Assinador Serpro

This is a community package of Assinador Serpro, maintained independently and unaffiliated with Serpro. It downloads the official Linux installer from Serpro at install time and takes the program out of it without running the installer. Using the program means accepting Serpro's terms of use. A new version reaches this package after it has been tested with a physical token.

Two small pieces of code are added inside the app. A PKCS#11 module, which Assinador Serpro loads for A3 tokens through its own PKCS11_DRIVER setting, passes the calls to the host's p11-kit, so the token's driver runs on the host; it hides p11-kit's trust slots and adjusts two calls to what p11-kit's RPC accepts. A library preloaded with LD_PRELOAD resolves assinador-desktop.serpro.gov.br to 127.0.0.1 inside the sandbox, because the native installer adds that name to /etc/hosts, which a sandboxed app cannot do. Nothing else is changed. Serpro's launcher is not used: this package starts the same Java command directly, and Flatpak does the updating.

Assinador Serpro is Serpro's desktop signer, for the Brazilian ICP-Brasil certificates. It signs documents with an A1 certificate file or an A3 token or smart card, and lets web pages in your browser request signatures through a local server.

Permissions: this package grants network access (web pages reach the signer through a local server, and it fetches revocation lists and timestamps), your Documents and Downloads folders, where A1 certificate files and documents to sign usually are, and the host's p11-kit socket for A3 tokens (below). Settings and logs stay inside the sandbox. To open certificates or documents from anywhere in your home folder: flatpak override --user --filesystem=home br.gov.serpro.desktop.assinador.

Signing from web pages needs one line on the host, because your browser runs outside the sandbox and the name is not in public DNS: echo '127.0.0.1 assinador-desktop.serpro.gov.br' | sudo tee -a /etc/hosts. The native installer adds the same line.

A3 tokens and smart cards need a one-time setup on the host, because the token's driver cannot run inside the sandbox. Install the driver from your certificate vendor and make sure pcscd is running, as for any Linux installation, and register the driver with p11-kit if the vendor does not (a file in ~/.config/pkcs11/modules/ with the line module: /path/to/the/driver.so). Then run a p11-kit server that listens on $XDG_RUNTIME_DIR/p11-kit/pkcs11: where your distribution ships the systemd user socket, that is systemctl --user enable --now p11-kit-server.socket. On an immutable system, Tessera from FlatPark can serve the driver instead of a package on the host. A1 certificate files need none of this.