diff --git a/CHANGELOG.md b/CHANGELOG.md
index dcdffc7..99cf19e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 * acme.sh packages for RHEL 8 to 10, Fedora, SLES and openSUSE Leap 15 and 16, Debian 12 and 13 and Ubuntu 22.04 to 26.04, with all DNS API, deploy and notify hooks; acme.sh no longer upgrades itself, updates come through the package manager.
+* curaLINE Client packages (`swisscom-schweiz-ag-cdr-client`) for RHEL 8 to 10, Fedora, SLES and openSUSE Leap 15 and 16, Debian 12 and 13 and Ubuntu 22.04 to 26.04 (x86_64), repacked from Swisscom's release, with a static service account and the UI split off into `swisscom-schweiz-ag-cdr-client-gui` (not on RHEL 8 and SLES 15); they update hosts that installed Swisscom's .deb and keep its configuration.
 * Build pipeline that turns Linuxfabrik's own and third-party software into RPM and DEB packages for EL, Fedora, SLES, Debian and Ubuntu.
 * DEB packages carry the target distro in their version (e.g. `4.5.8-1+debian13`), so each suite gets its own build.
 * exoscale-cli (`exo`) packages for RHEL 8 to 10, Fedora, SLES and openSUSE Leap 15 and 16, Debian 12 and 13 and Ubuntu 22.04 to 26.04, built from source; they replace the upstream RPM mirrored under repo.linuxfabrik.ch/exoscale/cli and update hosts that installed it.
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/control b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/control
new file mode 100644
index 0000000..6da4416
--- /dev/null
+++ b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/control
@@ -0,0 +1,52 @@
+Source: swisscom-schweiz-ag-cdr-client
+Maintainer: Linuxfabrik GmbH <info@linuxfabrik.ch>
+Section: misc
+Priority: optional
+Standards-Version: 4.6.2
+Homepage: https://github.com/swisscom/cdr-client
+Rules-Requires-Root: no
+Build-Depends: debhelper-compat (= 13)
+
+# The dependencies are listed by hand, as in Swisscom's .deb: dpkg-shlibdeps
+# knows nothing about the libraries of the bundled Java runtime, and the
+# libraries only the UI loads belong to the -gui package.
+Package: swisscom-schweiz-ag-cdr-client
+Architecture: amd64
+Depends: ${misc:Depends},
+         libc6,
+         systemd | systemd-standalone-sysusers | systemd-sysusers
+Description: client for the curaLINE Document Routing (CDR) service
+ The curaLINE Client exchanges documents with the curaLINE Document Routing
+ (CDR) service of Swisscom for participants in the Swiss healthcare system. It
+ uploads the files of a source folder and puts the documents it downloads into
+ a target folder.
+ .
+ This package contains the service. The UI is in
+ swisscom-schweiz-ag-cdr-client-gui.
+
+Package: swisscom-schweiz-ag-cdr-client-gui
+Architecture: amd64
+Depends: ${misc:Depends},
+         hicolor-icon-theme,
+         libasound2t64 | libasound2,
+         libdbus-1-3,
+         libfontconfig1,
+         libgl1,
+         libstdc++6,
+         libsystemd0,
+         libx11-6,
+         libxext6,
+         libxi6,
+         libxrender1,
+         libxtst6,
+         swisscom-schweiz-ag-cdr-client (= ${binary:Version})
+# Swisscom's .deb ships the UI in the base package. Unversioned, since its
+# versions carry no Debian revision to compare against; the base package of
+# this source ships none of the UI files.
+Replaces: swisscom-schweiz-ag-cdr-client
+Description: UI of the curaLINE Client
+ The curaLINE Client exchanges documents with the curaLINE Document Routing
+ (CDR) service of Swisscom for participants in the Swiss healthcare system.
+ .
+ This package contains the desktop UI, cdr-client-ui, to configure and watch
+ the client.
