tart login: read whole stdin contents instead of just a line (#170)

* Make sure we don't craft an URLComponents with an empty query items

* Prevent auth() infinite loop

* OCI: ignore invalid RFC 3339 formatted dates

Sources/tart/Commands/Login.swift

@@ -30,7 +30,9 @@ struct Login: AsyncParsableCommand {
 
       if let username = username {
         user = username
-        password = readLine()!
+
+        let passwordData = FileHandle.standardInput.readDataToEndOfFile()
+        password = String(decoding: passwordData, as: UTF8.self)
       } else {
         (user, password) = try StdinCredentials.retrieve()
       }

Sources/tart/Commands/Run.swift

@@ -36,6 +36,14 @@ struct Run: AsyncParsableCommand {
 
   @Flag var withSoftnet: Bool = false
 
+  @Option(help: ArgumentHelp("""
+    Additional disk attachments with an optional read-only specifier\n(e.g. --disk=\"disk.bin\" --disk=\"disk.bin:ro\")
+    """, discussion: """
+    Learn how to create a disk image using Disk Utility here:
+    https://support.apple.com/en-gb/guide/disk-utility/dskutl11888/mac
+    """))
+  var disk: [String] = []
+
   func validate() throws {
     if vnc && vncExperimental {
       throw ValidationError("--vnc and --vnc-experimental are mutually exclusive")
@@ -43,9 +51,13 @@ struct Run: AsyncParsableCommand {
   }
 
   @MainActor
-  func run() async throws {    
+  func run() async throws {
     let vmDir = try VMStorageLocal().open(name)
-    vm = try VM(vmDir: vmDir, withSoftnet: withSoftnet)
+    vm = try VM(
+      vmDir: vmDir,
+      withSoftnet: withSoftnet,
+      additionalDiskAttachments: additionalDiskAttachments()
+    )
 
     let vncImpl: VNC? = try {
       if vnc {
@@ -81,10 +93,10 @@ struct Run: AsyncParsableCommand {
       } catch {
         if error.localizedDescription.contains("Failed to lock auxiliary storage.") {
           print("Virtual machine \"\(name)\" is already running!")
-        } else {
-          print(error)
+          Foundation.exit(2)
         }
 
+        print(error)
         Foundation.exit(1)
       }
     }
@@ -102,6 +114,27 @@ struct Run: AsyncParsableCommand {
     }
   }
 
+  func additionalDiskAttachments() throws -> [VZDiskImageStorageDeviceAttachment] {
+    var result: [VZDiskImageStorageDeviceAttachment] = []
+    let readOnlySuffix = ":ro"
+
+    for rawDisk in disk {
+      if rawDisk.hasSuffix(readOnlySuffix) {
+        result.append(try VZDiskImageStorageDeviceAttachment(
+          url: URL(fileURLWithPath: String(rawDisk.prefix(rawDisk.count - readOnlySuffix.count))),
+          readOnly: true
+        ))
+      } else {
+        result.append(try VZDiskImageStorageDeviceAttachment(
+          url: URL(fileURLWithPath: rawDisk),
+          readOnly: false
+        ))
+      }
+    }
+
+    return result
+  }
+
   private func runUI() {
     let nsApp = NSApplication.shared
     nsApp.setActivationPolicy(.regular)

Sources/tart/Config.swift

@@ -1,11 +1,23 @@
 import Foundation
 
 struct Config {
-  public static let tartHomeDir: URL = FileManager.default
-          .homeDirectoryForCurrentUser
-          .appendingPathComponent(".tart", isDirectory: true)
+  let tartHomeDir: URL
+  let tartCacheDir: URL
 
-  public static let tartCacheDir: URL = tartHomeDir.appendingPathComponent("cache", isDirectory: true)
+  init() {
+    var tartHomeDir: URL
+
+    if let customTartHome = ProcessInfo.processInfo.environment["TART_HOME"] {
+      tartHomeDir = URL(fileURLWithPath: customTartHome)
+    } else {
+      tartHomeDir = FileManager.default
+              .homeDirectoryForCurrentUser
+              .appendingPathComponent(".tart", isDirectory: true)
+    }
+
+    self.tartHomeDir = tartHomeDir
+    tartCacheDir = tartHomeDir.appendingPathComponent("cache", isDirectory: true)
+  }
 
   static func jsonEncoder() -> JSONEncoder {
     let encoder = JSONEncoder()

Sources/tart/Credentials/KeychainCredentialsProvider.swift

@@ -35,27 +35,30 @@ class KeychainCredentialsProvider: CredentialsProvider {
 
     func store(host: String, user: String, password: String) throws {
         let passwordData = password.data(using: .utf8)
-        let attributes: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
-                                         kSecAttrAccount as String: user,
-                                         kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
-                                         kSecAttrServer as String: host,
-                                         kSecValueData as String: passwordData,
-                                         kSecAttrLabel as String: "Tart Credentials",
+        let key: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
+                                  kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
+                                  kSecAttrServer as String: host,
+                                  kSecAttrLabel as String: "Tart Credentials",
+        ]
+        let value: [String: Any] = [kSecAttrAccount as String: user,
+                                    kSecValueData as String: passwordData,
         ]
 
