Help center support eXpress

We've collected answers to popular questions to make eXpress easy and convenient to use. Didn't find the answer to your question? Contact our support team.

Linux Desktop App
Updated 9 Oct 2026

Linux Desktop App

RTS
Lite
CTS
ETS

System Requirements for Linux

Computer
  • At least 4 GB of RAM
  • CPU with actual clock speed from 2.6 GHz (including Turbo Boost), 4 logical cores (threads)
  • At least 1 GB of free disk space
Operating System
  • Linux x64: Ubuntu 18.04, Fedora 32, Debian 10, Astra Linux 1.7 and newer, Alt Linux, and other Linux distributions. To check the Linux version, enter lsb_release -a in the terminal.
Additional Conditions
  • Install the gnome-keyring keyring if it is not present on the system.
    Debian, Ubuntu, Astra Linux: sudo apt install gnome-keyring
    Red Hat-like (RED OS, Fedora): sudo dnf install gnome-keyring
    ALT Linux: sudo apt-get install gnome-keyring
    In a KDE environment, gnome-keyring is not needed: KDE uses its own keyring — KWallet (learn more).
  • To run AppImage, FUSE version 2 library is required.
    Ubuntu 24.04 and later: sudo apt install libfuse2t64
    Earlier Debian-based systems: sudo apt install libfuse2
    Red Hat-based (RED OS, Fedora): sudo dnf install fuse-libs
    On Astra Linux 1.8 and RED OS 8, the required libraries are preinstalled.
  • Install libappindicator3-1 for Astra Linux 1.7 or below, or the installation will fail with the error “Dpkg operation interrupted”.
    Command: sudo dpkg --configure -a, then sudo apt-get install libappindicator3-1
  • In Astra Linux 2.12 and earlier, the GLIBC library is outdated; version 2.28 is required. Update Astra Linux.

    • After installing the libraries, log out and back in or restart the computer.

  • Time synchronization with an NTP server (see OS documentation).
Required Permissions
  • Access to the microphone, camera, and notifications (see OS documentation).
The requirements for virtual backgrounds and video background blur are described separately.

DEB Package Signing for Astra Linux With Closed Software Environment Enabled

ETS

If Astra Linux has the closed software environment (CSE, integrity control) mode enabled, the system blocks installation of packages that are not signed with a trusted digital signature. The standard eXpress DEB package does not have such a signature, so installation will fail.

For the branded ETS app to work in the closed software environment, request the package signature from eXpress support. Add the obtained developer key to trusted keys according to Astra Linux documentation.

App Formats for Linux

SHA512 checksums and version information for the eXpress desktop app can be checked in YML files: eXpress | eXpress Corporate.
Package Format For which systems
DEB

For Debian-based systems (Ubuntu, Astra Linux).
Download: eXpress | eXpress Corporate
RPM

For Red Hat-based systems (ALT, Red OS, Fedora, RHEL-like).
Download: eXpress | eXpress Corporate
AppImage

For any Linux OS.
Download: eXpress | eXpress Corporate

Installation on Linux

Standard Installation

Package Format How to install
DEB
  • Double-click to run > installation will proceed in the package manager.
  • Via terminal: sudo apt install ./eXpress.deb
    Dependencies will be installed automatically. Without ./ before the file name, apt will search for the package in the repositories.
RPM
  • Double-click to run > installation will proceed in the package manager.
  • Via terminal: sudo dnf install ./eXpress.rpm
    For installation on ALT Linux, see below.
    ⚠️ Installing multiple desktop apps via RPM (eXpress + eXpress Corporate + ETS app) is not supported: the files in their packages conflict. Updating the same application is possible: the new version is installed over the old one using the standard installation command.
AppImage
  • Enable the “executable” or “allow execution” property for the file > double-click to run.
  • Via terminal: chmod +x eXpress.AppImage ./eXpress.AppImage

Are There Repositories for Automatic Installation on Linux?

