From 45db959dafc172ea9a48705b20d3b78d6b09754e Mon Sep 17 00:00:00 2001 From: David Heinemeier Hansson Date: Fri, 8 May 2026 16:41:20 +0200 Subject: [PATCH] Split fido2 and fingerprint setups into setup and remove (#5670) * Split fido2 and fingerprint setups into setup and remove Don't make one thing do two things * Extract helpers and clean up * No need to hide them * Don't need these --- bin/omarchy | 1 + bin/omarchy-echo-failure | 9 ++ bin/omarchy-echo-info | 9 ++ bin/omarchy-echo-success | 9 ++ bin/omarchy-menu | 17 ++- bin/omarchy-remove-security-fido2 | 35 ++++++ bin/omarchy-remove-security-fingerprint | 37 ++++++ bin/omarchy-setup-fido2 | 131 ------------------- bin/omarchy-setup-fingerprint | 161 ------------------------ bin/omarchy-setup-security-fido2 | 81 ++++++++++++ bin/omarchy-setup-security-fingerprint | 95 ++++++++++++++ 11 files changed, 288 insertions(+), 297 deletions(-) create mode 100755 bin/omarchy-echo-failure create mode 100755 bin/omarchy-echo-info create mode 100755 bin/omarchy-echo-success create mode 100755 bin/omarchy-remove-security-fido2 create mode 100755 bin/omarchy-remove-security-fingerprint delete mode 100755 bin/omarchy-setup-fido2 delete mode 100755 bin/omarchy-setup-fingerprint create mode 100755 bin/omarchy-setup-security-fido2 create mode 100755 bin/omarchy-setup-security-fingerprint diff --git a/bin/omarchy b/bin/omarchy index c23a6457..863d5104 100755 --- a/bin/omarchy +++ b/bin/omarchy @@ -53,6 +53,7 @@ GROUP_DESCRIPTIONS[npx]="NPX package wrappers" GROUP_DESCRIPTIONS[pkg]="Package management helpers" GROUP_DESCRIPTIONS[plymouth]="Plymouth boot theme management" GROUP_DESCRIPTIONS[powerprofiles]="Power profile management" +GROUP_DESCRIPTIONS[echo]="Colored terminal output helpers" GROUP_DESCRIPTIONS[refresh]="Reset config to defaults" GROUP_DESCRIPTIONS[reinstall]="Reinstall and reset workflows" GROUP_DESCRIPTIONS[reminder]="Desktop notification reminders" diff --git a/bin/omarchy-echo-failure b/bin/omarchy-echo-failure new file mode 100755 index 00000000..6a0e2e3c --- /dev/null +++ b/bin/omarchy-echo-failure @@ -0,0 +1,9 @@ +#!/bin/bash + +# omarchy:summary=Print a failure message in red +# omarchy:args= + +RED='\033[0;31m' +NC='\033[0m' + +echo -e "${RED}$*${NC}" diff --git a/bin/omarchy-echo-info b/bin/omarchy-echo-info new file mode 100755 index 00000000..b48543cc --- /dev/null +++ b/bin/omarchy-echo-info @@ -0,0 +1,9 @@ +#!/bin/bash + +# omarchy:summary=Print an informational message in yellow +# omarchy:args= + +YELLOW='\033[1;33m' +NC='\033[0m' + +echo -e "${YELLOW}$*${NC}" diff --git a/bin/omarchy-echo-success b/bin/omarchy-echo-success new file mode 100755 index 00000000..40bc21b5 --- /dev/null +++ b/bin/omarchy-echo-success @@ -0,0 +1,9 @@ +#!/bin/bash + +# omarchy:summary=Print a success message in green +# omarchy:args= + +GREEN='\033[0;32m' +NC='\033[0m' + +echo -e "${GREEN}$*${NC}" diff --git a/bin/omarchy-menu b/bin/omarchy-menu index 966cd10e..2d7355c8 100755 --- a/bin/omarchy-menu +++ b/bin/omarchy-menu @@ -330,8 +330,8 @@ show_setup_power_menu() { show_setup_security_menu() { case $(menu "Setup" "󰈷 Fingerprint\n Fido2") in - *Fingerprint*) present_terminal omarchy-setup-fingerprint ;; - *Fido2*) present_terminal omarchy-setup-fido2 ;; + *Fingerprint*) present_terminal omarchy-setup-security-fingerprint ;; + *Fido2*) present_terminal omarchy-setup-security-fido2 ;; *) show_setup_menu ;; esac } @@ -644,7 +644,7 @@ show_install_elixir_menu() { } show_remove_menu() { - case $(menu "Remove" "󰣇 Package\n Browser\n Web App\n TUI\n󰵮 Development\n Gaming\n󰏓 Preinstalls\n Dictation\n󰸌 Theme\n󰍲 Windows\n󰈷 Fingerprint\n Fido2") in + case $(menu "Remove" "󰣇 Package\n Browser\n Web App\n TUI\n󰵮 Development\n Gaming\n󰏓 Preinstalls\n Dictation\n󰸌 Theme\n󰍲 Windows\n Security") in *Package*) terminal omarchy-pkg-remove ;; *Browser*) show_remove_browser_menu ;; *Web*) present_terminal omarchy-webapp-remove ;; @@ -655,12 +655,19 @@ show_remove_menu() { *Dictation*) present_terminal omarchy-voxtype-remove ;; *Theme*) present_terminal omarchy-theme-remove ;; *Windows*) present_terminal "omarchy-windows-vm remove" ;; - *Fingerprint*) present_terminal "omarchy-setup-fingerprint --remove" ;; - *Fido2*) present_terminal "omarchy-setup-fido2 --remove" ;; + *Security*) show_remove_security_menu ;; *) show_main_menu ;; esac } +show_remove_security_menu() { + case $(menu "Remove" "󰈷 Fingerprint\n Fido2") in + *Fingerprint*) present_terminal omarchy-remove-security-fingerprint ;; + *Fido2*) present_terminal omarchy-remove-security-fido2 ;; + *) show_remove_menu ;; + esac +} + show_remove_browser_menu() { case $(menu "Remove" " Chrome\n Edge\n Brave\n Brave Origin\n Firefox\n Zen") in *Chrome*) present_terminal "omarchy-remove-browser chrome" ;; diff --git a/bin/omarchy-remove-security-fido2 b/bin/omarchy-remove-security-fido2 new file mode 100755 index 00000000..f8925767 --- /dev/null +++ b/bin/omarchy-remove-security-fido2 @@ -0,0 +1,35 @@ +#!/bin/bash + +# omarchy:summary=Remove FIDO2 authentication from sudo and polkit +# omarchy:requires-sudo=true + +set -e + + +remove_pam_config() { + # Remove from sudo + if grep -q pam_u2f.so /etc/pam.d/sudo; then + omarchy-echo-info "Removing FIDO2 authentication from sudo..." + sudo sed -i '/pam_u2f\.so/d' /etc/pam.d/sudo + fi + + # Remove from polkit + if [[ -f /etc/pam.d/polkit-1 ]] && grep -Fq 'pam_u2f.so' /etc/pam.d/polkit-1; then + omarchy-echo-info "Removing FIDO2 authentication from polkit..." + sudo sed -i '/pam_u2f\.so/d' /etc/pam.d/polkit-1 + fi +} + +omarchy-echo-success "Removing FIDO2 device from authentication.\n" + +remove_pam_config + +if [[ -d /etc/fido2 ]]; then + omarchy-echo-info "Removing FIDO2 configuration..." + sudo rm -rf /etc/fido2 +fi + +omarchy-echo-info "Removing FIDO2 packages..." +omarchy-pkg-drop libfido2 pam-u2f + +omarchy-echo-success "FIDO2 authentication has been completely removed." diff --git a/bin/omarchy-remove-security-fingerprint b/bin/omarchy-remove-security-fingerprint new file mode 100755 index 00000000..ba3bd4c4 --- /dev/null +++ b/bin/omarchy-remove-security-fingerprint @@ -0,0 +1,37 @@ +#!/bin/bash + +# omarchy:summary=Remove fingerprint authentication from sudo, polkit, and lock screen +# omarchy:requires-sudo=true + +set -e + + +remove_pam_config() { + # Remove from sudo + if grep -q pam_fprintd.so /etc/pam.d/sudo; then + omarchy-echo-info "Removing fingerprint authentication from sudo..." + sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/sudo + fi + + # Remove from polkit + if [[ -f /etc/pam.d/polkit-1 ]] && grep -Fq 'pam_fprintd.so' /etc/pam.d/polkit-1; then + omarchy-echo-info "Removing fingerprint authentication from polkit..." + sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/polkit-1 + fi +} + +remove_hyprlock_fingerprint_icon() { + omarchy-echo-info "Removing fingerprint icon from hyprlock placeholder text..." + sed -i 's/placeholder_text = .*/placeholder_text = Enter Password/' ~/.config/hypr/hyprlock.conf + sed -i 's/fingerprint:enabled = .*/fingerprint:enabled = false/' ~/.config/hypr/hyprlock.conf +} + +omarchy-echo-success "Removing fingerprint scanner from authentication.\n" + +remove_pam_config +remove_hyprlock_fingerprint_icon + +omarchy-echo-info "Removing fingerprint packages..." +omarchy-pkg-drop fprintd libfprint-git + +omarchy-echo-success "Fingerprint authentication has been completely removed." diff --git a/bin/omarchy-setup-fido2 b/bin/omarchy-setup-fido2 deleted file mode 100755 index 0e55d0b2..00000000 --- a/bin/omarchy-setup-fido2 +++ /dev/null @@ -1,131 +0,0 @@ -#!