Jorijn van der Graaf
823c710b15
All checks were successful
package / package (push) Successful in 1m22s
0.2.3's manifest pinned the sha256 of one Android build's focal64 (16.82.0, the build the dev phone runs). Fairphone re-signs the trustlet every release, so that pin matched exactly one of the six builds seen, and two of two field reports had no sensor: one user on 16.100.0 edited the manifest by hand, another ended up with a file QTEE refuses. The manifest now carries '-' instead of a hash and depends on fp6-vendor-blobs 1-r3, which tries the active slot first and verifies the image's structure; QTEE's signature check is the gate it always was (one flipped byte -> ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03 and again today). post-install reassembles the trustlet right away, so 'apk add' no longer needs a boot for it. post-upgrade re-derives it from the active slot, which replaces a hand-placed or wrongly pinned file, and then restarts the daemon -- a plain restart, so a daemon that exited on a refused trustlet comes back up on the re-derived one. loadFromBuffer failures name the loader's verdict. The field's first report was a bare result=12; it now reads ERROR_ELF_SIGNATURE_ERROR with what to do about it. Probed on the phone with this build: a one-byte tampered image and 100000 random bytes both print it, the pristine image loads, and the suites pass 8/8.
153 lines
7.5 KiB
Text
153 lines
7.5 KiB
Text
# SPDX-License-Identifier: GPL-3.0-only
|
|
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
|
|
# Maintainer: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
|
|
# Binary packaging: wraps a crafter-build binary cross-compiled per the
|
|
# README's "Cross-compiling" section into a proper apk — used by this repo's
|
|
# package CI (packaging/build-package.sh, which seds pkgver from
|
|
# implementations/main.cpp) and runnable by hand. The source tarball is
|
|
# produced by packaging/make-bin-tarball.sh. There is deliberately no
|
|
# source-building aport: the build driver is crafter-build, which is not in
|
|
# Alpine, so an APKBUILD that compiled from source could not be built by
|
|
# anyone but us either.
|
|
pkgname=fingerprintd
|
|
pkgver=0.2.4
|
|
pkgrel=0
|
|
pkgdesc="Fingerprint daemon for the Fairphone 6 (FocalTech FT9391 behind QTEE)"
|
|
url="https://forgejo.catcrafts.net/Catcrafts/fingerprintd"
|
|
arch="aarch64"
|
|
license="GPL-3.0-only"
|
|
# GLib for the D-Bus interface; libc++ because the binary is a clang/libc++
|
|
# C++26 modules build linked dynamically against the phone's own runtime.
|
|
#
|
|
# fprintd-pam is pam_fprintd, which is the point of the whole daemon: it is
|
|
# what turns a matched finger into a login. It is an install_if subpackage
|
|
# conditioned on the EXACT version fprintd-pam was built against
|
|
# (i:fprintd=1.94.5-r1), so the provides below breaks that condition and apk
|
|
# would purge it as no-longer-needed. Depending on it explicitly is what keeps
|
|
# it. It has no dependency on fprintd itself, so nothing is being forced.
|
|
#
|
|
# fp6-vendor-blobs runs the manifest fragment below, which reassembles the
|
|
# trustlet out of the stock modem partition on first boot. Without it there is
|
|
# no matcher and the unit stays inert on its ConditionPathExists -- so this is
|
|
# a real dependency, not a nicety. It is an FP6 device package; so is this.
|
|
# The mbn directive the fragment uses arrived in 1-r2; the unpinned form
|
|
# ('-' as the sha256, active slot first) and --refresh arrived in 1-r3. An
|
|
# older extractor would read '-' as a hash and refuse every image, which on a
|
|
# first boot fails the blobs unit after the audio fragment ran and before
|
|
# this one could.
|
|
depends="dbus glib libc++ fprintd-pam fp6-vendor-blobs>=1-r3"
|
|
# The versioned provides both satisfies plasma-workspace's fprintd dependency
|
|
# — its Users KCM is the fingerprint enrolment UI and speaks exactly this bus
|
|
# name — and EXCLUDES the real package, which is required rather than tidy:
|
|
# fprintd is D-Bus-activatable, so a client call would otherwise start the
|
|
# real daemon and fight for net.reactivated.Fprint. fprintd-pam is a separate
|
|
# package that does not depend on fprintd, so PAM keeps working.
|
|
#
|
|
# The cost, which is real: the fprintd-enroll/-list/-verify/-delete CLIs go
|
|
# away with the package. Enrolment then goes through Plasma's Users KCM.
|
|
provides="fprintd=$pkgver-r$pkgrel"
|
|
# The unit is the deliverable — a daemon holding QTEE's listener table open for
|
|
# the life of the boot is not something to start by hand — but abuild wants
|
|
# systemd files in their own package, and install_if puts them back on any
|
|
# system that has systemd. No OpenRC service: nothing here has ever been run
|
|
# under one, and the unit's conditions (the vendor blob, /dev/tee0) are what
|
|
# keep the package inert on a phone that cannot use it.
|
|
subpackages="$pkgname-agent $pkgname-systemd"
|
|
# nothing is compiled here, and the aarch64 ELF's NEEDED entries must not be
|
|
# traced against an x86_64 build host
|
|
options="!check !tracedeps"
|
|
source="fingerprintd-$pkgver.tar.gz"
