tart login: read whole stdin contents instead of just a line (#170)

* Make sure we don't craft an URLComponents with an empty query items

* Prevent auth() infinite loop

* OCI: ignore invalid RFC 3339 formatted dates

README.md

@@ -55,6 +55,31 @@ config from above will just work in Cirrus CI and your tasks will be executed in
 
 **Note:** Cirrus CI only allows [images managed and regularly updated by us](https://github.com/orgs/cirruslabs/packages?tab=packages&q=macos).
 
+### Retrieving artifacts from within Tart VMs
+
+In many cases there is a need to retrieve particular files or a folder from within a Tart virtual machine.
+For example, the below `.cirrus.yml` configuration defines a single task that builds a `tart` binary and
+exposes it via [`artifacts` instruction](https://cirrus-ci.org/guide/writing-tasks/#artifacts-instruction):
+
+```yaml
+task:
+  name: Build
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-monterey-xcode:latest
+  build_script: swift build --product tart
+  binary_artifacts:
+    path: .build/debug/tart
+```
+
+Running Cirrus CLI with `--artifacts-dir` will write defined `artifacts` to the provided local directory on the host:
+
+```bash
+cirrus run --artifacts-dir artifacts
+```
+
+Note that all retrieved artifacts will be prefixed with the associated task name and `artifacts` instruction name.
+For the example above, `tart` binary will be saved to `$PWD/artifacts/Build/binary/.build/debug/tart`.
+
 ## Virtual Machine Management
 
 ### Creating from scratch

Sources/tart/ARP/ARPCache.swift

@@ -1,119 +0,0 @@
-import Foundation
-import Network
-import Virtualization
-
-struct ARPCommandFailedError: Error, CustomStringConvertible {
-  var terminationReason: Process.TerminationReason
-  var terminationStatus: Int32
-
-  var description: String {
-    var reason: String
-
-    switch terminationReason {
-    case .exit:
-      reason = "exit code \(terminationStatus)"
-    case .uncaughtSignal:
-      reason = "uncaught signal"
-    default:
-      reason = "unknown reason"
-    }
-
-    return "arp command failed: \(reason)"
-  }
-}
-
-struct ARPCommandYieldedInvalidOutputError: Error, CustomStringConvertible {
-  var explanation: String
-
-  var description: String {
-    "arp command yielded invalid output: \(explanation)"
-  }
-}
-
-struct ARPCacheInternalError: Error, CustomStringConvertible {
-  var explanation: String
-
-  var description: String {
-    "ARPCache internal error: \(explanation)"
-  }
-}
-
-struct ARPCache {
-  static func ResolveMACAddress(macAddress: MACAddress, bridgeOnly: Bool = true) throws -> IPv4Address? {
-    let process = Process.init()
-    process.executableURL = URL.init(fileURLWithPath: "/usr/sbin/arp")
-    process.arguments = ["-an"]
-
-    let pipe = Pipe()
-    process.standardOutput = pipe
-    process.standardError = pipe
-    process.standardInput = FileHandle.nullDevice
-
-    try process.run()
-    process.waitUntilExit()
-
-    if !(process.terminationReason == .exit && process.terminationStatus == 0) {
-      throw ARPCommandFailedError(
-        terminationReason: process.terminationReason,
-        terminationStatus: process.terminationStatus)
-    }
-
-    guard let rawLines = try pipe.fileHandleForReading.readToEnd() else {
-      throw ARPCommandYieldedInvalidOutputError(explanation: "empty output")
-    }
-    let lines = String(decoding: rawLines, as: UTF8.self)
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-            .components(separatedBy: "\n")
-
-    // Based on https://opensource.apple.com/source/network_cmds/network_cmds-606.40.2/arp.tproj/arp.c.auto.html
-    let regex = try NSRegularExpression(pattern: #"^.* \((?<ip>.*)\) at (?<mac>.*) on (?<interface>.*) .*$"#)
-
-    for line in lines {
-      let nsLineRange = NSRange(line.startIndex..<line.endIndex, in: line)
-
-      guard let match = regex.firstMatch(in: line, range: nsLineRange) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "unparseable entry \"\(line)\"")
-      }
-
-      let rawIP = try match.getCaptureGroup(name: "ip", for: line)
-      guard let ip = IPv4Address(rawIP) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "failed to parse IPv4 address \(rawIP)")
-      }
-
-      let rawMAC = try match.getCaptureGroup(name: "mac", for: line)
-      if rawMAC == "(incomplete)" {
-        continue
-      }
-      guard let mac = MACAddress(fromString: rawMAC) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "failed to parse MAC address \(rawMAC)")
-      }
-
-      let interface = try match.getCaptureGroup(name: "interface", for: line)
-      if bridgeOnly && !interface.starts(with: "bridge") {
-        continue
-      }
-
-      if macAddress == mac {
-        return ip
-      }
-    }
-
-    return nil
-  }
-}
-
-extension NSTextCheckingResult {
-  func getCaptureGroup(name: String, for string: String) throws -> String {
-    let nsRange = self.range(withName: name)
-
-    if nsRange.location == NSNotFound {
-      throw ARPCacheInternalError(explanation: "attempted to retrieve non-existent named capture group \(name)")
-    }
-
-    guard let range = Range.init(nsRange, in: string) else {
-      throw ARPCacheInternalError(explanation: "failed to convert NSRange to Range")
-    }
-
-    return String(string[range])
-  }
-}