There are no public eXpress repositories for Linux. Many organizations set up their own local repository. The latest package is downloaded automatically from permanent links (see App Formats for Linux) and is uploaded to the organization's repository. Then the workstations are updated using the package manager's standard tools. The version and hash sums of the current package can be obtained automatically from the YML files specified in the same section.

Installing on ALT Linux

Starting with version 3.68, the RPM package requires the dependencies (libXtst or libXtst6) and (libuuid or libuuid1). The apt-get package manager in ALT Linux does not support such conditional (boolean) dependencies. The apt-get install command fails with unmet dependencies, even though the libraries themselves are present on the system.

Installing on a Single Computer

Install the package with the rpm command:

sudo rpm -i eXpress.rpm

⚠️ After such an installation, apt-get stops installing other packages and updating the system: it sees unmet dependencies for eXpress. The apt-get --fix-broken install command removes eXpress. If you need apt-get on the computer, repackage the package (see the row below) or use AppImage.
Installing and Updating via Your Own Repository

Before putting the package into the local repository, rebuild it without conditional dependencies. Either of the two utilities from the standard ALT repository will work.

epm (the eepm package):

epm repack eXpress.rpm

⚠️ When repackaging, epm does not transfer the installation scripts of the source package, so the symbolic link /usr/bin/express is not created. Launching from the application menu works as usual. If you need the link, create it manually: ln -sf /opt/eXpress/express /usr/bin/express.

rpmrebuild preserves the installation scripts. Rebuilding requires more than 2 GB in the temporary folder. In ALT, the /tmp folder is placed in RAM, so set the temporary folder on disk:

sudo apt-get install rpmrebuild echo '%__find_scriptlet_requires /bin/true' >> ~/.rpmmacros mkdir -p ~/rpmrebuild-tmp ~/rpmrebuild-out export RPMREBUILD_TMPDIR=~/rpmrebuild-tmp rpmrebuild -p -n -d ~/rpmrebuild-out --change-spec-requires='sed -e "s/(libXtst or libXtst6)/libXtst/" -e "s/(libuuid or libuuid1)/libuuid/"' eXpress.rpm

The line in ~/.rpmmacros disables automatic dependency detection for installation scripts. Without it, the ALT builder will add a dependency on /usr/bin/ischroot, and apt-get will refuse to install the package. The line applies to all builds by this user.

Place the resulting package in the local repository and update its indexes. After that, installation and updating are performed as usual: apt-get update && apt-get dist-upgrade. The repackaging step can be automated with a script on the repository server.

On computers where the package is already installed via rpm -i, apt-get will be fixed when the next version is installed from the repository. To fix it immediately, remove the package with the rpm -e command and install it from the repository via apt-get install.

The package is modified after repackaging. When contacting support, state that you are using a repackaged build.
Without a Repository and Without Modifying the Package

Use AppImage. It does not register in the package database and does not affect apt-get. The app in AppImage format finds and installs updates itself.

Installing Certificates on Linux

CTS
ETS

Corporate server certificates are installed so that the connection works. By default, this is not required.

On Astra Linux and RED OS, the Ministry of Digital Development National Certification Authority certificates are already included in the system — if the server has switched to them, no installation is needed.

For Administrators: Installing a Certificate on Linux

Step 1. Install the Certificate in the System-Wide Store

The procedure depends on the distribution family.

Linux family Steps
Debian, Ubuntu, Linux Mint, Astra Linux, Kali Linux
and their derivatives
  1. Check whether the /usr/local/share/ca-certificates directory exists:
    ls -l /usr/local/share/ca-certificates
    If it doesn't exist yet, create it:
    sudo mkdir /usr/local/share/ca-certificates
    The certificate must be in PEM format and have the .crt extension. Typically, the certificate is already in PEM format. If your certificate has a .pem extension, change it to .crt.

