Enrico Zini: CAdES signatures on Debian
CAdES is a digital signature
standard that is used and sometimes mandated, by the Italian Public
Administration.
To be able to do my job, I own a Carta Nazionale dei Servizi
(CNS) with which I
can generate legally binding signatures. Now comes the problem of finding a
software to do it.
Infocamere Firma4NG
InfoCamere are distributing a
software called Firma4NG,
with a Linux option, which, I'm pleased to say, seems to work just fine.
Autofirma
AutoFirma is a Java
software for digital signatures distributed by the Spanish government, which
has a Linux version.
It is licensed as
Test if you can access the smart card with:
You can find other
Edit
Test with
See PKCS11 URI documentation here.
Install the PKCS11 engine for openssl
It looks like providers replaced
engines, and
this would not be needed, but I couldn't find a way to convince openssl to work
without this.
Sign a document
It verifies correctly using the Austrian verification system.
All the Italian verification
systems
I tried, however, complain that, although the signature is valid, the
certificate is emitted by an unqualified CA and the certificate revocation
information cannot be found.
PAdES
When signing PDF files, the PAdES
standard is sometimes accepted.
LibreOffice is able to generate PAdES signatures using the "File / Digital
signatures " menu, and provided the smart card is in the reader it is able to
use it. Both LibreOffice and Okular can verify that the signature is indeed
there.
However, when trying to validate the signature using Italian validators, I get
the same complaints about unqualified CAs and missing revocation information.
Wall of shame
Dike GoSign
Infocert (now Tinexta) used to
distribute a software called "Dike GoSign" that worked on Ubuntu, which I used
on a completely isolated VM, and it was awful but it worked.
I had to regenerate the VM for it, and discovered that the version they
distribute now will refuse to work unless one signs in online with a Tinexta
account. From the same company that asks you to install their own root
certifiactes
to use their digital signature system.
Gross.
Dropped.
Aruba Sign
Aruba used to distribute a
software called Aruba Sign, which also worked on Ubuntu.
Ubuntu support has been discontinued, and they now only offer support for
Windows or Mac.
Yuck. Dropped.
GPL-2+ EUPL-1.1, and the source seems to be
here.
While my Spanish is decent I lack jargon for this specific field, and I didn't
manage to make it work with my CNS.
Autogram
Andrej Shadura pointed me to Autogram,
a Slovakian software for digital signatures, licensed under the EUPL-1.2.
The interface is still only in Slovakian, so tried it but I didn't go very far
in trying to make it work.
OpenSSL
In trixie, openssl is almost, but not quite, able to do it. Here's as far as I've got.
Install opensc
apt install opensc
pkcs11-tool --list-objects [-l]
pkcs11-tool examples here
Set up a pkcs11 provider for openssl
apt install pkcs11-provider
/etc/ssl/openssl.cnf:
- In
[provider_sect]addpkcs11 = pkcs11_sect - In
[default_sect], uncommentactivate = 1 - Add this new section:
[pkcs11_sect]
module = /usr/lib/x86_64-linux-gnu/ossl-modules/pkcs11.so
pkcs11-module-path = /usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so
default_algorithms = ALL
activate = 1
openssl list -providers
You can check if openssl can see keys on the card:
openssl pkey -in 'pkcs11:id=%01' -pubin -pubout -text
apt install libengine-pkcs11-openssl
openssl cms -nodetach -binary -cades -outform DER -in filename -out filename.p7m -sign -signer 'pkcs11:id=%01' -keyform engine -engine pkcs11
I ve noticed that procrastination and inability to be consistently productive at work has become quite common in recent years. This is clearly visible in younger people who have grown up with an endless stream of entertainment literally at their fingertips, on their mobile phone. It is however a trap one can escape from with a little bit of help.
Screenshot of Debian installer installing the base system.
Have you ever had to download a file from your terminal using curl and didn't
remember the parameters needed? I did.
Nowadays you can use 
Try it out:
I've found this quite useful for machines where I'm required to install
third-party monitoring software that tends to randomly consume more resources
than it should. If I feel like my machine is struggling, I can quickly glance
at its load to verify if it's getting overloaded by some process.
The extension is not as complete as
On supported laptops, this setting is an easy way to set thresholds for when
charging should start and stop, just like you could do it with the 
You should check out the demos from the 
Have you ever had to download a file from your terminal using curl and didn't
remember the parameters needed? I did.
