Skip to content

bitwarden-desktop: fix browser biometrics #374068

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
nyawox wants to merge 2 commits into from
Closed

bitwarden-desktop: fix browser biometrics #374068

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6fd0382
bitwarden-desktop: add desktop_proxy
nyawox Jan 15, 2025
f7bae0c
bitwarden-desktop: add firefox native messaging host json
nyawox Jan 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions pkgs/by-name/bi/bitwarden-desktop/firefox-native-messaging-host.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
{
"name": "com.8bit.bitwarden",
"description": "Bitwarden desktop <-> browser bridge",
"path": "@out@/bin/desktop_proxy",
Copy link
Member

@Aleksanaa Aleksanaa Feb 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it is only consumed by firefox in this way, we might put it in paths like $out/libexec/bitwarden to avoid messing up with PATH.

Copy link
Contributor

@yajo yajo Apr 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When you run current Bitwarden Desktop app in NixOS 24.11 and click on the option to enable browser fingerprint auth, you'll get this error log:

07:38:16.900 › Error generating manifests: Error: Unable to find binary: /nix/store/sbas438bk37a1hm2v46s9kw2i70g0ncm-bitwarden-desktop-2025.1.1/bin/desktop_proxy
07:38:16.909 › Error in browser integration: Error: Unable to find binary: /nix/store/sbas438bk37a1hm2v46s9kw2i70g0ncm-bitwarden-desktop-2025.1.1/bin/desktop_proxy

So, I'd prefer to move it to libexec as you noted. However in that case, somehow we have to tell the app that there's where it'll be. Do you know how to do it?

Copy link
Contributor

@alexyao2015 alexyao2015 Jul 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You would have to patch the source code here to return the absolute path

"type": "stdio",
"allowed_extensions": ["{446900e4-71c2-419f-a6a7-df9c091e268b}"]
}
10 changes: 9 additions & 1 deletion pkgs/by-name/bi/bitwarden-desktop/package.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,10 @@ buildNpmPackage rec {
pushd apps/desktop/desktop_native/napi
npm run build
popd

pushd apps/desktop/desktop_native/proxy
cargo build --bin desktop_proxy --release
Copy link
Member

@amarshall amarshall Mar 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I can tell there is only one other pkg in nixpkgs that calls cargo build directly like this. We probably at least want to take a few things from cargoBuildHook if it can’t be used. E.g. -j, --offline, and perhaps --target (though this drv is likely broken for cross-compilation, it would be nice to at least not make it worse).

popd
'';

postBuild = ''
Expand Down Expand Up @@ -154,7 +158,11 @@ buildNpmPackage rec {
installPhase = ''
runHook preInstall

mkdir $out
mkdir -p $out/bin
cp -r apps/desktop/desktop_native/target/release/desktop_proxy $out/bin
Comment on lines +161 to +162
Copy link
Member

@Aleksanaa Aleksanaa Feb 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
mkdir -p $out/bin
cp -r apps/desktop/desktop_native/target/release/desktop_proxy $out/bin
install -Dm755 -t $out/bin apps/desktop/desktop_native/target/release/desktop_proxy


mkdir -p $out/lib/mozilla/native-messaging-hosts
substituteAll ${./firefox-native-messaging-host.json} $out/lib/mozilla/native-messaging-hosts/com.8bit.bitwarden.json
Copy link
Contributor

@yajo yajo Apr 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: Please could you also add native messaging host support for Chromium-based browsers?

Suggested change
substituteAll ${./firefox-native-messaging-host.json} $out/lib/mozilla/native-messaging-hosts/com.8bit.bitwarden.json
substituteAll ${./chromium-messaging-host.json} $out/etc/chromium/native-messaging-hosts/com.8bit.bitwarden.json

The file ./chromium-messaging-host.json should be something like this:

{
  "name": "com.8bit.bitwarden",
  "description": "Bitwarden desktop <-> browser bridge",
  "path": "@out@/bin/desktop_proxy",
  "type": "stdio",
  "allowed_origins": [
    "chrome-extension://nngceckbapebfimnlniiiahkandclblb/",
    "chrome-extension://hccnnhgbibccigepcmlgppchkpfdophk/",
    "chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh/",
    "chrome-extension://ccnckbpmaceehanjmeomladnmlffdjgn/"
  ]
}

Why do this? It would enable home-manager users to add this package to programs.brave.nativeMessagingHosts (or any other supported browser. In contrast, the equivalent files created by the bitwarden desktop app when ticking the host auth and browser integration boxes are only for a limited set of browsers.


pushd apps/desktop/dist/linux-${lib.optionalString stdenv.hostPlatform.isAarch64 "arm64-"}unpacked
mkdir -p $out/opt/Bitwarden
Expand Down