feat(fprint): update fprint to new device

host/ThinkPad/modules/fingerprint.nix

@@ -1,20 +1,234 @@
-{ config, ... }: {
-  services.fprintd.enable = true;
+{ lib, pkgs, ... }: let
+  pythonValidityPatch = pkgs.writeText "python-validity-python-3.14.patch" ''
+    diff --git a/validitysensor/flash.py b/validitysensor/flash.py
+    index d37f15a..be3d4a1 100644
+    --- a/validitysensor/flash.py
+    +++ b/validitysensor/flash.py
+    @@ -34,6 +34,10 @@ def get_flash_info():
+         rsp = tls.cmd(unhex('3e'))
+         assert_status(rsp)
+         rsp = rsp[2:]
+    +    if len(rsp) < 0xe:
+    +        # An uninitialised 06cb:009a returns only the success status word.
+    +        # Let init_flash() format it instead of failing in struct.unpack().
+    +        return FlashInfo(None, 0, 0, 0, 0, [])
+         hdr = rsp[:0xe]
+         rsp = rsp[0xe:]
+         jid0, jid1, blocks, unknown0, blocksize, unknown1, pcnt = unpack('<HHHHHHH', hdr)
+    diff --git a/validitysensor/init.py b/validitysensor/init.py
+    index 18890c5..710668c 100644
+    --- a/validitysensor/init.py
+    +++ b/validitysensor/init.py
+    @@ -25,8 +25,8 @@ def close():
 
-  security.pam.services = {
-    sudo.fprintAuth = true;
-    login.fprintAuth = false;
-    hyprlock.fprintAuth = false;
-  };
-
-  security.polkit.extraConfig = ''
-    polkit.addRule(function(action, subject) {
-      if (action.id == "net.reactivated.fprint.device.enroll" &&
-          subject.isInGroup("fprint")) {
-        return polkit.Result.YES;
-      }
-    });
+     def open_common():
+         init_data_dir()
+    -    init_flash()
+         usb.send_init()
+    +    init_flash()
+         tls.parse_tls_flash(read_tls_flash())
+         tls.open()
+         upload_fwext()
+    diff --git a/validitysensor/usb.py b/validitysensor/usb.py
+    index 9db2b07..353b2c7 100644
+    --- a/validitysensor/usb.py
+    +++ b/validitysensor/usb.py
+    @@ -1,6 +1,7 @@
+     import errno
+     import logging
+    +import time
+     import typing
+     from binascii import hexlify, unhexlify
+     from enum import Enum
+     from struct import unpack
+    @@ -68,22 +69,32 @@ class Usb:
+         def close(self):
+             if self.dev is not None:
+                 try:
+                     self.dev.reset()
+                     self.dev = None
+                 except:
+                     pass
+    ${" "}
+         def usb_dev(self):
+             return self.dev
+    ${" "}
+    +    def cmd_retry_busy(self, command: bytes):
+    +        # Metallica sensors can report 0x0104 for a few seconds after wake-up.
+    +        for _ in range(20):
+    +            rsp = self.cmd(command)
+    +            status, = unpack('<H', rsp[:2])
+    +            if status != 0x0104:
+    +                return rsp
+    +            time.sleep(0.5)
+    +        return rsp
+    +
+         def send_init(self):
+             # self.dev.set_configuration()
+    ${" "}
+             # TODO analyse responses, detect hardware type
+    -        assert_status(self.cmd(unhexlify('01')))  # RomInfo.get()
+    +        assert_status(self.cmd_retry_busy(unhexlify('01')))  # RomInfo.get()
+             assert_status(self.cmd(unhexlify('19')))
+    ${" "}
+             # 43 -- get partition header(?) (02 -- fwext partition)
+             # c28c745a in response is a FwextBuildtime = 0x5A748CC2
+    -        rsp = self.cmd(unhexlify('4302'))  # get_fw_info()
+    +        rsp = self.cmd_retry_busy(unhexlify('4302'))  # get_fw_info()
+    ${" "}
   '';
 