Nowadays you can use 
Try it out:
I've found this quite useful for machines where I'm required to install
third-party monitoring software that tends to randomly consume more resources
than it should. If I feel like my machine is struggling, I can quickly glance
at its load to verify if it's getting overloaded by some process.
The extension is not as complete as
On supported laptops, this setting is an easy way to set thresholds for when
charging should start and stop, just like you could do it with the 
You should check out the demos from the 
A bit more than a year ago, I had been thinking about making myself a
cartridge pleated skirt. For a number of reasons, one of which is the
historybounding potential, I ve been thinking pre-crinoline, so
somewhere around the 1840s, and that s a completely new era for me,
which means: new underwear.
Also, the 1840s are pre-sewing machine, and I was already in a position
where I had more chances to handsew than to machine sew, so I decided to
embrace the slowness and sew 100% by hand, not even using the machine
for straight seams.
If I remember correctly, I started with the corded petticoat, looking
around the internet for instructions, and then designing my own based on
the practicality of using modern wide fabric from my stash (and
specifically some DITTE from costumers favourite source of dirty cheap
cotton IKEA).
Around the same time I had also acquired a sashiko kit, and I used the
Japanese technique for sewing running stitches pushing the needle with a
thimble that covers the base of the middle finger, and I can confirm
that for this kind of things it s great!
I ve since worn the petticoat a few times for casual / historyBounding /
folkwearBounding reasons, during the summer, and I can confirm it s
comfortable to use; I guess that during the winter it could be nice to
add a flannel layer below it.
Then I proceeded with the base layers: I had been browsing through
The book only provided measurements for one size (moderate), and my
fabric was a bit too narrow to make them that size (not that I have any
idea what hip circumference a person of moderate size was supposed to
have), so the result is just wide enough to be comfortably worn, but I
think that when I ll make another pair I ll try to make them a bit
wider. On the other hand they are a bit too long, but I think that I ll
fix it by adding a tuck or two. Not a big deal, anyway.
The shift gave me a bit more issues: I used the recommended gusset size,
and ended up with a shift that was way too wide at the top, so I had to
take a box pleat in the center front and back, which changed the look
and wear of the garment. I have adjusted the instructions to make
gussets wider, and in the future I ll make another shift following
those.
Even with the pleat, the narrow shoulder straps are set quite far to the
sides, and they tend to droop, and I suspect that this is to be expected
from the way this garment is made. The fact that there are buttonholes
on the shoulder straps to attach to the corset straps and prevent the
issue is probably a hint that this behaviour was to be expected.
I ve also updated the instructions so that they shoulder straps are a
bit wider, to look more like the ones in the drawing from the book.
Making a corset suitable for the time period is something that I will
probably do, but not in the immediate future, but even just wearing the
shift under a later midbust corset with no shoulder strap helps.
I m also not sure what the point of the bosom gores is, as they don t
really give more room to the bust where it s needed, but to the high
bust where it s counterproductive. I also couldn t find images of
original examples made from this pattern to see if they were actually
used, so in my next make I may just skip them.
On the other hand, I m really happy with how cute the short sleeves
look, and if
Historically the primary way to contribute to Debian has been to email the Debian bug tracker with a code patch. Now that 
Following the Browse link opens the Debian package source repository, which is usually a project page on Salsa. To contribute, start by clicking the Fork button, select your own personal namespace and, under Branches to include, pick Only the default branch to avoid including unnecessary temporary development branches.
Once forking is complete, 
It may also be good to build the source package to establish a baseline of the current state and what kind of binaries and 
When you see a new Merge Request, try to review it within a couple of days. If you cannot review in a reasonable time, posting a small note that you intend to review it later will feel better to the submitter compared to not getting any response.
Personally, I have a habit of assigning myself as a reviewer so that I can keep track of my whole review queue at 
When adding the first comment, I choose Start review and for the following remarks Add to review. Finally, I click Finish review and Submit review, which will trigger one single email to the submitter with all my feedback. I try to avoid using the Add comment now option, as each such comment triggers a separate notification email to the submitter.
Snapshot mirroring in Debian (and Ubuntu)
The use of snapshots has been routine in both 
