tart login: introduce --username and --password-stdin flags (#143)

* Retrieve IP from DHCPD leases file instead of ARP cache

* Reference PLCache_read() from the retrieveRawLeases() parsing function

.ci/set-version.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+TMPFILE=$(mktemp)
+envsubst < Sources/tart/CI/CI.swift > $TMPFILE
+mv $TMPFILE Sources/tart/CI/CI.swift

.cirrus.yml

@@ -1,14 +1,16 @@
-persistent_worker:
-  labels:
-    name: Mac-Mini-M1
-
 task:
-  name: Test
+  name: Test on Ventura
+  persistent_worker:
+    labels:
+      name: Mac-Mini-M1
+  build_script: swift test
   test_script: swift test
 
 task:
   name: Build
   only_if: $CIRRUS_TAG == ''
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-monterey-xcode:14
   build_script: swift build --product tart
   sign_script: codesign --sign - --entitlements Resources/tart.entitlements --force .build/debug/tart
   binary_artifacts:
@@ -17,7 +19,13 @@ task:
 task:
   name: Release
   only_if: $CIRRUS_TAG != ''
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-monterey-xcode:14
   env:
     GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
     GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
+  install_script: brew install go goreleaser/tap/goreleaser-pro
+  info_script:
+    - xcodebuild -version
+    - swift -version
   release_script: goreleaser

.goreleaser.yml

@@ -7,12 +7,13 @@ builds:
     goarch:
       - arm64
     prebuilt:
-      path: .build/{{ .Arch }}-apple-macosx/release/tart
+      path: .build/{{ .Arch }}-apple-macosx/debug/tart
 
 before:
   hooks:
-    - swift build -c release --product tart
-    - codesign --sign - --entitlements Resources/tart.entitlements --force .build/arm64-apple-macosx/release/tart
+    - .ci/set-version.sh
+    - swift build -c debug --product tart
+    - codesign --sign - --entitlements Resources/tart.entitlements --force .build/arm64-apple-macosx/debug/tart
 
 archives:
   - id: binary
@@ -35,5 +36,7 @@ brews:
     homepage: https://github.com/cirruslabs/tart
     description: Run macOS VMs on Apple Silicon
     skip_upload: auto
+    dependencies:
+      - "cirruslabs/cli/softnet"
     custom_block: |
       depends_on :macos => :monterey

Package.resolved

@@ -1,5 +1,23 @@
 {
   "pins" : [
+    {
+      "identity" : "async-http-client",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/swift-server/async-http-client",
+      "state" : {
+        "revision" : "24425989dadab6d6e4167174791a23d4e2a6d0c3",
+        "version" : "1.10.0"
+      }
+    },
+    {
+      "identity" : "dynamic",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/mhdhejazi/Dynamic",
+      "state" : {
+        "branch" : "master",
+        "revision" : "772883073d044bc754d401cabb6574624eb3778f"
+      }
+    },
     {
       "identity" : "swift-argument-parser",
       "kind" : "remoteSourceControl",
@@ -18,6 +36,60 @@
         "version" : "0.8.1"
       }
     },
+    {
+      "identity" : "swift-log",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-log.git",
+      "state" : {
+        "revision" : "5d66f7ba25daf4f94100e7022febf3c75e37a6c7",
+        "version" : "1.4.2"
+      }
+    },
+    {
+      "identity" : "swift-nio",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio.git",
+      "state" : {
+        "revision" : "124119f0bb12384cef35aa041d7c3a686108722d",
+        "version" : "2.40.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-extras",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-extras.git",
+      "state" : {
+        "revision" : "8eea84ec6144167354387ef9244b0939f5852dc8",
+        "version" : "1.11.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-http2",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-http2.git",
+      "state" : {
+        "revision" : "72bcaf607b40d7c51044f65b0f5ed8581a911832",
+        "version" : "1.21.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-ssl",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-ssl.git",
+      "state" : {
+        "revision" : "1750873bce84b4129b5303655cce2c3d35b9ed3a",
+        "version" : "2.19.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-transport-services",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio-transport-services.git",
+      "state" : {
+        "revision" : "1a4692acb88156e3da1b0c6732a8a38b2a744166",
+        "version" : "1.12.0"
+      }
+    },
     {
       "identity" : "swift-parsing",
       "kind" : "remoteSourceControl",

Package.swift

@@ -1,7 +1,6 @@
 // swift-tools-version:5.6
 
 import PackageDescription
-
 let package = Package(
   name: "Tart",
   platforms: [
@@ -12,13 +11,18 @@ let package = Package(
   ],
   dependencies: [
     .package(url: "https://github.com/apple/swift-argument-parser", from: "1.1.2"),
+    .package(url: "https://github.com/mhdhejazi/Dynamic", branch: "master"),
     .package(url: "https://github.com/pointfreeco/swift-parsing", from: "0.9.2"),
+    .package(url: "https://github.com/swift-server/async-http-client", from: "1.10.0"),
   ],
   targets: [
     .executableTarget(name: "tart", dependencies: [
       .product(name: "ArgumentParser", package: "swift-argument-parser"),
+      .product(name: "AsyncHTTPClient", package: "async-http-client"),
+      .product(name: "Dynamic", package: "Dynamic"),
       .product(name: "Parsing", package: "swift-parsing"),
     ]),
     .testTarget(name: "TartTests", dependencies: ["tart"])
   ]
 )
+

README.md

@@ -3,7 +3,7 @@
 *Tart* is a virtualization toolset to build, run and manage virtual machines on Apple Silicon.
 Built by CI engineers for your automation needs. Here are some highlights of Tart:
 
-* Tart uses Apple's own `Virtualization.Framework` for near-native performance.
+* Tart uses Apple's own `Virtualization.Framework` for [near-native performance](https://browser.geekbench.com/v5/cpu/compare/14966395?baseline=14966339).
 * Push/Pull virtual machines from any OCI-compatible container registry.
 * Use Tart Packer Plugin to automate VM creation.
 * Built-in CI integration.
@@ -20,9 +20,13 @@ tart run monterey-base
 
 ## CI Integration
 
-[Cirrus CLI](https://github.com/cirruslabs/cirrus-cli) is an open-sourced CI-agnostic tool that can run workloads
-inside containers via Docker or Podman and now inside macOS VMs via Tart. Put the following `.cirrus.yml` file
-in the root of your repository:
+Tart itself is only responsible for managing virtual machines, but we've built Tart support into a tool called Cirrus CLI
+also developed by Cirrus Labs. [Cirrus CLI](https://github.com/cirruslabs/cirrus-cli) is a command line tool with
+one configuration format to execute common CI steps (run a script, cache a folder, etc.) locally or in any CI system.
+We built Cirrus CLI to solve "But it works on my machine!" problem.
+
+Here is an example of a `.cirrus.yml` configuration file which will start a Tart VM, will copy over working directory and
+will run scripts and [other instructions](https://cirrus-ci.org/guide/writing-tasks/#supported-instructions) inside the virtual machine:
 
 ```yaml
 task:
@@ -37,7 +41,7 @@ task:
     - sleep 15
 ```
 
-Run it locally or in CI with the following command:
+Put the above `.cirrus.yml` file in the root of your repository and run it with the following command:
 
 ```shell
 brew install cirruslabs/cli/cirrus
@@ -174,6 +178,13 @@ tart pull acme.io/remoteorg/name:latest my-local-vm-name
   disk size for new virtual machines. Here is an example of [how to change disk size in a Packer template](https://github.com/cirruslabs/macos-image-templates/blob/fb0bcf68e0b093129136875c050205a66729b596/templates/base.pkr.hcl#L15).
 </details>
 
+<details>
+  <summary>VM location on disk</summary>
+
+  Tart stores all it's files in `~/.tart/` directory. Local images that you can run are stored in `~/.tart/vms/`.
+  Remote images are pulled into `~/.tart/vms/cache/OCIs/`.
+</details>
+
 <details>
   <summary>Nested virtualization support?</summary>
 

Resources/AppIcon.png

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:8dd6af1a08bbcdc4faf0ff53601b38136c90231e11bd81bc8cd477d6f1c7d3f2
-size 209404
+oid sha256:1fe96aed7a965b075300f092a3ca76e09053eb7cf2f3125c3a819098a8bc4b31
+size 123360

Sources/tart/ARP/ARPCache.swift

@@ -1,119 +0,0 @@
-import Foundation
-import Network
-import Virtualization
-
-struct ARPCommandFailedError: Error, CustomStringConvertible {
-  var terminationReason: Process.TerminationReason
-  var terminationStatus: Int32
-
-  var description: String {
-    var reason: String
-
-    switch terminationReason {
-    case .exit:
-      reason = "exit code \(terminationStatus)"
-    case .uncaughtSignal:
-      reason = "uncaught signal"
-    default:
-      reason = "unknown reason"
-    }
-
-    return "arp command failed: \(reason)"
-  }
-}
-
-struct ARPCommandYieldedInvalidOutputError: Error, CustomStringConvertible {
-  var explanation: String
-
-  var description: String {
-    "arp command yielded invalid output: \(explanation)"
-  }
-}
-
-struct ARPCacheInternalError: Error, CustomStringConvertible {
-  var explanation: String
-
-  var description: String {
-    "ARPCache internal error: \(explanation)"
-  }
-}
-
-struct ARPCache {
-  static func ResolveMACAddress(macAddress: MACAddress, bridgeOnly: Bool = true) throws -> IPv4Address? {
-    let process = Process.init()
-    process.executableURL = URL.init(fileURLWithPath: "/usr/sbin/arp")
-    process.arguments = ["-an"]
-
-    let pipe = Pipe()
-    process.standardOutput = pipe
-    process.standardError = pipe
-    process.standardInput = FileHandle.nullDevice
-
-    try process.run()
-    process.waitUntilExit()
-
-    if !(process.terminationReason == .exit && process.terminationStatus == 0) {
-      throw ARPCommandFailedError(
-        terminationReason: process.terminationReason,
-        terminationStatus: process.terminationStatus)
-    }
-
-    guard let rawLines = try pipe.fileHandleForReading.readToEnd() else {
-      throw ARPCommandYieldedInvalidOutputError(explanation: "empty output")
-    }
-    let lines = String(decoding: rawLines, as: UTF8.self)
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-            .components(separatedBy: "\n")
-
-    // Based on https://opensource.apple.com/source/network_cmds/network_cmds-606.40.2/arp.tproj/arp.c.auto.html
-    let regex = try NSRegularExpression(pattern: #"^.* \((?<ip>.*)\) at (?<mac>.*) on (?<interface>.*) .*$"#)
-
-    for line in lines {
-      let nsLineRange = NSRange(line.startIndex..<line.endIndex, in: line)
-
-      guard let match = regex.firstMatch(in: line, range: nsLineRange) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "unparseable entry \"\(line)\"")
-      }
-
-      let rawIP = try match.getCaptureGroup(name: "ip", for: line)
-      guard let ip = IPv4Address(rawIP) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "failed to parse IPv4 address \(rawIP)")
-      }
-
-      let rawMAC = try match.getCaptureGroup(name: "mac", for: line)
-      if rawMAC == "(incomplete)" {
-        continue
-      }
-      guard let mac = MACAddress(fromString: rawMAC) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "failed to parse MAC address \(rawMAC)")
-      }
-
-      let interface = try match.getCaptureGroup(name: "interface", for: line)
-      if bridgeOnly && !interface.starts(with: "bridge") {
-        continue
-      }
-
-      if macAddress == mac {
-        return ip
-      }
-    }
-
-    return nil
-  }
-}
-
-extension NSTextCheckingResult {
-  func getCaptureGroup(name: String, for string: String) throws -> String {
-    let nsRange = self.range(withName: name)
-
-    if nsRange.location == NSNotFound {
-      throw ARPCacheInternalError(explanation: "attempted to retrieve non-existent named capture group \(name)")
-    }
-
-    guard let range = Range.init(nsRange, in: string) else {
-      throw ARPCacheInternalError(explanation: "failed to convert NSRange to Range")
-    }
-
-    return String(string[range])
-  }
-}

Sources/tart/CI/CI.swift

@@ -0,0 +1,13 @@
+struct CI {
+  private static let rawVersion = "${CIRRUS_TAG}"
+
+  static var version: String {
+    rawVersion.expanded() ? rawVersion : "SNAPSHOT"
+  }
+}
+
+private extension String {
+  func expanded() -> Bool {
+    !isEmpty && !starts(with: "$")
+  }
+}

Sources/tart/Commands/Clone.swift

@@ -11,24 +11,34 @@ struct Clone: AsyncParsableCommand {
   @Argument(help: "new VM name")
   var newName: String
 
+  func validate() throws {
+    if newName.contains("/") {
+      throw ValidationError("<new-name> should be a local name")
+    }
+  }
+
   func run() async throws {
     do {
-      if let remoteName = try? RemoteName(sourceName) {
-        if !VMStorageOCI().exists(remoteName) {
-          // Pull the VM in case it's OCI-based and doesn't exist locally yet
-          let registry = try Registry(host: remoteName.host, namespace: remoteName.namespace)
-          try await VMStorageOCI().pull(remoteName, registry: registry)
-        }
-        let remoteVM = try VMStorageHelper.open(sourceName)
+      let ociStorage = VMStorageOCI()
+      let localStorage = VMStorageLocal()
 
-        let remoteConfig = try VMConfig.init(fromURL: remoteVM.configURL)
-        let needToGenerateNewMAC = try localVMExistsWith(macAddress: remoteConfig.macAddress.string)
-
-        try remoteVM.clone(to: VMStorageLocal().create(newName), generateMAC: needToGenerateNewMAC)
-      } else {
-        try VMStorageHelper.open(sourceName).clone(to: VMStorageLocal().create(newName), generateMAC: true)
+      if let remoteName = try? RemoteName(sourceName), !ociStorage.exists(remoteName) {
+        // Pull the VM in case it's OCI-based and doesn't exist locally yet
+        let registry = try Registry(host: remoteName.host, namespace: remoteName.namespace)
+        try await ociStorage.pull(remoteName, registry: registry)
       }
 
+      let sourceVM = try VMStorageHelper.open(sourceName)
+      let generateMAC = try localStorage.hasVMsWithMACAddress(macAddress: sourceVM.macAddress())
+
+      let tmpVMDir = try VMDirectory.temporary()
+      try await withTaskCancellationHandler(operation: {
+        try sourceVM.clone(to: tmpVMDir, generateMAC: generateMAC)
+        try localStorage.move(newName, from: tmpVMDir)
+      }, onCancel: {
+        try? FileManager.default.removeItem(at: tmpVMDir.baseURL)
+      })
+
       Foundation.exit(0)
     } catch {
       print(error)
@@ -36,15 +46,16 @@ struct Clone: AsyncParsableCommand {
       Foundation.exit(1)
     }
   }
+}
 
-  private func localVMExistsWith(macAddress: String) throws -> Bool {
-    var needToGenerateNewMAC = false
-    for (_, localDir) in try VMStorageLocal().list() {
-      let localConfig = try VMConfig.init(fromURL: localDir.configURL)
-      if localConfig.macAddress.string == macAddress {
-        needToGenerateNewMAC = true
-      }
-    }
-    return needToGenerateNewMAC
+fileprivate extension VMDirectory {
+  func macAddress() throws -> String {
+    try VMConfig(fromURL: configURL).macAddress.string
+  }
+}
+
+fileprivate extension VMStorageLocal {
+  func hasVMsWithMACAddress(macAddress: String) throws -> Bool {
+    try list().contains { try $1.macAddress() == macAddress }
   }
 }

Sources/tart/Commands/Create.swift

@@ -13,7 +13,7 @@ struct Create: AsyncParsableCommand {
   var fromIPSW: String?
 
   @Option(help: ArgumentHelp("Disk size in Gb")) 
-  var diskSize: UInt8 = 32
+  var diskSize: UInt16 = 50
 
   func validate() throws {
     if fromIPSW == nil {
@@ -23,13 +23,18 @@ struct Create: AsyncParsableCommand {
 
   func run() async throws {
     do {
-      let vmDir = try VMStorageLocal().create(name)
+      let tmpVMDir = try VMDirectory.temporary()
+      try await withTaskCancellationHandler(operation: {
+        if fromIPSW! == "latest" {
+          _ = try await VM(vmDir: tmpVMDir, ipswURL: nil, diskSizeGB: diskSize)
+        } else {
+          _ = try await VM(vmDir: tmpVMDir, ipswURL: URL(fileURLWithPath: fromIPSW!), diskSizeGB: diskSize)
+        }
 
-      if fromIPSW! == "latest" {
-        _ = try await VM(vmDir: vmDir, ipswURL: nil, diskSizeGB: diskSize)
-      } else {
-        _ = try await VM(vmDir: vmDir, ipswURL: URL(fileURLWithPath: fromIPSW!), diskSizeGB: diskSize)
-      }
+        try VMStorageLocal().move(name, from: tmpVMDir)
+      }, onCancel: {
+        try? FileManager.default.removeItem(at: tmpVMDir.baseURL)
+      })
 
       Foundation.exit(0)
     } catch {

Sources/tart/Commands/IP.swift

@@ -17,7 +17,7 @@ struct IP: AsyncParsableCommand {
       let vmDir = try VMStorageLocal().open(name)
       let vmConfig = try VMConfig.init(fromURL: vmDir.configURL)
 
-      guard let ip = try await resolveIP(vmConfig, secondsToWait: wait) else {
+      guard let ip = try await IP.resolveIP(vmConfig, secondsToWait: wait) else {
         print("no IP address found, is your VM running?")
 
         Foundation.exit(1)
@@ -33,12 +33,12 @@ struct IP: AsyncParsableCommand {
     }
   }
 
-  private func resolveIP(_ config: VMConfig, secondsToWait: UInt16) async throws -> IPv4Address? {
+  static public func resolveIP(_ config: VMConfig, secondsToWait: UInt16) async throws -> IPv4Address? {
     let waitUntil = Calendar.current.date(byAdding: .second, value: Int(secondsToWait), to: Date.now)!
     let vmMacAddress = MACAddress(fromString: config.macAddress.string)!
 
     repeat {
-      if let ip = try ARPCache.ResolveMACAddress(macAddress: vmMacAddress) {
+      if let ip = try Leases().resolveMACAddress(macAddress: vmMacAddress) {
         return ip
       }
 

Sources/tart/Commands/List.swift

@@ -7,7 +7,7 @@ struct List: AsyncParsableCommand {
 
   func run() async throws {
     do {
-      print("Name\tSource")
+      print("Source\tName")
 
       displayTable("local", try VMStorageLocal().list())
       displayTable("oci", try VMStorageOCI().list())
@@ -21,7 +21,7 @@ struct List: AsyncParsableCommand {
   }
 
   private func displayTable(_ source: String, _ vms: [(String, VMDirectory)]) {
-    for (name, _) in vms {
+    for (name, _) in vms.sorted(by: { left, right in left.0 < right.0 }) {
       print("\(source)\t\(name)")
     }
   }

Sources/tart/Commands/Login.swift

@@ -8,11 +8,46 @@ struct Login: AsyncParsableCommand {
   @Argument(help: "host")
   var host: String
 
+  @Option(help: "username")
