macOS and Xcode 26.5 (#349)

* macOS and Xcode 26.5

* Updated expected tahoe runtimes

.ci/cirrus.base.yml

@@ -4,16 +4,23 @@ task:
   matrix:
     - env:
         MACOS_VERSION: sonoma
+        DISABLE_SIP_TEMPLATE: disable-sip.pkr.hcl
     - env:
         MACOS_VERSION: sequoia
+        DISABLE_SIP_TEMPLATE: disable-sip-with-username.pkr.hcl
     - env:
         MACOS_VERSION: tahoe
+        DISABLE_SIP_TEMPLATE: disable-sip-with-username.pkr.hcl
   <<: *defaults
   pull_vanilla_script:
     - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest
+    - tart clone ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest "$MACOS_VERSION-base"
+  disable_sip_script:
+    - packer init "templates/${DISABLE_SIP_TEMPLATE}"
+    - packer build -var vm_name="$MACOS_VERSION-base" "templates/${DISABLE_SIP_TEMPLATE}"
   build_base_script:
     - packer init templates/base.pkr.hcl
-    - packer build -var macos_version="$MACOS_VERSION" templates/base.pkr.hcl
+    - packer build -var vm_name="$MACOS_VERSION-base" templates/base.pkr.hcl
   push_base_script:
     - tart push $MACOS_VERSION-base ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
   always:

.ci/cirrus.release.yml

@@ -1,14 +1,16 @@
 task:
   name: "Release Xcode $CIRRUS_TAG ($MACOS_VERSION)"
-  matrix:
-    - env:
-        MACOS_VERSION: sequoia
+  env:
+    XCODE_COMPONENTS: "\"MetalToolchain\""
+    matrix:
+      - MACOS_VERSION: tahoe
+      - MACOS_VERSION: sequoia
   <<: *defaults
   pull_base_script:
     - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
   build_script:
     - packer init templates/xcode.pkr.hcl
-    - packer build -var macos_version="$MACOS_VERSION" -var xcode_version="[\"$CIRRUS_TAG\"]" templates/xcode.pkr.hcl
+    - packer build -var macos_version="$MACOS_VERSION" -var xcode_version="[\"$CIRRUS_TAG\"]" -var xcode_components="[$XCODE_COMPONENTS]" templates/xcode.pkr.hcl
   push_script: |
     if [[ $CIRRUS_TAG == *"beta"* ]]
     then

.ci/cirrus.runner.yml

@@ -1,16 +1,18 @@
 task:
   name: "Update Runner Image ($MACOS_VERSION)"
-  execution_lock: runner-image-update
   env:
     matrix:
-      - MACOS_VERSION: sonoma
-        XCODE_VERSIONS: "16.1,16,15.4"
-        ADDITIONAL_IOS_BUILDS: "17.5"
-        DISK_SIZE: 275
       - MACOS_VERSION: sequoia
-        XCODE_VERSIONS: "16.4,\"26-beta-5\",16.3,16.2,16.1,16"
+        XCODE_VERSIONS: "\"26.0.1\",16.4,16.3,16.2,16.1,16"
         ADDITIONAL_IOS_BUILDS: "18.5,18.4,18.2,17.5"
-        DISK_SIZE: 600
+        ADDITIONAL_TVOS_BUILDS: "17.5"
+        XCODE_COMPONENTS: "\"MetalToolchain\""
+        DISK_SIZE: 380
+      - MACOS_VERSION: tahoe
+        XCODE_VERSIONS: "\"26.5\",\"26.4.1\",\"26.3\",\"26.2\",\"26.1.1\",\"26.0.1\""
+        XCODE_COMPONENTS: "\"MetalToolchain\""
+        ADDITIONAL_IOS_BUILDS: "18.6"
+        DISK_SIZE: 330
   <<: *defaults
   pull_base_script:
     - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
@@ -21,8 +23,18 @@ task:
         -var macos_version="$MACOS_VERSION" \
         -var xcode_version="[$XCODE_VERSIONS]" \
         -var additional_ios_builds="[$ADDITIONAL_IOS_BUILDS]" \
+        -var additional_tvos_builds="[$ADDITIONAL_TVOS_BUILDS]" \
+        -var xcode_components="[$XCODE_COMPONENTS]" \
         -var expected_runtimes_file="data/expected.$MACOS_VERSION.runtimes.txt" \
         templates/xcode.pkr.hcl
+  finalize_script: |
+    if [[ -f "scripts/finalize-$MACOS_VERSION.sh" ]]; then
+      packer build -var vm_name="$MACOS_VERSION-xcode:runner" \
+        -var script_path="scripts/finalize-$MACOS_VERSION.sh" \
+        templates/exex-script.pkr.hcl
+    else
+      echo "Skipping prepare script for $MACOS_VERSION"
+    fi
   push_script: |
     if [[ -z "$CIRRUS_PR" ]]; then
       tart push "$MACOS_VERSION-xcode:runner" ghcr.io/cirruslabs/macos-runner:$MACOS_VERSION

