Install fprintd-tod with support for Broadcom readers on Debian testing

setup.sh

#!/usr/bin/env sh

####################################################################
###  ____  _____ ____ ___    _    _   _    ___  _   _ _  __   __ ###
### |  _ \| ____| __ )_ _|  / \  | \ | |  / _ \| \ | | | \ \ / / ###
### | | | |  _| |  _ \| |  / _ \ |  \| | | | | |  \| | |  \ V /  ###
### | |_| | |___| |_) | | / ___ \| |\  | | |_| | |\  | |___| |   ###
### |____/|_____|____/___/_/   \_\_| \_|  \___/|_| \_|_____|_|   ###
####################################################################
#######  _   _  ___    _   _ ____  _   _ _   _ _____ _   _  ########
####### | \ | |/ _ \  | | | | __ )| | | | \ | |_   _| | | | ########
####### |  \| | | | | | | | |  _ \| | | |  \| | | | | | | | ########
####### | |\  | |_| | | |_| | |_) | |_| | |\  | | | | |_| | ########
####### |_| \_|\___/   \___/|____/ \___/|_| \_| |_|  \___/  ########
####################################################################

TEMPDIR=$(mktemp -d)

# Install build dependencies
sudo DEBIAN_FRONTEND=noninteractive apt -qq build-dep -y libfprint-2-2

# Clone the closed-source library and firmware
cd "${TEMPDIR}" || exit

git clone --depth=1 --branch ubuntu/latest git://git.launchpad.net/libfprint-2-tod1-broadcom
cd libfprint-2-tod1-broadcom || exit

sudo cp lib/udev/rules.d/60-libfprint-2-device-broadcom.rules /usr/lib/udev/rules.d/60-libfprint-2-device-broadcom.rules
sudo chown -R root:root /usr/lib/udev/rules.d/60-libfprint-2-device-broadcom.rules

sudo mkdir -p /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1
sudo cp usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod-1-broadcom.so /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod-1-broadcom.so
sudo chown -R root:root /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod-1-broadcom.so

sudo cp -r var/lib/fprint/fw /var/lib/fprint/
sudo chown -R root:root /var/lib/fprint/fw

# Clone libfprint, switch to the correct tag, patch and build
# LIBFPRINT_VERSION=$(dpkg-query --showformat='${Version}' --show fprintd | cut -d '-' -f 1)
LIBFPRINT_VERSION=$(dpkg-query --showformat='${Version}' --show libfprint-2-2 | cut -d '-' -f 1 | cut -d ":" -f 2)
cd "${TEMPDIR}" || exit
git clone --branch v${LIBFPRINT_VERSION}+tod1 --depth=1 https://gitlab.freedesktop.org/3v1n0/libfprint.git
cd "${TEMPDIR}"/libfprint || exit
sed -e "/subdir('tests')/s/^/#/g" -i meson.build
sed -e "/subdir('examples')/s/^/#/g" -i meson.build
meson build --prefix=/usr
cd build || exit
meson compile

sudo cp libfprint/tod/libfprint-2-tod.so.1 /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so.1
sudo chown root:root /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so.1
sudo ln -sf /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so.1 /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so

sudo cp libfprint/libfprint-2.so.2 /usr/lib/x86_64-linux-gnu/
sudo chown root:root /usr/lib/x86_64-linux-gnu/libfprint-2.so.2

## Remove file incorrectly copied in a previous revision of this gist
sudo rm -f /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod.so.1

cd "${TEMPDIR}"

# Configure fprintd to not sleep
sudo mkdir -p /etc/systemd/system/fprintd.service.d
cat > override.conf <<EOF
[Service]
ExecStart=
ExecStart=/usr/libexec/fprintd --no-timeout
EOF
sudo cp override.conf /etc/systemd/system/fprintd.service.d/override.conf

sudo udevadm control --reload-rules
sudo systemctl daemon-reload
sudo systemctl restart fprintd

rm -rf "${TEMPDIR}"

