fix: audit fixes — async restart_verify, locale caching, panic safety (v0.5.0)

- restart_verify() now async via spawn_future_local (was blocking main thread)
- stop() uses 3s timeout instead of unbounded
- load_strings() caches locale detection in OnceLock (was reading /etc/locale.conf on every call)
- child_get() replaced with child_value().get() for graceful D-Bus type mismatch handling
- Eliminate redundant password clone in auth path (direct move into spawn_blocking)
- Add on_exhausted callback: hides fp_label after MAX_FP_ATTEMPTS
- Set running=false before on_success callback (prevent double-unlock)
- Add 4 unit tests for on_verify_status state machine
- Document GLib-GString/CString zeroize limitation in CLAUDE.md

CLAUDE.md

@@ -38,13 +38,13 @@ LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so ./target/release/moonlock
 ## Architektur
 
 - `auth.rs` — PAM-Authentifizierung via Raw FFI (unsafe extern "C" conv callback, msg_style-aware, Zeroizing<Vec<u8>>)
-- `fingerprint.rs` — fprintd D-Bus Listener (Rc<RefCell<FingerprintListener>>, self-wiring g-signal via connect_local)
+- `fingerprint.rs` — fprintd D-Bus Listener, async init/claim/verify via gio futures, sync stop with 3s timeout, on_exhausted callback after MAX_FP_ATTEMPTS
 - `users.rs` — Aktuellen User via nix getuid, Avatar-Loading mit Symlink-Rejection
-- `power.rs` — Reboot/Shutdown via /usr/bin/loginctl
+- `power.rs` — Reboot/Shutdown via /usr/bin/systemctl
-- `i18n.rs` — Locale-Erkennung und String-Tabellen (DE/EN), faillock_warning mit konfigurierbarem max_attempts
+- `i18n.rs` — Locale-Erkennung (OnceLock-cached) und String-Tabellen (DE/EN), faillock_warning mit konfigurierbarem max_attempts
 - `config.rs` — TOML-Config (background_path, fingerprint_enabled als Option<bool>) + Wallpaper-Fallback
-- `lockscreen.rs` — GTK4 UI, PAM-Auth via gio::spawn_blocking, Fingerprint-Indikator, Zeroizing<String> für Passwort, Power-Confirm
+- `lockscreen.rs` — GTK4 UI via LockscreenHandles, PAM-Auth via gio::spawn_blocking, FP-Label/Start separat verdrahtet, Zeroizing<String> für Passwort, Power-Confirm
-- `main.rs` — Entry Point, Panic-Hook, Root-Check, ext-session-lock-v1 (Pflicht in Release), Multi-Monitor
+- `main.rs` — Entry Point, Panic-Hook, Root-Check, ext-session-lock-v1 (Pflicht in Release), Multi-Monitor, systemd-Journal-Logging, async fprintd-Init nach window.present()
 
 ## Sicherheit
 
@@ -52,7 +52,7 @@ LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so ./target/release/moonlock
 - Release-Build: Ohne ext-session-lock-v1 wird `exit(1)` aufgerufen — kein Fenster-Fallback
 - Panic-Hook: Bei Crash wird geloggt, aber NIEMALS unlock() aufgerufen — Screen bleibt schwarz
 - PAM-Callback: msg_style-aware (Passwort nur bei PAM_PROMPT_ECHO_OFF), strdup-OOM-sicher
-- Passwort: Zeroizing<String> ab GTK-Entry-Extraktion, Zeroizing<Vec<u8>> im PAM-FFI-Layer
+- Passwort: Zeroizing<String> ab GTK-Entry-Extraktion, Zeroizing<Vec<u8>> im PAM-FFI-Layer (bekannte Einschränkung: GLib-GString und CString werden nicht gezeroized — inhärente GTK/libc-Limitierung)
 - Root-Check: Exit mit Fehler wenn als root gestartet
 - Faillock: UI-Warnung nach 3 Fehlversuchen, aber PAM entscheidet über Lockout (Entry bleibt aktiv)
 - Kein Schließen per Escape/Alt-F4 — nur durch erfolgreiche PAM-Auth oder Fingerprint

