Disable SIP in vanilla images

* Push images to public ECR

Related to https://github.com/cirruslabs/tart/discussions/652

* Use the default alias until we get the custom one

.cirrus.yml

@@ -1,47 +1,91 @@
+persistent_worker:
+  labels:
+    name: dev-mini
+
+env:
+  TART_REGISTRY_HOSTNAME: ghcr.io
+  TART_REGISTRY_USERNAME: fkorotkov # GitHub supports only PATs
+  TART_REGISTRY_PASSWORD: ENCRYPTED[!82ed873afdf627284305afef4958c85a8f73127b09978a9786ac521559630ea6c9a5ab6e7f8315abf9ead09b6eff6eae!]
+  AWS_ACCESS_KEY_ID: ENCRYPTED[c187b670a17eead88c1698849376273991d09678efe37ae2f0c9738c27a2422741a71c501ef4b6a4df7bff3eca5213a9]
+  AWS_SECRET_ACCESS_KEY: ENCRYPTED[e456254a53b82e3167f2da23e24c389620cb3f7d47e4e5e7d993813bf9bb18c784d5cb8d88d19632073acc9e1f6096c9]
+
 task:
-  name: "Update Base Image"
-  only_if: $CIRRUS_CRON != ""
-  persistent_worker:
-    labels:
-      name: dev-mini
-  env:
-    TART_REGISTRY_USERNAME: fkorotkov # GitHub supports only PATs
-    TART_REGISTRY_PASSWORD: ENCRYPTED[!82ed873afdf627284305afef4958c85a8f73127b09978a9786ac521559630ea6c9a5ab6e7f8315abf9ead09b6eff6eae!]
+  name: "Update Vanilla Images"
+  only_if: false
+  timeout_in: 3h
   update_script: brew update && brew upgrade
   info_script:
     - tart --version
     - packer --version
   build_script:
-    - packer init templates/base.pkr.hcl
-    - packer build -var-file="variables.pkrvars.hcl" templates/base.pkr.hcl
+    - packer init templates/vanilla-sonoma.pkr.hcl
+    - packer build templates/vanilla-sonoma.pkr.hcl
+  disable_sip_script:
+    - packer build -var vm_name=sonoma-vanilla templates/disable-sip.pkr.hcl
   push_script:
-    - tart push ventura-base ghcr.io/cirruslabs/macos-ventura-base:latest
+    - tart push sonoma-vanilla ghcr.io/cirruslabs/macos-sonoma-vanilla:latest
   always:
     cleanup_script:
-      - tart delete ventura-base
+      - tart delete sonoma-vanilla || true
+
+task:
+  name: "Update Non-Vanilla Images"
+  only_if: $CIRRUS_CRON != ""
+  timeout_in: 3h
+  update_script: brew update && brew upgrade
+  info_script:
+    - tart --version
+    - packer --version
+  env_script:
+    - echo "XCODE_VERSION=$(cat variables.pkrvars.hcl | grep xcode_version | awk '{print $(NF)}' | tr -d '\"')" >> $CIRRUS_ENV
+  build_base_script:
+    - packer init templates/base.pkr.hcl
+    - packer build -var-file="variables.pkrvars.hcl" templates/base.pkr.hcl
+  build_xcode_script:
+    - packer init templates/xcode.pkr.hcl
+    - packer build -var-file="variables.pkrvars.hcl" templates/xcode.pkr.hcl
+  push_base_script:
+    - tart push sonoma-base ghcr.io/cirruslabs/macos-sonoma-base:latest
+  push_xcode_script:
+    - tart push sonoma-xcode:$XCODE_VERSION ghcr.io/cirruslabs/macos-sonoma-xcode:$XCODE_VERSION ghcr.io/cirruslabs/macos-sonoma-xcode:latest
+  push_base_ecr_script:
+    - tart push --chunk-size=5 sonoma-base public.ecr.aws/cirruslabs/macos:sonoma-base
+  push_xcode_ecr_script:
+    - tart push --chunk-size=5 sonoma-xcode:$XCODE_VERSION public.ecr.aws/cirruslabs/macos:sonoma-xcode-$XCODE_VERSION public.ecr.aws/cirruslabs/macos:sonoma-xcode
+  always:
+    cleanup_script:
+      - tart delete sonoma-base || true
+      - tart delete sonoma-xcode:$XCODE_VERSION || true
 
