ajp_anton/fedora-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rebase opt-in fingerprint workaround onto KScreenLocker 6.7.5

Browse Source
This commit is contained in:
ajp_anton
2026-09-12 05:05:58 +00:00
parent b8cb9dbddb
commit db352083cf
7 changed files with 228 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plasma-fingerprint-workaround/README.md
+20 -2
View File
@@ -21,7 +21,7 @@ restores the current KScreenLocker package from Fedora's `fedora` or `updates`
repository.
The provided build currently supports Fedora 44 on x86_64 and is based on
`kscreenlocker-6.7.4-1.fc44`. A different base version is rejected by default.
`kscreenlocker-6.7.5-1.fc44`. A different base version is rejected by default.
To intentionally install the older provided build after a KScreenLocker update:
```bash
@@ -41,7 +41,7 @@ Install the resulting package directly through the controller:
```bash
sudo plasma-fingerprint-workaround enable \
--rpm rpmbuild/RPMS/x86_64/kscreenlocker-6.7.4-1.fc44.ajp5.x86_64.rpm
--rpm rpmbuild/RPMS/x86_64/kscreenlocker-6.7.5-1.fc44.ajp6.x86_64.rpm
```
For another upstream version, supply its version, Fedora base release, and
@@ -58,3 +58,21 @@ A locally built package based on a different installed version requires
`--force`. This flag permits the version mismatch and allows DNF to downgrade;
it does not bypass the package identity, architecture, integrity, or workaround
metadata checks.
## Authentication regression tests
With an extracted source tree and the patches applied in numeric order:
```bash
cmake -S plasma-fingerprint-workaround/tests/authentication \
-B local/fingerprint-tests -DKSCREENLOCKER_SOURCE=/path/to/patched/kscreenlocker
cmake --build local/fingerprint-tests
ctest --test-dir local/fingerprint-tests --output-on-failure
```
These tests compile the upstream authentication classes against a simulated
PAM backend. They check retries after fingerprint timeout or temporary
unavailability, preservation of the password conversation, absent smartcards,
missing modules, the grace-period guard and incorrect passwords. They never
access the system's authentication configuration. Actual reader behaviour and
the lock-screen interface still require testing on the laptop.
plasma-fingerprint-workaround/kscreenlocker/kscreenlocker.spec
+5 -2
View File
@@ -1,6 +1,6 @@
%{!?upstream_version:%global upstream_version 6.7.4}
%{!?upstream_version:%global upstream_version 6.7.5}
%{!?base_release:%global base_release 1}
%{!?workaround_release:%global workaround_release 5}
%{!?workaround_release:%global workaround_release 6}
Name: kscreenlocker
Version: %{upstream_version}
@@ -103,6 +103,9 @@ install -D -m 0755 %{SOURCE1} \
%{_datadir}/dbus-1/interfaces/*.xml
%changelog
* Sat Sep 12 2026 Anton - 6.7.5-1.fc44.ajp6
- Rebase the existing fingerprint workaround onto Fedora's Plasma 6.7.5
* Fri Sep 04 2026 Anton - 6.7.4-1.fc44.ajp5
- Package the fprintd resume hook and compatibility metadata
- Apply the tested fingerprint retry patch set
plasma-fingerprint-workaround/payload.conf
+2 -2
View File
@@ -1,2 +1,2 @@
payload_url=https://git.ajpanton.se/api/packages/ajp_anton/generic/plasma-fingerprint-workaround/6.7.4-1.fc44.ajp5/kscreenlocker-6.7.4-1.fc44.ajp5.x86_64.rpm
payload_sha256=d64515f3c7cb9c44b1c8fc194e90503be5944b1d24094aab2f68d989b3eca381
payload_url=https://git.ajpanton.se/api/packages/ajp_anton/generic/plasma-fingerprint-workaround/6.7.5-1.fc44.ajp6/kscreenlocker-6.7.5-1.fc44.ajp6.x86_64.rpm
payload_sha256=ce454bfb8bcdb7c80e698fb0549f7765bc4570f5383ad7314eb2c292b7708532
plasma-fingerprint-workaround/plasma-fingerprint-workaround.spec
+4 -1
View File
@@ -1,6 +1,6 @@
Name: plasma-fingerprint-workaround
Version: 0.1.0
Release: 3%{?dist}
Release: 4%{?dist}
Summary: Opt-in patched KScreenLocker for fingerprint recovery after suspend
License: MIT
@@ -51,6 +51,9 @@ install -D -m 0644 %{SOURCE3} \
%{_datadir}/plasma-fingerprint-workaround/payload.conf
%changelog
* Sat Sep 12 2026 fedora-tools contributors - 0.1.0-4
- Update the opt-in payload to Fedora KScreenLocker 6.7.5
* Sat Sep 05 2026 fedora-tools contributors - 0.1.0-3
- Clarify what the workaround patches
plasma-fingerprint-workaround/tests/authentication/CMakeLists.txt
+32
View File
@@ -0,0 +1,32 @@
cmake_minimum_required(VERSION 3.25)
project(fingerprintRetryTests LANGUAGES CXX)
