OpenCIE

Open-source application for digital signatures, verification, and identity management with the Italian Electronic Identity Card (CIE — Carta d'Identità Elettronica)

Features · Install · Supported cards · Build · Usage

_{Sign · Verify · Manage cards · Settings}

Features


Sign	CAdES (`.p7m`), PAdES (PDF), and XAdES (`.xml`) digital signatures using the CIE chip
Verify	Validate signatures with OCSP/CRL revocation checking
Timestamp	RFC 3161 trusted timestamps; upgrade signatures for long-term validation (B-LT/B-LTA)
Manage	Enroll and manage CIE cards, change/unblock PIN
Cross-platform	Android, Linux, macOS, Windows

Application bundle ID: io.github.m0rf30.opencie. iOS is not supported.

Install

Downloads

Grab the file for your platform from the latest release:

Platform	File	Notes
Linux (Flatpak, x86_64)	`opencie-<version>-x86_64.flatpak`	Sandboxed; see Linux (Flatpak)
Linux (Flatpak, arm64)	`opencie-<version>-aarch64.flatpak`	64-bit ARM
Linux (tarball)	`opencie-<version>-linux-{x86_64,aarch64}.tar.gz`	Pick the one matching your architecture
Android	`opencie-<version>-android-arm64-v8a.apk`	An `x86_64` APK is also published for x86_64 devices/emulators
Windows	`opencie-<version>-windows-x86_64-setup.exe`	Installer
macOS	`opencie-<version>-macos-arm64.dmg`	Apple Silicon; see macOS notes

Linux (Flatpak)

Download opencie-<version>-x86_64.flatpak (or opencie-<version>-aarch64.flatpak on 64-bit ARM) from the latest release and install it:

flatpak install --user opencie-<version>-x86_64.flatpak
flatpak run io.github.m0rf30.opencie

The bundle is sandboxed (Wayland/X11, network, PC/SC reader, and the XDG Documents/Downloads/Desktop folders) and pulls the Freedesktop Platform 25.08 runtime from Flathub automatically on first install. Card operations need pcscd running on the host:

sudo systemctl enable --now pcscd.socket

Android

Install and auto-update via Obtainium:

or add it manually in Obtainium using the source URL https://github.com/M0Rf30/opencie (obtainium://add/https://github.com/M0Rf30/opencie).

Obtainium tracks the per-ABI APK named opencie-<version>-android-arm64-v8a.apk on the releases page; an x86_64 build is published alongside it for x86_64 devices/emulators. There is no armeabi-v7a build — libopencie-pkcs11 doesn't ship one. Release APKs are signed with the project's release key (see Android release signing); tag builds without a configured release key fail CI instead of shipping a debug-signed APK.

macOS / Windows

Download the .dmg or installer from the releases page.

Supported cards & readers

OpenCIE supports the CIE 3.0 (contactless and contact). CIE 2.0/older contact cards, health cards (TS/CNS) and other eIDs are not supported. Any PC/SC reader with a contactless or contact slot works; combo readers expose several slots and all are tried, so you don't need to disable built-in readers.

If you see an "unsupported card" error, run pcsc_scan to get the card's ATR and open an issue attaching it together with the log from ~/.CIEPKI/ (Flatpak: ~/.var/app/io.github.m0rf30.opencie/.CIEPKI/).

Full list of recognised chips and details: supported-cards.md.

Getting Started

Building from source is only needed for development or unsupported platforms.

Prerequisites

Flutter SDK — Dart ^3.11.1 (see pubspec.yaml)
Hardware to read the CIE:
- Android: device with NFC
- Desktop (Linux/macOS/Windows): a PC/SC-compatible smart card or contactless reader
Native PKCS#11 library — opencie-pkcs11. Build it per the instructions in that repository, then let the OpenCIE build pick it up:
- Linux: place libopencie-pkcs11.so in the repo root, set the OPENCIE_PKCS11_LIB environment variable to its path, or keep an opencie-pkcs11 checkout (with builddir/) next to this repository — it gets bundled into bundle/lib/ automatically
- Windows: same, via OPENCIE_PKCS11_LIB pointing to the .dll
- Android: synced into android/app/src/main/jniLibs/ (see scripts/sync-jnilibs.sh)
- macOS: bundled into the .app by CI; for local runs make the .dylib findable by DynamicLibrary.open
For Android builds only: Android NDK r29, minimum SDK 24 (required by libopencie-pkcs11)

Build

flutter pub get

flutter build apk --release      # Android
flutter build linux --release    # Linux
flutter build macos --release    # macOS
flutter build windows --release  # Windows

Flatpak (Linux)

Build the Flatpak locally

Build and install into the user installation:

./tools/flatpak-build.sh
flatpak run io.github.m0rf30.opencie

Manifests live in flatpak/ (Freedesktop Platform 25.08 runtime; grants Wayland/X11, network, PC/SC, and scoped XDG Documents/Downloads/Desktop access — no blanket home access). Card operations need pcscd on the host (systemctl enable --now pcscd.socket). To produce a distributable single-file bundle:

flatpak-builder --user --force-clean --repo=repo build \
  flatpak/flathub/io.github.m0rf30.opencie.yml
flatpak build-bundle --runtime-repo=https://flathub.org/repo/flathub.flatpakrepo \
  repo opencie-x86_64.flatpak io.github.m0rf30.opencie

