Disable apsd daemon and wait before shutting down

.ci/cirrus.base.yml

@@ -9,8 +9,6 @@ task:
   <<: *defaults
   pull_vanilla_script:
     - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest
-  install_sshpass_script:
-    - brew install sshpass
   build_base_script:
     - packer init templates/base.pkr.hcl
     - packer build -var macos_version="$MACOS_VERSION" templates/base.pkr.hcl

.ci/cirrus.release.yml

@@ -1,6 +1,8 @@
 task:
   name: "Release Xcode $CIRRUS_TAG ($MACOS_VERSION)"
   matrix:
+    - env:
+        MACOS_VERSION: sonoma
     - env:
         MACOS_VERSION: sequoia
   <<: *defaults

.ci/cirrus.runner.yml

@@ -4,11 +4,11 @@ task:
   env:
     matrix:
       - MACOS_VERSION: sonoma
-        XCODE_VERSIONS: "16.1,16,15.4,15.3,15.2,15.1,\"15.0.1\""
-        DISK_SIZE: 375
+        XCODE_VERSIONS: "16,15.4,15.3,15.2,15.1,\"15.0.1\""
+        DISK_SIZE: 350
       - MACOS_VERSION: sequoia
-        XCODE_VERSIONS: "16.2,16.1,16,15.4"
-        DISK_SIZE: 320
+        XCODE_VERSIONS: "16.1,\"16.2-beta-2\",16,15.4"
+        DISK_SIZE: 300
   <<: *defaults
   pull_base_script:
     - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest

.ci/cirrus.vanilla.yml

@@ -1,30 +1,29 @@
-env:
-  RESOLVE_VM_BASE_NAME: "ghcr.io/cirruslabs/macos-${MACOS_VERSION}-vanilla:latest"
-  RESOLVE_VM_NAME: "resolve-macos-number-task-id-${CIRRUS_TASK_ID}"
-  RESOLVE_FILE: "${RESOLVE_VM_NAME}.txt"
-
 task:
-  name: "Update Vanilla Image ($MACOS_VERSION)"
-  env:
-    matrix:
-      - MACOS_VERSION: sequoia
-      - MACOS_VERSION: sonoma
-      - MACOS_VERSION: ventura
-      - MACOS_VERSION: monterey
-  only_if: $CIRRUS_BRANCH == $CIRRUS_DEFAULT_BRANCH && changesInclude("templates/vanilla-$MACOS_VERSION.pkr.hcl")
+  name: "Update Vanilla Sonoma Image"
+  only_if: $CIRRUS_BRANCH == $CIRRUS_DEFAULT_BRANCH && changesInclude("templates/vanilla-sonoma.pkr.hcl")
   <<: *defaults
   build_script:
-    - packer init templates/vanilla-$MACOS_VERSION.pkr.hcl
-    - packer build templates/vanilla-$MACOS_VERSION.pkr.hcl
+    - packer init templates/vanilla-sonoma.pkr.hcl
+    - packer build templates/vanilla-sonoma.pkr.hcl
   disable_sip_script:
-    - packer build -var vm_name=$MACOS_VERSION-vanilla templates/disable-sip.pkr.hcl
-  resolve_macos_number_script:
-    - packer build -var vm_base_name=$RESOLVE_VM_BASE_NAME -var vm_name=$RESOLVE_VM_NAME -var resolve_file=$RESOLVE_FILE templates/resolve-macos-number.pkr.hcl
-    - echo "MACOS_NUMBER=$(cat $RESOLVE_FILE)" >> $CIRRUS_ENV
-    - rm $RESOLVE_FILE
-    - tart delete $RESOLVE_VM_NAME
+    - packer build -var vm_name=sonoma-vanilla templates/disable-sip.pkr.hcl
   push_script:
-    - tart push $MACOS_VERSION-vanilla ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:$MACOS_NUMBER
+    - tart push sonoma-vanilla ghcr.io/cirruslabs/macos-sonoma-vanilla:latest ghcr.io/cirruslabs/macos-sonoma-vanilla:14.6
   always:
     cleanup_script:
-      - tart delete $MACOS_VERSION-vanilla
+      - tart delete sonoma-vanilla
+
+task:
+  name: "Update Vanilla Sequoia Image"
+  only_if: $CIRRUS_BRANCH == $CIRRUS_DEFAULT_BRANCH && changesInclude("templates/vanilla-sequoia.pkr.hcl")
+  <<: *defaults
+  build_script:
+    - packer init templates/vanilla-sequoia.pkr.hcl
+    - packer build templates/vanilla-sequoia.pkr.hcl
+  disable_sip_script:
+    - packer build -var vm_name=sequoia-vanilla templates/disable-sip.pkr.hcl
+  push_script:
+    - tart push sequoia-vanilla ghcr.io/cirruslabs/macos-sequoia-vanilla:latest ghcr.io/cirruslabs/macos-sequoia-vanilla:15.1
+  always:
+    cleanup_script:
+      - tart delete sequoia-vanilla

