markuslf · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 * acme.sh packages for RHEL 8 to 10, Fedora, SLES and openSUSE Leap 15 and 16, Debian 12 and 13 and Ubuntu 22.04 to 26.04, with all DNS API, deploy and notify hooks; acme.sh no longer upgrades itself, updates come through the package manager.
+* curaLINE Client packages (`swisscom-schweiz-ag-cdr-client`) for RHEL 8 to 10, Fedora, SLES and openSUSE Leap 15 and 16, Debian 12 and 13 and Ubuntu 22.04 to 26.04 (x86_64), repacked from Swisscom's release, with a static service account and the UI split off into `swisscom-schweiz-ag-cdr-client-gui` (not on RHEL 8 and SLES 15); they update hosts that installed Swisscom's .deb and keep its configuration.
 * Build pipeline that turns Linuxfabrik's own and third-party software into RPM and DEB packages for EL, Fedora, SLES, Debian and Ubuntu.
 * DEB packages carry the target distro in their version (e.g. `4.5.8-1+debian13`), so each suite gets its own build.
 * exoscale-cli (`exo`) packages for RHEL 8 to 10, Fedora, SLES and openSUSE Leap 15 and 16, Debian 12 and 13 and Ubuntu 22.04 to 26.04, built from source; they replace the upstream RPM mirrored under repo.linuxfabrik.ch/exoscale/cli and update hosts that installed it.

diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/control b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/control
@@ -0,0 +1,52 @@
+Source: swisscom-schweiz-ag-cdr-client
+Maintainer: Linuxfabrik GmbH <info@linuxfabrik.ch>
+Section: misc
+Priority: optional
+Standards-Version: 4.6.2
+Homepage: https://github.com/swisscom/cdr-client
+Rules-Requires-Root: no
+Build-Depends: debhelper-compat (= 13)
+
+# The dependencies are listed by hand, as in Swisscom's .deb: dpkg-shlibdeps
+# knows nothing about the libraries of the bundled Java runtime, and the
+# libraries only the UI loads belong to the -gui package.
+Package: swisscom-schweiz-ag-cdr-client
+Architecture: amd64
+Depends: ${misc:Depends},
+         libc6,
+         systemd | systemd-standalone-sysusers | systemd-sysusers
+Description: client for the curaLINE Document Routing (CDR) service
+ The curaLINE Client exchanges documents with the curaLINE Document Routing
+ (CDR) service of Swisscom for participants in the Swiss healthcare system. It
+ uploads the files of a source folder and puts the documents it downloads into
+ a target folder.
+ .
+ This package contains the service. The UI is in
+ swisscom-schweiz-ag-cdr-client-gui.
+
+Package: swisscom-schweiz-ag-cdr-client-gui
+Architecture: amd64
+Depends: ${misc:Depends},
+         hicolor-icon-theme,
+         libasound2t64 | libasound2,
+         libdbus-1-3,
+         libfontconfig1,
+         libgl1,
+         libstdc++6,
+         libsystemd0,
+         libx11-6,
+         libxext6,
+         libxi6,
+         libxrender1,
+         libxtst6,
+         swisscom-schweiz-ag-cdr-client (= ${binary:Version})
+# Swisscom's .deb ships the UI in the base package. Unversioned, since its
+# versions carry no Debian revision to compare against; the base package of
+# this source ships none of the UI files.
+Replaces: swisscom-schweiz-ag-cdr-client
+Description: UI of the curaLINE Client
+ The curaLINE Client exchanges documents with the curaLINE Document Routing
+ (CDR) service of Swisscom for participants in the Swiss healthcare system.
+ .
+ This package contains the desktop UI, cdr-client-ui, to configure and watch
+ the client.
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/copyright b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/copyright
@@ -0,0 +1,31 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: cdr-client
+Upstream-Contact: Swisscom (Schweiz) AG
+Source: https://cdr.health.swisscom.ch/share/downloads/download.html
+
+Files: *
+Copyright: Swisscom (Schweiz) AG
+License: Apache-2.0
+ On Debian systems, the complete text of the Apache License version 2.0 can be
+ found in "/usr/share/common-licenses/Apache-2.0".
