Why the effort

The .deb packages from Citrix miss some features that are required in the corporate environment. Although you can point your users at Citrix webpage and tell them to download and install it, it will not always work. At the same time it is cheaper to provide a working client than to spend an hour or two per machine to explain and fix a broken installation.

State as of this writing

It is November 2012 and although Citrix committed to fixing their client, their effort has not brought much fruit yet.

Citrix original packages

Citrix provides binary-only 32-bit only .deb packages for Ubuntu. The amd64.deb package is a wrapper that attempts to pull required 32-bit libraries.

Citrix has a policy of not releasing patched versions of their packages until the next point release. However, if you have a Citrix contract, you can request a so-called "private release" which contains bugfixes by reporting one of the known bugs. The latest private release I was able to obtain is 12.1.4.217911.

Making custom packages

This may sound a lot of work, but it is really worth the effort. As you read on, I will explain which change fixes which deficiency.

I would gladly publish the fixed packages, but I have not sorted the license issues yet. So for the time being, you have to do the changes yourself.

Unpacking the .deb files

I am assuming you have downloaded the icaclient original package to the ~/Downloads directory (and you have no other version there, otherwise you need to specify it):

   1 mkdir icaclient-i386
   2 cd icaclient-i386
   3 dpkg -x ~/Downloads/icaclient-12.1*i386.deb .
   4 dpkg -e ~/Downloads/icaclient-12.1*i386.deb
   5 cd ..
   6 
   7 mkdir ctxusb-i386
   8 cd ctxusb-i386
   9 dpkg -x ~/Downloads/ctxusb-2.2*i386.deb .
  10 dpkg -e ~/Downloads/ctxusb-2.2*i386.deb

Package version

Citrix package 12.1 can mean a lot of things. In the past we were provided with 3 different binaries marked as 12.0. Since we reported the problem, it was slightly better, but still you will be safer to provide the whole build-numbered version of the package.

Change icaclient-i386/DEBIAN/control field "Version: " from 12.1 to the actual build version you get when you start the Receiver -> Help -> About. You should add the package version and some random string that would indicate your customization:

Version: 12.1.4.217911-1custom1

SSL Certificates

The Citrix packages come with just a handful of trusted certificates in opt/Citrix/ICAClient/keystore/cacerts. Your choices are:

1. Put your Xen server certificate there.
2. Put the certificate of the CA that signed your certificate.
3. Modify the package to use system CA certificates and manage them instead.

The first two you can get with just copying your certificate to icaclient-i386/opt/Citrix/ICAClient/keystore/cacerts

What I recommend, though, is to pick the last option and override the handful of certs with system certificates.

For that you need to:

1. modify icaclient-i386/DEBIAN/control field "Depends:" to include "ca-certificates" (this is the system package containing the certificates)
2. remove the directory opt/Citrix/ICAClient/keystore/cacerts and replace it with a link to /etc/ssl/certs.
3. add a shell excerpt to handle upgrades from upstream Citrix packages. In DEBIAN/preinst under:

   1  case "$1" in
   2      install|upgrade)

add

   1     ## Tieto modification to remove custom certs from /opt/Citrix/ICAClient/keystore/cacerts/
   2     if [ -e /opt/Citrix/ICAClient/keystore/cacerts -a ! -h /opt/Citrix/ICAClient/keystore/cacerts ]
   3     then
   4         mkdir -p /opt/Citrix/ICAClient/keystore/cacerts.old
   5         mv /opt/Citrix/ICAClient/keystore/cacerts/* /opt/Citrix/ICAClient/keystore/cacerts.old/ || true
   6         rmdir /opt/Citrix/ICAClient/keystore/cacerts
   7         ln -sf /etc/ssl/certs /opt/Citrix/ICAClient/keystore/cacerts
   8     fi

Packing it back together

   1 sudo chown root.root icaclient-i386
   2 version=`cat icaclient-i386/DEBIAN/control |grep Version |cut -d ' ' -f 2`
   3 sudo dpkg -b icaclient-i386 icaclient_${version}_i386.deb
   4 
   5 sudo chown root.root ctxusb-i386
   6 version=`cat ctxusb-i386/DEBIAN/control |grep Version |cut -d ' ' -f 2`
   7 sudo dpkg -b ctxusb-i386 icaclient_${version}_i386.deb