From cb6213955ac77d5eb0830e09ca1f5eebb5da02ee Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Sun, 8 Feb 2026 22:35:36 -0600
Subject: trivionomicon: mediawiki: formatting

---
 modules/mediawiki/options.nix | 42 +++++++++++++++++++++---------------------
 modules/mediawiki/sys.nix     |  3 ++-
 2 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/modules/mediawiki/options.nix b/modules/mediawiki/options.nix
index 06acbf1..9fe0723 100644
--- a/modules/mediawiki/options.nix
+++ b/modules/mediawiki/options.nix
@@ -12,21 +12,21 @@ with lib.types; {
       description = "name of the wiki";
       example = "posixlycorrect wiki";
     };
-    
+
     passwordFile = lib.mkOption {
       type = types.path;
       description = "path of passwordfile for mediawiki";
       example = "/run/keys/mediawiki-password";
     };
-    
+
     skins = lib.mkOption {
       type = types.attrsOf (types.nullOr str);
       description = "skins for mediawiki";
-      example = ''{
-        citizen = "flakes.mediawikiSkinCitizen";
-      };'';
+      example = ''        {
+                citizen = "flakes.mediawikiSkinCitizen";
+              };'';
     };
-    
+
     extraConfig = lib.mkOption {
       type = str;
       example = ''
@@ -52,21 +52,21 @@ with lib.types; {
     extensions = lib.mkOption {
       type = types.attrsOf (types.nullOr types.path);
       description = "some extensions are included and can enabled by passing null";
-      example = ''{
-        VisualEditor = null;
-        CategoryTree = null;
-        CiteThisPage = null;
-        Scribunto = null;
-        Cite = null;
-        CodeEditor = null;
-        Math = null;
-        MultimediaViewer = null;
-        PdfHandler = null;
-        Poem = null;
-        SecureLinkFixer = null;
-        WikiEditor = null;
-        ParserFunctions = null;
-      };'';
+      example = ''        {
+                VisualEditor = null;
+                CategoryTree = null;
+                CiteThisPage = null;
+                Scribunto = null;
+                Cite = null;
+                CodeEditor = null;
+                Math = null;
+                MultimediaViewer = null;
+                PdfHandler = null;
+                Poem = null;
+                SecureLinkFixer = null;
+                WikiEditor = null;
+                ParserFunctions = null;
+              };'';
     };
   };
 }
diff --git a/modules/mediawiki/sys.nix b/modules/mediawiki/sys.nix
index 525ec3e..b6a9273 100644
--- a/modules/mediawiki/sys.nix
+++ b/modules/mediawiki/sys.nix
@@ -4,7 +4,8 @@
   cfg,
   doctrine,
   ...
-}: with lib; {
+}:
+with lib; {
   services = {
     nginx = {
       virtualHosts.${cfg.hostName} = {
-- 
cgit v1.2.3


From 80ea8a98998e3ac14dac9759c29a363bd98f52ad Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 18 Feb 2026 18:56:39 -0600
Subject: trivionomicon: athena-bccr: fix Polkit authentication failures

---
 modules/athena-bccr/sys.nix | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/modules/athena-bccr/sys.nix b/modules/athena-bccr/sys.nix
index 631185d..9532358 100644
--- a/modules/athena-bccr/sys.nix
+++ b/modules/athena-bccr/sys.nix
@@ -19,8 +19,22 @@ in {
     systemPackages = [athena.ase-pkcs11];
   };
 
-  #FIXME: Extremadamente peligroso si BCCR o MICITT caen, investigar política nacional de root CA
-  security.pki.certificateFiles = ["${athena.bccr-cacerts}/root-ca.pem"];
+  security = {
+    #FIXME: Extremadamente peligroso si BCCR o MICITT caen, investigar política nacional de root CA
+    pki.certificateFiles = ["${athena.bccr-cacerts}/root-ca.pem"];
+
+    polkit = {
+      enable = lib.mkDefault true;
+
+      extraConfig = ''
+        polkit.addRule(function(action, subject) {
+            if (action.id == "org.debian.pcsc-lite.access_pcsc" && subject.isInGroup("users")) {
+                    return polkit.Result.YES;
+            }
+        });
+      '';
+    };
+  };
 
   services = {
     pcscd.enable = true;
-- 
cgit v1.2.3


From 41025c06bf5fca7f311e38ff5c3b1b8622894533 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 18 Feb 2026 19:06:23 -0600
Subject: trivionomicon: athena-bccr: allow the 'users' group to access any
 card