+
+Files: lib/runtime/*
+Copyright: Oracle and/or its affiliates, and the other authors of OpenJDK
+License: GPL-2.0 with Classpath exception
+ The bundled Java runtime is built from OpenJDK. The license texts of the
+ runtime and of the libraries it contains are in lib/runtime/legal/ below
+ /usr/lib/swisscom-schweiz-ag/cdr-client.
+ .
+ On Debian systems, the complete text of the GNU General Public License
+ version 2 can be found in "/usr/share/common-licenses/GPL-2".
+
+Files: debian/*
+Copyright: 2026 Linuxfabrik GmbH <info@linuxfabrik.ch>
+License: Unlicense
+ This is free and unencumbered software released into the public domain.
+ .
+ Anyone is free to copy, modify, publish, use, compile, sell, or distribute
+ this software, either in source code form or as a compiled binary, for any
+ purpose, commercial or non-commercial, and by any means.
+ .
+ For more information, please refer to <https://unlicense.org/>.
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/rules b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/rules
@@ -0,0 +1,47 @@
+#!/usr/bin/make -f
+
+APPDIR = /usr/lib/swisscom-schweiz-ag/cdr-client
+BASE = debian/swisscom-schweiz-ag-cdr-client
+GUI = debian/swisscom-schweiz-ag-cdr-client-gui
+
+%:
+	dh $@
+
+override_dh_auto_configure:
+	# The default configuration downloads into java.io.tmpdir, which is
+	# private to the service (PrivateTmp=yes) and emptied on every restart,
+	# so the documents being downloaded would be lost. Use the state
+	# directory instead.
+	sed --in-place 's|^\(  local-folder:\).*|\1 /var/lib/swisscom-schweiz-ag/cdr-client|' lib/app/conf/application-customer.yaml
+
+override_dh_auto_build:
+	# prebuilt
+
+override_dh_auto_install:
+	install -d $(BASE)$(APPDIR) $(BASE)/etc/swisscom-schweiz-ag/cdr-client $(BASE)/usr/bin
+	cp --archive bin lib $(BASE)$(APPDIR)/
+	# Conveyor's own unit; ours replaces it
+	rm --recursive $(BASE)$(APPDIR)/lib/systemd
+	ln --symbolic $(APPDIR)/bin/cdr-client-service $(BASE)/usr/bin/cdr-client-service
+	# dh_installsysusers is not part of the debhelper 13 sequence; the
+	# postinst runs systemd-sysusers itself
+	install -D -m 0644 debian/swisscom-schweiz-ag-cdr-client.sysusers $(BASE)/usr/lib/sysusers.d/swisscom-schweiz-ag-cdr-client.conf
+	# the UI
+	install -d $(GUI)$(APPDIR)/bin $(GUI)$(APPDIR)/lib/app/conf $(GUI)/usr/bin $(GUI)/usr/share
+	mv $(BASE)$(APPDIR)/bin/cdr-client-ui $(GUI)$(APPDIR)/bin/
+	mv $(BASE)$(APPDIR)/lib/app/conf/logback-ui.xml $(GUI)$(APPDIR)/lib/app/conf/
+	# the native libraries of the UI toolkit (Compose, tray icon, desktop theme)
+	install -d $(GUI)$(APPDIR)/lib/runtime/lib
+	mv $(addprefix $(BASE)$(APPDIR)/lib/runtime/lib/,libLinuxTray.so libnucleus_linux_theme.so libskiko-linux-x64.so) $(GUI)$(APPDIR)/lib/runtime/lib/
+	ln --symbolic $(APPDIR)/bin/cdr-client-ui $(GUI)/usr/bin/cdr-client-ui
+	cp --archive share/applications share/icons share/metainfo $(GUI)/usr/share/
+
+# Leave the binaries of the bundled Java runtime as Swisscom built them, and
+# keep its private libraries out of the shlibs and ldconfig handling.
+override_dh_dwz:
+
+override_dh_makeshlibs:
+
+override_dh_shlibdeps:
+
+override_dh_strip:
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/source/format b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/source/format
@@ -0,0 +1 @@
+3.0 (quilt)
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.postinst b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.postinst
@@ -0,0 +1,29 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = configure ]; then
+    # The account has to exist before the configuration is handed to it and
+    # before the service is started by the debhelper snippet below.