# Compile the actual patched upstream classes, but never use the host's PAM
# configuration or credentials. The test executable supplies a fake PAM API.
set(KSCREENLOCKER_SOURCE "" CACHE PATH "Extracted, patched KScreenLocker source")
if(NOT EXISTS "${KSCREENLOCKER_SOURCE}/greeter/pamauthenticator.cpp")
message(FATAL_ERROR "Set KSCREENLOCKER_SOURCE to the patched source directory")
endif()
set(CMAKE_CXX_STANDARD 23)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_AUTOMOC ON)
find_package(Qt6 REQUIRED COMPONENTS Core Test)
find_package(ECM REQUIRED NO_MODULE)
list(APPEND CMAKE_MODULE_PATH "${ECM_MODULE_PATH}")
include(ECMQtDeclareLoggingCategory)
set(sources retrytest.cpp
${KSCREENLOCKER_SOURCE}/greeter/pamauthenticator.cpp
${KSCREENLOCKER_SOURCE}/greeter/pamauthenticators.cpp)
ecm_qt_declare_logging_category(sources
HEADER kscreenlocker_greet_logging.h
IDENTIFIER KSCREENLOCKER_GREET
CATEGORY_NAME kscreenlocker_greet)
add_executable(retrytest ${sources})
target_include_directories(retrytest PRIVATE
${CMAKE_CURRENT_BINARY_DIR} ${KSCREENLOCKER_SOURCE}/greeter)
target_compile_definitions(retrytest PRIVATE HAVE_PAM_FAIL_DELAY)
target_link_libraries(retrytest PRIVATE Qt6::Core Qt6::Test)
enable_testing()
add_test(NAME fingerprint-retry COMMAND retrytest)
set_tests_properties(fingerprint-retry PROPERTIES TIMEOUT 30)
plasma-fingerprint-workaround/tests/authentication/retrytest.cpp
+160
View File
@@ -0,0 +1,160 @@
#include "pamauthenticators.h"
#include <QSignalSpy>
#include <QTest>
#include <security/pam_appl.h>
#include <cstdlib>
#include <cstring>
// Test-only PAM implementation. No real authentication or system files are used.
struct pam_handle {
QByteArray service;
pam_conv conversation;
int attempts = 0;
};
int pam_start(const char *service, const char *, const pam_conv *conversation, pam_handle_t **handle)
{
*handle = new pam_handle{service, *conversation};
return PAM_SUCCESS;
}
int pam_end(pam_handle_t *handle, int)
{
delete handle;
return PAM_SUCCESS;
}
int pam_set_item(pam_handle_t *, int, const void *) { return PAM_SUCCESS; }
int pam_setcred(pam_handle_t *, int) { return PAM_SUCCESS; }
const char *pam_strerror(pam_handle_t *, int) { return "simulated PAM result"; }
int pam_authenticate(pam_handle_t *handle, int)
{
++handle->attempts;
if (handle->service == "missing") {
return PAM_MODULE_UNKNOWN;
}
if (handle->service == "transient" && handle->attempts == 1) {
return PAM_AUTHINFO_UNAVAIL;
}
if (handle->service == "timeout" && handle->attempts == 1) {
return PAM_MAXTRIES;
}
pam_message message{PAM_PROMPT_ECHO_OFF, "Test credential:"};
const pam_message *messages = &message;
pam_response *response = nullptr;
const auto &conversation = handle->conversation;
const int result = conversation.conv(1, &messages, &response, conversation.appdata_ptr);
if (result != PAM_SUCCESS) {
return result;
}
const bool accepted = response && response->resp && std::strcmp(response->resp, "correct") == 0;
if (response) {
std::free(response->resp);
std::free(response);
}
return accepted ? PAM_SUCCESS : PAM_AUTH_ERR;
}
class RetryTest : public QObject
{
Q_OBJECT
private Q_SLOTS:
void retryWithActivePassword_data()
{
QTest::addColumn<QString>("service");
QTest::newRow("temporary unavailability") << QStringLiteral("transient");
QTest::newRow("attempt timeout") << QStringLiteral("timeout");
}
void retryWithActivePassword()
{
QFETCH(QString, service);
auto password = std::make_unique<PamAuthenticator>(QStringLiteral("password"), QStringLiteral("test"));
auto fingerprint = std::make_unique<PamAuthenticator>(service, QStringLiteral("test"), PamAuthenticator::Fingerprint);
auto *fingerprintPtr = fingerprint.get();
QSignalSpy passwordPrompts(password.get(), &PamAuthenticator::promptForSecret);
QSignalSpy fingerprintPrompts(fingerprintPtr, &PamAuthenticator::promptForSecret);
QSignalSpy fingerprintFailures(fingerprintPtr, &PamAuthenticator::failed);
std::vector<std::unique_ptr<PamAuthenticator>> others;
others.push_back(std::move(fingerprint));
PamAuthenticators authenticators(std::move(password), std::move(others));
QSignalSpy successes(&authenticators, &PamAuthenticators::succeeded);
authenticators.startAuthenticating();
QTRY_COMPARE(passwordPrompts.count(), 1);
QTRY_COMPARE_WITH_TIMEOUT(fingerprintFailures.count(), 1, 2000);
QTRY_VERIFY(!fingerprintPtr->isAvailable());
QCOMPARE(authenticators.state(), PamAuthenticators::Authenticating);
QVERIFY(!authenticators.isUnlocked());
authenticators.startAuthenticating();
QTRY_COMPARE_WITH_TIMEOUT(fingerprintPrompts.count(), 1, 2000);
QTRY_VERIFY(fingerprintPtr->isAvailable());
// Repeated starts must not duplicate either active conversation.
