From f2a696bbbe08975a51cdb8feb3470e6065ed68a7 Mon Sep 17 00:00:00 2001 From: Jorijn van der Graaf Date: Wed, 2 Sep 2026 17:28:47 +0200 Subject: [PATCH] Drop the gid 60 compatibility path gid 60 was never a decision -- it was the ENROLL token's timeout field being read as a gid, then made self-consistent. Keeping it readable alongside gid = uid would be a second code path, a second group to reason about, and a migration to eventually retire, all to avoid re-enrolling one finger on one dev phone. Re-enrol it instead. --- interfaces/Fingerprintd-Store.cppm | 11 +++++------ tests/Store/main.cpp | 3 +-- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/interfaces/Fingerprintd-Store.cppm b/interfaces/Fingerprintd-Store.cppm index 6439dab..4eefcc4 100644 --- a/interfaces/Fingerprintd-Store.cppm +++ b/interfaces/Fingerprintd-Store.cppm @@ -71,13 +71,12 @@ export namespace fingerprintd::store { // We choose the caller's Linux uid, which makes the mapping total and // needs no allocation table. // - // The dev phone's existing template sits under gid 60, which was never a - // decision: it came from the ENROLL token's timeout field being read as - // the gid, and was then made self-consistent. It is kept readable as a - // legacy group so an enrolled finger is not stranded, but nothing new is - // written there. + // The research harness used gid 60, which was never a decision -- it was + // the ENROLL token's timeout field being read as the gid, then made + // self-consistent. There is no compatibility path for it: the finger it + // enrolled gets re-enrolled under the uid. Nothing is worth carrying a + // second group id for. using Gid = std::uint32_t; - inline constexpr Gid LegacyGid = 60; inline Gid GidForUid(std::uint32_t uid) { return uid; } // common.max_enrolling_fingers, from the trustlet config we ship. diff --git a/tests/Store/main.cpp b/tests/Store/main.cpp index 311300f..b7523fb 100644 --- a/tests/Store/main.cpp +++ b/tests/Store/main.cpp @@ -150,8 +150,7 @@ int main() { { Check(GidForUid(1000) == 1000, "gid is the uid"); Check(GidForUid(0) == 0, "root maps too"); - Check(LegacyGid == 60, "the dev phone's accidental group is remembered"); - Check(GidForUid(1000) != LegacyGid, "and a real uid does not collide with it"); + Check(GidForUid(4294967295u) == 4294967295u, "the whole uid range maps"); Check(PathForUid("/var/lib/fingerprintd", 1000) == "/var/lib/fingerprintd/fingers-1000.map", "state path"); }