip); escaped. The install
scripts leave a byte-identical adapter alone: replacing one LunaSysMgr has mapped left a
deleted file on / that kept it read-write.
Device (Enyo, CE 3.1.0): the five newer roots trusted and nothing written to cert9.db; a
SwissSign 2022-1 site loads with the setting on and fails off; a Certificate Manager CA
trusted after a start and gone after removal; the Relay re-signs with its CA off and loads
with it on; manual, PAC, webOS's setting and a login proxy through a PC test proxy; WebOne
0.18.3's CA from its link, then https through it; the Relay's CA refused from a link.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LcrVQFRMC2ANGDfVaRG9Ed
NotAlexNoyleandClaude Opus 5.5
e223591f81