fingerprintd/packaging/20-focal64.manifest

# FocalTech FT9391 trustlet (proprietary, OEM-signed) - reassembled from the
# stock modem partition on-device instead of being shipped (fp6 repo
# journal/blobs/, journal/fingerprint/). It is the matcher: every pixel the
# sensor produces stays inside it, and no part of the daemon can substitute
# for it. QTEE's signature gate is fused OEM root, measured 2026-09-03, so
# there is no version of this that is our own code.
#
# Not one file: image/focal64.mdt plus focal64.b00..b08, placed at each ELF
# segment's p_offset. Slot A first, slot B as fallback. The sha256 is of the
# reassembled image and is the one QTEE has actually accepted since
# 2026-08-24.
mbn modem_a,modem_b image focal64 /usr/lib/firmware/focal64.mbn 1930c490d67e6f006ec346d3bee9f73d812bc0b7374bfc112873dc97ebb6cd68
A verify nobody answered is not a failure, and the trustlet is not ours to ship Two things the packaging left behind. A verify that ran its 600-frame budget without the sensor being touched was reported to the client as verify-unknown-error. Nothing had gone wrong: nobody had pressed. It cost three verifications during packaging, each reading as a broken daemon. fprintd's contract is that a verify runs until the client stops it, so the frame cap bounds one trustlet scan session rather than the user's patience, and a window with no press simply runs again. Verified across the rollover: 600 frames untouched, "still waiting", then a press matching on its first contact frame in 44 ms. Presses that happen and never reach a verdict now report verify-retry-scan -- a bad scan, which fprintd has a word for, and not the matcher saying no. The cost is that an unanswered verify polls every ~200 ms for as long as the client holds it. The cure is measured and available -- gpio75 is silent at idle and bursts on contact -- but it would make the IRQ the only way a press is ever noticed, deleting the poll under every rate this daemon has been measured at. Noted where the loop waits, not done. And the trustlet: focal64.mbn is a proprietary OEM-signed blob, so the package ships a fp6-vendor-blobs manifest fragment instead, the same mechanism soc-fairphone-fp6-audio uses for the amp config. It needed a new directive there -- a QTEE image is an ELF header file plus one payload per program header, not one file -- and reassembly on the phone reproduces the image QTEE has accepted since August, byte for byte. 2026-09-05 04:01:06 +02:00			`# FocalTech FT9391 trustlet (proprietary, OEM-signed) - reassembled from the`
			`# stock modem partition on-device instead of being shipped (fp6 repo`
			`# journal/blobs/, journal/fingerprint/). It is the matcher: every pixel the`
			`# sensor produces stays inside it, and no part of the daemon can substitute`
			`# for it. QTEE's signature gate is fused OEM root, measured 2026-09-03, so`
			`# there is no version of this that is our own code.`
			`#`
			`# Not one file: image/focal64.mdt plus focal64.b00..b08, placed at each ELF`
			`# segment's p_offset. Slot A first, slot B as fallback. The sha256 is of the`
			`# reassembled image and is the one QTEE has actually accepted since`
			`# 2026-08-24.`
			`mbn modem_a,modem_b image focal64 /usr/lib/firmware/focal64.mbn 1930c490d67e6f006ec346d3bee9f73d812bc0b7374bfc112873dc97ebb6cd68`