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/copyright b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/copyright
new file mode 100644
index 0000000..10bc0e7
--- /dev/null
+++ b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/copyright
@@ -0,0 +1,31 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: cdr-client
+Upstream-Contact: Swisscom (Schweiz) AG
+Source: https://cdr.health.swisscom.ch/share/downloads/download.html
+
+Files: *
+Copyright: Swisscom (Schweiz) AG
+License: Apache-2.0
+ On Debian systems, the complete text of the Apache License version 2.0 can be
+ found in "/usr/share/common-licenses/Apache-2.0".
+
+Files: lib/runtime/*
+Copyright: Oracle and/or its affiliates, and the other authors of OpenJDK
+License: GPL-2.0 with Classpath exception
+ The bundled Java runtime is built from OpenJDK. The license texts of the
+ runtime and of the libraries it contains are in lib/runtime/legal/ below
+ /usr/lib/swisscom-schweiz-ag/cdr-client.
+ .
+ On Debian systems, the complete text of the GNU General Public License
+ version 2 can be found in "/usr/share/common-licenses/GPL-2".
+
+Files: debian/*
+Copyright: 2026 Linuxfabrik GmbH <info@linuxfabrik.ch>
+License: Unlicense
+ This is free and unencumbered software released into the public domain.
+ .
+ Anyone is free to copy, modify, publish, use, compile, sell, or distribute
+ this software, either in source code form or as a compiled binary, for any
+ purpose, commercial or non-commercial, and by any means.
+ .
+ For more information, please refer to <https://unlicense.org/>.
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/rules b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/rules
new file mode 100755
index 0000000..beddc45
--- /dev/null
+++ b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/rules
@@ -0,0 +1,47 @@
+#!/usr/bin/make -f
+
+APPDIR = /usr/lib/swisscom-schweiz-ag/cdr-client
+BASE = debian/swisscom-schweiz-ag-cdr-client
+GUI = debian/swisscom-schweiz-ag-cdr-client-gui
+
+%:
+	dh $@
+
+override_dh_auto_configure:
+	# The default configuration downloads into java.io.tmpdir, which is
+	# private to the service (PrivateTmp=yes) and emptied on every restart,
+	# so the documents being downloaded would be lost. Use the state
+	# directory instead.
+	sed --in-place 's|^\(  local-folder:\).*|\1 /var/lib/swisscom-schweiz-ag/cdr-client|' lib/app/conf/application-customer.yaml
+
+override_dh_auto_build:
+	# prebuilt
+
+override_dh_auto_install:
+	install -d $(BASE)$(APPDIR) $(BASE)/etc/swisscom-schweiz-ag/cdr-client $(BASE)/usr/bin
+	cp --archive bin lib $(BASE)$(APPDIR)/
+	# Conveyor's own unit; ours replaces it
+	rm --recursive $(BASE)$(APPDIR)/lib/systemd
+	ln --symbolic $(APPDIR)/bin/cdr-client-service $(BASE)/usr/bin/cdr-client-service
+	# dh_installsysusers is not part of the debhelper 13 sequence; the
+	# postinst runs systemd-sysusers itself
+	install -D -m 0644 debian/swisscom-schweiz-ag-cdr-client.sysusers $(BASE)/usr/lib/sysusers.d/swisscom-schweiz-ag-cdr-client.conf
+	# the UI
+	install -d $(GUI)$(APPDIR)/bin $(GUI)$(APPDIR)/lib/app/conf $(GUI)/usr/bin $(GUI)/usr/share
+	mv $(BASE)$(APPDIR)/bin/cdr-client-ui $(GUI)$(APPDIR)/bin/
+	mv $(BASE)$(APPDIR)/lib/app/conf/logback-ui.xml $(GUI)$(APPDIR)/lib/app/conf/
+	# the native libraries of the UI toolkit (Compose, tray icon, desktop theme)
+	install -d $(GUI)$(APPDIR)/lib/runtime/lib
+	mv $(addprefix $(BASE)$(APPDIR)/lib/runtime/lib/,libLinuxTray.so libnucleus_linux_theme.so libskiko-linux-x64.so) $(GUI)$(APPDIR)/lib/runtime/lib/
+	ln --symbolic $(APPDIR)/bin/cdr-client-ui $(GUI)/usr/bin/cdr-client-ui
+	cp --archive share/applications share/icons share/metainfo $(GUI)/usr/share/
+
+# Leave the binaries of the bundled Java runtime as Swisscom built them, and
+# keep its private libraries out of the shlibs and ldconfig handling.