/bin/bash - -# omarchy:summary=Set up or remove FIDO2 authentication for sudo and polkit -# omarchy:args=[--remove] -# omarchy:requires-sudo=true - -set -e - -GREEN='\033[0;32m' -RED='\033[0;31m' -YELLOW='\033[1;33m' -NC='\033[0m' # No Color - -print_success() { - echo -e "${GREEN}$1${NC}" -} - -print_error() { - echo -e "${RED}$1${NC}" -} - -print_info() { - echo -e "${YELLOW}$1${NC}" -} - -check_fido2_hardware() { - tokens=$(fido2-token -L 2>/dev/null) - if [[ -z $tokens ]]; then - print_error "\nNo FIDO2 device detected. Please plug it in (you may need to unlock it as well)." - return 1 - fi - return 0 -} - -setup_pam_config() { - # Configure sudo - if ! grep -q pam_u2f.so /etc/pam.d/sudo; then - print_info "Configuring sudo for FIDO2 authentication..." - sudo sed -i '1i auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/sudo - fi - - # Configure polkit - if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_u2f.so' /etc/pam.d/polkit-1; then - print_info "Configuring polkit for FIDO2 authentication..." - sudo sed -i '1i auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/polkit-1 - elif [[ ! -f /etc/pam.d/polkit-1 ]]; then - print_info "Creating polkit configuration with FIDO2 authentication..." - sudo tee /etc/pam.d/polkit-1 >/dev/null <<'EOF' -auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2 -auth required pam_unix.so - -account required pam_unix.so -password required pam_unix.so -session required pam_unix.so -EOF - fi -} - -remove_pam_config() { - # Remove from sudo - if grep -q pam_u2f.so /etc/pam.d/sudo; then - print_info "Removing FIDO2 authentication from sudo..." - sudo sed -i '/pam_u2f\.so/d' /etc/pam.d/sudo - fi - - # Remove from polkit - if [[ -f /etc/pam.d/polkit-1 ]] && grep -Fq 'pam_u2f.so' /etc/pam.d/polkit-1; then - print_info "Removing FIDO2 authentication from polkit..." - sudo sed -i '/pam_u2f\.so/d' /etc/pam.d/polkit-1 - fi -} - -if [[ "--remove" == $1 ]]; then - print_success "Removing FIDO2 device from authentication.\n" - - # Remove PAM configuration - remove_pam_config - - # Remove FIDO2 configuration - if [[ -d /etc/fido2 ]]; then - print_info "Removing FIDO2 configuration..." - sudo rm -rf /etc/fido2 - fi - - # Uninstall packages - print_info "Removing FIDO2 packages..." - sudo pacman -Rns --noconfirm libfido2 pam-u2f - - print_success "FIDO2 authentication has been completely removed." -else - print_success "Setting up FIDO2 device for authentication.\n" - - # Install required packages - print_info "Installing required packages..." - omarchy-pkg-add libfido2 pam-u2f - - if ! check_fido2_hardware; then - exit 1 - fi - - # Create the pamu2fcfg file - if [[ ! -f /etc/fido2/fido2 ]]; then - sudo mkdir -p /etc/fido2 - print_success "\nLet's setup your device by confirming on the device now." - print_info "Touch your FIDO2 key when it lights up...\n" - - if pamu2fcfg >/tmp/fido2; then - sudo mv /tmp/fido2 /etc/fido2/fido2 - print_success "FIDO2 device registered successfully!" - else - print_error "\nFIDO2 registration failed. Please try again." - exit 1 - fi - else - print_info "FIDO2 device already registered." - fi - - # Configure PAM - setup_pam_config - - # Test with sudo - print_info "\nTesting FIDO2 authentication with sudo..." - print_info "Touch your FIDO2 key when prompted.\n" - - if sudo echo "FIDO2 authentication test successful"; then - print_success "\nPerfect! FIDO2 authentication is now configured." - print_info "You can use your FIDO2 key for sudo and polkit authentication." - else - print_error "\nVerification failed. You may want to check your configuration." - fi -fi diff --git a/bin/omarchy-setup-fingerprint b/bin/omarchy-setup-fingerprint deleted file mode 100755 index 77a97cb9..00000000 --- a/bin/omarchy-setup-fingerprint +++ /dev/null @@ -1,161 +0,0 @@ -#!