37 lines
1.7 KiB
Markdown
37 lines
1.7 KiB
Markdown
|
# `fingerprintd.json` — where it comes from, and why this exact file
|
||
|
|
|
||
|
|
The trustlet gates its config file on `common.configuration_uuid` and silently
|
||
|
|
falls back to built-in defaults on a mismatch, so the file is not decorative:
|
||
|
|
`SYNC_CONFIG` returning 0 is what makes the whole init chain run.
|
||
|
|
|
||
|
|
This copy is generated, not hand-written. Its source is `fp6fpcfg.py` in the
|
||
|
|
fp6 bring-up repo, which builds it from the captured stock configuration dump
|
||
|
|
(`journal/fingerprint/captures/2026-08-25-focal64-effective-config-from-stock.txt`):
|
||
|
|
|
||
|
|
```sh
|
||
|
|
utilities/fp6fpcfg.py --daemon --verbose > packaging/fingerprintd.json
|
||
|
|
```
|
||
|
|
|
||
|
|
sha256 begins `b205c756914a66f1`.
|
||
|
|
|
||
|
|
## Why the `--verbose` variant
|
||
|
|
|
||
|
|
`--verbose` here is the *trustlet's* own log level, not the daemon's. It is
|
||
|
|
shipped because it is the file every accuracy number was measured on — 30/30
|
||
|
|
held presses, zero false accepts, 36-330 ms to a verdict — and the TA's log
|
||
|
|
level cannot be raised again by a runtime `SYNC_CONFIG`, so a session that
|
||
|
|
needs the matcher's own lines has to have started with it.
|
||
|
|
|
||
|
|
`--daemon` alone produces the same file with trustlet logging off (sha256
|
||
|
|
`6c4503e628406424`, four `diagnosis.*` keys differ and nothing else). It is
|
||
|
|
plausibly the better shipping default and it is **untested**: no rate in the
|
||
|
|
journal was measured on it. Switching is a measurement, not an edit.
|
||
|
|
|
||
|
|
## The two policy keys
|
||
|
|
|
||
|
|
* `common.max_authentication_rescan_times: 0` — at the stock budget a wrong
|
||
|
|
finger never yields a terminal frame, so a PAM client waits forever for the
|
||
|
|
`verify-no-match` it needs.
|
||
|
|
* `trustlet.enable_trusted_enrollment: false` — skips the challenge compare
|
||
|
|
and the `hw_auth_token` HMAC verify. pmOS has no Gatekeeper to issue a token
|
||
|
|
and nothing on pmOS verifies one.
|