.ci/cirrus.xcode.yml

@@ -4,19 +4,17 @@ task:
   env:
     matrix:
       - MACOS_VERSION: sequoia
-        XCODE_VERSION: 16.2
+        XCODE_VERSION: 16.1
         LATEST: true
       - MACOS_VERSION: sequoia
-        XCODE_VERSION: 16.1
+        XCODE_VERSION: 16.2-beta-2
       - MACOS_VERSION: sequoia
         XCODE_VERSION: 16
       - MACOS_VERSION: sequoia
         XCODE_VERSION: 15.4
-      - MACOS_VERSION: sonoma
-        XCODE_VERSION: 16.1
-        LATEST: true
       - MACOS_VERSION: sonoma
         XCODE_VERSION: 16
+        LATEST: true
       - MACOS_VERSION: sonoma
         XCODE_VERSION: 15.4
       - MACOS_VERSION: sonoma

.cirrus.star

@@ -16,18 +16,14 @@ def on_build_failed(ctx):
   if "Cron" not in ctx.payload.data.build.changeMessageTitle:
     return
 
-  resp = http.post(env.get("SLACK_WEBHOOK_URL"), headers={
+  resp = http.post("https://slack.com/api/chat.postMessage", headers={
     "Content-Type": "application/json",
+    "Authorization": "Bearer " + env.get("SLACK_TOKEN"),
   }, json_body={
-    "text": "Build {build_id} (\"{change_message_title}\") failed on branch \"{branch_name}\" in repository \"{repository_name}\".".format(
-      build_id=ctx.payload.data.build.id,
-      change_message_title=ctx.payload.data.build.changeMessageTitle,
-      branch_name=ctx.payload.data.build.branch,
-      repository_name=ctx.payload.data.repository.name,
-    ),
-    "url": "https://cirrus-ci.com/build/{build_id}".format(
-      build_id=ctx.payload.data.build.id,
-    ),
+    "channel": "#image-updates",
+    "text": "Build <https://cirrus-ci.com/build/{build_id}|{build_id} (\"{change_message_title}\")> failed on branch \"{branch_name}\" in repository \"{repository_name}\".".format(
+      build_id=ctx.payload.data.build.id, change_message_title=ctx.payload.data.build.changeMessageTitle,
+      branch_name=ctx.payload.data.build.branch, repository_name=ctx.payload.data.repository.name),
   })
 
   if resp.status_code != 200:

README.md

@@ -25,8 +25,8 @@ Some of the images are regularly getting rebuild in order to update the pre-inst
 monthly on the first Saturday of the month:
 
 * `ghcr.io/cirruslabs/macos-{sequoia,sonoma}-base`
-* `ghcr.io/cirruslabs/macos-runner:sonoma` which is a superset of `ghcr.io/cirruslabs/macos-sonoma-xcode:{latest,16.1,16,15.4,15.3,15.2,15.1,15.0.1}`
-* `ghcr.io/cirruslabs/macos-runner:sequoia` which is a superset of `ghcr.io/cirruslabs/macos-sequoia-xcode:{latest,16.2,16.1,16,15.4}`
+* `ghcr.io/cirruslabs/macos-runner:sonoma` which is a superset of `ghcr.io/cirruslabs/macos-sonoma-xcode:{latest,16,15.4,15.3,15.2,15.1,15.0.1}`
+* `ghcr.io/cirruslabs/macos-runner:sequoia` which is a superset of `ghcr.io/cirruslabs/macos-sequoia-xcode:{latest,16.1,16.2-beta-2,16,15.4}`
 
 Note that `ghcr.io/cirruslabs/macos-runner:{sequoia,sonoma}` are updated every Sunday and these images are [optimised for startup](https://cirrus-runners.app/blog/2024/04/11/optimizing-startup-time-of-cirrus-runners/)
 on Cirrus Runners and Cirrus CI services.

