At work, I help maintain a smartcard middleware that is provided to Belgian citizens who want to use their electronic ID card to, e.g., log on to government websites. This middleware is a piece of software that hooks into various browsers and adds a way to access the smartcard in question, through whatever APIs the operating system and the browser in question provide for that purpose. The details of how that is done differ between each browser (and in the case of Google Chrome, for the same browser between different operating systems); but for Firefox (and Google Chrome on free operating systems), this is done by way of a PKCS#11 module.
For Firefox 57, mozilla decided to overhaul much of their browser. The changes are large and massive, and in some ways revolutionary. It's no surprise, therefore, that some of the changes break compatibility with older things.
One of the areas in which breaking changes were made is in the area of extensions to the browser. Previously, Firefox had various APIs available for extensions; right now, all APIs apart from the WebExtensions API are considered "legacy" and support for them will be removed from Firefox 57 going forward.
Since installing a PKCS#11 module manually is a bit complicated, and since the legacy APIs provided a way to do so automatically provided the user would first install an add-on (or provided the installer of the PKCS#11 module sideloads it), most parties who provide a PKCS#11 module for use with Firefox will provide an add-on to automatically install it. Since the alternative involves entering the right values in a dialog box that's hidden away somewhere deep in the preferences screen, the add-on option is much more user friendly.
I'm sure you can imagine my dismay when I found out that there was no WebExtensions API to provide the same functionality. So, after asking around a bit, I filed bug 1357391 to get a discussion started. While it took some convincing initially to get people to understand the reasons for wanting such an API, eventually the bug was assigned the "P5" priority -- essentially, a "we understand the need and won't block it, but we don't have the time to implement it. Patches welcome, though" statement.
Since having an add-on was something that work really wanted, and since I had the time, I got the go-ahead from management to look into implementing the required code myself. I made it obvious rather quickly that my background in Firefox was fairly limited, though, and so was assigned a mentor to help me through the process.
Having been a Debian Developer for the past fifteen years, I do understand how to develop free software. Yet, the experience was different enough that still learned some new things about free software development, which was somewhat unexpected.
Unfortunately, the process took much longer than I had hoped, which meant that the patch was not ready by the time Firefox 57 was branched off mozilla's "central" repository. The result of that is that while my patch has been merged into what will eventually become Firefox 58, it looks strongly as though it won't make it into Firefox 57. That's going to cause some severe headaches, which I'm not looking forward to; and while I can certainly understand the reasons for not wanting to grant the exception for the merge into 57, I can't help but feeling like this is a missed opportunity.
Anyway, writing code for the massive Open Source project that mozilla is has been a load of fun, and in the process I've learned a lot -- not only about Open Source development in general, but also about this weird little thing that Javascript is. That might actually be useful for this other project that I've got running here.
In closing, I'd like to thank Tomislav 'zombie' Jovanovic for mentoring me during the whole process, without whom it would have been doubtful if I would even have been ready by now. Apologies for any procedural mistakes I've made, and good luck in your future endeavours!
If you are looking for Belgian eID on Linux/Firefox adventure, you can check this (also available in French):
https://financienpr.belgium.be/nl/douane_accijnzen/ondernemingen/applicaties-da/registratie-en-configuratie/pc-configuratie
At this moment it is possible to login on Firefox/Linux to PLDA (the system of government for doing customs and duties administration). However, signing and submitting a document is not possible.
My company is Authorized Warehousekeeper and I am doing the administration for that. Weekly a signed document needs to be submitted in PLDA for all goods put on the market in the week before on which duties have been paid. I can prepare this documentation on my main desktop (Linux), but to submit the document I have to reboot my computer into Windows in order to online sign and submit the document. Obviously this is a cumbersome process involving running running Windows Update and application specific update tools on Windows as I want to do this safely.
@Sander,
I help maintain the eID middleware and I have direct contact with the people who maintain the Federal Authentication Service, also known as CSAM these days; but I'm not responsible for what each of the various government bodies choose to do when they implement eID support.
I agree that it sucks if there's no Linux support for something you need to do, but the best advice I can give you on that subject is to contact the politician (minister, major, etc) in charge of the administration in question, and ask him or her to fix things.
Hi Wouter,
Taking into account they preferred to write instructions to install the discontinued ActiveX control Capicom on Windows 7 and higher, over switching to a supported and more standard solution, I'm afraid there will be no interest from politicians. But I can always try...