Today I needed to use Autofirma but as is often the case, there’s no Arch package available in the official repositories, so I got to work.

What is Autofirma?

It’s an application designed to electronically sign documents for use in official administrative processes.
You can find more information about it on its official website.
The app is provided by the Spanish government for a variety of platforms including Windows, MacOS, Ubuntu, Debian… but not Arch based distros.

What about the AUR?

There’s in fact various packages for the app on the Arch User Repository as you can see here, most of them maintained by Óscar García Amor, a well respected developer with an amount of interesting projects.

My problem with this is that Autofirma uses an e-certificate that in case of getting leaked in addition to having a leaked password can be used to supplant my identity.
And given the recent HUGE malware problem in the AUR I don’t feel comfortable using the AUR package even if consistently maintained by a non malicious developer.

Debtap to the rescue!

Debtap is a CLI utility to translate .deb packages to Arch packages.
I already had this tool installed and knowing there’s an official .deb package for Autofirma I decided to install it this way.

Installing Debtap

The recommended way is to do it from AUR, in my case:

yay -S debtap

After installing you need to update the databases it uses to translate packages:

sudo debtap -u

Using it to package Autofirma

The basic command for using debtap is:

sudo debtap -o [output_directory] [package_path] 

So in my case, that I had the package in the downloads folder the command was:

debtap -o ~/Downloads/Autofirma_Linux_Debian ~/Downloads/Autofirma_Linux_Debian/autofirma_1_9.deb

This will create the package that can be installed in Arch. To install it you simply do it with pacman like so:

sudo pacman -U ~/Downloads/Autofirma_Linux_Debian/autofirma-1.9.0-1-any.pkg.tar.zst

Downsides of this method

The main downside is the lack of automatic updates. Whenever a new version of Autofirma comes out, you need to manually update it, downloading the new .deb package and using debtap again.

Being an app that does not require frequent updates, this might be acceptable for some users. However, for those who rely on the latest features and security patches, this method may not be suitable.