ansible/playbook-system-updater.yml

@@ -1,5 +0,0 @@
-- hosts: default
-  roles:
-    - system-updater
-  vars:
-    ansible_password: admin

ansible/roles/system-updater/tasks/main.yml

@@ -1,27 +0,0 @@
-- name: Perform first "softwareupdate" invocation
-  include_tasks: softwareupdate.yml
-
-# Needed after a major macOS update, otherwise things like
-# Command Line Tools won't be updated
-- name: Perform second "softwareupdate" invocation
-  include_tasks: softwareupdate.yml
-
-# This one looks weird, but unfortunately there's no other way around, because Homebrew
-# is not designed to run as root (see https://gist.github.com/irazasyed/7732946
-# for more details).
-- name: fix up /usr/local permissions for Homebrew
-  file:
-    path: /usr/local/share/man
-    state: directory
-    owner: "{{ ansible_user_id }}"
-    recurse: yes
-  become: yes
-
-- name: Ensure that there are no more software updates available (1/2)
-  command: "softwareupdate --all --list"
-  register: check_updates_result
-
-- name: Ensure that there are no more software updates available (2/2)
-  assert:
-    that:
-      - "'No new software available' in check_updates_result.stderr"

ansible/roles/system-updater/tasks/softwareupdate.yml

@@ -1,26 +0,0 @@
-# It seems that we must always pass "--restart" command-line argument to "softwareupdate",
-# otherwise on the OS update the "softwareupdate" will be stuck at "Downloaded: macOS [...]"
-- name: install all macOS updates
-  command:
-    cmd: "softwareupdate --all --install --agree-to-license --force --restart --user admin --stdinpass"
-    stdin: "{{ ansible_password }}"
-  register: update_result
-  # Work around the following:
-  # > Data could not be sent to remote host [...].
-  # > Make sure this host can be reached over ssh:
-  # > ssh: connect to host [...] port 22: Connection refused.
-  ignore_unreachable: yes
-  # Ignore SIGTERM/SIGKILL sent "softwareupdate" process
-  # when the system reboots due to --restart
-  failed_when: update_result.rc not in [0, 9, -9, 15, -15]
-  become: yes
-
-# Wait for the connection since the previous command could restart the host
-- name: wait for connection
-  wait_for_connection:
-    # We need to wait long enough for the "softwareupdate" to initiate the reboot,
-    # otherwise it's possible that we'll interrupt the process by running
-    # the commands below on a non-restarted system.
-    delay: 60
-    timeout: 1800
-  when: "'No updates are available' not in (update_result.stderr_lines | join('\n'))"

data/github_known_hosts

@@ -1,3 +0,0 @@
-github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
-github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
-github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

templates/base.pkr.hcl

@@ -56,34 +56,16 @@ build {
       "echo 'eval \"$(/opt/homebrew/bin/brew shellenv)\"' >> ~/.zprofile",
       "echo \"export HOMEBREW_NO_AUTO_UPDATE=1\" >> ~/.zprofile",
       "echo \"export HOMEBREW_NO_INSTALL_CLEANUP=1\" >> ~/.zprofile",
-    ]
-  }
-
-  provisioner "shell" {
-    inline = [
       "source ~/.zprofile",
       "brew --version",
       "brew update",
-      "brew install wget unzip zip ca-certificates cmake gcc git-lfs jq yq gh gitlab-runner",
-      "brew install curl || true", // doesn't work on Monterey
+      "brew install curl wget unzip zip ca-certificates cmake gcc git-lfs jq yq gh gitlab-runner",
       "brew install --cask git-credential-manager",
       "git lfs install",
       "sudo softwareupdate --install-rosetta --agree-to-license"
     ]
   }
 
-  // Add GitHub to known hosts
-  // Similar to https://github.com/actions/runner-images/blob/main/images/macos/scripts/build/configure-ssh.sh
-  provisioner "shell" {
-    inline = [
-      "mkdir -p ~/.ssh"
-    ]
-  }
-  provisioner "file" {
-    source      = "data/github_known_hosts"
-    destination = "~/.ssh/known_hosts"
-  }
-
   // Install the GitHub Actions runner
   provisioner "shell" {
     script = "scripts/install-actions-runner.sh"
@@ -144,9 +126,7 @@ build {
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
-      "test -d /Users/runner",
-      "test -f ~/.ssh/known_hosts",
-      "brew doctor"
+      "test -d /Users/runner"
     ]
   }
 }

