Arch Linux User Repository

I've updated this package to use a specific version of wxWidgets (3.0.x), which is also available on AUR. I've tested this package in my system and it is working fine.

This is a tricky problem to solve. Arch's wxwidgets-gtk package bumped that library version and upstream doesn't provide an updated version, so it relies on that specific version that's not provided anymore. A possible solution is to provide a package for wxwidgets-gtk3.0, but I don't have any time right now. I didn't find any suitable version currently on AUR, so I'll have to create a new one.

tokenadmin: error while loading shared libraries: libwx_gtk3u_core-3.0.so.0: cannot open shared object file: No such file or directory

It seems that libwx_gtk3u_core-3.0.so.0 was dropped from the latest wxwidgets-gtk3 update.

@denisfalqueto I just reinstalled, same version, and wxgtk3 seems to be up-to-date

$ sudo pacman -Qi wxgtk3
Name            : wxgtk3
Version         : 3.0.5.1-3
Description     : GTK+3 implementation of wxWidgets API for GUI
Architecture    : x86_64
URL             : https://wxwidgets.org
Licenses        : custom:wxWindows
Groups          : None
Provides        : None
Depends On      : gtk3  gst-plugins-base-libs  libsm  libxxf86vm  wxgtk-common  libnotify
Optional Deps   : webkit2gtk: for webview support [installed]
Required By     : audacity  safesignidentityclient
Optional For    : None
Conflicts With  : wxgtk<3.0.3.1-2
Replaces        : None
Installed Size  : 15.08 MiB
Packager        : Antonio Rojas <arojas@archlinux.org>
Build Date      : Wed 05 Jan 2022 07:10:46 AM -03
Install Date    : Mon 07 Mar 2022 12:38:25 PM -03
Install Reason  : Installed as a dependency for another package
Install Script  : No
Validated By    : Signature

@potuz, when did you install this package? It could be some old version of a dependency (I would bet on wxgtk3...). I just tested with an old token (expired certificates, etc) but it showed digital id's correctly.

Getting a segfault on tokenadmin installed with yay.

     Product name: SafeSign IC Standard Linux
          Version: 3.7
            Build: 0.0
     Distribution: AET.000

        File Name: File Version
    libaetjcss.so: 3.9.2.1
    libaetpkss.so: 3.8.4.2
  libaetdlglib.so: 3.7.14.1
    libaetdlss.so: 4.2.3.1
       tokenadmin: 3.8.24.1

It opens up and when clicking on "show digital IDs" a popup "working" appears for a split second before it segfaults.

No problem @denisfalqueto.

The newer version of safesign 3.7.0 if you want to update:

Release of SafeSign Identity Client version 3.7 for Microsoft, MacOS and Linux

https://safesign.gdamericadosul.com.br/download

Thanks @illusion for the heads up. It's good they dropped wxgtk2 as a dependency. I can get rid of it in my box now.

You may need to install wxgtk3 because it's a required dep, I think wxgtk2 is deprecated in this version.

Sorry for the delay in updating. Just got some time today and updated it to 3.6.0.0, according to @illusioon's comment. Thanks again for helping out.

https://certificaat.kpn.com/installatie-en-gebruik/installatie/pas-usb-stick/linux/

Creio que seja uma versão mais atualizada do safesignidentityclient

https://safesign.gdamericadosul.com.br/download (aqui tem a versão 3.7)

Que segundo a aeteurope é a última versão disponível:

https://www.aeteurope.com/news/release-of-safesign-identity-client-version-3-7-for-windows-macos-and-linux/

Good catch, @euzao. Updated again, just a pkgver bump.

Thanks for the update. It is also important to update the URL above accordingly.

Updated package, according to new version suggested by @gravity. Thanks for the heads up.

Although I don't have a compatible smartcard to test with (I don't remember why I subscribed to this), I could suggest running the module out-of-process in case it somehow interferes with the browser's internals (e.g. by trying to load incompatible libraries):

1. Remove libaetpkss.so from the browser.

2. Add /usr/lib/p11-kit-proxy.so to the browser.

3. Create a file ~/.config/pkcs11/modules/safesign.module with contents:

   module: /usr/lib/libaetpkss.so
remote: |p11-kit remote /usr/lib/libaetpkss.so

4. After restarting the program, you should see the 'p11-kit remote' process as a child of firefox in the process tree.

(Note that p11-kit will load all modules from ~/.config/pkcs11/modules and from /usr/share/p11-kit/modules, acting as one big PKCS#11 supermodule.)

By the way, there's a more current version here, which doesn't seem to require gdbm183. Manually installing it did not fix my issues though.

