### System details

Lenovo ThinkPad T480s (20L8S27E04), Intel i5-8350U, UHD Graphics 620, Omarchy 4.0.3-1, reader 06cb:009a

### What's wrong?

`omarchy setup security fingerprint` detects the USB reader, installs `libfprint-git` + `fprintd`, then enrollment fails with `NoSuchDevice`. USB sees the hardware; stock `fprintd` does not. The wizard treats that as a retryable enroll failure instead of “this reader has no libfprint driver.”

Related: https://github.com/omacom/omarchy/issues/7006 and https://github.com/omacom/omarchy/pull/8757 cover *not clobbering* an already-installed `python-validity` stack. This report is the **first-run** path: Setup → Security → Fingerprint on a clean machine.

## Steps to recreate

1. ThinkPad with Synaptics/Validity `06cb:009a` (T480 / T480s / T490 / X1 Carbon 6th, etc.).
2. Omarchy menu → Setup → Security → Fingerprint, or `omarchy setup security fingerprint`.
3. Enter sudo password when asked.
4. Enrollment dies with:

```text
Setting up fingerprint scanner for authentication.

Let's setup your right index finger as the first fingerprint.
Keep moving the finger around on sensor until the process completes.

[sudo] password for …:
Impossible to enroll: GDBus.Error:net.reactivated.Fprint.Error.NoSuchDevice: No devices available

Enrollment failed. Please try again.
```

## What the stock wizard actually does on 4.0.3

`omarchy-hw-fingerprint` returns true because the USB product string contains “fingerprint” and/or vendor ID `06cb` is in the hardcoded vendor list. That is USB presence, not “libfprint can open this device.” The setup script already comments on this for Elan MOC readers (`Detection only proves a reader is there, not that libfprint can drive it`) but still proceeds to enroll.

It then installs only:

```bash
sudo pacman -S --needed --noconfirm --ask 4 libfprint-git fprintd usbutils
```

and runs `sudo fprintd-enroll "$USER"`.

`libfprint-git` (1:1.94.100.r10.g6f9479c-1) is pinned for FocalTech and Synaptics **`06cb:010b`**. That pin cannot help `06cb:009a`. libfprint's own hwdb lists this ID under **Known unsupported devices**:

```text
# /usr/lib/udev/hwdb.d/60-autosuspend-libfprint-2.hwdb
# Known unsupported devices
usb:v06CBp009A*
```

Same family, same outcome: `138a:0097` (commented on #7006). There is no libfprint driver for `06cb:009a`.

`fprintd-list $USER` on the stock stack: `No devices available`.

## Workaround (not a stock fix)

Replacing stock `fprintd` with the community Validity stack makes the reader work:

- `python-validity` 0.15-1 (AUR)
- `open-fprintd` 0.7-2 (AUR)
- `fprintd-clients-git` 1.90.1.r2.g54e56d6-10 (AUR; provides `fprintd-enroll` / `pam_fprintd.so`, conflicts with `fprintd`)

Enable `python3-validity`, `open-fprintd`, and the suspend/resume units, then enroll. After that:

```text
found 1 devices
Device at /net/reactivated/Fprint/Device/0
Fingerprints for user … on DBus driver (press):
 - #0: right-index-finger
```

PAM for sudo, polkit, and `/etc/pam.d/omarchy-lock-fingerprint` works unchanged. The gap is **backend selection and packaging**, not the PAM/lock-screen work the wizard already does.

This remains a workaround: AUR packages, a different daemon, firmware extract (`validity-sensors-firmware`), extra systemd units, and the user must not re-run the stock wizard or it tries to put `fprintd` back (#7006). PR #8757 would stop the clobber. Neither makes first-run Setup → Security → Fingerprint succeed on a clean install.

## What stock setup needs in order to actually fix this

PR #8757 is necessary but not sufficient. Skipping package install when an alternate stack is *already* present still leaves every first-run T480s user at `NoSuchDevice`.

### 1. Stop treating USB presence as ready to enroll

Before `fprintd-enroll`:

- Read USB vendor:product (here `06cb:009a`).
- Check libfprint's unsupported hwdb / `fprintd-list`.
- If the device is present on USB but `fprintd-list` reports no devices, do not ask for a finger. Fail with the USB ID and the backend that is required.

Today the script asks for a sudo password and then fails at enroll. That looks like a flaky sensor. It is a missing driver.