 task:
   name: "Release Xcode $CIRRUS_TAG"
   only_if: $CIRRUS_TAG != ""
-  persistent_worker:
-    labels:
-      name: dev-mini
-  env:
-    TART_REGISTRY_USERNAME: fkorotkov # GitHub supports only PATs
-    TART_REGISTRY_PASSWORD: ENCRYPTED[!82ed873afdf627284305afef4958c85a8f73127b09978a9786ac521559630ea6c9a5ab6e7f8315abf9ead09b6eff6eae!]
+  timeout_in: 3h
   update_script: brew update && brew upgrade
   info_script:
     - tart --version
     - packer --version
   pull_base_script:
-    - tart pull ghcr.io/cirruslabs/macos-ventura-base:latest
-    - tart clone ghcr.io/cirruslabs/macos-ventura-base:latest ventura-base
+    - tart pull ghcr.io/cirruslabs/macos-sonoma-base:latest
+    - tart clone ghcr.io/cirruslabs/macos-sonoma-base:latest sonoma-base
   build_script:
     - packer init templates/xcode.pkr.hcl
     - packer build -var-file="variables.pkrvars.hcl" -var xcode_version="$CIRRUS_TAG" templates/xcode.pkr.hcl
-  push_script:
-    - tart push ventura-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-ventura-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-ventura-xcode:latest
+  push_script: |
+    if [[ $CIRRUS_TAG == *"beta"* ]]
+    then
+      tart push sonoma-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-sonoma-xcode:$CIRRUS_TAG
+    else
+      tart push sonoma-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-sonoma-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-sonoma-xcode:latest
+    fi
+  push_ecr_script: |
+    if [[ $CIRRUS_TAG == *"beta"* ]]
+    then
+      tart push  --chunk-size=5 sonoma-xcode:$CIRRUS_TAG public.ecr.aws/cirruslabs/macos:sonoma-xcode-$CIRRUS_TAG
+    else
+      tart push  --chunk-size=5 sonoma-xcode:$CIRRUS_TAG public.ecr.aws/cirruslabs/macos:sonoma-xcode-$CIRRUS_TAG public.ecr.aws/cirruslabs/macos:sonoma-xcode
+    fi
   always:
     cleanup_script:
-      - tart delete ventura-base || true
-      - tart delete ventura-xcode:$CIRRUS_TAG || true
+      - tart delete sonoma-base || true
+      - tart delete sonoma-xcode:$CIRRUS_TAG || true

README.md

@@ -1,35 +1,25 @@
-## macOS Packer Templates for Cirrus CI
+## macOS Packer Templates for Tart
 
-Repository with Packer templates to build [Tart VMs](https://github.com/cirruslabs/tart) to use with [Cirrus CI](https://cirrus-ci.org/guide/macOS/).
+Repository with Packer templates to build [Tart VMs](https://github.com/cirruslabs/tart) to use with [Cirrus Runners](https://tart.run/integrations/github-actions/) and [Cirrus CI](https://cirrus-ci.org/guide/macOS/).
 
-* `macos-{monterey,ventura}-vanilla` image has nothing pre-installed
-* `macos-{monterey,ventura}-base` image has only `brew` pre-installed
-* `macos-{monterey,ventura}-xcode:N` image is based on `macos-{monterey,ventura}-base` image and has `Xcode N` with [`Flutter`](https://flutter.dev/) pre-installed
+* `macos-{monterey,ventura,sonoma}-vanilla` image has nothing pre-installed
+* `macos-{monterey,ventura,sonoma}-base` image has only `brew` pre-installed
+* `macos-{monterey,ventura,sonoma}-xcode:N` image is based on `macos-{monterey,ventura}-base` image and has `Xcode N` with [`Flutter`](https://flutter.dev/) pre-installed
 
-See a full list of VMs available on Cirrus CI [here](https://github.com/orgs/cirruslabs/packages?tab=packages&q=macos-).
+See a full list of VMs available [here](https://github.com/orgs/cirruslabs/packages?tab=packages&q=macos-).
 