.ci/cirrus.vanilla.yml

@@ -1,26 +1,20 @@
 env:
   RESOLVE_VM_NAME: "resolve-macos-number-task-id-${CIRRUS_TASK_ID}"
   RESOLVE_FILE: "${RESOLVE_VM_NAME}.txt"
-  DISABLE_SIP_TEMPLATE: disable-sip.pkr.hcl
 
 task:
   name: "Update Vanilla Image ($MACOS_VERSION)"
   env:
     matrix:
       - MACOS_VERSION: tahoe
-        DISABLE_SIP_TEMPLATE: disable-sip-with-username.pkr.hcl
       - MACOS_VERSION: sequoia
-        DISABLE_SIP_TEMPLATE: disable-sip-with-username.pkr.hcl
       - MACOS_VERSION: sonoma
-      - MACOS_VERSION: ventura
       - MACOS_VERSION: monterey
   only_if: $CIRRUS_BRANCH == $CIRRUS_DEFAULT_BRANCH && changesInclude("templates/vanilla-$MACOS_VERSION.pkr.hcl")
   <<: *defaults
   build_script:
     - packer init templates/vanilla-$MACOS_VERSION.pkr.hcl
     - packer build templates/vanilla-$MACOS_VERSION.pkr.hcl
-  disable_sip_script:
-    - packer build -var vm_name=$MACOS_VERSION-vanilla "templates/${DISABLE_SIP_TEMPLATE}"
   resolve_macos_number_script:
     - packer build -var vm_base_name=$MACOS_VERSION-vanilla -var vm_name=$RESOLVE_VM_NAME -var resolve_file=$RESOLVE_FILE templates/resolve-macos-number.pkr.hcl
     - echo "MACOS_NUMBER=$(cat $RESOLVE_FILE)" >> $CIRRUS_ENV

.ci/cirrus.xcode.yml

@@ -4,8 +4,15 @@ task:
   env:
     matrix:
       - MACOS_VERSION: tahoe
-        XCODE_VERSION: 26-beta-5
+        XCODE_VERSION: "26.2"
+        XCODE_COMPONENTS: "\"MetalToolchain\""
         LATEST: true
+      - MACOS_VERSION: tahoe
+        XCODE_VERSION: "26.1.1"
+        XCODE_COMPONENTS: "\"MetalToolchain\""
+      - MACOS_VERSION: tahoe
+        XCODE_VERSION: "26.0.1"
+        XCODE_COMPONENTS: "\"MetalToolchain\""
       - MACOS_VERSION: sequoia
         XCODE_VERSION: 16.4
         LATEST: true
@@ -22,12 +29,14 @@ task:
         LATEST: true
       - MACOS_VERSION: sonoma
         XCODE_VERSION: 16
+      - MACOS_VERSION: sonoma
+        XCODE_VERSION: 15.4
   <<: *defaults
   pull_base_script:
     - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
   build_xcode_script:
     - packer init templates/xcode.pkr.hcl
-    - packer build -var macos_version="$MACOS_VERSION" -var xcode_version="[\"$XCODE_VERSION\"]" templates/xcode.pkr.hcl
+    - packer build -var macos_version="$MACOS_VERSION" -var xcode_version="[\"$XCODE_VERSION\"]" -var xcode_components="[$XCODE_COMPONENTS]" templates/xcode.pkr.hcl
   push_script: |
     if [[ -z "$LATEST" ]]
     then

.cirrus.yml

@@ -13,9 +13,6 @@ env:
 
 defaults: &defaults
   timeout_in: 3h
-  update_script:
-    - brew update || true
-    - brew upgrade || true
   info_script:
     - tart --version
     - packer --version

DEVELOPMENT.md

@@ -15,7 +15,7 @@ packer build -var vm_name=sonoma-vanilla templates/disable-sip.pkr.hcl
 ## Building Base Image
 
 ```bash
-packer build -var macos_version=sonoma templates/base.pkr.hcl
+packer build -var vm_name=sonoma-vanilla templates/base.pkr.hcl
 ```
 
 ## Building Xcode Image

README.md

@@ -5,28 +5,21 @@ Repository with Packer templates to build macOS [Tart](https://tart.run/) virtua
 
 The following image variants are currently available:
 
-* `macos-{sequoia,sonoma}-base` image has only `brew` pre-installed and the latest version of `macOS` available
-* `macos-{sequoia,sonoma}-xcode:N` image is based on `macos-{sequoia,sonoma}-base` image and has `Xcode N` with [`Flutter`](https://flutter.dev/) pre-installed
-* `macos-runner:{sequoia,sonoma}` image is a variant of `xcode:N` with several versions of `Xcode` pre-installed and [`xcodes` tool](https://github.com/XcodesOrg/xcodes) to switch between them.
+* `macos-{tahoe,sequoia,sonoma}-vanilla` — a vanilla macOS installation with helpful tweaks such as auto-login, but no additional software preinstalled
+* `macos-{tahoe,sequoia,sonoma}-base` — based on `macos-{tahoe,sequoia,sonoma}-vanilla` image, it comes with `brew` and [other useful software](https://github.com/cirruslabs/macos-image-templates/blob/main/templates/base.pkr.hcl) pre-installed, but without Xcode
+* `macos-{tahoe,sequoia,sonoma}-xcode:N` — based on `macos-{tahoe,sequoia,sonoma}-base` image and has `Xcode N` with [`Flutter`](https://flutter.dev/) pre-installed
+* `macos-runner:{tahoe,sequoia,sonoma}` — a variant of `xcode:N` with several versions of `Xcode` pre-installed and [`xcodes` tool](https://github.com/XcodesOrg/xcodes) to switch between them.
 