+override_dh_dwz:
+
+override_dh_makeshlibs:
+
+override_dh_shlibdeps:
+
+override_dh_strip:
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/source/format b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/source/format
new file mode 100644
index 0000000..163aaf8
--- /dev/null
+++ b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/source/format
@@ -0,0 +1 @@
+3.0 (quilt)
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.postinst b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.postinst
new file mode 100644
index 0000000..70aab31
--- /dev/null
+++ b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.postinst
@@ -0,0 +1,29 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = configure ]; then
+    # The account has to exist before the configuration is handed to it and
+    # before the service is started by the debhelper snippet below.
+    systemd-sysusers swisscom-schweiz-ag-cdr-client.conf
+
+    # The configuration is not part of the package. It holds the client
+    # secret, the client rewrites it when it renews its credential, and it may
+    # belong to another account such as `hnet` (see the unit). Create it from
+    # the defaults if it is missing, and hand it to the service account if it
+    # belongs to root, since the client refuses to start with a file it does
+    # not own.
+    confdir=/etc/swisscom-schweiz-ag/cdr-client
+    for file in application-customer.yaml logback-service.xml; do
+        if [ ! -e "$confdir/$file" ]; then
+            install -m 0640 "/usr/lib/swisscom-schweiz-ag/cdr-client/lib/app/conf/$file" "$confdir/$file"
+        fi
+        if [ "$(stat --format='%u' "$confdir/$file")" = 0 ]; then
+            chown swisscom-schweiz-ag-cdr-client:swisscom-schweiz-ag-cdr-client "$confdir/$file"
+            chmod 0640 "$confdir/$file"
+        fi
+    done
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.postrm b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.postrm
new file mode 100644
index 0000000..85f2802
--- /dev/null
+++ b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.postrm
@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+# the configuration created by the postinst, with the client secret
+if [ "$1" = purge ]; then
+    rm --force /etc/swisscom-schweiz-ag/cdr-client/application-customer.yaml \
+        /etc/swisscom-schweiz-ag/cdr-client/logback-service.xml
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.preinst b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.preinst
new file mode 100644
index 0000000..f661af8
--- /dev/null
+++ b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.preinst
@@ -0,0 +1,23 @@
+#!/bin/sh
+set -e
+
+# Swisscom's .deb links /etc/swisscom-schweiz-ag/cdr-client to the
+# configuration below /usr/lib, which this package replaces with a directory.
+# Keep the configuration: copy it into a real directory before dpkg unpacks
+# this package over it. The postinst hands it to the service account.
+confdir=/etc/swisscom-schweiz-ag/cdr-client
+if [ "$1" = upgrade ] && [ -L "$confdir" ]; then
+    olddir="$(readlink --canonicalize "$confdir")"
+    rm "$confdir"
+    mkdir "$confdir"
+    for file in application-customer.yaml logback-service.xml; do
+        if [ -f "$olddir/$file" ]; then
+            cp "$olddir/$file" "$confdir/$file"
+            chmod 0640 "$confdir/$file"
+        fi
+    done
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/packages/swisscom-schweiz-ag-cdr-client/files/swisscom-schweiz-ag-cdr-client.service b/packages/swisscom-schweiz-ag-cdr-client/files/swisscom-schweiz-ag-cdr-client.service
new file mode 100644
index 0000000..a523ace
--- /dev/null
+++ b/packages/swisscom-schweiz-ag-cdr-client/files/swisscom-schweiz-ag-cdr-client.service
@@ -0,0 +1,51 @@
+# Based on the unit of Swisscom's .deb, but with a static account instead of
+# `DynamicUser=yes`, so that the client can be run under an existing account
+# such as `hnet` by a drop-in. The sandboxing that `DynamicUser=yes` implies is
+# set explicitly. The client may only write to the directories below, so the
+# folders of the connectors have to be added by a drop-in as well:
+#
+#   [Service]
+#   ReadWritePaths=/data/xml
+#   # optional
+#   Group=hnet
+#   User=hnet
+
+[Unit]
+After=network-online.target
+Description=curaLINE Client
+Wants=network-online.target
+
+[Service]
+CacheDirectory=swisscom-schweiz-ag/cdr-client
+# writable for the client, which rewrites application-customer.yaml when it
+# renews its credential
+ConfigurationDirectory=swisscom-schweiz-ag/cdr-client
+# independent of the home of the account, so the client never writes into an
+# existing home such as /home/hnet
+Environment=HOME=/var/lib/swisscom-schweiz-ag/cdr-client
+# Started through /usr/bin/env because of SELinux on the Red Hat family: the
+# client below /usr/lib is lib_t, for which systemd has no domain transition,
+# while bin_t makes it transition to unconfined_service_t, which may execute
+# the client.
