From 6f2fbde4f11cb2597a0f56df4c1a201dbf9a847b Mon Sep 17 00:00:00 2001 From: Bernardo Magri Date: Sun, 12 Jul 2026 19:10:19 +0100 Subject: [PATCH] =?UTF-8?q?docs(fingerprint):=20parallel=20prompt=20in=20H?= =?UTF-8?q?ARDWARE.md=20=C2=A75=20+=20MIGRATION=20note?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The feature commit updated the README table, template, ROADMAP and HARDWARE-QUEUE but missed the canonical user-facing page: HARDWARE.md §5 gets a "Parallel prompt" subsection (default, opt-out, structural lockout safety, grep to verify, known leftover-prompt quirk) and the option-summary table row; MIGRATION.md's fingerprint bullet points at it. Doc-only, V0. Co-Authored-By: Claude Fable 5 --- docs/HARDWARE.md | 18 +++++++++++++++++- docs/MIGRATION.md | 3 +++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/docs/HARDWARE.md b/docs/HARDWARE.md index ba1d5cb..928bbfb 100644 --- a/docs/HARDWARE.md +++ b/docs/HARDWARE.md @@ -167,6 +167,7 @@ Elan, …) via `lsusb` or `/sys/bus/usb/.../idVendor`. On hit: ```nix nomarchy.hardware.fingerprint.enable = true; # services.fprintd # nomarchy.hardware.fingerprint.pam = true; # login + sudo (opt-in) +# nomarchy.hardware.fingerprint.parallel = false; # sequential prompt instead ``` ### Enroll (menu or CLI) @@ -190,6 +191,21 @@ fprintd-list "$USER" PAM stays opt-in on purpose: password-only remains the cautious default until a finger is enrolled. Full enroll on a real reader is V3/hardware. +### Parallel prompt (password *or* finger, whichever first) + +With `fingerprint.pam` on, sudo/login/hyprlock show **one** prompt that +accepts either factor — type the password or touch the sensor +(2026-07-12; `pam-fprint-grosshack`, an fprintd fork, since stock PAM +can't express parallel factors). This is the default; +`fingerprint.parallel = false` restores stock pam_fprintd's sequential +wait-for-the-reader-then-password. Lockout safety is structural: the +module never validates passwords itself — a typed password is handed to +the normal `pam_unix` rule, and every failure (no reader, fprintd hung, +timeout) falls through to password, so finger auth can only ever *add* a +way in. Verify the wiring with +`grep pam_fprintd_grosshack /etc/pam.d/sudo`. Known cosmetic quirk: after +a fingerprint win a leftover password prompt may linger on the console. + ### Doctor `nomarchy-doctor` reports fprintd unit + enroll status when present. @@ -438,7 +454,7 @@ Full tables: [README § options](../README.md). Hardware-shaped surface: | `mkFlake.hardwareProfile` | nixos-hardware name or list | | `nomarchy.hardware.intel.enable` / `.guc` / `.computeRuntime` | Intel gap layer | | `nomarchy.hardware.amd.enable` / `.pstate` / `.vaapi` / `.rocm.*` | AMD gap layer | -| `nomarchy.hardware.fingerprint.enable` / `.pam` | fprintd + PAM | +| `nomarchy.hardware.fingerprint.enable` / `.pam` / `.parallel` | fprintd + PAM (parallel password-or-finger prompt by default) | | `nomarchy.hardware.npu.enable` | in-kernel NPU only | | `nomarchy.hardware.latestKernel` | `linuxPackages_latest` | | `nomarchy.hardware.camera.hideIrSensor` / `.irMatch` | dual-sensor webcams (v4l2 only; §7) | diff --git a/docs/MIGRATION.md b/docs/MIGRATION.md index 86cb378..1b9c802 100644 --- a/docs/MIGRATION.md +++ b/docs/MIGRATION.md @@ -269,6 +269,9 @@ default yet. on whenever fprintd is enabled; Nomarchy forces PAM to follow the `pam` flag, but only after a **system** rebuild. Verify with `grep pam_fprintd /etc/pam.d/sudo` (should be empty when pam is off). + With pam on, the prompt accepts password *or* finger in parallel by + default (`fingerprint.parallel = false` for stock sequential) — see + HARDWARE.md §5. - **Browser profiles:** Nomarchy does not manage Chromium/Firefox state. Bookmarks/extensions live under `~/.config/chromium` (or `~/.config/google-chrome` / ungoogled paths if that was your previous