Cargo.lock

@@ -2,65 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "aho-corasick"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "anstream"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
-
-[[package]]
-name = "anstyle-parse"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
-dependencies = [
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle-query"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
-dependencies = [
- "windows-sys",
-]
-
-[[package]]
-name = "anstyle-wincon"
-version = "3.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
-dependencies = [
- "anstyle",
- "once_cell_polyfill",
- "windows-sys",
-]
-
 [[package]]
 name = "anyhow"
 version = "1.0.102"
@@ -124,35 +65,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
-[[package]]
-name = "colorchoice"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
-
-[[package]]
-name = "env_filter"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32e90c2accc4b07a8456ea0debdc2e7587bdd890680d71173a15d4ae604f6eef"
-dependencies = [
- "log",
- "regex",
-]
-
-[[package]]
-name = "env_logger"
-version = "0.11.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0621c04f2196ac3f488dd583365b9c09be011a4ab8b9f37248ffcc8f6198b56a"
-dependencies = [
- "anstream",
- "anstyle",
- "env_filter",
- "jiff",
- "log",
-]
-
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -610,42 +522,12 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "is_terminal_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
-
 [[package]]
 name = "itoa"
 version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
-[[package]]
-name = "jiff"
-version = "0.2.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a3546dc96b6d42c5f24902af9e2538e82e39ad350b0c766eb3fbf2d8f3d8359"
-dependencies = [
- "jiff-static",
- "log",
- "portable-atomic",
- "portable-atomic-util",
- "serde_core",
-]
-
-[[package]]
-name = "jiff-static"
-version = "0.2.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a8c8b344124222efd714b73bb41f8b5120b27a7cc1c75593a6ff768d9d05aa4"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "khronos_api"
 version = "3.1.0"
@@ -693,9 +575,8 @@ dependencies = [
 
 [[package]]
 name = "moonlock"
-version = "0.4.0"
+version = "0.4.2"
 dependencies = [
- "env_logger",
  "gdk-pixbuf",
  "gdk4",
  "gio",
@@ -707,6 +588,7 @@ dependencies = [
  "log",
  "nix",
  "serde",
+ "systemd-journal-logger",
  "tempfile",
  "toml 0.8.23",
  "zeroize",
@@ -730,12 +612,6 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
-[[package]]
-name = "once_cell_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
-
 [[package]]
 name = "pango"
 version = "0.22.0"
@@ -772,21 +648,6 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
-[[package]]
-name = "portable-atomic"
-version = "1.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
-
-[[package]]
-name = "portable-atomic-util"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "091397be61a01d4be58e7841595bd4bfedb15f1cd54977d79b8271e94ed799a3"
-dependencies = [
- "portable-atomic",
-]
-
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -830,35 +691,6 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
-[[package]]
-name = "regex"
-version = "1.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
-
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -984,6 +816,16 @@ dependencies = [
  "version-compare",
 ]
 
+[[package]]
+name = "systemd-journal-logger"
+version = "2.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7266304d24ca5a4b230545fc558c80e18bd3e1d2eb1be149b6bcd04398d3e79c"
+dependencies = [
+ "log",
+ "rustix",
+]
+
 [[package]]
 name = "target-lexicon"
 version = "0.13.3"
@@ -1116,12 +958,6 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
-[[package]]
-name = "utf8parse"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
-
 [[package]]
 name = "version-compare"
 version = "0.2.1"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "moonlock"
-version = "0.4.1"
+version = "0.5.0"
 edition = "2024"
 description = "A secure Wayland lockscreen with GTK4, PAM and fingerprint support"
 license = "MIT"
@@ -18,7 +18,7 @@ nix = { version = "0.29", features = ["user"] }
 zeroize = { version = "1", features = ["derive"] }
 libc = "0.2"
 log = "0.4"
-env_logger = "0.11"
+systemd-journal-logger = "2.2"
 
 [dev-dependencies]
 tempfile = "3"

README.md

@@ -7,8 +7,8 @@ Part of the Moonarch ecosystem.
 
 - **ext-session-lock-v1** — Protocol-guaranteed screen locking (compositor keeps screen locked on crash)
 - **PAM authentication** — Uses system PAM stack (`/etc/pam.d/moonlock`)
-- **Fingerprint unlock** — fprintd D-Bus integration (optional)
+- **Fingerprint unlock** — fprintd D-Bus integration, async init (optional, window appears instantly)
-- **Multi-monitor** — Lockscreen on every monitor
+- **Multi-monitor** — Lockscreen on every monitor, single shared fingerprint listener
 - **i18n** — German and English (auto-detected)
 - **Faillock warning** — UI counter + system pam_faillock
 - **Panic safety** — Panic hook logs but never unlocks

