Catcrafts/fingerprintd
Watch
2
0
Fork
You've already forked fingerprintd
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Package the daemon, so a fingerprint survives a reflash

Browse source 
An aport, the units, and everything a phone needs to come up with a working
sensor without a single command being run by hand. Verified on the dev phone
across two reboots: modules-load.d loads qcomtee, tmpfiles builds the SFS
root, the mount unit brings up persist, and the daemon is ready 51 seconds
into the boot, owning net.reactivated.Fprint with the enrolled finger
visible.

The packaging shape is the one imsd uses for 81voltd. A versioned
provides="fprintd=..." satisfies plasma-workspace -- its Users KCM is the
enrolment UI and speaks exactly this bus name -- and excludes the real
fprintd, which is not tidiness: fprintd is D-Bus-activatable, so a client
call would otherwise start it and fight us for the name. The cost is the
fprintd-* CLIs, which go with the package.

fprintd-pam is an install_if subpackage pinned to the exact fprintd version,
so the provides breaks its condition and apk purges it -- taking pam_fprintd,
which is the entire point of the daemon, with it. Depending on it explicitly
is what keeps it, and it has no dependency on fprintd itself.

Two things the packaging exposed in the daemon:

The transcript is for experiments, not for a shipped daemon. A file per start
in an unrotated directory, recording the time of every unlock, to say what
the journal already has. It is now opt-in behind --log-dir, which is what
deploy-dev.sh passes since fplearn.sh reads it.

Taking it off the daemon path also took away the setvbuf it was doing as a
side effect of dup2'ing fd 1, and under systemd stdout is a pipe, which means
full buffering: the daemon started, worked, answered D-Bus calls, and printed
nothing. A working daemon that looks hung. stdout is now line-buffered from
the first line of main.

The config ships as generated by fp6fpcfg.py --daemon --verbose, sha256
b205c756914a66f1, because that is the file every accuracy number was measured
on. The quieter variant is untested and switching is a measurement.

The trustlet is not here and never will be: focal64.mbn is a proprietary
OEM-signed blob, and the unit's ConditionPathExists is what keeps the package
inert without it -- as it does on a kernel with no CONFIG_QCOMTEE.
This commit is contained in:
Jorijn van der Graaf 2026-09-05 02:52:01 +02:00
commit 905e261d63
15 changed files with 518 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

30
implementations/main.cpp
View file

@ -66,7 +66,7 @@ namespace {
// Bumping this is what publishes a package: the registry answers 409 for a
// version it already has, which a build treats as a no-op.
constexpr const char* Version = "0.1.0";
constexpr const char* Version = "0.1.1";
bool g_verbose = false;
// 500 ms was the research harness's pace, chosen so a human could read the
@ -87,6 +87,9 @@ int g_samples = -1;
constexpr int SamplesFallback = 20; // stock's value, if the config lacks the key
bool g_samplesForced = false;
std::string g_logDir = "/var/log/fingerprintd";
// Only an explicit --log-dir turns the transcript on for the daemon; see
// StartTranscript.
bool g_logDirExplicit = false;
std::string g_stateDir = "/var/lib/fingerprintd";
int g_rescan = -1; // -1 = leave the config's value alone
@ -172,11 +175,16 @@ std::string g_cfgPath = "/lib/firmware/fingerprintd.json";
qcomtee_object* g_root = QCOMTEE_OBJECT_NULL;
// Every run writes its own timestamped transcript. Not a convenience: a run
// whose result nobody recorded is a run that has to be repeated on a human's
// finger. And a SINGLE shared log path is worse than none -- the next run,
// including a quick control, destroys the interesting one, which is how the
// first successful authentication in this project was very nearly lost.
// Every PROBE run writes its own timestamped transcript. Not a convenience: a
// run whose result nobody recorded is a run that has to be repeated on a
// human's finger. And a SINGLE shared log path is worse than none -- the next
// run, including a quick control, destroys the interesting one, which is how
// the first successful authentication in this project was very nearly lost.
//
// The daemon is the exception, and takes one only when --log-dir says so. That
// reasoning is about experiments; a packaged daemon that ran it would leave a
// file per start in an unrotated directory, and record the time of every
// unlock, to say what the journal already has.
//
// Done at the file-descriptor level rather than by wrapping a stream, because
// std::println writes to stdout through C stdio: an ostream wrapper would
@ -2623,6 +2631,12 @@ int RunProbeTaLoad(const std::string& path) {
}
int main(int argc, char** argv) {
// Under systemd stdout is a pipe, and a pipe means FULL buffering: the
// daemon's lines would sit in the buffer rather than reach the journal,
// which is how a working daemon looks like a hung one. StartTranscript
// used to set this as a side effect of taking over fd 1, and the daemon
// does not run it.
::setvbuf(stdout, nullptr, _IOLBF, 0);
std::span<char*> args(argv, static_cast<std::size_t>(argc));
bool probe = false, daemon = false, doAuth = false, doEnrol = false, doCalSave = false;
bool doLearnProbe = false;
@ -2652,7 +2666,7 @@ int main(int argc, char** argv) {
// The observer thread and the loop would both drain the same fd, so
// the diagnostic and the wake are mutually exclusive.
if (a == "--edge-wake") g_edgeWake = true;
if (a.starts_with("--log-dir=")) g_logDir = a.substr(10);
if (a.starts_with("--log-dir=")) { g_logDir = a.substr(10); g_logDirExplicit = true; }
if (a.starts_with("--state-dir=")) g_stateDir = a.substr(12);
if (a.starts_with("--rescan=")) g_rescan = std::stoi(std::string(a.substr(9)));
if (a.starts_with("--reject-budget=")) g_pressRejectBudget = std::stoi(std::string(a.substr(16)));
@ -2664,7 +2678,7 @@ int main(int argc, char** argv) {
if (a.starts_with("--sfs-root=")) g_sfsRoot = a.substr(11);
if (a.starts_with("--gid=")) gid = static_cast<std::uint32_t>(std::stoul(std::string(a.substr(6))));
}
StartTranscript(g_logDir);
if (!daemon || g_logDirExplicit) StartTranscript(g_logDir);
if (!probeTa.empty()) return RunProbeTaLoad(probeTa);
if (daemon) return RunDaemon();
if (probe) return RunProbe(doAuth, doEnrol, doCalSave, doLearnProbe, gid, frames);