Install fprintd-tod with support for Broadcom readers on Debian testing

setup.sh

#!/usr/bin/env sh

####################################################################
###  ____  _____ ____ ___    _    _   _    ___  _   _ _  __   __ ###
### |  _ \| ____| __ )_ _|  / \  | \ | |  / _ \| \ | | | \ \ / / ###
### | | | |  _| |  _ \| |  / _ \ |  \| | | | | |  \| | |  \ V /  ###
### | |_| | |___| |_) | | / ___ \| |\  | | |_| | |\  | |___| |   ###
### |____/|_____|____/___/_/   \_\_| \_|  \___/|_| \_|_____|_|   ###
####################################################################
#######  _   _  ___    _   _ ____  _   _ _   _ _____ _   _  ########
####### | \ | |/ _ \  | | | | __ )| | | | \ | |_   _| | | | ########
####### |  \| | | | | | | | |  _ \| | | |  \| | | | | | | | ########
####### | |\  | |_| | | |_| | |_) | |_| | |\  | | | | |_| | ########
####### |_| \_|\___/   \___/|____/ \___/|_| \_| |_|  \___/  ########
####################################################################

TEMPDIR=$(mktemp -d)

# Install build dependencies
sudo DEBIAN_FRONTEND=noninteractive apt -qq build-dep -y libfprint-2-2

# Clone the closed-source library and firmware
cd "${TEMPDIR}" || exit

git clone --depth=1 --branch jammy git://git.launchpad.net/libfprint-2-tod1-broadcom
cd libfprint-2-tod1-broadcom || exit

sudo cp lib/udev/rules.d/60-libfprint-2-device-broadcom.rules /usr/lib/udev/rules.d/60-libfprint-2-device-broadcom.rules
sudo chown -R root:root /usr/lib/udev/rules.d/60-libfprint-2-device-broadcom.rules

sudo mkdir -p /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1
sudo cp usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod-1-broadcom.so /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod-1-broadcom.so
sudo chown -R root:root /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod-1-broadcom.so

sudo cp -r var/lib/fprint/fw /var/lib/fprint/
sudo chown -R root:root /var/lib/fprint/fw

# Clone libfprint, switch to the correct tag, patch and build
# LIBFPRINT_VERSION=$(dpkg-query --showformat='${Version}' --show fprintd | cut -d '-' -f 1)
LIBFPRINT_VERSION=$(dpkg-query --showformat='${Version}' --show libfprint-2-2 | cut -d '-' -f 1 | cut -d ":" -f 2)
cd "${TEMPDIR}" || exit
git clone --branch v${LIBFPRINT_VERSION}+tod1 --depth=1 https://gitlab.freedesktop.org/3v1n0/libfprint.git
cd "${TEMPDIR}"/libfprint || exit
sed -e "/subdir('tests')/s/^/#/g" -i meson.build
sed -e "/subdir('examples')/s/^/#/g" -i meson.build
meson build --prefix=/usr
cd build || exit
meson compile

sudo cp libfprint/tod/libfprint-2-tod.so.1 /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so.1
sudo chown root:root /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so.1
sudo ln -sf /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so.1 /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so

sudo cp libfprint/libfprint-2.so.2 /usr/lib/x86_64-linux-gnu/
sudo chown root:root /usr/lib/x86_64-linux-gnu/libfprint-2.so.2

## Remove file incorrectly copied in a previous revision of this gist
sudo rm -f /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod.so.1

cd "${TEMPDIR}"

# Configure fprintd to not sleep
sudo mkdir -p /etc/systemd/system/fprintd.service.d
cat > override.conf <<EOF
[Service]
ExecStart=
ExecStart=/usr/libexec/fprintd --no-timeout
EOF
sudo cp override.conf /etc/systemd/system/fprintd.service.d/override.conf

sudo udevadm control --reload-rules
sudo systemctl daemon-reload
sudo systemctl restart fprintd

rm -rf "${TEMPDIR}"

LIBFPRINT_VERSION=$(dpkg -l | grep libfprint | awk '{print $3}' | cut -d ':' -f 2 | cut -d '-' -f 1)

@vin-c mind sending me the output of that command?
Changed to a different way to get the version - mind testing that and letting me know if it works better or it's still not good?

Ok on debian testing but

sudo cp libfprint/tod/libfprint-2-tod.so.1 /usr/lib/x86_64-linux-gnu/

was necessary for me

not sure why. will double-check. Thanks for the report Indeed, my system had that file there as a leftover from a previous build. Fixed.

