# howdy: Windows Hello style facial authentication for Linux.
#
# Upstream merged the 3.0.0 rewrite (C++ PAM module + meson) to master on
# 2025-06-22 (commit d3ab993) but never tagged it. The last tag, v2.6.1, is
# the old Python-PAM architecture and must NOT be packaged. Per Fedora
# snapshot versioning guidelines this is a pre-release snapshot of 3.0.0,
# hence Version: 3.0.0~<date>git<shortcommit>.
#
# Deliberate choices:
#  * The package NEVER touches /etc/pam.d. Enabling howdy in the PAM stack
#    is a conscious admin action; see README.Fedora.md.
#  * The dlib face models (public domain, davisking/dlib-models) are bundled
#    so the package works offline out of the box instead of requiring the
#    upstream install.sh download step.
#  * howdy-gtk is built but not shipped in v1: it hard-imports the Python
#    "elevate" module, which is not packaged in Fedora. TODO for v2.
#  * No SELinux policy in v1 (TODO); sudo/login work on stock targeted
#    policy in testing, but some PAM entry points may need a local policy.

%global commit          d3ab99382f88f043d15f15c1450ab69433892a1c
%global shortcommit     %(c=%{commit}; echo ${c:0:7})
%global snapdate        20250622
# dlib-models commit the bundled model files were taken from
%global modelscommit    fd81b6308a6a73d4ce08859eb2f4b628a21e27a2

Name:           howdy
Version:        3.0.0~%{snapdate}git%{shortcommit}
Release:        1%{?dist}
Summary:        Windows Hello style facial authentication for Linux

# howdy itself is MIT; the bundled dlib model data files are CC0/public domain
License:        MIT AND CC0-1.0
URL:            https://github.com/boltgolt/howdy
Source0:        %{url}/archive/%{commit}/howdy-%{shortcommit}.tar.gz
# Face recognition model data, public domain, pinned to a dlib-models commit
Source1:        https://github.com/davisking/dlib-models/raw/%{modelscommit}/dlib_face_recognition_resnet_model_v1.dat.bz2
Source2:        https://github.com/davisking/dlib-models/raw/%{modelscommit}/mmod_human_face_detector.dat.bz2
Source3:        https://github.com/davisking/dlib-models/raw/%{modelscommit}/shape_predictor_5_face_landmarks.dat.bz2
Source4:        README.Fedora.md

BuildRequires:  meson >= 0.64.0
BuildRequires:  ninja-build
BuildRequires:  gcc-c++
BuildRequires:  pam-devel
BuildRequires:  libevdev-devel
BuildRequires:  inih-devel
BuildRequires:  python3-devel
BuildRequires:  gettext
BuildRequires:  bzip2

Requires:       python3
Requires:       python3-dlib
Requires:       python3-opencv
Requires:       python3-numpy
Provides:       bundled(dlib-models)

%description
Howdy provides Windows Hello style authentication for Linux: it authenticates
you by scanning your face with the IR emitters and camera found in many
laptops, as a PAM module usable for sudo, login and other PAM-aware services.

This build is the 3.0.0 pre-release (C++ PAM module, meson build) from
upstream master. Installing this package does NOT modify your PAM
configuration; see README.Fedora.md for the one line you must add yourself.

%prep
%autosetup -n howdy-%{commit}
cp %{SOURCE4} .

%build
%meson \
    -Dpam_dir=%{_libdir}/security \
    -Dconfig_dir=%{_sysconfdir}/howdy \
    -Dpython_path=%{python3}
%meson_build

%install
%meson_install

# Bundle the public-domain dlib model files so howdy works out of the box
# (upstream expects the admin to run /usr/share/dlib-data/install.sh, which
# downloads these exact files)
for src in %{SOURCE1} %{SOURCE2} %{SOURCE3}; do
    base=$(basename "$src" .bz2)
    bzcat "$src" > %{buildroot}%{_datadir}/dlib-data/"$base"
done

# howdy-gtk is not shipped in v1 (needs python3 "elevate", not in Fedora)
rm -f  %{buildroot}%{_bindir}/howdy-gtk
rm -rf %{buildroot}%{_libdir}/howdy-gtk
rm -rf %{buildroot}%{_datadir}/howdy-gtk

# Normalize odd upstream install modes
chmod 644 %{buildroot}%{_sysconfdir}/howdy/config.ini
chmod 755 %{buildroot}%{_datadir}/dlib-data/install.sh
chmod 644 %{buildroot}%{_datadir}/bash-completion/completions/howdy
# Completions are sourced, not executed; drop the shebang rpmlint trips on
sed -i "1{/^#!/d}" %{buildroot}%{_datadir}/bash-completion/completions/howdy

%files
%license LICENSE
%doc README.md README.Fedora.md
%{_bindir}/howdy
%{_libdir}/security/pam_howdy.so
%dir %{_sysconfdir}/howdy
%config(noreplace) %{_sysconfdir}/howdy/config.ini
%{_libdir}/howdy/
%{_datadir}/howdy/
%{_datadir}/dlib-data/
%{_datadir}/bash-completion/completions/howdy
%{_mandir}/man1/howdy.1*

%changelog
* Sun Aug 23 2026 Scott Nelson <scottdnelson.coffee@gmail.com> - 3.0.0~20250622gitd3ab993-1
- Initial package of the untagged 3.0.0 rewrite (upstream master, d3ab993)
- Bundle public-domain dlib model files so no post-install download is needed
- Never touch /etc/pam.d; the auth-stack line is documented, not automated
- howdy-gtk withheld (python3-elevate missing in Fedora); SELinux policy TODO