# `fingerprintd.json` — where it comes from, and why this exact file

The trustlet gates its config file on `common.configuration_uuid` and silently
falls back to built-in defaults on a mismatch, so the file is not decorative:
`SYNC_CONFIG` returning 0 is what makes the whole init chain run.

This copy is generated, not hand-written. Its source is `fp6fpcfg.py` in the
fp6 bring-up repo, which builds it from the captured stock configuration dump
(`journal/fingerprint/captures/2026-08-25-focal64-effective-config-from-stock.txt`):

```sh
utilities/fp6fpcfg.py --daemon --verbose > packaging/fingerprintd.json
```

sha256 begins `b205c756914a66f1`.

## Why the `--verbose` variant

`--verbose` here is the *trustlet's* own log level, not the daemon's. It is
shipped because it is the file every accuracy number was measured on — 30/30
held presses, zero false accepts, 36-330 ms to a verdict — and the TA's log
level cannot be raised again by a runtime `SYNC_CONFIG`, so a session that
needs the matcher's own lines has to have started with it.

`--daemon` alone produces the same file with trustlet logging off (sha256
`6c4503e628406424`, four `diagnosis.*` keys differ and nothing else). It is
plausibly the better shipping default and it is **untested**: no rate in the
journal was measured on it. Switching is a measurement, not an edit.

## The two policy keys

* `common.max_authentication_rescan_times: 0` — at the stock budget a wrong
  finger never yields a terminal frame, so a PAM client waits forever for the
  `verify-no-match` it needs.
* `trustlet.enable_trusted_enrollment: false` — skips the challenge compare
  and the `hw_auth_token` HMAC verify. pmOS has no Gatekeeper to issue a token
  and nothing on pmOS verifies one.