Repository navigation
Normal driver installation now downloads a fixed Arch package and verifies its exact size and SHA-256, replacing installation-time builds with mutable toolchain dependencies. The root-owned staged package is verified again before pacman installation; downloads have HTTPS-only redirects, timeouts and a kernel-enforced size limit.
Development tests now use a committed uv.lock with exact pytest/Ruff versions and transitive hashes. Test commands run frozen and offline; bootstrap instructions are documented.
The driver remains package release 1.94.100.r626.0fd7856-5. Fingerprint matching, persistent enrollment and PAM password fallback are unchanged. The release includes the exact tested x86-64 package; SHA-256 is also pinned in the plugin source:
7af9fdb4ca35344ec3c7aa02742e15cd3a06a15266557b1a26c9d5443f6d8c94
Validation: 39 panel/helper/launcher/integrity Python tests, six build/package integration tests, and 99 native Meson entries passed (32 skipped). QML, manifest, desktop-entry, Ruff and Bash checks passed. The marketplace baseline reports zero findings and requires manual capability review. No new physical fingerprint scans or production authentication changes were performed. This is a locally built, integrity-pinned artifact, not a claim of reproducible-build attestation.