| Filename | Latest commit message | Latest commit date |
|---|---|---|
Jorijn van der Graaf
823c710b15
All checks were successful
package / package (push) Successful in 1m22s
0.2.3's manifest pinned the sha256 of one Android build's focal64 (16.82.0, the build the dev phone runs). Fairphone re-signs the trustlet every release, so that pin matched exactly one of the six builds seen, and two of two field reports had no sensor: one user on 16.100.0 edited the manifest by hand, another ended up with a file QTEE refuses. The manifest now carries '-' instead of a hash and depends on fp6-vendor-blobs 1-r3, which tries the active slot first and verifies the image's structure; QTEE's signature check is the gate it always was (one flipped byte -> ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03 and again today). post-install reassembles the trustlet right away, so 'apk add' no longer needs a boot for it. post-upgrade re-derives it from the active slot, which replaces a hand-placed or wrongly pinned file, and then restarts the daemon -- a plain restart, so a daemon that exited on a refused trustlet comes back up on the re-derived one. loadFromBuffer failures name the loader's verdict. The field's first report was a bare result=12; it now reads ERROR_ELF_SIGNATURE_ERROR with what to do about it. Probed on the phone with this build: a one-byte tampered image and 100000 random bytes both print it, the pristine image loads, and the suites pass 8/8. |
||
| .. | ||
| 20-focal64.manifest | ||
| 80-fingerprintd.preset | ||
| actions.conf.example | ||
| APKBUILD | ||
| build-package.sh | ||
| deploy-dev.sh | ||
| fingerprint-auth.pam | ||
| fingerprintd-agent.service | ||
| fingerprintd.json | ||
| fingerprintd.modules-load.conf | ||
| fingerprintd.post-install | ||
| fingerprintd.post-upgrade | ||
| fingerprintd.service | ||
| fingerprintd.tmpfiles.conf | ||
| fingers.conf.example | ||
| fpenrol.sh | ||
| fplearn.sh | ||
| fptrial.sh | ||
| make-bin-tarball.sh | ||
| make-libqcomtee.sh | ||
| make-sysroot.sh | ||
| mnt-persist.mount | ||
| net.reactivated.Fprint.conf | ||
| net.reactivated.fprint.device.policy | ||
| net.reactivated.Fprint.service | ||
| postlogin.pam | ||
| README.config.md | ||
fingerprintd.json — where it comes from, and why this exact file
The trustlet gates its config file on common.configuration_uuid and silently
falls back to built-in defaults on a mismatch, so the file is not decorative:
SYNC_CONFIG returning 0 is what makes the whole init chain run.
This copy is generated, not hand-written. Its source is fp6fpcfg.py in the
fp6 bring-up repo, which builds it from the captured stock configuration dump
(journal/fingerprint/captures/2026-08-25-focal64-effective-config-from-stock.txt):
utilities/fp6fpcfg.py --daemon --verbose > packaging/fingerprintd.json
sha256 begins b205c756914a66f1.
Why the --verbose variant
--verbose here is the trustlet's own log level, not the daemon's. It is
shipped because it is the file every accuracy number was measured on — 30/30
held presses, zero false accepts, 36-330 ms to a verdict — and the TA's log
level cannot be raised again by a runtime SYNC_CONFIG, so a session that
needs the matcher's own lines has to have started with it.
--daemon alone produces the same file with trustlet logging off (sha256
6c4503e628406424, four diagnosis.* keys differ and nothing else). It is
plausibly the better shipping default and it is untested: no rate in the
journal was measured on it. Switching is a measurement, not an edit.
The two policy keys
common.max_authentication_rescan_times: 0— at the stock budget a wrong finger never yields a terminal frame, so a PAM client waits forever for theverify-no-matchit needs.trustlet.enable_trusted_enrollment: false— skips the challenge compare and thehw_auth_tokenHMAC verify. pmOS has no Gatekeeper to issue a token and nothing on pmOS verifies one.