GitHub - standardagents/t1bridge: Linux support for Apple T1 hardware

Open-source Linux support for Apple's T1 iBridge. The goal is to support every function directly handled by the T1, including its display, camera, Touch ID, sensors, and device lifecycle—not only fingerprint authentication. Current coverage and remaining work are listed below.

Install the official signed packages from linux.standardagents.ai. No source build, GitHub authentication, or download token is required.

Supported hardware

MacBookPro13,3 success is confirmed on two machines. A MacBookPro13,2 tester confirmed Touch Bar controls, two-finger enrollment/verification, reboot persistence and configured PAM consumers on official v0.1.1 packages. Camera streaming and system sleep/wake were not tested there. A MacBookPro14,3 tester confirmed enrollment after allowing xART on the private T1 link and a full shutdown/power-on, without replacing the packaged build or resetting saved data. This does not establish all functions on that model. Automatic EFI discovery still has an open multi-ESP failure; explicit same-machine backup import works for those reporters. A MacBookPro14,2 tester reported Touch Bar, enrollment/verification, sudo and lock authentication on v0.1.1, with controls persisting after reboot. Camera capture was not tested; lid reopening left a black screen, and a sustained keybag relay restart loop remains under investigation. Reports from testers are welcome through GitHub issues; include your model, kernel/package versions and which functions work or fail, but no serial numbers or machine-specific EFI data.

T2 Macs, Apple Silicon, and models without a Touch Bar are outside this project's hardware scope. Currently installable official packages are for x86_64 Arch Linux and Arch-based distributions, including Omarchy, only (systemd 256 or newer). There are no official Ubuntu, Mint, Debian, or Fedora packages yet. The source is desktop-neutral; supporting another distribution requires packaging and validation, not installing these Arch packages there. See supported versions.

T1 function support

🟢 Available · 🟡 Partial / integration needed · 🔴 Not working or not implemented

These statuses describe current coverage, not a claim that every model and kernel combination has been tested. Missing T1 functionality remains in scope.

Wi-Fi, Bluetooth, speakers, the internal keyboard/trackpad, GPU switching and host-wide power management are separate from T1Bridge. Recovery of the T1's own functions during host sleep/wake is in scope; fixing unrelated GPU, firmware, or platform suspend problems is not. This is not a complete MacBook hardware-enablement bundle.

Try a custom Touch Bar UI

The separate Standard Agents touchbar-doom package is an optional demo for Omarchy users who want to try a nonstandard Touch Bar UI. It runs playable Doom with a panoramic game view, labeled HUD, weapon artwork, and a mute toggle through T1Bridge's unprivileged renderer interface.

Follow its installation instructions to install the package and supply the Doom shareware game data. Open Touch Bar Doom from the application launcher or run touchbar-doom launch. Tap QUIT at the far left, or press Fn, to restore the previous renderer.

It is not bundled with T1Bridge or installed by default. Installing it does not change the active renderer; launching it is an explicit user action. Gameplay captures the keyboard until Quit or Fn releases it. A working T1Bridge Touch Bar is required first; the demo does not install hardware drivers.

Install official packages

Keep a working password login and back up your disk.

1. Trust the signing key

Run from your normal account:

key_dir=$(mktemp -d)
curl -fSLo "$key_dir/t1bridge-signing-key.asc" \
  https://linux.standardagents.ai/arch/standardagents/x86_64/t1bridge-signing-key.asc
gpg --show-keys --with-fingerprint "$key_dir/t1bridge-signing-key.asc"

Check that the primary fingerprint is exactly:

35B166F78B063B04DE1E3D913E6C4216EB03D371

Only after it matches:

sudo pacman-key --add "$key_dir/t1bridge-signing-key.asc"
sudo pacman-key --lsign-key 35B166F78B063B04DE1E3D913E6C4216EB03D371

2. Add the repository and install

Add this block once to /etc/pacman.conf, preserving your existing repositories:

[standardagents]
SigLevel = Required DatabaseRequired
Server = https://linux.standardagents.ai/arch/$repo/$arch

Keep $repo and $arch literal in that file. For the standard Arch linux kernel:

sudo pacman -Syu --needed linux-headers t1bridge t1bridge-dkms libfprint-t1bridge fprintd-t1bridge

Use the header package matching your kernel if it is not linux. This performs a normal system upgrade. Confirm DKMS and initramfs/UKI generation succeed before rebooting; do not bypass signature or dependency errors.

omarchy update
sudo pacman -S --needed linux-headers t1bridge t1bridge-dkms libfprint-t1bridge fprintd-t1bridge

The fingerprint packages replace distro libfprint/fprintd system-wide and must stay a matched pair. For Touch Bar/camera-only use, omit those two packages.

3. Enable hardware support

Still from your normal account:

sudo systemd-sysusers /usr/lib/sysusers.d/t1bridge.conf
sudo systemd-tmpfiles --create /usr/lib/tmpfiles.d/t1bridge.conf
sudo usermod -aG t1bridge "$(id -un)"
sudo systemctl daemon-reload
sudo systemctl enable t1-touchbar-hw.service t1-touchid-auth.socket t1bridge-fingerprint.socket

Reboot to load the modules and refresh group membership. Then, in your local graphical session:

systemctl --user daemon-reload
systemctl --user enable --now t1-touchbar.service
sudo t1bridge status

Check each status row. keybag: not-enrolled is normal before first enrollment. The private network and xART services start with the device; do not enable the keybag relay as an unconditional boot service or hot-swap competing T1 drivers.

4. Set up Touch ID

With this Mac's preserved Apple EFI partition attached and the reader idle:

sudo systemctl start t1bridge-import.service
sudo systemctl status t1bridge-import.service --no-pager

For a copied backup instead, see backup import. After successful import, enroll and verify from your normal account in a terminal inside your graphical desktop session, with a working Polkit agent:

fprintd-list "$(id -un)"
fprintd-enroll -f right-index-finger
fprintd-verify -f right-index-finger

An enrollment timeout can mean missing Polkit authorization, even when xART is working. See enrollment troubleshooting before changing firewall rules.

If you already have enrolled fingers, verify an existing one instead of enrolling it again. Choose the correct finger label and repeatedly lift/touch during enrollment. Require enroll-completed and then verify-match.

Enrollment does not automatically enable sudo, Polkit or lock-screen login. Follow safe PAM setup for your distribution, preserving password access and a root recovery shell. Do not blindly run a desktop setup wizard that replaces this matched fingerprint pair.

See manual setup for desktop providers, removal and recovery, and How Touch ID works for startup and authentication diagrams.

Package boundaries

T1Bridge owns T1 hardware support, protected machine-data import and recovery, the fingerprint backend, and the default Touch Bar. Its core does not depend on desktop integration or the separately packaged libfprint/fprintd integration.

Standard fprintd tools provide fingerprint management. A reusable management TUI and a baseline desktop-controls provider are planned as separate optional packages. Distribution integrations own installer preservation, automatic setup, menus, themes, and HUD integration. Custom Touch Bar renderers remain user-selected programs, not bundled presets.

Contributing and security

See contributing for development and bug reports, and security reporting for private vulnerability reports. For import, Touch ID, or Touch Bar failures, see opt-in shareable diagnostics.

Maintained by Andrew Boyd.