Add fingerprint reader selection and lid-based routing

2026-09-21 19:02:37 +02:00
commit b8967e9505
15 changed files with 2979 additions and 0 deletions
@@ -0,0 +1,50 @@
+# Validation — 2026-09-20
+
+Host: Aurora 44; libfprint `1.94.100-1.fc44`; fprintd `1.94.5-5.fc44`.
+
+Completed:
+
+- `cargo build --release --offline --locked` — passed; executable at
+  `target/release/fingerprint-switch`.
+- `cargo test --offline --locked` — **24 passed**: 12 private-D-Bus lifecycle
+  tests, 8 routing tests, 3 reader-selection tests, 1 CLI validation test.
+  Mock buses require permission to create local sockets. They do not use the
+  system fprintd or write biometrics.
+- `cargo clippy --all-targets --offline --locked -- -D warnings` — passed.
+- `cargo fmt --check` — passed.
+- Shell syntax checks and ShellCheck for both installer scripts — passed.
+- `systemd-analyze verify` — passed for temporary copies of both service units
+  and the fprintd drop-in together. The staged unit's executable path was replaced
+  with the built workspace binary solely for this check. Nothing was installed.
+- Final release `probe --sensor external` — real Microarray reader opened and
+  released successfully through fprintd; no enrollment.
+- Final release `probe --sensor internal` — real Goodix reader opened and
+  released successfully through fprintd; no enrollment.
+- Final release `status` — detected both readers, open lid, and selected Goodix
+  for CLI auto mode. Goodix still listed its three existing finger enrollments;
+  Microarray listed none.
+- ELF interpreter and dependencies resolve to system `/lib64` libraries, so the
+  binary does not depend on a Homebrew path hidden by the systemd service's
+  `ProtectHome` setting.
+
+Not yet performed:
+
+- Real enrollment, matching and rejection with a person touching each sensor.
+- Installing/starting the watcher or changing host authentication configuration.
+- Physical lid-close/open and USB-unplug routing with the installed service.
+
+The tests validate policy and error handling; they do not establish fingerprint
+matching accuracy or prove the uninstalled system integration end to end.
+
+Suggested hands-on check after enrollment and opt-in installation:
+
+1. Verify the enrolled finger on each reader using explicit CLI selection while
+   both readers are exposed (`mode both` if the watcher is installed).
+2. Check rejection with a different, unenrolled finger on each reader.
+3. Set `mode auto`, keep the lid open and confirm `list` exposes Goodix.
+4. Close the lid while docked and awake; confirm Microarray is exposed and can
+   authenticate. Existing system power settings still determine suspend behavior.
+5. Reopen the lid and confirm Goodix returns. Unplug the USB reader and check
+   fallback. Keep a password-based session available while testing.
+6. Verify an ordinary configured fingerprint authentication flow, such as the
+   screen lock or sudo, then test the uninstall script if rollback is desired.