 See a full list of VMs available [here](https://github.com/orgs/cirruslabs/packages?tab=packages&q=macos-).
 
 ## Release Cadence
 
 Once a new version of Xcode is released, we will initiate a GitHub release which will automatically build and push
-a new version of the `macos-sequoia-xcode:N`. This generally happens within 24 hours of a release.
+a new version of the `macos-{tahoe,sequoia}-xcode:N`. This generally happens the next weekend after a release.
 Please watch this repository releases to get notified about new images.
 
-For an Xcode release which is non beta and not an RC `ghcr.io/cirruslabs/macos-runner:sequoia` image will also be updated.
-
 ## Update Cadence
 
-Some of the images are regularly getting rebuild in order to update the pre-installed packages. The following images are updated
-monthly on the first Saturday of the month:
+Some of the images are regularly getting rebuild in order to update the pre-installed packages. 
 
-* `ghcr.io/cirruslabs/macos-{sequoia,sonoma}-base`
-* `ghcr.io/cirruslabs/macos-runner:sonoma` which is a superset of `ghcr.io/cirruslabs/macos-sonoma-xcode:{latest,16.1,16,15.4,15.3,15.2,15.1,15.0.1}`
-* `ghcr.io/cirruslabs/macos-runner:sequoia` which is a superset of `ghcr.io/cirruslabs/macos-sequoia-xcode:{latest,16.3,16.2,16.1,16,15.4}`
-
-Note that `ghcr.io/cirruslabs/macos-runner:{sequoia,sonoma}` are updated every Sunday and these images are [optimised for startup](https://cirrus-runners.app/blog/2024/04/11/optimizing-startup-time-of-cirrus-runners/)
-on Cirrus Runners and Cirrus CI services.
+[This configuration file](.ci/cirrus.release.yml) defines images that are getting rebuilt monthly on the first Saturday of the month.

data/expected.sequoia.runtimes.txt

@@ -7,13 +7,14 @@ iOS 18.3 (18.3.1 - 22D8075) - com.apple.CoreSimulator.SimRuntime.iOS-18-3
 iOS 18.4 (18.4 - 22E238) - com.apple.CoreSimulator.SimRuntime.iOS-18-4
 iOS 18.5 (18.5 - 22F77) - com.apple.CoreSimulator.SimRuntime.iOS-18-5
 iOS 18.6 (18.6 - 22G86) - com.apple.CoreSimulator.SimRuntime.iOS-18-6
-iOS 26.0 (26.0 - 23A5308g) - com.apple.CoreSimulator.SimRuntime.iOS-26-0
+iOS 26.0 (26.0.1 - 23A8464) - com.apple.CoreSimulator.SimRuntime.iOS-26-0
+tvOS 17.5 (17.5 - 21L569) - com.apple.CoreSimulator.SimRuntime.tvOS-17-5
 tvOS 18.4 (18.4 - 22L254) - com.apple.CoreSimulator.SimRuntime.tvOS-18-4
 tvOS 18.5 (18.5 - 22L572) - com.apple.CoreSimulator.SimRuntime.tvOS-18-5
-tvOS 26.0 (26.0 - 23J5327g) - com.apple.CoreSimulator.SimRuntime.tvOS-26-0
+tvOS 26.0 (26.0 - 23J352) - com.apple.CoreSimulator.SimRuntime.tvOS-26-0
 watchOS 11.4 (11.4 - 22T250) - com.apple.CoreSimulator.SimRuntime.watchOS-11-4
 watchOS 11.5 (11.5 - 22T572) - com.apple.CoreSimulator.SimRuntime.watchOS-11-5
-watchOS 26.0 (26.0 - 23R5328g) - com.apple.CoreSimulator.SimRuntime.watchOS-26-0
+watchOS 26.0 (26.0 - 23R353) - com.apple.CoreSimulator.SimRuntime.watchOS-26-0
 visionOS 2.4 (2.4 - 22O237) - com.apple.CoreSimulator.SimRuntime.xrOS-2-4
 visionOS 2.5 (2.5 - 22O473) - com.apple.CoreSimulator.SimRuntime.xrOS-2-5
-visionOS 26.0 (26.0 - 23M5311g) - com.apple.CoreSimulator.SimRuntime.xrOS-26-0
+visionOS 26.0 (26.0 - 23M336) - com.apple.CoreSimulator.SimRuntime.xrOS-26-0

