Revision 2 as of 2012-11-20 08:51:51

Clear message

Why the effort

The .deb packages from Citrix miss some features that are required in the corporate environment. Although you can point your users at Citrix webpage and tell them to download and install it, it will not always work. At the same time it is cheaper to provide a working client than to spend an hour or two per machine to explain and fix a broken installation.

State as of this writing

It is November 2012 and although Citrix committed to fixing their client, their effort has not brought much fruit yet.

Citrix original packages

Citrix provides binary-only 32-bit only .deb packages for Ubuntu. The amd64.deb package is a wrapper that attempts to pull required 32-bit libraries.

Citrix has a policy of not releasing patched versions of their packages until the next point release. However, if you have a Citrix contract, you can request a so-called "private release" which contains bugfixes by reporting one of the known bugs. The latest private release I was able to obtain is

Making custom packages

This may sound a lot of work, but it is really worth the effort. As you read on, I will explain which change fixes which deficiency.

I would gladly publish the fixed packages, but I have not sorted the license issues yet. So for the time being, you have to do the changes yourself.

Unpacking the .deb files

I am assuming you have downloaded the icaclient original package to the ~/Downloads directory (and you have no other version there, otherwise you need to specify it):

   1 mkdir icaclient-i386
   2 cd icaclient-i386
   3 dpkg -x ~/Downloads/icaclient-12.1*i386.deb .
   4 dpkg -e ~/Downloads/icaclient-12.1*i386.deb
   5 cd ..
   7 mkdir ctxusb-i386
   8 cd ctxusb-i386
   9 dpkg -x ~/Downloads/ctxusb-2.2*i386.deb .
  10 dpkg -e ~/Downloads/ctxusb-2.2*i386.deb

Package version

Citrix package 12.1 can mean a lot of things. In the past we were provided with 3 different binaries marked as 12.0. Since we reported the problem, it was slightly better, but still you will be safer to provide the whole build-numbered version of the package.

Change icaclient-i386/DEBIAN/control field "Version: " from 12.1 to the actual build version you get when you start the Receiver -> Help -> About. You should add the package version and some random string that would indicate your customization:


SSL Certificates

The Citrix packages come with just a handful of trusted certificates in opt/Citrix/ICAClient/keystore/cacerts. Your choices are:

  1. Put your Xen server certificate there.
  2. Put the certificate of the CA that signed your certificate.
  3. Modify the package to use system CA certificates and manage them instead.

The first two you can get with just copying your certificate to icaclient-i386/opt/Citrix/ICAClient/keystore/cacerts

What I recommend, though, is to pick the last option and override the handful of certs with system certificates.

For that you need to:

  1. modify icaclient-i386/DEBIAN/control field "Depends:" to include "ca-certificates" (this is the system package containing the certificates)
  2. remove the directory opt/Citrix/ICAClient/keystore/cacerts and replace it with a link to /etc/ssl/certs.
  3. add a shell excerpt to handle upgrades from upstream Citrix packages. In DEBIAN/preinst under:

   1  case "$1" in
   2      install|upgrade)


   1     ## Tieto modification to remove custom certs from /opt/Citrix/ICAClient/keystore/cacerts/
   2     if [ -e /opt/Citrix/ICAClient/keystore/cacerts -a ! -h /opt/Citrix/ICAClient/keystore/cacerts ]
   3     then
   4         mkdir -p /opt/Citrix/ICAClient/keystore/cacerts.old
   5         mv /opt/Citrix/ICAClient/keystore/cacerts/* /opt/Citrix/ICAClient/keystore/cacerts.old/ || true
   6         rmdir /opt/Citrix/ICAClient/keystore/cacerts
   7         ln -sf /etc/ssl/certs /opt/Citrix/ICAClient/keystore/cacerts
   8     fi


I found that VDFLASH2.DLL and VORBIS.DLL files are linked against libstdc++. You should thus add "libstdc++6" to "Recommends:" section in DEBIAN/control. Why Recommends, not Depends? Well, flash and vorbis support are not obligatory, either.

Although most systems have libstdc++6 library installed, it may not be the case for multi-arch (see below).

Microphone input

By default, microphone input is disabled and the user does not get any indication that it can be turned on. This, I was told, was caused by privacy concerns.

What I do, is I enable the microphone pass-through by default. Edit etc/icaclient/nls/*/wfclient.ini and add:


into the [WFClient] section.

License question

Although you should be able to seed the answer to the license question now with:

echo icaclient icaclient/accepteula select true | sudo debconf-set-selections
echo ctxusb ctxusb/accepteula select true | sudo debconf-set-selections

I bumped to a number of problems in the past that the question popped up anyway due to weak implementation. As it is the company that accepts the license anyway, not the user himself, I do not find it as a breach of license to remove the question.

To remove it:

  1. Delete icaclient-i386/DEBIAN/control
  2. Edit DEBIAN/preinst under:

   1  case "$1" in
   2      install|upgrade)


    if [ "yes" = "yes" ]


    if [ "yes" = "no" ]

and add this *before* the condition:

   1     ## Tieto hack to get rid of the license question
   2     db_set icaclient/accepteula true
   3     db_fset icaclient/accepteula seen true

Multi-arch support

Why care about multi-arch? Well, there is a number of reasons:

  1. The amd64 package from Citrix is actually 1:1 i386 with just slightly modified control file to include ia32-libs.
  2. The Citrix ia32-libs dependency pulls a lot of libraries you will never use and not even the ones that offer multimedia support.
  3. Multi-arch has been enabled from Ubuntu Oneiric (11.10) and in all releases to date (12.10).

How to handle i386 packages on amd64

Since multi-arch is enabled by default, you can just install a 32-bit package on amd64 and apt should satisfy its dependencies.

If you you want to install the Receiver by clicking it out (ok, I know, you want it automated, just read on), the package manager should handle the apt dependencies when you double-click a fixed icaclient package.

You can try installing it with dpkg -i, but afterwards you will need to satisfy its dependencies with apt-get install -f.

The best approach, though, is to provide a package repository so that people can check it out from the Software Centre or your software configuration manager can install it for you.

At that point you can just run:

sudo apt-get install ctxusb:i386 icaclient:i386"

or make the CM do it for you.

Fixes for multi-arch

Although the upstream i386 packages can be installed on amd64 without modifications, the dependencies will be at flaw. To fix it, add:

Multi-Arch: foreign

below Conflicts: in icaclient-i386/DEBIAN/control.

Fixes for ctxusb

Fix the version

ctxusb will not tell you which build it is. I use the same build version number as the one accompanying the icaclient package, like this (in ctxusb-i386/DEBIAN/control):



The same "Multi-Arch: foreign" line in ctxusb-i386/DEBIAN/control is required as in icaclient (see above).

License question

The same changes as in icaclient need to be performed in ctxusb to get rid of the license question.

Packing it back together

   1 sudo chown root.root icaclient-i386
   2 version=`cat icaclient-i386/DEBIAN/control |grep Version |cut -d ' ' -f 2`
   3 sudo dpkg -b icaclient-i386 icaclient_${version}_i386.deb
   5 sudo chown root.root ctxusb-i386
   6 version=`cat ctxusb-i386/DEBIAN/control |grep Version |cut -d ' ' -f 2`
   7 sudo dpkg -b ctxusb-i386 icaclient_${version}_i386.deb

Other deployment topics to note