templates/resolve-macos-number.pkr.hcl

@@ -1,46 +0,0 @@
-packer {
-  required_plugins {
-    tart = {
-      version = ">= 1.12.0"
-      source  = "github.com/cirruslabs/tart"
-    }
-  }
-}
-
-variable "vm_base_name" {
-  type = string
-}
-
-variable "vm_name" {
-  type = string
-}
-
-variable "resolve_file" {
-  type = string
-}
-
-source "tart-cli" "tart" {
-  vm_base_name = "${var.vm_base_name}"
-  vm_name      = "${var.vm_name}"
-  cpu_count    = 4
-  memory_gb    = 8
-  ssh_password = "admin"
-  ssh_username = "admin"
-  ssh_timeout  = "120s"
-}
-
-build {
-  sources = ["source.tart-cli.tart"]
-
-  provisioner "shell" {
-    inline = [
-      "sw_vers --productVersion > /tmp/sw-vers-product-version.txt",
-    ]
-  }
-
-  provisioner "file" {
-    source = "/tmp/sw-vers-product-version.txt"
-    destination = "${var.resolve_file}"
-    direction = "download"
-  }
-}

templates/vanilla-monterey.pkr.hcl

@@ -1,139 +0,0 @@
-packer {
-  required_plugins {
-    tart = {
-      version = ">= 1.2.0"
-      source  = "github.com/cirruslabs/tart"
-    }
-    ansible = {
-      version = "~> 1"
-      source = "github.com/hashicorp/ansible"
-    }
-  }
-}
-
-source "tart-cli" "tart" {
-  # You can find macOS IPSW URLs on various websites like https://ipsw.me/
-  from_ipsw    = "https://updates.cdn-apple.com/2022FallFCS/fullrestores/012-66032/8D8D90C6-A876-4FFF-BBF4-D158939B3841/UniversalMac_12.6.1_21G217_Restore.ipsw"
-  vm_name      = "monterey-vanilla"
-  cpu_count    = 4
-  memory_gb    = 8
-  disk_size_gb = 40
-  ssh_password = "admin"
-  ssh_username = "admin"
-  ssh_timeout  = "120s"
-  boot_command = [
-    # hello, hola, bonjour, etc.
-    "<wait60s><spacebar>",
-    # Language: most of the times we have a list of "English"[1], "English (UK)", etc. with
-    # "English" language already selected. If we type "english", it'll cause us to switch
-    # to the "English (UK)", which is not what we want. To solve this, we switch to some other
-    # language first, e.g. "Italiano" and then switch back to "English". We'll then jump to the
-    # first entry in a list of "english"-prefixed items, which will be "English".
-    #
-    # [1]: should be named "English (US)", but oh well 🤷
-    "<wait30s>italiano<esc>english<enter>",
-    # Select Your Country and Region
-    "<wait30s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Written and Spoken Languages
-    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Accessibility
-    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Data & Privacy
-    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Migration Assistant
-    "<wait10s><tab><tab><tab><spacebar>",
-    # Sign In with Your Apple ID
-    "<wait10s><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Are you sure you want to skip signing in with an Apple ID?
-    "<wait10s><tab><spacebar>",
-    # Terms and Conditions
-    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # I have read and agree to the macOS Software License Agreement
-    "<wait10s><tab><spacebar>",
-    # Create a Computer Account
-    "<wait10s>admin<tab><tab>admin<tab>admin<tab><tab><tab><spacebar>",
-    # Enable Location Services
-    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Are you sure you don't want to use Location Services?
-    "<wait10s><tab><spacebar>",
-    # Select Your Time Zone
-    "<wait10s><tab>UTC<enter><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Analytics
-    "<wait10s><tab><spacebar><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Screen Time
-    "<wait10s><tab><spacebar>",
-    # Siri
-    "<wait10s><tab><spacebar><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Choose Your Look
-    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Enable Voice Over
-    "<wait10s><leftAltOn><f5><leftAltOff><wait5s>v",
-    # Now that the installation is done, open "System Preferences"
-    "<wait10s><leftAltOn><spacebar><leftAltOff>System Preferences<enter>",
-    # Navigate to "Sharing"
-    "<wait10s>sharing<enter>",
-    # Enable Screen Sharing
-    "<wait10s><tab><tab><tab><tab><spacebar>",
-    # Enable Remote Login
-    "<wait10s><down><down><down><down><spacebar><tab><tab><spacebar>",
-    # Disable Voice Over
-    "<leftAltOn><f5><leftAltOff>",
-  ]
-
-  // A (hopefully) temporary workaround for Virtualization.Framework's
-  // installation process not fully finishing in a timely manner
-  create_grace_time = "30s"
-
-  // Keep the recovery partition, otherwise it's not possible to "softwareupdate"
-  recovery_partition = "keep"
-}
-
-build {
-  sources = ["source.tart-cli.tart"]
-
-  provisioner "shell" {
-    inline = [
-      // Enable passwordless sudo
-      "echo admin | sudo -S sh -c \"echo 'admin ALL=(ALL) NOPASSWD: ALL' | EDITOR=tee visudo /etc/sudoers.d/admin-nopasswd\"",
-      // Enable auto-login
-      //
-      // See https://github.com/xfreebird/kcpassword for details.
-      "echo '00000000: 1ced 3f4a bcbc ba2c caca 4e82' | sudo xxd -r - /etc/kcpassword",
-      "sudo defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser admin",
-      // Disable screensaver at login screen
-      "sudo defaults write /Library/Preferences/com.apple.screensaver loginWindowIdleTime 0",
-      // Disable screensaver for admin user
-      "defaults -currentHost write com.apple.screensaver idleTime 0",
-      // Prevent the VM from sleeping
-      "sudo systemsetup -setdisplaysleep Off 2>/dev/null",
-      "sudo systemsetup -setsleep Off 2>/dev/null",
-      "sudo systemsetup -setcomputersleep Off 2>/dev/null",
-      // Launch Safari to populate the defaults
-      "/Applications/Safari.app/Contents/MacOS/Safari &",
-      "SAFARI_PID=$!",
-      "disown",
-      "sleep 30",
-      "kill -9 $SAFARI_PID",
-      // Enable Safari's remote automation
-      "sudo safaridriver --enable",
-      // Disable screen lock
-      //
-      // Note that this only works if the user is logged-in,
-      // i.e. not on login screen.
-      "sysadminctl -screenLock off -password admin",
-    ]
-  }
-
-  provisioner "shell" {
-    inline = [
-      # Install command-line tools
-      "touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress",
-      "softwareupdate --list | sed -n 's/.*Label: \\(Command Line Tools for Xcode-.*\\)/\\1/p' | xargs -I {} softwareupdate --install '{}'",
-      "rm /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress",
-    ]
-  }
-
-  provisioner "ansible" {
-    playbook_file = "ansible/playbook-system-updater.yml"
-  }
-}