+    systemd-sysusers swisscom-schweiz-ag-cdr-client.conf
+
+    # The configuration is not part of the package. It holds the client
+    # secret, the client rewrites it when it renews its credential, and it may
+    # belong to another account such as `hnet` (see the unit). Create it from
+    # the defaults if it is missing, and hand it to the service account if it
+    # belongs to root, since the client refuses to start with a file it does
+    # not own.
+    confdir=/etc/swisscom-schweiz-ag/cdr-client
+    for file in application-customer.yaml logback-service.xml; do
+        if [ ! -e "$confdir/$file" ]; then
+            install -m 0640 "/usr/lib/swisscom-schweiz-ag/cdr-client/lib/app/conf/$file" "$confdir/$file"
+        fi
+        if [ "$(stat --format='%u' "$confdir/$file")" = 0 ]; then
+            chown swisscom-schweiz-ag-cdr-client:swisscom-schweiz-ag-cdr-client "$confdir/$file"
+            chmod 0640 "$confdir/$file"
+        fi
+    done
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.postrm b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.postrm
@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+# the configuration created by the postinst, with the client secret
+if [ "$1" = purge ]; then
+    rm --force /etc/swisscom-schweiz-ag/cdr-client/application-customer.yaml \
+        /etc/swisscom-schweiz-ag/cdr-client/logback-service.xml
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.preinst b/packages/swisscom-schweiz-ag-cdr-client/deb/debian/swisscom-schweiz-ag-cdr-client.preinst
@@ -0,0 +1,23 @@
+#!/bin/sh
+set -e
+
+# Swisscom's .deb links /etc/swisscom-schweiz-ag/cdr-client to the
+# configuration below /usr/lib, which this package replaces with a directory.
+# Keep the configuration: copy it into a real directory before dpkg unpacks
+# this package over it. The postinst hands it to the service account.
+confdir=/etc/swisscom-schweiz-ag/cdr-client
+if [ "$1" = upgrade ] && [ -L "$confdir" ]; then
+    olddir="$(readlink --canonicalize "$confdir")"
+    rm "$confdir"
+    mkdir "$confdir"
+    for file in application-customer.yaml logback-service.xml; do
+        if [ -f "$olddir/$file" ]; then
+            cp "$olddir/$file" "$confdir/$file"
+            chmod 0640 "$confdir/$file"
+        fi
+    done
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/packages/swisscom-schweiz-ag-cdr-client/files/swisscom-schweiz-ag-cdr-client.service b/packages/swisscom-schweiz-ag-cdr-client/files/swisscom-schweiz-ag-cdr-client.service
@@ -0,0 +1,51 @@
+# Based on the unit of Swisscom's .deb, but with a static account instead of
+# `DynamicUser=yes`, so that the client can be run under an existing account
+# such as `hnet` by a drop-in. The sandboxing that `DynamicUser=yes` implies is
+# set explicitly. The client may only write to the directories below, so the
+# folders of the connectors have to be added by a drop-in as well:
+#
+#   [Service]
+#   ReadWritePaths=/data/xml
+#   # optional
+#   Group=hnet
+#   User=hnet
+
+[Unit]
+After=network-online.target
+Description=curaLINE Client
+Wants=network-online.target
+
+[Service]
+CacheDirectory=swisscom-schweiz-ag/cdr-client
+# writable for the client, which rewrites application-customer.yaml when it
+# renews its credential
+ConfigurationDirectory=swisscom-schweiz-ag/cdr-client
+# independent of the home of the account, so the client never writes into an
+# existing home such as /home/hnet
+Environment=HOME=/var/lib/swisscom-schweiz-ag/cdr-client
+# Started through /usr/bin/env because of SELinux on the Red Hat family: the
+# client below /usr/lib is lib_t, for which systemd has no domain transition,
+# while bin_t makes it transition to unconfined_service_t, which may execute
+# the client.
