Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/klzgrad/naiveproxy/llms.txt

Use this file to discover all available pages before exploring further.

NaïveProxy is built from a heavily minimized subset of the Chromium source tree — only about 0.3% of the original codebase is included. This dramatically reduces build times and binary sizes compared to building full Chromium while still producing an authentic network stack. The build process follows the standard Chromium build system (gn + ninja) with a number of patches applied on top.
The current NaïveProxy base is built from Chromium 150.0.7871.63. The exact version is always tracked in the CHROMIUM_VERSION file at the root of the repository.

​
Authoritative Build Instructions

The canonical, always-up-to-date build instructions are maintained as a GitHub Actions workflow. This workflow is executed for every release and covers all supported platforms: .github/workflows/build.yml Rather than duplicating platform-specific steps here (which could become stale), refer directly to that file for the exact commands used to produce each release binary.
Do not track the master branch for downstream use. The master branch rebases from a new root commit for every new Chrome release, which means its history is regularly rewritten and cannot be tracked with a normal git pull. Always pin to a stable release tag instead. Short release notes are provided alongside each tag.

​
Chromium Modifications

NaïveProxy applies a focused set of patches to the Chromium source to support its use case as a proxy binary. The changes are:
The included source tree is reduced to approximately 0.3% of the original Chromium repository. Unused subsystems, UI code, and platform-specific components are stripped out to produce a minimal, fast-to-build binary.
C++ exceptions and runtime type information (RTTI) are disabled to reduce binary size and link time. This applies on all platforms except macOS and Android, where the toolchain or platform requirements necessitate them.
The build system is patched to support cross-compilation targeting OpenWrt device architectures. See OpenWrt Support for the list of supported instruction sets.
On Linux and Android, the system TLS verifier (which depends on NSS on Linux) is replaced with Chromium’s builtin verifier. The trust store is read from standard system paths, following the same lookup order as Go’s crypto/x509:
  • The file at the path in the SSL_CERT_FILE environment variable
  • The first available file among:
    • /etc/ssl/certs/ca-certificates.crt (Debian / Ubuntu / Gentoo)
    • /etc/pki/tls/certs/ca-bundle.crt (Fedora / RHEL 6)
    • /etc/ssl/ca-bundle.pem (OpenSUSE)
    • /etc/pki/tls/cacert.pem (OpenELEC)
    • /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem (CentOS / RHEL 7)
    • /etc/ssl/cert.pem (Alpine Linux)
  • Files in the directory at the path in the SSL_CERT_DIR environment variable
  • Files in the first available directory among:
    • /etc/ssl/certs (SLES10 / SLES11)
    • /etc/pki/tls/certs (Fedora / RHEL)
    • /system/etc/security/cacerts (Android)
Authority Information Access (AIA) responses delivered in PKCS#7 format are handled correctly, broadening compatibility with certificate authorities that use this format.
The per-host and per-proxy socket limits inherited from Chromium are increased to accommodate proxy workloads, which typically require more simultaneous connections than a regular browser.
All outbound sockets are forced through the CONNECT tunnel, ensuring that no traffic bypasses the proxy chain.
Support for Fast Open on CONNECT tunnels is added via the fastopen header, allowing payload to be sent before the tunnel response is received where the server supports it. See the Padding Protocol page for the constraint on the first CONNECT request.
RST_STREAM frames are padded as described in the Padding Protocol specification to reduce their detectability as a behavioral signal.

Build docs developers (and LLMs) love

Get started for freeTalk to us