templates/vanilla-sequoia.pkr.hcl

@@ -4,15 +4,11 @@ packer {
       version = ">= 1.12.0"
       source  = "github.com/cirruslabs/tart"
     }
-    ansible = {
-      version = "~> 1"
-      source = "github.com/hashicorp/ansible"
-    }
   }
 }
 
 source "tart-cli" "tart" {
-  from_ipsw    = "https://updates.cdn-apple.com/2025WinterFCS/fullrestores/072-08269/7CAAB9F7-E970-428D-8764-4CD7BCD105CD/UniversalMac_15.3_24D60_Restore.ipsw"
+  from_ipsw    = "https://updates.cdn-apple.com/2024FallFCS/fullrestores/072-12302/3786987A-AD94-4BFB-81B8-56D3841CA81B/UniversalMac_15.1_24B2083_Restore.ipsw"
   vm_name      = "sequoia-vanilla"
   cpu_count    = 4
   memory_gb    = 8
@@ -56,7 +52,7 @@ source "tart-cli" "tart" {
     # Are you sure you don't want to use Location Services?
     "<wait10s><tab><spacebar>",
     # Select Your Time Zone
-    "<wait10s><tab><tab>UTC<enter><leftShiftOn><tab><tab><leftShiftOff><spacebar>",
+    "<wait10s><tab>UTC<enter><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Analytics
     "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Screen Time
@@ -87,9 +83,6 @@ source "tart-cli" "tart" {
   // A (hopefully) temporary workaround for Virtualization.Framework's
   // installation process not fully finishing in a timely manner
   create_grace_time = "30s"
-
-  // Keep the recovery partition, otherwise it's not possible to "softwareupdate"
-  recovery_partition = "keep"
 }
 
 build {
@@ -125,17 +118,4 @@ build {
       "sysadminctl -screenLock off -password admin",
     ]
   }
-
-  provisioner "shell" {
-    inline = [
-      # Install command-line tools
-      "touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress",
-      "softwareupdate --list | sed -n 's/.*Label: \\(Command Line Tools for Xcode-.*\\)/\\1/p' | xargs -I {} softwareupdate --install '{}'",
-      "rm /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress",
-    ]
-  }
-
-  provisioner "ansible" {
-    playbook_file = "ansible/playbook-system-updater.yml"
-  }
 }

templates/vanilla-sonoma.pkr.hcl

@@ -4,10 +4,6 @@ packer {
       version = ">= 1.12.0"
       source  = "github.com/cirruslabs/tart"
     }
-    ansible = {
-      version = "~> 1"
-      source = "github.com/hashicorp/ansible"
-    }
   }
 }
 