-        let status = SecItemAdd(attributes as CFDictionary, nil)
+        let status = SecItemCopyMatching(key as CFDictionary, nil)
 
         switch status {
+        case errSecItemNotFound:
+            let status = SecItemAdd(key.merging(value) { (current, _) in current } as CFDictionary, nil)
+            if status != errSecSuccess {
+              throw CredentialsProviderError.Failed(message: "Keychain failed to add item: \(status.explanation())")
+            }
         case errSecSuccess:
-            return
-        case errSecDuplicateItem:
-            let status = SecItemUpdate(attributes as CFDictionary,
-                [kSecValueData as String : passwordData] as CFDictionary)
+            let status = SecItemUpdate(key as CFDictionary, value as CFDictionary)
             if status != errSecSuccess {
               throw CredentialsProviderError.Failed(message: "Keychain failed to update item: \(status.explanation())")
             }
         default:
-            throw CredentialsProviderError.Failed(message: "Keychain failed to add item: \(status.explanation())")
+            throw CredentialsProviderError.Failed(message: "Keychain failed to find item: \(status.explanation())")
         }
     }
 }

Sources/tart/OCI/Registry.swift

@@ -2,6 +2,7 @@ import Foundation
 import NIOCore
 import NIOHTTP1
 import AsyncHTTPClient
+import NIOPosix
 
 enum RegistryError: Error {
   case UnexpectedHTTPStatusCode(when: String, code: UInt, details: String = "")
@@ -38,15 +39,16 @@ struct TokenResponse: Decodable, Authentication {
 
     decoder.keyDecodingStrategy = .convertFromSnakeCase
 
-    // RFC3339 date formatter from Apple's documentation[1]
-    //
-    // [1]: https://developer.apple.com/documentation/foundation/dateformatter
-    let dateFormatter = DateFormatter()
-    dateFormatter.locale = Locale(identifier: "en_US_POSIX")
-    dateFormatter.dateFormat = "yyyy-MM-dd'T'HH:mm:ssZZZZZ"
+    let dateFormatter = ISO8601DateFormatter()
+    dateFormatter.formatOptions = [.withInternetDateTime]
     dateFormatter.timeZone = TimeZone(secondsFromGMT: 0)
 
-    decoder.dateDecodingStrategy = .formatted(dateFormatter)
+    decoder.dateDecodingStrategy = .custom { decoder in
+      let container = try decoder.singleValueContainer()
+      let dateString = try container.decode(String.self)
+
+      return dateFormatter.date(from: dateString) ?? Date()
+    }
 
     return try decoder.decode(TokenResponse.self, from: fromData)
   }
@@ -75,8 +77,10 @@ struct TokenResponse: Decodable, Authentication {
 }
 
 class Registry {
-  private let httpClient = HTTPClient(eventLoopGroupProvider: .createNew)
-  
+  private let httpClient = HTTPClient(
+    eventLoopGroupProvider: .shared(MultiThreadedEventLoopGroup(numberOfThreads: 1))
+  )
+
   deinit {
     try! httpClient.syncShutdown()
   }
@@ -226,11 +230,12 @@ class Registry {
     _ urlComponents: URLComponents,
     headers: Dictionary<String, String> = Dictionary(),
     parameters: Dictionary<String, String> = Dictionary(),
-    body: Data? = nil
+    body: Data? = nil,
+    doAuth: Bool = true
   ) async throws -> HTTPClientResponse {
     var urlComponents = urlComponents
 
-    if urlComponents.queryItems == nil {
+    if urlComponents.queryItems == nil && !parameters.isEmpty {
       urlComponents.queryItems = []
     }
     urlComponents.queryItems?.append(contentsOf: parameters.map { key, value -> URLQueryItem in
@@ -312,7 +317,7 @@ class Registry {
       headers["Authorization"] = "Basic \(encodedCredentials!)"
     }
 
-    let response = try await rawRequest(.GET, authenticateURL, headers: headers)
+    let response = try await rawRequest(.GET, authenticateURL, headers: headers, doAuth: false)
     if response.status != .ok {
       let body = try await response.body.readTextResponse() ?? ""
       throw RegistryError.AuthFailed(why: "received unexpected HTTP status code \(response.status.code) "