pkg/PKGBUILD

@@ -4,7 +4,7 @@
 # Maintainer: Dominik Kressler
 
 pkgname=moonlock-git
-pkgver=0.4.0.r0.g0000000
+pkgver=0.4.1.r1.g78bcf90
 pkgrel=1
 pkgdesc="A secure Wayland lockscreen with GTK4, PAM and fingerprint support"
 arch=('x86_64')
@@ -15,6 +15,7 @@ depends=(
     'gtk4-layer-shell'
     'gtk-session-lock'
     'pam'
+    'systemd-libs'
 )
 makedepends=(
     'git'

src/fingerprint.rs

@@ -29,35 +29,36 @@ pub struct FingerprintListener {
     failed_attempts: u32,
     on_success: Option<Box<dyn Fn() + 'static>>,
     on_failure: Option<Box<dyn Fn() + 'static>>,
+    on_exhausted: Option<Box<dyn Fn() + 'static>>,
 }
 
 impl FingerprintListener {
-    /// Create a new FingerprintListener.
+    /// Create a lightweight FingerprintListener without any D-Bus calls.
-    /// Connects to fprintd synchronously — call before creating GTK windows.
+    /// Call `init_async().await` afterwards to connect to fprintd.
     pub fn new() -> Self {
-        let mut listener = FingerprintListener {
+        FingerprintListener {
             device_proxy: None,
             signal_id: None,
             running: false,
             failed_attempts: 0,
             on_success: None,
             on_failure: None,
-        };
+            on_exhausted: None,
-        listener.init_device();
+        }
-        listener
     }
 
-    /// Connect to fprintd and get the default device.
+    /// Connect to fprintd and get the default device asynchronously.
-    fn init_device(&mut self) {
+    pub async fn init_async(&mut self) {
-        let manager = match gio::DBusProxy::for_bus_sync(
+        let manager = match gio::DBusProxy::for_bus_future(
             gio::BusType::System,
             gio::DBusProxyFlags::NONE,
             None,
             FPRINTD_BUS_NAME,
             FPRINTD_MANAGER_PATH,
             FPRINTD_MANAGER_IFACE,
-            gio::Cancellable::NONE,
+        )
-        ) {
+        .await
+        {
             Ok(m) => m,
             Err(e) => {
                 log::debug!("fprintd manager not available: {e}");
@@ -66,13 +67,10 @@ impl FingerprintListener {
         };
 
         // Call GetDefaultDevice
-        let result = match manager.call_sync(
+        let result = match manager
-            "GetDefaultDevice",
+            .call_future("GetDefaultDevice", None, gio::DBusCallFlags::NONE, -1)
-            None,
+            .await
-            gio::DBusCallFlags::NONE,
+        {
-            -1,
-            gio::Cancellable::NONE,
-        ) {
             Ok(r) => r,
             Err(e) => {
                 log::debug!("fprintd GetDefaultDevice failed: {e}");
@@ -81,20 +79,27 @@ impl FingerprintListener {
         };
 
         // Extract device path from variant tuple
-        let device_path: String = result.child_get::<String>(0);
+        let device_path = match result.child_value(0).get::<String>() {
+            Some(p) => p,
+            None => {
+                log::debug!("fprintd: unexpected GetDefaultDevice response type");
+                return;
+            }
+        };
         if device_path.is_empty() {
             return;
         }
 
-        match gio::DBusProxy::for_bus_sync(
+        match gio::DBusProxy::for_bus_future(
             gio::BusType::System,
             gio::DBusProxyFlags::NONE,
             None,
             FPRINTD_BUS_NAME,
             &device_path,
             FPRINTD_DEVICE_IFACE,
-            gio::Cancellable::NONE,
+        )
-        ) {
+        .await
+        {
             Ok(proxy) => {
                 self.device_proxy = Some(proxy);
             }
@@ -104,41 +109,46 @@ impl FingerprintListener {
         }
     }
 
-    /// Check if fprintd is available and the user has enrolled fingerprints.
+    /// Check if fprintd is available and the user has enrolled fingerprints (async).
-    pub fn is_available(&self, username: &str) -> bool {
+    pub async fn is_available_async(&self, username: &str) -> bool {
         let proxy = match &self.device_proxy {
             Some(p) => p,
             None => return false,
         };
 
         let args = glib::Variant::from((&username,));
-        match proxy.call_sync(
+        match proxy
-            "ListEnrolledFingers",
+            .call_future("ListEnrolledFingers", Some(&args), gio::DBusCallFlags::NONE, -1)
-            Some(&args),
+            .await
-            gio::DBusCallFlags::NONE,
+        {
-            -1,
-            gio::Cancellable::NONE,
-        ) {
             Ok(result) => {
                 // Result is a tuple of (array of strings)
-                let fingers: Vec<String> = result.child_get::<Vec<String>>(0);
+                match result.child_value(0).get::<Vec<String>>() {
-                !fingers.is_empty()
+                    Some(fingers) => !fingers.is_empty(),
+                    None => {
+                        log::debug!("fprintd: unexpected ListEnrolledFingers response type");
+                        false
+                    }
+                }
             }
             Err(_) => false,
         }
     }
 