  2. Copy your certificate with the command:
    sudo cp ./CERTIFICATE.crt /usr/local/share/ca-certificates/
  3. Update the system-wide list:
    sudo update-ca-certificates
  4. Check that your certificate is among the trusted certificates:
    awk -v cmd='openssl x509 -noout -subject' ' /BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt | grep -i CERTIFICATE
RED OS, ALT Linux, RHEL, CentOS, Fedora
and their derivatives
  1. Copy the certificate to the trusted directory:
    sudo cp ./CERTIFICATE.crt /etc/pki/ca-trust/source/anchors/
  2. Update the system-wide list of trusted certificates:
    sudo update-ca-trust extract
  3. Check the result:
    grep -c "CERTIFICATE" /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
Arch Linux, BlackArch
and their derivatives
  1. Run the command:
    sudo cp ./CERTIFICATE.crt /etc/ca-certificates/trust-source/anchors/
  2. Update the system-wide list of trusted certificates:
    sudo update-ca-trust

Step 2. Check Whether This Is Enough for the Desktop App

On some distributions, the desktop app takes certificates from its own user database instead of the system-wide store. Symptom: curl and browsers connect to the server normally, but the app returns a certificate error.

Distribution Is the system-wide store enough?
Astra Linux, RED OS Yes, step 1 is enough.
Debian, Ubuntu, Linux Mint
and their derivatives		 No. Additionally perform step 3.

If your distribution is not in the table, check with the command:

readlink -f /usr/lib/x86_64-linux-gnu/libnssckbi.so /usr/lib64/libnssckbi.so 2>/dev/null

If the output contains p11-kit-trust.so — the system-wide store is enough. If the file links to itself or the command outputs nothing — perform step 3.

Step 3. Install the Certificate in the User's Certificate Database (NSS)

Perform the step as the user under which the app runs, without sudo.

  1. Install the certutil utility — on most distributions it is not included in the base installation:
    sudo apt install libnss3-tools
    for RPM distributions:
    sudo dnf install nss-tools
  2. Add the root certificate:
    certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n "Certificate name" -i ./CERTIFICATE.crt
  3. If the certificate has an intermediate, add it too — with different trust flags:
    certutil -d sql:$HOME/.pki/nssdb -A -t ",," -n "Intermediate name" -i ./INTERMEDIATE.crt
  4. Check that the entries appeared:
    certutil -d sql:$HOME/.pki/nssdb -L

If certutil reports SEC_ERROR_BAD_DER, the certificate file is in binary DER format. Convert it and try again:

openssl x509 -inform DER -in CERTIFICATE.cer -out CERTIFICATE.crt

Step 4. Restart the App

Fully quit the app — closing the window is not enough; it keeps running in the notification area. You can check and quit it like this:

ps aux | grep -i express

After that, start the app again.

If your organization's server has switched to Ministry of Digital Development National Certification Authority certificates, see the instructions.

Credential Storage on Linux

The app stores authentication data in the system keyring. The keyring provides the Secret Service. Which keyring the app uses depends on the desktop environment:

  • gnome-keyring — in GNOME and most other environments. To view keys, open Passwords and Keys (Seahorse) in Ubuntu, Astra Linux, and others;
  • KWallet — in the KDE environment (in Plasma 6, the service is provided by the ksecretd component). To view keys, open KDE Wallet.
If both keyrings are installed on the system, the app uses the one that first claimed the Secret Service when the session started. Therefore, on the same machine, the prompt may look different: the Unlock Keyring window (gnome-keyring) or the KDE Wallet Service wizard (KWallet).

Creating a Keyring

If no application has yet created a keyring on the system, the system will prompt you to create one when eXpress starts:
Environment What happens
GNOME and others The system will open a window and prompt you to create a password for the keyring. ⚠️ On subsequent app launches, the system may ask for this password again.
KDE

When the app first accesses the keyring in KDE, the KDE Wallet Service wizard opens. The wizard prompts you to choose the encryption type:

  • Classic blowfish encryption — the wallet is protected with a password. If the password is left blank, the system will not prompt for it every time the app starts;
  • Use GPG encryption for better protection — the wallet is encrypted with an existing GPG key.
⚠️ The GPG option requires the user to already have a GPG key suitable for encryption. If no keys exist, the wizard shows the error “It seems there are no keys suitable for encryption in your system. Install at least one encryption key and try again,” and does not offer to create a key.

