Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
setup security fingerprint wipes the clamshell gate from omarchy-lock-fingerprint
Reported by 1818TusculumSt · filed Sep 4, 2026Closed upstream on 2026-10-11 by the bot omarchybot, as a duplicate (target not recorded).
R-989 is the earliest report of this defect — filed Sep 4, 2026, open upstream. This report (filed Sep 4, 2026) describes the same defect, so it is folded under it in the inbox.
Decided by agents · verified· Oct 8, 2026
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
What happened
Running omarchy setup security fingerprint (to re-enroll a print) silently removed the clamshell gate from the lock-screen PAM stack.
Before the wizard, /etc/pam.d/omarchy-lock-fingerprint contained:
#%PAM-1.0
auth [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed
auth required pam_fprintd.so
account include system-local-loginAfter the wizard, it contained:
#%PAM-1.0
auth required pam_fprintd.so
account include system-local-loginSo with the lid closed (docked, reader unreachable), the lock screen blocks on the fingerprint reader until timeout instead of dropping straight to the password prompt.
What was expected
The gate should survive a re-enrollment. The wizard already knows about it: setup_pam_config in the same script inserts the omarchy-hw-laptop-closed gate before pam_fprintd.so in the sudo and polkit stacks, with comments stating the gate "runs before pam_fprintd in every stack". Only setup_lock_fingerprint_pam()'s heredoc omits it.
Steps to reproduce
- Have the clamshell gate present in
/etc/pam.d/omarchy-lock-fingerprint - Run
omarchy setup security fingerprintand complete enrollment cat /etc/pam.d/omarchy-lock-fingerprint— thepam_exec … omarchy-hw-laptop-closedline is gone
Suggested fix
Include the gate line in setup_lock_fingerprint_pam()'s heredoc, sharing the $fprintd_gate variable the same script already defines (same pattern as the polkit heredoc branch).
System details
- Omarchy 4.0.2-1, kernel 7.1.9-arch1-2, i7-1270P
- fprintd 1.94.5-2, libfprint 1.94.100-1
- Sensor: 06cb:00fc Synaptics Prometheus Fingerprint Reader
View raw text
## What happened Running `omarchy setup security fingerprint` (to re-enroll a print) silently removed the clamshell gate from the lock-screen PAM stack. Before the wizard, `/etc/pam.d/omarchy-lock-fingerprint` contained: ``` #%PAM-1.0 auth [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed auth required pam_fprintd.so account include system-local-login ``` After the wizard, it contained: ``` #%PAM-1.0 auth required pam_fprintd.so account include system-local-login ``` So with the lid closed (docked, reader unreachable), the lock screen blocks on the fingerprint reader until timeout instead of dropping straight to the password prompt. ## What was expected The gate should survive a re-enrollment. The wizard already knows about it: `setup_pam_config` in the same script inserts the `omarchy-hw-laptop-closed` gate before `pam_fprintd.so` in the sudo and polkit stacks, with comments stating the gate "runs before pam_fprintd in every stack". Only `setup_lock_fingerprint_pam()`'s heredoc omits it. ## Steps to reproduce 1. Have the clamshell gate present in `/etc/pam.d/omarchy-lock-fingerprint` 2. Run `omarchy setup security fingerprint` and complete enrollment 3. `cat /etc/pam.d/omarchy-lock-fingerprint` — the `pam_exec … omarchy-hw-laptop-closed` line is gone ## Suggested fix Include the gate line in `setup_lock_fingerprint_pam()`'s heredoc, sharing the `$fprintd_gate` variable the same script already defines (same pattern as the polkit heredoc branch). ## System details - Omarchy 4.0.2-1, kernel 7.1.9-arch1-2, i7-1270P - fprintd 1.94.5-2, libfprint 1.94.100-1 - Sensor: 06cb:00fc Synaptics Prometheus Fingerprint Reader
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Duplicate ofR-989omarchy-setup-security-fingerprint doesn't add the clamshell gate to the lock screen's fingerprint PAM config· decided by agents · verified
- Fixed bypr/10393· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.