+ExecStart=/usr/bin/env /usr/lib/swisscom-schweiz-ag/cdr-client/bin/cdr-client-service
+Group=swisscom-schweiz-ag-cdr-client
+LogsDirectory=swisscom-schweiz-ag/cdr-client
+LogsDirectoryMode=0750
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectHome=read-only
+ProtectSystem=strict
+# the client exits with 29 after renewing its credential, to be restarted
+Restart=always
+RestartSec=10s
+RestrictSUIDSGID=yes
+StateDirectory=swisscom-schweiz-ag/cdr-client
+# the JVM exits with 143 on SIGTERM
+SuccessExitStatus=143
+SyslogIdentifier=cdr-client
+Type=exec
+User=swisscom-schweiz-ag-cdr-client
+WorkingDirectory=/usr/lib/swisscom-schweiz-ag/cdr-client
+
+[Install]
+WantedBy=multi-user.target
diff --git a/packages/swisscom-schweiz-ag-cdr-client/files/swisscom-schweiz-ag-cdr-client.sysusers b/packages/swisscom-schweiz-ag-cdr-client/files/swisscom-schweiz-ag-cdr-client.sysusers
new file mode 100644
index 0000000..09fc4d5
--- /dev/null
+++ b/packages/swisscom-schweiz-ag-cdr-client/files/swisscom-schweiz-ag-cdr-client.sysusers
@@ -0,0 +1,3 @@
+# the account of swisscom-schweiz-ag-cdr-client.service, with the group of the
+# same name
+u swisscom-schweiz-ag-cdr-client - "curaLINE Client" /var/lib/swisscom-schweiz-ag/cdr-client /usr/sbin/nologin
diff --git a/packages/swisscom-schweiz-ag-cdr-client/package.conf b/packages/swisscom-schweiz-ag-cdr-client/package.conf
new file mode 100644
index 0000000..f1d97ff
--- /dev/null
+++ b/packages/swisscom-schweiz-ag-cdr-client/package.conf
@@ -0,0 +1,47 @@
+# Build manifest for swisscom-schweiz-ag-cdr-client. Sourced by
+# build/create-package.sh.
+#
+# The curaLINE Client of Swisscom, which exchanges documents with the curaLINE
+# Document Routing (CDR) service of the Swiss healthcare system. It is built
+# with Hydraulic Conveyor, which needs a commercial license and bundles a Java
+# runtime, so the package repacks the linux-amd64 tarball from the Swisscom
+# download page instead of building from source. The tarball holds the same
+# files as Swisscom's own .deb (checked 2026-10-29). The package keeps the
+# name and the paths of that .deb, so it updates hosts that installed it. It
+# differs in a static service account instead of `DynamicUser=yes`, real
+# configuration files below /etc instead of a symlink into /usr/lib, a root
+# owned installation, and the UI split off into the -gui package.
+
+PKG_VERSION='6.2.1'
+
+# Swisscom's download page refuses GitHub's runners (HTTP 403, checked
+# 2026-10-29), and its GitHub tags run ahead of it, so nothing is watched here.