Both Firefox and Chromium seem to hang when trying to talk to the smartcard (a VALID eCPF on a VASCO DP905v1.1). I added /usr/lib/libaetpkss.so to both, as instructed here. When I so much as switch tabs (even to something that doesn't even try to authenticate with the card) with the card inserted, both browsers freeze completely.

Has anyone run into this?

Muito obrigado, funcionou perfeitamente!

@malta: happy to learn that. I'll try to make a snap package for this, so we can get around library dependencies. If I succeed, I'll leave a message here.

now its working. seems a few steps and packages were missing. anyone having this problem just follow https://wiki.archlinux.org/index.php/Smartcards

@malta: it's working for me. This is a proprietary mess, without any commitment from the hardware providers.

similar error as @joaopassarini and @ralvesco. Is there a fix to this?

[malta@malta-ub ~]$ tokenadmin 21:51:51: Warning: Mismatch between the program and library build versions detected. The library used 3.0 (wchar_t,compiler with C++ ABI 1013,wx containers,compatible with 2.8), and your program used 3.0 (wchar_t,compiler with C++ ABI 1009,wx containers,compatible with 2.8). *** Caught unhandled unknown exception; terminating Falha de segmentação (imagem do núcleo gravada)

I was able to run tokenadmin after installing gdbm183, from AUR. I'll change that dependency to point to the correct package. Sorry for taking so long to answer.

I'm having the same problem pointed out by @joaopassarini in his last comment, do you have any clues?

Sorry to bother you, @denisfalqueto.

Thanks!

@denisfalqueto I'm still not able to use the certificate. It looks like a mismatch between the library versions:

[joao@ga-78lmt-usb3 ~]$ tokenadmin 
14:03:29: Warning: Mismatch between the program and library build versions detected.
The library used 3.0 (wchar_t,compiler with C++ ABI 1013,wx containers,compatible with 2.8),
and your program used 3.0 (wchar_t,compiler with C++ ABI 1009,wx containers,compatible with 2.8).
libgdbm_compat.so.3: não é possível abrir arquivo compartilhado: Arquivo ou diretório inexistente

Any clues?

@denisfalqueto

https://pastebin.com/GQAb4ZcA

@joaopassarini, that's quite strange. /usr/lib/libaetpkss.so is linked to the right file and access rights are correct. Would you send the results of:

ldd /usr/bin/tokenadmin

You can put it on Pastebin.com.

@geyslan Here you are:

lrwxrwxrwx 1 root root      15 out 29 14:15 /usr/lib/libaetpkss.so -> libaetpkss.so.3
lrwxrwxrwx 1 root root      17 out 29 14:15 /usr/lib/libaetpkss.so.3 -> libaetpkss.so.3.5
lrwxrwxrwx 1 root root      22 out 29 14:15 /usr/lib/libaetpkss.so.3.5 -> libaetpkss.so.3.5.4112
-rw-r--r-- 1 root root 1481176 out 29 14:15 /usr/lib/libaetpkss.so.3.5.4112

@joaopassarini @jplatte, perhaps it's due to broken links. Can you paste the result of ls?

ls -l /usr/lib/libaetpkss*

@denisfalqueto after upgrading to new versions (3.5-1 and 3.5-2), 'tokenadmin' stopped working. It cannot load the library libaetpkss.so anymore

Newer dependencies are nice, but for me 3.5 doesn't work. The 'Token Admin' still detected that a card was present, but didn't show the same card label and didn't allow me to do anything with it. Downgrading to 3.0.101-5 fixed the problem.

Many thanks for Geyslan for important hints for avoiding deb2targz dependency for build.

Update to version 3.5, fetched from Pronova CA. This version has newer dependencies, so it's easier to install.

Hi guys, just trying to get this PJe to install on a Manjaro live-session as a trial run.

So far I've tried to install the safesignidentityclient directly through Pamac and got a bunch of errors regarding openssl098, so I went to google and found out this "guide" from @loliveira but even when I replicate his steps, I got the package to install but when I open the tokenadmin, these messages appears on the terminal and the app crashes a few seconds after: "tokenadmin: /usr/lib/libcrypto.so.0.9.8: no version information available (required by tokenadmin) 10:55:57 PM: Deleted stale lock file '/tmp/{B58139E8-7087-C745-ACBE-5EE8B60C3D32} - manjaro'.

Aborted (core dumped)"

I have these files on the path: /usr/lib/libcrypto.so -> libcrypto.so.1.1 /usr/lib/libcrypto.so.0.9.8 /usr/lib/libcrypto.so.1.0.0 /usr/lib/libcrypto.so.1.1

Tried running it with sudo and got a new error right before the crash: "terminate called after throwing an instance of 'unsigned long' Aborted"

Can you guys help me figure this one out? Trying to get another user away from Windows!!! :D

Thanks in advance.