---
 modules/athena-bccr/sys.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/athena-bccr/sys.nix b/modules/athena-bccr/sys.nix
index 9532358..2dd56e2 100644
--- a/modules/athena-bccr/sys.nix
+++ b/modules/athena-bccr/sys.nix
@@ -28,7 +28,8 @@ in {
 
       extraConfig = ''
         polkit.addRule(function(action, subject) {
-            if (action.id == "org.debian.pcsc-lite.access_pcsc" && subject.isInGroup("users")) {
+            if ((action.id == "org.debian.pcsc-lite.access_pcsc" || action.id == "org.debian.pcsc-lite.access_card") &&
+                subject.isInGroup("users")) {
                     return polkit.Result.YES;
             }
         });
-- 
cgit v1.2.3


From c641960fda28ffede55c5e5bf67ed2e3e9106962 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 18 Feb 2026 19:25:49 -0600
Subject: trivionomicon: athena-bccr: update 1.9.8 -> latest master

---
 .../0001-Remove-CheckUpdatePlugin-from-default-list.patch      | 10 +++++-----
 pkgs/athena-bccr/firmador.nix                                  | 10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/athena-bccr/0001-Remove-CheckUpdatePlugin-from-default-list.patch b/pkgs/athena-bccr/0001-Remove-CheckUpdatePlugin-from-default-list.patch
index e7fc5d5..a15896a 100644
--- a/pkgs/athena-bccr/0001-Remove-CheckUpdatePlugin-from-default-list.patch
+++ b/pkgs/athena-bccr/0001-Remove-CheckUpdatePlugin-from-default-list.patch
@@ -8,18 +8,18 @@ Subject: [PATCH] Remove CheckUpdatePlugin from default list
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/main/java/cr/libre/firmador/Settings.java b/src/main/java/cr/libre/firmador/Settings.java
-index e5ddf01..a028d6e 100644
+index e392a82..c2ab5e4 100644
 --- a/src/main/java/cr/libre/firmador/Settings.java
 +++ b/src/main/java/cr/libre/firmador/Settings.java
-@@ -81,7 +81,7 @@ public class Settings {
- 
+@@ -160,7 +160,7 @@ public class Settings {
+     @SuppressWarnings("this-escape")
      public Settings() {
          activePlugins.add("cr.libre.firmador.plugins.DummyPlugin");
 -        activePlugins.add("cr.libre.firmador.plugins.CheckUpdatePlugin");
 +        // activePlugins.add("cr.libre.firmador.plugins.CheckUpdatePlugin");
+         // activePlugins.add("cr.libre.firmador.plugins.DocumentSignLogs");
          availablePlugins.add("cr.libre.firmador.plugins.DummyPlugin");
          availablePlugins.add("cr.libre.firmador.plugins.CheckUpdatePlugin");
-     }
 -- 
-2.49.0
+2.51.2
 
diff --git a/pkgs/athena-bccr/firmador.nix b/pkgs/athena-bccr/firmador.nix
index 8ae8750..e07235b 100644
--- a/pkgs/athena-bccr/firmador.nix
+++ b/pkgs/athena-bccr/firmador.nix
@@ -11,7 +11,7 @@
     enableJavaFX = true;
   };
 
-  version = "1.9.8";
+  version = "1.9.8+master";
 in
   maven.buildMavenPackage {
     pname = "firmador";
@@ -19,15 +19,15 @@ in
 
     src = fetchgit {
       url = "https://codeberg.org/firmador/firmador";
-      rev = version;
-      hash = "sha256-xdiVPjihRADPK4nG+WQHWsDzVYLCeN6ouQ6SDtjf1qQ=";
+      rev = "676b0e3c0dc5adb0628d4d98efcfccfca3daa8a7";
+      hash = "sha256-f/EKll1csvUCRSt4G1SeDB4gVW+ZtUgJjlmM7PlafyQ=";
     };
 
     patches = [
       ./0001-Remove-CheckUpdatePlugin-from-default-list.patch
     ];
 