+# A new version is announced by newreleases.io (see the Wartungsarbeiten in the
+# wiki). To bump: download the tarball from
+# https://cdr.health.swisscom.ch/share/downloads/download.html, upload it with
+# `gh release upload sources-swisscom-schweiz-ag-cdr-client <tarball>` and set
+# PKG_VERSION.
+PKG_UPSTREAM_TYPE='none'
+
+# Swisscom's linux-amd64 tarball, mirrored as an asset of the release
+# sources-swisscom-schweiz-ag-cdr-client of this repository. It unpacks to
+# cdr-client-<version>/.
+PKG_SOURCE_TARBALL="cdr-client-${PKG_VERSION}-linux-amd64.tar.gz"
+PKG_SOURCE_URL="https://github.com/Linuxfabrik/packaging/releases/download/sources-swisscom-schweiz-ag-cdr-client/${PKG_SOURCE_TARBALL}"
+
+# RPM recipe and the EL/Fedora/SLES targets it is built for. The UI needs
+# glibc 2.34, so EL 8 and SLES 15 get the service only.
+PKG_RPM_SPEC='rpm/swisscom-schweiz-ag-cdr-client.spec'
+PKG_RPM_DISTROS='fedora-v44 rocky-v8 rocky-v9 rocky-v10 sles-v15 sles-v16'
+
+# DEB recipe and the Debian/Ubuntu targets it is built for.
+PKG_DEB_DEBIAN_DIR='deb/debian'
+PKG_DEB_DISTROS='debian-v12 debian-v13 ubuntu-v2204 ubuntu-v2404 ubuntu-v2604'
+
+# Swisscom only publishes the client for linux-amd64.
+PKG_ARCHES='x86_64'
+
+# Run after installing the package into a fresh container, as user nobody: the
+# packaged version is installed, and the client starts, finds its configuration
+# and stops because nobody may not read it.
+PKG_SMOKE_TEST="test -f /usr/lib/swisscom-schweiz-ag/cdr-client/lib/app/cdr-client-service-${PKG_VERSION}-plain.jar && timeout 120 cdr-client-service 2>&1 | grep --fixed-strings 'exists but does not point to a readable, regular file'"
diff --git a/packages/swisscom-schweiz-ag-cdr-client/rpm/swisscom-schweiz-ag-cdr-client.spec b/packages/swisscom-schweiz-ag-cdr-client/rpm/swisscom-schweiz-ag-cdr-client.spec
new file mode 100644
index 0000000..e2ce4dd
--- /dev/null
+++ b/packages/swisscom-schweiz-ag-cdr-client/rpm/swisscom-schweiz-ag-cdr-client.spec
@@ -0,0 +1,200 @@
+# Version and release are injected by build/create-rpm.sh via --define. Provide
+# defaults so the spec still parses (e.g. for `dnf builddep`) without them.
+%{!?pkg_version: %global pkg_version 0}
+%{!?pkg_release: %global pkg_release 0}
+
+%global appdir %{_prefix}/lib/swisscom-schweiz-ag/cdr-client
+%global confdir %{_sysconfdir}/swisscom-schweiz-ag/cdr-client
+%global statedir %{_sharedstatedir}/swisscom-schweiz-ag/cdr-client
+
+# The tarball is a prebuilt application with its own Java runtime. Leave the
+# binaries as Swisscom built them: no debug package, no stripping, and no
+# build-id links, which the identical launchers of both packages would clash on.
+%global debug_package %{nil}
+%global _build_id_links none
+%global __brp_strip %{nil}
+%global __brp_strip_comment_note %{nil}
+%global __brp_strip_static_archive %{nil}
+%global __strip /bin/true
+# The launchers find the bundled runtime through the runpath
+# ${ORIGIN}/../lib/runtime/lib, which check-rpaths rejects for the braces.
+%global __brp_check_rpaths %{nil}
+
+# The libraries of the bundled runtime are private: provide none of them, and
+# require none of them or the libraries only the UI loads. The -gui package
+# requires the latter explicitly.