     /// Start listening for fingerprint verification.
+    /// Claims the device and starts verification using async D-Bus calls.
     /// Connects the D-Bus g-signal handler internally. The `listener` parameter
     /// must be the same `Rc<RefCell<FingerprintListener>>` that owns `self`.
-    pub fn start<F, G>(
+    pub async fn start_async<F, G, H>(
         listener: &Rc<RefCell<FingerprintListener>>,
         username: &str,
         on_success: F,
         on_failure: G,
+        on_exhausted: H,
     ) where
         F: Fn() + 'static,
         G: Fn() + 'static,
+        H: Fn() + 'static,
     {
         let proxy = {
             let inner = listener.borrow();
@@ -152,38 +162,29 @@ impl FingerprintListener {
             let mut inner = listener.borrow_mut();
             inner.on_success = Some(Box::new(on_success));
             inner.on_failure = Some(Box::new(on_failure));
+            inner.on_exhausted = Some(Box::new(on_exhausted));
         }
 
         // Claim the device
         let args = glib::Variant::from((&username,));
-        if let Err(e) = proxy.call_sync(
+        if let Err(e) = proxy
-            "Claim",
+            .call_future("Claim", Some(&args), gio::DBusCallFlags::NONE, -1)
-            Some(&args),
+            .await
-            gio::DBusCallFlags::NONE,
+        {
-            -1,
-            gio::Cancellable::NONE,
-        ) {
             log::error!("Failed to claim fingerprint device: {e}");
             return;
         }
 
         // Start verification
         let start_args = glib::Variant::from((&"any",));
-        if let Err(e) = proxy.call_sync(
+        if let Err(e) = proxy
-            "VerifyStart",
+            .call_future("VerifyStart", Some(&start_args), gio::DBusCallFlags::NONE, -1)
-            Some(&start_args),
+            .await
-            gio::DBusCallFlags::NONE,
+        {
-            -1,
-            gio::Cancellable::NONE,
-        ) {
             log::error!("Failed to start fingerprint verification: {e}");
-            let _ = proxy.call_sync(
+            let _ = proxy
-                "Release",
+                .call_future("Release", None, gio::DBusCallFlags::NONE, -1)
-                None,
+                .await;
-                gio::DBusCallFlags::NONE,
-                -1,
-                gio::Cancellable::NONE,
-            );
             return;
         }
 
@@ -232,6 +233,7 @@ impl FingerprintListener {
         }
 
         if status == "verify-match" {
+            self.running = false;
             if let Some(ref cb) = self.on_success {
                 cb();
             }
@@ -240,23 +242,26 @@ impl FingerprintListener {
 
         if RETRY_STATUSES.contains(&status) {
             if done {
-                self.restart_verify();
+                self.restart_verify_async();
             }
             return;
         }
 
         if status == "verify-no-match" {
             self.failed_attempts += 1;
-            if let Some(ref cb) = self.on_failure {
-                cb();
-            }
             if self.failed_attempts >= MAX_FP_ATTEMPTS {
                 log::warn!("Fingerprint max attempts ({MAX_FP_ATTEMPTS}) reached, stopping");
+                if let Some(ref cb) = self.on_exhausted {
+                    cb();
+                }
                 self.stop();
                 return;
             }
+            if let Some(ref cb) = self.on_failure {
+                cb();
+            }
             if done {
-                self.restart_verify();
+                self.restart_verify_async();
             }
             return;
         }
@@ -264,31 +269,28 @@ impl FingerprintListener {
         log::debug!("Unhandled fprintd status: {status}");
     }
 