Sources/tart/Commands/IP.swift

@@ -38,7 +38,7 @@ struct IP: AsyncParsableCommand {
     let vmMacAddress = MACAddress(fromString: config.macAddress.string)!
 
     repeat {
-      if let ip = try ARPCache.ResolveMACAddress(macAddress: vmMacAddress) {
+      if let ip = try Leases().resolveMACAddress(macAddress: vmMacAddress) {
         return ip
       }
 

Sources/tart/Commands/Login.swift

@@ -8,9 +8,34 @@ struct Login: AsyncParsableCommand {
   @Argument(help: "host")
   var host: String
 
+  @Option(help: "username")
+  var username: String?
+
+  @Flag(help: "password-stdin")
+  var passwordStdin: Bool = false
+
+  func validate() throws {
+    let usernameProvided = username != nil
+    let passwordProvided = passwordStdin
+
+    if usernameProvided != passwordProvided {
+      throw ValidationError("both --username and --password-stdin are required")
+    }
+  }
+
   func run() async throws {
     do {
-      let (user, password) = try StdinCredentials.retrieve()
+      var user: String
+      var password: String
+
+      if let username = username {
+        user = username
+
+        let passwordData = FileHandle.standardInput.readDataToEndOfFile()
+        password = String(decoding: passwordData, as: UTF8.self)
+      } else {
+        (user, password) = try StdinCredentials.retrieve()
+      }
       let credentialsProvider = DictionaryCredentialsProvider([
         host: (user, password)
       ])

Sources/tart/Commands/Run.swift

@@ -24,42 +24,79 @@ struct Run: AsyncParsableCommand {
   
   @Flag(help: ArgumentHelp(
           "Use screen sharing instead of the built-in UI.",
-          discussion: "Useful since VNC supports copy/paste, drag and drop, etc.\nNote that Remote Login option should be enabled inside the VM.")) 
+          discussion: "Useful since Screen Sharing supports copy/paste, drag and drop, etc.\n"
+            + "Note that Remote Login option should be enabled inside the VM."))
   var vnc: Bool = false
 
+  @Flag(help: ArgumentHelp(
+    "Use Virtualization.Framework's VNC server instead of the build-in UI.",
+    discussion: "Useful since this type of VNC is available in recovery mode and in macOS installation.\n"
+      + "Note that this feature is experimental and there may be bugs present when using VNC."))
+  var vncExperimental: Bool = false
+
   @Flag var withSoftnet: Bool = false
 
-  @MainActor
-  func run() async throws {    
-    let vmDir = try VMStorageLocal().open(name)
-    vm = try VM(vmDir: vmDir, withSoftnet: withSoftnet)
+  @Option(help: ArgumentHelp("""
+    Additional disk attachments with an optional read-only specifier\n(e.g. --disk=\"disk.bin\" --disk=\"disk.bin:ro\")
+    """, discussion: """
+    Learn how to create a disk image using Disk Utility here:
+    https://support.apple.com/en-gb/guide/disk-utility/dskutl11888/mac
+    """))
+  var disk: [String] = []
 
-    var vncWrapper: VNCWrapper?
-
-    if vnc {
-        vncWrapper = VNCWrapper(virtualMachine: vm!.virtualMachine)
+  func validate() throws {
+    if vnc && vncExperimental {
+      throw ValidationError("--vnc and --vnc-experimental are mutually exclusive")
     }
+  }
+
+  @MainActor
+  func run() async throws {
+    let vmDir = try VMStorageLocal().open(name)
+    vm = try VM(
+      vmDir: vmDir,
+      withSoftnet: withSoftnet,
+      additionalDiskAttachments: additionalDiskAttachments()
+    )
+
+    let vncImpl: VNC? = try {
+      if vnc {
+        let vmConfig = try VMConfig.init(fromURL: vmDir.configURL)
+        return ScreenSharingVNC(vmConfig: vmConfig)
+      } else if vncExperimental {
+        return FullFledgedVNC(virtualMachine: vm!.virtualMachine)
+      } else {
+        return nil
+      }
+    }()
 
     let task = Task {
       do {
-        if let vncWrapper = vncWrapper {
-          await vncWrapper.open()
+        if let vncImpl = vncImpl {
+          let vncURL = try await vncImpl.waitForURL()
+
+          if noGraphics || ProcessInfo.processInfo.environment["CI"] != nil {
+            print("VNC server is running at \(vncURL)")
+          } else {
+            print("Opening \(vncURL)...")
+            NSWorkspace.shared.open(vncURL)
+          }
         }
 
         try await vm!.run(recovery)
 
-        if let vncWrapper = vncWrapper {
-          try vncWrapper.stop()
+        if let vncImpl = vncImpl {
+          try vncImpl.stop()
         }
 
         Foundation.exit(0)
       } catch {
         if error.localizedDescription.contains("Failed to lock auxiliary storage.") {
           print("Virtual machine \"\(name)\" is already running!")
-        } else {
-          print(error)
+          Foundation.exit(2)
         }
 
+        print(error)
         Foundation.exit(1)
       }
     }
@@ -70,13 +107,34 @@ struct Run: AsyncParsableCommand {
     }
     sigintSrc.activate()
 
