yeold/vfs7500
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
7 commits 1 branch 0 tags 52 KiB
  • Shell 100%
Find a file
Exact
Isac 93a770e853 Fix pair stage: sudo's secure_path excludes /snap/bin 
sudo validity-sensors-tools.initializer failed with "command not found"
even though it resolves fine unprivileged — sudo replaces PATH with its
own secure_path, which doesn't include /snap/bin. Use the full path.

Verified end to end on real hardware: pairing succeeded, fprintd now
lists the device as "Validity VFS0090" via the TOD driver built earlier.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MagAaDKo9P2uBWh6d8i5HJ
2026-09-10 21:40:27 +02:00
libfprint-tod-vfs0090@252c984957 Scaffold VFS7500 fingerprint sensor setup 2026-09-10 20:33:27 +02:00
python-validity@5ba2094f8c Scaffold VFS7500 fingerprint sensor setup 2026-09-10 20:33:27 +02:00
upstream-libfprint@6f9479c3d5 Scaffold VFS7500 fingerprint sensor setup 2026-09-10 20:33:27 +02:00
.gitignore Scaffold VFS7500 fingerprint sensor setup 2026-09-10 20:33:27 +02:00
.gitmodules Scaffold VFS7500 fingerprint sensor setup 2026-09-10 20:33:27 +02:00
README.md Scaffold VFS7500 fingerprint sensor setup 2026-09-10 20:33:27 +02:00
setup.sh Fix pair stage: sudo's secure_path excludes /snap/bin 2026-09-10 21:40:27 +02:00

README.md

vfs7500

Getting the Validity 138a:0090 (VFS7500) fingerprint sensor in this ThinkPad X1 Carbon 4th Gen working under Linux (openSUSE Tumbleweed).

This device isn't supported by stock libfprint. Nobody needs to write a new driver for it — 3v1n0/python-validity and 3v1n0/libfprint-tod-vfs0090 already implement the encrypted pairing protocol and the libfprint TOD (third-party driver) module. Those are vendored here as git submodules. upstream-libfprint is the real upstream libfprint source, used only to get the private TOD headers needed to build the driver module — openSUSE patches these in downstream, which is why we build against openSUSE's own source package rather than vanilla upstream (see stage 2 below).

Run git submodule update --init after cloning.

How it works

  • Pairing: the sensor ships unpaired. python-validity's pair.py negotiates a TLS session between this host and the sensor, using firmware extracted from Lenovo's own Windows driver. Without pairing the sensor won't talk to anything.
  • Runtime driver: libfprint-tod-vfs0090 builds a .so that libfprint's TOD loader (libfprint-2-tod.so.1, already packaged in openSUSE) loads at runtime. It does image-based matching on the host (not on-chip) using libfprint's normal minutiae comparison.
  • fprintd/PAM then talks to it exactly like any other libfprint device.

Setup

Run the stages in setup.sh in order, reading each one before running it — stages 1-2 are routine package/build steps, stage 3 pairs the physical sensor (flashes firmware onto it) and needs a file you fetch yourself:

./setup.sh deps        # build/runtime dependencies
./setup.sh build-driver # build the TOD driver module against matching headers

Then, manually:

  1. Download the Synaptics Metallica MOC Touch Fingerprint Reader Driver for the X1 Carbon 4th Gen (type 20FB/20FC) from Lenovo's support page: https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x1-carbon-type-20fb-20fc/downloads (search "fingerprint"). Do not commit this file — it's proprietary and it's already gitignored.
  2. ./setup.sh pair /path/to/downloaded-installer.exe

Then enroll fingerprints:

for finger in {left,right}-{thumb,{index,middle,ring,little}-finger}; do
  fprintd-enroll -f "$finger" "$USER"
done

And optionally wire it into login/sudo:

sudo pam-config -a --fprintd

Notes

  • Match-on-host, not match-on-chip (that's only supported on 138a:0097).
  • Matching sensitivity is tuned by bz3_threshold in vfs0090.c (currently 12 upstream) — raise it if false-accepts happen, lower it if enrollment keeps rejecting legitimate re-scans.