Arch Linux User Repository

to enable legacy TLS CCA auth use opensc pkcs11-register (firefox, firefox-esr, thunderbird, chromium)

or add opensc pkcs11 module manually to Security Devices.

while trying to install web-eid-firefox got:

:: (1/1) Parsing SRCINFO: web-eid
gpg: error reading key: No public key
pub   rsa2048 2013-11-18 [SC]
      D1EBC666EFCBFBD3CFC2EBAA90C0B5E75C3B195D
uid           [ unknown] Raul Metsma <raul@metsma.ee>
uid           [ unknown] Raul Metsma <raul.metsma@eesti.ee>
uid           [ unknown] Raul Metsma <raul.metsma@maddog.ee>
uid           [ unknown] Raul Metsma <raul.metsma@raulwalter.com>
sub   rsa2048 2013-11-18 [E]


:: PGP keys need importing:
 -> 1282B0F8809D0DC632C85A3F86B611CE24492160, required by: web-eid
:: Import? [Y/n] 
:: Importing keys with gpg...
gpg: keyserver receive failed: No data
 -> problem importing keys

yay -Sa web-eid-chrome produces error complaining about line 58 in PKGBUILD:

...
==> Entering fakeroot environment...
==> Starting package_web-eid-native()...
/home/user/.cache/yay/web-eid/PKGBUILD: line 58: cd: /home/user/.cache/yay/web-eid/src/web-eid/web-eid-build: No such file or directory
==> ERROR: A failure occurred in package_web-eid-native().
    Aborting...
 -> error making: web-eid (web-eid-chrome)

I managed to fix the build by modifying PKGBUILD as follows:

diff --git a/PKGBUILD b/PKGBUILD
index 50604dd..ccc48cf 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -10,7 +10,7 @@ license=('MIT')
 conflicts=(chrome-token-signing)
 depends=('openssl' 'qt6-base' 'qt6-svg' 'pcsclite' 'hicolor-icon-theme')
 makedepends=('git' 'qt6-tools' 'gtest' 'gmock' 'cmake')
-source=("$pkgname::git+https://github.com/web-eid/web-eid-app.git?signed#tag=$_rls_tag"
+source=("$pkgbase::git+https://github.com/web-eid/web-eid-app.git?signed#tag=$_rls_tag"
         "web-eid-libelectronic-id::git+https://github.com/web-eid/libelectronic-id.git"
         "web-eid-libpcsc-cpp::git+https://github.com/web-eid/libpcsc-cpp.git"
         "web-eid-libpcsc-mock::git+https://github.com/web-eid/libpcsc-mock.git")
@@ -20,27 +20,27 @@ validpgpkeys=(
 )

 prepare() {
-    cd "$srcdir/$pkgname"
-    [[ -d "$pkgname-build" ]] && rm -r "$pkgname-build"
-    mkdir "$pkgname-build"
+    cd "$srcdir/$pkgbase"
+    [[ -d "$pkgbase-build" ]] && rm -r "$pkgbase-build"
+    mkdir "$pkgbase-build"

     git submodule init
     git config submodule.lib/libelectronic-id.url $srcdir/web-eid-libelectronic-id
     git -c protocol.file.allow=always submodule update lib/libelectronic-id

-    cd "$srcdir/$pkgname/lib/libelectronic-id"
+    cd "$srcdir/$pkgbase/lib/libelectronic-id"
     git submodule init
     git config submodule.lib/libpcsc-cpp.url $srcdir/web-eid-libpcsc-cpp
     git -c protocol.file.allow=always submodule update

-    cd "$srcdir/$pkgname/lib/libelectronic-id/lib/libpcsc-cpp"
+    cd "$srcdir/$pkgbase/lib/libelectronic-id/lib/libpcsc-cpp"
     git submodule init
     git config submodule.tests/lib/libpcsc-mock.url $srcdir/web-eid-libpcsc-mock
     git -c protocol.file.allow=always submodule update
 }

 build() {
-    cd "$srcdir/$pkgname/$pkgname-build"
+    cd "$srcdir/$pkgbase/$pkgbase-build"
     export BUILD_NUMBER=${pkgver##*.}
     cmake .. -DCMAKE_BUILD_TYPE=Release \
              -DCMAKE_C_FLAGS:STRING="${CFLAGS} -ffile-prefix-map=$srcdir=." \

There will be error during update:

==> Sources are ready.
==> Making package: web-eid 2.1.0.565-1
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> WARNING: Using existing $srcdir/ tree
==> Starting build()...
~/.cache/yay/web-eid/PKGBUILD: line 44: cmake: command not exist
==> ERROR: A failure occurred in build().
    Aborting...

Perhaps is a good idea to put cmake as dependency with parameter --needed - if not installed, then it will be; otherwise untouched. After manually installed cmake, also update went flawlessly.

Anyway, if there could be the key imported automatically, then we would not need to do it manually. Seems like other ID-card software components already can import keys.

you don't need to trust the keys for makepkg gpg verification.

:: PGP keys need importing:
 -> 1282B0F8809D0DC632C85A3F86B611CE24492160, required by: web-eid  web-eid-webextension (firefox-extension-web-eid chromium-extension-web-eid)
==> Import? [Y/n] y
:: Importing keys with gpg...
gpg: võtmeserverilt lugemine ebaõnnestus: No data
error: target not found: gtest
error: target not found: nodejs-lts-fermium
error: target not found: nodejs-nopt
error: target not found: semver
error: target not found: node-gyp
error: target not found: npm
 -> problem importing keys

when to look https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=web-eid then there is a link as a comment to proper GPG-key

# Mart Somermaa https://github.com/mrts.gpg

Then:

# download to standard output and then import the key from there
wget -q -O- https://github.com/mrts.gpg | gpg --import -

# trust imported keys
for i in $(gpg --list-keys --with-colons --fingerprint | sed -n 's/^fpr:::::::::\([[:alnum:]]\+\):/\1/p') ; do printf "trust\n5\ny\nquit" | gpg -q --no-tty --command-fd 0 --status-fd 2 --expert --edit-key $i 2>/dev/null 1>/dev/null ; done

Then there is possible to install web-eid, also browser extensions firefox-extension-web-eid, chromium-extension-web-eid.

The pgp key import fails:

:: PGP keys need importing:
 -> 1282B0F8809D0DC632C85A3F86B611CE24492160, required by: web-eid
==> Import? [Y/n] 
:: Importing keys with gpg...
gpg: keyserver receive failed: No data
 -> problem importing keys

the log shows:

'https://162.213.33.9:443/pks/lookup?op=get&options=mr&search=0x1282B0F8809D0DC632C85A3F86B611CE24492160': http status 404

qt5-svg is missing from makedepends.

You can get the pubkey at https://github.com/mrts.gpg - could we ask Mart to upload it to a keyserver like pgp.mit.edu?

==> Verifying source file signatures with gpg...
    web-eid git repo ... FAILED (unknown public key 86B611CE24492160)
==> ERROR: One or more PGP signatures could not be verified!

:(