From 3d6445b446cbe6046450e3474fc023ee3d2cba87 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Fri, 7 Aug 2026 10:24:00 -0400 Subject: [PATCH] Update Tahoe restore image and automation permissions --- .github/workflows/template-validation.yml | 2 +- scripts/update-tcc-database.sh | 10 +++++++++- templates/vanilla-tahoe.pkr.hcl | 4 ++-- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/template-validation.yml b/.github/workflows/template-validation.yml index eb58199..7358428 100644 --- a/.github/workflows/template-validation.yml +++ b/.github/workflows/template-validation.yml @@ -185,7 +185,7 @@ jobs: git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt build=false - if grep -Eq '^(templates/base\.pkr\.hcl|templates/disable-sip.*\.pkr\.hcl|data/(github_known_hosts|limit\.maxfiles\.plist|setup-info-template\.json|tart-guest-.*\.plist)|scripts/install-actions-runner\.sh|ansible/)' changed-files.txt; then + if grep -Eq '^(templates/base\.pkr\.hcl|templates/disable-sip.*\.pkr\.hcl|data/(github_known_hosts|limit\.maxfiles\.plist|setup-info-template\.json|tart-guest-.*\.plist)|scripts/(install-actions-runner|update-tcc-database)\.sh|ansible/)' changed-files.txt; then build=true fi diff --git a/scripts/update-tcc-database.sh b/scripts/update-tcc-database.sh index 6b99319..7e33bda 100644 --- a/scripts/update-tcc-database.sh +++ b/scripts/update-tcc-database.sh @@ -36,7 +36,15 @@ update_tcc_database() { ('kTCCServiceScreenCapture', 1, '/usr/bin/osascript', 2, 0, 1, NULL, 'UNUSED'), ('kTCCServicePostEvent', 1, '/usr/bin/osascript', 2, 0, 1, NULL, 'UNUSED'), ('kTCCServiceAppleEvents', 1, '/usr/bin/osascript', 2, 0, 1, 0, 'com.apple.systemevents'), - ('kTCCServiceAppleEvents', 1, '/usr/bin/osascript', 2, 0, 1, 0, 'com.apple.Safari'); + ('kTCCServiceAppleEvents', 1, '/usr/bin/osascript', 2, 0, 1, 0, 'com.apple.Safari'), + -- Direct Python invocation + ('kTCCServiceAccessibility', 0, 'org.python.python', 2, 0, 1, NULL, 'UNUSED'), + ('kTCCServiceScreenCapture', 0, 'org.python.python', 2, 0, 1, NULL, 'UNUSED'), + ('kTCCServicePostEvent', 0, 'org.python.python', 2, 0, 1, NULL, 'UNUSED'), + -- Commands invoked through the Tart Guest Agent + ('kTCCServiceAccessibility', 1, '/opt/homebrew/bin/tart-guest-agent', 2, 0, 1, NULL, 'UNUSED'), + ('kTCCServiceScreenCapture', 1, '/opt/homebrew/bin/tart-guest-agent', 2, 0, 1, NULL, 'UNUSED'), + ('kTCCServicePostEvent', 1, '/opt/homebrew/bin/tart-guest-agent', 2, 0, 1, NULL, 'UNUSED'); EOF } diff --git a/templates/vanilla-tahoe.pkr.hcl b/templates/vanilla-tahoe.pkr.hcl index 3d7a17d..c5ba700 100644 --- a/templates/vanilla-tahoe.pkr.hcl +++ b/templates/vanilla-tahoe.pkr.hcl @@ -6,13 +6,13 @@ packer { } ansible = { version = "~> 1" - source = "github.com/hashicorp/ansible" + source = "github.com/hashicorp/ansible" } } } source "tart-cli" "tart" { - from_ipsw = "https://updates.cdn-apple.com/2026SpringFCS/fullrestores/122-58869/DFB1CEEF-5619-4591-9924-E20DB2C8FED0/UniversalMac_26.5_25F71_Restore.ipsw" + from_ipsw = "https://updates.cdn-apple.com/2026SummerFCS/fullrestores/140-83079/25315EF6-AEAB-4588-9774-A3723774C47F/UniversalMac_26.6.1_25G76_Restore.ipsw" vm_name = "tahoe-vanilla" cpu_count = 4 memory_gb = 8