-    /// Restart fingerprint verification after a completed attempt.
+    /// Restart fingerprint verification asynchronously after a completed attempt.
-    fn restart_verify(&self) {
+    fn restart_verify_async(&self) {
         if let Some(ref proxy) = self.device_proxy {
+            let proxy = proxy.clone();
+            glib::spawn_future_local(async move {
                 // VerifyStop before VerifyStart to avoid D-Bus errors
-            let _ = proxy.call_sync(
+                let _ = proxy
-                "VerifyStop",
+                    .call_future("VerifyStop", None, gio::DBusCallFlags::NONE, -1)
-                None,
+                    .await;
-                gio::DBusCallFlags::NONE,
-                -1,
-                gio::Cancellable::NONE,
-            );
                 let args = glib::Variant::from((&"any",));
-            if let Err(e) = proxy.call_sync(
+                if let Err(e) = proxy
-                "VerifyStart",
+                    .call_future("VerifyStart", Some(&args), gio::DBusCallFlags::NONE, -1)
-                Some(&args),
+                    .await
-                gio::DBusCallFlags::NONE,
+                {
-                -1,
-                gio::Cancellable::NONE,
-            ) {
                     log::error!("Failed to restart fingerprint verification: {e}");
                 }
+            });
         }
     }
 
     /// Stop listening and release the device.
+    /// Uses a short timeout (3s) to avoid blocking the UI indefinitely.
     pub fn stop(&mut self) {
         if !self.running {
             return;
@@ -303,14 +305,14 @@ impl FingerprintListener {
                 "VerifyStop",
                 None,
                 gio::DBusCallFlags::NONE,
-                -1,
+                3000,
                 gio::Cancellable::NONE,
             );
             let _ = proxy.call_sync(
                 "Release",
                 None,
                 gio::DBusCallFlags::NONE,
-                -1,
+                3000,
                 gio::Cancellable::NONE,
             );
         }
@@ -334,4 +336,64 @@ mod tests {
     fn max_attempts_constant() {
         assert_eq!(MAX_FP_ATTEMPTS, 10);
     }
+
+    #[test]
+    fn verify_match_sets_running_false_and_calls_success() {
+        use std::cell::Cell;
+        let called = Rc::new(Cell::new(false));
+        let called_clone = called.clone();
+        let mut listener = FingerprintListener::new();
+        listener.running = true;
+        listener.on_success = Some(Box::new(move || { called_clone.set(true); }));
+
+        listener.on_verify_status("verify-match", false);
+        assert!(called.get());
+        assert!(!listener.running);
+    }
+
+    #[test]
+    fn verify_no_match_calls_failure_and_stays_running() {
+        use std::cell::Cell;
+        let called = Rc::new(Cell::new(false));
+        let called_clone = called.clone();
+        let mut listener = FingerprintListener::new();
+        listener.running = true;
+        listener.on_failure = Some(Box::new(move || { called_clone.set(true); }));
+
+        listener.on_verify_status("verify-no-match", false);
+        assert!(called.get());
+        assert!(listener.running);
+        assert_eq!(listener.failed_attempts, 1);
+    }
+
+    #[test]
+    fn max_attempts_stops_listener_and_calls_exhausted() {
+        use std::cell::Cell;
+        let exhausted = Rc::new(Cell::new(false));
+        let exhausted_clone = exhausted.clone();
+        let mut listener = FingerprintListener::new();
+        listener.running = true;
+        listener.on_failure = Some(Box::new(|| {}));
+        listener.on_exhausted = Some(Box::new(move || { exhausted_clone.set(true); }));
+
+        for _ in 0..MAX_FP_ATTEMPTS {
+            listener.on_verify_status("verify-no-match", true);
+        }
+        assert!(!listener.running);
+        assert!(exhausted.get());
+        assert_eq!(listener.failed_attempts, MAX_FP_ATTEMPTS);
+    }
+
+    #[test]
+    fn not_running_ignores_signals() {
+        use std::cell::Cell;
+        let called = Rc::new(Cell::new(false));
+        let called_clone = called.clone();
+        let mut listener = FingerprintListener::new();
+        listener.running = false;
+        listener.on_success = Some(Box::new(move || { called_clone.set(true); }));
+
+        listener.on_verify_status("verify-match", false);
+        assert!(!called.get());
+    }
 }

src/i18n.rs

@@ -4,9 +4,13 @@
 use std::env;
 use std::fs;
 use std::path::Path;
+use std::sync::OnceLock;
 
 const DEFAULT_LOCALE_CONF: &str = "/etc/locale.conf";
 
+/// Cached locale prefix — detected once, reused for all subsequent calls.
+static CACHED_LOCALE: OnceLock<String> = OnceLock::new();
+
 #[derive(Debug, Clone)]
 pub struct Strings {
     pub password_placeholder: &'static str,
@@ -86,8 +90,11 @@ pub fn detect_locale() -> String {
 }
 
 pub fn load_strings(locale: Option<&str>) -> &'static Strings {
-    let locale = match locale { Some(l) => l.to_string(), None => detect_locale() };
+    let locale = match locale {
-    match locale.as_str() { "de" => &STRINGS_DE, _ => &STRINGS_EN }
+        Some(l) => l,
+        None => CACHED_LOCALE.get_or_init(detect_locale),
+    };
+    match locale { "de" => &STRINGS_DE, _ => &STRINGS_EN }
 }
 
 pub fn faillock_warning(attempt_count: u32, max_attempts: u32, strings: &Strings) -> Option<String> {

src/lockscreen.rs

@@ -19,23 +19,33 @@ use crate::i18n::{faillock_warning, load_strings, Strings};
 use crate::power::{self, PowerError};
 use crate::users;
 
