Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Fingerprint setup gives no diagnosis when libfprint has no driver for the detected reader
Reported by busbyjon · filed Sep 14, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
What happened
On a ThinkPad L13 Yoga (Gen 3) with a Goodix 27c6:55b4 fingerprint reader, omarchy setup security fingerprint detects the reader (omarchy-hw-fingerprint correctly matches the USB product string), installs libfprint-git, fprintd, and usbutils, then runs fprintd-enroll. Enrollment fails immediately, and the wizard prints:
Enrollment failed. Please try again.Retrying changes nothing, because the real problem is that libfprint-git (even the upstream-tracking snapshot Omarchy pins) has no driver at all for this exact chip — it's a TLS-encrypted Goodix sensor that isn't in libfprint's supported-device table. fprintd-list "$USER" reports No devices available before enrollment is ever attempted. No amount of retrying fprintd-enroll can succeed.
What was expected
A reader that's detected but has no usable libfprint driver should get a clear, actionable message ("this exact sensor isn't supported") instead of being sent through enrollment and told to try again.
This is a real gap, not just this one chip — the setup script's own comment already anticipates the same class of problem for another vendor:
# PAM comes last, once a print is enrolled and verified. Detection only
# proves a reader is there, not that libfprint can drive it — an Elan MOC
# sensor outside the elanmoc table gets this far and then fails to enroll.Steps to reproduce
- On a machine with a Goodix
27c6:55b4reader (or any other reader libfprint has no driver for — e.g. certain Elan MOC variants). - Run
omarchy setup security fingerprint. - Observe enrollment fails with a generic "please try again" message, with no indication the hardware isn't supported.
System details
omarchy version: 4.0.3-1- CPU: Intel Core i7-10510U (CometLake-U)
- GPU: Intel UHD Graphics (CometLake-U GT2)
- Laptop: Lenovo ThinkPad L13 Yoga (20R5000SUK)
- Reader: Shenzhen Goodix Technology Fingerprint Reader, USB ID
27c6:55b4
Proposed fix
I have a small, tested patch ready (adds an fprintd-list check before enrollment, plus test coverage) and will open a PR against this issue.
View raw text
## What happened
On a ThinkPad L13 Yoga (Gen 3) with a Goodix `27c6:55b4` fingerprint reader, `omarchy setup security fingerprint` detects the reader (`omarchy-hw-fingerprint` correctly matches the USB product string), installs `libfprint-git`, `fprintd`, and `usbutils`, then runs `fprintd-enroll`. Enrollment fails immediately, and the wizard prints:
```
Enrollment failed. Please try again.
```
Retrying changes nothing, because the real problem is that `libfprint-git` (even the upstream-tracking snapshot Omarchy pins) has no driver at all for this exact chip — it's a TLS-encrypted Goodix sensor that isn't in libfprint's supported-device table. `fprintd-list "$USER"` reports `No devices available` before enrollment is ever attempted. No amount of retrying `fprintd-enroll` can succeed.
## What was expected
A reader that's detected but has no usable libfprint driver should get a clear, actionable message ("this exact sensor isn't supported") instead of being sent through enrollment and told to try again.
This is a real gap, not just this one chip — the setup script's own comment already anticipates the same class of problem for another vendor:
```sh
# PAM comes last, once a print is enrolled and verified. Detection only
# proves a reader is there, not that libfprint can drive it — an Elan MOC
# sensor outside the elanmoc table gets this far and then fails to enroll.
```
## Steps to reproduce
1. On a machine with a Goodix `27c6:55b4` reader (or any other reader libfprint has no driver for — e.g. certain Elan MOC variants).
2. Run `omarchy setup security fingerprint`.
3. Observe enrollment fails with a generic "please try again" message, with no indication the hardware isn't supported.
## System details
- `omarchy version`: 4.0.3-1
- CPU: Intel Core i7-10510U (CometLake-U)
- GPU: Intel UHD Graphics (CometLake-U GT2)
- Laptop: Lenovo ThinkPad L13 Yoga (20R5000SUK)
- Reader: Shenzhen Goodix Technology Fingerprint Reader, USB ID `27c6:55b4`
## Proposed fix
I have a small, tested patch ready (adds an `fprintd-list` check before enrollment, plus test coverage) and will open a PR against this issue.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 13:30 UTC