-
Notifications
You must be signed in to change notification settings - Fork 52
DeveloperTips
This is needed only when the build machine has no network access during configuration or compilation. common/CMakeLists.txt normally downloads the central configuration files during CMake configuration, while client/download_tsl.py downloads the TSL files when the application target is built.
This refers to a network-isolated build environment, such as an isolated CI runner, and is unrelated to the macOS App Sandbox discussed later on this page.
Download the latest TSL files to the qdigidoc4/client source folder:
-
https://ec.europa.eu/tools/lotl/eu-lotl.xml →
eu-lotl.xml -
https://sr.riik.ee/tsl/estonian-tsl.xml →
EE.xml
Download the latest configuration files to the qdigidoc4/common source folder:
Use the application's one-time log generation workflow to collect diagnostic logs:
- Open Settings → Diagnostics.
- Enable Enable one-time log generation.
- Restart DigiDoc4 Client when prompted.
- Reproduce the problem.
- Return to Settings → Diagnostics and save the generated logs.
Diagnostic logs can contain personal or service-related information. Review them before sharing and transfer them only through an approved support channel.
These are the application's own QSettings/registry values, read via Settings/Application::confValue—separate from libdigidocpp's XML configuration file (parameters marked with a single *) and from the signed central configuration service (parameters marked with **).
Detailed descriptions of QSettings fallback paths and rules:
- https://doc.qt.io/qt-6/qsettings.html#platform-specific-notes
- https://doc.qt.io/qt-6/qsettings.html#fallback-mechanism
| Parameter | Description |
|---|---|
| Language | Application language. Possible values are: et and en. |
| showIntro | Show the introduction. Possible values are: true and false. |
| DefaultDir | Directory where the target file will be saved. By default, the target file is written to the same directory as the input file. |
| lastPath | Last path used in a file-selection dialog. |
| LastCheck | Date when the application last successfully checked for a newer central configuration file. |
| Parameter | Description |
|---|---|
| LDAP-PERSON-URLS** | List of LDAP directory addresses used to search for personal certificates. |
| LDAP-CORP-URL** | LDAP directory address used to search for organisation certificates. |
| LDAP-CERTS** | List of base64-encoded CA certificates used as trust anchors for LDAP-PERSON-URLS and LDAP-CORP-URL connections. |
| Parameter | Description |
|---|---|
| MobileSettings | Remember Mobile-ID settings. Possible values are: true and false. |
| MobileCode | Personal identification code used for signing with Mobile-ID. |
| MobileNumber | Phone number used for signing with Mobile-ID. |
| MID-PROXY-URL** | Mobile-ID address used when the relying party UUID is not manually configured. |
| MID-SK-URL** | Mobile-ID address used when the relying party UUID is manually configured. |
| MIDNAME | Relying party name sent to the Mobile-ID service. |
| MIDUUID | Relying party UUID sent to the Mobile-ID service. |
| Parameter | Description |
|---|---|
| SmartIDSettings | Remember Smart-ID settings. Possible values are: true and false. |
| SmartID | Personal identification code used for signing with Smart-ID. |
| SmartIDCountry | Country used for signing with Smart-ID. Possible values are: EE, LT, and LV. |
| SIDV2-PROXY-URL** | Smart-ID address used when the relying party UUID is not manually configured. |
| SIDV2-SK-URL** | Smart-ID address used when the relying party UUID is manually configured. |
| SIDNAME | Relying party name sent to the Smart-ID service. |
| SIDUUID | Relying party UUID sent to the Smart-ID service. |
The Settings dialog's encryption page lists the servers from CDOC2-CONF by name, together with a manually specified entry.
Choosing a listed server changes CDOC2-DEFAULT-KEYSERVER to its UUID and reads its fetch and POST addresses from CDOC2-CONF. These addresses are read-only in the Settings dialog.
Choosing the manually specified entry changes CDOC2-DEFAULT-KEYSERVER to CDOC2-UUID and allows the user to edit CDOC2-GET and CDOC2-POST and pin a certificate using CDOC2-GET-CERT and CDOC2-POST-CERT.
