Please support Debian GNU/Linux

[MagicFab]

I previously requested support for Debian Jessie installation (see #3 ).

I'd like to reiterate my request this time to cover Debian and following its releases. Supporting Debian would mean support for all its derivatives would be available, including Devuan, Trisquel and Ubuntu just to name a few.

Ubuntu's default desktop environment in Ubuntu 18.04 LTS will be GNOME again, the same as Debian's (now released, since 2018-04), so this would be a good time to target that. It means desktop support and documentation will be easier to implement and maintain as they should be very close going forward.

Special attention has to be paid to the browser choice (see #14), but Debian and other distributions should carry Firefox ESR for some more time (at least June 2018 or by next ESR release). The official release date for ESR-59 should be in march 2018, meaning it would be available from official packages in Debian around June 2018, typically earlier in Ubuntu. Manual installation is possible and rather easy, it's possible to keep an existing Firefox version with a more recent manually-installed one.

Since Firefox 57 came out (2017-11) many extensions stopped working as XUL is not supported anymore for their development. I believe this also means Open-EID stopped working for anyone that upgraded (see #14 (comment) ), I am not certain. This means Firefox 57 and up should be targeted for proper support.

The Debian Backports repository for the current Debian stable version (Debian 9) could be an option to check which packages more recent version can be used to remain as close as possible to a supported Debian install by using package repositories instead of manual installation or compilation which can break Debian.

[metsma]

Firefox 57 does not provide alternative to load PKCS11 modules with WebExtensions
It will come with FF 58 https://bugzilla.mozilla.org/show_bug.cgi?id=1357391
and is implemented here open-eid/firefox-pkcs11-loader#6.
Signing is not affected by this change.

[explit7]

I have Debian 10 (Sid atm.) It would be very good, if it could be supported

[MagicFab]

Firefox is now at version 59, but is only available when installed manually in Debian.

@explit7 Debian 10 is the current "testing" release, it will include Firefox 59 but not before ~May 2019. It could be a good plan to target that for proper support of Open-EID installation, maunal installation of FF59 in Debian 9 could be an alternative.

[MagicFab]

The last release as of last month has been reported broken (see #36) with several important bugs, it targets Ubuntu 16.04 (LTS), 18.04 (LTS) (64bit), 18.10, Chrome or Firefox (no mention of versions)

ID-software version: 18.12, DigiDoc4 client version: 4.2.0.43, released 03.12.2018

Debian Stable now has support for Firefox-ESR (60.4 as of today), no need for backports or external sources.

According to information at https://www.ria.ee/en/state-information-system/eid/digidoc-software.html :

Installation of DigiDoc software

The following will be installed into your computer during the installation of the DigiDoc software:

ID-card application DigiDoc4 Client, timestamping application TeRa.

In 2018, DigiDoc4, the new ID-card software that combines the former three applications in one utility, was taken into use. This means that only one application will be installed into your computer during the installation of the software. As of June 2018, DigiDoc3 will automatically update into DigiDoc4.

[zsoltsandor]

I revisit this issue, because I am considering joining the e-Estonians.
I am using Kali, which is obviously not the most common Debian derivative, but supporting Testing, or at least Sid would also mean support for Parrot OS and PureOS Byzantium.
Using the candidate/sid repo for the Belgian eID provides the same version as what is currently available for Ubuntu 20.04, and installs without an issue: deb https://files.eid.belgium.be/debian/ candidate/sid main
Estonian eID repos for Ubuntu versions don't seem to work properly. The middleware package gets broken, and open-eid metapackage breaks too.

[kali-gandaki]

Hi, I came up this issue as repo for ubuntu hirsute/focal won't install in debian 11. So I spent this morning packaging for my own use. I hosted it in OBS. If you need it add the following location in sources.list.
deb [signed-by=/usr/share/keyrings/my_obs.gpg] https://download.opensuse.org/repositories/home:/sapanaryal:/openeid/Debian_11/ ./
Don't forget to download release.key file from above mentioned link, convert it to gpg file and add it in /usr/share/keyrings.

Install it by apt-get update && apt-get install open-eid

[maltfield]

+1 Please add Debian 11 support.

If you support Debian, then you'll not only support Ubuntu (a downstream derivitative of Debian), but you'll also support countless other downstream derivatives of Debian.

Why not implement it at the source to support more people with the same effort? Please support Debian 11.

[teadur]

+1 for Debian 11 support

[hanna142x]

Debian 11 bullseye ships with libxalan-c112, but focal open-eid install wants libxalan-c111 (focal is closest to bullseye).
Fix is to download libxalan-c111 from buster (Debian 10) repo (https://packages.debian.org/buster/amd64/libxalan-c111/download) and install it manually using sudo dpkg -i <package name>

Then edit install-open-eid.sh
after buster section add:

        bullseye)
          add_repository focal
          ;;

After that install-open-eid.sh installs everything needed without a problem. ... and the most important, both Digidoc4 Client and authentication in web using the ID-card works.

