Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Feature Request: Switch to dracut for robust multi-FIDO2 key support with LUKS2
Reported by d-cas · filed Oct 9, 2025Closed upstream on 2025-10-30 by its own reporter d-cas. GitHub close reason: completed. Closed by its own reporter — not by itself evidence of a fix.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
TL;DR: Enable FIDO2 hardware key boot decryption by switching from mkinitcpio to dracut for better systemd-cryptenroll integration.
I'd like Omarchy to support FIDO2 hardware keys (like YubiKey) for LUKS2 boot decryption, enabling a workflow like: Boot → Insert key + PIN (optional) + tap → Desktop (instantly).
This would require switching from mkinitcpio to dracut as the initramfs generator, since mkinitcpio has limited FIDO2 support while dracut has native systemd integration and reliable multi-key support.
Benefits
- More secure boot process with two-factor authentication
- Frictionless hardware key usage
- Backup key support (critical if primary key is lost/damaged)
- Industry-standard approach used by Fedora/RHEL
Current Limitation
Omarchy uses mkinitcpio, which doesn't properly support systemd-cryptenroll's FIDO2 features. While you can enroll FIDO2 keys with systemd-cryptenroll, they won't work at boot without dracut.
Why dracut?
- Native systemd integration (same stack that powers systemd-cryptenroll)
- Reliable multi-key support (primary + backup keys)
- Better auto-detection of hardware
- Simpler configuration for complex boot scenarios
References
- https://wiki.archlinux.org/title/FIDO2#Full_disk_encryption
- https://www.freedesktop.org/software/systemd/man/latest/systemd-cryptenroll.html
- https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-250.html
- https://fedoramagazine.org/use-fido-u2f-security-keys-with-fedora-linux/
View raw text
**TL;DR**: Enable FIDO2 hardware key boot decryption by switching from mkinitcpio to dracut for better systemd-cryptenroll integration. --- I'd like Omarchy to support FIDO2 hardware keys (like YubiKey) for LUKS2 boot decryption, enabling a workflow like: Boot → Insert key + PIN (optional) + tap → Desktop (instantly). This would require switching from mkinitcpio to dracut as the initramfs generator, since mkinitcpio has limited FIDO2 support while dracut has native systemd integration and reliable multi-key support. ## Benefits - More secure boot process with two-factor authentication - Frictionless hardware key usage - Backup key support (critical if primary key is lost/damaged) - Industry-standard approach used by Fedora/RHEL ## Current Limitation Omarchy uses mkinitcpio, which doesn't properly support systemd-cryptenroll's FIDO2 features. While you can enroll FIDO2 keys with systemd-cryptenroll, they won't work at boot without dracut. ## Why dracut? - Native systemd integration (same stack that powers systemd-cryptenroll) - Reliable multi-key support (primary + backup keys) - Better auto-detection of hardware - Simpler configuration for complex boot scenarios ## References - https://wiki.archlinux.org/title/FIDO2#Full_disk_encryption - https://www.freedesktop.org/software/systemd/man/latest/systemd-cryptenroll.html - https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-250.html - https://fedoramagazine.org/use-fido-u2f-security-keys-with-fedora-linux/
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.