-    if noGraphics || vnc {
+    if noGraphics || vnc || vncExperimental {
       dispatchMain()
     } else {
       runUI()
     }
   }
 
+  func additionalDiskAttachments() throws -> [VZDiskImageStorageDeviceAttachment] {
+    var result: [VZDiskImageStorageDeviceAttachment] = []
+    let readOnlySuffix = ":ro"
+
+    for rawDisk in disk {
+      if rawDisk.hasSuffix(readOnlySuffix) {
+        result.append(try VZDiskImageStorageDeviceAttachment(
+          url: URL(fileURLWithPath: String(rawDisk.prefix(rawDisk.count - readOnlySuffix.count))),
+          readOnly: true
+        ))
+      } else {
+        result.append(try VZDiskImageStorageDeviceAttachment(
+          url: URL(fileURLWithPath: rawDisk),
+          readOnly: false
+        ))
+      }
+    }
+
+    return result
+  }
+
   private func runUI() {
     let nsApp = NSApplication.shared
     nsApp.setActivationPolicy(.regular)

Sources/tart/Config.swift

@@ -1,9 +1,33 @@
 import Foundation
 
 struct Config {
-  public static let tartHomeDir: URL = FileManager.default
-          .homeDirectoryForCurrentUser
-          .appendingPathComponent(".tart", isDirectory: true)
+  let tartHomeDir: URL
+  let tartCacheDir: URL
 
-  public static let tartCacheDir: URL = tartHomeDir.appendingPathComponent("cache", isDirectory: true)
+  init() {
+    var tartHomeDir: URL
+
+    if let customTartHome = ProcessInfo.processInfo.environment["TART_HOME"] {
+      tartHomeDir = URL(fileURLWithPath: customTartHome)
+    } else {
+      tartHomeDir = FileManager.default
+              .homeDirectoryForCurrentUser
+              .appendingPathComponent(".tart", isDirectory: true)
+    }
+
+    self.tartHomeDir = tartHomeDir
+    tartCacheDir = tartHomeDir.appendingPathComponent("cache", isDirectory: true)
+  }
+
+  static func jsonEncoder() -> JSONEncoder {
+    let encoder = JSONEncoder()
+
+    encoder.outputFormatting = [.sortedKeys]
+
+    return encoder
+  }
+
+  static func jsonDecoder() -> JSONDecoder {
+    JSONDecoder()
+  }
 }

Sources/tart/Credentials/KeychainCredentialsProvider.swift

@@ -34,21 +34,37 @@ class KeychainCredentialsProvider: CredentialsProvider {
     }
 
     func store(host: String, user: String, password: String) throws {
-        let attributes: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
-                                         kSecAttrAccount as String: user,
-                                         kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
-                                         kSecAttrServer as String: host,
-                                         kSecValueData as String: password,
-                                         kSecAttrLabel as String: "Tart Credentials",
+        let passwordData = password.data(using: .utf8)
+        let key: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
+                                  kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
+                                  kSecAttrServer as String: host,
+                                  kSecAttrLabel as String: "Tart Credentials",
+        ]
+        let value: [String: Any] = [kSecAttrAccount as String: user,
+                                    kSecValueData as String: passwordData,
         ]
 
-        let status = SecItemAdd(attributes as CFDictionary, nil)
+        let status = SecItemCopyMatching(key as CFDictionary, nil)
 
         switch status {
-        case errSecSuccess, errSecDuplicateItem:
-            return
+        case errSecItemNotFound:
+            let status = SecItemAdd(key.merging(value) { (current, _) in current } as CFDictionary, nil)
+            if status != errSecSuccess {
+              throw CredentialsProviderError.Failed(message: "Keychain failed to add item: \(status.explanation())")
+            }
+        case errSecSuccess:
+            let status = SecItemUpdate(key as CFDictionary, value as CFDictionary)
+            if status != errSecSuccess {
+              throw CredentialsProviderError.Failed(message: "Keychain failed to update item: \(status.explanation())")
+            }
         default:
-            throw CredentialsProviderError.Failed(message: "Keychain returned unsuccessful status \(status)")
+            throw CredentialsProviderError.Failed(message: "Keychain failed to find item: \(status.explanation())")
         }
     }
 }
+
+extension OSStatus {
+  func explanation() -> CFString {
+    SecCopyErrorMessageString(self, nil) ?? "Unknown status code \(self)." as CFString
+  }
+}

Sources/tart/MACAddressResolver/Lease.swift

@@ -0,0 +1,32 @@
+import Network
+
+struct Lease {
+  var mac: MACAddress
+  var ip: IPv4Address
+
+  init?(fromRawLease: [String : String]) {
+    // Retrieve the required fields
+    guard let hwAddress = fromRawLease["hw_address"] else { return nil }
+    guard let ipAddress = fromRawLease["ip_address"] else { return nil }
+
+    // Parse MAC address
+    let hwAddressSplits = hwAddress.split(separator: ",")
+    if hwAddressSplits.count != 2 {
+      return nil
+    }
+    if let hwAddressProto = Int(hwAddressSplits[0]), hwAddressProto != ARPHRD_ETHER {
+      return nil
+    }
+    guard let mac = MACAddress(fromString: String(hwAddressSplits[1])) else {
+      return nil
+    }
+
+    // Parse IP address
+    guard let ip = IPv4Address(ipAddress) else {
+      return nil
+    }
+
+    self.ip = ip
+    self.mac = mac
+  }
+}

