Catcrafts/fingerprintd
Watch
2
0
Fork
You've already forked fingerprintd
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions
fingerprintd/packaging
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Jorijn van der Graaf 51f476e596
 the agent prints the daemon's version, from the constant the packaging reads 
The agent answered --version with "fingerprintd-agent 0.2.2", the string
it was written with, while the daemon's constant went 0.2.3, 0.2.4, 0.2.5:
the subpackage carried the package's version and reported another. The
constant moves from main.cpp into the module both products import, with
its note on what a bump publishes; the two scripts that derive pkgver
from it, the APKBUILD's header and the CI comment name the new file. The
APKBUILD's own pkgver stays a hand-kept copy, which a bump changes too.
2026-10-14 01:37:38 +02:00
..
20-focal64.manifest 0.2.4: the trustlet comes from the active slot, unpinned, and a refusal says why 2026-09-11 13:04:35 +02:00
80-fingerprintd.preset Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
actions.conf.example text change 2026-09-08 16:50:25 +02:00
APKBUILD the agent prints the daemon's version, from the constant the packaging reads 2026-10-14 01:37:38 +02:00
build-package.sh the agent prints the daemon's version, from the constant the packaging reads 2026-10-14 01:37:38 +02:00
deploy-dev.sh Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fingerprint-auth.pam An agent, so a finger can mean something in your session 2026-09-05 06:21:53 +02:00
fingerprintd-agent.service An agent, so a finger can mean something in your session 2026-09-05 06:21:53 +02:00
fingerprintd.json Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fingerprintd.modules-load.conf Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fingerprintd.post-install 0.2.4: the trustlet comes from the active slot, unpinned, and a refusal says why 2026-09-11 13:04:35 +02:00
fingerprintd.post-upgrade 0.2.4: the trustlet comes from the active slot, unpinned, and a refusal says why 2026-09-11 13:04:35 +02:00
fingerprintd.service A verify nobody answered is not a failure, and the trustlet is not ours to ship 2026-09-05 04:01:06 +02:00
fingerprintd.tmpfiles.conf Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fingers.conf.example An agent, so a finger can mean something in your session 2026-09-05 06:21:53 +02:00
fpenrol.sh fpenrol.sh: no enrolment ever received the position guidance this script claims 2026-09-03 17:44:35 +02:00
fplearn.sh a template no name accounts for is removed, not kept in the way 2026-10-14 01:37:38 +02:00
fptrial.sh Hold, do not tap -- and stop spending the verdict on a frame that cannot carry it 2026-09-05 00:17:13 +02:00
make-bin-tarball.sh the agent prints the daemon's version, from the constant the packaging reads 2026-10-14 01:37:38 +02:00
make-libqcomtee.sh Reach QTEE: credentials, client env and the app loader, with no QCBOR 2026-09-02 18:02:28 +02:00
make-sysroot.sh Add the cross-build sysroot recipe, verified on the device 2026-09-02 17:34:27 +02:00
mnt-persist.mount Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
net.reactivated.Fprint.conf Give a finger a meaning beyond "it was you" 2026-09-05 05:12:41 +02:00
net.reactivated.fprint.device.policy Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
net.reactivated.Fprint.service Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
postlogin.pam Ship postlogin too, the other half of the seam kscreenlocker expects 2026-09-05 05:56:47 +02:00
README.config.md Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00

README.config.md

fingerprintd.json — where it comes from, and why this exact file

The trustlet gates its config file on common.configuration_uuid and silently falls back to built-in defaults on a mismatch, so the file is not decorative: SYNC_CONFIG returning 0 is what makes the whole init chain run.

This copy is generated, not hand-written. Its source is fp6fpcfg.py in the fp6 bring-up repo, which builds it from the captured stock configuration dump (journal/fingerprint/captures/2026-08-25-focal64-effective-config-from-stock.txt):

utilities/fp6fpcfg.py --daemon --verbose > packaging/fingerprintd.json

sha256 begins b205c756914a66f1.

Why the --verbose variant

--verbose here is the trustlet's own log level, not the daemon's. It is shipped because it is the file every accuracy number was measured on — 30/30 held presses, zero false accepts, 36-330 ms to a verdict — and the TA's log level cannot be raised again by a runtime SYNC_CONFIG, so a session that needs the matcher's own lines has to have started with it.

--daemon alone produces the same file with trustlet logging off (sha256 6c4503e628406424, four diagnosis.* keys differ and nothing else). It is plausibly the better shipping default and it is untested: no rate in the journal was measured on it. Switching is a measurement, not an edit.

The two policy keys

  • common.max_authentication_rescan_times: 0 — at the stock budget a wrong finger never yields a terminal frame, so a PAM client waits forever for the verify-no-match it needs.
  • trustlet.enable_trusted_enrollment: false — skips the challenge compare and the hw_auth_token HMAC verify. pmOS has no Gatekeeper to issue a token and nothing on pmOS verifies one.