data/expected.sonoma.runtimes.txt

@@ -1,13 +1,9 @@
 == Runtimes ==
-iOS 17.5 (17.5 - 21F79) - com.apple.CoreSimulator.SimRuntime.iOS-17-5
 iOS 18.0 (18.0 - 22A3351) - com.apple.CoreSimulator.SimRuntime.iOS-18-0
 iOS 18.1 (18.1 - 22B81) - com.apple.CoreSimulator.SimRuntime.iOS-18-1
-tvOS 17.5 (17.5 - 21L569) - com.apple.CoreSimulator.SimRuntime.tvOS-17-5
 tvOS 18.0 (18.0 - 22J356) - com.apple.CoreSimulator.SimRuntime.tvOS-18-0
 tvOS 18.1 (18.1 - 22J578) - com.apple.CoreSimulator.SimRuntime.tvOS-18-1
-watchOS 10.5 (10.5 - 21T575) - com.apple.CoreSimulator.SimRuntime.watchOS-10-5
 watchOS 11.0 (11.0 - 22R349) - com.apple.CoreSimulator.SimRuntime.watchOS-11-0
 watchOS 11.1 (11.1 - 22R581) - com.apple.CoreSimulator.SimRuntime.watchOS-11-1
-visionOS 1.2 (1.2 - 21O5565d) - com.apple.CoreSimulator.SimRuntime.xrOS-1-2
 visionOS 2.0 (2.0 - 22N318) - com.apple.CoreSimulator.SimRuntime.xrOS-2-0
 visionOS 2.1 (2.1 - 22N580) - com.apple.CoreSimulator.SimRuntime.xrOS-2-1

data/expected.tahoe.runtimes.txt

@@ -1,5 +1,16 @@
 == Runtimes ==
-iOS 26.0 (26.0 - 23A5287g) - com.apple.CoreSimulator.SimRuntime.iOS-26-0
-tvOS 26.0 (26.0 - 23J5306f) - com.apple.CoreSimulator.SimRuntime.tvOS-26-0
-watchOS 26.0 (26.0 - 23R5307g) - com.apple.CoreSimulator.SimRuntime.watchOS-26-0
-visionOS 26.0 (26.0 - 23M5290f) - com.apple.CoreSimulator.SimRuntime.xrOS-26-0
+iOS 18.6 (18.6 - 22G86) - com.apple.CoreSimulator.SimRuntime.iOS-18-6
+iOS 26.0 (26.0.1 - 23A8464) - com.apple.CoreSimulator.SimRuntime.iOS-26-0
+iOS 26.1 (26.1 - 23B86) - com.apple.CoreSimulator.SimRuntime.iOS-26-1
+iOS 26.3 (26.3.1 - 23D8133) - com.apple.CoreSimulator.SimRuntime.iOS-26-3
+iOS 26.4 (26.4.1 - 23E254a) - com.apple.CoreSimulator.SimRuntime.iOS-26-4
+iOS 26.5 (26.5 - 23F77) - com.apple.CoreSimulator.SimRuntime.iOS-26-5
+tvOS 26.2 (26.2 - 23K51) - com.apple.CoreSimulator.SimRuntime.tvOS-26-2
+tvOS 26.4 (26.4 - 23L243a) - com.apple.CoreSimulator.SimRuntime.tvOS-26-4
+tvOS 26.5 (26.5 - 23L470) - com.apple.CoreSimulator.SimRuntime.tvOS-26-5
+watchOS 26.2 (26.2 - 23S303) - com.apple.CoreSimulator.SimRuntime.watchOS-26-2
+watchOS 26.4 (26.4 - 23T240b) - com.apple.CoreSimulator.SimRuntime.watchOS-26-4
+watchOS 26.5 (26.5 - 23T570) - com.apple.CoreSimulator.SimRuntime.watchOS-26-5
+visionOS 26.2 (26.2 - 23N301) - com.apple.CoreSimulator.SimRuntime.xrOS-26-2
+visionOS 26.4 (26.4.1 - 23O249a) - com.apple.CoreSimulator.SimRuntime.xrOS-26-4
+visionOS 26.5 (26.5 - 23O470) - com.apple.CoreSimulator.SimRuntime.xrOS-26-5

