Gabriel Brown
dfc0c49877
Three surfaces the first laptop install showed were missing. The bar's battery icon gets an optional exact number beside it -- GNOME's "Show Battery Percentage", off by default for GNOME's reason, one color with the icon so it reads as one indicator. The Power page says what closing the lid does. The policy already existed (LidPolicy holds a suspend inhibitor while an external display is connected) but was surfaced nowhere, so the machine's most physical behavior was undiscoverable -- and the deliberate absence of an override deserves stating rather than leaving someone to hunt for a switch that does not exist. And the Users page grows a Fingerprint card, because fingerprint login is two systems that fail silently when they disagree: fprintd holds the enrolled prints, authselect decides whether PAM ever asks the reader. This machine arrived with a finger enrolled from its GNOME days and with-fingerprint off, which reads as "the reader is broken". The card shows both facts, flips the authselect feature through polkit with a stated reason, and hands enrollment to GNOME's Users panel, which owns the only good capture dialog -- a named exception in the handoff contract. Everything through scripts/panama-fingerprint, pinned by a stub-driven contract. Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh
87 lines
3.4 KiB
Bash
Executable File
87 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Fingerprint state and the one privileged switch, for the Users page.
|
|
#
|
|
# Two independent facts make a working fingerprint login, and conflating them
|
|
# is how the feature usually confuses people: fprintd must hold at least one
|
|
# enrolled print (GNOME's Users panel owns that dialog, and Panama hands off
|
|
# to it), and PAM must be told to ask the reader at all, which on Fedora is
|
|
# authselect's `with-fingerprint` feature. This helper reports both and can
|
|
# flip the second.
|
|
#
|
|
# Usage:
|
|
# panama-fingerprint status -> {"reader":bool,"readerName":"","enrolled":[],"pamEnabled":bool,"error":""}
|
|
# panama-fingerprint set-unlock on|off (prompts through panama-sudo/polkit)
|
|
#
|
|
# authselect is baseline Fedora (it manages PAM for the whole install), and
|
|
# fprintd ships with Workstation; a machine with neither simply reports no
|
|
# reader, which hides the card.
|
|
|
|
set -uo pipefail
|
|
|
|
PANAMA_PATH="${PANAMA_PATH:-$HOME/.local/share/Panama}"
|
|
|
|
emit() {
|
|
jq -cn \
|
|
--argjson reader "$1" \
|
|
--arg readerName "$2" \
|
|
--argjson enrolled "$3" \
|
|
--argjson pamEnabled "$4" \
|
|
--arg error "$5" \
|
|
'{reader: $reader, readerName: $readerName, enrolled: $enrolled,
|
|
pamEnabled: $pamEnabled, error: $error}'
|
|
}
|
|
|
|
cmd_status() {
|
|
command -v fprintd-list >/dev/null 2>&1 || { emit false "" '[]' false ""; return; }
|
|
|
|
# fprintd-list both answers "is there a reader" (fprintd is bus-activated,
|
|
# so this also copes with the daemon not running yet) and names the
|
|
# enrolled fingers in one call.
|
|
local listing
|
|
if ! listing="$(timeout 10 fprintd-list "$USER" 2>&1)"; then
|
|
# "No devices available" is the normal no-reader machine; anything
|
|
# else is a real problem worth surfacing.
|
|
if grep -qi 'no devices' <<<"$listing"; then
|
|
emit false "" '[]' false ""
|
|
else
|
|
emit false "" '[]' false "fprintd did not answer: $(head -1 <<<"$listing")"
|
|
fi
|
|
return
|
|
fi
|
|
|
|
# "Fingerprints for user gib on FocalTech ... (press):" carries the reader
|
|
# product name; " - #0: right-index-finger" lines carry the enrollment.
|
|
local name enrolled pam
|
|
name="$(sed -n 's/^Fingerprints for user [^ ]* on \(.*\) (\w*):$/\1/p' <<<"$listing" | head -1)"
|
|
enrolled="$(sed -n 's/^ *- #[0-9]*: //p' <<<"$listing" | jq -Rn '[inputs]')"
|
|
pam=false
|
|
authselect current 2>/dev/null | grep -q 'with-fingerprint' && pam=true
|
|
|
|
emit true "$name" "$enrolled" "$pam" ""
|
|
}
|
|
|
|
cmd_set_unlock() {
|
|
local verb reason
|
|
case "$1" in
|
|
on) verb=enable-feature
|
|
reason="Turning on fingerprint login: telling PAM (via authselect) to ask the fingerprint reader when unlocking" ;;
|
|
off) verb=disable-feature
|
|
reason="Turning off fingerprint login: telling PAM (via authselect) to stop asking the fingerprint reader" ;;
|
|
*) echo 'panama-fingerprint set-unlock takes on|off' >&2; exit 1 ;;
|
|
esac
|
|
|
|
local sudo_cmd=(sudo)
|
|
[[ -x "$PANAMA_PATH/bin/panama-sudo" ]] && sudo_cmd=(
|
|
"$PANAMA_PATH/bin/panama-sudo" --reason "$reason" --
|
|
)
|
|
"${sudo_cmd[@]}" authselect "$verb" with-fingerprint
|
|
}
|
|
|
|
case "${1:-}" in
|
|
status) cmd_status ;;
|
|
set-unlock) [[ -n "${2:-}" ]] || { echo 'panama-fingerprint set-unlock takes on|off' >&2; exit 1; }
|
|
cmd_set_unlock "$2" ;;
|
|
*) echo 'usage: panama-fingerprint status | set-unlock on|off' >&2; exit 1 ;;
|
|
esac
|