Arch Linux User Repository

I updated to version 4.1.2, but currently I am not able to sign document. Nor with dLauncher, nor with qesportal.sk. No certs accessible during signage process to be used for digital signage.

According to manual I have to create new User cryptography service provider as for first time use, because previously configured were lost. (This was caused maybe by manual uninstalling and reinstalling eidklient.) But I am not able to create another one because of no "libpkcs11_x64.so" installed/unpacked to /usr/libs or wherever.

Lib probably should be installed to /usr/lib/eID_klient to be able to be used with "eID klient" system provider

Ccid is required. Interestingly, pcsclite is a dependence of ccid in Arch. In Debian, it's vice versa. I'll leave it there as a clear statement the package needs both.

Squashfuse is not required - I've tested that a moment ago.

Thanks, @piecka, for the update!

Here are some nitpicks I’ve found.

1. Why squashfuse instead of fuse2?
2. Does the app really depend on ccid? You might be right, I have it installed, however, It is not listed in the app dependencies.

3. Here are some nitpicks (all are fixed in the patch below):

   • _url variable value end with a backslash, however, whenever you use that variable (L15-17), you always put another backslash after it.
   • you seem to use four spaces for indentation, however in pkgver() (L18-19) you use seven;
   • getting latest version from eID_klient_release_notes.txt could be simplified if we could use GNU grep with PCRE (I have no idea what grep version could be used in PKGBUILD);

diff --git a/eidklient_orig.sh b/eidklient_mdfd.sh
index 72ad2c6..933c7f9 100644
--- a/eidklient_orig.sh
+++ b/eidklient_mdfd.sh
@@ -11,7 +11,7 @@ _upstream_arch=
 [[ "$CARCH" == "x86_64" ]] && _upstream_arch="x86_64"
 [[ "$CARCH" == "i686" ]] && _upstream_arch="i386"
 _appimage="eID_klient-${_upstream_arch}.AppImage"
-_url="https://eidas.minv.sk/downloadservice/eidklient/linux/"
+_url="https://eidas.minv.sk/downloadservice/eidklient/linux"
 source=("${_url}/eID_klient_release_notes.txt")
 source_i686=("${_url}/${_appimage}")
 source_x86_64=("${_url}/${_appimage}")
@@ -28,8 +28,8 @@ prepare() {
 }

 pkgver() {
-       # Match version from upstream release notes
-       cat eID_klient_release_notes.txt | grep "verzia" | head -n1 | sed 's/^.*verzia \([0-9.]*\).*/\1/'
+    # Match version from upstream release notes
+    grep -Pom1 'verzia \K[\d.]+' eID_klient_release_notes.txt
 }

 package() {

Thank you Krtko and tukusejssirs for your contributions.

For now I prefer to leave AppImage in it's original form.

Thanks, @Krtko!

Just a few notes:

a. tar accepts output path using -C option (it has to be placed after the archive name), thus following three commands could be replaced with a single one:

# Current
cd "${srcdir}/squashfs-root/"
tar xf "share.tar"
cd "../.."

# Proposed
tar xf share.tar -C "${srcdir}/squashfs-root"

b. We should escape full stops (dots) in regex.

# Current
sed -i -E "s|Exec=./eID_Client|Exec=env DESKTOPINTEGRATION=false /usr/bin/${pkgname}|" "squashfs-root/eid-klient-mw.desktop"

# Proposed
sed -i -E "s|Exec=\./eID_Client|Exec=env DESKTOPINTEGRATION=false /usr/bin/${pkgname}|" "squashfs-root/eid-klient-mw.desktop"

c. You removed the list of dependencies, however, the app still depends on pcsclite, xterm, fuse2 (I am not sure if xterm is actually used at runtime). I am not sure if it still opt-depends on disig-web-signer.

d. I might still prefer extracting entire AppImage instead of running it, although I understand it requires some additional commands (as you can see it here) and might be even less supported. I think we could create two AUR packages: eidklient/eidklient-extracted and eidklient-appimage.

suggested patch to use new AppImage

From 6ec4707e276ce55f5c223591e7b435889974ffd5 Mon Sep 17 00:00:00 2001
From: Matej Novota <matej.novota@gmail.com>
Date: Thu, 20 Oct 2022 13:56:49 +0200
Subject: [PATCH] upgrade to 4.1

---
 PKGBUILD | 54 +++++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 37 insertions(+), 17 deletions(-)

diff --git a/PKGBUILD b/PKGBUILD
index f46238b..2719c6c 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,33 +1,53 @@
 # Maintainer: Fedor Piecka <teplavoda at gmail dot com>