-    mvnHash = "sha256-m3UaOLNyIlVAOI5tzxMlxg4KZ1N5gT2O2WSka+jBat4=";
+    mvnHash = "sha256-0vwJ1f+0UXxrXRaJ1BHqfOXDU/pxrSPdYYEQ71m4jJQ=";
 
     nativeBuildInputs = [
       makeWrapper
@@ -35,7 +35,7 @@ in
     ];
 
     postPatch = lib.optionalString (libasep11 != null) ''
-      sed -i 's@/usr/lib/x64-athena/libASEP11.so@${libasep11}@g' src/main/java/cr/libre/firmador/CRSigner.java
+      sed -i 's@/usr/lib/x64-athena/libASEP11.so@${libasep11}@g' src/main/java/cr/libre/firmador/signers/CRSigner.java
     '';
 
     installPhase = ''
-- 
cgit v1.2.3


From 378b6c12c7f3fdff0975d1dd56f3204bd4e04247 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Mon, 2 Mar 2026 19:48:42 -0600
Subject: trivionomicon: athena-bccr: add support for non-Athena driver vendors

---
 modules/athena-bccr/sys.nix    |   9 +-
 pkgs/athena-bccr/default.nix   |  10 +-
 pkgs/athena-bccr/firmador.nix  |   6 +-
 pkgs/athena-bccr/gaudi-env.nix |   2 +-
 pkgs/athena-bccr/releases.nix  |   1 +
 pkgs/athena-bccr/unwrapped.nix | 248 +++++++++++++++++++++--------------------
 6 files changed, 142 insertions(+), 134 deletions(-)

diff --git a/modules/athena-bccr/sys.nix b/modules/athena-bccr/sys.nix
index 2dd56e2..5bbefa3 100644
--- a/modules/athena-bccr/sys.nix
+++ b/modules/athena-bccr/sys.nix
@@ -6,17 +6,18 @@
   ...
 }: let
   athena = pkgs.${doctrine.prefix}.athena-bccr.${cfg.release};
+  inherit (athena.card-driver) vendor;
 in {
   environment = {
-    etc = {
-      "Athena".source = "${athena.ase-pkcs11}/etc/Athena";
+    etc = lib.optionalAttrs (vendor == "athena") {
+      "Athena".source = "${athena.card-driver}/etc/Athena";
 
       "pkcs11/modules/asep11".text = ''
-        module: ${athena.libasep11}
+        module: ${athena.pkcs11-module}
       '';
     };
 
-    systemPackages = [athena.ase-pkcs11];
+    systemPackages = [athena.card-driver];
   };
 
   security = {
diff --git a/pkgs/athena-bccr/default.nix b/pkgs/athena-bccr/default.nix
index a5f79ca..c48ab87 100644
--- a/pkgs/athena-bccr/default.nix
+++ b/pkgs/athena-bccr/default.nix
@@ -16,15 +16,15 @@
     };
 
   pkgsForRelease = release: let
-    ase-pkcs11 = unwrapped.ase-idprotect.lib;
-    libasep11 = "${ase-pkcs11}/lib/x64-athena/libASEP11.so";
+    inherit (unwrapped) card-driver bccr-cacerts;
+
     unwrapped = overrideUnwrapped {inherit release;} {};
+    pkcs11-module = "${card-driver.lib}/${card-driver.pkcs11-path}";
   in {
-    inherit ase-pkcs11 libasep11;
-    inherit (unwrapped) ase-idprotect bccr-cacerts;
+    inherit card-driver bccr-cacerts pkcs11-module;
 
     gaudi = callPackage ./gaudi-env.nix {inherit unwrapped;};
-    firmador = callPackage ./firmador.nix {inherit libasep11;};
+    firmador = callPackage ./firmador.nix {inherit pkcs11-module;};
   };
 in
   lib.mapAttrs (_: pkgsForRelease) (releases // {latest = releases.${latest};})
diff --git a/pkgs/athena-bccr/firmador.nix b/pkgs/athena-bccr/firmador.nix
index e07235b..82578e8 100644
--- a/pkgs/athena-bccr/firmador.nix
+++ b/pkgs/athena-bccr/firmador.nix
@@ -5,7 +5,7 @@
   maven,
   openjdk,
   wrapGAppsHook3,
-  libasep11 ? null,
+  pkcs11-module ? null,
 }: let
   jdk = openjdk.override {
     enableJavaFX = true;
@@ -34,8 +34,8 @@ in
       wrapGAppsHook3
     ];
 
