Catcrafts/fingerprintd
Watch
2
0
Fork
You've already forked fingerprintd
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
fingerprintd/packaging/fingerprintd.post-upgrade

21 lines
1.1 KiB
Text
Raw Normal View History

Depend on the extractor that understands our manifest, and restart on upgrade fp6-vendor-blobs learned the mbn directive in 1-r2. The extractor before it exits on an unknown directive, so a fresh flash with 1-r1 and our 20-focal64.manifest processes the audio fragment and then fails the blobs unit on ours: a red unit, no trustlet, and nothing in the daemon's own logs to say why. Saying >=1-r2 makes apk refuse a combination that cannot work instead of installing one that fails at first boot. Existing installs never saw this -- the old fast path only checks file lines and exits before the dispatcher. apk also swaps the binary on disk and leaves the running daemon alone, which is how 0.2.2's FingerMatched signal first presented: a clean MATCH in the journal and nothing downstream, because the boot's 0.1.3 was still answering. A post-upgrade try-restart closes that. A daemon that is not running stays not running, and a build chroot without systemd is left alone. 0.2.3, so the package CI publishes it.
2026-09-05 20:22:17 +02:00
#!/bin/sh
# SPDX-License-Identifier: GPL-3.0-only
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
#
0.2.4: the trustlet comes from the active slot, unpinned, and a refusal says why 0.2.3's manifest pinned the sha256 of one Android build's focal64 (16.82.0, the build the dev phone runs). Fairphone re-signs the trustlet every release, so that pin matched exactly one of the six builds seen, and two of two field reports had no sensor: one user on 16.100.0 edited the manifest by hand, another ended up with a file QTEE refuses. The manifest now carries '-' instead of a hash and depends on fp6-vendor-blobs 1-r3, which tries the active slot first and verifies the image's structure; QTEE's signature check is the gate it always was (one flipped byte -> ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03 and again today). post-install reassembles the trustlet right away, so 'apk add' no longer needs a boot for it. post-upgrade re-derives it from the active slot, which replaces a hand-placed or wrongly pinned file, and then restarts the daemon -- a plain restart, so a daemon that exited on a refused trustlet comes back up on the re-derived one. loadFromBuffer failures name the loader's verdict. The field's first report was a bare result=12; it now reads ERROR_ELF_SIGNATURE_ERROR with what to do about it. Probed on the phone with this build: a one-byte tampered image and 100000 random bytes both print it, the pristine image loads, and the suites pass 8/8.
2026-09-11 13:04:35 +02:00
# Two things an upgrade must do on a running phone. First re-derive the
# trustlet from the active slot: 0.2.3 pinned one Android build's hash, so a
# phone on any other build has no trustlet, or a hand-placed one, and
# --refresh replaces it with the phone's own (fp6 journal, fingerprint lane,
# 2026-09-11). --if-device keeps this a no-op inside build/CI chroots.
/usr/lib/fp6-vendor-blobs/extract --if-device --refresh || :
Depend on the extractor that understands our manifest, and restart on upgrade fp6-vendor-blobs learned the mbn directive in 1-r2. The extractor before it exits on an unknown directive, so a fresh flash with 1-r1 and our 20-focal64.manifest processes the audio fragment and then fails the blobs unit on ours: a red unit, no trustlet, and nothing in the daemon's own logs to say why. Saying >=1-r2 makes apk refuse a combination that cannot work instead of installing one that fails at first boot. Existing installs never saw this -- the old fast path only checks file lines and exits before the dispatcher. apk also swaps the binary on disk and leaves the running daemon alone, which is how 0.2.2's FingerMatched signal first presented: a clean MATCH in the journal and nothing downstream, because the boot's 0.1.3 was still answering. A post-upgrade try-restart closes that. A daemon that is not running stays not running, and a build chroot without systemd is left alone. 0.2.3, so the package CI publishes it.