Sources/tart/MACAddressResolver/Leases.swift

@@ -0,0 +1,106 @@
+import Foundation
+import Network
+
+enum LeasesError: Error {
+  case UnexpectedFormat(name: String = "unexpected DHCPD leases file format", message: String, line: Int)
+  case Truncated(name: String = "truncated DHCPD leases file")
+
+  var description: String {
+    switch self {
+
+    case .UnexpectedFormat(name: let name, message: let message, line: let line):
+      return "\(name) on line \(line): \(message)"
+    case .Truncated(name: let name):
+      return "\(name)"
+    }
+  }
+}
+
+class Leases {
+  private let leases: [MACAddress : Lease]
+
+  convenience init() throws {
+    try self.init(URL(fileURLWithPath: "/var/db/dhcpd_leases"))
+  }
+
+  convenience init(_ fromURL: URL) throws {
+    let fileContents = try String(contentsOf: fromURL, encoding: .utf8)
+
+    try self.init(fileContents)
+  }
+
+  init(_ fromString: String) throws {
+    var leases: [MACAddress : Lease] = Dictionary()
+
+    for lease in try Self.retrieveRawLeases(fromString).compactMap({ Lease(fromRawLease: $0) }) {
+      leases[lease.mac] = lease
+    }
+
+    self.leases = leases
+  }
+
+  /// Parse leases from the host cache similarly to the PLCache_read() function found in Apple's Open Source releases.
+  ///
+  /// [1]: https://github.com/apple-opensource/bootp/blob/master/bootplib/NICache.c#L285-L391
+  private static func retrieveRawLeases(_ dhcpdLeasesContents: String) throws -> [[String : String]] {
+    var rawLeases: [[String : String]] = Array()
+
+    enum State {
+      case Nowhere
+      case Start
+      case Body
+      case End
+    }
+    var state = State.Nowhere
+
+    var currentRawLease: [String : String] = Dictionary()
+
+    for (lineNumber, line) in dhcpdLeasesContents.split(separator: "\n").enumerated().map({ ($0 + 1, $1) }) {
+      if line == "{" {
+        // Handle lease block start
+        if state != .Nowhere && state != .End {
+          throw LeasesError.UnexpectedFormat(message: "unexpected lease block start ({)", line: lineNumber)
+        }
+
+        state = .Start
+      } else if line == "}" {
+        // Handle lease block end
+        if state != .Body {
+          throw LeasesError.UnexpectedFormat(message: "unexpected lease block end (})", line: lineNumber)
+        }
+
+        rawLeases.append(currentRawLease)
+        currentRawLease = Dictionary()
+
+        state = .End
+      } else {
+        // Handle lease block contents
+        let lineWithoutTabs = String(line.drop { $0 == " " || $0 == "\t"})
+
+        if lineWithoutTabs.isEmpty {
+          continue
+        }
+
+        let splits = lineWithoutTabs.split(separator: "=", maxSplits: 1)
+        if splits.count != 2 {
+          throw LeasesError.UnexpectedFormat(message: "key-value pair with only a key", line: lineNumber)
+        }
+        let (key, value) = (String(splits[0]), String(splits[1]))
+
+        currentRawLease[key] = value
+
+        state = .Body
+      }
+    }
+
+    if state == .Start || state == .Body {
+      throw LeasesError.Truncated()
+    }
+
+    return rawLeases
+  }
+
+  func resolveMACAddress(macAddress: MACAddress) throws -> IPv4Address? {
+    leases[macAddress]?.ip
+  }
+}

Sources/tart/MACAddressResolver/MACAddress.swift

@@ -1,6 +1,6 @@
 import Foundation
 
-struct MACAddress: Equatable, CustomStringConvertible {
+struct MACAddress: Equatable, Hashable, CustomStringConvertible {
   var mac: [UInt8] = Array(repeating: 0, count: 6)
 
   init?(fromString: String) {

Sources/tart/OCI/Authentication.swift

@@ -0,0 +1,21 @@
+import Foundation
+
+protocol Authentication {
+  func header() -> (String, String)
+  func isValid() -> Bool
+}
+
+struct BasicAuthentication: Authentication {
+  let user: String
+  let password: String
+
+  func header() -> (String, String) {
+    let creds = Data("\(user):\(password)".utf8).base64EncodedString()
+
+    return ("Authorization", "Basic \(creds)")
+  }
+
+  func isValid() -> Bool {
+    true
+  }
+}

Sources/tart/OCI/Manifest.swift

@@ -24,8 +24,16 @@ struct OCIManifest: Codable, Equatable {
     }
   }
 
+  init(fromJSON: Data) throws {
+    self = try Config.jsonDecoder().decode(Self.self, from: fromJSON)
+  }
+
+  func toJSON() throws -> Data {
+    try Config.jsonEncoder().encode(self)
+  }
+
   func digest() throws -> String {
-    try Digest.hash(JSONEncoder().encode(self))
+    try Digest.hash(toJSON())
   }
 
   func uncompressedDiskSize() -> UInt64? {
@@ -37,6 +45,15 @@ struct OCIManifest: Codable, Equatable {
   }
 }
 
