v1.6.0

Upgrading

After upgrading, run tpm-keyring-unlock-configure once more (./install.sh in a git checkout) to be asked the new polkit question below. Answer n at "Overwrite?" to keep your sealed secret.

Fingerprint for polkit prompts, if you want it

The configure step can now give polkit prompts (App Center and snap installs, other admin actions) a fingerprint line of their own, in /etc/pam.d/polkit-1. The lock screen never reads that file, so the reader race the installer fixes there does not come back.

It is asked the other way round: answer n to "Keep polkit prompts password-only?" to add the line. Enter keeps polkit password-only. With the line, an enrolled finger alone approves any polkit prompt, installing software and other root-level changes included. tpm-keyring-unlock-deconfigure (./uninstall.sh) takes it back out.

The question appears only when polkit prompts would otherwise take no fingerprint (already, or after the greeter fix in the same run) and you have a finger enrolled.

What's Changed

• feat: offer polkit prompts a fingerprint line of their own, Enter keeping them password-only by @dmitriitimoshenko in #26
• release: 1.6.0 by @dmitriitimoshenko in #27

Full Changelog: v1.5.1...v1.6.0

v1.5.1

Upgrading

After upgrading, run tpm-keyring-unlock-configure once more (./install.sh in a git checkout). On Fedora that run wires gdm-fingerprint and, under SELinux, loads the policy module that lets GDM reach the TPM; everywhere it re-checks the PAM stacks an older version wired. Answer n at "Overwrite?" to keep your sealed secret.

Fedora 44 packages are now published too: Fedora_44 in the Build Service repository.

What's Changed

• fix: wire Fedora's keyring-less gdm-fingerprint, and let GDM reach the TPM under SELinux by @dmitriitimoshenko in #24
• release: 1.5.1 by @dmitriitimoshenko in #25

Full Changelog: v1.5.0...v1.5.1

v1.5.0

Upgrading

After upgrading, run tpm-keyring-unlock-configure once more (./install.sh in a git checkout). It re-checks the PAM stacks an older version wired, and takes the helper back out of any that the stricter checks now refuse. Answer n at "Overwrite?" to keep your sealed secret.

What's Changed

• fix: stop promising sudo keeps fingerprint, and follow libpam into /usr/lib/pam.d by @dmitriitimoshenko in #20
• fix: let only vetted modules run after the helper, and read PAM lines as libpam does by @dmitriitimoshenko in #21
• release: 1.5.0 by @dmitriitimoshenko in #22

Full Changelog: v1.4.1...v1.5.0

v1.4.1

What's Changed

• release: 1.4.1 by @dmitriitimoshenko in #18

Full Changelog: v1.4.0...v1.4.1

v1.4.0

What's Changed

• feat: adopting for aur and obs by @dmitriitimoshenko in #17

Full Changelog: v1.3.1...v1.4.0

v1.3.1

What's Changed

• chore: minor bugs fixes and docs upd by @dmitriitimoshenko in #16

Full Changelog: v1.3.0...v1.3.1

v1.3.0

What's Changed

• fix: detect auth lines written with the pam.conf "-" prefix by @SoulInfernoDE in #6
• feat: fingerpring attempt stack by @dmitriitimoshenko in #9
• fix: preserve enrollment when resealing fails by @Tunahanyrd in #5
• feat: fingerpring attempt stack pt.2 by @dmitriitimoshenko in #10
• fix: survive eviction of the shared TPM primary, and say what PCR7 protects by @dmitriitimoshenko in #11
• fix: verify the sealed blob by descriptor, not by path, and restore #12 to main by @dmitriitimoshenko in #13
• chore: docs upd by @dmitriitimoshenko in #14
• chore: docs upd pt.2 by @dmitriitimoshenko in #15

New Contributors

• @SoulInfernoDE made their first contribution in #6
• @Tunahanyrd made their first contribution in #5

Full Changelog: v1.1.7...v1.3.0

v1.1.7

What's Changed

• chore: less confirmations for better UX with the same set of information by @dmitriitimoshenko in #4

Full Changelog: v1.1.6...v1.1.7

v1.1.6

What's Changed

• feat: persist tpm primary key, not recreating on every login by @dmitriitimoshenko in #3

Full Changelog: v1.1.5...v1.1.6

v1.1.5

What's Changed

• release 1.1.4 by @dmitriitimoshenko in #1
• release 1.1.5 by @dmitriitimoshenko in #2

New Contributors

• @dmitriitimoshenko made their first contribution in #1

Full Changelog: v1.1.3...v1.1.5