--EDIT: Nevermind, guys. Got it to work by installing the drivers for the token first (the package "ccid-morpho" from AUR). Now everything works flawlessly, as expected coming from Linux ;)

@loliveira

Oh, I'm glad it worked! This method of linking to specific versions of libraries is a little problematic on Arch, with rolling release just moving dependencies underneath and we only learn it when the software blows on our faces. That's why I've provided gdbm183 also, so it wouldn't update the underlining library.

Anyway, I'm very happy to help.

Just managed to get it to work!!!

Here is what I did:

sudo yaourt -R safesignidentityclient openssl098 # Removed both safesign and openssl098 package

sudo rm -rf /usr/lib/libssl.so.0.9.8 # This was left even after removing openssl098, so I removed it manually

I cloned the repository for openssl098: https://aur.archlinux.org/openssl098.git/

makepkg # built it locally

sudo pacman -U openssl098-0.9.8.zh-2-x86_64.pkg.tar.xz # installed it

sudo rm -rf /usr/lib/libaet* # remove anything related to libaet

sudo yaourt -Sy safesignidentityclient # installed safesignidentityclient again

tokenadmin # started tokenadmin and installed the firefox integration through it

Launched firefox, and for my surprise, it worked! Now, I have no idea why that fixed my problem to be honest, if you look close enough you will see I didn't do anything that wouldn't have happened with a simple yaourt -Sy safesignidentityclient openssl098, but something certainly got messed up with my shared objects, so hopefully this info here will help someone one day.

I thought I was the only Brazilian trying to pull this off on Arch, only to find you had done all the hard work and shared it, thanks a lot @denisfalqueto!

@loliveira

Hi. You should never symlink for different versions of libraries. If some library or program links to an specific version of another, there's a reason for that and if you symlink to a different version, all hell will break lose. So, don't do that.

According to your ldd output, your version of libaetpkss.so.3 is wrongly linked to libgdbm.so.2. That should be libgdbm.so.3, which is provided by gdbm183. As libaetpkss.so.3 is a binary provided by AET Software (through some hardware vendor), I believe that you should uninstall and reinstall SafeSign again. Make sure that the original source is the same as the source url in this page.

hi @denisfalqueto!

Same thing over here as you can see (I updated the gist): https://gist.github.com/devlucas/79c9e4639a370b51ddef6f00c750d0bb

I don't have the libgdbm.so.2 missing error anymore, as I have fixed it with a symlink to libgdbm.so.3.0.0.

Do you have firefox integrated with libaetpkss (by clicking on tokenadmin's "Integration > Install SafeSign in Firefox")? When I click that, it says the integration has been successfully installed, but when I trigger firefox from my terminal I get:

$ firefox

/usr/lib/firefox/firefox: symbol lookup error: /usr/lib/libaetpkss.so.3.0: undefined symbol: EVP_md2

I am fighting this one now by trying to compile openssl098 with enable-md2, not sure if this will fix the issue though..

@loliveira

I also have a warning for libopenssl, I think that's normal. But I don't have any messages about missing libgdbm.so.2. ldd tokenadmin gave the same results as yours. Could you provide the output for ldd /usr/lib/libaetpkss.so? This is the library that links to libgdbm and here in my box is links to libgdbm.so.3.

Turns out the issue was this:

libgdbm.so.2: cannot open shared object file: No such file or directory

I looked up what .so files I had for libgdbm and I found this:

$ find /usr/lib -type f -name "libgdbm*" | awk '!/compat/'

/usr/lib/libgdbm.so.5.0.0

/usr/lib/libgdbm.so.3.0.0

So I created a symlink for the closest version:

$ sudo ln -s /usr/lib/libgdbm.so.3.0.0 /usr/lib/libgdbm.so.2

Now I am able to run tokenadmin although it crashes as soon as I try to do basically anything, screaming about undefined symbols on libaetpkss.so.3.0 like this:

tokenadmin: symbol lookup error: /usr/lib/libaetpkss.so.3.0: undefined symbol: dbm_open

I believe this has to do with the first error that shows up on my terminal when I run tokenadmin (although it doesn't blow up right there):

tokenadmin: /usr/lib/libcrypto.so.0.9.8: no version information available (required by tokenadmin)

I am able to install the firefox integration though, but when I do it crashes firefox like this:

$ firefox

/usr/lib/firefox/firefox: symbol lookup error: /usr/lib/libaetpkss.so.3.0: undefined symbol: EVP_md2

Digging deeper on google I found this: http://openssl.6102.n7.nabble.com/EVP-md2-error-td24359.html

So tomorrow I am gonna try to recompile openssl098 with enable-md2 and see how it goes, I wonder if anyone is facing these issues as well, but anyway I will keep posting here for the sake of information.

