Code change:
Hello, please find below a bug report about the Nix package qdidgidoc: I can not sign any more since the 24.5 update. Failed to sign container. Please check the access to signing services and network settings. Failed to sign container. Failed to connect to host: 'dd-' DECODER routines:0 error:1E08010C:DECODER routines::unsupported BIO routines:0 error::BIO routines::system lib I also checked if I am able to authenticate with https://web- . Both, authentication and singing works. For completeness, here my diagnostics output: Locale: English / enUS.UTF-8 Application version: 4.5.1.0 (64 bit) OS: NixOS 24.05 (Uakari) (x8664/x8664) CPU: AMD Ryzen 5 PRO 4650U with Radeon Graphics Kernel: Linux 6.6.44 -NixOS SMP PREEMPTDYNAMIC Sat Aug 3 06:54:42 UTC 2024 x8664 Libraries: QT (5.15.14) OpenSSL build (OpenSSL 3.0.14 4 Jun 2024) OpenSSL current (OpenSSL 3.0.14 4 Jun 2024) Arguments: qdigidoc4 Library paths: /run/wrappers/lib/qt- 15.14/plugins; 15.14/plugins;/var/lib/flatpak/exports/lib/qt- 15.14/plugins; 15.14/plugins;/nix/profile/lib/qt- 15.14/plugins; 15.14/plugins;/etc/profiles/per-user/getreu/lib/qt- 15.14/plugins;/nix/var/nix/profiles/default/lib/qt- 15.14/plugins;/run/current-system/sw/lib/qt- 15.14/plugins;/nix/store/h8m7pcd6d20jsx7hn81rsgkq0h884893-qtwayland- 15.14-bin/lib/qt- 15.14/plugins;/nix/store/vc9wklk5w3cskkymp52g7js83my4d9ch-qttools- 15.14-bin/lib/qt- 15.14/plugins;/nix/store/plix80gx31963j2qpsws7rid1gfr6cyn- qtdeclarative-5.15.14-bin/lib/qt- 15.14/plugins;/nix/store/h32d5q8ngcy68nddbw5vja3r316s20p3-qtsvg- 15.14-bin/lib/qt- 15.14/plugins;/nix/store/fbddznz5ln765jbl2i2mfnf8h7rkkmd9-qtbase- 15.14-bin/lib/qt- 15.14/plugins;/nix/store/h4li58h9pni11wigz8xldad9kgzc0q3c-qdigidoc- 1/bin URLs: CONFIGURL: SID-PROXY-URL: https://dd- SIDV2-PROXY-URL: https://dd- SID-SK-URL: https://dd- SIDV2-SK-URL: https://dd- MID-PROXY-URL: https://dd- MID-SK-URL: https://dd- RPUUID: is set by default TSLURL: TSAURL: http://dd- SIVAURL: CDOC2: CDOC2-DEFAULT: false CDOC2-USE-KEYSERVER: true CDOC2-DEFAULT-KEYSERVER: ria-test TSL signing certs: Patrick Kremer (Signature) European Commission European Commission JEROEN ARNOLD L RATHE APOSTOLOS APLADAS CONSTANTIN-ADRIAN CROITORU TSL cache: (65) eu-lotl-pivot- (335) eu-lotl-pivot- (341) eu- (343) g0xdp6w34ric1mdh8g7r0v8h85idkcg1-eu-lotl-pivot- (300) Central Configuration: Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
I can reproduce. The "Signing" animation is shown for a while, and then an error too: The error message mentions not being reachable: ! This hostname does not even have a DNS record. I spotted changing the "Default TSA URL". Maybe they updated the URL in some places, but forgot updating elsewhere? I found this URL in my qdigidoc settings too: ! Changing it to the new URL unfortunately also didn't help, as it doesn't like the Digicert certificate. Maybe unrelated, maybe not - I also see a in my logs. This looks like an issue in the application itself / some config shipped somewhere, but nothing NixOS-specific. I propose opening an issue upstream in qdigidoc, maybe linking to here for context.
I tried manually bumping , and I tried using from . It mentions a signature to be invalid: Opened an issue upstream:
I got a link to , mentioning a workaround. However it looks like the libdigidocpp changes linked there are not a sufficient fix, so I cannot patch this in nixpkgs, and it for now requires each user to manually set that address and import certificates.
As I understand now fixes this issue with the related commit: . Do you consider a patch release?
Unless I'm missing something, is the only relevant change for us from this commit (which sets the flag). The patch doesn't apply, but IIRC I tried setting this manually via and it didn't fix things for me back then. I can try again tomorrow or so, re-rolling that patch and trying to sign again with a fresh profile. Yes, absolutely, if there's a patch we can apply to fix this for nixpkgs users, at least when starting with empty state I'd like to do it.
I did apply the TSA_URL change in , and it seems this was enough to get signing to work. PR is up at , please test and report back there.

Related discussion:
text: outputs = [ "out" "lib" "dev" "bin" ]; <ins> # Cherry-pick of # https://github.com/open-eid/libdigidocpp/commit/2b5db855ba3ceb9bae1f11589ea1aea22bb7595a # Fixes https://github.com/NixOS/nixpkgs/issues/334397 postPatch = '' substituteInPlace CMakeLists.txt  --replace-fail 'TSA_URL "http://dd-at.ria.ee/tsa"' 'TSA_URL "https://eid-dd.ria.ee/ts"' ''; </ins> # libdigidocpp.so's `PKCS11Signer::PKCS11Signer()` dlopen()s "opensc-pkcs11.so" # itself, so add OpenSC to its DT_RUNPATH after the fixupPhase shrinked it. # https://github.com/open-eid/cmake/pull/35 might be an alternative.