### 2. Branch by reader family, not always `libfprint-git` + `fprintd`

| Family | Examples | Stock path today | Working backend |
| --- | --- | --- | --- |
| libfprint-supported | `06cb:010b` and anything in the supported hwdb | `libfprint-git` + `fprintd` | keep current path |
| Validity Prometheus (no libfprint driver) | `06cb:009a`, `138a:0097`, `138a:0090` | same path → `NoSuchDevice` | `python-validity` + `open-fprintd` + `fprintd-clients` |
| Some Elan match-on-chip | `04f3:0c4b` and similar (see #7006) | libfprint protocol/calibration errors | vendor TOD (`libfprint-tod` + `libfprint-2-tod1-elan`) |
| Unknown / no driver | various Goodix IDs | `NoSuchDevice` after sudo | hard fail with USB ID |

`open-fprintd` implements the same `net.reactivated.Fprint` D-Bus API the rest of the wizard already uses. Once a device shows up in `fprintd-list`, enroll → verify → PAM → lock-screen PAM can stay as they are.

### 3. Ship the Validity stack from Omarchy packages, not only the AUR

A stock wizard cannot depend on `yay -S python-validity` as the happy path. Needed in `omarchy-pkgs` / OPR:

- `python-validity`
- `open-fprintd`
- `fprintd-clients` / `fprintd-clients-git` (CLI + `pam_fprintd.so`, without the libfprint daemon)

`fprintd-clients-git` **conflicts with** `fprintd`. The wizard must pick one daemon.

### 4. First-boot bring-up for python-validity, not just `pacman -S`

1. Replace `fprintd` with `open-fprintd` + `fprintd-clients*` + `python-validity`.
2. `systemctl enable --now python3-validity.service open-fprintd.service`.
3. Enable resume hooks when shipped: `open-fprintd-resume`, `open-fprintd-suspend`, `python3-validity-suspend-hotfix`.
4. Run `validity-sensors-firmware` on first start. Wait until `fprintd-list` shows a device before enroll.
5. If the service fails with signature / TLS errors, the documented recovery is stop → firmware → `factory-reset.py` → start. A minority of units also need one Windows enrollment to initialize the chip.

### 5. Do not let later Omarchy operations revert the backend

- Re-running Setup → Security → Fingerprint must not `pacman -S fprintd` over `fprintd-clients-git` (#7006 / #8757).
- `omarchy-remove-security-fingerprint` currently `omarchy-pkg-drop fprintd libfprint libfprint-git` and does not know about `python-validity` / `open-fprintd`.
- Update migrations that assume `libfprint-git` + `fprintd` must be no-ops on a Validity backend.

### 6. Keep the PAM work; it already works

Once `fprintd-list` sees a device: enroll + verify first, PAM last, clamshell gate via `omarchy-hw-laptop-closed`, `/etc/pam.d/omarchy-lock-fingerprint` for the lock screen.

## Expected

On a T480s with `06cb:009a`, Setup → Security → Fingerprint should either:

1. install and start the Validity backend, enroll, and configure PAM, or
2. refuse up front with `06cb:009a` is not supported by libfprint — never `NoSuchDevice` after a password prompt.