[teadur]

Debian 11 bullseye ships with libxalan-c112, but focal open-eid install wants libxalan-c111 (focal is closest to bullseye). Fix is to download libxalan-c111 from buster (Debian 10) repo (https://packages.debian.org/buster/amd64/libxalan-c111/download) and install it manually using sudo dpkg -i <package name>

Then edit install-open-eid.sh after buster section add:

        bullseye)
          add_repository focal
          ;;

After that install-open-eid.sh installs everything needed without a problem. ... and the most important, both Digidoc4 Client and authentication in web using the ID-card works.

@metsma would pull request doing that be accepted to installer ?

[AlexDaniel]

@teadur Ubuntu packages can no longer be installed in debian because debian's dpkg does not support zstd. See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=892664.

[maltfield]

Actually, I think we should update this request from "Support Debian" to "Change support from Ubuntu to Debian". Support for open-eid in Ubuntu is already broken. Supporting Debian would require less work and provide support for more users. See also:

• Extension not installed after installing linux packages (firefox) web-eid/web-eid-webextension#41

Quoting from above ticket

Ubuntu 22.04 is moving away deb packaged Firefox (to snap) and this has other set problems (Sandbox does not allow to communicate with native messaging host and there is currently no workaround, except to install official Firefox/Chrome binary)

Oh man, you're right. When I saw that firefox switched from deb to snap I decided to stop recommending Ubuntu and recommend Mint instead.

snap is a cancer closed-wall garden created by Canonical, and a lot of people are leaving Ubuntu because of this. I highly, highly recommend supporting Debian instead of Ubuntu; you'll support more users, especially as everyone leaves Ubuntu for more libre distros.

Is "supporting Ubuntu only" RIK's requirement? Can it be changed through an enumeration of:

1. technical documentation of all of the issues with Ubuntu and snaps (Mint has some strong opinions about snaps)
2. documentation of the market share of Ubuntu declining vs Debian and Debian-derived systems (including Mint) surpassing it
3. enumeration of all the issues and development hours required to support Ubuntu vs Debian (eg this ticket, your concerns with "native messaging host" support breaking, and others like it)
4. etc?

I think a very strong argument can be made that switching support of open-eid from Ubuntu to Debian would

1. Support more users and
2. Decrease time/costs of supporting those users

[mrts]

Web eID unofficially supports Debian now (by including Firefox extension XPI), see web-eid/web-eid-app#215.

[kristelmerilain]

We added c111 package into our repo so now you should be able to install ID-software on Debian 11 with install script.

If you use Firefox on Debian then you have to install Web eID extension from Firefox Add-on Store: https://addons.mozilla.org/en-US/firefox/addon/web-eid-webextension/ This will be fixed in the next ID-software release.

[Jalakas]

Ubuntu 21.10 switched on compressing Debian packages with Zstd. [1]
Debian is still not supporting Zstd compression. [2]
So packages built from 21.10 on are not usable in Debian.

One solution would be [3] adding this build rule into "debian/rules":
override_dh_builddeb: dh_builddeb -- -Zgzip

1. https://www.phoronix.com/news/Ubuntu-21.10-Zstd-Debs
2. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=892664
3. https://stackoverflow.com/questions/71196872/how-do-i-build-a-deb-without-zstd-compression-in-ubuntu-21-10

[pauljamesharper]

I can report I am on Debian 12 Bookworm which is the latest stable version and I can connect to the Estonia E-Residency site with the ID, I used the install script and in added Ubuntu Kinetic to the sources.list.d:

deb [signed-by=/usr/share/keyrings/ria-repository.gpg] https://installer.id.ee/media/ubuntu/ kinetic main

OS: Debian GNU/Linux 12 (bookworm) x86_64 
ThinkPad X1 Carbon Gen 1 
Kernel: 6.1.0-10-amd64

[Arszilla]

In my testing, using focal (i.e. the same as bullseye) works for Kali Linux. Thus the script can be modified to the following:

case $distro in
   debian|kali)
      make_warn "Debian is not officially supported"
      echo "### Installing possibly missing https support for APT (apt install apt-transport-https)"
      # Debian lacks https support for apt, by default
      sudo apt install apt-transport-https
      case "$codename" in
         bullseye|kali-rolling)
          make_warn "Debian $codename is not officially supported"
          make_warn "Installing from ubuntu-focal repository"
          add_repository focal
          ;;
         bookworm)
          make_warn "Debian $codename is not officially supported"
          make_warn "Installing from ubuntu-kinetic repository"
          add_repository kinetic
          ;;
        *)
          make_fail "Debian $codename is not officially supported"
          ;;
      esac
      ;;

However, as per open-eid/DigiDoc4-Client#1215, there's a Segmentation Fault occurring in DigiDoc4 client. Not sure what's the cause of this, as the packages used by open-eid are coming from Debian upstream, not from Kali themselves.

However, a few packages are missing, but can be downloaded and installed via Debian's online repository:

• https://packages.debian.org/bullseye/amd64/libssl1.1/download
• https://packages.debian.org/buster/libldap-2.4-2 (Kali has libldap-2.5)
• https://packages.debian.org/buster/amd64/libenchant1c2a/download

[Arszilla]

Update to my previous reply: The aforementioned Debian packages are not needed anymore. With #120, Kali Linux should work. However, I must address that the use of Ubuntu repositories in Debian and its derivates (such as Kali Linux or Parrot OS) is a big problem, as the use of Ubuntu repositories could break apt in the future.