 ## Building Vanilla Image
 
-To build `macos-monterey-vanilla`:
+To build `macos-sonoma-vanilla`:
 
 ```bash
-packer build templates/vanilla-monterey.pkr.hcl
-```
-
-To build `macos-ventura-vanilla`:
-
-```bash
-packer build templates/vanilla-ventura.pkr.hcl
+packer build templates/vanilla-sonoma.pkr.hcl
 ```
 
 Optionally, SIP can be disabled for each image by running the following commands:
 
 ```bash
-packer build -var vm_name=monterey-vanilla templates/disable-sip.pkr.hcl
-```
-
-```bash
-packer build -var vm_name=ventura-vanilla templates/disable-sip.pkr.hcl
+packer build -var vm_name=sonoma-vanilla templates/disable-sip.pkr.hcl
 ```
 
 ## Building Base Image

data/limit.maxfiles.plist

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
+        "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>Label</key>
+    <string>limit.maxfiles</string>
+    <key>ProgramArguments</key>
+    <array>
+      <string>launchctl</string>
+      <string>limit</string>
+      <string>maxfiles</string>
+      <string>65536</string>
+      <string>524288</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>ServiceIPC</key>
+    <false/>
+  </dict>
+</plist>

templates/base.pkr.hcl

@@ -1,22 +1,22 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 0.5.4"
+      version = ">= 1.2.0"
       source  = "github.com/cirruslabs/tart"
     }
   }
 }
 
 variable "macos_version" {
-  type =  string
+  type = string
 }
 
 variable "gha_version" {
-  type =  string
+  type = string
 }
 
 source "tart-cli" "tart" {
-  vm_base_name = "ghcr.io/cirruslabs/macos-${var.macos_version}-vanilla:13.3"
+  vm_base_name = "ghcr.io/cirruslabs/macos-${var.macos_version}-vanilla:latest"
   vm_name      = "${var.macos_version}-base"
   cpu_count    = 4
   memory_gb    = 8
@@ -29,17 +29,19 @@ source "tart-cli" "tart" {
 build {
   sources = ["source.tart-cli.tart"]
 
-  provisioner "shell" {
-    inline = [
-      "echo 'Disabling spotlight...'",
-      "sudo mdutil -a -i off",
-    ]
+  provisioner "file" {
+    source      = "data/limit.maxfiles.plist"
+    destination = "~/limit.maxfiles.plist"
   }
 
-  # setup DNS
   provisioner "shell" {
     inline = [
-      "networksetup -setdnsservers Ethernet 8.8.8.8 8.8.4.4 1.1.1.1",
+      "echo 'Configuring maxfiles...'",
+      "sudo mv ~/limit.maxfiles.plist /Library/LaunchDaemons/limit.maxfiles.plist",
+      "sudo chown root:wheel /Library/LaunchDaemons/limit.maxfiles.plist",
+      "sudo chmod 0644 /Library/LaunchDaemons/limit.maxfiles.plist",
+      "echo 'Disabling spotlight...'",
+      "sudo mdutil -a -i off",
     ]
   }
 
@@ -70,24 +72,41 @@ build {
       "source ~/.zprofile",
       "brew --version",
       "brew update",
-      "brew install wget cmake gcc git-lfs jq gh",
+      "brew install wget cmake gcc git-lfs jq gh gitlab-runner",
       "git lfs install",
     ]
   }
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
+      "brew install libyaml", # https://github.com/rbenv/ruby-build/discussions/2118
       "brew install rbenv",
       "echo 'if which rbenv > /dev/null; then eval \"$(rbenv init -)\"; fi' >> ~/.zprofile",
       "source ~/.zprofile",
-      "rbenv install 3.0.5",
-      "rbenv global 3.0.5",
+      "rbenv install 2.7.8", // latest 2.x.x before EOL
+      "rbenv install $(rbenv install -l | grep -v - | tail -1)",
+      "rbenv global $(rbenv install -l | grep -v - | tail -1)",
       "gem install bundler",
     ]
   }
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "brew install node",
+      "node --version",
+      "npm install --global yarn",
+      "yarn --version",
+    ]
+  }
   provisioner "shell" {
     inline = [
       "sudo safaridriver --enable",
     ]
   }
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "brew install awscli"
+    ]
+  }
 }

templates/disable-sip.pkr.hcl

@@ -1,7 +1,7 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 0.5.4"
+      version = ">= 1.2.0"
       source  = "github.com/cirruslabs/tart"
     }
   }