Hi folks!

First, thank you for the amazing effort you have put onto this :)

I got this package installed this week, but when I try to open tokenadmin, I am facing a few issues, some I think are fine, but there is one in particular that prevents me from using the program:

~ » tokenadmin

tokenadmin: /usr/lib/libcrypto.so.0.9.8: no version information available (required by tokenadmin)

01:12:24 AM: Deleted stale lock file '/tmp/{B58139E8-7087-C745ACBE-5EE8B60C3D32} - lucas'.

libgdbm.so.2: cannot open shared object file: No such file or directory

The above shows up on my terminal but doesn't prevent the program from starting up, the thing is that when it starts, I get a GUI titled "Fatal Error" with the following message: "Unable to load libaetpkss.so.3.0"

This is the relevant info I can get about libaetpkss.so.3.0:

~ » ll /usr/lib/libaetpkss.so.3.0

lrwxrwxrwx 1 root root 22 Apr 19 00:55 /usr/lib/libaetpkss.so.3.0 -> libaetpkss.so.3.0.3930

~ » pacman -Qo /usr/lib/libaetpkss.so.3.0 /usr/lib/libaetpkss.so.3.0 is owned by safesignidentityclient 3.0.101-5

You can see the output of "ldd /usr/bin/tokenadmin" on my machine here: https://gist.github.com/devlucas/79c9e4639a370b51ddef6f00c750d0bb

Any chance someone can help me figure out what's going on?

Thanks a lot in advance!

Changelog for 3.0.101-5:

• Remove use of deb2targz
• Make ccid obligatory dependency

Thanks @la-mj for pointing that out.

@la-mj

"fetching binary packages from github makes me sad => who knows how they were REALLY obtained"

This is certainly a valid point, but on the other hand, our providers also don't have a source from where they get it. For example, "Valid AC" can get a version of Safesign different from "Caixa AC". So, that's a moot point.

"deb2targz is a builddep => please add it"

Point taken, I'll change it.

"using wxgtk3 is no good => confirmed"

Also had confirmed it before.

"ccid is not optional for this unit"

Thanks. I'll fix it.

"Warning: Mismatch between the program and library build versions detected. The library used 2.8 (no debug,Unicode,compiler with C++ ABI 1011,wx containers,compatible with 2.6), and your program used 2.8 (no debug,Unicode,compiler with C++ ABI 1002,wx containers,compatible with 2.6)."

This mean your version of wxgtk was built with a different version of toolchain than the one used to build Safesign. That could be fixed by rebuilding wxgtk2.8 with the right options.

"locally available win-only version is 3.0.124 => vendor & provider are grade A holes"

That's true. Unfortunately, we're on their hands for Linux support, which is always an afterthought.

"seems to work kinda..."

Yeah, unfortunately also not under our control.

"firefox picks it up but I am getting SSL_ERROR_UNKNOWN_CA_ALERT on a site that should recognize it"

That problem is related to missing intermediary CA certs known to Firefox. That's nothing Safesign can do about it.

"too bad nothing free handles pdf signing"

Also not related to Safesign.

Thanks for commenting. I'll try to fix what I can as soon as possible.

@la-mj,

My cents about some concerns.

• "fetching binary packages from github makes me sad => who knows how they were REALLY obtained"

• https://github.com/geyslan/morpho/blob/master/README.md

• "deb2targz is a builddep => please add it"

• Actually tar can handle it alone. There's no need of deb2targz. Eg. tar xf data.tar.xz

Notes on trying 3.0.101-4 with 1059:0019 Giesecke & Devrient GmbH:

• fetching binary packages from github makes me sad => who knows how they were REALLY obtained
• deb2targz is a builddep => please add it
• using wxgtk3 is no good => confirmed
• ccid is not optional for this unit
• Warning: Mismatch between the program and library build versions detected. The library used 2.8 (no debug,Unicode,compiler with C++ ABI 1011,wx containers,compatible with 2.6), and your program used 2.8 (no debug,Unicode,compiler with C++ ABI 1002,wx containers,compatible with 2.6).
• locally available win-only version is 3.0.124 => vendor & provider are grade A holes
• seems to work kinda...
• firefox picks it up but I am getting SSL_ERROR_UNKNOWN_CA_ALERT on a site that should recognize it
• too bad nothing free handles pdf signing