scripts/finalize-tahoe.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+
+source ~/.zprofile
+
+# Set shell options to enable fail-fast behavior
+#
+# * -e: fail the script when an error occurs or command fails
+# * -u: fail the script when attempting to reference unset parameters
+# * -o pipefail: by default an exit status of a pipeline is that of its
+#                last command, this fails the pipe early if an error in
+#                any of its commands occurs
+#
+set -euo pipefail
+
+# Wait until `xcrun simctl list devices -v` no longer reports any devices as "unavailable".
+#
+# Exit codes:
+#   0 - Success: no devices are marked as unavailable within the timeout window
+#   1 - Failure: timed out waiting for devices to become available
+#   2 - Failure: prerequisites missing (e.g., xcrun not found)
+
+DEFAULT_TIMEOUT_MINUTES=60
+TIMEOUT_MINUTES=${1:-$DEFAULT_TIMEOUT_MINUTES}
+
+if ! [[ "$TIMEOUT_MINUTES" =~ ^[0-9]+$ ]]; then
+  echo "[wait-simulators] ERROR: TIMEOUT_MINUTES must be an integer number of minutes (got: '$TIMEOUT_MINUTES')." >&2
+  exit 2
+fi
+
+SECONDS_TOTAL=$(( TIMEOUT_MINUTES * 60 ))
+DEADLINE=$(( $(date +%s) + SECONDS_TOTAL ))
+SLEEP_SECONDS=15
+
+# Print a one-line status snapshot of current unavailable devices (if any)
+print_status() {
+  if xcrun simctl list devices -v | grep -qi "unavailable"; then
+    echo "[wait-simulators] Still seeing 'unavailable' devices at $(date '+%Y-%m-%d %H:%M:%S')"
+    # Show a concise list of unavailable lines for debugging
+    xcrun simctl list devices -v | grep -i "unavailable" | sed 's/^/[wait-simulators]   /'
+  else
+    echo "[wait-simulators] No 'unavailable' devices detected at $(date '+%Y-%m-%d %H:%M:%S')"
+  fi
+}
+
+trap 'echo "[wait-simulators] Interrupted" >&2; exit 130' INT TERM
+
+echo "[wait-simulators] Waiting up to ${TIMEOUT_MINUTES} minute(s) for simulators to become available..."
+
+while true; do
+  if ! xcrun simctl list devices -v | grep -qi "unavailable"; then
+    echo "[wait-simulators] All simulators are available."
+    exit 0
+  fi
+
+  NOW=$(date +%s)
+  if (( NOW >= DEADLINE )); then
+    echo "[wait-simulators] TIMEOUT after ${TIMEOUT_MINUTES} minute(s). Some simulators remain 'unavailable'." >&2
+    echo "[wait-simulators] Final snapshot of unavailable devices:" >&2
+    xcrun simctl list devices -v | grep -i "unavailable" | sed 's/^/[wait-simulators]   /' >&2
+    exit 1
+  fi
+
+  print_status
+  REMAIN=$(( DEADLINE - NOW ))
+  # Sleep in chunks to allow quicker exit when they become available
+  SLEEP=$SLEEP_SECONDS
+  if (( REMAIN < SLEEP_SECONDS )); then SLEEP=$REMAIN; fi
+  sleep "$SLEEP"
+  # Loop and re-check
+done
+
+

scripts/update-tcc-database.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+source ~/.zprofile
+
+# Set shell options to enable fail-fast behavior
+#
+# * -e: fail the script when an error occurs or command fails
+# * -u: fail the script when attempting to reference unset parameters
+# * -o pipefail: by default an exit status of a pipeline is that of its
+#                last command, this fails the pipe early if an error in
+#                any of its commands occurs
+#
+set -euo pipefail
+
+update_tcc_database() {
+  sudo sqlite3 "$1" <<-'EOF'
+	INSERT OR REPLACE
+	INTO access (
+	  service,
+	  client_type,
+	  client,
+	  auth_value,
+	  auth_reason,
+	  auth_version,
+	  indirect_object_identifier_type,
+	  indirect_object_identifier
+	) VALUES
+	-- Indirect osascript invocation via SSH
+	('kTCCServiceAccessibility', 1, '/usr/libexec/sshd-keygen-wrapper', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServiceScreenCapture', 1, '/usr/libexec/sshd-keygen-wrapper', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServicePostEvent', 1, '/usr/libexec/sshd-keygen-wrapper', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServiceAppleEvents', 1, '/usr/libexec/sshd-keygen-wrapper', 2, 0, 1, 0, 'com.apple.systemevents'),
+	('kTCCServiceAppleEvents', 1, '/usr/libexec/sshd-keygen-wrapper', 2, 0, 1, 0, 'com.apple.Safari'),
+	-- Direct osascript invocation
+	('kTCCServiceAccessibility', 1, '/usr/bin/osascript', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServiceScreenCapture', 1, '/usr/bin/osascript', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServicePostEvent', 1, '/usr/bin/osascript', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServiceAppleEvents', 1, '/usr/bin/osascript', 2, 0, 1, 0, 'com.apple.systemevents'),
+	('kTCCServiceAppleEvents', 1, '/usr/bin/osascript', 2, 0, 1, 0, 'com.apple.Safari');
+	EOF
+}
+
+# Update TCC.db for all users
+update_tcc_database "/Library/Application Support/com.apple.TCC/TCC.db"
+
+# Update TCC.db for the current user
+update_tcc_database "${HOME}/Library/Application Support/com.apple.TCC/TCC.db"