+struct OCIConfig: Codable {
+  var architecture: String = "arm64"
+  var os: String = "darwin"
+
+  func toJSON() throws -> Data {
+    try Config.jsonEncoder().encode(self)
+  }
+}
+
 struct OCIManifestConfig: Codable, Equatable {
   var mediaType: String = ociConfigMediaType
   var size: Int

Sources/tart/OCI/Registry.swift

@@ -2,6 +2,7 @@ import Foundation
 import NIOCore
 import NIOHTTP1
 import AsyncHTTPClient
+import NIOPosix
 
 enum RegistryError: Error {
   case UnexpectedHTTPStatusCode(when: String, code: UInt, details: String = "")
@@ -25,7 +26,7 @@ extension HTTPClientResponse.Body {
   }
 }
 
-struct TokenResponse: Decodable {
+struct TokenResponse: Decodable, Authentication {
   let defaultIssuedAt = Date()
   let defaultExpiresIn = 60
 
@@ -34,19 +35,20 @@ struct TokenResponse: Decodable {
   var issuedAt: Date?
 
   static func parse(fromData: Data) throws -> Self {
-    let decoder = JSONDecoder()
+    let decoder = Config.jsonDecoder()
 
     decoder.keyDecodingStrategy = .convertFromSnakeCase
 
-    // RFC3339 date formatter from Apple's documentation[1]
-    //
-    // [1]: https://developer.apple.com/documentation/foundation/dateformatter
-    let dateFormatter = DateFormatter()
-    dateFormatter.locale = Locale(identifier: "en_US_POSIX")
-    dateFormatter.dateFormat = "yyyy-MM-dd'T'HH:mm:ssZZZZZ"
+    let dateFormatter = ISO8601DateFormatter()
+    dateFormatter.formatOptions = [.withInternetDateTime]
     dateFormatter.timeZone = TimeZone(secondsFromGMT: 0)
 
-    decoder.dateDecodingStrategy = .formatted(dateFormatter)
+    decoder.dateDecodingStrategy = .custom { decoder in
+      let container = try decoder.singleValueContainer()
+      let dateString = try container.decode(String.self)
+
+      return dateFormatter.date(from: dateString) ?? Date()
+    }
 
     return try decoder.decode(TokenResponse.self, from: fromData)
   }
@@ -65,16 +67,20 @@ struct TokenResponse: Decodable {
     }
   }
 
-  var isValid: Bool {
-    get {
-      Date() < tokenExpiresAt
-    }
+  func header() -> (String, String) {
+    ("Authorization", "Bearer \(token)")
+  }
+
+  func isValid() -> Bool {
+    Date() < tokenExpiresAt
   }
 }
 
 class Registry {
-  private let httpClient = HTTPClient(eventLoopGroupProvider: .createNew)
-  
+  private let httpClient = HTTPClient(
+    eventLoopGroupProvider: .shared(MultiThreadedEventLoopGroup(numberOfThreads: 1))
+  )
+
   deinit {
     try! httpClient.syncShutdown()
   }
@@ -83,7 +89,7 @@ class Registry {
   let namespace: String
   let credentialsProvider: CredentialsProvider
 
-  var currentAuthToken: TokenResponse? = nil
+  var currentAuthToken: Authentication? = nil
 
   init(urlComponents: URLComponents,
        namespace: String,
@@ -116,7 +122,7 @@ class Registry {
   }
 
   func pushManifest(reference: String, manifest: OCIManifest) async throws -> String {
-    let manifestJSON = try JSONEncoder().encode(manifest)
+    let manifestJSON = try manifest.toJSON()
 
     let response = try await endpointRequest(.PUT, "\(namespace)/manifests/\(reference)",
       headers: ["Content-Type": manifest.mediaType],
@@ -139,7 +145,7 @@ class Registry {
     }
 
     let manifestData = try await response.body.readResponse()
-    let manifest = try JSONDecoder().decode(OCIManifest.self, from: manifestData)
+    let manifest = try OCIManifest(fromJSON: manifestData)
 
     return (manifest, manifestData)
   }
@@ -224,11 +230,12 @@ class Registry {
     _ urlComponents: URLComponents,
     headers: Dictionary<String, String> = Dictionary(),
     parameters: Dictionary<String, String> = Dictionary(),
-    body: Data? = nil
+    body: Data? = nil,
+    doAuth: Bool = true
   ) async throws -> HTTPClientResponse {
     var urlComponents = urlComponents
 
-    if urlComponents.queryItems == nil {
+    if urlComponents.queryItems == nil && !parameters.isEmpty {
       urlComponents.queryItems = []
     }
     urlComponents.queryItems?.append(contentsOf: parameters.map { key, value -> URLQueryItem in
@@ -245,7 +252,7 @@ class Registry {
     }
 
     // Invalidate token if it has expired
-    if currentAuthToken?.isValid == false {
+    if currentAuthToken?.isValid() == false {
       currentAuthToken = nil
     }
 
