Catcrafts/fingerprintd
Watch
2
0
Fork
You've already forked fingerprintd
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
fingerprintd/packaging
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Jorijn van der Graaf 7a0a86a7f0 packaging: cross-compile for the FP6's own cores 
The phone is one SoC, 4x Cortex-A520 + 4x Cortex-A720, and the package is
built for nothing else, so build for it: -march=armv8.6-a+fp16fml+aes+sha3+sm4
-mtune=cortex-a720 instead of the generic Armv8 baseline, for the daemon, the
agent and libqcomtee alike. That is gcc's own -march=native expansion on the
phone, re-based on armv8.6-a so clang can express the same set; 8.6 is the
highest level whose mandatory set the phone exposes (8.7 would assume WFxT,
9.x SVE2 - neither is in its hwcaps, and SVE2 code would SIGILL). Same string
as the fp6-img aports and kernel.
2026-09-06 00:02:41 +02:00
..
20-focal64.manifest A verify nobody answered is not a failure, and the trustlet is not ours to ship 2026-09-05 04:01:06 +02:00
80-fingerprintd.preset Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
actions.conf.example Drop two fields nobody needed: session was a no-op, and no-unlock is the finger 2026-09-05 05:23:40 +02:00
APKBUILD Depend on the extractor that understands our manifest, and restart on upgrade 2026-09-05 20:22:17 +02:00
build-package.sh packaging: cross-compile for the FP6's own cores 2026-09-06 00:02:41 +02:00
deploy-dev.sh Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fingerprint-auth.pam An agent, so a finger can mean something in your session 2026-09-05 06:21:53 +02:00
fingerprintd-agent.service An agent, so a finger can mean something in your session 2026-09-05 06:21:53 +02:00
fingerprintd.json Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fingerprintd.modules-load.conf Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fingerprintd.post-upgrade Depend on the extractor that understands our manifest, and restart on upgrade 2026-09-05 20:22:17 +02:00
fingerprintd.service A verify nobody answered is not a failure, and the trustlet is not ours to ship 2026-09-05 04:01:06 +02:00
fingerprintd.tmpfiles.conf Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fingers.conf.example An agent, so a finger can mean something in your session 2026-09-05 06:21:53 +02:00
fpenrol.sh fpenrol.sh: no enrolment ever received the position guidance this script claims 2026-09-03 17:44:35 +02:00
fplearn.sh fplearn.sh: a wipe leaves learning off too 2026-09-05 02:07:26 +02:00
fptrial.sh Hold, do not tap -- and stop spending the verdict on a frame that cannot carry it 2026-09-05 00:17:13 +02:00
make-bin-tarball.sh An agent, so a finger can mean something in your session 2026-09-05 06:21:53 +02:00
make-libqcomtee.sh Reach QTEE: credentials, client env and the app loader, with no QCBOR 2026-09-02 18:02:28 +02:00
make-sysroot.sh Add the cross-build sysroot recipe, verified on the device 2026-09-02 17:34:27 +02:00
mnt-persist.mount Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
net.reactivated.Fprint.conf Give a finger a meaning beyond "it was you" 2026-09-05 05:12:41 +02:00
net.reactivated.fprint.device.policy Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
net.reactivated.Fprint.service Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
postlogin.pam Ship postlogin too, the other half of the seam kscreenlocker expects 2026-09-05 05:56:47 +02:00
README.config.md Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00

README.config.md

fingerprintd.json — where it comes from, and why this exact file

The trustlet gates its config file on common.configuration_uuid and silently falls back to built-in defaults on a mismatch, so the file is not decorative: SYNC_CONFIG returning 0 is what makes the whole init chain run.

This copy is generated, not hand-written. Its source is fp6fpcfg.py in the fp6 bring-up repo, which builds it from the captured stock configuration dump (journal/fingerprint/captures/2026-08-25-focal64-effective-config-from-stock.txt):

utilities/fp6fpcfg.py --daemon --verbose > packaging/fingerprintd.json

sha256 begins b205c756914a66f1.

Why the --verbose variant

--verbose here is the trustlet's own log level, not the daemon's. It is shipped because it is the file every accuracy number was measured on — 30/30 held presses, zero false accepts, 36-330 ms to a verdict — and the TA's log level cannot be raised again by a runtime SYNC_CONFIG, so a session that needs the matcher's own lines has to have started with it.

--daemon alone produces the same file with trustlet logging off (sha256 6c4503e628406424, four diagnosis.* keys differ and nothing else). It is plausibly the better shipping default and it is untested: no rate in the journal was measured on it. Switching is a measurement, not an edit.

The two policy keys

  • common.max_authentication_rescan_times: 0 — at the stock budget a wrong finger never yields a terminal frame, so a PAM client waits forever for the verify-no-match it needs.
  • trustlet.enable_trusted_enrollment: false — skips the challenge compare and the hw_auth_token HMAC verify. pmOS has no Gatekeeper to issue a token and nothing on pmOS verifies one.