templates/vanilla-monterey.pkr.hcl

@@ -1,7 +1,7 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 0.5.4"
+      version = ">= 1.2.0"
       source  = "github.com/cirruslabs/tart"
     }
   }
@@ -90,14 +90,18 @@ build {
       "sudo defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser admin",
       // Disable screensaver at login screen
       "sudo defaults write /Library/Preferences/com.apple.screensaver loginWindowIdleTime 0",
+      // Disable screensaver for admin user
+      "defaults -currentHost write com.apple.screensaver idleTime 0",
       // Prevent the VM from sleeping
-      "sudo systemsetup -setdisplaysleep Off",
-      "sudo systemsetup -setsleep Off",
-      "sudo systemsetup -setcomputersleep Off",
+      "sudo systemsetup -setdisplaysleep Off 2>/dev/null",
+      "sudo systemsetup -setsleep Off 2>/dev/null",
+      "sudo systemsetup -setcomputersleep Off 2>/dev/null",
       // Launch Safari to populate the defaults
       "/Applications/Safari.app/Contents/MacOS/Safari &",
-      "sleep 3",
-      "kill -9 %1",
+      "SAFARI_PID=$!",
+      "disown",
+      "sleep 30",
+      "kill -9 $SAFARI_PID",
       // Enable Safari's remote automation and "Develop" menu
       "sudo safaridriver --enable",
       "defaults write com.apple.Safari.SandboxBroker ShowDevelopMenu -bool true",

templates/vanilla-sonoma.pkr.hcl

@@ -0,0 +1,126 @@
+packer {
+  required_plugins {
+    tart = {
+      version = ">= 1.2.0"
+      source  = "github.com/cirruslabs/tart"
+    }
+  }
+}
+
+source "tart-cli" "tart" {
+  from_ipsw    = "https://updates.cdn-apple.com/2023FallFCS/fullrestores/042-86430/DBE44960-58A6-4715-948B-D64F33F769BD/UniversalMac_14.1_23B74_Restore.ipsw"
+  vm_name      = "sonoma-vanilla"
+  cpu_count    = 4
+  memory_gb    = 8
+  disk_size_gb = 40
+  ssh_password = "admin"
+  ssh_username = "admin"
+  ssh_timeout  = "120s"
+  boot_command = [
+    # hello, hola, bonjour, etc.
+    "<wait60s><spacebar>",
+    # Language: most of the times we have a list of "English"[1], "English (UK)", etc. with
+    # "English" language already selected. If we type "english", it'll cause us to switch
+    # to the "English (UK)", which is not what we want. To solve this, we switch to some other
+    # language first, e.g. "Italiano" and then switch back to "English". We'll then jump to the
+    # first entry in a list of "english"-prefixed items, which will be "English".
+    #
+    # [1]: should be named "English (US)", but oh well 🤷
+    "<wait30s>italiano<esc>english<enter>",
+    # Select Your Country and Region
+    "<wait30s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Written and Spoken Languages
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Accessibility
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Data & Privacy
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Migration Assistant
+    "<wait10s><tab><tab><tab><spacebar>",
+    # Sign In with Your Apple ID
+    "<wait10s><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Are you sure you want to skip signing in with an Apple ID?
+    "<wait10s><tab><spacebar>",
+    # Terms and Conditions
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # I have read and agree to the macOS Software License Agreement
+    "<wait10s><tab><spacebar>",
+    # Create a Computer Account
+    "<wait10s>admin<tab><tab>admin<tab>admin<tab><tab><tab><spacebar>",
+    # Enable Location Services
+    "<wait30s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Are you sure you don't want to use Location Services?
+    "<wait10s><tab><spacebar>",
+    # Select Your Time Zone
+    "<wait10s><tab>UTC<enter><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Analytics
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Screen Time
+    "<wait10s><tab><spacebar>",
+    # Siri
+    "<wait10s><tab><spacebar><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Choose Your Look
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Enable Voice Over
+    "<wait10s><leftAltOn><f5><leftAltOff><wait5s>v",
+    # Now that the installation is done, open "System Settings"
+    "<wait10s><leftAltOn><spacebar><leftAltOff>System Settings<enter>",
+    # Navigate to "Sharing"
+    "<wait10s><leftAltOn>f<leftAltOff>sharing<enter>",
+    # Navigate to "Screen Sharing" and enable it
+    "<wait10s><tab><tab><tab><tab><tab><spacebar>",
+    # Navigate to "Remote Login" and enable it
+    "<wait10s><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><spacebar>",
+    # Open "Remote Login" details
+    "<wait10s><tab><spacebar>",
+    # Enable "Full Disk Access"
+    "<wait10s><tab><spacebar>",
+    # Click "Done"
+    "<wait10s><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Disable Voice Over
+    "<leftAltOn><f5><leftAltOff>",
+  ]
+
+  // A (hopefully) temporary workaround for Virtualization.Framework's
+  // installation process not fully finishing in a timely manner
+  create_grace_time = "30s"
+}
+
+build {
+  sources = ["source.tart-cli.tart"]
+
+  provisioner "shell" {
+    inline = [
+      // Enable passwordless sudo
+      "echo admin | sudo -S sh -c \"mkdir -p /etc/sudoers.d/; echo 'admin ALL=(ALL) NOPASSWD: ALL' | EDITOR=tee visudo /etc/sudoers.d/admin-nopasswd\"",
+      // Enable auto-login
+      //
+      // See https://github.com/xfreebird/kcpassword for details.
+      "echo '00000000: 1ced 3f4a bcbc ba2c caca 4e82' | sudo xxd -r - /etc/kcpassword",
+      "sudo defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser admin",
+      // Disable screensaver at login screen
+      "sudo defaults write /Library/Preferences/com.apple.screensaver loginWindowIdleTime 0",
+      // Disable screensaver for admin user
+      "defaults -currentHost write com.apple.screensaver idleTime 0",
+      // Prevent the VM from sleeping
+      "sudo systemsetup -setdisplaysleep Off 2>/dev/null",
+      "sudo systemsetup -setsleep Off 2>/dev/null",
+      "sudo systemsetup -setcomputersleep Off 2>/dev/null",
+      // Launch Safari to populate the defaults
+      "/Applications/Safari.app/Contents/MacOS/Safari &",
+      "SAFARI_PID=$!",
+      "disown",
+      "sleep 30",
+      "kill -9 $SAFARI_PID",
+      // Enable Safari's remote automation and "Develop" menu
+      "sudo safaridriver --enable",
+      "defaults write com.apple.Safari.SandboxBroker ShowDevelopMenu -bool true",
+      "defaults write com.apple.Safari IncludeDevelopMenu -bool true",
+      // Disable screen lock
+      //
+      // Note that this only works if the user is logged-in,
+      // i.e. not on login screen.
+      "sysadminctl -screenLock off -password admin",
+    ]
+  }
+}