@@ -82,9 +78,6 @@ source "tart-cli" "tart" {
   // A (hopefully) temporary workaround for Virtualization.Framework's
   // installation process not fully finishing in a timely manner
   create_grace_time = "30s"
-
-  // Keep the recovery partition, otherwise it's not possible to "softwareupdate"
-  recovery_partition = "keep"
 }
 
 build {
@@ -122,17 +115,4 @@ build {
       "sysadminctl -screenLock off -password admin",
     ]
   }
-
-  provisioner "shell" {
-    inline = [
-      # Install command-line tools
-      "touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress",
-      "softwareupdate --list | sed -n 's/.*Label: \\(Command Line Tools for Xcode-.*\\)/\\1/p' | xargs -I {} softwareupdate --install '{}'",
-      "rm /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress",
-    ]
-  }
-
-  provisioner "ansible" {
-    playbook_file = "ansible/playbook-system-updater.yml"
-  }
 }

templates/vanilla-ventura.pkr.hcl

@@ -4,10 +4,6 @@ packer {
       version = ">= 1.12.0"
       source  = "github.com/cirruslabs/tart"
     }
-    ansible = {
-      version = "~> 1"
-      source = "github.com/hashicorp/ansible"
-    }
   }
 }
 
@@ -90,9 +86,6 @@ source "tart-cli" "tart" {
   // A (hopefully) temporary workaround for Virtualization.Framework's
   // installation process not fully finishing in a timely manner
   create_grace_time = "30s"
-
-  // Keep the recovery partition, otherwise it's not possible to "softwareupdate"
-  recovery_partition = "keep"
 }
 
 build {
@@ -131,17 +124,4 @@ build {
       "defaults -currentHost write com.apple.screensaver idleTime 0"
     ]
   }
-
-  provisioner "shell" {
-    inline = [
-      # Install command-line tools
-      "touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress",
-      "softwareupdate --list | sed -n 's/.*Label: \\(Command Line Tools for Xcode-.*\\)/\\1/p' | xargs -I {} softwareupdate --install '{}'",
-      "rm /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress",
-    ]
-  }
-
-  provisioner "ansible" {
-    playbook_file = "ansible/playbook-system-updater.yml"
-  }
 }

templates/xcode.pkr.hcl

@@ -37,7 +37,7 @@ variable "disk_free_mb" {
 
 variable "android_sdk_tools_version" {
   type    = string
-  default = "11076708" # https://developer.android.com/studio#command-line-tools-only
+  default = "11076708" # https://developer.android.com/studio/#command-tools
 }
 
 source "tart-cli" "tart" {
@@ -112,7 +112,7 @@ build {
       "rm android-sdk-tools.zip",
       "mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/latest",
       "yes | sdkmanager --licenses",
-      "yes | sdkmanager 'platform-tools' 'platforms;android-35' 'build-tools;35.0.0' 'ndk;27.2.12479018'"
+      "yes | sdkmanager 'platform-tools' 'platforms;android-33' 'build-tools;34.0.0' 'ndk;25.2.9519653'"
     ]
   }
 
@@ -240,17 +240,6 @@ build {
     ]
   }
 
-  # Compatibility with GitHub Actions Runner Images, where
-  # /usr/local/bin belongs to the default user. Also see [2].
-  #
-  # [1]: https://github.com/actions/runner-images/blob/6bbddd20d76d61606bea5a0133c950cc44c370d3/images/macos/scripts/build/configure-machine.sh#L96
-  # [2]: https://github.com/actions/runner-images/discussions/7607
-  provisioner "shell" {
-    inline = [
-      "sudo chown admin /usr/local/bin"
-    ]
-  }
-
   # Wait for the "update_dyld_sim_shared_cache" process[1][2] to finish
   # to avoid wasting CPU cycles after boot
   #
@@ -258,7 +247,7 @@ build {
   # [2]: https://stackoverflow.com/a/68394101/9316533
   provisioner "shell" {
     inline = [
-      "sleep 1800"
+      "sleep 900"
     ]
   }
 }