## omarchy-debug

`omarchy-debug --no-sudo --print` (dmesg skipped because of `--no-sudo`; journal omitted here because it is ~4000 lines of post-workaround `python-validity` lock-screen match timeouts, not the stock enroll failure).

```text
Date: Sun Sep 13 07:39:08 PM CEST 2026
Hostname: OmarchyT480
Omarchy Package: omarchy 4.0.3-1

=========================================
SYSTEM INFORMATION
=========================================
System:
  Kernel 7.2.3-arch1-3 arch x86_64 bits 64 compiler gcc v 16.2.1 clocksource tsc avail acpi_pm
    parameters cryptdevice=PARTUUID=d5a2e30e-54c4-43b7-8360-443e2dfb1f41:root root=/dev/mapper/root
    zswap.enabled=0 rootflags=subvol=@ rw rootfstype=btrfs resume=/dev/mapper/root
    resume_offset=1927862 initramfs_async=0 quiet splash loglevel=0 systemd.show_status=false
    rd.udev.log_level=0 vt.global_cursor_default=0
  Desktop Hyprland v 0.56.2 vt 1 dm SDDM Distro Omarchy
Machine:
  Type Laptop System LENOVO product 20L8S27E04 v ThinkPad T480s serial <superuser required> Chassis
    type 10 serial <superuser required>
  Mobo LENOVO model 20L8S27E04 v SDK0J40697 WIN serial <superuser required>
    part-nu LENOVO_MT_20L8_BU_Think_FM_ThinkPad T480s uuid <superuser required> Firmware UEFI
    vendor LENOVO v N22ET61W (1.38 ) date 01/11/2020
Battery:
  ID-1 BAT0 charge 50.2 Wh (100%) condition 50.2/57 Wh (88.1%) volts 12.82 min 11.58
    model LGC 01AV478 type Li-poly serial <filter> charging status full control start 0% end 100%
    cycles 133
CPU:
  Info model Intel Core i5-8350U bits 64 type MT MCP arch Coffee Lake gen core 8 level v3
    note check built 2017 process Intel 14nm family 6 model-id 0x8E (142) stepping 0xA (10)
    microcode 0xF6
  Topology cpus 1x dies 1 clusters 4 cores 4 threads 8 tpc 2 smt enabled cache L1 256 KiB
    desc d-4x32 KiB; i-4x32 KiB L2 1024 KiB desc 4x256 KiB L3 6 MiB desc 1x6 MiB
  Speed (MHz) avg 3601 min/max 400/3600 scaling driver intel_pstate governor powersave cores
    1 3601 2 3601 3 3601 4 3601 5 3601 6 3601 7 3601 8 3601 bogomips 30399
  Flags-basic avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx
  Vulnerabilities
  Type gather_data_sampling mitigation Microcode
  Type ghostwrite status Not affected
  Type indirect_target_selection status Not affected
  Type itlb_multihit status KVM: Split huge pages
  Type l1tf mitigation PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
  Type mds mitigation Clear CPU buffers; SMT vulnerable
  Type meltdown mitigation PTI
  Type mmio_stale_data mitigation Clear CPU buffers; SMT vulnerable
  Type old_microcode status Not affected
  Type reg_file_data_sampling status Not affected
  Type retbleed mitigation IBRS
  Type spec_rstack_overflow status Not affected
  Type spec_store_bypass mitigation Speculative Store Bypass disabled via prctl
  Type spectre_v1 mitigation usercopy/swapgs barriers and __user pointer sanitization
  Type spectre_v2 mitigation IBRS; IBPB: conditional; STIBP: conditional; RSB filling;
    PBRSB-eIBRS: Not affected; BHI: Not affected
  Type srbds mitigation Microcode
  Type tsa status Not affected
  Type tsx_async_abort mitigation TSX disabled
  Type vmscape mitigation IBPB before exit to userspace
Graphics:
  Device-1 Intel Kaby Lake-R GT2 [UHD Graphics 620] vendor Lenovo driver i915 v kernel arch Gen-9.5
    process Intel 14nm built 2016-20 ports active eDP-1 empty DP-1, DP-2, HDMI-A-1, HDMI-A-2
    bus-ID 00:02.0 chip-ID 8086:5917 class-ID 0300
  Device-2 Chicony Integrated IR Camera driver uvcvideo type USB rev 2.0 speed 480 Mb/s lanes 1
    mode 2.0 bus-ID 1-5:3 chip-ID 04f2:b615 class-ID 0e02
  Device-3 Chicony Integrated Camera driver uvcvideo type USB rev 2.0 speed 480 Mb/s lanes 1
    mode 2.0 bus-ID 1-8:5 chip-ID 04f2:b614 class-ID 0e02
  Display wayland server X.org v 1.21.1.24 with Xwayland v 24.1.13 compositor Hyprland v 0.56.2
    driver gpu i915 display-ID 1
  Monitor-1 eDP-1 model AU Optronics 0x243d built 2017 res 1920x1080 dpi 158 gamma 1.2
    size 309x173mm (12.17x6.81") diag 354mm (13.9") ratio 16:9 modes 1920x1080
  API EGL Message EGL data requires eglinfo. Check --recommends.
  Info Tools x11 xprop
Audio:
  Device-1 Intel Sunrise Point-LP HD Audio vendor Lenovo driver snd_hda_intel v kernel
    alternate snd_soc_avs bus-ID 00:1f.3 chip-ID 8086:9d71 class-ID 0403
