Fix update discovery and isolate fingerprint installer permissions

plasma-fingerprint-workaround/plasma-fingerprint-workaround

@@ -36,6 +36,12 @@ require_fedora() {
     [[ ${ID:-} == fedora ]] || die "this workaround only supports Fedora Linux"
 }
 
+run_dnf() (
+    # The private download's umask must not make DNF's system state root-only.
+    umask 022
+    dnf5 "$@"
+)
+
 cleanup() {
     [[ -n $temporary_dir ]] || return
     rm -f -- "$temporary_dir/kscreenlocker.rpm"
@@ -233,7 +239,7 @@ enable_workaround() {
 
     dnf_args=(install --assumeyes)
     (( force )) && dnf_args+=(--allow-downgrade)
-    dnf5 "${dnf_args[@]}" "$candidate"
+    run_dnf "${dnf_args[@]}" "$candidate"
 
     is_workaround_package -q kscreenlocker ||
         die "DNF completed without enabling the workaround"
@@ -264,7 +270,7 @@ disable_workaround() {
     printf 'This will replace the workaround with Fedora\x27s current KScreenLocker package.\n'
     confirm
 
-    dnf5 \
+    run_dnf \
         --repo=fedora,updates \
         --refresh \
         distro-sync \

plasma-fingerprint-workaround/plasma-fingerprint-workaround.spec

@@ -1,6 +1,6 @@
 Name:           plasma-fingerprint-workaround
 Version:        0.1.0
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        Opt-in patched KScreenLocker for fingerprint recovery after suspend
 
 License:        MIT
@@ -51,6 +51,9 @@ install -D -m 0644 %{SOURCE3} \
 %{_datadir}/plasma-fingerprint-workaround/payload.conf
 
 %changelog
+* Sat Sep 12 2026 fedora-tools contributors - 0.1.0-6
+- Keep private-download permissions from leaking into DNF's system state
+
 * Sat Sep 12 2026 fedora-tools contributors - 0.1.0-5
 - Simplify status queries and extend invalid-command tests
 

plasma-fingerprint-workaround/tests/test-controller

@@ -29,4 +29,23 @@ source "$payload_config"
 [[ $payload_url == https://*/*.rpm ]]
 [[ $payload_sha256 =~ ^[[:xdigit:]]{64}$ ]]
 
+# Load the functions through the harmless help command, then replace DNF with
+# a test function. Never invoke the package manager in this test.
+(
+    source "$controller" --help >/dev/null
+    dnf5() {
+        [[ $(umask) == 0022 && $1 == test-argument ]]
+    }
+    umask 077
+    run_dnf test-argument
+    [[ $(umask) == 0077 ]]
+    dnf5() { return 23; }
+    if run_dnf test-argument; then
+        printf 'DNF failure was not propagated.\n' >&2
+        exit 1
+    else
+        [[ $? == 23 ]]
+    fi
+)
+
 printf 'Controller tests passed.\n'