-    postPatch = lib.optionalString (libasep11 != null) ''
-      sed -i 's@/usr/lib/x64-athena/libASEP11.so@${libasep11}@g' src/main/java/cr/libre/firmador/signers/CRSigner.java
+    postPatch = lib.optionalString (pkcs11-module != null) ''
+      sed -i 's@/usr/lib/x64-athena/libASEP11.so@${pkcs11-module}@g' src/main/java/cr/libre/firmador/signers/CRSigner.java
     '';
 
     installPhase = ''
diff --git a/pkgs/athena-bccr/gaudi-env.nix b/pkgs/athena-bccr/gaudi-env.nix
index 0ca1b82..db79641 100644
--- a/pkgs/athena-bccr/gaudi-env.nix
+++ b/pkgs/athena-bccr/gaudi-env.nix
@@ -12,7 +12,7 @@ in
     name = "gaudi";
 
     targetPkgs = pkgs: [
-      unwrappedWithGaudi.ase-idprotect.lib
+      unwrappedWithGaudi.card-driver.lib
       unwrappedWithGaudi.gaudi
 
       (writeShellScriptBin "launch-gaudi" ''
diff --git a/pkgs/athena-bccr/releases.nix b/pkgs/athena-bccr/releases.nix
index e965172..3e413e1 100644
--- a/pkgs/athena-bccr/releases.nix
+++ b/pkgs/athena-bccr/releases.nix
@@ -3,6 +3,7 @@
     # nix hash convert --hash-algo sha256 --from base16 --to sri $(sha256sum sfd_ClientesLinux_DEB64_Rev26.zip | cut -d' ' -f1)
     hash = "sha256-ZPWP9TqJQ5coJAPzUSiaXKVItBWlqFM4smCjOf+gqQM=";
     basename = "sfd_ClientesLinux_DEB64_Rev26";
+    vendor = "athena";
 
     srcPaths = {
       gaudi = "Firma Digital/Agente GAUDI/agente-gaudi_20.0_amd64.deb";
diff --git a/pkgs/athena-bccr/unwrapped.nix b/pkgs/athena-bccr/unwrapped.nix
index d6f3f38..e2e0bbd 100644
--- a/pkgs/athena-bccr/unwrapped.nix
+++ b/pkgs/athena-bccr/unwrapped.nix
@@ -5,7 +5,7 @@
   gaudiHash ? null,
   ...
 }: let
-  inherit (release) srcPaths;
+  inherit (release) srcPaths vendor;
 
   src = requireFile {
     url = "https://soportefirmadigital.com";
@@ -42,7 +42,7 @@
         '';
       }
       // lib.removeAttrs args ["stdenv" "dpkg" "unzip" "srcPath" "nativeBuildInputs"]);
-in {
+
   ase-idprotect = {
     autoPatchelfHook,
     dpkg,
@@ -89,138 +89,144 @@ in {
       preFixup = ''
         patchelf --set-rpath $lib/lib/x64-athena $out/bin/*
       '';
-    };
 
-  gaudi = {
-    autoPatchelfHook,
-    dpkg,
-    makeWrapper,
-    openjdk,
-    pkgs,
-    stdenv,
-    unzip,
-    writeShellScriptBin,
-    update-gaudi,
-    ...
-  }: let
-    jdk = openjdk.override {
-      enableJavaFX = true;
-      openjfx_jdk = pkgs."openjfx${lib.head (lib.splitString "." openjdk.version)}".override {withWebKit = true;};
+      passthru.pkcs11-path = "lib/x64-athena/libASEP11.so";
     };
+in
+  {
+    gaudi = {
+      autoPatchelfHook,
+      dpkg,
+      makeWrapper,
+      openjdk,
+      pkgs,
+      stdenv,
+      unzip,
+      writeShellScriptBin,
+      update-gaudi,
+      ...
+    }: let
+      jdk = openjdk.override {
+        enableJavaFX = true;
+        openjfx_jdk = pkgs."openjfx${lib.head (lib.splitString "." openjdk.version)}".override {withWebKit = true;};
+      };
+
+      fakeSudo = writeShellScriptBin "sudo" "";
+      gaudiUpdate = gaudiUpdateSrc {inherit update-gaudi;};
+    in
+      moduleFromDeb "gaudi" {
+        inherit dpkg stdenv unzip;
+        srcPath = srcPaths.gaudi;
+
+        nativeBuildInputs = [
+          autoPatchelfHook
+          jdk
+          makeWrapper
+        ];
+
+        preBuild = lib.optionalString (gaudiHash != null) ''
+          unzip -o ${gaudiUpdate} -d opt/Agente-GAUDI/lib/app
+        '';
 
