From e2bf0daaa8acc32d076938443d6d624fc3cf99ca Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@hey.com>
Date: Thu, 23 Jul 2026 14:03:19 -0700
Subject: [PATCH] Invite fingerprint setup on first run when a reader is
 present

Add a first-run notification, alongside the keybindings/Wi-Fi toasts, that
invites anyone with a fingerprint sensor to enable it. Clicking launches
omarchy-setup-security-fingerprint in a floating terminal.

Detection lives in a new omarchy-hw-fingerprint helper that reads sysfs
(device product descriptor plus a fingerprint-vendor allowlist), so it
works before fprintd/usbutils are installed and without nagging machines
that have no reader. The setup script reuses the same helper as an early
gate, bailing before installing any packages when no reader is found
(replacing the old post-install fprintd-list probe).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 bin/omarchy-first-run                  |  3 +++
 bin/omarchy-hw-fingerprint             | 28 ++++++++++++++++++++++++++
 bin/omarchy-setup-security-fingerprint | 22 ++++++--------------
 install/user/first-run/fingerprint.sh  |  9 +++++++++
 4 files changed, 46 insertions(+), 16 deletions(-)
 create mode 100755 bin/omarchy-hw-fingerprint
 create mode 100644 install/user/first-run/fingerprint.sh

diff --git a/bin/omarchy-first-run b/bin/omarchy-first-run
index b95849d3..40692c39 100755
--- a/bin/omarchy-first-run
+++ b/bin/omarchy-first-run
@@ -123,6 +123,9 @@ run_first_run_step "show welcome notification" \
 sleep 0.3
 run_first_run_step "show Wi-Fi/update notifications" \
   bash "$OMARCHY_PATH/install/user/first-run/wifi.sh"
+sleep 0.3
+run_first_run_step "invite fingerprint setup" \
+  bash "$OMARCHY_PATH/install/user/first-run/fingerprint.sh"
 
 if (( first_run_failed == 0 )); then
   omarchy-done mark "$FIRST_RUN_DONE"
diff --git a/bin/omarchy-hw-fingerprint b/bin/omarchy-hw-fingerprint
new file mode 100755
index 00000000..9984e9d5
--- /dev/null
+++ b/bin/omarchy-hw-fingerprint
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# omarchy:summary=Returns true when a fingerprint reader is present
+# omarchy:hidden=true
+
+# Detect straight from sysfs so this works before fprintd/usbutils are
+# installed (the fingerprint setup pulls those in). USB vendor IDs listed here
+# ship fingerprint readers; multi-purpose vendors (e.g. Elan/STMicro, which
+# also make USB touchscreens) are left out to avoid nagging laptops with no
+# reader — those still match on the product string below when present.
+fingerprint_vendors=" 27c6 138a 06cb 08ff 1c7a 147e "
+
+for dev in /sys/bus/usb/devices/*; do
+  # The device's own product descriptor usually names it, e.g. "Goodix
+  # Fingerprint USB Device" — driver-independent and vendor-agnostic.
+  if [[ -r $dev/product ]]; then
+    product=$(<"$dev/product")
+    product=${product,,}
+    [[ $product == *fingerprint* || $product == *biometric* ]] && exit 0
+  fi
+
+  if [[ -r $dev/idVendor ]]; then
+    vendor=$(<"$dev/idVendor")
+    [[ $fingerprint_vendors == *" $vendor "* ]] && exit 0
+  fi
+done
+
+exit 1
diff --git a/bin/omarchy-setup-security-fingerprint b/bin/omarchy-setup-security-fingerprint
index f56bf805..d02558dc 100755
--- a/bin/omarchy-setup-security-fingerprint
+++ b/bin/omarchy-setup-security-fingerprint
@@ -6,18 +6,6 @@
 set -e
 
 
-check_fingerprint_hardware() {
-  # Get fingerprint devices for the user
-  devices=$(fprintd-list "$USER" 2>/dev/null)
-
-  # Exit if no devices found
-  if [[ -z $devices ]]; then
-    echo -e "\e[31m\nNo fingerprint sensor detected.\e[0m"
-    return 1
-  fi
-  return 0
-}
-
 setup_pam_config() {
   # Configure sudo
   if ! grep -q pam_fprintd.so /etc/pam.d/sudo; then
@@ -72,6 +60,12 @@ EOF
 
 echo -e "\e[32mSetting up fingerprint scanner for authentication.\n\e[0m"
 
+# Bail before installing anything if there's no reader to talk to.
+if ! omarchy-hw-fingerprint; then
+  echo -e "\e[31mNo fingerprint sensor detected.\e[0m"
+  exit 1
+fi
+
 # Install required packages
 echo "Installing required packages..."
 
@@ -86,10 +80,6 @@ fi
 
 omarchy-pkg-add libfprint-git fprintd usbutils
 
-if ! check_fingerprint_hardware; then
-  exit 1
-fi
-
 # Configure PAM
 setup_pam_config
 
diff --git a/install/user/first-run/fingerprint.sh b/install/user/first-run/fingerprint.sh
new file mode 100644
index 00000000..7f5f5807
--- /dev/null
+++ b/install/user/first-run/fingerprint.sh
@@ -0,0 +1,9 @@
+(
+  # Only invite when there's a reader to use and it isn't set up yet (the lock
+  # PAM file is the last thing the setup writes on success).
+  if omarchy-hw-fingerprint && [[ ! -f /etc/pam.d/omarchy-lock-fingerprint ]]; then
+    if [[ -n $(omarchy-notification-send -u critical -g 󰈷 "Setup Fingerprint" "Click to unlock login, sudo, and the lock screen with your fingerprint." -a) ]]; then
+      omarchy-launch-floating-terminal-with-presentation omarchy-setup-security-fingerprint
+    fi
+  fi
+) >/dev/null 2>&1 &