| Parameter | Description |
|---|---|
| CDOC2-DEFAULT** | Offer CDoc 2.0 as the default encryption container format instead of CDoc 1.0. Possible values are: true and false. |
| CDOC2-USE-KEYSERVER** | Use a CDoc 2.0 key transfer server for encryption. Possible values are: true and false. |
| CDOC2-CONF** | List of available CDoc 2.0 key transfer servers, keyed by UUID. Each entry contains a display name and its fetch and POST addresses. |
| CDOC2-DEFAULT-KEYSERVER** | UUID of the selected CDoc 2.0 key transfer server. This can identify an entry in CDOC2-CONF or the locally configured manual server. |
| CDOC2-UUID | UUID identifying the manually specified CDoc 2.0 key transfer server. It is generated for the current user profile when the encryption settings are initialized and regenerated if the application settings are cleared. |
| CDOC2-GET | Fetch address of the manually specified CDoc 2.0 key transfer server. In builds without central configuration, this is the only key transfer server fetch address. |
| CDOC2-GET-CERT | Base64-encoded TLS certificate pinned for the manually specified key transfer server's fetch address. |
| CDOC2-POST | POST address of the manually specified CDoc 2.0 key transfer server. In builds without central configuration, this is the only key transfer server POST address. |
| CDOC2-POST-CERT | Base64-encoded TLS certificate pinned for the manually specified key transfer server's POST address. |
| Parameter | Description |
|---|---|
| RoleAddressInfo | Ask for role and address information when signing. Possible values are: true and false. |
| City | City where the signature is created. |
| Country | Country where the signature is created. |
| State | State or province where the signature is created. |
| Zip | Postal code of the signature creation location. |
| Role | Signer's role or roles. |
| DefaultLTA | Use the Long Term Archival (time-stamp-archive) signature profile when signing.Possible values are: true and false. |
| Parameter | Description |
|---|---|
| ShowPrintSummary | Show the button used to print the container's Validity Confirmation Sheet. Possible values are: true and false. |
| SIVA-URL** | Digital Signature Validation Service SiVa address. |
| SIVA-CERT** | Digital Signature Validation Service SiVa TLS certificate. |
| TSA-URL** | Timestamping service address. |
| TSA-CERT** | Timestamping service TLS certificate. |
| tsl.onlineDigest* | Enable online TSL digest verification. |
| Parameter | Description |
|---|---|
| ProxyConfig | Proxy mode stored in application settings.0 – no proxy;1 – use system proxy settings;2 – manual proxy configuration. |
| ProxyHost | Manual proxy hostname stored in application settings on macOS. |
| ProxyPort | Manual proxy port stored in application settings on macOS. |
| ProxyUser | Manual proxy username stored in application settings on macOS. |
| ProxyPass | Manual proxy password stored in application settings on macOS. |
| proxy.host* | Manual proxy hostname stored in the libdigidocpp configuration on Windows and Linux. |
| proxy.port* | Manual proxy port stored in the libdigidocpp configuration on Windows and Linux. |
| proxy.user* | Manual proxy username stored in the libdigidocpp configuration on Windows and Linux. |
| proxy.pass* | Manual proxy password stored in the libdigidocpp configuration on Windows and Linux. |
| proxy.tunnelSSL* | Enables using an HTTP proxy tunnel for HTTPS connections, including TSL downloads. |
* The parameter can be edited in the libdigidocpp configuration file. Default locations for Windows, macOS, and Ubuntu are documented here:
https://open-eid.github.io/libdigidocpp/manual.html#loading
See also the libdigidocpp configuration parameters:
https://open-eid.github.io/libdigidocpp/manual.html#parameters
** Parameters originating from the central configuration service are available in:
https://id.eesti.ee/config.json
Machine-level overrides use the platform-specific system-scope settings area.
- User settings:
HKEY_CURRENT_USER\Software\RIA\qdigidoc4 - System settings:
HKEY_LOCAL_MACHINE\Software\RIA\qdigidoc4
- Sandboxed signed package (App Store or Developer ID):
~/Library/Containers/ee.ria.qdigidoc4/Data/Library/Preferences/ee.ria.qdigidoc4.plist - Unsigned/non-sandboxed self-build:
~/Library/Preferences/ee.ria.qdigidoc4.plist - System-scope settings:
/Library/Preferences/ee.ria.qdigidoc4.plist - Read the current user settings with:
defaults read ee.ria.qdigidoc4
- User settings:
~/.config/RIA/qdigidoc4.conf - System settings:
/etc/xdg/RIA/qdigidoc4.conf
The default location follows libdigidocpp's path-resolution rules, except on macOS:
https://open-eid.github.io/libdigidocpp/manual.html#loading
~/Library/Group Containers/group.ee.ria.qdigidoc4.tsl
The macOS build overrides the default and uses this application-group container. This allows the cache to be shared with the sandboxed DigiDocQL Quick Look extension, which needs the TSL cache to validate previewed containers but does not receive the main application's other entitlements.
%APPDATA%\RIA\qdigidoccrypto\certhistory.xml
- Sandboxed signed package (App Store or Developer ID):
~/Library/Containers/ee.ria.qdigidoc4/Data/Library/Application Support/RIA/qdigidoc4/certhistory.xml - Unsigned/non-sandboxed self-build:
~/Library/Application Support/RIA/qdigidoc4/certhistory.xml
~/.local/share/RIA/qdigidoc4/certhistory.xml