-    fakeSudo = writeShellScriptBin "sudo" "";
-    gaudiUpdate = gaudiUpdateSrc {inherit update-gaudi;};
-  in
-    moduleFromDeb "gaudi" {
-      inherit dpkg stdenv unzip;
-      srcPath = srcPaths.gaudi;
-
-      nativeBuildInputs = [
-        autoPatchelfHook
-        jdk
-        makeWrapper
-      ];
-
-      preBuild = lib.optionalString (gaudiHash != null) ''
-        unzip -o ${gaudiUpdate} -d opt/Agente-GAUDI/lib/app
-      '';
-
-      buildPhase = ''
-        runHook preBuild
-
-        install -m755 -d $out/{bin,opt/Firmador-BCCR/lib}
-        cp -r opt/Agente-GAUDI/lib/app $out/opt/Firmador-BCCR/lib/app
+        buildPhase = ''
+          runHook preBuild
 
-        # Preserves the original filename and avoids <hash>-LaunchGaudi.java
-        ln -s ${./LaunchGaudi.java} LaunchGaudi.java
+          install -m755 -d $out/{bin,opt/Firmador-BCCR/lib}
+          cp -r opt/Agente-GAUDI/lib/app $out/opt/Firmador-BCCR/lib/app
 
-        javac \
-          -cp opt/Agente-GAUDI/lib/app/bccr-firma-fva-clienteMultiplataforma.jar \
-          -d $out/opt/Firmador-BCCR/lib/app \
-          LaunchGaudi.java
+          # Preserves the original filename and avoids <hash>-LaunchGaudi.java
+          ln -s ${./LaunchGaudi.java} LaunchGaudi.java
 
-        runHook postBuild
-      '';
+          javac \
+            -cp opt/Agente-GAUDI/lib/app/bccr-firma-fva-clienteMultiplataforma.jar \
+            -d $out/opt/Firmador-BCCR/lib/app \
+            LaunchGaudi.java
 
-      installPhase = ''
-        runHook preInstall
+          runHook postBuild
+        '';
 
-        install -m755 -d $out/{share,opt/Firmador-BCCR/lib/runtime/lib}
-        install -m755 -D opt/Agente-GAUDI/bin/Agente-GAUDI $out/opt/Firmador-BCCR/bin/Agente-GAUDI
-        install -m755 -D opt/Agente-GAUDI/lib/libapplauncher.so $out/opt/Firmador-BCCR/lib/libapplauncher.so
+        installPhase = ''
+          runHook preInstall
 
-        ln -s ../opt/Firmador-BCCR/lib/app $out/share/java
-        ln -s Firmador-BCCR $out/opt/Agente-GAUDI
-        ln -s ${jdk}/lib/openjdk/lib/libjli.so $out/opt/Firmador-BCCR/lib/runtime/lib/libjli.so
+          install -m755 -d $out/{share,opt/Firmador-BCCR/lib/runtime/lib}
+          install -m755 -D opt/Agente-GAUDI/bin/Agente-GAUDI $out/opt/Firmador-BCCR/bin/Agente-GAUDI
+          install -m755 -D opt/Agente-GAUDI/lib/libapplauncher.so $out/opt/Firmador-BCCR/lib/libapplauncher.so
 
-        makeWrapper ${jdk}/bin/java $out/bin/gaudi \
-          --prefix PATH : ${fakeSudo}/bin \
-          --add-flags "-cp $out/share/java:$out/share/java/bccr-firma-fva-clienteMultiplataforma.jar" \
-          --add-flags "-Djavax.net.ssl.trustStore=$out/opt/Firmador-BCCR/lib/app/bccr.cacerts" \
-          --add-flags "LaunchGaudi"
+          ln -s ../opt/Firmador-BCCR/lib/app $out/share/java
+          ln -s Firmador-BCCR $out/opt/Agente-GAUDI
+          ln -s ${jdk}/lib/openjdk/lib/libjli.so $out/opt/Firmador-BCCR/lib/runtime/lib/libjli.so
 
-        runHook postInstall
-      '';
-    };
+          makeWrapper ${jdk}/bin/java $out/bin/gaudi \
+            --prefix PATH : ${fakeSudo}/bin \
+            --add-flags "-cp $out/share/java:$out/share/java/bccr-firma-fva-clienteMultiplataforma.jar" \
+            --add-flags "-Djavax.net.ssl.trustStore=$out/opt/Firmador-BCCR/lib/app/bccr.cacerts" \
+            --add-flags "LaunchGaudi"
 
