[RPM Based Distro] How to install latest `pcsclite` and `ccid` package


For everyone got problems using the nk3 with RPM based linux distros I post the way I got both important libraries installed.

First download the sources for both from

To install the pcsclite package
you can use the well known
./configure make make install

assuming you have the developer meta package installed.

For my system (Mageia Linux)
the installation of the ccid package was much harder.

First of all you have to tell configure the path to the
libpcsclite.pc file.
Second you need the libusb package installed (of course) and the devoleper files for libusb.

Then you need to tell configure also this path.
So this command made the configuration running.
./configure PKG_CONFIG_PATH=/usr/local/lib/pkgconfig --enable-libusb=/usr/lib64

Thereafter I can do make and make install.

After that you have to start the pcscd deamon.

That should do the trick.
Unfortunately my system still did not recognize the key as
a GPG Smart Card.

Any suggestions welcome!

What do you use? Under Fedora 37 for example, the device will work without any compilation.

1 Like

Hello @tuxmaster5000
I use Mageia Linux.

Well If if is possible to use the nk3 on Fedora than it
should be with Mageia too.

Can you please print the info from the following cmds
dnf info ccid
dnf info pcsc-lite
systemctl status pcscd
gpg --version

On my system I have default
pcsc-lite 1.9.0
ccid 1.4.33 → which need to be min 1.5
gpg 2.2.36

Thanks !

You can check what is the current latest package for various versions of Fedora here:




it is also relatively easy to clone those git projects and rebuild the RPM on your own.

Hello @saper :slight_smile:
Thank you for the answer

Hm I want to understand what’s going wrong here.

Things I did not understand:

  • What does the gpg card agent need to accept the nk3 as a smartcard
  • Do I need to start the pcsc daemon
  • I installed the ccid package 1.5 and the latest pcsc-lite package (compiling and building them). Can it be that gpg did not consider those packages since they are not installed by rpm/dnf?

If all those will not get me any further I maybe switch my Linux distro.
But this should be not the purpose of this. :frowning:
Thanks TL

It depends.

You can use gnupg + scdaemon + libusb

This is the default on most systems - there should be no need to run pcscd and no PC/SC lite is required.

You can also use gnupg + scdaemon + pcscd + ccid

For that, you can add disable-ccid to ${HOME}/.gnupg/scdaemon.conf and this way all smartcard communication is going via PC/SC Lite and the pcscd daemon. Looks like gnupg2 does not need to be compiled with pcsclite support directly to support this, it is a runtime option.

Now, Fedora prefers to disable direct ccid support in their RPM and their require PC/SC lite library to build the package.

Mageia seems to use the default - allow scdaemon to access USB directly via libusb. This way ccid is not needed for gnupg2 and they can use older 1.4.33.

(Personally, I prefer the pcscd way because I use lots of other software to access smartcards in parallel, but this is a personal choice).

As for Mageia, I could not easily find information who maintains their gnupg2 and ccid packages. Edit: ccid seems to be maintained by sander85 and gnupg2 does not seem to have a current maintainer. Maybe you can volunteer to submit a patch to update their ccid version.

1 Like

Hello @saper
Thanks for your answer.
Hmm On my system there is no scdaemon and dnf did not know this.
Mageia will soon become version 9 and I will decide to stay with it or
give Fedora again a try. I used it for a while but have trouble with my
Nvidia grafic card and native drivers. That was the reason to switch to Mageia.

I still did not really get a clue what I’ve todo.
Thanks anyway! :slight_smile:

You could grab srpms from Alma or Rocky Linux and compile them on your distro.

1 Like

Hello again :slight_smile:

Since I gave up trying to use nk3 on Mageia8 I accidentely tried to
start the gpg --card-edit as root and this worked.

So I wonder why. After I read an other thread here I check the
status of the pcscd.

When I am loggin in as root then this is enabled and active.
When not this is not active. So this is maybe the reason why I can’t use the nk3 as non root user.

So I must activate the deamon on startup for my user account right?

best regard

This can be also due to the fact that polkit support is enabled:

1 Like

Yes I guess. The last update of the pcsc-lite lib should handle this.
What I understand from the changelog of Ludovic’s lib.

Not really. Since 2.0.0 polkit integration is enabled by default and there is a new option to disable it. Previously, it had to be enabled by the person building the software. Some packagers decided to enable it (as Enterprise Linux derivatives do).

[packages] Contents of /cauldron/pcsc-lite/current/SPECS/pcsc-lite.spec if you are using this, they have enabled it for you - so you need to configure polkit to allow selected users to interact with the smart cards.

1 Like

I was not sure how to translate

polkit is enabled by default

from the changelog.

For me as a little to medium skilled linux user this is still not easy so

polkit is a tool (separate package with its own programs and configuration) that allows other programs to determine if the particular action of particular user in particular context should be allowed or not. Something that goes way beyond simple file or directory permissions.

pcscd with polkit integration enabled means:

  • pcscd thinks: whenever a program running as particular user needs access to the smart card, I have to talk to the polkit and let it determine if the access should be allowed.

By default, polkit will not enable users other than root to access the smartcard.

I can’t give you details how to do this on your system because I would need to dig into the details of your system too much. For example, I don’t know what are the directories where polkit files needs to be stored.

If you know how to rebuild your pcscd (using source RPM or from plain source) to disable polkit integration, it may help.

It might be easier, however, to create a polkit configuration file that allows your user access to the PC/SC integration.

1 Like

Hello @saper

I try this. Maybe this is the only way I am capable of.



I was able to build the 2.0.1 version of pcsc-lite without polkit support.
(disabling polkit)
Still can’t access the key as normal user.

for admin I get the following info

Reader ...........: 20A0:42B2:X:0
Application ID ...: D276000124010304000F6CEB5B3E0000
Application type .: OpenPGP
Version ..........: 3.4
Manufacturer .....: unknown
Serial number ....: 6CEB5B3E
Name of cardholder: Card state corrupted.
Language prefs ...: [not set]
Salutation .......: 
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 0
KDF setting ......: off
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]

Is this ok?

What means card state corrupted


I am using gpg 2.4.3 and I get this instead as a response to gpg2 --edit-card

Name of cardholder: [not set]

I wouldn’t worry too much about this, I recommend using newer GnuPG.

But in general, it seems you have solved the problem.

1 Like