Catcrafts/fingerprintd
Watch
2
0
Fork
You've already forked fingerprintd
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
fingerprintd/packaging
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Jorijn van der Graaf fd244238d0 Ship postlogin too, the other half of the seam kscreenlocker expects 
fingerprint-auth alone was not enough. /etc/pam.d/kde-fingerprint is written
for a Fedora/authselect layout and its auth stack is two lines: a substack of
fingerprint-auth followed by an include of postlogin. Alpine ships neither.

With only the first supplied, the fingerprint MATCHED and PAM still answered
Permission denied -- the include of a missing service failing after the match
had already succeeded, which is a confusing way to be told a file is absent.
The daemon's own log said MATCH while pamtester said no.

On Fedora postlogin does lastlog and umask bookkeeping. Nothing here needs
that; what is needed is that the seam exists and contributes nothing, so the
stack's result stays the one the fingerprint substack produced. Hence four
optional pam_permit lines and a comment explaining why it is deliberately
empty rather than merely unfinished.

Also observed while testing, and worth knowing before anyone calls this
broken: the lock screen arms fingerprint ONCE when it appears, waits 30
seconds -- pam_fprintd's own timeout -- and then cancels and falls back to a
password. Pressing outside that window reaches nothing at all, and the daemon
records it as `verify: cancelled over 0 press(es)`.
2026-09-05 05:56:47 +02:00
..
20-focal64.manifest A verify nobody answered is not a failure, and the trustlet is not ours to ship 2026-09-05 04:01:06 +02:00
80-fingerprintd.preset Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
actions.conf.example Drop two fields nobody needed: session was a no-op, and no-unlock is the finger 2026-09-05 05:23:40 +02:00
APKBUILD Ship postlogin too, the other half of the seam kscreenlocker expects 2026-09-05 05:56:47 +02:00
build-package.sh Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
deploy-dev.sh Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fingerprint-auth.pam Give a finger a meaning beyond "it was you" 2026-09-05 05:12:41 +02:00
fingerprintd.json Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fingerprintd.modules-load.conf Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fingerprintd.service A verify nobody answered is not a failure, and the trustlet is not ours to ship 2026-09-05 04:01:06 +02:00
fingerprintd.tmpfiles.conf Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
fpenrol.sh fpenrol.sh: no enrolment ever received the position guidance this script claims 2026-09-03 17:44:35 +02:00
fplearn.sh fplearn.sh: a wipe leaves learning off too 2026-09-05 02:07:26 +02:00
fptrial.sh Hold, do not tap -- and stop spending the verdict on a frame that cannot carry it 2026-09-05 00:17:13 +02:00
make-bin-tarball.sh Ship postlogin too, the other half of the seam kscreenlocker expects 2026-09-05 05:56:47 +02:00
make-libqcomtee.sh Reach QTEE: credentials, client env and the app loader, with no QCBOR 2026-09-02 18:02:28 +02:00
make-sysroot.sh Add the cross-build sysroot recipe, verified on the device 2026-09-02 17:34:27 +02:00
mnt-persist.mount Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
net.reactivated.Fprint.conf Give a finger a meaning beyond "it was you" 2026-09-05 05:12:41 +02:00
net.reactivated.fprint.device.policy Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
net.reactivated.Fprint.service Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00
postlogin.pam Ship postlogin too, the other half of the seam kscreenlocker expects 2026-09-05 05:56:47 +02:00
README.config.md Package the daemon, so a fingerprint survives a reflash 2026-09-05 02:52:01 +02:00

README.config.md

fingerprintd.json — where it comes from, and why this exact file

The trustlet gates its config file on common.configuration_uuid and silently falls back to built-in defaults on a mismatch, so the file is not decorative: SYNC_CONFIG returning 0 is what makes the whole init chain run.

This copy is generated, not hand-written. Its source is fp6fpcfg.py in the fp6 bring-up repo, which builds it from the captured stock configuration dump (journal/fingerprint/captures/2026-08-25-focal64-effective-config-from-stock.txt):

utilities/fp6fpcfg.py --daemon --verbose > packaging/fingerprintd.json

sha256 begins b205c756914a66f1.

Why the --verbose variant

--verbose here is the trustlet's own log level, not the daemon's. It is shipped because it is the file every accuracy number was measured on — 30/30 held presses, zero false accepts, 36-330 ms to a verdict — and the TA's log level cannot be raised again by a runtime SYNC_CONFIG, so a session that needs the matcher's own lines has to have started with it.

--daemon alone produces the same file with trustlet logging off (sha256 6c4503e628406424, four diagnosis.* keys differ and nothing else). It is plausibly the better shipping default and it is untested: no rate in the journal was measured on it. Switching is a measurement, not an edit.

The two policy keys

  • common.max_authentication_rescan_times: 0 — at the stock budget a wrong finger never yields a terminal frame, so a PAM client waits forever for the verify-no-match it needs.
  • trustlet.enable_trusted_enrollment: false — skips the challenge compare and the hw_auth_token HMAC verify. pmOS has no Gatekeeper to issue a token and nothing on pmOS verifies one.