  API ALSA v k7.2.3-arch1-3 status kernel-api tools alsactl,alsamixer,amixer
  Server-1 sndiod v N/A status off tools aucat,midicat,sndioctl
  Server-2 PipeWire v 1.6.8 status active with 1 pipewire-pulse status active 2 wireplumber
    status active 3 pipewire-alsa type plugin 4 pw-jack type plugin tools pactl,pw-cat,pw-cli,wpctl
Network:
  Device-1 Intel Ethernet I219-LM vendor Lenovo driver e1000e v kernel port N/A bus-ID 00:1f.6
    chip-ID 8086:15d7 class-ID 0200
  IF enp0s31f6 state down mac <filter>
  Device-2 Intel Wireless 8265 / 8275 driver iwlwifi v kernel pcie gen 1 speed 2.5 GT/s lanes 1
    bus-ID 3d:00.0 chip-ID 8086:24fd class-ID 0280
  IF wlp61s0 state up mac <filter>
  Info services NetworkManager, systemd-timesyncd, wpa_supplicant
Bluetooth:
  Device-1 Intel Bluetooth wireless interface driver btusb v 0.8 type USB rev 2.0 speed 12 Mb/s
    lanes 1 mode 1.1 bus-ID 1-7:4 chip-ID 8087:0a2b class-ID e001
  Report btmgmt ID hci0 rfk-id 1 state up address <filter> bt-v 4.2 lmp-v 8 status
    discoverable no pairing no class-ID 6c010c
Drives:
  Local Storage total 245.95 GiB used 18.22 GiB (7.4%)
  SMART Message Required tool smartctl not installed. Check --recommends
  ID-1 /dev/nvme0n1 maj-min 259:0 vendor Samsung model MZVLB256HAHQ-000L7 size 238.47 GiB
    block-size physical 512 B logical 512 B speed 31.6 Gb/s lanes 4 tech SSD serial <filter>
    fw-rev 1L2QEXD7 temp 30.9 C scheme GPT
  ID-2 /dev/sda maj-min 8:0 vendor Kingston model DataTraveler 2.0 size 7.48 GiB block-size
    physical 512 B logical 512 B type USB rev 2.0 spd 480 Mb/s lanes 1 mode 2.0 tech N/A
    serial <filter> fw-rev 1.00 scheme MBR
Partition:
  ID-1 / raw-size 236.46 GiB size 236.46 GiB (100.00%) used 18.12 GiB (7.7%) fs btrfs dev /dev/dm-0
    maj-min 253:0 mapped root
  ID-2 /boot raw-size 2 GiB size 2 GiB (99.80%) used 106.6 MiB (5.2%) fs vfat dev /dev/nvme0n1p1
    maj-min 259:1
  ID-3 /home raw-size 236.46 GiB size 236.46 GiB (100.00%) used 18.12 GiB (7.7%) fs btrfs
    dev /dev/dm-0 maj-min 253:0 mapped root
  ID-4 /var/log raw-size 236.46 GiB size 236.46 GiB (100.00%) used 18.12 GiB (7.7%) fs btrfs
    dev /dev/dm-0 maj-min 253:0 mapped root
Swap:
  Kernel swappiness 150 (default 60) cache-pressure 50 (default 100) zswap no
  ID-1 swap-1 type file size 7.49 GiB used 0 KiB (0.0%) priority 0 file /swap/swapfile
  ID-2 swap-2 type zram size 7.49 GiB used 2.4 MiB (0.0%) priority 100 comp zstd
    avail lzo-rle,lzo,lz4,lz4hc,deflate,842 dev /dev/zram0
Sensors:
  System Temperatures cpu 40.0 C pch 37.0 C mobo N/A
  Fan Speeds (rpm) fan-1 0
Repos:
  Packages pm pacman pkgs 985 libs 271 tools yay
  Active pacman repo servers in /etc/pacman.conf
    1 https: //pkgs.omarchy.org/stable/$arch
  Active pacman repo servers in /etc/pacman.d/mirrorlist
    1 https: //stable-mirror.omarchy.org/$repo/os/$arch
Info:
  Memory total 8 GiB note est. available 7.49 GiB used 3 GiB (40.0%)
  Processes 273 Power uptime 2h 25m states freeze,mem,disk suspend deep avail s2idle wakeups 0
    hibernate platform avail shutdown, reboot, suspend, test_resume image 2.96 GiB
    services power-profiles-daemon, thermald, upowerd Init systemd v 261 default graphical
    tool systemctl
  Compilers clang 22.1.8 gcc 16.2.1 Client shell wrapper v 5.3.15-release inxi 3.3.41

=========================================
DMESG
=========================================
(skipped - --no-sudo flag used)

=========================================
```

Fingerprint extras (not in the stock debug dump):

```text
$ lsusb | grep 06cb
Bus 001 Device 006: ID 06cb:009a Synaptics, Inc. Metallica MIS Touch Fingerprint Reader

$ grep -n '009A' /usr/lib/udev/hwdb.d/60-autosuspend-libfprint-2.hwdb
441:usb:v06CBp009A*

$ pacman -Q python-validity open-fprintd fprintd-clients-git fprintd libfprint-git omarchy
python-validity 0.15-1
open-fprintd 0.7-2
fprintd-clients-git 1.90.1.r2.g54e56d6-10
error: package 'fprintd' was not found
libfprint-git 1:1.94.100.r10.g6f9479c-1
omarchy 4.0.3-1

$ fprintd-list $USER
found 1 devices
Device at /net/reactivated/Fprint/Device/0
Using device /net/reactivated/Fprint/Device/0
Fingerprints for user … on DBus driver (press):
 - #0: right-index-finger
```

Stock `fprintd-list` *before* the workaround was `No devices available`.