-  bccr-cacerts = {
-    openssl,
-    stdenv,
-    unzip,
-    ...
-  }:
-    stdenv.mkDerivation {
-      pname = "bccr-cacerts";
-      version = release.name;
+          runHook postInstall
+        '';
+      };
+
+    bccr-cacerts = {
+      openssl,
+      stdenv,
+      unzip,
+      ...
+    }:
+      stdenv.mkDerivation {
+        pname = "bccr-cacerts";
+        version = release.name;
 
-      inherit src;
+        inherit src;
 
-      nativeBuildInputs = [
-        openssl
-        unzip
-      ];
+        nativeBuildInputs = [
+          openssl
+          unzip
+        ];
 
-      installPhase = ''
-        cp -r Firma\ Digital/Certificados $out
-        openssl x509 -in $out/CA\ RAIZ\ NACIONAL\ -\ COSTA\ RICA\ v2.crt -out $out/root-ca.pem -text
+        installPhase = ''
+          cp -r Firma\ Digital/Certificados $out
+          openssl x509 -in $out/CA\ RAIZ\ NACIONAL\ -\ COSTA\ RICA\ v2.crt -out $out/root-ca.pem -text
+        '';
+      };
+
+    update-gaudi = {
+      wget,
+      writeShellScript,
+      zip,
+      bccr-cacerts,
+      ...
+    }:
+      writeShellScript "update-gaudi" ''
+        set -o errexit
+        set -o pipefail
+        set -o nounset
+
+        temp_dir="$(mktemp -d)"
+        trap 'cd / && rm -rf -- "$temp_dir"' EXIT
+        cd "$temp_dir"
+
+        PATH="${lib.makeBinPath [wget zip]}:$PATH"
+        ca_cert="${bccr-cacerts}/root-ca.pem"
+        base_url="https://www.firmadigital.go.cr/Bccr.Firma.Fva.Actualizador.ClienteFirmadorJava//recursosLiberica17/actualizador"
+
+        wget --ca-certificate="$ca_cert" "$base_url/bccr.cacerts"
+        wget --ca-certificate="$ca_cert" "$base_url/config.properties"
+        wget --ca-certificate="$ca_cert" "$base_url/bccr-firma-fva-clienteMultiplataforma.jar"
+        wget --ca-certificate="$ca_cert" "$base_url/ServicioActualizadorClienteBCCR.jar"
+
+        # https://gist.github.com/stokito/c588b8d6a6a0aee211393d68eea678f2
+        TZ=UTC find . -exec touch --no-dereference -a -m -t 198002010000.00 {} +
+        zip_path="$PWD/gaudi-update-${release.name}.zip"
+        TZ=UTC zip -q --move --recurse-paths --symlinks -X "$zip_path" .
+        TZ=UTC touch -a -m -t 198002010000.00 "$zip_path"
+
+        set -x
+        nix-store --add-fixed sha256 "$zip_path"
+        set +x
+
+        echo -e "\ngaudiHash: $(nix-hash --to-sri --type sha256 $(sha256sum "$zip_path" | cut -d' ' -f1))"
       '';
-    };
-
-  update-gaudi = {
-    wget,
-    writeShellScript,
-    zip,
-    bccr-cacerts,
-    ...
-  }:
-    writeShellScript "update-gaudi" ''
-      set -o errexit
-      set -o pipefail
-      set -o nounset
-
-      temp_dir="$(mktemp -d)"
-      trap 'cd / && rm -rf -- "$temp_dir"' EXIT
-      cd "$temp_dir"
-
-      PATH="${lib.makeBinPath [wget zip]}:$PATH"
-      ca_cert="${bccr-cacerts}/root-ca.pem"
-      base_url="https://www.firmadigital.go.cr/Bccr.Firma.Fva.Actualizador.ClienteFirmadorJava//recursosLiberica17/actualizador"
-
-      wget --ca-certificate="$ca_cert" "$base_url/bccr.cacerts"
-      wget --ca-certificate="$ca_cert" "$base_url/config.properties"
-      wget --ca-certificate="$ca_cert" "$base_url/bccr-firma-fva-clienteMultiplataforma.jar"
-      wget --ca-certificate="$ca_cert" "$base_url/ServicioActualizadorClienteBCCR.jar"
-
-      # https://gist.github.com/stokito/c588b8d6a6a0aee211393d68eea678f2
-      TZ=UTC find . -exec touch --no-dereference -a -m -t 198002010000.00 {} +
-      zip_path="$PWD/gaudi-update-${release.name}.zip"
-      TZ=UTC zip -q --move --recurse-paths --symlinks -X "$zip_path" .
-      TZ=UTC touch -a -m -t 198002010000.00 "$zip_path"
-
-      set -x
-      nix-store --add-fixed sha256 "$zip_path"
-      set +x
-
-      echo -e "\ngaudiHash: $(nix-hash --to-sri --type sha256 $(sha256sum "$zip_path" | cut -d' ' -f1))"
-    '';
-}
+  }
+  // lib.optionalAttrs (vendor == "athena") {
+    card-driver = ase-idprotect;
+  }
-- 
cgit v1.2.3