+/// Handles returned from create_lockscreen_window for post-creation wiring.
+pub struct LockscreenHandles {
+    pub window: gtk::ApplicationWindow,
+    pub fp_label: gtk::Label,
+    pub password_entry: gtk::PasswordEntry,
+    pub unlock_callback: Rc<dyn Fn()>,
+    pub username: String,
+    state: Rc<RefCell<LockscreenState>>,
+}
+
 const AVATAR_SIZE: i32 = 128;
 const FAILLOCK_MAX_ATTEMPTS: u32 = 3;
 
 /// Shared mutable state for the lockscreen.
 struct LockscreenState {
     failed_attempts: u32,
-    fp_listener: FingerprintListener,
     fp_listener_rc: Option<Rc<RefCell<FingerprintListener>>>,
 }
 
 /// Create a lockscreen window for a single monitor.
+/// Fingerprint is not initialized here — use `wire_fingerprint()` after async init.
 pub fn create_lockscreen_window(
     bg_path: &Path,
-    config: &Config,
+    _config: &Config,
     app: &gtk::Application,
     unlock_callback: Rc<dyn Fn()>,
-) -> gtk::ApplicationWindow {
+) -> LockscreenHandles {
     let window = gtk::ApplicationWindow::builder()
         .application(app)
         .build();
@@ -46,17 +56,24 @@ pub fn create_lockscreen_window(
         Some(u) => u,
         None => {
             log::error!("Failed to get current user");
-            return window;
+            let fp_label = gtk::Label::new(None);
+            fp_label.set_visible(false);
+            return LockscreenHandles {
+                window,
+                fp_label,
+                password_entry: gtk::PasswordEntry::new(),
+                unlock_callback,
+                username: String::new(),
+                state: Rc::new(RefCell::new(LockscreenState {
+                    failed_attempts: 0,
+                    fp_listener_rc: None,
+                })),
+            };
         }
     };
 
-    let fp_listener = FingerprintListener::new();
-    let fp_available = config.fingerprint_enabled
-        && fp_listener.is_available(&user.username);
-
     let state = Rc::new(RefCell::new(LockscreenState {
         failed_attempts: 0,
-        fp_listener,
         fp_listener_rc: None,
     }));
 
@@ -119,15 +136,10 @@ pub fn create_lockscreen_window(
     error_label.set_visible(false);
     login_box.append(&error_label);
 
-    // Fingerprint label
+    // Fingerprint label — hidden until async fprintd init completes
     let fp_label = gtk::Label::new(None);
     fp_label.add_css_class("fingerprint-label");
-    if fp_available {
-        fp_label.set_text(strings.fingerprint_prompt);
-        fp_label.set_visible(true);
-    } else {
     fp_label.set_visible(false);
-    }
     login_box.append(&fp_label);
 
     // Confirm box area (for power confirm)
@@ -227,9 +239,8 @@ pub fn create_lockscreen_window(
                 password_entry,
                 async move {
                     let user = username.clone();
-                    let pass = Zeroizing::new((*password).clone());
                     let result = gio::spawn_blocking(move || {
-                        auth::authenticate(&user, &pass)
+                        auth::authenticate(&user, &password)
                     }).await;
 
                     match result {
@@ -293,11 +304,61 @@ pub fn create_lockscreen_window(
     ));
     window.add_controller(key_controller);
 