Hello, I wonder if someone could assist me - I have completed the script install for the broadcom driver on my Dell Latitude 5430 with Debian 13, and everything appears to be installed and running correctly:

● fprintd.service - Fingerprint Authentication Daemon
     Loaded: loaded (/usr/lib/systemd/system/fprintd.service; static)
    Drop-In: /etc/systemd/system/fprintd.service.d
             └─override.conf
     Active: active (running) since Sun 2026-04-26 16:35:37 BST; 8min ago
 Invocation: 92a235c610844d0fb24dcf82bb99edeb
       Docs: man:fprintd(1)
   Main PID: 3723 (fprintd)
      Tasks: 7 (limit: 18570)
     Memory: 27.8M (peak: 28.8M)
        CPU: 124ms
     CGroup: /system.slice/fprintd.service
             └─3723 /usr/libexec/fprintd --no-timeout

Apr 26 16:35:37 peitho fprintd[3723]: AAI version available for upgrade = 5.15.10.0
Apr 26 16:35:37 peitho fprintd[3723]: SBI version available for upgrade = 229
Apr 26 16:35:37 peitho fprintd[3723]: AAI version matches - it is up do date
Apr 26 16:35:37 peitho fprintd[3723]: SBI version matches - it is up do date
Apr 26 16:35:37 peitho fprintd[3723]: Citadel A0 CID7 Chip Found....
Apr 26 16:35:37 peitho fprintd[3723]: Sensor type  : 16 Sensor firmware version on device: GF5288_GM188WNC_APP_10009 length: 25
Apr 26 16:35:37 peitho fprintd[3723]: Sensor-firmware file signature verification is valid
Apr 26 16:35:37 peitho fprintd[3723]: Sensor firmware version in file(sensor 16): GF5288_GM188WNC_APP_10009 length: 25
Apr 26 16:35:37 peitho fprintd[3723]: Sensor firmware versions in file and on device match
Apr 26 16:35:37 peitho systemd[1]: Started fprintd.service - Fingerprint Authentication Daemon.

However, every time I try to run fprintd-enroll or attempt through the GUI in Settings for my user account, it doesn't 'bring anything up' or confirm reads at all with a response either in the GUI or CLI, as if it's just not doing anything, yet the above says everything is online and working.

Pulling my hair out a bit now so going to go for a cup of tea and think about anything else until someone might have an idea!!
Thanks in advance, Iain.

Just to add after some further testing, if I wait about 1 minute after starting enroll it seems to register my prints, so at least I know the sensor is physically working now, but I get a certain amount through the registration and then it locks up:

Using device /net/reactivated/Fprint/Device/0
Enrolling right-index-finger finger.
Enroll result: enroll-stage-passed
Enroll result: enroll-stage-passed
Enroll result: enroll-stage-passed
Enroll result: enroll-stage-passed
Enroll result: enroll-stage-passed
Enroll result: enroll-stage-passed
Enroll result: enroll-stage-passed
Enroll result: enroll-stage-passed
Enroll result: enroll-stage-passed
Enroll result: enroll-stage-passed
Enroll result: enroll-unknown-error

Checking the service logs it shows ongoing registration at the time but at the point of failure above I get one of two errors:

Apr 27 13:21:55 peitho fprintd[1538]: Device reported an error during enroll: Enrollment failed : Device status = (11)
Apr 27 13:24:55 peitho fprintd[1538]: Device reported an error during enroll: Device disabled to prevent overheating.

I have tried reinstalling the script/driver using ubuntu/jammy as suggested earlier in the thread, but that had the same exact outcome, so I have reinstalled again using the default ubuntu/latest.
I have also tried resetting my TPM chip in the BIOS as a post I found suggested that previously registered Windows Hello data, which is held in the reader's local memory, could be blocking registration in Linux - no dice. :(