v0.3.2 — Touch ID sensor presence detection

Minor release. Adds two columns to the touchid_system_config table for reliably detecting whether a Mac has a usable Touch ID sensor — built-in or an attached accessory.

What's new

• touchid_builtin — 1 iff the Mac has a built-in Touch ID sensor (laptops), via AppleBiometricSensor IOKit nodes.
• touchid_sensor_present — 1 iff a built-in sensor or an attached external Touch ID sensor (e.g. a Magic Keyboard with Touch ID) is present. The external sensor is detected via the AppleMesaAccessory capability class, which is name-, transport-, and localization-independent (works wired or Bluetooth; an old/plain Magic Keyboard correctly reads as no sensor).

Why

touchid_compatible / touchid_enabled are 1 on every Apple Silicon Mac because the Secure Enclave is on-die — they cannot distinguish a Mac with a real fingerprint sensor from a keyboard-less Mac mini/Studio. Use touchid_sensor_present to gate a Touch ID enrollment policy so sensor-less desktops are treated as not-applicable instead of failing. See the README for the full rationale and the connection-dependent caveat.

Verified across MacBook (built-in), Mac Studio + Touch ID keyboard (USB and Bluetooth), keyboard-less Mac mini/Studio, and an iMac with a disconnected Touch ID keyboard. See #2.

Assets

• mac_enclosure_color.ext — universal (arm64 + amd64)
• touchid.ext — arm64 (Apple Silicon only)

v0.3.1 — release touchid extension binary

Patch release.

The release workflow now builds and uploads the touchid extension, which was missing from v0.3.0 (the workflow only built mac_enclosure_color).

Assets

• mac_enclosure_color.ext — universal (arm64 + amd64)
• touchid.ext — arm64 (Apple Silicon only)

No extension source changed since v0.3.0; this is a CI/packaging fix. The mac_enclosure_color asset is renamed from the generic osquery-extension.ext to mac_enclosure_color.ext.

Touch ID

Merge pull request #1 from CampusTech/touchid-tables

touchid: add touchid_system_config and touchid_user_config tables

v0.2.0 — rules-as-data + Gestalt interface refactor

Internal refactor preparing the codebase for upstream submission to macadmins/osquery-extension. No externally-visible behavior change — same table schema, same color mappings as v0.1.2.

What changed

• Color mapping is now a data table. resolver.go defines an ordered []colorRule (model-forced rules → model-disambiguated codes → universal codes); resolveColor() is now a 10-line first-match-wins loop. Adding a new color/model combination is a one-line table entry instead of a new switch case.
• MobileGestalt access lives behind a Gestalt interface. The cgo call to /usr/lib/libMobileGestalt.dylib is isolated to gestalt_darwin.go and the production type mobileGestalt is the only thing that touches C.* symbols. Tests use a fakeGestalt injected at the call site.
• system_profiler shell-out is now mockable. generate() takes a cmdRunner func type as a dependency; tests pass canned JSON instead of spawning subprocesses.

Test coverage

31 unit tests across 3 files:

• resolver_test.go — 20 cases covering all code × model combinations, model-forced overrides, fallback paths.
• modelname_test.go — 6 cases for system_profiler JSON parsing (happy + malformed + empty).
• table_test.go — 5 cases for the generator (populated row, missing code, system_profiler error, model-forced override, column schema).

Asset

osquery-extension.ext — universal (arm64 + amd64) macOS binary.

v0.1.2 — code 11 Sky Blue back to universal

Reverts the code 11 (Sky Blue) restriction from v0.1.1.

Changes

• Code 11 (Sky Blue) is now universal again — matches the canonical munkireport/ibridge bash script. v0.1.1's restriction to MacBook Air was based on a Python revision that diverged from the bash, which is the more widely-deployed reference.

Asset

osquery-extension.ext — universal (arm64 + amd64) macOS binary.

v0.1.1 — mapping sync with munkireport/ibridge

Syncs the color-code-to-name mapping with the current upstream munkireport/ibridge source.

Changes

• Restrict code 11 (Sky Blue) to MacBook Air only. Previously universal — non-Air devices with code 11 will now report Unknown instead of Sky Blue.
• Add code 12 → Indigo (MacBook Neo)
• Add code 13 → Citrus (MacBook Neo)
• Add code 14 → Blush (MacBook Neo)

Asset

osquery-extension.ext — universal (arm64 + amd64) macOS binary.

v0.1.0 — mac_enclosure_color

Initial release of the mac_enclosure_color osquery extension.

What's in the box

• osquery-extension.ext — universal (arm64 + amd64) macOS binary that exposes a mac_enclosure_color table to osquery, returning the running Mac's enclosure color (Space Black, Midnight, Silver, etc.).

Usage

osqueryi --extension ./osquery-extension.ext
osquery> SELECT * FROM mac_enclosure_color;

Data sources

• MobileGestalt (/usr/lib/libMobileGestalt.dylib) — ProductType + DeviceEnclosureColor
• system_profiler SPHardwareDataType -json — human-readable Model Name

Color-code-to-name mapping mirrors munkireport/ibridge conventions.