Integrating Brave and KeePassXC (Flatpak ver)

01_brave_keepassxc_integration_flatpak.md

Integrating Brave and KeePassXC (Flatpak ver)

• OS: Aurora (Universal Blue, KDE)
• To integrate Brave and KeePassXC when both are installed via Flatpak, a small wrapper script is required to bridge the sandbox gap.
• ref: Cannot save new credentials using browser · Issue #1631 · keepassxreboot/keepassxc-browser
  • The script below is slightly modified to add cd $APP_PATH/files as keepassxc-proxy is not in the PATH.

# 1. Grant Brave access to KeePassXC's Flatpak files and runtime
flatpak override --user --filesystem={/var/lib,xdg-data}/flatpak/{app/org.keepassxc.KeePassXC,runtime/org.kde.Platform}:ro --filesystem=xdg-run/app/org.keepassxc.KeePassXC:create com.brave.Browser

# 2. Create the wrapper script
cat > ~/.var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser/keepassxc-proxy-wrapper.sh <<'EOF'
#!/bin/bash
APP_REF="org.keepassxc.KeePassXC/x86_64/stable"
for inst in "$HOME/.local/share/flatpak" "/var/lib/flatpak"; do
    if [ -d "$inst/app/$APP_REF" ]; then
        FLATPAK_INST="$inst"
        break
    fi
done
[ -z "$FLATPAK_INST" ] && exit 1
APP_PATH="$FLATPAK_INST/app/$APP_REF/active"
RUNTIME_REF=$(awk -F'=' '$1=="runtime" { print $2 }' < "$APP_PATH/metadata")
RUNTIME_PATH="$FLATPAK_INST/runtime/$RUNTIME_REF/active"

cd "$APP_PATH/files"
exec flatpak-spawn \
    --env=LD_LIBRARY_PATH="$LD_LIBRARY_PATH:/app/lib:$APP_PATH/files/lib" \
    --app-path="$APP_PATH/files" \
    --usr-path="$RUNTIME_PATH/files" \
    -- bin/keepassxc-proxy "$@"
EOF
chmod +x ~/.var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser/keepassxc-proxy-wrapper.sh

# 3. Register the wrapper as a NativeMessagingHost for the browser extension
cat > ~/.var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json <<EOF
{
    "allowed_origins": [
        "chrome-extension://pdffhmdngciaglkoonimfcmckehcpafo/",
        "chrome-extension://oboonakemofpalcgghocfoadofidjkkk/"
    ],
    "description": "KeePassXC integration with native messaging support",
    "name": "org.keepassxc.keepassxc_browser",
    "path": "/home/${USER}/.var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser/keepassxc-proxy-wrapper.sh",
    "type": "stdio"
}
EOF