|
|
# post-install: reassemble the trustlet now, so a fresh 'apk add' has a sensor
|
|
# without waiting for a boot. post-upgrade: re-derive it from the active slot
|
|
# (heals a hand-placed or wrongly pinned file), then restart the daemon --
|
|
# apk swaps the binary on disk and leaves the running one alone.
|
|
install="$pkgname.post-install $pkgname.post-upgrade"
|
|
|
|
package() {
|
|
cd "$srcdir/fingerprintd-$pkgver"
|
|
install -Dm755 fingerprintd "$pkgdir"/usr/bin/fingerprintd
|
|
|
|
install -Dm644 fingerprintd.service \
|
|
"$pkgdir"/usr/lib/systemd/system/fingerprintd.service
|
|
install -Dm644 mnt-persist.mount \
|
|
"$pkgdir"/usr/lib/systemd/system/mnt-persist.mount
|
|
# enabled by preset, and by an explicit .wants link so a fingerprint
|
|
# surviving a reboot never depends on a manual systemctl enable. The
|
|
# mount needs neither: fingerprintd.service pulls it in with
|
|
# RequiresMountsFor.
|
|
install -Dm644 80-fingerprintd.preset \
|
|
"$pkgdir"/usr/lib/systemd/system-preset/80-fingerprintd.preset
|
|
mkdir -p "$pkgdir"/etc/systemd/system/multi-user.target.wants
|
|
ln -s /usr/lib/systemd/system/fingerprintd.service \
|
|
"$pkgdir"/etc/systemd/system/multi-user.target.wants/fingerprintd.service
|
|
|
|
# who may own and call the bus name
|
|
install -Dm644 net.reactivated.Fprint.conf \
|
|
"$pkgdir"/usr/share/dbus-1/system.d/net.reactivated.Fprint.conf
|
|
# replaces fprintd's activation file, which points at /usr/libexec/fprintd
|
|
install -Dm644 net.reactivated.Fprint.service \
|
|
"$pkgdir"/usr/share/dbus-1/system-services/net.reactivated.Fprint.service
|
|
# the action ids fprintd defined; see the file for what enforces them
|
|
install -Dm644 net.reactivated.fprint.device.policy \
|
|
"$pkgdir"/usr/share/polkit-1/actions/net.reactivated.fprint.device.policy
|
|
|
|
# the SFS root's directories and its two symlinks into the persist mount
|
|
install -Dm644 fingerprintd.tmpfiles.conf \
|
|
"$pkgdir"/usr/lib/tmpfiles.d/fingerprintd.conf
|
|
# qcomtee -> /dev/tee0
|
|
install -Dm644 fingerprintd.modules-load.conf \
|
|
"$pkgdir"/usr/lib/modules-load.d/fingerprintd.conf
|
|
|
|
# the trustlet's configuration, generated by fp6fpcfg.py from the captured
|
|
# stock dump — see packaging/README.config.md. Not a user config file:
|
|
# the TA discards a file whose configuration_uuid does not match, and the
|
|
# two policy keys in it were each forced by a measurement.
|
|
install -Dm644 fingerprintd.json \
|
|
"$pkgdir"/usr/lib/firmware/fingerprintd.json
|
|
|
|
# the trustlet is NOT in this package and never will be: it is a
|
|
# proprietary OEM-signed blob. This tells fp6-vendor-blobs how to
|
|
# reassemble it from the phone's own stock partitions, which is the
|
|
# same mechanism soc-fairphone-fp6-audio uses for the amp config.
|
|
install -Dm644 20-focal64.manifest \
|
|
"$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d/20-focal64.manifest
|
|
|
|
# The PAM service kscreenlocker substacks and Alpine does not provide.
|
|
# Vendor directory, so /etc/pam.d still overrides it.
|
|
install -Dm644 fingerprint-auth.pam \
|
|
"$pkgdir"/usr/lib/pam.d/fingerprint-auth
|
|
install -Dm644 postlogin.pam \
|
|
"$pkgdir"/usr/lib/pam.d/postlogin
|
|
|
|
# Documentation, not configuration: shipping an /etc/fingerprintd/
|
|
# actions.conf would be shipping a root shell nobody asked for. The
|
|
# feature is off until an administrator installs one.
|
|
install -Dm644 actions.conf.example \
|
|
"$pkgdir"/usr/share/doc/$pkgname/actions.conf.example
|
|
|
|
# The session half; split out below.
|
|
install -Dm755 fingerprintd-agent "$pkgdir"/usr/bin/fingerprintd-agent
|
|
install -Dm644 fingerprintd-agent.service \
|
|
"$pkgdir"/usr/lib/systemd/user/fingerprintd-agent.service
|
|
install -Dm644 fingers.conf.example \
|
|
"$pkgdir"/usr/share/doc/$pkgname/fingers.conf.example
|
|
}
|
|
|
|
agent() {
|
|
pkgdesc="Run things in your session when a fingerprint matches"
|
|
# Useful only against a daemon that emits the signal, but it is a
|
|
# SEPARATE package because it is a separate trust domain: it runs as the
|
|
# user, reads a config the user owns, and starts the user's software.
|
|
depends="$pkgname=$pkgver-r$pkgrel"
|
|
|
|
amove usr/bin/fingerprintd-agent
|
|
amove usr/lib/systemd/user/fingerprintd-agent.service
|
|
amove usr/share/doc/$pkgname/fingers.conf.example
|
|
}
|
|
|
|
systemd() {
|
|
install_if="$pkgname=$pkgver-r$pkgrel systemd"
|
|
|
|
amove usr/lib/systemd
|
|
amove etc/systemd
|
|
}
|