elegos/linux-hello
Watch
1
0
Fork
You've already forked linux-hello
 0
Code Issues 1 Pull requests Projects 1 Releases 2 Packages Wiki Activity Actions
2 releases 2 tags
  • v0.1.0-alpha2 1bf428426c

    0.1.0-alpha2
    All checks were successful
    Package / Discover supported releases (push) Successful in 2s
    Details
    CI / Format & Lint (push) Successful in 1m31s
    Details
    CI / Toolchain check (rust:1.97) (push) Successful in 1m55s
    Details
    Rebuild Cargo Cache / Populate linux-hello-cargo-cache volume (push) Successful in 2m51s
    Details
    CI / Test (push) Successful in 2m56s
    Details
    SAST / SAST (audit · deny · geiger · semgrep) (push) Successful in 4m2s
    Details
    Package / Arch Linux / CachyOS / Manjaro / EndeavourOS (push) Successful in 15m1s
    Details
    Package / DEB — debian:trixie (debian:trixie, debian-trixie) (push) Successful in 13m39s
    Details
    Package / DEB — ubuntu:22.04 (incomplete matrix)-1 (push) Successful in 13m53s
    Details
    Package / DEB — ubuntu:26.04 (incomplete matrix)-1 (push) Successful in 6m2s
    Details
    Package / RPM — fedora:43 (fedora:43, fedora-43) (push) Successful in 23m51s
    Details
    Package / DEB — ubuntu:24.04 (incomplete matrix)-1 (push) Successful in 21m25s
    Details
    Package / RPM — fedora:44 (fedora:44, fedora-44) (push) Successful in 34m29s
    Details
    Package / Create Forgejo release (push) Successful in 16s
    Details
    Pre-release

    elegos released this 2026-08-28 12:34:33 +02:00 | 2 commits to develop since this release

    This is a first, pre-release preview.

    It is currently feature-full, though it has been tested on Fedora 44 only.
    Fingerprint enroll / usage has not been tested due to no device available.

    Changes from alpha-1

    • SDDM SELinux (mainly targeting Fedora-based distros) hotfix

    Currently tested

    • Face (webcam RGB)
    • Face (IR Windows Hello — Nexigo camera). Tested with a single UVC infrared
      webcam; other cameras may have issues.
    • PIN
    • FIDO2 USB key
    • TOTP
    • SDDM and kscreenlocker themes

    Not tested

    • Fingerprint (no device available)
    • Recovery token
    • swaylock, hyprlock, greetd, LightDM integrations

    Quick setup

    1. Install the package.
    2. Ensure the following system-wide services are enabled and running:
      • linux-hello — main authentication daemon
      • linux-hello-sddm-helper — HTTP bridge required by the SDDM theme
      • linux-hello-reseal — re-seals TPM keys at boot (only relevant with
        Secure Boot + TPM 2.0; harmless otherwise)
    3. Optionally enable the following user services
      (systemctl enable --user --now):
      • linux-hello-overlay — graphical Wayland overlay during auth (not needed
        under SDDM)
      • linux-hello-notify — desktop notification on key inconsistency errors
    4. Run Linux Hello Enrollment and enroll your preferred authentication
      methods.
    5. Run Linux Hello Admin:
      • Choose your recovery mode.
      • Enable the integrations you want to use.
      • Configure the authentication policies.
      • Apply a linux-hello theme:
        • SDDM — use the theme picker in the Admin UI.
        • KDE lockscreen (kscreenlocker) — use the Install lockscreen theme
          button; this patches the Plasma files and is automatically re-applied
          on plasma-desktop upgrades.
    6. Go to your display manager settings and select the linux-hello SDDM theme.

    Recovery / escape hatches

    Tip: do not add linux-hello to the login PAM service (TTY logins).
    Keeping TTY login as pure password authentication gives you an always-available
    escape hatch regardless of what happens to the graphical session.

    Locked screen won't unlock

    Switch to a free TTY (Ctrl+Alt+F2), log in with your password, then:

    loginctl unlock-sessions

    Switch back to your graphical session (Ctrl+Alt+F1 or whichever VT it is on).

    SDDM theme broken / login loop

    Switch to a TTY and log in with your password, then either:

    • Disable the linux-hello SDDM theme — change the active theme back to the
      default:
      sudo sed -i 's/^Current=.*/Current=breeze/' /etc/sddm.conf.d/kde_settings.conf
      sudo systemctl restart sddm
      (adjust the config path and theme name to match your system)
    • Or disable the SDDM integration entirely via the Admin TUI:
      sudo linux-hello-admin # launches the TUI when run without a display
      Navigate to Integrations, disable SDDM, and apply.

    KDE lockscreen patch gone wrong

    From a TTY or a working terminal:

    sudo linux-hello-admin lockscreen uninstall

    This reverts the Plasma files to their original state. Log out and back in to
    reload the lockscreen.

    Nuclear option — disable linux-hello entirely

    sudo systemctl stop linux-hello linux-hello-sddm-helper
    sudo systemctl disable linux-hello linux-hello-sddm-helper

    PAM will fall through to pam_unix (password) automatically, because the PAM
    stacks use default=ignore — a linux-hello failure or absence never blocks
    login on its own.

    Downloads
  • v0.1.0-alpha1 4b36ecf298

    0.1.0-alpha1
    Some checks failed
    CI / Toolchain check (rust:1.97) (push) Successful in 1m3s
    Details
    Package / Discover supported releases (push) Successful in 3s
    Details
    CI / Test (push) Successful in 1m55s
    Details
    CI / Format & Lint (push) Successful in 2m10s
    Details
    SAST / SAST (audit · deny · geiger · semgrep) (push) Successful in 2m52s
    Details
    Package / DEB — ubuntu:22.04 (incomplete matrix)-1 (push) Successful in 15m24s
    Details
    Package / Arch Linux / CachyOS / Manjaro / EndeavourOS (push) Successful in 16m12s
    Details
    Package / DEB — ubuntu:24.04 (incomplete matrix)-1 (push) Successful in 15m36s
    Details
    Package / DEB — debian:trixie (debian:trixie, debian-trixie) (push) Successful in 6m10s
    Details
    Package / DEB — ubuntu:26.04 (incomplete matrix)-1 (push) Successful in 22m14s
    Details
    Package / RPM — fedora:44 (fedora:44, fedora-44) (push) Successful in 26m25s
    Details
    Package / RPM — fedora:43 (fedora:43, fedora-43) (push) Successful in 34m20s
    Details
    Package / Create Forgejo release (push) Failing after 25s
    Details
    Pre-release

    elegos released this 2026-08-28 00:00:28 +02:00 | 6 commits to develop since this release

    This is a first, pre-release preview.

    It is currently feature-full, though it has been tested on Fedora 44 only.
    Fingerprint enroll / usage has not been tested due to no device available.

    Currently tested

    • Face (webcam RGB)
    • Face (IR Windows Hello — Nexigo camera). Tested with a single UVC infrared
      webcam; other cameras may have issues.
    • PIN
    • FIDO2 USB key
    • TOTP
    • SDDM and kscreenlocker themes

    Not tested

    • Fingerprint (no device available)
    • Recovery token
    • swaylock, hyprlock, greetd, LightDM integrations

    Quick setup

    1. Install the package.
    2. Ensure the following system-wide services are enabled and running:
      • linux-hello — main authentication daemon
      • linux-hello-sddm-helper — HTTP bridge required by the SDDM theme
      • linux-hello-reseal — re-seals TPM keys at boot (only relevant with
        Secure Boot + TPM 2.0; harmless otherwise)
    3. Optionally enable the following user services
      (systemctl enable --user --now):
      • linux-hello-overlay — graphical Wayland overlay during auth (not needed
        under SDDM)
      • linux-hello-notify — desktop notification on key inconsistency errors
    4. Run Linux Hello Enrollment and enroll your preferred authentication
      methods.
    5. Run Linux Hello Admin:
      • Choose your recovery mode.
      • Enable the integrations you want to use.
      • Configure the authentication policies.
      • Apply a linux-hello theme:
        • SDDM — use the theme picker in the Admin UI.
        • KDE lockscreen (kscreenlocker) — use the Install lockscreen theme
          button; this patches the Plasma files and is automatically re-applied
          on plasma-desktop upgrades.
    6. Go to your display manager settings and select the linux-hello SDDM theme.

    Recovery / escape hatches

    Tip: do not add linux-hello to the login PAM service (TTY logins).
    Keeping TTY login as pure password authentication gives you an always-available
    escape hatch regardless of what happens to the graphical session.

    Locked screen won't unlock

    Switch to a free TTY (Ctrl+Alt+F2), log in with your password, then:

    loginctl unlock-sessions

    Switch back to your graphical session (Ctrl+Alt+F1 or whichever VT it is on).

    SDDM theme broken / login loop

    Switch to a TTY and log in with your password, then either:

    • Disable the linux-hello SDDM theme — change the active theme back to the
      default:
      sudo sed -i 's/^Current=.*/Current=breeze/' /etc/sddm.conf.d/kde_settings.conf
      sudo systemctl restart sddm
      (adjust the config path and theme name to match your system)
    • Or disable the SDDM integration entirely via the Admin TUI:
      sudo linux-hello-admin # launches the TUI when run without a display
      Navigate to Integrations, disable SDDM, and apply.

    KDE lockscreen patch gone wrong

    From a TTY or a working terminal:

    sudo linux-hello-admin lockscreen uninstall

    This reverts the Plasma files to their original state. Log out and back in to
    reload the lockscreen.

    Nuclear option — disable linux-hello entirely

    sudo systemctl stop linux-hello linux-hello-sddm-helper
    sudo systemctl disable linux-hello linux-hello-sddm-helper

    PAM will fall through to pam_unix (password) automatically, because the PAM
    stacks use default=ignore — a linux-hello failure or absence never blocks
    login on its own.

    Downloads