authenticators.startAuthenticating();
QTest::qWait(100);
QCOMPARE(passwordPrompts.count(), 1);
QCOMPARE(fingerprintPrompts.count(), 1);
QCOMPARE(successes.count(), 0);
// The original password conversation still accepts a response.
authenticators.respond("correct");
QTRY_COMPARE(successes.count(), 1);
QVERIFY(authenticators.isUnlocked());
}
void permanentUnavailability_data()
{
QTest::addColumn<QString>("service");
QTest::addColumn<int>("type");
QTest::newRow("absent smartcard") << QStringLiteral("transient") << int(PamAuthenticator::Smartcard);
QTest::newRow("missing fingerprint module") << QStringLiteral("missing") << int(PamAuthenticator::Fingerprint);
}
void permanentUnavailability()
{
QFETCH(QString, service);
QFETCH(int, type);
PamAuthenticator auth(service, QStringLiteral("test"), PamAuthenticator::NoninteractiveAuthenticatorType(type));
QSignalSpy availability(&auth, &PamAuthenticator::availableChanged);
QSignalSpy prompts(&auth, &PamAuthenticator::promptForSecret);
auth.tryUnlock();
QTRY_VERIFY(availability.count() >= 3);
QVERIFY(!auth.isAvailable());
availability.clear();
auth.tryUnlock();
QTest::qWait(100);
QCOMPARE(availability.count(), 0);
QCOMPARE(prompts.count(), 0);
QVERIFY(!auth.isUnlocked());
}
void graceAndIncorrectPassword()
{
auto password = std::make_unique<PamAuthenticator>(QStringLiteral("password"), QStringLiteral("test"));
PamAuthenticators authenticators(std::move(password), {});
QSignalSpy prompts(&authenticators, &PamAuthenticators::promptForSecretChanged);
QSignalSpy failures(&authenticators, &PamAuthenticators::failed);
QSignalSpy successes(&authenticators, &PamAuthenticators::succeeded);
authenticators.setGraceLocked(true);
authenticators.startAuthenticating();
QTest::qWait(100);
QCOMPARE(prompts.count(), 0);
authenticators.setGraceLocked(false);
authenticators.startAuthenticating();
QTRY_COMPARE(prompts.count(), 1);
authenticators.respond("incorrect");
QTRY_COMPARE(failures.count(), 1);
QCOMPARE(successes.count(), 0);
QVERIFY(!authenticators.isUnlocked());
authenticators.startAuthenticating();
QTRY_COMPARE(prompts.count(), 2);
authenticators.respond("correct");
QTRY_COMPARE(successes.count(), 1);
}
};
QTEST_GUILESS_MAIN(RetryTest)
#include "retrytest.moc"
scripts/build-patched-kscreenlocker-rpm
+5 -3
View File
@@ -5,13 +5,15 @@ set -euo pipefail
repo_root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
source_dir="$repo_root/plasma-fingerprint-workaround/kscreenlocker"
topdir="$repo_root/rpmbuild"
version=${KSCREENLOCKER_VERSION:-6.7.4}
version=${KSCREENLOCKER_VERSION:-6.7.5}
base_release=${KSCREENLOCKER_BASE_RELEASE:-1}
workaround_release=${KSCREENLOCKER_WORKAROUND_RELEASE:-5}
workaround_release=${KSCREENLOCKER_WORKAROUND_RELEASE:-6}
archive="$topdir/SOURCES/kscreenlocker-$version.tar.xz"
archive_url="https://download.kde.org/stable/plasma/$version/kscreenlocker-$version.tar.xz"
if [[ $version == 6.7.4 ]]; then
if [[ $version == 6.7.5 ]]; then
default_archive_sha256=6c41ce2cb79d2b85d4fbe5a3a61c09e40c70e5a869ae6f0352c7e1cb3b44606b
elif [[ $version == 6.7.4 ]]; then
default_archive_sha256=f9cd525d501f08931f2c0b4d08f5384588967bc89fac62e39ed4ae2da2925a39
else
default_archive_sha256=