Tessera

This package is maintained by Tessera's developer. It installs Tessera's official release build from its GitHub releases, unmodified, and downloads each token driver from its vendor at install time, checked against a pinned checksum. One driver file is adapted: SerproID's launcher and configuration name its install folder, /usr/share/serproid-desktop, and are pointed at its copy inside the app. The drivers' install scripts never run.

Tessera lets sandboxed apps use hardware tokens, smart cards and cloud certificates without installing any driver on the system. It runs the token drivers inside its own sandbox and shares every token with other apps through p11-kit, the standard way for Linux apps to reach PKCS#11 devices.

This is meant for immutable systems such as Fedora Silverblue, Kinoite, Bluefin, Aurora and Bazzite, where installing a vendor's driver package on the host is hard or impossible.

• Shows the card readers, the inserted tokens and their certificates
• Drivers included: SafeSign IC, SafeNet Authentication Client and SerproID; more can be added as extensions
• Vendor drivers are downloaded from the vendors at install time and checked against pinned checksums
• Opens the vendors' tools, such as SafeSign's Token Administration and the SerproID app
• Sets up Firefox, Chromium, Google Chrome, Microsoft Edge, Brave, Papers and Okular to use the tokens, and shows the command that lets them reach Tessera
• Publishes a driver only while it answers, so a driver that hangs cannot hang the apps
• Keeps running in the background with an icon in the tray, and can start at login

Each driver runs in its own p11-kit server inside Tessera. Tessera adds them to the host's p11-kit configuration, and the host's p11-kit server (p11-kit-server.socket, enabled once) serves them to other apps. Sandboxed apps need --filesystem=xdg-run/p11-kit/pkcs11; PJeOffice Pro from FlatPark has it already.

The host needs pcscd with the CCID driver and the user's p11-kit server, which most distributions ship. Turn the server on once with systemctl --user enable --now p11-kit-server.socket; Tessera's window shows the command too.

Each sandboxed app that should use the tokens needs access to that server, given once per app; Tessera's window shows the command for each, for example flatpak override --user --filesystem=xdg-run/p11-kit/pkcs11 org.mozilla.firefox. Firefox, Papers and Okular also need the "Set up" button in Tessera. Apps installed from the distribution are on the Native tab, each with its own Set up. To undo it for an app: flatpak override --user --reset org.mozilla.firefox.