adcc96a782
* Use updated libfprint-git for fingerprint setup on edge * Pick the fingerprint driver from the reader, not the release channel The channel gate blocked every edge and dev user until the newer libfprint-git pin is published, misrouted dev checkouts on the stable mirror, and left the stock-libfprint migration reverting the driver on accounts without its marker. Key both the setup and the migration on omarchy-hw-fingerprint-git, a USB ID table of readers stock libfprint cannot drive, so the git snapshot only goes where it is needed on any channel. Qualify the package with the omarchy repo, and skip pacman entirely when the packages are already current so a rerun cannot become a partial upgrade. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Install libfprint-git for every fingerprint reader Stock libfprint lags upstream on new readers, and gating the git snapshot per reader or per channel only added machinery to keep in sync with the package repo. Install libfprint-git unconditionally instead: the omarchy-pkgs pin is the single place a new reader gets enabled. The migration that swapped it back to stock goes away with the policy it enforced; late updaters keep the driver they have and pick up the new pin as a normal package upgrade. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: powderluv <powderluv@powderluv.org> Co-authored-by: David Heinemeier Hansson <david@hey.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
94 lines
3.0 KiB
Bash
Executable File
94 lines
3.0 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# The fingerprint setup installs libfprint-git in place of stock libfprint. The
|
|
# two conflict, so the swap has to happen inside one --ask 4 transaction, and a
|
|
# rerun with everything installed must not touch pacman at all. The real
|
|
# omarchy-pkg-missing runs; pacman and the privileged calls are stubbed.
|
|
|
|
set -euo pipefail
|
|
|
|
source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
|
|
|
|
scratch=$(mktemp -d)
|
|
trap 'rm -rf "$scratch"' EXIT
|
|
mkdir -p "$scratch/bin"
|
|
export CALL_LOG="$scratch/calls"
|
|
export PATH="$scratch/bin:$ROOT/bin:$PATH"
|
|
|
|
cat > "$scratch/bin/omarchy-hw-fingerprint" <<'STUB'
|
|
#!/bin/bash
|
|
exit "${HARDWARE_STATUS:-0}"
|
|
STUB
|
|
cat > "$scratch/bin/sudo" <<'STUB'
|
|
#!/bin/bash
|
|
case "$1" in
|
|
pacman | fprintd-enroll) exec "$@" ;;
|
|
*) echo "Unexpected privileged call: $*" >> "$CALL_LOG"; exit 99 ;;
|
|
esac
|
|
STUB
|
|
# INSTALLED lists the installed package names, one per line.
|
|
cat > "$scratch/bin/pacman" <<'STUB'
|
|
#!/bin/bash
|
|
case "$1" in
|
|
-Q) grep -qx "$2" <<< "${INSTALLED:-}" ;;
|
|
-S)
|
|
printf 'pacman %s\n' "$*" >> "$CALL_LOG"
|
|
exit "${INSTALL_STATUS:-0}"
|
|
;;
|
|
*) printf 'pacman %s\n' "$*" >> "$CALL_LOG"; exit 99 ;;
|
|
esac
|
|
STUB
|
|
cat > "$scratch/bin/fprintd-enroll" <<'STUB'
|
|
#!/bin/bash
|
|
# Stop before verification/PAM; no host authentication files may be changed.
|
|
echo enroll >> "$CALL_LOG"
|
|
exit 1
|
|
STUB
|
|
cat > "$scratch/bin/fprintd-verify" <<'STUB'
|
|
#!/bin/bash
|
|
echo verify >> "$CALL_LOG"
|
|
exit 1
|
|
STUB
|
|
chmod +x "$scratch/bin/"*
|
|
|
|
run_setup() {
|
|
: > "$CALL_LOG"
|
|
if "$ROOT/bin/omarchy-setup-security-fingerprint" > "$scratch/output" 2>&1; then
|
|
fail "setup stops on the simulated enrollment or installation failure"
|
|
fi
|
|
if grep -q 'Unexpected privileged call' "$CALL_LOG"; then
|
|
fail "setup does not change PAM after failed enrollment"
|
|
fi
|
|
}
|
|
|
|
assert_installs() {
|
|
grep -qx 'pacman -S --needed --noconfirm --ask 4 libfprint-git fprintd usbutils' "$CALL_LOG" || fail "$1"
|
|
(( $(grep -c '^pacman ' "$CALL_LOG") == 1 )) || fail "$1: one pacman transaction"
|
|
}
|
|
|
|
run_setup
|
|
assert_installs "a fresh machine installs libfprint-git, fprintd and usbutils"
|
|
grep -qx enroll "$CALL_LOG" || fail "installation is followed by enrollment"
|
|
pass "a fresh machine installs libfprint-git and reaches enrollment"
|
|
|
|
INSTALLED=$'libfprint\nfprintd\nusbutils' run_setup
|
|
assert_installs "installed stock libfprint is replaced in the same transaction"
|
|
pass "installed stock libfprint is replaced without a removal step"
|
|
|
|
INSTALLED=$'libfprint-git\nfprintd\nusbutils' run_setup
|
|
if grep -q '^pacman' "$CALL_LOG"; then
|
|
fail "a rerun with everything installed does not touch pacman"
|
|
fi
|
|
grep -qx enroll "$CALL_LOG" || fail "a rerun with everything installed reaches enrollment"
|
|
pass "a rerun with everything installed goes straight to enrollment"
|
|
|
|
INSTALL_STATUS=1 run_setup
|
|
if grep -qx enroll "$CALL_LOG"; then
|
|
fail "a failed package transaction prevents enrollment"
|
|
fi
|
|
pass "a failed installation stops before enrollment"
|
|
|
|
HARDWARE_STATUS=1 run_setup
|
|
[[ ! -s $CALL_LOG ]] || fail "missing hardware stops before package operations"
|
|
pass "missing hardware performs no package operations"
|