Add Credential Manager support and improve WebAuthnLinux authenticator functionality

[Karloss1234]

Core authenticator improvements (webauthn-authenticator.js)

Major improvements have been made to the WebAuthn authenticator implementation. It is now a functional Linux software Passkey authenticator with built-in credential management capabilities.

Summary

This PR improves WebAuthnLinux by adding Credential Manager functionality, improving credential persistence, and strengthening browser/native messaging integration.

The main areas changed are:

• Credential management and storage (view, rename, and delete credentials)
• Authenticator state handling
• WebAuthn metadata improvements
• Firefox and Chrome compatibility improvements
• Native messaging installation improvements
• Extensive testing on Kubuntu and Fedora with Firefox and Chrome

Testing has successfully verified Passkey registration and login with:

• Google
• Microsoft
• GitHub
• Government tax reporting websites
• webauthn.io

Specific changes

Credential management

• Added improved credential storage handling and persistence.
• Improved loading and saving of system_credentials through browser storage.
• Added reliable credential retrieval after extension restart.
• Improved handling of stored credential metadata.
• Added credential management operations including renaming and deleting credentials.

Authenticator reliability

• Improved authenticator initialisation and state handling.
• Improved asynchronous storage operations using modern Promise/async patterns.
• Reduced the risk of credential storage inconsistencies.
• Improved handling of authenticator state across browser sessions.

WebAuthn compatibility

• Improved authenticator metadata handling, including AAGUID management.
• Improved compatibility with browser WebAuthn flows.
• Maintained compatibility with existing WebAuthn registration and authentication processes.

Native messaging installation improvements

• Simplified native host installation.
• Removed the need for users to manually create the native messaging manifest.
• Added support for different Firefox configuration paths used by distributions such as Fedora.
• Improved installer verification output.

Debugging and development

• Added additional logging around credential operations and storage events.
• Improved visibility of authenticator state transitions during testing.

Breaking changes

None expected. Existing registered credentials remain usable.

[rgpublic]

This PR is a huge progress. The installation is currently still very cumbersome though. I had to upload under addons.mozilla.org and change the ID (because of duplicate ID error) and also change the ID in the installer script and download the signed XPI. Any other attempt to make the temporary addon permanent failed (tried the Firefox Developer Version, disabled signature verification in about:config, yada yada - to no avail). But this will hopefully be better when there is an official version on addons.mozilla.org.

Now, I have a permanent addon in the browser and a popup window appears with a button. But unfortunately, the fingerprint doesnt verify:

WebAuthnLinux Authenticator
Error: Fingerprint Failed: Failed: Using device /net/reactivated/Fprint/Device/0 Listing enrolled fingers: - #0: right-index-finger Verify started! Verifying: right-index-finger Verify result: verify-no-match (done)

fprintd-verify on the command-line works. But no matter how often I try, always verify-no-match with the add-on.

[Karloss1234]

Good to see someone testing it. Thanks for trying the fork.

I did make one small change in /WebAuthnLinux/native/webauthnlinux_host.py: I changed the fingerprint command from:

fprintd-verify to: fprintd-verify -f any

Would you mind testing these two commands in your terminal and letting me know if there is any difference?

fprintd-verify

and:

fprintd-verify -f any

The extension error you posted is identical to what I get if I intentionally use the wrong finger, so I want to confirm whether the command behaves differently on your system.

If you like, you can also temporarily edit webauthnlinux_host.py back to the original command and test the extension again (remember to restart Firefox).

Could you also let me know:

Linux distribution and version
fingerprint sensor model (lsusb output would help)
fprintd --version

Yes, the installation procedure still needs a lot of work.

For my setup, setting: xpinstall.signatures.required = false allows the extension to be installed permanently.

I am using the latest Firefox installed from the Kubuntu APT repository (not Snap or Flatpak), and I also test with LibreWolf.

It would be useful to know whether this behaves differently on other Firefox builds or distributions. Can you let me know your Firefox Install environment?

Thanks!`

[Karloss1234]

I have been playing around with Flatpack Firefox.
The extension loads, but I can't get fprintd-verify to load. The fingerprint backend integration requires a future D-Bus/portal implementation.
Installing this extension in Snap or Flatpack Firefox is a nightmare.
Only load extension in APT or DNF installed browsers.

[rgpublic]

@Karloss1234 : My coworker took that laptop home, so I can only check next week. A few things I can already say though:

• There is no "fprintd" executable. Only "fprintd-verify", "fprintd-enroll" etc. There is no version argument.
• We're all on Manjaro Linux 26.1 "Bian-May".
• Package manager says fprintd 1.94.5-2
• I'm suprised xpinstall.signatures.required=false worked for you per https://wiki.mozilla.org/Add-ons/Extension_Signing this should only work for Firefox Developer or Nightly Releases. We temporarily tried to use the Firefox Developer release yesterday but setting this to false had not effect.
• We noticed that we can't drag and drop the "extension" folder to add-ons - we had to zip the extension folder into a file and drag and drop that. Alternatively we could indeed install as a temporary addon like described in the README via. Add temporary addon and selecting the manifest.json but this addon always vanished after restarting Firefox.
• I guess getting this to work with Snap/Flatback will still be on a whole other level of difficulty so I would recommend tackling normale Firefox releases in the first place. We didn't use a Snap/Flatback edition but the regular Firefox edition from the official Manjaro extra repository.
• The only way we could install it was by uploading the addon on my private addons.mozilla.org account and downloading the signed version from there but that required changing the ID.
• I will try next week the commands you suggested. Although I don't think it's a wrong finger issue. We only used fprintd-enroll without any arguments and there is only one finger registered - the default right index finger. fprintd-verify (without arguments) worked. Using the fingerprint e.g. for GNOME sudo dialog windows (e.g. during package installations) worked flawlessly.

[Karloss1234]

Okay, I'll look to making an install of Manjaro and see if I get the same.

Let me know about fprintd-verify -f any command run from the terminal?

Does which fprintd-verify return /usr/bin/fprintd-verify?

It appears that some distros allow xpinstall.signatures.required = false, such as Kubuntu APT firefox.