Run (development)

flutter run -d <device-id>       # use `flutter devices` to list

Regenerate the README/Flathub screenshots (offscreen render, fake data only; run from the repo root with FLUTTER_ROOT set):

OPENCIE_SCREENSHOTS=1 fvm flutter test --tags screenshots test/screenshots

Live-endpoint tests (e.g. FreeTSA) are tagged network, excluded in CI and skipped by default:

OPENCIE_NETWORK_TESTS=1 fvm flutter test --tags network

Android release signing

Keystore setup for local and CI builds

flutter build apk --release and flutter build appbundle --release will use a release keystore when one is configured, and fall back to debug signing otherwise (so flutter run --release keeps working out of the box).

Local builds — drop a keystore on disk and create android/key.properties:

keytool -genkey -v -keystore opencie.keystore -alias opencie \
  -keyalg RSA -keysize 4096 -validity 10000

# android/key.properties (gitignored)
storeFile=/absolute/path/to/opencie.keystore
storePassword=...
keyAlias=opencie
keyPassword=...

CI (GitHub Actions) — add four repository secrets under Settings → Secrets and variables → Actions:

Secret	Value
`KEYSTORE_BASE64`	`base64 -w0 opencie.keystore`
`KEYSTORE_PASSWORD`	keystore password
`KEY_ALIAS`	key alias (e.g. `opencie`)
`KEY_PASSWORD`	key password

Without KEYSTORE_BASE64, PR/branch builds continue with a warning and produce a debug-signed APK/AAB (useful for local testing). Tag builds (refs/tags/v*) instead fail CI if the release keystore secrets aren't configured — the workflow never publishes a debug-signed release, and also verifies (via apksigner verify --print-certs) that the built APKs aren't signed with the Android Debug certificate before staging them. Keep the keystore and passwords offline; losing them means you can't ship updates that Android will accept as the same app.

Usage

Launch OpenCIE.
Choose Sign, Verify, Timestamp, or Manage.
When prompted, present your CIE to the reader (tap on NFC, or insert into a smart card reader) and enter your PIN.
For signatures, pick the file to sign and the desired format (CAdES / PAdES / XAdES). The signed output is written next to the original.

No contactless reader on your computer? Use your NFC phone instead — see Signing with your phone.

macOS notes

Gatekeeper will block the first launch — click to expand

The macOS DMG produced by CI is ad-hoc signed only (codesign --sign -). This is free, requires no Apple Developer account, and is just enough for the dynamic linker to load the bundled Homebrew dylibs on Apple Silicon — but it is not signed with an Apple Developer ID and is not notarized.

As a consequence, on first launch macOS Gatekeeper will refuse to open the app with a message like "OpenCIE.app is damaged and can't be opened" or "cannot be opened because the developer cannot be verified". To bypass this:

Right-click the app → Open → confirm in the dialog. macOS will remember your choice from then on.
Or, from a terminal: xattr -dr com.apple.quarantine /Applications/OpenCIE.app

This is a deliberate choice. Apple's Developer ID program costs $99/year and requires submitting builds to Apple's notary service — neither is something this project intends to depend on. If you'd prefer a cleanly signed build, you're welcome to fork and add your own signing identity to the workflow.

Security

Release assets carry a signed build-provenance attestation (gh attestation verify <file> --repo M0Rf30/opencie) and each release includes a CycloneDX SBOM. To report a vulnerability privately, see SECURITY.md.

Contributing

Issues and pull requests are welcome — see the issue tracker. For non-trivial changes, please open an issue first to discuss the approach.

Name		Name	Last commit message	Last commit date
.github		.github
LICENSES		LICENSES
android		android
assets		assets
docs		docs
flatpak		flatpak
fonts		fonts
installer		installer
lib		lib
linux		linux
macos		macos
scripts		scripts
test		test
tools		tools
windows		windows
.fvmrc		.fvmrc
.gitignore		.gitignore
.metadata		.metadata
AGENTS.md		AGENTS.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE.md		LICENSE.md
README.md		README.md
REUSE.toml		REUSE.toml
SECURITY.md		SECURITY.md
analysis_options.yaml		analysis_options.yaml
dart_test.yaml		dart_test.yaml
l10n.yaml		l10n.yaml
pubspec.yaml		pubspec.yaml

Navigation Menu

Repository files navigation

OpenCIE

Features

Install

Downloads

Linux (Flatpak)

Android

macOS / Windows

Supported cards & readers

Getting Started

Prerequisites

Build

Flatpak (Linux)

Run (development)

Android release signing

Usage

macOS notes

Security

Contributing

License

About

Releases

Packages

Used by

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

OpenCIE

Features

Install

Downloads

Linux (Flatpak)

Android

macOS / Windows

Supported cards & readers

Getting Started

Prerequisites

Build

Flatpak (Linux)

Run (development)

Android release signing

Usage

macOS notes

Security

Contributing

License

About

Topics

Resources

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages