On 27-07-2022 17:57, Maya via Guix-patches via wrote:
> Added a feature to fprintd-service-type to allow unlocking PAM modules (ie. gdm login, gnome polkit etc.) by fingerprint.
>
> ---

Documentation is missing (in the manual), so as-is, this new feature is 
hard to find.

Also, the manual required giving every top-level procedure a docstring 
IIRC,

>   gnu/services/authentication.scm | 49 +++++++++++++++++++++++++++++++--
>   1 file changed, 46 insertions(+), 3 deletions(-)
>
> diff --git a/gnu/services/authentication.scm b/gnu/services/authentication.scm
> index f7becdfafb..5737c15f4c 100644
> --- a/gnu/services/authentication.scm
> +++ b/gnu/services/authentication.scm
> @@ -44,9 +44,50 @@ (define-module (gnu services authentication)
>               nslcd-configuration?
>               nslcd-service-type))
>
> -(define-configuration fprintd-configuration
> +(define-configuration/no-serialization fprintd-configuration
>     (fprintd      (file-like fprintd)
> -                "The fprintd package"))
> +                "The fprintd package")
> +  (unlock-gdm?
> +   (boolean #t)
> +   "Generate PAM configuration that unlocks gdm with fprintd.")
> +  (unlock-other
> +   (list '("polkit-1" "sddm")) ;; polkit-1 is the name of a PAM module for GNOME polkit
> +   "List of other PAM modules that can be unlocked with fprintd.
> +
> +This depends on your desktop configuration. If you for example want GNOME prompts to be unlocked by fingerprint, you add @code{polkit-1} to this list. (This is enabled by default.)
> +"))

This documentation is unclear -- does this field need to be set to the 
_name_ of the module, or to the _file name_ of the _shared library_ (as 
a file-like, not a direct file name, because of staging), or ...?  Also, 
the 'list' check can be more precise, IIRC there was some method for not 
just using list? but doing things like list-of-strings?.

Anyway, I don't really know PAM, but I've written some comments on the 
patch, hopefullt they are useful.