I highly advise the creation of a Debian-specific repository to allow Debian users to use DigiDoc4/open-eid without worrying if this will break their apt in the future.

[eluuk]

I've used my ID card on Debian for years but signing in browsers (i.e. open-eid and web-eid) has stopped working since the new ID software was released in April 2024 (DigiDoc4, i.e. qdigidoc4 works). The browsers are chromium and firefox-esr and it would suffice if it worked in one of them. I upgraded from buster to bullseye, run the install script, installed browser extensions and it's still not working

I'm investigating this issue further, would appreciate any advice and have some specific questions:

1. Is the PKCS11 extension still required for FF?
2. ATM I have both libxalan-c112 and libxalan-c111 installed. Should I remove one of them (and which one)?

[metsma]

Chromium browser is not supported at this version, you can try use Chrome or modify system by hand (web-eid/web-eid-app#324).
Firefox-esr should be working.

1. PKCS11 extension is optional because
   a) most authentication is done these days with web-eid and does not require Client Certificate Authentication with TLS
   b) OpenSC has also XDG registration tool that setups the PKCS11 module
2. I think the other version is needed for libxml-security-c because packages are build on ubuntu and keep compatiblity.
   You can probably remove one if package manager allows it, it should be hard dependency and prevent removing if it is in use.

[eluuk]

More precisely, the errors are as follows:

On seb.ee:

Chromium: error on PIN2:

allkirjastamine ebaõnnestus. palun sulgege kõik veebilehitseja aknad ja sisenege uuesti internetipanka. vea kordumisel kontrollige, kas veebilehitseja allkirjastamise mooduli kasutamine on lubatud. juhised leiate veebilehelt id.ee > abikeskus

FF ESR: error on primary authentication (kasutajatunnus before PIN1):

ID-kaardiga sisenemine ebaõnnestus. Palun veenduge, et ID-kaart on korrektselt lugejas. Sulgege kõik brauseri aknad ja proovige seejärel uuesti.

On eesti.ee:

Chromium: error on PIN1:

Kasutaja tuvastamine ebaõnnestus. Palun uuendage ID-tarkvara id.ee veebilehelt ja järgige seal kirjeldatud veebibrauseri seadistamise juhiseid. Uuendamata ID-tarkvaraga ei ole võimalik ID-kaardiga sisse logida Riigi autentimisteenuse kaudu.

FF ESR: PIN1 works (no PIN2 authentication there)

[mrts]

Chromium support will come in web-eid/web-eid-app#324.

[edmundlaugasson]

Different Linux distro support are listed here https://github.com/open-eid/linux-installer/wiki/Linux-Packages
Sounds like lines 134-155 add some Debian support in main script.
As ID-card software requires Internet connectivity anyway, a distro-agnostic solution could be fully in browser working software. Web eID is already as web browser extension, why not also DigiDoc. Web eID can communicate with smart card readers. Even better solution would be DigiDoc as web application like earlier times was DigiDoc portal, now Dokobit - sold to Lithuanian company... Actually Estonia as a e-country and for e-residents desperately needs a web DigiDoc portal owned by Estonian government (never sold) and web-based DigiDoc software is key pillar of that portal.
Actually, a Flatpak version of DigiDoc is also available, would be interesting to hear, how it works.

[edmundlaugasson]

Chromium support will come in web-eid/web-eid-app#324.

Still in Linux Mint the Chromium support does not work at all - tested in last three versions of Linux Mint (20, 21, 22). Only official Google Chrome works with web-eid extension. Linux Mint is closely based on officially supported Ubuntu LTS and therefore is quite weird, that web-eid does not work at all in Chromium
At the same time in EndeavourOS the Chromium support works fine. EndeavourOS is closely Arch Linux based, which is very unofficial but works fine.

[metsma]

Chromium support will come in web-eid/web-eid-app#324.

Still in Linux Mint the Chromium support does not work at all - tested in last three versions of Linux Mint (20, 21, 22). Only official Google Chrome works with web-eid extension. Linux Mint is closely based on officially supported Ubuntu LTS and therefore is quite weird, that web-eid does not work at all in Chromium At the same time in EndeavourOS the Chromium support works fine. EndeavourOS is closely Arch Linux based, which is very unofficial but works fine.

Chromium and Chrome do not share same config paths.
https://developer.chrome.com/docs/extensions/develop/concepts/native-messaging
Linux (system-wide)

• Google Chrome: /etc/opt/chrome/native-messaging-hosts/com.my_company.my_application.json
• Chromium: /etc/chromium/native-messaging-hosts/com.my_company.my_application.json

https://developer.chrome.com/docs/extensions/how-to/distribute/install-extensions#preference-linux
Place it in one of the following folders:

• /opt/google/chrome/extensions/
• /usr/share/google-chrome/extensions/