templates/base.pkr.hcl

@@ -7,13 +7,12 @@ packer {
   }
 }
 
-variable "macos_version" {
+variable "vm_name" {
   type = string
 }
 
 source "tart-cli" "tart" {
-  vm_base_name = "ghcr.io/cirruslabs/macos-${var.macos_version}-vanilla:latest"
-  vm_name      = "${var.macos_version}-base"
+  vm_name      = "${var.vm_name}"
   cpu_count    = 4
   memory_gb    = 8
   disk_size_gb = 50
@@ -65,6 +64,8 @@ build {
       "brew --version",
       "brew update",
       "brew install wget unzip zip ca-certificates cmake gcc git-lfs jq yq gh gitlab-runner",
+      "brew install buildkite/buildkite/buildkite-agent",
+      "brew install equinix-labs/otel-cli/otel-cli",
       "brew install curl || true", // doesn't work on Monterey
       "brew install --cask git-credential-manager",
       "git lfs install",
@@ -105,6 +106,7 @@ build {
       "brew install libyaml", # https://github.com/rbenv/ruby-build/discussions/2118
       "brew install rbenv",
       "echo 'if which rbenv > /dev/null; then eval \"$(rbenv init -)\"; fi' >> ~/.zprofile",
+      "brew install mise",
       "source ~/.zprofile",
       "rbenv install 2.7.8", // latest 2.x.x before EOL
       "rbenv install -l | grep -v - | tail -2 | xargs -L1 rbenv install",
@@ -115,8 +117,8 @@ build {
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
-      "brew install node@20",
-      "echo 'export PATH=\"/opt/homebrew/opt/node@20/bin:$PATH\"' >> ~/.zprofile",
+      "brew install node@24",
+      "echo 'export PATH=\"/opt/homebrew/opt/node@24/bin:$PATH\"' >> ~/.zprofile",
       "source ~/.zprofile",
       "node --version",
       "npm install --global yarn",
@@ -175,4 +177,9 @@ build {
       "sudo chmod 0644 /Library/LaunchAgents/org.cirruslabs.tart-guest-agent.plist",
     ]
   }
+
+  # Update TCC.db and allow automation tools
+  provisioner "shell" {
+    script = "scripts/update-tcc-database.sh"
+  }
 }

templates/exex-script.pkr.hcl

@@ -0,0 +1,39 @@
+packer {
+  required_plugins {
+    tart = {
+      version = ">= 1.12.0"
+      source  = "github.com/cirruslabs/tart"
+    }
+  }
+}
+
+variable "vm_name" {
+  type = string
+}
+
+variable "script_path" {
+  type        = string
+  description = "Path to a local script that should be uploaded and executed inside the VM."
+}
+
+variable "pause_before" {
+  type        = string
+  default     = "60s"
+  description = "How long Packer should wait before running the uploaded script."
+}
+
+source "tart-cli" "tart" {
+  vm_name      = "${var.vm_name}"
+  ssh_password = "admin"
+  ssh_username = "admin"
+  ssh_timeout  = "120s"
+}
+
+build {
+  sources = ["source.tart-cli.tart"]
+
+  provisioner "shell" {
+    script = var.script_path
+    pause_before = var.pause_before
+  }
+}

templates/vanilla-sequoia.pkr.hcl

@@ -1,7 +1,7 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 1.12.0"
+      version = ">= 1.16.0"
       source  = "github.com/cirruslabs/tart"
     }
     ansible = {
@@ -12,7 +12,8 @@ packer {
 }
 
 source "tart-cli" "tart" {
-  from_ipsw    = "https://updates.cdn-apple.com/2025SummerFCS/fullrestores/082-08674/51294E4D-A273-44BE-A280-A69FC347FB87/UniversalMac_15.6_24G84_Restore.ipsw"
+  // will be update to 15.7.2
+  from_ipsw    = "https://updates.cdn-apple.com/2025SummerFCS/fullrestores/093-10809/CFD6DD38-DAF0-40DA-854F-31AAD1294C6F/UniversalMac_15.6.1_24G90_Restore.ipsw"
   vm_name      = "sequoia-vanilla"
   cpu_count    = 4
   memory_gb    = 8
@@ -32,7 +33,7 @@ source "tart-cli" "tart" {
     # [1]: should be named "English (US)", but oh well 🤷
     "<wait30s>italiano<esc>english<enter>",
     # Select Your Country or Region
-    "<wait30s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
+    "<wait30s><click 'Select Your Country or Region'><wait5s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
     # Transfer Your Data to This Mac
     "<wait10s><tab><tab><tab><spacebar><tab><tab><spacebar>",
     # Written and Spoken Languages

templates/vanilla-sonoma.pkr.hcl

@@ -12,6 +12,7 @@ packer {
 }
 
 source "tart-cli" "tart" {
+  // will be update to 14.8.2
   from_ipsw    = "https://updates.cdn-apple.com/2024SummerFCS/fullrestores/062-52859/932E0A8F-6644-4759-82DA-F8FA8DEA806A/UniversalMac_14.6.1_23G93_Restore.ipsw"
   vm_name      = "sonoma-vanilla"
   cpu_count    = 4

templates/vanilla-tahoe.pkr.hcl

@@ -1,7 +1,7 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 1.12.0"
+      version = ">= 1.16.0"
       source  = "github.com/cirruslabs/tart"
     }
     ansible = {
@@ -12,7 +12,7 @@ packer {
 }
 
