Linux-Hello/CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

0.1.0 - 2026-01-30

Added

• Core Authentication

  • Face detection with LBPH algorithm (default) or ONNX models (optional)
  • Face embedding extraction and template matching
  • Multi-template support per user (e.g., with/without glasses)
  • Configurable distance thresholds

• Security Features

  • TPM2 integration for hardware-bound template encryption
  • AES-256-GCM software fallback when TPM unavailable
  • Secure memory handling with automatic zeroization
  • Constant-time comparison for security-sensitive operations
  • Memory locking to prevent swapping sensitive data

• Anti-Spoofing

  • IR presence validation
  • Depth estimation (gradient-based)
  • Texture analysis (LBP-based)
  • Blink detection
  • Micro-movement tracking
  • Configurable thresholds per check

• Camera Support

  • V4L2 camera enumeration
  • IR camera detection heuristics
  • IR emitter control
  • Multiple pixel format support (GREY, YUYV, MJPEG)

• IPC & Integration

  • Unix socket IPC for PAM module communication
  • D-Bus interface for desktop integration
  • Peer credential verification
  • Rate limiting

• CLI Tool

  • capture - Capture test frames
  • detect - Test face detection
  • status - Show system status
  • enroll - Enroll a face
  • list - List enrolled templates
  • remove - Remove templates
  • test - Test authentication
  • config - View/modify configuration

• PAM Module

  • C implementation for maximum compatibility
  • Configurable timeout
  • Password fallback support
  • Debug logging

• Settings Apps

  • GNOME Settings app (GTK4/libadwaita)
  • KDE System Settings module (Qt6/KCM)

• Documentation

  • Comprehensive README
  • API documentation
  • Testing guide
  • Coding standards
  • Security policy

Security Notes

• Requires IR camera for security - RGB cameras explicitly not supported
• TPM2 recommended for production deployments
• Software fallback encryption is NOT cryptographically bound to hardware

Known Limitations

• ONNX models require glibc 2.38+ (Ubuntu 24.04+, Fedora 39+)
• IR emitter control may require hardware-specific configuration
• Full TPM hardware integration needs real TPM for testing