+ExecStart=/usr/bin/env /usr/lib/swisscom-schweiz-ag/cdr-client/bin/cdr-client-service
+Group=swisscom-schweiz-ag-cdr-client
+LogsDirectory=swisscom-schweiz-ag/cdr-client
+LogsDirectoryMode=0750
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectHome=read-only
+ProtectSystem=strict
+# the client exits with 29 after renewing its credential, to be restarted
+Restart=always
+RestartSec=10s
+RestrictSUIDSGID=yes
+StateDirectory=swisscom-schweiz-ag/cdr-client
+# the JVM exits with 143 on SIGTERM
+SuccessExitStatus=143
+SyslogIdentifier=cdr-client
+Type=exec
+User=swisscom-schweiz-ag-cdr-client
+WorkingDirectory=/usr/lib/swisscom-schweiz-ag/cdr-client
+
+[Install]
+WantedBy=multi-user.target
diff --git a/packages/swisscom-schweiz-ag-cdr-client/files/swisscom-schweiz-ag-cdr-client.sysusers b/packages/swisscom-schweiz-ag-cdr-client/files/swisscom-schweiz-ag-cdr-client.sysusers
@@ -0,0 +1,3 @@
+# the account of swisscom-schweiz-ag-cdr-client.service, with the group of the
+# same name
+u swisscom-schweiz-ag-cdr-client - "curaLINE Client" /var/lib/swisscom-schweiz-ag/cdr-client /usr/sbin/nologin
diff --git a/packages/swisscom-schweiz-ag-cdr-client/package.conf b/packages/swisscom-schweiz-ag-cdr-client/package.conf
@@ -0,0 +1,47 @@
+# Build manifest for swisscom-schweiz-ag-cdr-client. Sourced by
+# build/create-package.sh.
+#
+# The curaLINE Client of Swisscom, which exchanges documents with the curaLINE
+# Document Routing (CDR) service of the Swiss healthcare system. It is built
+# with Hydraulic Conveyor, which needs a commercial license and bundles a Java
+# runtime, so the package repacks the linux-amd64 tarball from the Swisscom
+# download page instead of building from source. The tarball holds the same
+# files as Swisscom's own .deb (checked 2026-10-29). The package keeps the
+# name and the paths of that .deb, so it updates hosts that installed it. It
+# differs in a static service account instead of `DynamicUser=yes`, real
+# configuration files below /etc instead of a symlink into /usr/lib, a root
+# owned installation, and the UI split off into the -gui package.
+
+PKG_VERSION='6.2.1'
+
+# Swisscom's download page refuses GitHub's runners (HTTP 403, checked
+# 2026-10-29), and its GitHub tags run ahead of it, so nothing is watched here.
+# A new version is announced by newreleases.io (see the Wartungsarbeiten in the
+# wiki). To bump: download the tarball from
+# https://cdr.health.swisscom.ch/share/downloads/download.html, upload it with
+# `gh release upload sources-swisscom-schweiz-ag-cdr-client <tarball>` and set
+# PKG_VERSION.
+PKG_UPSTREAM_TYPE='none'
+
+# Swisscom's linux-amd64 tarball, mirrored as an asset of the release
+# sources-swisscom-schweiz-ag-cdr-client of this repository. It unpacks to
+# cdr-client-<version>/.
+PKG_SOURCE_TARBALL="cdr-client-${PKG_VERSION}-linux-amd64.tar.gz"
+PKG_SOURCE_URL="https://github.com/Linuxfabrik/packaging/releases/download/sources-swisscom-schweiz-ag-cdr-client/${PKG_SOURCE_TARBALL}"
+
+# RPM recipe and the EL/Fedora/SLES targets it is built for. The UI needs
+# glibc 2.34, so EL 8 and SLES 15 get the service only.
+PKG_RPM_SPEC='rpm/swisscom-schweiz-ag-cdr-client.spec'
+PKG_RPM_DISTROS='fedora-v44 rocky-v8 rocky-v9 rocky-v10 sles-v15 sles-v16'
+
+# DEB recipe and the Debian/Ubuntu targets it is built for.
+PKG_DEB_DEBIAN_DIR='deb/debian'
+PKG_DEB_DISTROS='debian-v12 debian-v13 ubuntu-v2204 ubuntu-v2404 ubuntu-v2604'
+
+# Swisscom only publishes the client for linux-amd64.
+PKG_ARCHES='x86_64'
+
+# Run after installing the package into a fresh container, as user nobody: the
+# packaged version is installed, and the client starts, finds its configuration
+# and stops because nobody may not read it.
+PKG_SMOKE_TEST="test -f /usr/lib/swisscom-schweiz-ag/cdr-client/lib/app/cdr-client-service-${PKG_VERSION}-plain.jar && timeout 120 cdr-client-service 2>&1 | grep --fixed-strings 'exists but does not point to a readable, regular file'"