 pkgname=eidklient
-pkgver=3.7.0
-pkgrel=2
+pkgver=4.1.0
+pkgrel=1
 pkgdesc="Slovak eID Client"
 arch=('i686' 'x86_64')
 url="https://www.slovensko.sk/"
 license=('custom')
-source_i686=('https://eidas.minv.sk/TCTokenService/download/linux/debian/Aplikacia_pre_eID_i386_debian.tar.gz')
-source_x86_64=('https://eidas.minv.sk/TCTokenService/download/linux/debian/Aplikacia_pre_eID_amd64_debian.tar.gz')
-md5sums_i686=('SKIP')
-md5sums_x86_64=('SKIP')
+_upstream_arch=
+[[ "$CARCH" == "x86_64" ]] && _upstream_arch="x86_64"
+[[ "$CARCH" == "i686" ]] && _upstream_arch="i386"
+_appimage="eID_klient-${_upstream_arch}.AppImage"
+_url="https://eidas.minv.sk/downloadservice/eidklient/linux/"
+source_i686=("${_url}/${_appimage}")
+source_x86_64=("${_url}/${_appimage}")
+b2sums_i686=('4c4138f78d84c2a6125fc99700f6274f23dacdabec626874be0eb9efc0f7778802be7a01c1c455c48870235f9c054165e7a8791ec3ce0b3cbe0f669ec1b90008')
+b2sums_x86_64=('82ca6b10e07c02dcbc246edc4da862336d812e4b663ae256591c58f8daeccd72bb448ae447e00370ead8b47feaa0c0fd66a1edadb6b91069cd3c05c6e82a5f07')
 options=("!strip")
 install=eidklient.install

-# Upstream uses Debian architecture naming convention. Let's prepare a variable for that.
-upstream_arch=
-[[ "$CARCH" == "x86_64" ]] && upstream_arch="amd64"
-[[ "$CARCH" == "i686" ]] && upstream_arch="i386"
-
+prepare() {
+    chmod +x "${_appimage}"
+    ./"${_appimage}" --appimage-extract
+}

-pkgver() {
-   # Match Debian package version
-   ar p ${srcdir}/Aplikacia_pre_eID_${upstream_arch}_debian.deb control.tar.gz | tar -Oxz ./control | grep ^Version: | cut -f2 -d" " | tr -d '[:space:]'
+build() {
+    # Adjust .desktop so it will work outside of AppImage container
+    sed -i -E "s|Exec=./eID_Client|Exec=env DESKTOPINTEGRATION=false /usr/bin/${pkgname}|"\
+        "squashfs-root/eid-klient-mw.desktop"
+    # Fix permissions; .AppImage permissions are 700 for all directories
+    chmod -R a-x+rX squashfs-root
 }

 package() {
-        depends=("glibc" "pcsclite" "ccid" )
-        optdepends=('disig-web-signer: online certificates update support')
+    # AppImage
+    install -Dm755 "${srcdir}/${_appimage}" "${pkgdir}/opt/${pkgname}/${pkgname}.AppImage"
+
+    # Desktop file
+    install -Dm644 "${srcdir}/squashfs-root/eid-klient-mw.desktop"\
+            "${pkgdir}/usr/share/applications/${pkgname}.desktop"
+
+    # Icon images
+    cd "${srcdir}/squashfs-root/"
+    tar xf "share.tar"
+    cd "../.."
+    install -dm755 "${pkgdir}/usr/share/"
+    cp -a "${srcdir}/squashfs-root/share/icons" "${pkgdir}/usr/share/"

-   ar p ${srcdir}/Aplikacia_pre_eID_${upstream_arch}_debian.deb data.tar.xz | tar -xJ -C "${pkgdir}"
+    # Symlink executable
+    install -dm755 "${pkgdir}/usr/bin"
+    ln -s "/opt/${pkgname}/${pkgname}.AppImage" "${pkgdir}/usr/bin/${pkgname}"
 }
-- 
2.38.0

New official version of eID Klient came out recently (v4.x) which is an AppImage bundled in a DEB package.

The download URL, however, changed to https://eidas.minv.sk/downloadservice/eidklient/linux/eID_klient_x86_64.tar.gz.

I haved tested it out (both running AppImage and extracting and running its contents) and it seems to work on Arch Linux. Here’s my messy script with some notes.

@piecka, could you update this package please?

Update: I have just received information of the callcentrum of Ministry of the Interior (Slovakia) that the direct links to the AppImages actually exist, however, they are not yet published on the download site.

• eID_klient-x86_64.AppImage;
• eID_klient-i386.AppImage.

EAC MW client: Nepodarilo sa spojiť so serverom. 1.) Skontrolujte správnosť nastavenia proxy servera v aplikačných nastaveniach (postup nájdete v príručke k aplikácii) 2.) Skontrolujte, či nejaká aplikácia (napr. antivírový program) neblokuje Aplikácii pre eID prístup do siete S

Error message: Error(35): Cannot download TCToken: curl_easy_perform failed: Couldn’t use specified SSL cipher (url: https://eidas.minv.sk/SessionToken/TCToken?.…&node=4) - 612 - 36

Any suggestions how to fix it?

I would suggest adding disig-web-signer package into optional dependencies, as in my understanding, it required for eac_mw_client (this app) to issue the certificates when the eID is still in the factory settings.

EDIT: I have also written a guide for eID Arch users, might help someone: https://peterbabic.dev/blog/using-electronic-id-on-arch-in-slovakia-pt2/

You're right. Perhaps we can't remove the SW QT4 dependency itself, but I've found out, that we could get rid of the AUR package qt4 dependency. According to my research, these seven qt4 libs seems to be required for the eID to be running (feel free to describe more if you find them as required):

libQtCore.so.4
libQtDeclarative.so.4
libQtGui.so.4
libQtNetwork.so.4
libQtScript.so.4
libQtSql.so.4
libQtXml.so.4

I've extracted (from qt4 v4.8.7-30-x86_64) these for standalone use: https://uloz.to/!qAWi7ct7AYXn/qt4libs-4eid-tar-gz Now, one could remove the qt4 package out of the system and simply place those provided libs into the "/usr/lib/eac_mw_klient/" folder.