-  users.users.kirill.extraGroups = [ "fprint" ];
+  python-validity = pkgs.python3Packages.buildPythonApplication rec {
+    pname = "python-validity";
+    version = "0.15-unstable-2020-12-14";
+    pyproject = true;
+
+    src = pkgs.fetchFromGitHub {
+      owner = "uunicorn";
+      repo = "python-validity";
+      rev = "a6bbc21dce7b8b3c3cd92378a0b2579a2fb45920";
+      hash = "sha256-RflX7e6nd11pSg8mh3mjZiVGNUSdox/SKXHR4W+PhMs=";
+    };
+
+    postPatch = ''
+      ${lib.getExe pkgs.gitMinimal} apply ${pythonValidityPatch}
+    '';
+
+    build-system = [ pkgs.python3Packages.setuptools ];
+
+    dependencies = with pkgs.python3Packages; [
+      cryptography
+      dbus-python
+      pygobject3
+      pyusb
+      pyyaml
+    ];
+
+    nativeBuildInputs = [ pkgs.makeWrapper ];
+
+    postInstall = ''
+      install -Dm755 dbus_service/dbus-service \
+        "$out/lib/python-validity/dbus-service"
+      install -Dm644 dbus_service/io.github.uunicorn.Fprint.conf \
+        "$out/share/dbus-1/system.d/io.github.uunicorn.Fprint.conf"
+
+      install -Dm755 dbus_service/dbus-service \
+        "$out/bin/python-validity-service"
+      install -Dm755 scripts/factory-reset.py \
+        "$out/bin/validity-factory-reset"
+
+      install -d "$out/share/python-validity/playground"
+      install -m755 \
+        scripts/dbus-cmd.py \
+        scripts/lsdbus.py \
+        scripts/factory-reset.py \
+        scripts/prototype.py \
+        "$out/share/python-validity/playground/"
+    '';
+
+    postFixup = ''
+      wrapProgram "$out/bin/validity-sensors-firmware" \
+        --prefix PATH : ${lib.makeBinPath [
+          pkgs.findutils
+          pkgs.innoextract
+        ]}
+    '';
+
+    # Upstream does not have an automated test suite.
+    doCheck = false;
+
+    meta = {
+      description = "Userspace driver for Validity and Synaptics fingerprint sensors";
+      homepage = "https://github.com/uunicorn/python-validity";
+      license = lib.licenses.mit;
+      platforms = lib.platforms.linux;
+    };
+  };
+
+  fprintd-clients = pkgs.runCommand "fprintd-clients" { } ''
+    mkdir -p "$out/bin"
+    for client in fprintd-delete fprintd-enroll fprintd-list fprintd-verify; do
+      ln -s "${pkgs.fprintd}/bin/$client" "$out/bin/$client"
+    done
+  '';
+
+  sleepTargets = [
+    "suspend.target"
+    "hibernate.target"
+    "hybrid-sleep.target"
+    "suspend-then-hibernate.target"
+  ];
+in {
+  services = {
+    # The 06cb:009a sensor is driven by python-validity through open-fprintd;
+    # stock fprintd/libfprint cannot handle it.
+    fprintd.enable = false;
+
+    dbus.packages = [
+      pkgs.open-fprintd
+      python-validity
+    ];
+  };
+
+  security.pam.services = {
+    greetd.fprintAuth = true;
+    polkit-1.fprintAuth = true;
+    sudo.fprintAuth = true;
+    login.fprintAuth = true;
+    hyprlock.fprintAuth = true;
+  };
+
+  systemd.services = {
+    open-fprintd = {
+      description = "Open FPrint daemon";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "dbus";
+        BusName = "net.reactivated.Fprint";
+        ExecStart = "${pkgs.open-fprintd}/lib/open-fprintd/open-fprintd";
+        Restart = "on-failure";
+      };
+    };
+
+    python3-validity = {
+      description = "python-validity fingerprint sensor backend";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "open-fprintd.service" ];
+      wants = [ "open-fprintd.service" ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${python-validity}/bin/python-validity-service";
+        Restart = "always";
+        RestartSec = 2;
+        RuntimeDirectory = "python-validity";
+        RuntimeDirectoryMode = "0700";
+        RuntimeDirectoryPreserve = "yes";
+      };
+    };
+
+    open-fprintd-suspend = {
+      description = "Suspend open-fprintd backends";
+      wantedBy = sleepTargets;
+      before = sleepTargets;
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.open-fprintd}/lib/open-fprintd/suspend.py";
+      };
+    };
+
+    open-fprintd-resume = {
+      description = "Resume open-fprintd backends";
+      wantedBy = sleepTargets;
+      after = sleepTargets;
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.open-fprintd}/lib/open-fprintd/resume.py";
+      };
+    };
+  };
+
+  environment.systemPackages = [
+    fprintd-clients
+    python-validity
+  ];
 }

host/ThinkPad/modules/thinkpad.nix

@@ -13,7 +13,6 @@
   services = {
     fwupd.enable = true;
     thermald.enable = true;
-    fprintd.enable = true;
 
     logind.settings.Login = {
       HandleLidSwitch = "suspend-then-hibernate";