From ef392aba7432a6d46de339119c56645cc9284fb3 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Mon, 2 Mar 2026 20:25:46 -0600
Subject: trivionomicon: athena-bccr: initial idopte support

---
 modules/athena-bccr/sys.nix    | 18 +++++++------
 pkgs/athena-bccr/default.nix   |  3 ++-
 pkgs/athena-bccr/releases.nix  | 14 ++++++++++
 pkgs/athena-bccr/unwrapped.nix | 58 +++++++++++++++++++++++++++++++++++++++++-
 4 files changed, 83 insertions(+), 10 deletions(-)

diff --git a/modules/athena-bccr/sys.nix b/modules/athena-bccr/sys.nix
index 5bbefa3..5457ca5 100644
--- a/modules/athena-bccr/sys.nix
+++ b/modules/athena-bccr/sys.nix
@@ -6,16 +6,18 @@
   ...
 }: let
   athena = pkgs.${doctrine.prefix}.athena-bccr.${cfg.release};
-  inherit (athena.card-driver) vendor;
+  inherit (athena) vendor;
 in {
   environment = {
-    etc = lib.optionalAttrs (vendor == "athena") {
-      "Athena".source = "${athena.card-driver}/etc/Athena";
-
-      "pkcs11/modules/asep11".text = ''
-        module: ${athena.pkcs11-module}
-      '';
-    };
+    etc =
+      {
+        "pkcs11/modules/${vendor}".text = ''
+          module: ${athena.pkcs11-module}
+        '';
+      }
+      // lib.optionalAttrs (vendor == "athena") {
+        "Athena".source = "${athena.card-driver}/etc/Athena";
+      };
 
     systemPackages = [athena.card-driver];
   };
diff --git a/pkgs/athena-bccr/default.nix b/pkgs/athena-bccr/default.nix
index c48ab87..c4a8575 100644
--- a/pkgs/athena-bccr/default.nix
+++ b/pkgs/athena-bccr/default.nix
@@ -2,7 +2,7 @@
   callPackage,
   lib,
 }: let
-  latest = "deb64-rev26";
+  latest = "deb64-rev26.2";
 
   releases = lib.mapAttrs (name: release: release // {name = name;}) (import ./releases.nix);
 
@@ -22,6 +22,7 @@
     pkcs11-module = "${card-driver.lib}/${card-driver.pkcs11-path}";
   in {
     inherit card-driver bccr-cacerts pkcs11-module;
+    inherit (release) vendor;
 
     gaudi = callPackage ./gaudi-env.nix {inherit unwrapped;};
     firmador = callPackage ./firmador.nix {inherit pkcs11-module;};
diff --git a/pkgs/athena-bccr/releases.nix b/pkgs/athena-bccr/releases.nix
index 3e413e1..cbc5bdb 100644
--- a/pkgs/athena-bccr/releases.nix
+++ b/pkgs/athena-bccr/releases.nix
@@ -2,6 +2,7 @@
   "deb64-rev26" = {
     # nix hash convert --hash-algo sha256 --from base16 --to sri $(sha256sum sfd_ClientesLinux_DEB64_Rev26.zip | cut -d' ' -f1)
     hash = "sha256-ZPWP9TqJQ5coJAPzUSiaXKVItBWlqFM4smCjOf+gqQM=";
+    filename = "sfd_ClientesLinux_DEB64_Rev26.zip";
     basename = "sfd_ClientesLinux_DEB64_Rev26";
     vendor = "athena";
 
