Let the laptop say what it is doing: battery percentage, the lid, a fingerprint
Three surfaces the first laptop install showed were missing. The bar's battery icon gets an optional exact number beside it -- GNOME's "Show Battery Percentage", off by default for GNOME's reason, one color with the icon so it reads as one indicator. The Power page says what closing the lid does. The policy already existed (LidPolicy holds a suspend inhibitor while an external display is connected) but was surfaced nowhere, so the machine's most physical behavior was undiscoverable -- and the deliberate absence of an override deserves stating rather than leaving someone to hunt for a switch that does not exist. And the Users page grows a Fingerprint card, because fingerprint login is two systems that fail silently when they disagree: fprintd holds the enrolled prints, authselect decides whether PAM ever asks the reader. This machine arrived with a finger enrolled from its GNOME days and with-fingerprint off, which reads as "the reader is broken". The card shows both facts, flips the authselect feature through polkit with a stated reason, and hands enrollment to GNOME's Users panel, which owns the only good capture dialog -- a named exception in the handoff contract. Everything through scripts/panama-fingerprint, pinned by a stub-driven contract. Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh
This commit is contained in:
Gabriel Brown
@@ -70,6 +70,7 @@ package_for() {
|
||||
case "$1" in
|
||||
zbarimg) printf 'zbar' ;;
|
||||
fc-list|fc-match) printf 'fontconfig' ;;
|
||||
fprintd-list) printf 'fprintd' ;;
|
||||
lspci) printf 'pciutils' ;;
|
||||
getenforce) printf 'libselinux-utils' ;;
|
||||
nmcli) printf 'NetworkManager' ;;
|
||||
|
||||
Executable
+110
@@ -0,0 +1,110 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Fingerprint login, which is two systems that must be kept honest with each
|
||||
# other: fprintd holds the enrolled prints, authselect decides whether PAM
|
||||
# asks the reader. A print enrolled while with-fingerprint is off does
|
||||
# nothing, and that silence -- "I enrolled a finger and nothing happened" --
|
||||
# is the failure this card exists to name.
|
||||
#
|
||||
# The helper is the parse surface, so it runs for real against stub fprintd
|
||||
# and authselect; the page and service checks are structural.
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||||
helper="$repo_dir/config/dot/quickshell/scripts/panama-fingerprint"
|
||||
service="$repo_dir/config/dot/quickshell/services/Fingerprint.qml"
|
||||
page="$repo_dir/config/dot/quickshell/modules/settings/UsersPage.qml"
|
||||
|
||||
fail() {
|
||||
printf 'fingerprint contract: %s\n' "$1" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
# ── Wiring ───────────────────────────────────────────────────────────────────
|
||||
|
||||
rg -Fq 'visible: Fingerprint.readerPresent' "$page" \
|
||||
|| fail 'the card is not hidden on machines with no reader'
|
||||
rg -Fq 'onToggled: value => Fingerprint.setUnlockEnabled(value)' "$page" \
|
||||
|| fail 'the unlock switch does not drive authselect'
|
||||
rg -Fq 'SystemSettings.openGnomePanel("system", "users")' "$page" \
|
||||
|| fail 'enrollment does not hand off to the GNOME Users panel'
|
||||
rg -Fq 'Fingerprint.refresh()' "$page" \
|
||||
|| fail 'the page never reads the fingerprint state'
|
||||
rg -Fq 'authselect' "$helper" && rg -Fq 'with-fingerprint' "$helper" \
|
||||
|| fail 'the helper does not manage the authselect feature'
|
||||
rg -Fq -- '--reason' "$helper" \
|
||||
|| fail 'the privileged change carries no stated reason'
|
||||
rg -Fq 'function fingerLabel' "$service" \
|
||||
|| fail 'finger names have no single place to be presented from'
|
||||
|
||||
# ── The helper against stub fprintd and authselect ───────────────────────────
|
||||
|
||||
stub_dir="$(mktemp -d)"
|
||||
state_dir="$(mktemp -d)"
|
||||
trap 'rm -rf "$stub_dir" "$state_dir"' EXIT
|
||||
|
||||
cat >"$stub_dir/fprintd-list" <<STUB
|
||||
#!/usr/bin/env bash
|
||||
if [[ -e "$state_dir/no-reader" ]]; then
|
||||
echo 'Impossible to enumerate devices: No devices available'
|
||||
exit 1
|
||||
fi
|
||||
cat <<'OUT'
|
||||
found 1 devices
|
||||
Device at /net/reactivated/Fprint/Device/0
|
||||
Using device /net/reactivated/Fprint/Device/0
|
||||
Fingerprints for user gib on Goodix MOC Fingerprint Sensor (press):
|
||||
- #0: right-index-finger
|
||||
- #1: left-thumb
|
||||
OUT
|
||||
STUB
|
||||
|
||||
cat >"$stub_dir/authselect" <<STUB
|
||||
#!/usr/bin/env bash
|
||||
echo "\$*" >>"$state_dir/authselect-log"
|
||||
if [[ "\$1" == "current" ]]; then
|
||||
echo 'Profile ID: local'
|
||||
[[ -e "$state_dir/pam-on" ]] && echo '- with-fingerprint'