Update 05.10.2022

• Manually install libssl1.1 from the Debian Sid repository, as the binary blob is compiled against it
• Fix path of the systemd override file

The filenames for the libssl package doesn't match on lines 50-51

The filenames for the libssl package doesn't match on lines 50-51

@johan-osvaldsson-ingka thanks, fixed.

Ubuntu 22.11
Dell Latitude 3790 2-in-1

When running in Ubuntu, DEBIAN_FRONTEND=noninteractive throws an error and I just removed them.
With a relatively fresh install of 22.11, the apt build-dep command on line 9 was failing with "E: You must put some 'deb-src' URIs in your sources.list"
Resolution:

sudo cp /etc/apt/sources.list /etc/apt/sources.list~
sudo sed -Ei 's/^# deb-src /deb-src /' /etc/apt/sources.list
sudo apt update

I would imagine that there would be some way to correct for this issue by detecting the error or looking at /etc/apt/sources.list.

Anyway, at the end of the day lsusb can see my scanner but I cannot connect it to fprintd...

$ lsusb -v -d 0a5c:5834
Bus 001 Device 004: ID 0a5c:5834 Broadcom Corp. 5880
Device Descriptor:
...

$ fprintd-verify 
Impossible to verify: GDBus.Error:net.reactivated.Fprint.Error.NoSuchDevice: No devices available

@iconoclasthero this script is for debian only.

Ubuntu users should use the built-in driver (dsd/fprintd#3 (comment)), eventually using the "staging" PPA (https://launchpad.net/~andch/+archive/ubuntu/staging-fprint) but keep in mind that the latest release has an issue and a file needs to be manually edited to make it work (read https://bugs.launchpad.net/libfprint-2-tod1-broadcom/+bug/1991794 carefully)

@iconoclasthero this script is for debian only.

Ubuntu users should use the built-in driver (dsd/fprintd#3 (comment)), eventually using the "staging" PPA (https://launchpad.net/~andch/+archive/ubuntu/staging-fprint) but keep in mind that the latest release has an issue and a file needs to be manually edited to make it work (read https://bugs.launchpad.net/libfprint-2-tod1-broadcom/+bug/1991794 carefully)
@giannello
Well...it seems launchpad is broken. :(
W: Failed to fetch https://launchpad.net/~andch/+archive/ubuntu/staging-fprint/dists/kinetic/InRelease Cannot initiate the connection to launchpad.net:443 (2620:2d:4000:1001::8004). - connect (101: Network is unreachable) Cannot initiate the connection to launchpad.net:443 (2620:2d:4000:1001::8003). - connect (101: Network is unreachable) Could not connect to launchpad.net:443 (185.125.189.223), connection timed out Could not connect to launchpad.net:443 (185.125.189.222), connection timed out

As soon as it comes back online I can try to install and then address the fix in comment 21...

Update 15.11.2022

• Use a newer version of the library, compiled against libssl3, and with a newer firmware

@vin-c @johan-osvaldsson-ingka mind giving it a spin?

@giannello I just got around to trying it, and it works as expected! I'm running bookworm/sid Debian 6.1.11-1 and kernel 6.1.0-4-amd64

It did work for me also, except after suspend as reported by others. It required a reboot to get it functioning again...

However with the newest version that I used from the upstream branch:
git clone -b upstream https://git.launchpad.net/libfprint-2-tod1-broadcom
it works flawlessly even after suspend.

Also there is no need for the fix for the wrong firmware version anymore...

Unfortunately, fprintd package has been removed from testing since August, though libfprint-2-2 is still there. I had to add stable repo to sources to install fprintd.

Branch jammy should be used while cloning the closed source binaries to get the ones compiled against libssl3.

build-dep package doesn't exist now, so install the following (extracted from meson.build):

meson gtk-doc-tools libgudev-1.0-dev libnss3-dev libgusb-dev libpixman-1-dev libglib2.0-dev libgirepository1.0-dev libcairo2-dev

I used libfprint version (as it is > fprintd ver on testing) in Line 42 with the following command:

dpkg-query --showformat='${Version}' --show libfprint-2-2 | cut -d '-' -f 1 | cut -d ":" -f 2

Line 46 of this gist should be removed else cannot build (gives installed_tests variable failure).

The last echos are also useless now.

(Made these changes in forked gist here, please update this gist.)

---

After all this, I can enroll using fprintd-enroll and verify using fprintd-verify.

But GDM cannot allow me to login, it has continuous failures and is stuck in a loop so cannot login. Does anyone know a fix for this?

Unfortunately, fprintd package has been removed from testing since August, though libfprint-2-2 is still there. I had to add stable repo to sources to install fprintd.

