connect flatpak firefox to flatpak keepassXC - browser integration ( Fedora Silverblue 44, Gnome 50)

gistfile1.txt

# 1. Reset Firefox overrides 
flatpak override --user --reset org.mozilla.firefox

# 2. Grant Firefox permission to talk to the Flatpak Portal
flatpak override --user --talk-name=org.freedesktop.Flatpak org.mozilla.firefox

# 3. Create the necessary internal directory structure if it doesn't exist
mkdir -p ~/.var/app/org.mozilla.firefox/data/bin
mkdir -p ~/.var/app/org.mozilla.firefox/.mozilla/native-messaging-hosts

# 4. Create the Proxy Wrapper Script
# Instead of mounting libraries, this tells Firefox to ask the host 
# to run KeePassXC's proxy in its own correct environment.
cat << 'EOF' > ~/.var/app/org.mozilla.firefox/data/bin/keepassxc-proxy-wrapper.sh
#!/bin/sh
# Escaping the Firefox sandbox to execute the proxy on the host
/usr/bin/flatpak-spawn --host flatpak run --command=keepassxc-proxy org.keepassxc.KeePassXC "$@"
EOF

# 5. Make the script executable
chmod +x ~/.var/app/org.mozilla.firefox/data/bin/keepassxc-proxy-wrapper.sh

# 6. Create the JSON Manifest
# We use the absolute /var/home/$USER path because Flatpaks in 
# Fedora 44/GNOME 50 often fail to resolve '~' inside manifest files.
cat << EOF > ~/.var/app/org.mozilla.firefox/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json
{
    "allowed_extensions": [
        "keepassxc-browser@keepassxc.org"
    ],
    "description": "KeePassXC integration with native messaging support",
    "name": "org.keepassxc.keepassxc_browser",
    "path": "/var/home/$USER/.var/app/org.mozilla.firefox/data/bin/keepassxc-proxy-wrapper.sh",
    "type": "stdio"
}
EOF

echo "Setup complete. Please restart Firefox and KeePassXC."

Does this require https://github.com/flatpak/xdg-native-messaging-proxy to be installed?

no

I couldn't make it work in my installation (Fedora 44 based Zirconium). Both Firefox and Keepass are installed as sytem Flatpaks.

For me it only works when org.freedesktop.portal.Flatpak is replaced by org.freedesktop.Flatpak in line 5.

I am running Flatpak 1.16.3 on Fedora Linux 43 (Silverblue)

thanks, had to change it today on my other pc to org.freedesktop.Flatpak for reasons, updated gist.

Maybe it is worth to point out somewhere in the comments, what the implication of flatpak override --user --talk-name=org.freedesktop.portal.Flatpak org.mozilla.firefox is? It makes a hole in the sandbox and allows code execution outside on the host system.

    "path": "/var/home/$USER/.var/app/org.mozilla.firefox/data/bin/keepassxc-proxy-wrapper.sh",

this does not on Arch and likely on Debian/Ubuntu/Mint

what you put to app/.../data/bin goes to sandboxed /var/data/bin

Similar for LibreWolf

https://gist.github.com/qywx/91f987d8d8dcee7e0c1d95e8efa9c801