Subject: [bug#49957] [PATCH] gnu: p11-kit: Fix certificate errors from flatpak apps

From: John Kehayias <[email-masked]>
Date: Tue, 28 Sep 2021 05:07:54 +0000

For the record, I'm using the beta of Flatpak (installs fine with --with-source transformation), version 1.11.3.

Also, I found a workaround by manually killing the p11-kit server and running a new one that I built with this patch and updated to the latest version. In case this helps anyone, I ran with the parameters Flatpak tries to launch:

p11-kit server --sh -n /run/user/1000/.flatpak-helper/pkcs11-flatpak-#### --provider p11-kit-trust.so "pkcs11:model=p11-kit-trust?write-protected=yes"

where the -n argument #### came from trying to run a Flatpak app and seeing it fail not finding the p11-kit server at that socket. Probably you can do this more easily by forcing Flatpak when it first runs to use the fixed p11-kit version (through a patch in Flatpak or some environment setting? or what the system starts?). But with p11-kit server already running for me, this did the trick for testing.