|
||||
exit 0
|
||||
fi
|
||||
STUB
|
||||
|
||||
# PANAMA_PATH pointed at an empty directory forces the plain-sudo fallback,
|
||||
# which the stub records instead of escalating.
|
||||
cat >"$stub_dir/sudo" <<STUB
|
||||
#!/usr/bin/env bash
|
||||
echo "\$*" >>"$state_dir/sudo-log"
|
||||
exec "\$@"
|
||||
STUB
|
||||
chmod +x "$stub_dir"/fprintd-list "$stub_dir"/authselect "$stub_dir"/sudo
|
||||
|
||||
run() { PANAMA_PATH="$state_dir" PATH="$stub_dir:$PATH" "$helper" "$@"; }
|
||||
|
||||
status="$(run status)"
|
||||
jq -e '.reader and .readerName == "Goodix MOC Fingerprint Sensor"' <<<"$status" >/dev/null \
|
||||
|| fail "the reader name did not parse: $status"
|
||||
jq -e '.enrolled == ["right-index-finger", "left-thumb"]' <<<"$status" >/dev/null \
|
||||
|| fail "enrolled fingers did not parse: $status"
|
||||
jq -e '.pamEnabled == false and .error == ""' <<<"$status" >/dev/null \
|
||||
|| fail "authselect state misread as enabled: $status"
|
||||
|
||||
touch "$state_dir/pam-on"
|
||||
jq -e '.pamEnabled == true' <<<"$(run status)" >/dev/null \
|
||||
|| fail 'with-fingerprint enabled was not detected'
|
||||
|
||||
# No reader is a normal machine, not an error.
|
||||
touch "$state_dir/no-reader"
|
||||
jq -e '.reader == false and .error == ""' <<<"$(run status)" >/dev/null \
|
||||
|| fail "a readerless machine was reported as a problem: $(run status)"
|
||||
rm -f "$state_dir/no-reader"
|
||||
|
||||
# The privileged change goes through, with the right feature name.
|
||||
run set-unlock on >/dev/null
|
||||
grep -Fq 'authselect enable-feature with-fingerprint' "$state_dir/sudo-log" \
|
||||
|| fail 'set-unlock on did not enable the authselect feature'
|
||||
run set-unlock off >/dev/null
|
||||
grep -Fq 'authselect disable-feature with-fingerprint' "$state_dir/sudo-log" \
|
||||
|| fail 'set-unlock off did not disable the authselect feature'
|
||||
|
||||
printf 'fingerprint contract: ok\n'
|
||||
@@ -49,6 +49,7 @@ declare -A OWNED=(
|
||||
# Anything here must be justified, not merely tolerated.
|
||||
declare -A ALLOWED=(
|
||||
["OnlineAccountsPage.qml:online-accounts"]="adding an account requires GOA's own dialog"
|
||||
["UsersPage.qml:system-users"]="fingerprint enrollment requires fprintd's guided capture flow, and GNOME's Users panel carries the only good dialog for it"
|
||||
)
|
||||
|
||||
pages="$(grep -oE '\{ *page: "[a-z-]+"' "$sidebar" | sed 's/.*"\(.*\)"/\1/' | sort -u)"
|
||||
|
||||
Reference in New Issue
Block a user