/bin/bash - -# omarchy:summary=Set up or remove fingerprint authentication for sudo, polkit, and lock screen -# omarchy:args=[--remove] -# omarchy:requires-sudo=true - -set -e - -GREEN='\033[0;32m' -RED='\033[0;31m' -YELLOW='\033[1;33m' -NC='\033[0m' # No Color - -print_success() { - echo -e "${GREEN}$1${NC}" -} - -print_error() { - echo -e "${RED}$1${NC}" -} - -print_info() { - echo -e "${YELLOW}$1${NC}" -} - -check_fingerprint_hardware() { - # Get fingerprint devices for the user - devices=$(fprintd-list "$USER" 2>/dev/null) - - # Exit if no devices found - if [[ -z $devices ]]; then - print_error "\nNo fingerprint sensor detected." - return 1 - fi - return 0 -} - -setup_pam_config() { - # Configure sudo - if ! grep -q pam_fprintd.so /etc/pam.d/sudo; then - print_info "Configuring sudo for fingerprint authentication..." - sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/sudo - fi - - # Configure polkit - if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_fprintd.so' /etc/pam.d/polkit-1; then - print_info "Configuring polkit for fingerprint authentication..." - sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/polkit-1 - elif [[ ! -f /etc/pam.d/polkit-1 ]]; then - print_info "Creating polkit configuration with fingerprint authentication..." - sudo tee /etc/pam.d/polkit-1 >/dev/null <<'EOF' -auth sufficient pam_fprintd.so -auth required pam_unix.so - -account required pam_unix.so -password required pam_unix.so -session required pam_unix.so -EOF - fi -} - -add_hyprlock_fingerprint_icon() { - print_info "Adding fingerprint icon to hyprlock placeholder text..." - sed -i 's/placeholder_text = .*/placeholder_text = Enter Password 󰈷 <\/span>/' ~/.config/hypr/hyprlock.conf - sed -i 's/fingerprint:enabled = .*/fingerprint:enabled = true/' ~/.config/hypr/hyprlock.conf -} - -remove_hyprlock_fingerprint_icon() { - print_info "Removing fingerprint icon from hyprlock placeholder text..." - sed -i 's/placeholder_text = .*/placeholder_text = Enter Password/' ~/.config/hypr/hyprlock.conf - sed -i 's/fingerprint:enabled = .*/fingerprint:enabled = false/' ~/.config/hypr/hyprlock.conf -} - -remove_pam_config() { - # Remove from sudo - if grep -q pam_fprintd.so /etc/pam.d/sudo; then - print_info "Removing fingerprint authentication from sudo..." - sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/sudo - fi - - # Remove from polkit - if [[ -f /etc/pam.d/polkit-1 ]] && grep -Fq 'pam_fprintd.so' /etc/pam.d/polkit-1; then - print_info "Removing fingerprint authentication from polkit..." - sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/polkit-1 - fi -} - -if [[ "--remove" == $1 ]]; then - print_success "Removing fingerprint scanner from authentication.\n" - - # Remove PAM configuration - remove_pam_config - - # Remove fingerprint icon from hyprlock placeholder text - remove_hyprlock_fingerprint_icon - - # Uninstall packages - print_info "Removing fingerprint packages..." - sudo pacman -Rns --noconfirm fprintd - - print_success "Fingerprint authentication has been completely removed." -else - print_success "Setting up fingerprint scanner for authentication.\n" - - # Install required packages - print_info "Installing required packages..." - - # ASUS ExpertBook B9406CAA ships a FocalTech FT9349 ESS reader (USB - # 2808:a97a). Mainline libfprint at 1.94.x lacks the focaltech_moc - # driver (and its 0xa97a id_table entry); OPR ships libfprint-git - # which carries both. Once upstream catches up, this branch is a - # no-op and `libfprint-git` provides=libfprint anyway. Detect via - # /sys to avoid depending on usbutils being installed first. - for v in /sys/bus/usb/devices/*/idVendor; do - [[ "$(cat "$v" 2>/dev/null)" == "2808" ]] || continue - [[ "$(cat "${v%idVendor}idProduct" 2>/dev/null)" == "a97a" ]] || continue - print_info "FocalTech FT9349 detected (B9406CAA) — using libfprint-git from OPR..." - # libfprint-git provides+conflicts libfprint; pacman -S --noconfirm - # defaults the conflict prompt to N and aborts. Pre-remove libfprint - # with -Rdd so the install goes silent. -Rdd (not omarchy-pkg-drop's - # -Rns) is required because fprintd requires libfprint; the dep is - # re-satisfied immediately by libfprint-git's provides=libfprint. - if omarchy-pkg-present libfprint; then - sudo pacman -Rdd --noconfirm libfprint - fi - omarchy-pkg-add libfprint-git - break - done - - omarchy-pkg-add fprintd usbutils - - if ! check_fingerprint_hardware; then - exit 1 - fi - - # Configure PAM - setup_pam_config - - # Add fingerprint icon to hyprlock placeholder text - add_hyprlock_fingerprint_icon - - # Enroll first fingerprint - print_success "\nLet's setup your right index finger as the first fingerprint." - print_info "Keep moving the finger around on sensor until the process completes.\n" - - if sudo fprintd-enroll "$USER"; then - print_success "\nFingerprint enrolled successfully!" - - # Verify - print_info "\nNow let's verify that it's working correctly.\n" - if fprintd-verify; then - print_success "\nPerfect! Fingerprint authentication is now configured." - print_info "You can use your fingerprint for sudo, polkit, and lock screen (Super + Escape)." - else - print_error "\nVerification failed. You may want to try enrolling again." - fi - else - print_error "\nEnrollment failed. Please try again." - exit 1 - fi -fi diff --git a/bin/omarchy-setup-security-fido2 b/bin/omarchy-setup-security-fido2 new file mode 100755 index 00000000..603add90 --- /dev/null +++ b/bin/omarchy-setup-security-fido2 @@ -0,0 +1,81 @@ +#!/bin/bash + +# omarchy:summary=Set up FIDO2 authentication for sudo and polkit +# omarchy:requires-sudo=true + +set -e + + +check_fido2_hardware() { + tokens=$(fido2-token -L 2>/dev/null) + if [[ -z $tokens ]]; then + omarchy-echo-failure "\nNo FIDO2 device detected. Please plug it in (you may need to unlock it as well)." + return 1 + fi + return 0 +} + +setup_pam_config() { + # Configure sudo + if ! grep -q pam_u2f.so /etc/pam.d/sudo; then + omarchy-echo-info "Configuring sudo for FIDO2 authentication..." + sudo sed -i '1i auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/sudo + fi + + # Configure polkit + if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_u2f.so' /etc/pam.d/polkit-1; then + omarchy-echo-info "Configuring polkit for FIDO2 authentication..." + sudo sed -i '1i auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/polkit-1 + elif [[ ! -f /etc/pam.d/polkit-1 ]]; then + omarchy-echo-info "Creating polkit configuration with FIDO2 authentication..." + sudo tee /etc/pam.d/polkit-1 >/dev/null <<'EOF' +auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2 +auth required pam_unix.so + +account required pam_unix.so +password required pam_unix.so +session required pam_unix.so +EOF + fi +} + +omarchy-echo-success "Setting up FIDO2 device for authentication.\n" + +# Install required packages +omarchy-echo-info "Installing required packages..." +omarchy-pkg-add libfido2 pam-u2f + +if ! check_fido2_hardware; then + exit 1 +fi + +# Create the pamu2fcfg file +if [[ ! -f /etc/fido2/fido2 ]]; then + sudo mkdir -p /etc/fido2 + omarchy-echo-success "\nLet's setup your device by confirming on the device now." + omarchy-echo-info "Touch your FIDO2 key when it lights up...\n" + + if pamu2fcfg >/tmp/fido2; then + sudo mv /tmp/fido2 /etc/fido2/fido2 + omarchy-echo-success "FIDO2 device registered successfully!" + else + omarchy-echo-failure "\nFIDO2 registration failed. Please try again." + exit 1 + fi +else + omarchy-echo-info "FIDO2 device already registered." +fi + +# Configure PAM +setup_pam_config + +# Test with sudo +omarchy-echo-info "\nTesting FIDO2 authentication with sudo..." +omarchy-echo-info "Touch your FIDO2 key when prompted.