templates/vanilla-ventura.pkr.hcl

@@ -1,7 +1,7 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 0.5.4"
+      version = ">= 1.2.0"
       source  = "github.com/cirruslabs/tart"
     }
   }
@@ -10,7 +10,7 @@ packer {
 source "tart-cli" "tart" {
   # You can find macOS IPSW URLs on various websites like https://ipsw.me/
   # and https://www.theiphonewiki.com/wiki/Beta_Firmware/Mac/13.x
-  from_ipsw    = "https://updates.cdn-apple.com/2023WinterSeed/fullrestores/002-75537/8250FA0E-0962-46D6-8A90-57A390B9FFD7/UniversalMac_13.3_22E252_Restore.ipsw"
+  from_ipsw    = "https://updates.cdn-apple.com/2023SummerFCS/fullrestores/042-43686/945D434B-DA5D-48DB-A558-F6D18D11AD69/UniversalMac_13.5.2_22G91_Restore.ipsw"
   vm_name      = "ventura-vanilla"
   cpu_count    = 4
   memory_gb    = 8
@@ -96,14 +96,18 @@ build {
       "sudo defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser admin",
       // Disable screensaver at login screen
       "sudo defaults write /Library/Preferences/com.apple.screensaver loginWindowIdleTime 0",
+      // Disable screensaver for admin user
+      "defaults -currentHost write com.apple.screensaver idleTime 0",
       // Prevent the VM from sleeping
-      "sudo systemsetup -setdisplaysleep Off",
-      "sudo systemsetup -setsleep Off",
-      "sudo systemsetup -setcomputersleep Off",
+      "sudo systemsetup -setdisplaysleep Off 2>/dev/null",
+      "sudo systemsetup -setsleep Off 2>/dev/null",
+      "sudo systemsetup -setcomputersleep Off 2>/dev/null",
       // Launch Safari to populate the defaults
       "/Applications/Safari.app/Contents/MacOS/Safari &",
+      "SAFARI_PID=$!",
+      "disown",
       "sleep 30",
-      "kill -9 %1",
+      "kill -9 $SAFARI_PID",
       // Enable Safari's remote automation and "Develop" menu
       "sudo safaridriver --enable",
       "defaults write com.apple.Safari.SandboxBroker ShowDevelopMenu -bool true",
@@ -113,6 +117,7 @@ build {
       // Note that this only works if the user is logged-in,
       // i.e. not on login screen.
       "sysadminctl -screenLock off -password admin",
+      "defaults -currentHost write com.apple.screensaver idleTime 0"
     ]
   }
 }

