Proof Portal

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox

ReportR-4327GitHub issuePublicReceived

omarchy-setup-fingerprint: lock screen fingerprint auth not wired up despite claiming support

Reported by lrettig · filed Apr 30, 2026Closed upstream on 2026-04-30 by its own reporter lrettig. GitHub close reason: completed. Closed by its own reporter — not by itself evidence of a fix.

Open at source

Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?: Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?: Not yet mapped to any requirement or component.
3 · Is it reproducible?: No validation has been run yet.
4 · What remains unclear?: Not validated yet: no claims, no reproducer.
5 · What happens next?: Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

omarchy-setup-fingerprint: lock screen fingerprint auth not wired up despite claiming supportrevision 1 · captured 2026-10-04 11:56 UTC via poll

Summary

omarchy-setup-fingerprint prints "You can use your fingerprint for sudo, polkit, and lock screen (Super + Escape)" and sets fingerprint:enabled = true in hyprlock.conf (causing the fingerprint icon to appear on the lock screen), but never adds pam_fprintd.so to /etc/pam.d/hyprlock. The result is that the icon shows but touching the reader does nothing.

Root cause

setup_pam_config in the script configures /etc/pam.d/sudo and /etc/pam.d/polkit-1, but omits /etc/pam.d/hyprlock.

Fix

Add a third block to setup_pam_config:

# Configure hyprlock
if ! grep -q pam_fprintd.so /etc/pam.d/hyprlock; then
  print_info "Configuring hyprlock for fingerprint authentication..."
  sudo sed -i '1i auth        sufficient  pam_fprintd.so' /etc/pam.d/hyprlock
fi

And the corresponding removal in remove_pam_config:

# Remove from hyprlock
if grep -q pam_fprintd.so /etc/pam.d/hyprlock; then
  print_info "Removing fingerprint authentication from hyprlock..."
  sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/hyprlock
fi

Steps to reproduce

Run omarchy-setup-fingerprint on a system with a working fingerprint reader
Lock the screen with Super+Ctrl+L
Place finger on reader — nothing happens despite the fingerprint icon being visible

Verified fix

Manually running sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/hyprlock resolves the issue immediately.

View raw text

## Summary

`omarchy-setup-fingerprint` prints "You can use your fingerprint for sudo, polkit, and lock screen (Super + Escape)" and sets `fingerprint:enabled = true` in `hyprlock.conf` (causing the fingerprint icon to appear on the lock screen), but never adds `pam_fprintd.so` to `/etc/pam.d/hyprlock`. The result is that the icon shows but touching the reader does nothing.

## Root cause

`setup_pam_config` in the script configures `/etc/pam.d/sudo` and `/etc/pam.d/polkit-1`, but omits `/etc/pam.d/hyprlock`.

## Fix

Add a third block to `setup_pam_config`:

```bash
# Configure hyprlock
if ! grep -q pam_fprintd.so /etc/pam.d/hyprlock; then
  print_info "Configuring hyprlock for fingerprint authentication..."
  sudo sed -i '1i auth        sufficient  pam_fprintd.so' /etc/pam.d/hyprlock
fi
```

And the corresponding removal in `remove_pam_config`:

```bash
# Remove from hyprlock
if grep -q pam_fprintd.so /etc/pam.d/hyprlock; then
  print_info "Removing fingerprint authentication from hyprlock..."
  sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/hyprlock
fi
```

## Steps to reproduce

1. Run `omarchy-setup-fingerprint` on a system with a working fingerprint reader
2. Lock the screen with Super+Ctrl+L
3. Place finger on reader — nothing happens despite the fingerprint icon being visible

## Verified fix

Manually running `sudo sed -i '1i auth        sufficient  pam_fprintd.so' /etc/pam.d/hyprlock` resolves the issue immediately.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.

Proof

History & reports

Reference