-    // Start fingerprint listener
+    // Fade-in on map
-    if fp_available {
+    window.connect_map(|w| {
-        let unlock_cb_fp = unlock_callback.clone();
+        glib::idle_add_local_once(clone!(
-        let fp_label_success = fp_label.clone();
+            #[weak]
-        let fp_label_fail = fp_label.clone();
+            w,
+            move || {
+                w.add_css_class("visible");
+            }
+        ));
+    });
+
+    // Focus password entry on realize
+    window.connect_realize(clone!(
+        #[weak]
+        password_entry,
+        move |_| {
+            glib::idle_add_local_once(move || {
+                password_entry.grab_focus();
+            });
+        }
+    ));
+
+    LockscreenHandles {
+        window,
+        fp_label,
+        password_entry: password_entry.clone(),
+        unlock_callback,
+        username: user.username,
+        state: state.clone(),
+    }
+}
+
+/// Show the fingerprint label and store the listener reference for stop-on-unlock.
+/// Does NOT start verification — call `start_fingerprint()` on one monitor for that.
+pub fn show_fingerprint_label(
+    handles: &LockscreenHandles,
+    fp_rc: &Rc<RefCell<FingerprintListener>>,
+) {
+    let strings = load_strings(None);
+    handles.fp_label.set_text(strings.fingerprint_prompt);
+    handles.fp_label.set_visible(true);
+
+    // Store the Rc reference for stop() on unlock
+    handles.state.borrow_mut().fp_listener_rc = Some(fp_rc.clone());
+}
+
+/// Start fingerprint verification on a single monitor's handles.
+/// Wires up on_success/on_failure callbacks and calls start_async.
+pub fn start_fingerprint(
+    handles: &LockscreenHandles,
+    fp_rc: &Rc<RefCell<FingerprintListener>>,
+) {
+    let fp_label_success = handles.fp_label.clone();
+    let fp_label_fail = handles.fp_label.clone();
+    let unlock_cb_fp = handles.unlock_callback.clone();
 
     let on_success = move || {
         let label = fp_label_success.clone();
@@ -335,42 +396,21 @@ pub fn create_lockscreen_window(
         ));
     };
 
-        // Extract the fp_listener into its own Rc<RefCell<>> for signal self-wiring
+    let fp_label_exhausted = handles.fp_label.clone();
-        let fp_rc = {
+    let on_exhausted = move || {
-            let mut s = state.borrow_mut();
+        let label = fp_label_exhausted.clone();
-            let listener = std::mem::replace(&mut s.fp_listener, FingerprintListener::new());
+        glib::idle_add_local_once(move || {
-            Rc::new(RefCell::new(listener))
+            label.set_visible(false);
+        });
     };
 
-        FingerprintListener::start(&fp_rc, &user.username, on_success, on_failure);
+    let username = handles.username.clone();
-
+    let fp_rc_clone = fp_rc.clone();
-        // Store back the Rc reference for stop() on unlock
+    glib::spawn_future_local(async move {
-        state.borrow_mut().fp_listener_rc = Some(fp_rc);
+        FingerprintListener::start_async(
-    }
+            &fp_rc_clone, &username, on_success, on_failure, on_exhausted,
-
+        ).await;
-    // Fade-in on map
-    window.connect_map(|w| {
-        glib::idle_add_local_once(clone!(
-            #[weak]
-            w,
-            move || {
-                w.add_css_class("visible");
-            }
-        ));
     });
-
-    // Focus password entry on realize
-    window.connect_realize(clone!(
-        #[weak]
-        password_entry,
-        move |_| {
-            glib::idle_add_local_once(move || {
-                password_entry.grab_focus();
-            });
-        }
-    ));
-
-    window
 }
 
 /// Create a Picture widget for the wallpaper background.

src/main.rs

@@ -13,9 +13,12 @@ use gdk4 as gdk;
 use gtk4::prelude::*;
 use gtk4::{self as gtk, gio};
 use gtk4_session_lock;
+use std::cell::RefCell;
 use std::path::PathBuf;
 use std::rc::Rc;
 
+use crate::fingerprint::FingerprintListener;
+
 fn load_css(display: &gdk::Display) {
     let css_provider = gtk::CssProvider::new();
     css_provider.load_from_resource("/dev/moonarch/moonlock/style.css");
@@ -75,27 +78,67 @@ fn activate_with_session_lock(
         app_clone.quit();
     });
 
+    // Create all monitor windows immediately — no D-Bus calls here
+    let mut all_handles = Vec::new();
     let mut created_any = false;
     for i in 0..monitors.n_items() {
         if let Some(monitor) = monitors
             .item(i)
             .and_then(|obj| obj.downcast::<gdk::Monitor>().ok())
         {
-            let window = lockscreen::create_lockscreen_window(
+            let handles = lockscreen::create_lockscreen_window(
                 bg_path,
                 config,
                 app,
                 unlock_callback.clone(),
             );
-            lock.assign_window_to_monitor(&window, &monitor);
+            lock.assign_window_to_monitor(&handles.window, &monitor);
-            window.present();
+            handles.window.present();
+            all_handles.push(handles);
             created_any = true;
         }
     }
 