+%global __provides_exclude_from ^%{appdir}/
+%global __requires_exclude ^lib(asound\\.so\\.2|awt|dbus-1\\.so\\.3|fontconfig\\.so\\.1|freetype|GL\\.so\\.1|java|jli|jvm|net|stdc\\+\\+\\.so\\.6|systemd\\.so\\.0|X11\\.so\\.6|Xext\\.so\\.6|Xi\\.so\\.6|Xrender\\.so\\.1|Xtst\\.so\\.6)
+
+# the native libraries of the UI toolkit (Compose, tray icon, desktop theme),
+# which go into the -gui package
+%global guilibs libLinuxTray.so libnucleus_linux_theme.so libskiko-linux-x64.so
+
+# The UI needs glibc 2.34, which EL 8 and SLES 15 do not have.
+%if 0%{?rhel} >= 9 || 0%{?fedora} || 0%{?suse_version} >= 1600
+%bcond_without gui
+%else
+%bcond_with gui
+%endif
+
+Name:           swisscom-schweiz-ag-cdr-client
+Version:        %{pkg_version}
+Release:        %{pkg_release}%{?dist}
+Summary:        Client for the curaLINE Document Routing (CDR) service
+
+# the client is Apache-2.0, the bundled Java runtime GPL-2.0 with the Classpath
+# exception, the bundled Java libraries come under their own licenses
+License:        Apache-2.0 AND GPL-2.0-only WITH Classpath-exception-2.0
+URL:            https://github.com/swisscom/cdr-client
+Source0:        https://cdr.health.swisscom.ch/share/downloads/cdr-client-%{version}-linux-amd64.tar.gz
+Source1:        %{name}.service
+Source2:        %{name}.sysusers
+
+ExclusiveArch:  x86_64
+
+BuildRequires:  systemd-rpm-macros
+%if 0%{?suse_version}
+Requires(pre):  shadow
+%else
+Requires(pre):  shadow-utils
+%endif
+# /usr/bin/env in the unit
+Requires:       coreutils
+
+%description
+The curaLINE Client exchanges documents with the curaLINE Document Routing
+(CDR) service of Swisscom for participants in the Swiss healthcare system. It
+uploads the files of a source folder and puts the documents it downloads into
+a target folder.
+
+This package contains the service. The UI is in %{name}-gui.
+
+%if %{with gui}
+%package gui
+Summary:        UI of the curaLINE Client
+Requires:       %{name}%{?_isa} = %{version}-%{release}
+Requires:       hicolor-icon-theme
+Requires:       libasound.so.2()(64bit)
+Requires:       libdbus-1.so.3()(64bit)
+Requires:       libfontconfig.so.1()(64bit)
+Requires:       libGL.so.1()(64bit)
+Requires:       libstdc++.so.6()(64bit)
+Requires:       libsystemd.so.0()(64bit)
+Requires:       libX11.so.6()(64bit)
+Requires:       libXext.so.6()(64bit)
+Requires:       libXi.so.6()(64bit)
+Requires:       libXrender.so.1()(64bit)
+Requires:       libXtst.so.6()(64bit)
+
+%description gui
+The curaLINE Client exchanges documents with the curaLINE Document Routing
+(CDR) service of Swisscom for participants in the Swiss healthcare system.
+
+This package contains the desktop UI, cdr-client-ui, to configure and watch
+the client.
+%endif
+
+%prep
+%autosetup -n cdr-client-%{version}
+
+# The default configuration downloads into java.io.tmpdir, which is private to
+# the service (PrivateTmp=yes) and emptied on every restart, so the documents
+# being downloaded would be lost. Use the state directory instead.
