From 7a0a86a7f0593e0b8928039cd14e8db0e80e6a9a Mon Sep 17 00:00:00 2001 From: Jorijn van der Graaf Date: Sat, 5 Sep 2026 23:06:57 +0200 Subject: [PATCH 1/2] packaging: cross-compile for the FP6's own cores The phone is one SoC, 4x Cortex-A520 + 4x Cortex-A720, and the package is built for nothing else, so build for it: -march=armv8.6-a+fp16fml+aes+sha3+sm4 -mtune=cortex-a720 instead of the generic Armv8 baseline, for the daemon, the agent and libqcomtee alike. That is gcc's own -march=native expansion on the phone, re-based on armv8.6-a so clang can express the same set; 8.6 is the highest level whose mandatory set the phone exposes (8.7 would assume WFxT, 9.x SVE2 - neither is in its hwcaps, and SVE2 code would SIGILL). Same string as the fp6-img aports and kernel. --- README.md | 4 ++-- packaging/build-package.sh | 9 +++++++-- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index d44e754..02b98f3 100644 --- a/README.md +++ b/README.md @@ -19,8 +19,8 @@ Cross-compiling for the phone: ```sh packaging/make-sysroot.sh -crafter-build -- --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8-a --mtune=generic -crafter-build test --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8-a --mtune=generic +crafter-build -- --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720 +crafter-build test --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720 ``` Verified on the device: all five suites pass cross-built and run on the phone diff --git a/packaging/build-package.sh b/packaging/build-package.sh index 14b45f0..d93d8ca 100755 --- a/packaging/build-package.sh +++ b/packaging/build-package.sh @@ -76,13 +76,18 @@ retry "make sysroot" "$SRC/packaging/make-sysroot.sh" "$SYSROOT" # under ~/.cache/fingerprintd/libqcomtee-, which is this script's # default output dir. Needs git, installed above. retry "make libqcomtee" "$SRC/packaging/make-libqcomtee.sh" \ - --target=aarch64-alpine-linux-musl --sysroot="$SYSROOT" --march=armv8-a + --target=aarch64-alpine-linux-musl --sysroot="$SYSROOT" --march=armv8.6-a+fp16fml+aes+sha3+sm4 # --- cross-compile the daemon; run the suites natively. The core is portable # by construction (no GLib, no libqcomtee, no system headers), which is what # lets the wire formats and state machines be tested on the build host at all. cd "$SRC" -XTARGET="--target=aarch64-alpine-linux-musl --sysroot=$SYSROOT --march=armv8-a --mtune=generic" +# The phone is one SoC, 4x Cortex-A520 + 4x Cortex-A720, so build for it (the +# same -march goes to libqcomtee above). armv8.6-a is the highest level whose +# mandatory set it exposes (8.7 would assume WFxT, 9.x SVE2 - neither is in +# its hwcaps); +fp16fml+aes+sha3+sm4 are the optional extensions it has. Same +# string as the fp6-img aports. +XTARGET="--target=aarch64-alpine-linux-musl --sysroot=$SYSROOT --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720" crafter-build -- $XTARGET crafter-build -- --product=agent $XTARGET crafter-build test From 0b8ff3df9f6a34ff6371cf11b14c177a077ea563 Mon Sep 17 00:00:00 2001 From: Jorijn van der Graaf Date: Tue, 8 Sep 2026 16:50:25 +0200 Subject: [PATCH 2/2] text change --- packaging/actions.conf.example | 35 +++++++++------------------------- 1 file changed, 9 insertions(+), 26 deletions(-) diff --git a/packaging/actions.conf.example b/packaging/actions.conf.example index bfb6ff9..da6ce1d 100644 --- a/packaging/actions.conf.example +++ b/packaging/actions.conf.example @@ -1,19 +1,14 @@ -# fingerprintd — per-finger actions. +# fingerprintd per-finger actions. # # Install as /etc/fingerprintd/actions.conf. With no such file, a finger does # exactly what it always did: it unlocks. # -# YOU PROBABLY DO NOT NEED THIS FILE. Every matched finger is already -# announced on the system bus, unconditionally and with nothing configured: +# This file is for running root scripts on finger actions. +# For scripts that run in your session, you can use this D-Bus: # # net.catcrafts.Fingerprintd1.FingerMatched(finger, uid) # on /net/reactivated/Fprint/Device/0 # -# That is how a finger launches an application. An agent in your own session -# hears the signal and decides what the finger means, from your own -# configuration, running as you with your bus and your display. The daemon is -# root and deliberately does not try to do that for you. -# # This file is for the two things that do need the daemon. # # THIS FILE IS A ROOT SHELL. Every command here is run by root when that @@ -38,30 +33,18 @@ # no-unlock this finger never unlocks. The client is told it did not match, # whatever really happened. # -# command an ABSOLUTE path, passed to /bin/sh -c with a fixed environment -# plus FINGERPRINTD_FINGER. Double-forked, so it may outlive the -# daemon and can never delay an unlock. +# command an absolute path, passed to /bin/sh -c with a fixed environment +# plus FINGERPRINTD_FINGER. # -# At least one of the two is required. A finger listed on its own says nothing -# the signal above does not already say. - # --- A finger that also does something, as root ----------------------------- #right-ring-finger /usr/local/bin/toggle-something - -# --- A finger that does not unlock ------------------------------------------ -#left-thumb no-unlock - +# # --- A duress finger: rejected, and the script runs anyway ------------------ # -# Think carefully before making that script destructive: -# -# * a false accept that opens a camera is a shrug; one that wipes is not, -# * and anyone who can compel one unlock can usually compel a second. -# -# AND KNOW WHAT THIS IS NOT. It is a panic button, not deniability. The -# rejection it fabricates is far faster than a real one — a finger the sensor +# Know what this is not: It is a panic button, not deniability. The +# rejection it fabricates is far faster than a real one. A finger the sensor # genuinely does not know takes about three seconds to be refused, this takes -# milliseconds — the daemon's journal records that the finger really matched, +# milliseconds. The daemon's journal records that the finger really matched, # this file names it in plain text, and the finger still shows as enrolled in # fprintd-list. It reliably runs your script. It does not reliably hide that # it did.