What to do if this error occurs: click OK > < Back and select Classic blowfish encryption. Alternatively, create a GPG key in advance with the command:
gpg --quick-generate-key "First Last <user@example.com>" default default never
then try again — the wizard will offer to select the created key.

Removing App Keys from the Keyring

If you remove the app's authentication keys from the keyring, the authentication screen will open after the app restarts. With a standard app uninstall, the keys are preserved.

For Administrators: Application-Specific Keystore
ETS
 Since version 3.42, you can configure a non-system app keystore in the /home/user_name/.config/app_name folder in an
ETS
build. Contact eXpress support to get more details.

Updating on Linux

The app in AppImage format finds updates on its own and offers to install them. The app from a DEB or RPM package finds updates, but you have to download and install them manually (details). Check for updates manually: Settings (avatar button) > Check for updates.

For Administrators: Additional Update Options

Disabling Update Checks

  • Create an AppConfig.json in the /home/user_name/.config/app_name folder and add:
    { "AutoUpdate": false, "Update": false }
    Pre-made file: AppConfig.json. Version 3.54 or above is required.
  • Or, block access to the updates.express.ms resource. If an
    ETS
    app has its own update server configured, the app contacts it.

Standard Update

An app is updated manually in the same way as it is installed (see above).

⚠️ After installing the new package, restart the app. Installing a package doesn’t send an update signal to the running application. Therefore, the running instance continues to run with old files that no longer exist on disk. This looks like a “broken window”: the app doesn't close normally and has to be force-quit.
For Administrators: Centralized Updates via Puppet, Ansible, or a Package Manager If the package is installed centrally via Puppet, Ansible, or a package manager on a schedule, add an app restart as a separate step after the package installation. Without a restart, the files on disk will be updated, but the running app will remain with the old ones.

Uninstalling on Linux

Before uninstalling, close the application via the system tray icon — otherwise it will continue running from the already deleted files until restarted.
Package Format How to uninstall
DEB
  • Via the package manager: find the app in the list of installed programs and select “Remove”.
  • Via the terminal (for example, Ubuntu). For ETS builds, the package name differs from express, so first find the exact package name:
    dpkg -l | grep -i express
    then uninstall:
    sudo apt remove package_name
RPM
  • Via the package manager: find the application in the list of installed programs and select “Remove”.
  • Via the terminal: first find the exact package name:
    rpm -qa | grep -i express
    then uninstall:
    sudo dnf remove package_name
    On systems without dnf (for example, ALT Linux):
    sudo rpm -e package_name
AppImage
  • Delete the eXpress.AppImage file.
  • If AppImageLauncher was used for menu integration or the shortcut was pinned manually, additionally remove the integration file (usually in ~/.local/share/applications) and the pinned shortcut.
For an ETS app, the package name, keys, and folders will use the ETS app's name instead of eXpress.
For Administrators: Uninstalling the App With Full Cleanup of Traces
  1. Uninstall the app using the standard method (see the table above).
  2. Open the keyring manager (Passwords and Keys in Ubuntu, KDE Wallet in KDE, Seahorse in Astra Linux, and others) and delete the keys that start with eXpress.
  3. Delete the app profile folder in the file manager:
    /home/username/.config/eXpress
    or via the terminal:
    rm -rf ~/.config/eXpress
  4. Delete the remaining local user data:
    rm -rf ~/.cache/eXpress ~/.local/share/eXpress ~/.local/state/eXpress
  5. If the app was added to autostart, delete its shortcut:
    rm -f ~/.config/autostart/eXpress.desktop
  6. Check for installation leftovers. Usually, the package manager removes them, but after uninstalling the RPM package, the empty /opt/eXpress directory remains:
    sudo rm -rf /opt/eXpress /usr/bin/express /usr/share/applications/express.desktop
  7. For AppImage, additionally delete the eXpress.AppImage file, and if AppImageLauncher was used — the integration file in ~/.local/share/applications and the pinned shortcut.

Related questions