@@ -266,6 +273,15 @@ class Registry {
     }
 
     let wwwAuthenticate = try WWWAuthenticate(rawHeaderValue: wwwAuthenticateRaw)
+
+    if wwwAuthenticate.scheme == "Basic" {
+      if let (user, password) = try credentialsProvider.retrieve(host: baseURL.host!) {
+        currentAuthToken = BasicAuthentication(user: user, password: password)
+      }
+
+      return
+    }
+
     if wwwAuthenticate.scheme != "Bearer" {
       throw RegistryError.AuthFailed(why: "WWW-Authenticate header's authentication scheme "
         + "\"\(wwwAuthenticate.scheme)\" is unsupported, expected \"Bearer\" scheme")
@@ -301,7 +317,7 @@ class Registry {
       headers["Authorization"] = "Basic \(encodedCredentials!)"
     }
 
-    let response = try await rawRequest(.GET, authenticateURL, headers: headers)
+    let response = try await rawRequest(.GET, authenticateURL, headers: headers, doAuth: false)
     if response.status != .ok {
       let body = try await response.body.readTextResponse() ?? ""
       throw RegistryError.AuthFailed(why: "received unexpected HTTP status code \(response.status.code) "
@@ -316,7 +332,8 @@ class Registry {
     var request = request
 
     if let token = currentAuthToken {
-      request.headers.add(name: "Authorization", value: "Bearer \(token.token)")
+      let (name, value) = token.header()
+      request.headers.add(name: name, value: value)
     }
 
     return try await httpClient.execute(request, deadline: .distantFuture)

Sources/tart/VM.swift

@@ -25,7 +25,10 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
 
   var softnet: Softnet? = nil
 
-  init(vmDir: VMDirectory, withSoftnet: Bool = false) throws {
+  init(vmDir: VMDirectory,
+       withSoftnet: Bool = false,
+       additionalDiskAttachments: [VZDiskImageStorageDeviceAttachment] = []
+  ) throws {
     let auxStorage = VZMacAuxiliaryStorage(contentsOf: vmDir.nvramURL)
 
     name = vmDir.name
@@ -37,7 +40,7 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     }
 
     let configuration = try Self.craftConfiguration(diskURL: vmDir.diskURL, auxStorage: auxStorage, vmConfig: config,
-      softnet: softnet)
+      softnet: softnet, additionalDiskAttachments: additionalDiskAttachments)
     virtualMachine = VZVirtualMachine(configuration: configuration)
 
     super.init()
@@ -53,7 +56,7 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     }
 
 
-    let ipswCacheFolder = Config.tartCacheDir.appendingPathComponent("IPSWs", isDirectory: true)
+    let ipswCacheFolder = Config().tartCacheDir.appendingPathComponent("IPSWs", isDirectory: true)
     try FileManager.default.createDirectory(at: ipswCacheFolder, withIntermediateDirectories: true)
 
     let expectedIPSWLocation = ipswCacheFolder.appendingPathComponent("\(image.buildVersion).ipsw", isDirectory: false)
@@ -94,7 +97,13 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     }
   }
 
-  init(vmDir: VMDirectory, ipswURL: URL?, diskSizeGB: UInt16, withSoftnet: Bool = false) async throws {
+  init(
+    vmDir: VMDirectory,
+    ipswURL: URL?,
+    diskSizeGB: UInt16,
+    withSoftnet: Bool = false,
+    additionalDiskAttachments: [VZDiskImageStorageDeviceAttachment] = []
+  ) async throws {
     let ipswURL = ipswURL != nil ? ipswURL! : try await VM.retrieveLatestIPSW();
 
     // Load the restore image and try to get the requirements
@@ -132,7 +141,7 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     }
 
     let configuration = try Self.craftConfiguration(diskURL: vmDir.diskURL, auxStorage: auxStorage, vmConfig: config,
-      softnet: softnet)
+      softnet: softnet, additionalDiskAttachments: additionalDiskAttachments)
     virtualMachine = VZVirtualMachine(configuration: configuration)
 
     super.init()
@@ -183,7 +192,8 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     diskURL: URL,
     auxStorage: VZMacAuxiliaryStorage,
     vmConfig: VMConfig,
-    softnet: Softnet? = nil
+    softnet: Softnet? = nil,
+    additionalDiskAttachments: [VZDiskImageStorageDeviceAttachment]
   ) throws -> VZVirtualMachineConfiguration {
     let configuration = VZVirtualMachineConfiguration()
 
@@ -227,7 +237,11 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
 
     // Audio
     let soundDeviceConfiguration = VZVirtioSoundDeviceConfiguration()
-    soundDeviceConfiguration.streams = [VZVirtioSoundDeviceInputStreamConfiguration(), VZVirtioSoundDeviceOutputStreamConfiguration()]
+    let inputAudioStreamConfiguration = VZVirtioSoundDeviceInputStreamConfiguration()
+    inputAudioStreamConfiguration.source = VZHostAudioInputStreamSource()
+    let outputAudioStreamConfiguration = VZVirtioSoundDeviceOutputStreamConfiguration()
+    outputAudioStreamConfiguration.sink = VZHostAudioOutputStreamSink()
+    soundDeviceConfiguration.streams = [inputAudioStreamConfiguration, outputAudioStreamConfiguration]
     configuration.audioDevices = [soundDeviceConfiguration]
 
     // Keyboard and mouse
@@ -247,9 +261,9 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     configuration.networkDevices = [vio]
 
