2.9 KiB
Plasma fingerprint workaround
This is an experimental and unaudited replacement for Fedora's KScreenLocker package. It changes security-sensitive session-locking and authentication code. Review the patches and build the package yourself if you do not trust the provided binary.
Installing plasma-fingerprint-workaround does not enable the workaround or
modify KScreenLocker. The controller only acts when explicitly asked:
sudo plasma-fingerprint-workaround enable
plasma-fingerprint-workaround status
sudo plasma-fingerprint-workaround disable
The default payload is kept outside the DNF repository. The controller checks
its pinned SHA-256 digest, RPM integrity, package name, architecture, and
workaround metadata before asking DNF to install it. Disabling the workaround
restores the current KScreenLocker package from Fedora's fedora or updates
repository.
The provided build currently supports Fedora 44 on x86_64 and is based on
kscreenlocker-6.7.5-1.fc44. A different base version is rejected by default.
To intentionally install the older provided build after a KScreenLocker update:
sudo plasma-fingerprint-workaround enable --force
Locally built package
Build dependencies can be installed and the package built with:
sudo dnf5 builddep plasma-fingerprint-workaround/kscreenlocker/kscreenlocker.spec
./scripts/build-patched-kscreenlocker-rpm
Install the resulting package directly through the controller:
sudo plasma-fingerprint-workaround enable \
--rpm rpmbuild/RPMS/x86_64/kscreenlocker-6.7.5-1.fc44.ajp6.x86_64.rpm
For another upstream version, supply its version, Fedora base release, and source archive checksum. The patches must still apply and compile cleanly.
KSCREENLOCKER_VERSION=6.7.5 \
KSCREENLOCKER_BASE_RELEASE=1 \
KSCREENLOCKER_SOURCE_SHA256=SHA256 \
./scripts/build-patched-kscreenlocker-rpm
A locally built package based on a different installed version requires
--force. This flag permits the version mismatch and allows DNF to downgrade;
it does not bypass the package identity, architecture, integrity, or workaround
metadata checks.
Authentication regression tests
With an extracted source tree and the patches applied in numeric order:
cmake -S plasma-fingerprint-workaround/tests/authentication \
-B local/fingerprint-tests -DKSCREENLOCKER_SOURCE=/path/to/patched/kscreenlocker
cmake --build local/fingerprint-tests
ctest --test-dir local/fingerprint-tests --output-on-failure
These tests compile the upstream authentication classes against a simulated PAM backend. They check retries after fingerprint timeout or temporary unavailability, preservation of the password conversation, absent smartcards, missing modules, the grace-period guard and incorrect passwords. They never access the system's authentication configuration. Actual reader behaviour and the lock-screen interface still require testing on the laptop.