Rapid flip between connection status in the UI

Here's the sequence of events:

1. I press on the connect button
2. It goes to connecting state and immediately returns back to off state
3. I do not do anything, and after a few seconds it magically on its own, tries to connect to the VPN
4. The connection is successful
5. Sometimes, it does not get connected automatically and I need to hit connect again. It again flips between "Not connected -> Connecting -> Not connected -> Connecting -> Connected to VPN" on the UI.

As per the logs as well, it seems there are a bunch of starting immediately followed by a stopping status.

This was not a problem with previous 0.24.10 version. Seems there is a race condition somewhere that is flipping the states? Or it mandatorily keeps things off until a client cert is fetched?

Log with some comments:

[[ Momentarily I see "connectin to VPN screen here ]]

/sbin/bitmask-root firewall isup"
qml: show motd
qml: configured locale: en
qml: platform: linux
qml: status off
qrc:/components/BoldLabel.qml:15:5: Unable to assign [undefined] to QString
qrc:/components/VPNState.qml:48:9: QML State: Binding loop detected for property "when":
qrc:/components/VPNState.qml:49:13
qml: status is off and startingUI is true
2025-09-01T01:52:21+05:30 INF Getting OpenVPN client certificate
qml: status off

[[ Screen immediately changes back to off/"Unencrypted connection" ]]

[[ It stopped here for a few seconds with the (red) screen displaying "Unencrypted connection" ]]

[[ Now without me pressing any button it suddenly resumes with the logs below ]]


025-09-01T01:52:26+05:30 INF Getting gateways for transport=openvpn
2025-09-01T01:52:26+05:30 INF Getting gateways for transport=openvpn
2025-09-01T01:52:26+05:30 INF Getting gateways automatic location by timezone
2025-09-01T01:52:26+05:30 INF Getting gateways for transport=openvpn
2025-09-01T01:52:26+05:30 INF Getting gateways automatic location by timezone
2025-09-01T01:52:26+05:30 INF Got best gateway [{vpn20-par.riseup.net 51.159.198.167 Paris Paris FR [53 80 1194] [tcp udp] map[] openvpn} {vpn06-ams.riseup.net 51.158.144.32 Amsterdam Amsterdam NL [53 80 1194] [tcp udp] map[] openvpn} {vpn14-par.riseup.net 51.159.196.108 Paris Paris FR [53 80 1194] [tcp udp] map[] openvpn}]
2025-09-01T01:52:26+05:30 INF Starting firewall
2025-09-01T01:52:26+05:30 INF Getting gateways for transport=obfs4
2025-09-01T01:52:26+05:30 INF Getting gateways automatic location by timezone
2025-09-01T01:52:26+05:30 INF Getting gateways for transport=kcp
2025-09-01T01:52:26+05:30 INF Getting gateways automatic location by timezone
2025-09-01T01:52:26+05:30 INF Getting gateways for transport=quic
2025-09-01T01:52:26+05:30 INF Getting gateways automatic location by timezone
2025-09-01T01:52:26+05:30 INF Getting gateways for transport=obfs4-hop
2025-09-01T01:52:26+05:30 INF Getting gateways automatic location by timezone
qml: status starting

And lastly, there also is

2025-09-01T01:52:40+05:30 WRN Could not fetch geolocation error="Post \"https://api.black.riseup.net:9001/json\": tls: failed to verify certificate: x509: certificate signed by unknown authority"

I think this is simply because of missing SSL.

Could you please take a look at these things @jkito please? I'd like to release this to Debian, but this sounds like a regression that I don't think makes sense to release with.