     // Storage
-    let attachment = try VZDiskImageStorageDeviceAttachment(url: diskURL, readOnly: false)
-    let storage = VZVirtioBlockDeviceConfiguration(attachment: attachment)
-    configuration.storageDevices = [storage]
+    var attachments = [try VZDiskImageStorageDeviceAttachment(url: diskURL, readOnly: false)]
+    attachments.append(contentsOf: additionalDiskAttachments)
+    configuration.storageDevices = attachments.map { VZVirtioBlockDeviceConfiguration(attachment: $0) }
 
     // Entropy
     configuration.entropyDevices = [VZVirtioEntropyDeviceConfiguration()]

Sources/tart/VMConfig.swift

@@ -59,12 +59,16 @@ struct VMConfig: Codable {
     memorySize = memorySizeMin
   }
 
-  init(fromData: Data) throws {
-    self = try JSONDecoder().decode(VMConfig.self, from: fromData)
+  init(fromJSON: Data) throws {
+    self = try Config.jsonDecoder().decode(Self.self, from: fromJSON)
   }
 
   init(fromURL: URL) throws {
-    self = try Self(fromData: try Data(contentsOf: fromURL))
+    self = try Self(fromJSON: try Data(contentsOf: fromURL))
+  }
+
+  func toJSON() throws -> Data {
+    try Config.jsonEncoder().encode(self)
   }
 
   func save(toURL: URL) throws {

Sources/tart/VMDirectory+OCI.swift

@@ -139,12 +139,7 @@ extension VMDirectory {
     layers.append(OCIManifestLayer(mediaType: Self.nvramMediaType, size: nvram.count, digest: nvramDigest))
 
     // Craft a stub OCI config for Docker Hub compatibility
-    struct OCIConfig: Codable {
-      var architecture: String = "arm64"
-      var os: String = "darwin"
-    }
-
-    let ociConfigJSON = try JSONEncoder().encode(OCIConfig())
+    let ociConfigJSON = try OCIConfig().toJSON()
     let ociConfigDigest = try await registry.pushBlob(fromData: ociConfigJSON)
     let manifest = OCIManifest(
             config: OCIManifestConfig(size: ociConfigJSON.count, digest: ociConfigDigest),

Sources/tart/VMStorageLocal.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 class VMStorageLocal {
-  let baseURL: URL = Config.tartHomeDir.appendingPathComponent("vms", isDirectory: true)
+  let baseURL: URL = Config().tartHomeDir.appendingPathComponent("vms", isDirectory: true)
 
   private func vmURL(_ name: String) -> URL {
     baseURL.appendingPathComponent(name, isDirectory: true)

Sources/tart/VMStorageOCI.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 class VMStorageOCI {
-  let baseURL = Config.tartCacheDir.appendingPathComponent("OCIs", isDirectory: true)
+  let baseURL = Config().tartCacheDir.appendingPathComponent("OCIs", isDirectory: true)
 
   private func vmURL(_ name: RemoteName) -> URL {
     baseURL.appendingRemoteName(name)

Sources/tart/VNC/FullFledgedVNC.swift

@@ -0,0 +1,38 @@
+import Foundation
+import Dynamic
+import Virtualization
+
+class FullFledgedVNC: VNC {
+    let password: String
+    private let vnc: Dynamic
+
+    init(virtualMachine: VZVirtualMachine) {
+        password = Array(PassphraseGenerator().prefix(4)).joined(separator: "-")
+        let securityConfiguration = Dynamic._VZVNCAuthenticationSecurityConfiguration(password: password)
+        vnc = Dynamic._VZVNCServer(port: 0, queue: DispatchQueue.global(),
+                securityConfiguration: securityConfiguration)
+        vnc.virtualMachine = virtualMachine
+        vnc.start()
+    }
+
+    func waitForURL() async throws -> URL {
+      while true {
+        // Port is 0 shortly after start(),
+        // but will be initialized later
+        if let port = vnc.port.asUInt16, port != 0 {
+          return URL(string: "vnc://:\(password)@127.0.0.1:\(port)")!
+        }
+
+        // Wait 50 ms.
+        try await Task.sleep(nanoseconds: 50_000_000)
+      }
+    }
+
+    func stop() throws {
+        vnc.stop()
+    }
+
+    deinit {
+        try? stop()
+    }
+}

Sources/tart/VNC/ScreenSharingVNC.swift

@@ -0,0 +1,25 @@
+import Foundation
+import Dynamic
+import Virtualization
+
+class ScreenSharingVNC: VNC {
+  let vmConfig: VMConfig
+
+  init(vmConfig: VMConfig) {
+    self.vmConfig = vmConfig
+  }
+
+  func waitForURL() async throws -> URL {
+    let ip = try await IP.resolveIP(vmConfig, secondsToWait: 60)
+
+    if let ip = ip {
+      return URL(string: "vnc://\(ip)")!
+    }
+
+    throw IPNotFound()
+  }
+
+  func stop() throws {
+    // nothing to do
+  }
+}

Sources/tart/VNC/VNC.swift

@@ -0,0 +1,6 @@
+import Foundation
+
+protocol VNC {
+  func waitForURL() async throws -> URL
+  func stop() throws
+}

