Touch ID enrolled from Linux on a wiped T2 Mac, after nine years

macintog@macintogdev

This is a pretty big deal: announcing a proof of concept of the full Touch ID lifecycle on a *wiped* T2 Mac running Omarchy. Adding new fingerprints from Linux is now solved for the first time since Apple released this hardware nine years ago. The macOS dependency in all existing implementations is a thing of the past.

The work demonstrates creating the account identity from Linux, enrolling multiple fingerprints, saving and restoring their state across reboots, matching, and deleting an individual fingerprint. It builds on the GPL-licensed t2-touchid-linux, with @0xBOYD's T1Bridge informing parts of the lifecycle design.

I’m sharing the implementation alongside detailed research into the T2 Secure Enclave: its internal services, credential handling, persistent storage, and biometric protocols. There’s also an MIT-licensed t2touch-mini with original reference code and research documentation for people adapting the findings to other projects, particularly the more mature T1Bridge where this functionality remains unsolved.

My goal is to hand this work to the community. I’m not taking on ongoing maintenance, but I want others to have enough code and documentation to carry it forward, now that this breakthrough exists. This wouldn't have been possible without the deep LLM support in Omarchy and GPT-Daybreak-Blue. Codex ran almost entirely on its own over several weeks, reverse-engineering and debugging this across hundreds of reboots and 3.2B tokens.

I actually bought a second $200 Codex seat the day before they slammed the door so I could get this finished and shipped after a couple weeks of chipping away. Full T1 and T2 Mac support is now entirely within the community's reach. What an exciting time to have electricity and an internet connection.

Full PoC: t.co/9WyypRrCXC (GPL)
Docs only: t.co/dvv9yUg5Ph (MIT)