Fingerprint reader fails on resume; insufficient resume strategy: proposal fix

[sidneijp]

feat(systemd): add robust resume service for sensor re-initialization

Problem

Fingerprint sensor fails to re-initialize correctly after system suspend/hibernate on modern kernels. The python3-validity service loses its connection to the hardware or enters an inconsistent state, preventing fingerprint authentication upon resume.

Solution

Add a dedicated systemd resume service python3-validity-resume.service that explicitly restarts python3-validity.service and open-fprintd.service when the system wakes up. This ensures a clean state for the driver and the fprintd bridge.

Environment Information

Hardware

• Device: Synaptics, Inc. Metallica MIS Touch Fingerprint Reader
• USB ID: 06cb:009a
• Host System: ThinkPad T480 (Model: <GENERIC_LAPTOP_MODEL>)

Software

• OS: Ubuntu 26.04 LTS (Resolute Raccoon)
• Kernel: 7.0.0-15-generic
• Display Manager: SDDM 0.21.0 (KDE Plasma/Breeze)
• PAM: libpam-modules 1.7.0, libpam-systemd 259.5
• Related Services:
  • open-fprintd (0.7~ppa2)
  • python3-validity (0.15+)

Changes

• Created debian/python3-validity-resume.service to trigger on resume targets.
• Includes a D-Bus 'readiness gate' via ExecStartPost to ensure the driver is responsive before the service is marked finished.

Steps to Reproduce

1. Complete hardware/firmware setup and enroll fingerprints.
2. Verify initial fingerprint authentication works (e.g., sudo or login).
3. Suspend the system (Sleep/Hibernate).
4. Resume the system.
5. Attempt fingerprint authentication.
   • Observed Behavior (without fix): Sensor is unresponsive or returns USBError [Errno 19]. User is forced to use password fallback.

Validation Steps

1. Install the updated package including python3-validity-resume.service- from feat(systemd): add robust resume service for sensor re-initialization #255 .
2. Suspend the system.
3. Resume the system.
4. Verify the python3-validity-resume.service triggered successfully: systemctl status python3-validity-resume.service.
5. Verify fingerprint authentication works at the login/lock screen.
6. Verify sudo <command> correctly prompts for fingerprint authentication (if enabled in PAM).

[sidneijp]

Also tracking relevant discussions in issue #106.

[sidneijp]

I have confirmed a reliable, non-invasive fix by creating a dedicated resume service unit. This approach avoids arbitrary delays and modifications to PAM configuration.

Solution Details

Install the following unit file as /etc/systemd/system/python-validity-resume.service:

[Unit]
Description=Restart python-validity on resume
After=suspend.target hibernate.target hybrid-sleep.target suspend-then-hibernate.target
BindsTo=python3-validity.service

[Service]
Type=oneshot
ExecStart=/usr/bin/systemctl restart python3-validity.service open-fprintd.service
ExecStartPost=/usr/bin/python3 -c "import dbus; bus = dbus.SystemBus(); proxy = bus.get_object('net.reactivated.Fprint', '/net/reactivated/Fprint/Manager'); print('D-Bus ready')"

[Install]
WantedBy=suspend.target hibernate.target hybrid-sleep.target suspend-then-hibernate.target

Why this works:

1. BindsTo: Ensures a strict lifecycle dependency.
2. ExecStartPost: Acts as a D-Bus "readiness gate," ensuring systemd does not report the unit as "finished" until the driver is responsive on the bus. This solves the race condition with login greeters (GDM/SDDM).
3. No PAM/Sleep: Completely avoids brittle timing hacks or system-wide auth modifications.

[sidneijp]

P.S.: Great software, btw! Me and my t480 followed for years - and now using for years - the progress to the day its fingerprint sensor would work in linux.

I'm very thankfull for this project! 🥳

[milad-o]

I can confirm this is a real issue on the 138a:0092 sensor (HP EliteBook x360 1030 G2, Fedora 44) as well. After suspend, the USB connection goes stale and the sensor requires a full re-initialization.

The approach in PR #255 (dedicated resume service that restarts both python3-validity and open-fprintd) works well. I'm using the same pattern:

[Unit]
Description=Restart python-validity fingerprint driver on resume
After=suspend.target hibernate.target hybrid-sleep.target suspend-then-hibernate.target

[Service]
Type=oneshot
ExecStart=/usr/bin/systemctl restart python3-validity.service open-fprintd.service
ExecStartPost=/usr/bin/python3 -c "import dbus; bus = dbus.SystemBus(); proxy = bus.get_object('net.reactivated.Fprint', '/net/reactivated/Fprint/Manager'); iface = dbus.Interface(proxy, 'net.reactivated.Fprint.Manager'); devs = iface.GetDevices(); print(f'Ready: {len(devs)} device(s)')"

[Install]
WantedBy=suspend.target hibernate.target hybrid-sleep.target suspend-then-hibernate.target

The D-Bus readiness gate in ExecStartPost is key — without it, SDDM/KDE's lock screen may try to authenticate before the driver is back online.

+1 to merging #255 or a variant of it into the main project.