David Heinemeier HanssonandClaude Opus 4.8
540e411edf
Bring the fingerprint affordance to the Quickshell lock screen and polkit dialog, matching what hyprlock did on master. Lock screen: render the md-fingerprint glyph inside the password field's right edge when a sensor is enrolled, reserving space so long passwords never run under it. Polkit dialog: show one method at a time. When a sensor is enrolled and the reader is reachable, the dialog is just the centered fingerprint icon (square card); the moment PAM asks for a password it switches to the password field. Detects pam_fprintd anywhere in the auth stack now that a gate can precede it. Lid awareness: a closed lid means the reader is unreachable, so both surfaces fall back to the password. polkit gets a pam_exec clamshell gate (auth [success=1 default=ignore] before pam_fprintd) so a shut lid drops straight to the password prompt instead of blocking on the reader for the pam_fprintd timeout; the lock screen hides the icon and skips scanning. The gate points at the fixed /usr/bin path the package always provides so it survives switching between package installs and dev-link. A migration adds the gate for existing fingerprint setups. New helper omarchy-hw-laptop-closed (pure lid state); omarchy-hw-clamshell now composes it with the external-monitor check. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
22 lines
1.0 KiB
Bash
22 lines
1.0 KiB
Bash
echo "Gate polkit fingerprint auth behind the lid state (password when the lid is shut)"
|
|
|
|
# Existing fingerprint setups have pam_fprintd first in /etc/pam.d/polkit-1 but
|
|
# no lid gate, so a closed-lid pkexec would block on the unreachable reader for
|
|
# the full pam_fprintd timeout before offering the password. Insert a pam_exec
|
|
# gate before pam_fprintd that skips fingerprint while the lid is closed. New
|
|
# setups already get this from omarchy-setup-security-fingerprint.
|
|
#
|
|
# The gate points at the fixed /usr/bin path the omarchy package always
|
|
# provides, so it keeps working across package installs and dev-link (which
|
|
# overlays $OMARCHY_PATH but leaves /usr/bin untouched). pam_exec needs a
|
|
# literal absolute path — it does not expand env vars.
|
|
|
|
polkit_pam="/etc/pam.d/polkit-1"
|
|
gate="auth [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed"
|
|
|
|
if [[ -f $polkit_pam ]] &&
|
|
grep -q 'pam_fprintd\.so' "$polkit_pam" &&
|
|
! grep -q 'omarchy-hw-laptop-closed' "$polkit_pam"; then
|
|
sudo sed -i "/pam_fprintd\.so/i $gate" "$polkit_pam"
|
|
fi
|