ayandexyz / glance-linux

glance-linux 
Face unlock for Linux, with the liveness detection that face-unlock on Linux
usually doesn't have.
 .gif>)
A reimplementation of the liveness model from
Glance (macOS, MIT) around a PAM-based
unlock path. Not a port of the app — none of the Swift is portable — but the
part of Glance with real substance is: the five-cue liveness model that tells a
face from a photograph.
## Install
 [code] 
That adds the plugin, installs the daemon with every package pinned by
SHA-256, then sets up the service, PAM and lock screen -- one password prompt.
Run it again to update.
Then click the Glance icon in the top bar and choose **Glance panel → Enroll**:
your face, and a passphrase you choose.
To take it all back out:
 [code] 
It removes `pam_glance` from the lock-screen PAM stacks before deleting the
module (so no stack is left naming a missing one), restores the stock lock
screen, stops and deletes the service, removes the plugin, and deletes
`~/.local/share/glance` -- daemon, models, and your encrypted enrollment. It
asks once before touching anything.
## Why
Howdy already does face unlock on Arch. Its
well-known weakness is that it has essentially no liveness detection, so a
printed photo can unlock it. That is exactly the gap this fills.
The other half is that **Linux is a better platform for this than macOS**.
Glance's own README carries the caveat that *"macOS has no API that lets a
third-party app authorize a login, so Glance unlocks by typing your stored
password on the lock screen."* Linux has PAM. So this project:
- stores **no password** anywhere,
- injects **no keystrokes**,
- needs **no accessibility/input-injection permission**,
- and authorizes the session directly, through the same interface `sudo` and
 `hyprlock` already use.
That removes the single most sensitive secret in the macOS design.
### It is still not FaceID
A webcam sees a flat 2D image; an iPhone builds a 3D depth map. The liveness
cues here defeat a printed photo and a photo on a phone screen with reasonable
confidence. They do **not** reliably defeat a video of you. This is a
convenience feature, not a security upgrade.
Two guard rails come with that. Five failed scans in a row with a face in
view lock face unlock out for five minutes, so a looping hands-free lock
screen is not a free brute-force surface (`--max-failures`, `--lockout`). And
`SECURITY.md` spells out the trust boundary: the daemon runs as your user, so
code already running as you could subvert it — the same boundary Howdy and
the shell's own lock have, but one you should read before relying on it.
## Status
| Piece | State |
|---|---|
| Liveness model (`src/glanced/liveness/`) | **Complete, ported, tested** |
| Geometry / homography | Complete |
| Enrollment store (AES-256-GCM) | Complete |
| Alignment + ArcFace embedding | Complete |
| Camera capture, landmarking, scan loop | Complete |
| Daemon: sockets, arming, status | Complete, tested |
| `glancectl` (enroll, arm, authenticate, status, live, selft