Feature request: Touch ID / Apple Keychain support for fingerprint unlock

[rohrig]

Hey, cool project and thank you for what you're doing. It would be great if the fingerprint reader worked for unlocking the Apple Keychain. Right now it asks me to insert a key instead of prompting for my fingerprint, and I'd love to see that supported.

[Fail-Safe]

Preface: I am not associated with this project in any official capacity, so my response is strictly my opinion and not meant to give any indication as to the project's actual roadmap.

With that out of the way, as an enthusiast of this project, I love the idea and would love to see this work. However, this is a lot more challenging than it may appear at first.

My understanding is Touch ID isn't a USB fingerprint reader. It is cryptographically paired with the Mac's Secure Enclave. Applications receive an authentication result, not fingerprint data or a device that QEMU can forward to the guest OS. Apple documents this boundary explicitly here.

Not sure if you're familiar with the Asahi Linux project for Mac, but even with the incredible level of bare-metal/native functionality they were able to tap into for the M1 & M2 series hardware, Touch ID is still called out as an unusable function.

Who knows, though. Maybe there's a devil in the details somewhere that someone can find that changes this story. 🙂