 source "tart-cli" "tart" {
-  from_ipsw    = "https://updates.cdn-apple.com/2025SummerSeed/fullrestores/093-03417/C35F3BA3-6DCD-473C-9266-A3BF390520BE/UniversalMac_26.0_25A5327h_Restore.ipsw"
+  from_ipsw    = "https://updates.cdn-apple.com/2026SpringFCS/fullrestores/122-58869/DFB1CEEF-5619-4591-9924-E20DB2C8FED0/UniversalMac_26.5_25F71_Restore.ipsw"
   vm_name      = "tahoe-vanilla"
   cpu_count    = 4
   memory_gb    = 8
@@ -32,7 +32,7 @@ source "tart-cli" "tart" {
     # [1]: should be named "English (US)", but oh well 🤷
     "<wait30s>italiano<esc>english<enter>",
     # Select Your Country or Region
-    "<wait60s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
+    "<wait60s><click 'Select Your Country or Region'><wait5s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
     # Transfer Your Data to This Mac
     "<wait10s><tab><tab><tab><spacebar><tab><tab><spacebar>",
     # Written and Spoken Languages
@@ -46,25 +46,31 @@ source "tart-cli" "tart" {
     # Enable Voice Over
     "<wait120s><leftAltOn><f5><leftAltOff>",
     # Sign In with Your Apple ID
-    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar><up><spacebar>",
     # Are you sure you want to skip signing in with an Apple ID?
     "<wait10s><tab><spacebar>",
     # Terms and Conditions
     "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # I have read and agree to the macOS Software License Agreement
     "<wait10s><tab><spacebar>",
+    # Age Range -> Adult
+    "<wait10s><tab><tab><tab><spacebar>",
     # Enable Location Services
     "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Are you sure you don't want to use Location Services?
     "<wait10s><tab><spacebar>",
     # Select Your Time Zone
-    "<wait10s><tab><tab>UTC<enter><leftShiftOn><tab><tab><leftShiftOff><spacebar>",
+    "<wait10s><tab><tab><tab>UTC<enter><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Analytics
     "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Screen Time
     "<wait10s><tab><tab><spacebar>",
     # Siri
     "<wait10s><tab><spacebar><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # You Mac is Ready for FileVault
+    "<wait10s><leftShiftOn><tab><tab><leftShiftOff><spacebar>",
+    # Mac Data Will Not Be Securely Encrypted
+    "<wait10s><tab><spacebar>",
     # Choose Your Look
     "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Update Mac Automatically
@@ -72,31 +78,33 @@ source "tart-cli" "tart" {
     # Welcome to Mac
     "<wait30s><spacebar>",
     # Disable Voice Over
-    "<leftAltOn><f5><leftAltOff>",
+    "<wait10s><leftAltOn><f5><leftAltOff>",
     # Enable Keyboard navigation
     # This is so that we can navigate the System Settings app using the keyboard
-    "<wait10s><leftAltOn><spacebar><leftAltOff>Terminal<enter>",
-    "<wait10s>defaults write NSGlobalDomain AppleKeyboardUIMode -int 3<enter>",
-    "<wait10s><leftAltOn>q<leftAltOff>",
+    "<wait10s><leftAltOn><spacebar><leftAltOff>Terminal<wait10s><enter>",
+    "<wait10s><wait10s>defaults write NSGlobalDomain AppleKeyboardUIMode -int 3<enter>",
     # Now that the installation is done, open "System Settings"
-    "<wait10s><leftAltOn><spacebar><leftAltOff>System Settings<enter>",
+    # On Tahoe opening System Settings through Spotlight is not very reliable, sometimes opens System information
+    "<wait10s>open '/System/Applications/System Settings.app'<enter>",
+    "<wait120s>",
     # Navigate to "Sharing"
     "<wait10s><leftCtrlOn><f2><leftCtrlOff><right><right><right><down>Sharing<enter>",
     # Navigate to "Screen Sharing" and enable it
     "<wait10s><tab><tab><tab><tab><tab><spacebar>",
+    # Type in the password to allow enabling Screen Sharing
+    "<wait10s>admin<enter>",
     # Navigate to "Remote Login" and enable it
     "<wait10s><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><spacebar>",
     # Quit System Settings
     "<wait10s><leftAltOn>q<leftAltOff>",
     # Disable Gatekeeper (1/2)
-    "<wait10s><leftAltOn><spacebar><leftAltOff>Terminal<enter>",
     "<wait10s>sudo spctl --global-disable<enter>",
     "<wait10s>admin<enter>",
-    "<wait10s><leftAltOn>q<leftAltOff>",
     # Disable Gatekeeper (2/2)
-    "<wait10s><leftAltOn><spacebar><leftAltOff>System Settings<enter>",
+    # On Tahoe opening System Settings through Spotlight is not very reliable, sometimes opens System information
+    "<wait10s>open '/System/Applications/System Settings.app'<enter>",
     "<wait10s><leftCtrlOn><f2><leftCtrlOff><right><right><right><down>Privacy & Security<enter>",
-    "<wait10s><leftShiftOn><tab><tab><tab><tab><tab><leftShiftOff>",
+    "<wait10s><leftShiftOn><tab><tab><tab><tab><tab><tab><leftShiftOff>",
     "<wait10s><down><wait1s><down><wait1s><enter>",
     "<wait10s>admin<enter>",
     "<wait10s><leftShiftOn><tab><leftShiftOff><wait1s><spacebar>",
@@ -152,25 +160,4 @@ build {
       "spctl --status | grep -q 'assessments disabled'"
     ]
   }
-
-  provisioner "shell" {
-    inline = [
-      # Install command-line tools
-      "touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress",
-      "softwareupdate --list | sed -n 's/.*Label: \\(Command Line Tools .*\\)/\\1/p' | tr '\\n' '\\0' | xargs -0 -I {} softwareupdate --install '{}'",
-      "rm /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress",
-    ]
-  }
-
-  provisioner "ansible" {
-    playbook_file = "ansible/playbook-system-updater.yml"
-    extra_arguments = [
-      "-vvv",
-    ]
-    ansible_env_vars = [
-      "ANSIBLE_TRANSPORT=paramiko",
-      "ANSIBLE_HOST_KEY_CHECKING=False",
-    ]
-    use_proxy = false
-  }
 }