Fixed, installing from sid

Branch jammy should be used while cloning the closed source binaries to get the ones compiled against libssl3.

Fixed

build-dep package doesn't exist now, so install the following (extracted from meson.build):

That's not a package, it's an apt command. Anyway, fixed by pointing at libfprint-2-2 as it exists in the testing repo

I used libfprint version (as it is > fprintd ver on testing) in Line 42 with the following command:

dpkg-query --showformat='${Version}' --show libfprint-2-2 | cut -d '-' -f 1 | cut -d ":" -f 2

Fixed!

Line 46 of this gist should be removed else cannot build (gives installed_tests variable failure).

Fixed, we can exclude the examples from this build

After all this, I can enroll using fprintd-enroll and verify using fprintd-verify.

But GDM cannot allow me to login, it has continuous failures and is stuck in a loop so cannot login. Does anyone know a fix for this?

Any log/error you can share?

I somehow missed/dropped libpam-fprintd package somewhere in the process (as the library isn't there in testing either).

After installing it, GDM works fine. Sorry for the noise, and thanks for everything! It works nicely and fast!

Hi @giannello Many thanks for this script! I thought I would never get my laptop fingerprint sensor to work in Debian! I was able to register the fingerprints and was able to unlock screen and sudo auths. The setup works in the Debian 12 stable but it's wonky. After reboot, it breaks manytimes randomly. The login screen takes a while to appear(or never forcing to reboot again) and same for the sudo commands. Eventhough we pass the --no-timeout to the binary, it still exits. Trying to run fprintd from console is exiting with some C errors. Shutdown takes a lot of time and I had to press power button to turn off the laptop. When turning on the laptop, I have to reboot 2/3 times for the login screen to appear.

I'm facing this issue now everytime there is a fingerprint auth

sudo[3353]: pam_fprintd(sudo:auth): GetDevices failed: Connection timed out

From Systemd, I saw some errors:

systemd[1]: Starting fprintd.service - Fingerprint Authentication Daemon...
fprintd[1593]: double free or corruption (!prev)
systemd[1]: fprintd.service: Main process exited, code=killed, status=6/ABRT
systemd[1]: fprintd.service: Failed with result 'signal'.
systemd[1]: Failed to start fprintd.service - Fingerprint Authentication Daemon.

systemd[1]: Starting fprintd.service - Fingerprint Authentication Daemon...
systemd[1]: Started fprintd.service - Fingerprint Authentication Daemon.
fprintd[4366]: malloc(): unaligned tcache chunk detected
systemd[1]: fprintd.service: Main process exited, code=killed, status=6/ABRT
systemd[1]: fprintd.service: Failed with result 'signal'.

systemd[1]: Starting fprintd.service - Fingerprint Authentication Daemon...
systemd[1]: Started fprintd.service - Fingerprint Authentication Daemon.
systemd[1]: fprintd.service: Main process exited, code=killed, status=11/SEGV
systemd[1]: fprintd.service: Failed with result 'signal'.

systemd[1]: Starting fprintd.service - Fingerprint Authentication Daemon...
systemd[1]: Started fprintd.service - Fingerprint Authentication Daemon.
systemd[1]: fprintd.service: Main process exited, code=killed, status=7/BUS
systemd[1]: fprintd.service: Failed with result 'signal'.

Restarting the service works for a few minutes and then these issues are back.

@irfanjunaid I have never tried this on Debian 12 - maybe it ships an old version of fprintd that doesn't work very well with the out-of-tree drivers?

Yeah, it seems like it has something to do with the fprintd. Everything works perfectly on Ubuntu Noble and Jammy but not in Debian. I will try testing with different versions of the driver and fprintd. Thank you again for this script @giannello 👍

Looking for running Broadcom Corp. 58200 on Debian 12.
i've Impossible to enroll: GDBus.Error:net.reactivated.Fprint.Error.NoSuchDevice: No devices available
OK on lsusb :Bus 001 Device 005: ID 0a5c:5843 Broadcom Corp. 58200

Thx

Yeah, it seems like it has something to do with the fprintd. Everything works perfectly on Ubuntu Noble and Jammy but not in Debian. I will try testing with different versions of the driver and fprintd. Thank you again for this script @giannello 👍

You were able to get the broadcom 58200 0a5c:5843 working on noble using these commands? I know they need to be changed slightly for ubuntu but I haven't had any luck.

My new laptop does not have this fingerprint reader anymore, so the script is currently unmaintaned.

Could this script be converted to work on Arch? Also, does it work with 0a5c:5834