Sources/tart/VNCWrapper.swift

@@ -1,53 +0,0 @@
-import Foundation
-import Dynamic
-import Virtualization
-
-class VNCWrapper {
-    private let password: String
-    private let vnc: Dynamic
-
-    init(virtualMachine: VZVirtualMachine) {
-        password = Array(PassphraseGenerator().prefix(4)).joined(separator: "-")
-        let securityConfiguration = Dynamic._VZVNCAuthenticationSecurityConfiguration(password: password)
-        vnc = Dynamic._VZVNCServer(port: 0, queue: DispatchQueue.global(),
-                securityConfiguration: securityConfiguration)
-        vnc.virtualMachine = virtualMachine
-        vnc.start()
-    }
-
-    func open() async {
-        do {
-            let port = try await Self.waitForPort(vnc: vnc)
-
-            let url = URL(string: "vnc://:\(password)@127.0.0.1:\(port)")!
-            print("Opening \(url)...")
-
-            if ProcessInfo.processInfo.environment["CI"] == nil {
-                NSWorkspace.shared.open(url)
-            }
-        } catch {
-            print("Failed to retrieve a VNC server port: \(error)")
-        }
-    }
-
-    func stop() throws {
-        vnc.stop()
-    }
-
-    deinit {
-        try? stop()
-    }
-
-    private static func waitForPort(vnc: Dynamic) async throws -> UInt16 {
-        while true {
-            // Port is 0 shortly after start(),
-            // but will be initialized later
-            if let port = vnc.port.asUInt16, port != 0 {
-                return port
-            }
-
-            // Wait 50 ms.
-            try await Task.sleep(nanoseconds: 50_000_000)
-        }
-    }
-}

Tests/TartTests/MACAddressResolverTests.swift

@@ -0,0 +1,35 @@
+import XCTest
+import Network
+@testable import tart
+
+final class MACAddressResolverTests: XCTestCase {
+  func testSingleEntry() throws {
+    let leases = try Leases("""
+                            {
+                              ip_address=1.2.3.4
+                              hw_address=1,00:11:22:33:44:55
+                            }
+                            """)
+
+    XCTAssertEqual(IPv4Address("1.2.3.4"),
+      try leases.resolveMACAddress(macAddress: MACAddress(fromString: "00:11:22:33:44:55")!))
+  }
+
+  func testMultipleEntries() throws {
+    let leases = try Leases("""
+                            {
+                              ip_address=1.2.3.4
+                              hw_address=1,00:11:22:33:44:55
+                            }
+                            {
+                              ip_address=5.6.7.8
+                              hw_address=1,AA:BB:CC:DD:EE:FF
+                            }
+                            """)
+
+    XCTAssertEqual(IPv4Address("1.2.3.4"),
+      try leases.resolveMACAddress(macAddress: MACAddress(fromString: "00:11:22:33:44:55")!))
+    XCTAssertEqual(IPv4Address("5.6.7.8"),
+      try leases.resolveMACAddress(macAddress: MACAddress(fromString: "AA:BB:CC:DD:EE:FF")!))
+  }
+}

Tests/TartTests/RegistryTests.swift

@@ -62,11 +62,7 @@ final class RegistryTests: XCTestCase {
 
     func testPushPullManifest() async throws {
         // Craft a basic config
-        struct OCIConfig: Codable {
-            var architecture: String = "arm64"
-            var os: String = "darwin"
-        }
-        let configData = try JSONEncoder().encode(OCIConfig())
+        let configData = try OCIConfig().toJSON()
         let configDigest = try await registry.pushBlob(fromData: configData)
 
         // Craft a basic layer

Tests/TartTests/TokenResponseTests.swift

@@ -11,7 +11,7 @@ final class TokenResponseTests: XCTestCase {
     let expectedTokenExpiresAtRange = Date()...Date().addingTimeInterval(60)
     XCTAssertTrue(expectedTokenExpiresAtRange.contains(tokenResponse.tokenExpiresAt))
 
-    XCTAssertTrue(tokenResponse.isValid)
+    XCTAssertTrue(tokenResponse.isValid())
   }
 
   func testExpirationBasic() throws {
@@ -23,9 +23,9 @@ final class TokenResponseTests: XCTestCase {
     let expectedTokenExpiresAtRange = Date()...Date().addingTimeInterval(2)
     XCTAssertTrue(expectedTokenExpiresAtRange.contains(tokenResponse.tokenExpiresAt))
 
-    XCTAssertTrue(tokenResponse.isValid)
+    XCTAssertTrue(tokenResponse.isValid())
     _ = XCTWaiter.wait(for: [expectation(description: "Wait 3 seconds for the token to become invalid")], timeout: 2)
-    XCTAssertFalse(tokenResponse.isValid)
+    XCTAssertFalse(tokenResponse.isValid())
   }
 
   func testExpirationWithIssuedAt() throws {
@@ -33,6 +33,6 @@ final class TokenResponseTests: XCTestCase {
     let tokenResponse = try TokenResponse.parse(fromData: tokenResponseRaw)
 
     XCTAssertEqual(Date(timeIntervalSince1970: 3600), tokenResponse.tokenExpiresAt)
-    XCTAssertFalse(tokenResponse.isValid)
+    XCTAssertFalse(tokenResponse.isValid())
   }
 }