David Heinemeier HanssonandClaude Opus 5
6ebdfa3824
A Dell XPS 14 with no fingerprint reader was invited to set one up on first run. Its Synaptics webcam bridge, 06cb:0701 "SVP7500" bound to usbio-bridge, matched omarchy-hw-fingerprint on the bare 06cb vendor ID. The vendor list already excludes Elan and STMicro for being multi-purpose, but Synaptics is just as multi-purpose and was left in. Dropping 06cb is not an option: Synaptics and Validity are among the most common real reader vendors, and many of those readers report no product string at all, so the vendor ID is the only signal that finds them. The vendor guess is now qualified instead. libfprint drives every reader it supports from userspace over libusb, so a real reader sits with no kernel driver bound to any of its interfaces, while the bridges, touchpads and cameras that share these vendor IDs all bind one. The guard applies only to the fuzzy vendor-ID path; a device whose product descriptor names it a fingerprint reader is still trusted outright, since that signal is precise enough on its own and should not be lost to a driver that happened to claim the device. The menu entry was a second surface for the same bug. Setup > Security > Fingerprint carried no when clause, unlike the Remove entry beside it, so it appeared on every machine and dead-ended in the setup script's own hardware check. It now gates on the same detector. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017q97Rsk8KwgaPUVq5ArLgM
44 lines
1.6 KiB
Bash
Executable File
44 lines
1.6 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Returns true when a fingerprint reader is present
|
|
# omarchy:hidden=true
|
|
|
|
# Detect straight from sysfs so this works before fprintd/usbutils are
|
|
# installed (the fingerprint setup pulls those in). USB vendor IDs listed here
|
|
# ship fingerprint readers; multi-purpose vendors (e.g. Elan/STMicro, which
|
|
# also make USB touchscreens) are left out to avoid nagging laptops with no
|
|
# reader — those still match on the product string below when present.
|
|
fingerprint_vendors=" 27c6 138a 06cb 08ff 1c7a 147e "
|
|
|
|
# libfprint drives every reader it supports from userspace over libusb, so a
|
|
# real reader sits there with no kernel driver bound to any of its interfaces.
|
|
# The other things these vendors build — Synaptics webcam bridges (usbio-bridge
|
|
# on the Dell XPS 14), touchpads and touchscreens (usbhid), cameras (uvcvideo)
|
|
# — all bind one. Only the vendor-ID guess needs this; a device that names
|
|
# itself a fingerprint reader is trusted outright.
|
|
has_kernel_driver() {
|
|
local intf
|
|
for intf in "$1"/*:*; do
|
|
[[ -e $intf/driver ]] && return 0
|
|
done
|
|
return 1
|
|
}
|
|
|
|
for dev in /sys/bus/usb/devices/*; do
|
|
# The device's own product descriptor usually names it, e.g. "Goodix
|
|
# Fingerprint USB Device" — driver-independent and vendor-agnostic.
|
|
if [[ -r $dev/product ]]; then
|
|
product=$(<"$dev/product")
|
|
product=${product,,}
|
|
[[ $product == *fingerprint* || $product == *biometric* ]] && exit 0
|
|
fi
|
|
|
|
if [[ -r $dev/idVendor ]]; then
|
|
vendor=$(<"$dev/idVendor")
|
|
[[ $fingerprint_vendors == *" $vendor "* ]] &&
|
|
! has_kernel_driver "$dev" && exit 0
|
|
fi
|
|
done
|
|
|
|
exit 1
|