\n" + +if sudo echo "FIDO2 authentication test successful"; then + omarchy-echo-success "\nPerfect! FIDO2 authentication is now configured." + omarchy-echo-info "You can use your FIDO2 key for sudo and polkit authentication." +else + omarchy-echo-failure "\nVerification failed. You may want to check your configuration." +fi diff --git a/bin/omarchy-setup-security-fingerprint b/bin/omarchy-setup-security-fingerprint new file mode 100755 index 00000000..821f2472 --- /dev/null +++ b/bin/omarchy-setup-security-fingerprint @@ -0,0 +1,95 @@ +#!/bin/bash + +# omarchy:summary=Set up fingerprint authentication for sudo, polkit, and lock screen +# omarchy:requires-sudo=true + +set -e + + +check_fingerprint_hardware() { + # Get fingerprint devices for the user + devices=$(fprintd-list "$USER" 2>/dev/null) + + # Exit if no devices found + if [[ -z $devices ]]; then + omarchy-echo-failure "\nNo fingerprint sensor detected." + return 1 + fi + return 0 +} + +setup_pam_config() { + # Configure sudo + if ! grep -q pam_fprintd.so /etc/pam.d/sudo; then + omarchy-echo-info "Configuring sudo for fingerprint authentication..." + sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/sudo + fi + + # Configure polkit + if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_fprintd.so' /etc/pam.d/polkit-1; then + omarchy-echo-info "Configuring polkit for fingerprint authentication..." + sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/polkit-1 + elif [[ ! -f /etc/pam.d/polkit-1 ]]; then + omarchy-echo-info "Creating polkit configuration with fingerprint authentication..." + sudo tee /etc/pam.d/polkit-1 >/dev/null <<'EOF' +auth sufficient pam_fprintd.so +auth required pam_unix.so + +account required pam_unix.so +password required pam_unix.so +session required pam_unix.so +EOF + fi +} + +add_hyprlock_fingerprint_icon() { + omarchy-echo-info "Adding fingerprint icon to hyprlock placeholder text..." + sed -i 's/placeholder_text = .*/placeholder_text = Enter Password 󰈷 <\/span>/' ~/.config/hypr/hyprlock.conf + sed -i 's/fingerprint:enabled = .*/fingerprint:enabled = true/' ~/.config/hypr/hyprlock.conf +} + +omarchy-echo-success "Setting up fingerprint scanner for authentication.\n" + +# Install required packages +omarchy-echo-info "Installing required packages..." + +# libfprint-git provides+conflicts libfprint; pacman -S --noconfirm +# defaults the conflict prompt to N and aborts. Pre-remove libfprint +# with -Rdd so the install goes silent. -Rdd (not omarchy-pkg-drop's +# -Rns) is required because fprintd requires libfprint; the dep is +# re-satisfied immediately by libfprint-git's provides=libfprint. +if omarchy-pkg-present libfprint; then + sudo pacman -Rdd --noconfirm libfprint +fi + +omarchy-pkg-add libfprint-git fprintd usbutils + +if ! check_fingerprint_hardware; then + exit 1 +fi + +# Configure PAM +setup_pam_config + +# Add fingerprint icon to hyprlock placeholder text +add_hyprlock_fingerprint_icon + +# Enroll first fingerprint +omarchy-echo-success "\nLet's setup your right index finger as the first fingerprint." +omarchy-echo-info "Keep moving the finger around on sensor until the process completes.\n" + +if sudo fprintd-enroll "$USER"; then + omarchy-echo-success "\nFingerprint enrolled successfully!" + + # Verify + omarchy-echo-info "\nNow let's verify that it's working correctly.\n" + if fprintd-verify; then + omarchy-echo-success "\nPerfect! Fingerprint authentication is now configured." + omarchy-echo-info "You can use your fingerprint for sudo, polkit, and lock screen (Super + Escape)." + else + omarchy-echo-failure "\nVerification failed. You may want to try enrolling again." + fi +else + omarchy-echo-failure "\nEnrollment failed. Please try again." + exit 1 +fi