+sed --in-place 's|^\(  local-folder:\).*|\1 %{statedir}|' lib/app/conf/application-customer.yaml
+
+%build
+# prebuilt
+
+%install
+install -d %{buildroot}%{appdir}
+cp --archive bin lib %{buildroot}%{appdir}/
+install -d %{buildroot}%{_bindir}
+ln --symbolic %{appdir}/bin/cdr-client-service %{buildroot}%{_bindir}/cdr-client-service
+install -d %{buildroot}%{confdir}
+install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/%{name}.service
+install -D -p -m 0644 %{SOURCE2} %{buildroot}%{_sysusersdir}/%{name}.conf
+# Conveyor's own unit; ours replaces it
+rm --recursive %{buildroot}%{appdir}/lib/systemd
+
+%if %{with gui}
+ln --symbolic %{appdir}/bin/cdr-client-ui %{buildroot}%{_bindir}/cdr-client-ui
+install -d %{buildroot}%{_datadir}
+cp --archive share/applications share/icons share/metainfo %{buildroot}%{_datadir}/
+%else
+rm %{buildroot}%{appdir}/bin/cdr-client-ui %{buildroot}%{appdir}/lib/app/conf/logback-ui.xml
+for lib in %{guilibs}; do
+    rm %{buildroot}%{appdir}/lib/runtime/lib/$lib
+done
+%endif
+
+%pre
+# the account of sysusers.d/%{name}.conf, for the rpm versions that do not
+# create it from there
+getent group %{name} >/dev/null || groupadd --system %{name}
+getent passwd %{name} >/dev/null || \
+    useradd --system --gid %{name} --home-dir %{statedir} --no-create-home \
+        --shell /usr/sbin/nologin --comment 'curaLINE Client' %{name}
+exit 0
+
+%post
+# The configuration is not part of the package. It holds the client secret,
+# the client rewrites it when it renews its credential, and it may belong to
+# another account such as `hnet` (see the unit). Create it from the defaults
+# if it is missing, and hand it to the service account if it belongs to root,
+# since the client refuses to start with a file it does not own.
+for file in application-customer.yaml logback-service.xml; do
+    if [ ! -e %{confdir}/$file ]; then
+        install -m 0640 %{appdir}/lib/app/conf/$file %{confdir}/$file
+    fi
+    if [ "$(stat --format='%%u' %{confdir}/$file)" = 0 ]; then
+        chown %{name}:%{name} %{confdir}/$file
+        chmod 0640 %{confdir}/$file
+    fi
+done
+%systemd_post %{name}.service
+
+%preun
+%systemd_preun %{name}.service
+
+%postun
+%systemd_postun_with_restart %{name}.service
+
+%files
+%license lib/runtime/legal
+%dir %{_prefix}/lib/swisscom-schweiz-ag
+%dir %{appdir}
+%dir %{appdir}/bin
+%{appdir}/bin/cdr-client-service
+%dir %{appdir}/lib
+%dir %{appdir}/lib/app
+%{appdir}/lib/app/*.jar
+%{appdir}/lib/app/icon*
+%dir %{appdir}/lib/app/conf
+%{appdir}/lib/app/conf/application-customer.yaml
+%{appdir}/lib/app/conf/logback-service.xml
+%{appdir}/lib/runtime
+%if %{with gui}
+%exclude %{appdir}/lib/runtime/lib/libLinuxTray.so
+%exclude %{appdir}/lib/runtime/lib/libnucleus_linux_theme.so
+%exclude %{appdir}/lib/runtime/lib/libskiko-linux-x64.so
+%endif
+%{_bindir}/cdr-client-service
+%dir %{_sysconfdir}/swisscom-schweiz-ag
+%dir %{confdir}
+%{_sysusersdir}/%{name}.conf
+%{_unitdir}/%{name}.service
+
+%if %{with gui}
+%files gui
+%{appdir}/bin/cdr-client-ui
+%{appdir}/lib/app/conf/logback-ui.xml
+%{appdir}/lib/runtime/lib/libLinuxTray.so
+%{appdir}/lib/runtime/lib/libnucleus_linux_theme.so
+%{appdir}/lib/runtime/lib/libskiko-linux-x64.so
+%{_bindir}/cdr-client-ui
+%{_datadir}/applications/com.swisscom.health.des.cdr.cdr-client.desktop
+%{_datadir}/icons/hicolor/*/apps/%{name}.png
+%{_datadir}/metainfo/com.swisscom.health.des.cdr.cdr-client.metainfo.xml
+%endif
+
+%changelog