templates/xcode.pkr.hcl

@@ -20,6 +20,17 @@ variable "additional_ios_builds" {
   default = []
 }
 
+variable "additional_tvos_builds" {
+  type = list(string)
+  default = []
+}
+
+variable "xcode_components" {
+  type    = list(string)
+  default = []
+  description = "Additional Xcode components to download."
+}
+
 variable "expected_runtimes_file" {
   type    = string
   default = ""
@@ -33,7 +44,7 @@ variable "tag" {
 
 variable "disk_size" {
   type = number
-  default = 120
+  default = 140
 }
 
 variable "disk_free_mb" {
@@ -43,7 +54,7 @@ variable "disk_free_mb" {
 
 variable "android_sdk_tools_version" {
   type    = string
-  default = "11076708" # https://developer.android.com/studio#command-line-tools-only
+  default = "14742923" # https://developer.android.com/studio#command-line-tools-only
 }
 
 source "tart-cli" "tart" {
@@ -89,6 +100,9 @@ build {
       "brew --version",
       "brew update",
       "brew upgrade",
+      "brew install codex",
+      "brew install --cask claude-code",
+      "brew install --cask amazon-q"
     ]
   }
 
@@ -119,14 +133,14 @@ build {
       "rm android-sdk-tools.zip",
       "mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/latest",
       "yes | sdkmanager --licenses",
-      "yes | sdkmanager 'platform-tools' 'platforms;android-35' 'build-tools;35.0.0' 'ndk;27.2.12479018'"
+      "yes | sdkmanager 'platform-tools' 'platforms;android-36' 'build-tools;36.0.0' 'ndk;28.2.13676358'"
     ]
   }
 
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
-      "brew install xcodesorg/made/xcodes",
+      "brew install xcodes",
       "xcodes version",
     ]
   }
@@ -194,13 +208,34 @@ build {
     )
   }
 
+  provisioner "shell" {
+    inline = concat(
+      ["source ~/.zprofile"],
+      [
+        for runtime in var.additional_tvos_builds : "xcodebuild -downloadPlatform tvOS -buildVersion ${runtime}"
+      ]
+    )
+  }
+
+  provisioner "shell" {
+    inline = concat(
+      ["source ~/.zprofile"],
+      [
+        for component in var.xcode_components : "xcodebuild -downloadComponent ${component}"
+      ]
+    )
+  }
+
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
       "brew install libimobiledevice ideviceinstaller ios-deploy carthage",
       "brew install xcbeautify swiftformat swiftlint swiftgen licenseplist",
-      "brew install mint tuist/tuist/tuist",
-      "rbenv global 3.3.9", # fastlane conflicts with 3.4.0+ https://github.com/fastlane/fastlane/issues/29527
+      "brew install mint",
+      "brew tap tuist/tuist",
+      "brew install --formula tuist",
+      "rbenv install 3.3.10",
+      "rbenv global 3.3.10", # fastlane conflicts with 3.4.0+ https://github.com/fastlane/fastlane/issues/29527
       "gem update",
       "gem install fastlane",
       "gem install cocoapods",
@@ -307,6 +342,19 @@ build {
     ]
   }
 
+  # Wait for the "update_dyld_sim_shared_cache" process[1][2] to finish
+  # to avoid wasting CPU cycles after boot
+  #
+  # [1]: https://apple.stackexchange.com/questions/412101/update-dyld-sim-shared-cache-is-taking-up-a-lot-of-memory
+  # [2]: https://stackoverflow.com/a/68394101/9316533
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "xcrun simctl runtime dyld_shared_cache update --all || sleep 180",
+      "xcrun simctl list -v"
+    ]
+  }
+
   # Compatibility with GitHub Actions Runner Images, where
   # /usr/local/bin belongs to the default user. Also see [2].
   #
@@ -318,17 +366,6 @@ build {
     ]
   }
 
-  # Wait for the "update_dyld_sim_shared_cache" process[1][2] to finish
-  # to avoid wasting CPU cycles after boot
-  #
-  # [1]: https://apple.stackexchange.com/questions/412101/update-dyld-sim-shared-cache-is-taking-up-a-lot-of-memory
-  # [2]: https://stackoverflow.com/a/68394101/9316533
-  provisioner "shell" {
-    inline = [
-      "sleep 1800"
-    ]
-  }
-
   // Install setup-info-generator
   provisioner "shell" {
     inline = [