Compatibility

The current delivery targets are x86_64 Linux systems with V4L2 and Linux-PAM; source builds require Rust 1.88+. Package validation covers Arch, Debian 13 (trixie), Ubuntu 26.04 LTS (resolute), and Fedora 43/44/45. RHEL is not in the supported matrix. Source templates exist for OpenRC, runit, and s6, but that does not establish package or hardware support for every distribution using those supervisors.

Tested Distributions

Debian-family release support is exactly Debian 13 (Trixie) and Ubuntu 26.04 LTS (Resolute). Other Debian and Ubuntu releases are unsupported.

Distribution	Init System	Mode	Status
Arch Linux	systemd	daemon + D-Bus activation	Primary target
Debian 13 (Trixie)	systemd	daemon + D-Bus activation	Booted package gate
Ubuntu 26.04 LTS (Resolute)	systemd	daemon + D-Bus activation	Booted package gate
Fedora 43/44/45	systemd	daemon + D-Bus activation	Release matrix target

Expected to Work (untested)

No additional distribution is claimed as expected to work. Source templates do not convert a distribution into an untested support claim.

Cameras and formats

Facelock classifies an IR node from its advertised format set or an exact hardware quirk. It does not use a device name containing “IR” as evidence. The current hardware validation record covers the Logitech BRIO 046d:085e IR node using native GREY. Do not infer support for Intel RealSense or “Windows Hello” cameras from their product category alone.

Format	Authentication support
`GREY`	supported 8-bit grayscale path
`Y16`	conditional on a hardware-verified `y16_bit_depth` quirk from 8 through 16
`YUYV`, `NV12`, `MJPG`	supported decode paths; normally RGB unless an exact quirk says otherwise
`Y8`, `Y10`, `Y12`	IR-classification evidence only; not decoded
raw Bayer and other formats	not supported

The shipped RealSense Y16 quirks deliberately have no bit-depth evidence, so authentication rejects those Y16 paths. A 16-bit V4L2 container does not prove the sensor's meaningful bit depth. Auto-detection excludes devices with no decodable format and reports the advertised formats.

RGB operation requires security.require_ir = false and is for development. Frame variance and any enabled landmark-liveness check still apply, but they do not restore the default IR boundary or guarantee resistance to presentation attacks. See the canonical Compatibility page on GitHub for the IPU6/IPU7 relay notes, exact negotiation order, and current validation evidence.

Init and PAM

systemd with D-Bus activation is the packaged daemon path. On non-systemd systems, use daemon.mode = "oneshot" or install one of the source-tree OpenRC/runit/s6 templates after a source install. The daemon command must run as root.

Test PAM on sudo first while retaining a root recovery shell. Shared stacks, console login, and SSH are sensitive targets and require the CLI's explicit --allow-sensitive gate. PAM service availability is distribution-specific; use facelock pam status rather than assuming a path exists.

Inference providers