@@ -10,4 +11,17 @@
       idprotect = "Firma Digital/PinTool/IDProtect PINTool 7.24.02/DEB/idprotectclient_7.24.02-0_amd64.deb";
     };
   };
+
+  "deb64-rev26.2" = {
+    # nix hash convert --hash-algo sha256 --from base16 --to sri $(sha256sum sfd_ClientesLinux_DEB64_Ubuntu24_rev26_02 | cut -d' ' -f1)
+    hash = "sha256-DNzP0YRnuUbfKLhi7JeQCirdGx4kM7ROqHDkTuVs0mA=";
+    filename = "sfd_ClientesLinux_DEB64_Ubuntu24_rev26_02.zip";
+    basename = "sfd_ClientesLinux_DEB64_Ubuntu24_26_02";
+    vendor = "idopte";
+
+    srcPaths = {
+      gaudi = "Firma Digital/Agente GAUDI/agente-gaudi_27.0_amd64.deb";
+      idopte = "Firma Digital/Idopte/Idopte_6.23.44.0_ubun24_amd64.deb";
+    };
+  };
 }
diff --git a/pkgs/athena-bccr/unwrapped.nix b/pkgs/athena-bccr/unwrapped.nix
index e2e0bbd..c7781e4 100644
--- a/pkgs/athena-bccr/unwrapped.nix
+++ b/pkgs/athena-bccr/unwrapped.nix
@@ -9,7 +9,7 @@
 
   src = requireFile {
     url = "https://soportefirmadigital.com";
-    name = "${release.basename}.zip";
+    name = release.filename;
 
     inherit (release) hash;
   };
@@ -92,6 +92,59 @@
 
       passthru.pkcs11-path = "lib/x64-athena/libASEP11.so";
     };
+
+  scmiddleware = {
+    autoPatchelfHook,
+    dpkg,
+    glib,
+    gtk3,
+    libappindicator-gtk3,
+    libnotify,
+    openssl,
+    pcsclite,
+    stdenv,
+    unzip,
+    webkitgtk_4_1,
+    ...
+  }:
+    moduleFromDeb "idopte-scmiddleware" {
+      inherit dpkg stdenv unzip;
+      srcPath = srcPaths.idopte;
+
+      buildInputs = [
+        glib
+        gtk3
+        libappindicator-gtk3
+        libnotify
+        openssl
+        pcsclite
+        stdenv.cc.cc.lib
+        webkitgtk_4_1
+      ];
+
+      nativeBuildInputs = [
+        autoPatchelfHook
+      ];
+
+      outputs = ["out" "lib"];
+
+      installPhase = ''
+        runHook preInstall
+
+        install -m755 -d $out/bin $lib/{etc,lib/SCMiddleware}
+        install -m755 usr/lib/SCMiddleware/{idocachesrv,SCManager} $out/bin
+        install -m755 usr/lib/SCMiddleware/*.so $lib/lib/SCMiddleware
+        cp -r etc/id* $lib/etc
+
+        runHook postInstall
+      '';
+
+      preFixup = ''
+        patchelf --set-rpath $lib/lib/SCMiddleware $lib/lib/SCMiddleware/* $out/bin/*
+      '';
+
+      passthru.pkcs11-path = "lib/SCMiddleware/libidop11.so";
+    };
 in
   {
     gaudi = {
@@ -230,3 +283,6 @@ in
   // lib.optionalAttrs (vendor == "athena") {
     card-driver = ase-idprotect;
   }
+  // lib.optionalAttrs (vendor == "idopte") {
+    card-driver = scmiddleware;
+  }
-- 
cgit v1.2.3


From c5dfc77484eee582bd7377a41345cff10534e72e Mon Sep 17 00:00:00 2001
From: Fabian Montero <fabian@posixlycorrect.com>
Date: Sun, 8 Mar 2026 10:35:10 -0600
Subject: trivionomicon/waybar: make waybar solid black instead of transparent

this makes it so that window text does not go under bar text in a wierd
way
---
 modules/waybar/hm.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/waybar/hm.nix b/modules/waybar/hm.nix
index 1bfa3e2..6149a63 100644
--- a/modules/waybar/hm.nix
+++ b/modules/waybar/hm.nix
@@ -101,9 +101,9 @@ with lib; {
         box-shadow: none;
       }
 
-      /* Entire bar: fully transparent, no border */
+      /* Entire bar: solid black, no border */
       window#waybar {
-        background: transparent;
+        background: #000000;
         color: #eaeaea;
         margin: 0;
         padding: 0;
-- 
cgit v1.2.3