Sources/tart/VM.swift

@@ -25,7 +25,10 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
 
   var softnet: Softnet? = nil
 
-  init(vmDir: VMDirectory, withSoftnet: Bool = false) throws {
+  init(vmDir: VMDirectory,
+       withSoftnet: Bool = false,
+       additionalDiskAttachments: [VZDiskImageStorageDeviceAttachment] = []
+  ) throws {
     let auxStorage = VZMacAuxiliaryStorage(contentsOf: vmDir.nvramURL)
 
     name = vmDir.name
@@ -37,7 +40,7 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     }
 
     let configuration = try Self.craftConfiguration(diskURL: vmDir.diskURL, auxStorage: auxStorage, vmConfig: config,
-      softnet: softnet)
+      softnet: softnet, additionalDiskAttachments: additionalDiskAttachments)
     virtualMachine = VZVirtualMachine(configuration: configuration)
 
     super.init()
@@ -53,7 +56,7 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     }
 
 
-    let ipswCacheFolder = Config.tartCacheDir.appendingPathComponent("IPSWs", isDirectory: true)
+    let ipswCacheFolder = Config().tartCacheDir.appendingPathComponent("IPSWs", isDirectory: true)
     try FileManager.default.createDirectory(at: ipswCacheFolder, withIntermediateDirectories: true)
 
     let expectedIPSWLocation = ipswCacheFolder.appendingPathComponent("\(image.buildVersion).ipsw", isDirectory: false)
@@ -94,7 +97,13 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     }
   }
 
-  init(vmDir: VMDirectory, ipswURL: URL?, diskSizeGB: UInt16, withSoftnet: Bool = false) async throws {
+  init(
+    vmDir: VMDirectory,
+    ipswURL: URL?,
+    diskSizeGB: UInt16,
+    withSoftnet: Bool = false,
+    additionalDiskAttachments: [VZDiskImageStorageDeviceAttachment] = []
+  ) async throws {
     let ipswURL = ipswURL != nil ? ipswURL! : try await VM.retrieveLatestIPSW();
 
     // Load the restore image and try to get the requirements
@@ -132,7 +141,7 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     }
 
     let configuration = try Self.craftConfiguration(diskURL: vmDir.diskURL, auxStorage: auxStorage, vmConfig: config,
-      softnet: softnet)
+      softnet: softnet, additionalDiskAttachments: additionalDiskAttachments)
     virtualMachine = VZVirtualMachine(configuration: configuration)
 
     super.init()
@@ -183,7 +192,8 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     diskURL: URL,
     auxStorage: VZMacAuxiliaryStorage,
     vmConfig: VMConfig,
-    softnet: Softnet? = nil
+    softnet: Softnet? = nil,
+    additionalDiskAttachments: [VZDiskImageStorageDeviceAttachment]
   ) throws -> VZVirtualMachineConfiguration {
     let configuration = VZVirtualMachineConfiguration()
 
@@ -227,7 +237,11 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
 
     // Audio
     let soundDeviceConfiguration = VZVirtioSoundDeviceConfiguration()
-    soundDeviceConfiguration.streams = [VZVirtioSoundDeviceInputStreamConfiguration(), VZVirtioSoundDeviceOutputStreamConfiguration()]
+    let inputAudioStreamConfiguration = VZVirtioSoundDeviceInputStreamConfiguration()
+    inputAudioStreamConfiguration.source = VZHostAudioInputStreamSource()
+    let outputAudioStreamConfiguration = VZVirtioSoundDeviceOutputStreamConfiguration()
+    outputAudioStreamConfiguration.sink = VZHostAudioOutputStreamSink()
+    soundDeviceConfiguration.streams = [inputAudioStreamConfiguration, outputAudioStreamConfiguration]
     configuration.audioDevices = [soundDeviceConfiguration]
 
     // Keyboard and mouse
@@ -247,9 +261,9 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     configuration.networkDevices = [vio]
 
     // Storage
-    let attachment = try VZDiskImageStorageDeviceAttachment(url: diskURL, readOnly: false)
-    let storage = VZVirtioBlockDeviceConfiguration(attachment: attachment)
-    configuration.storageDevices = [storage]
+    var attachments = [try VZDiskImageStorageDeviceAttachment(url: diskURL, readOnly: false)]
+    attachments.append(contentsOf: additionalDiskAttachments)
+    configuration.storageDevices = attachments.map { VZVirtioBlockDeviceConfiguration(attachment: $0) }
 
     // Entropy
     configuration.entropyDevices = [VZVirtioEntropyDeviceConfiguration()]

Sources/tart/VMStorageLocal.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 class VMStorageLocal {
-  let baseURL: URL = Config.tartHomeDir.appendingPathComponent("vms", isDirectory: true)
+  let baseURL: URL = Config().tartHomeDir.appendingPathComponent("vms", isDirectory: true)
 
   private func vmURL(_ name: String) -> URL {
     baseURL.appendingPathComponent(name, isDirectory: true)

Sources/tart/VMStorageOCI.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 class VMStorageOCI {
-  let baseURL = Config.tartCacheDir.appendingPathComponent("OCIs", isDirectory: true)
+  let baseURL = Config().tartCacheDir.appendingPathComponent("OCIs", isDirectory: true)
 
   private func vmURL(_ name: RemoteName) -> URL {
     baseURL.appendingRemoteName(name)