Ship postlogin too, the other half of the seam kscreenlocker expects

fingerprint-auth alone was not enough. /etc/pam.d/kde-fingerprint is written
for a Fedora/authselect layout and its auth stack is two lines: a substack of
fingerprint-auth followed by an include of postlogin. Alpine ships neither.

With only the first supplied, the fingerprint MATCHED and PAM still answered
Permission denied -- the include of a missing service failing after the match
had already succeeded, which is a confusing way to be told a file is absent.
The daemon's own log said MATCH while pamtester said no.

On Fedora postlogin does lastlog and umask bookkeeping. Nothing here needs
that; what is needed is that the seam exists and contributes nothing, so the
stack's result stays the one the fingerprint substack produced. Hence four
optional pam_permit lines and a comment explaining why it is deliberately
empty rather than merely unfinished.

Also observed while testing, and worth knowing before anyone calls this
broken: the lock screen arms fingerprint ONCE when it appears, waits 30
seconds -- pam_fprintd's own timeout -- and then cancels and falls back to a
password. Pressing outside that window reaches nothing at all, and the daemon
records it as `verify: cancelled over 0 press(es)`.

implementations/main.cpp

@@ -68,7 +68,7 @@ namespace {
 
 // Bumping this is what publishes a package: the registry answers 409 for a
 // version it already has, which a build treats as a no-op.
-constexpr const char* Version = "0.2.1";
+constexpr const char* Version = "0.2.2";
 
 bool g_verbose = false;
 // 500 ms was the research harness's pace, chosen so a human could read the

packaging/APKBUILD

@@ -10,7 +10,7 @@
 # Alpine, so an APKBUILD that compiled from source could not be built by
 # anyone but us either.
 pkgname=fingerprintd
-pkgver=0.2.1
+pkgver=0.2.2
 pkgrel=0
 pkgdesc="Fingerprint daemon for the Fairphone 6 (FocalTech FT9391 behind QTEE)"
 url="https://forgejo.catcrafts.net/Catcrafts/fingerprintd"
@@ -106,6 +106,8 @@ package() {
 	# Vendor directory, so /etc/pam.d still overrides it.
 	install -Dm644 fingerprint-auth.pam \
 		"$pkgdir"/usr/lib/pam.d/fingerprint-auth
+	install -Dm644 postlogin.pam \
+		"$pkgdir"/usr/lib/pam.d/postlogin
 
 	# Documentation, not configuration: shipping an /etc/fingerprintd/
 	# actions.conf would be shipping a root shell nobody asked for. The

packaging/make-bin-tarball.sh

@@ -26,6 +26,7 @@ cp packaging/fingerprintd.service \
    packaging/fingerprintd.json \
    packaging/20-focal64.manifest \
    packaging/fingerprint-auth.pam \
+   packaging/postlogin.pam \
    packaging/actions.conf.example \
    "$stage/fingerprintd-$VER/"
 tar -C "$stage" -czf "fingerprintd-$VER.tar.gz" "fingerprintd-$VER"

packaging/postlogin.pam

@@ -0,0 +1,28 @@
+#%PAM-1.0
+# SPDX-License-Identifier: GPL-3.0-only
+# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
+#
+# The second service kscreenlocker names and Alpine does not provide.
+#
+# /etc/pam.d/kde-fingerprint is written for a Fedora/authselect layout. Its
+# auth stack is:
+#
+#     auth  substack  fingerprint-auth
+#     auth  include   postlogin
+#
+# Neither file exists on Alpine. With only the first supplied, a fingerprint
+# that MATCHED still came back as "Permission denied", because the include of
+# a missing service fails after the match has already succeeded -- which is a
+# confusing way to be told a file is absent.
+#
+# On Fedora postlogin does lastlog and umask bookkeeping. Nothing here needs
+# that. What is needed is that the seam exists and contributes nothing, so the
+# result of the stack stays the one the fingerprint substack produced.
+#
+# Vendor directory, so an administrator can still override it in /etc/pam.d.
+# Shipped here for the same reason as fingerprint-auth: this package is what
+# makes the fingerprint half of that stack mean anything.
+auth      optional  pam_permit.so
+account   optional  pam_permit.so
+password  optional  pam_permit.so
+session   optional  pam_permit.so