templates/xcode.pkr.hcl

@@ -1,26 +1,26 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 0.5.4"
+      version = ">= 1.2.0"
       source  = "github.com/cirruslabs/tart"
     }
   }
 }
 
 variable "macos_version" {
-  type =  string
+  type = string
 }
 
 variable "xcode_version" {
-  type =  string
+  type = string
 }
 
 variable "gha_version" {
-  type =  string
+  type = string
 }
 
 variable "android_sdk_tools_version" {
-  type =  string
+  type    = string
   default = "9477386" # https://developer.android.com/studio/#command-tools
 }
 
@@ -65,7 +65,7 @@ build {
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
-      "brew install homebrew/cask-versions/temurin11",
+      "brew install homebrew/cask-versions/temurin17",
       "echo 'export ANDROID_HOME=$HOME/android-sdk' >> ~/.zprofile",
       "echo 'export ANDROID_SDK_ROOT=$ANDROID_HOME' >> ~/.zprofile",
       "echo 'export PATH=$PATH:$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$ANDROID_HOME/emulator' >> ~/.zprofile",
@@ -76,7 +76,7 @@ build {
       "rm android-sdk-tools.zip",
       "mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/latest",
       "yes | sdkmanager --licenses",
-      "yes | sdkmanager 'platform-tools' 'platforms;android-33' 'build-tools;33.0.1' 'ndk;25.1.8937393'"
+      "yes | sdkmanager 'platform-tools' 'platforms;android-33' 'build-tools;34.0.0' 'ndk;25.2.9519653'"
     ]
   }
   provisioner "shell" {
@@ -121,6 +121,16 @@ build {
       "sudo gem uninstall --ignore-dependencies ffi && sudo gem install ffi -- --enable-libffi-alloc"
     ]
   }
+
+  # useful utils for mobile development
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "brew install graphicsmagick imagemagick",
+      "brew install wix/brew/applesimutils"
+    ]
+  }
+
   # inspired by https://github.com/actions/runner-images/blob/fb3b6fd69957772c1596848e2daaec69eabca1bb/images/macos/provision/configuration/configure-machine.sh#L33-L61
   provisioner "shell" {
     inline = [
@@ -128,17 +138,18 @@ build {
       "sudo security delete-certificate -Z FF6797793A3CD798DC5B2ABEF56F73EDC9F83A64 /Library/Keychains/System.keychain",
       "curl -o add-certificate.swift https://raw.githubusercontent.com/actions/runner-images/fb3b6fd69957772c1596848e2daaec69eabca1bb/images/macos/provision/configuration/add-certificate.swift",
       "swiftc add-certificate.swift",
+      "sudo mv ./add-certificate /usr/local/bin/add-certificate",
       "curl -o AppleWWDRCAG3.cer https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer",
       "curl -o DeveloperIDG2CA.cer https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer",
-      "sudo ./add-certificate AppleWWDRCAG3.cer",
-      "sudo ./add-certificate DeveloperIDG2CA.cer",
+      "sudo add-certificate AppleWWDRCAG3.cer",
+      "sudo add-certificate DeveloperIDG2CA.cer",
       "rm add-certificate* *.cer"
     ]
   }
+
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
-      "brew doctor",
       "flutter doctor"
     ]
   }

variables.pkrvars.hcl

@@ -1,3 +1,3 @@
-macos_version = "ventura"
-gha_version   = "2.303.0"
-xcode_version = "14.2"
+macos_version = "sonoma"
+gha_version   = "2.311.0"
+xcode_version = "15.1"