2026-09-05 20:22:17 +02:00
#
0.2.4: the trustlet comes from the active slot, unpinned, and a refusal says why 0.2.3's manifest pinned the sha256 of one Android build's focal64 (16.82.0, the build the dev phone runs). Fairphone re-signs the trustlet every release, so that pin matched exactly one of the six builds seen, and two of two field reports had no sensor: one user on 16.100.0 edited the manifest by hand, another ended up with a file QTEE refuses. The manifest now carries '-' instead of a hash and depends on fp6-vendor-blobs 1-r3, which tries the active slot first and verifies the image's structure; QTEE's signature check is the gate it always was (one flipped byte -> ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03 and again today). post-install reassembles the trustlet right away, so 'apk add' no longer needs a boot for it. post-upgrade re-derives it from the active slot, which replaces a hand-placed or wrongly pinned file, and then restarts the daemon -- a plain restart, so a daemon that exited on a refused trustlet comes back up on the re-derived one. loadFromBuffer failures name the loader's verdict. The field's first report was a bare result=12; it now reads ERROR_ELF_SIGNATURE_ERROR with what to do about it. Probed on the phone with this build: a one-byte tampered image and 100000 random bytes both print it, the pristine image loads, and the suites pass 8/8.
2026-09-11 13:04:35 +02:00
# Then restart the daemon: apk replaces /usr/bin/fingerprintd on disk and
# leaves the running one alone, so the phone would keep matching with the OLD
# code until a reboot (how 0.2.2's FingerMatched signal first presented,
# 2026-09-05). A plain restart rather than try-restart: a daemon that exited
# on a refused trustlet is not running and must come up on the re-derived
# file, and the unit's ConditionPathExists lines keep this inert on a phone
# with no trustlet or no /dev/tee0. No systemd inside a chroot.
Depend on the extractor that understands our manifest, and restart on upgrade fp6-vendor-blobs learned the mbn directive in 1-r2. The extractor before it exits on an unknown directive, so a fresh flash with 1-r1 and our 20-focal64.manifest processes the audio fragment and then fails the blobs unit on ours: a red unit, no trustlet, and nothing in the daemon's own logs to say why. Saying >=1-r2 makes apk refuse a combination that cannot work instead of installing one that fails at first boot. Existing installs never saw this -- the old fast path only checks file lines and exits before the dispatcher. apk also swaps the binary on disk and leaves the running daemon alone, which is how 0.2.2's FingerMatched signal first presented: a clean MATCH in the journal and nothing downstream, because the boot's 0.1.3 was still answering. A post-upgrade try-restart closes that. A daemon that is not running stays not running, and a build chroot without systemd is left alone. 0.2.3, so the package CI publishes it.
2026-09-05 20:22:17 +02:00
[ -d /run/systemd/system ] || exit 0
0.2.4: the trustlet comes from the active slot, unpinned, and a refusal says why 0.2.3's manifest pinned the sha256 of one Android build's focal64 (16.82.0, the build the dev phone runs). Fairphone re-signs the trustlet every release, so that pin matched exactly one of the six builds seen, and two of two field reports had no sensor: one user on 16.100.0 edited the manifest by hand, another ended up with a file QTEE refuses. The manifest now carries '-' instead of a hash and depends on fp6-vendor-blobs 1-r3, which tries the active slot first and verifies the image's structure; QTEE's signature check is the gate it always was (one flipped byte -> ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03 and again today). post-install reassembles the trustlet right away, so 'apk add' no longer needs a boot for it. post-upgrade re-derives it from the active slot, which replaces a hand-placed or wrongly pinned file, and then restarts the daemon -- a plain restart, so a daemon that exited on a refused trustlet comes back up on the re-derived one. loadFromBuffer failures name the loader's verdict. The field's first report was a bare result=12; it now reads ERROR_ELF_SIGNATURE_ERROR with what to do about it. Probed on the phone with this build: a one-byte tampered image and 100000 random bytes both print it, the pristine image loads, and the suites pass 8/8.
2026-09-11 13:04:35 +02:00
systemctl restart fingerprintd.service 2>/dev/null || :
Depend on the extractor that understands our manifest, and restart on upgrade fp6-vendor-blobs learned the mbn directive in 1-r2. The extractor before it exits on an unknown directive, so a fresh flash with 1-r1 and our 20-focal64.manifest processes the audio fragment and then fails the blobs unit on ours: a red unit, no trustlet, and nothing in the daemon's own logs to say why. Saying >=1-r2 makes apk refuse a combination that cannot work instead of installing one that fails at first boot. Existing installs never saw this -- the old fast path only checks file lines and exits before the dispatcher. apk also swaps the binary on disk and leaves the running daemon alone, which is how 0.2.2's FingerMatched signal first presented: a clean MATCH in the journal and nothing downstream, because the boot's 0.1.3 was still answering. A post-upgrade try-restart closes that. A daemon that is not running stays not running, and a build chroot without systemd is left alone. 0.2.3, so the package CI publishes it.
2026-09-05 20:22:17 +02:00
exit 0
Reference in a new issue Copy permalink