Burrowbox Docs

Browser extensions & signers

You can install Chrome extensions in a machine's browser. The usual reason is a site that only works with its own component, such as the digital-signature components Brazilian portals use (Softplan Web Signer, BRy, …). It also works for any other extension your agent needs.

Extensions need the full browser (Chromium). Installing one switches the machine to it.

#Install an extension

From the Chrome Web Store, by ID or by the store URL:

{
  "name": "browser_extension_install",
  "arguments": { "web_store": "https://chromewebstore.google.com/detail/web-signer/bbafmabaelnnkondpfpjmdklbmfnbmol" }
}

Chromium downloads it, keeps it up to date and reinstalls it if needed. The first install takes a few seconds, and the call waits for it.

Or upload a file, as file_base64 or as a path on the machine:

{ "name": "browser_extension_install", "arguments": { "path": "~/Downloads/signer.crx" } }
Tool
browser_extension_install web_store, or file_base64 / path (.crx, .zip)
browser_extensions Installed extensions: ID, name, version, source (web_store or uploaded)
browser_extension_remove id, or the slot of an uploaded extension

Each change restarts the browser once, and open tabs reopen. Extensions stay installed across restarts.

#Signature components with a native app

Most signature components come in two parts: the browser extension, and a native app that holds the certificate and does the signing. To set one up:

  1. Install the native app with apps_install, usually the vendor's .deb for 64-bit Linux:
    { "name": "apps_install", "arguments": { "kind": "deb", "url": "https://vendor.example/downloads/signer-amd64.deb" } }
    Many of these packages register themselves only with Google Chrome. Burrowbox connects them to Chromium automatically when the browser starts.
  2. Install the extension with browser_extension_install (Web Store ID or .crx).
  3. Install your certificate with browser_certificate_import. See Digital certificates. It goes into the certificate stores Linux signers read: NSS, which Chromium and most components use, and .NET's, which Lacuna-based components use.
  4. Use the portal with the browser_* tools.
  5. Answer the component's consent windows. These are native windows on the machine's desktop. Look at them with screenshot (or get_app_state) and answer with click. For Lacuna Web PKI, browser_certificate_prompt does it in one call.

Lacuna Web PKI needs none of this: browser_certificate_import installs it for you.

#Known signers

Component Used by Extension (Web Store ID) Native app on Linux Status on Burrowbox
Lacuna Web PKI Many NFS-e portals and other government sites dcngeagmmhegagicpcmpinaoklddcgon Installed automatically Supported and tested: Digital certificates
Softplan Web Signer e-SAJ courts (TJSP, TJSC, TJMS, TJCE, …) bbafmabaelnnkondpfpjmdklbmfnbmol .deb from websigner.softplan.com.br (host br.com.softplan.webpki) Not tested yet. It's built on Lacuna Web PKI, so it should behave the same once the .deb is installed
BRy "Assinatura Digital no Navegador" Paraná eProtocolo, Recife and others mbpaklahifpfndjiefdfjhmkefppocfm .deb from BRy (linked on extension.bry.com.br) The extension installs. The native module hasn't been tested
Certisign WebSigner Certisign's signing portal acfifjfajpekbmhmjppnmmjgmhjkildl None published for Linux Not supported: no Linux native app

#Signers that run as a local app

Some signers have no extension. They run as a desktop app on the machine, and the page talks to it over localhost. Install them with apps_install, start them with apps_launch, and give them the certificate in their own settings window (desktop tools: screenshot, click, type_text). These apps read the .pfx file themselves, so copy it to the machine with file_write or download it there.

Signer Used by Linux install How the page reaches it
Assinador SERPRO Federal systems that use SERPRO's signer APT repository assinadorserpro.estaleiro.serpro.gov.br (package assinador-serpro), or the .bin from artefatos-assinador.serpro.gov.br Secure WebSocket on 127.0.0.1:65156. The app uses its own certificate, which the browser must trust once
PJeOffice Pro PJe courts (*.jus.br) pjeoffice-pro-…-linux_x64.zip from the courts' download pages (bundles its own Java) HTTP on localhost:8800. Only answers *.jus.br, *.mp.br, *.gov.br and *.def.br sites

Neither has been tested on Burrowbox yet.

#Sites that only ask for a certificate at login

Many portals don't need any component: the browser presents the certificate when the site asks for one (TLS client authentication). browser_certificate_import with the site in auto_select_urls is all they need. Brasília's ISS portal (iss.fazenda.df.gov.br) logs in this way. Portals that also sign documents may still need a signer for that step.

Got a portal that uses something else? Find its component in the portal's instructions, usually a "how to install the signer" page, and install it with the steps above.

#Good to know