Arch Linux User Repository

@ewtoombs: How did you configure Firefox to use Atostek ID? For me Firefox only crashes, if the pcscd.{service,socket} is not started. In any case, the overall user experience is so sluggish and cumbersome, that I almost never use my ID card on Linux. I just test that suomi.fi login works after every update, and that's about it :D

Now, 4.3.0.0 tends to crash all of firefox and 4.3.1.0 doesn't work at all.

There's now a section for Atostek ID in the Arch Wiki: https://wiki.archlinux.org/title/Electronic_identification#Atostek_ID

Feel free to document more use cases or add other details.

I just tried the latest version of DigiSignClient (4:4.3.2_8863-1) on Arch Linux. If DigiSignClient is running, Firefox delegates the PIN dialog correctly to DigiSignClient. If it is not running, Firefox shows its own dialogs multiple times, and does not explicitly ask which PIN the user should enter.

I also tried Atostek ID (4.3.0.0) on Ubuntu 24.04 with regular Firefox (non-snap). PIN dialogs are shown by Firefox (multiple times), even though the Atostek ID app is running in the background. Well, at least the Firefox dialogs now explicitly tell which PIN it wants in this Atostek PKCS#11 module implementation.

In summary, it seems that the Atostek PKCS#11 module works equally bad with Firefox both in Arch Linux and Ubuntu.

FWIW I don't remember needing to enter my PIN several times with DigiSignClient. But I use it very seldomly. Currently installing this to see how it fares.

@ewtoombs I'm afraid what you are describing is the expected behaviour in the Linux version of Atostek ID. When using the PKCS #11 module via Firefox, the PIN dialogs come from Firefox and they will appear multiple times per operation. IIRC, this was also how it worked with the previous software DigiSignClient. It also seems that that some browsers fail to ask which PIN to use. If you have set different PINs for PIN1 and PIN2, it can be very confusing.

In Windows, when authenticating with a web browser, the PIN dialogs are correctly delegated to the Atostek ID application and you only need to enter the PIN once per operation. Unfortunately, Linux seems to be second class citizen in terms of features for now.

atosekid does work, but at least in Firefox, I have to enter my password four times, every single time I log into any website using my henkilökortti. Can this be avoided somehow?

About -installSCSCA: There was a UI, though. I was running it in sway, with xwayland. Maybe root doesn't have access to a user's wayland or X session.

❗Possible breaking change introduced in commit 851734d. The PKCS #11 module Atostek-ID-PKCS11.so was moved from /usr/lib/ to /usr/lib/pkcs11/, because the latter is the proper directory in Arch Linux for PKCS #11 modules. If you have configured any program with absolute paths, e.g. /usr/lib/Atostek-ID-PKCS11.so, please reconfigure accordingly.

@neonmoe, Thanks for the heads up.

I have created another AUR package (libqpdf29) that provides an older version (29) of the QPDF library that is compatible with atostekid. The package contains only the library /usr/lib/libqpdf.so.29{,.10.1} and license files. In other words, it can coexist with the current system qpdf package.