     if !created_any {
         log::error!("No lockscreen windows created — screen stays locked (compositor policy)");
+        return;
     }
+
+    // Async fprintd initialization — runs after windows are visible
+    if config.fingerprint_enabled {
+        init_fingerprint_async(all_handles);
+    }
+}
+
+/// Initialize fprintd asynchronously after windows are visible.
+/// Uses a single FingerprintListener shared across all monitors —
+/// only the first monitor's handles get the fingerprint UI wired up.
+fn init_fingerprint_async(all_handles: Vec<lockscreen::LockscreenHandles>) {
+    glib::spawn_future_local(async move {
+        let mut listener = FingerprintListener::new();
+        listener.init_async().await;
+
+        // Use the first monitor's username to check enrollment
+        let username = &all_handles[0].username;
+        if username.is_empty() {
+            return;
+        }
+
+        if !listener.is_available_async(username).await {
+            log::debug!("fprintd not available or no enrolled fingers");
+            return;
+        }
+
+        let fp_rc = Rc::new(RefCell::new(listener));
+
+        // Show fingerprint label on all monitors
+        for handles in &all_handles {
+            lockscreen::show_fingerprint_label(handles, &fp_rc);
+        }
+
+        // Start verification listener on the first monitor only
+        lockscreen::start_fingerprint(&all_handles[0], &fp_rc);
+    });
 }
 
 #[cfg(debug_assertions)]
@@ -109,33 +152,27 @@ fn activate_without_lock(
         app_clone.quit();
     });
 
-    let window = lockscreen::create_lockscreen_window(
+    let handles = lockscreen::create_lockscreen_window(
         bg_path,
         config,
         app,
         unlock_callback,
     );
-    window.set_default_size(800, 600);
+    handles.window.set_default_size(800, 600);
-    window.present();
+    handles.window.present();
+
+    // Async fprintd initialization for development mode
+    if config.fingerprint_enabled {
+        init_fingerprint_async(vec![handles]);
+    }
 }
 
 fn setup_logging() {
-    let mut builder = env_logger::Builder::from_default_env();
+    systemd_journal_logger::JournalLog::new()
-    builder.filter_level(log::LevelFilter::Info);
+        .unwrap()
-
+        .install()
-    let log_dir = PathBuf::from("/var/cache/moonlock");
+        .unwrap();
-    if log_dir.is_dir() {
+    log::set_max_level(log::LevelFilter::Info);
-        let log_file = log_dir.join("moonlock.log");
-        if let Ok(file) = std::fs::OpenOptions::new()
-            .create(true)
-            .append(true)
-            .open(&log_file)
-        {
-            builder.target(env_logger::Target::Pipe(Box::new(file)));
-        }
-    }
-
-    builder.init();
 }
 
 fn install_panic_hook() {

src/power.rs

@@ -1,4 +1,4 @@
-// ABOUTME: Power actions — reboot and shutdown via loginctl.
+// ABOUTME: Power actions — reboot and shutdown via systemctl.
 // ABOUTME: Wrappers around system commands for the lockscreen UI.
 
 use std::fmt;
@@ -22,11 +22,10 @@ impl fmt::Display for PowerError {
 impl std::error::Error for PowerError {}
 
 fn run_command(action: &'static str, program: &str, args: &[&str]) -> Result<(), PowerError> {
-    let child = Command::new(program)
+    let output = Command::new(program)
         .args(args)
-        .spawn()
+        .stderr(std::process::Stdio::piped())
-        .map_err(|e| PowerError::CommandFailed { action, message: e.to_string() })?;
+        .output()
-    let output = child.wait_with_output()
         .map_err(|e| PowerError::CommandFailed { action, message: e.to_string() })?;
     if !output.status.success() {
         let stderr = String::from_utf8_lossy(&output.stderr);
@@ -37,8 +36,8 @@ fn run_command(action: &'static str, program: &str, args: &[&str]) -> Result<(),
     Ok(())
 }
 
-pub fn reboot() -> Result<(), PowerError> { run_command("reboot", "/usr/bin/loginctl", &["reboot"]) }
+pub fn reboot() -> Result<(), PowerError> { run_command("reboot", "/usr/bin/systemctl", &["--no-ask-password", "reboot"]) }
-pub fn shutdown() -> Result<(), PowerError> { run_command("shutdown", "/usr/bin/loginctl", &["poweroff"]) }
+pub fn shutdown() -> Result<(), PowerError> { run_command("shutdown", "/usr/bin/systemctl", &["--no-ask-password", "poweroff"]) }
 
 #[cfg(test)]
 mod tests {