+  var username: String
+
+  @Flag(help: "password-stdin")
+  var passwordStdin: Bool = false
+
+  func validate() throws {
+    let usernameProvided = !username.isEmpty
+    let passwordProvided = passwordStdin
+
+    if usernameProvided != passwordProvided {
+      throw ValidationError("both --username and --password-stdin are required")
+    }
+  }
+
   func run() async throws {
     do {
-      let (user, password) = try Credentials.retrieveStdin()
+      var user: String
+      var password: String
 
-      try Credentials.store(host: host, user: user, password: password)
+      if !username.isEmpty {
+        user = username
+        password = readLine()!
+      } else {
+        (user, password) = try StdinCredentials.retrieve()
+      }
+      let credentialsProvider = DictionaryCredentialsProvider([
+        host: (user, password)
+      ])
+
+      do {
+        let registry = try Registry(host: host, namespace: "", credentialsProvider: credentialsProvider)
+        try await registry.ping()
+      } catch {
+        print("invalid credentials: \(error)")
+
+        Foundation.exit(1)
+      }
+
+      try KeychainCredentialsProvider().store(host: host, user: user, password: password)
 
       Foundation.exit(0)
     } catch {
@@ -22,3 +57,19 @@ struct Login: AsyncParsableCommand {
     }
   }
 }
+
+fileprivate class DictionaryCredentialsProvider: CredentialsProvider {
+  var credentials: Dictionary<String, (String, String)>
+
+  init(_ credentials: Dictionary<String, (String, String)>) {
+    self.credentials = credentials
+  }
+
+  func retrieve(host: String) throws -> (String, String)? {
+    credentials[host]
+  }
+
+  func store(host: String, user: String, password: String) throws {
+    credentials[host] = (user, password)
+  }
+}

Sources/tart/Commands/Pull.swift

@@ -10,6 +10,14 @@ struct Pull: AsyncParsableCommand {
 
   func run() async throws {
     do {
+      // Be more liberal when accepting local image as argument,
+      // see https://github.com/cirruslabs/tart/issues/36
+      if VMStorageLocal().exists(remoteName) {
+        print("\"\(remoteName)\" is a local image, nothing to pull here!")
+
+        Foundation.exit(0)
+      }
+
       let remoteName = try RemoteName(remoteName)
       let registry = try Registry(host: remoteName.host, namespace: remoteName.namespace)
 

Sources/tart/Commands/Push.swift

@@ -12,6 +12,10 @@ struct Push: AsyncParsableCommand {
   @Argument(help: "remote VM name(s)")
   var remoteNames: [String]
 
+  @Flag(help: ArgumentHelp("cache pushed images locally",
+          discussion: "Increases disk usage, but saves time if you're going to pull the pushed images later."))
+  var populateCache: Bool = false
+
   func run() async throws {
     do {
       let localVMDir = try VMStorageLocal().open(localName)
@@ -35,12 +39,20 @@ struct Push: AsyncParsableCommand {
       for (registryIdentifier, remoteNamesForRegistry) in registryGroups {
         let registry = try Registry(host: registryIdentifier.host, namespace: registryIdentifier.namespace)
 
-        let listOfTagsAndDigests = "{" + remoteNamesForRegistry.map{$0.fullyQualifiedReference }
-                .joined(separator: ",") + "}"
         defaultLogger.appendNewLine("pushing \(localName) to "
-          + "\(registryIdentifier.host)/\(registryIdentifier.namespace)\(listOfTagsAndDigests)...")
+          + "\(registryIdentifier.host)/\(registryIdentifier.namespace)\(remoteNamesForRegistry.referenceNames())...")
 
-        try await localVMDir.pushToRegistry(registry: registry, references: remoteNamesForRegistry.map{ $0.reference })
+        let pushedRemoteName = try await localVMDir.pushToRegistry(registry: registry, references: remoteNamesForRegistry.map{ $0.reference.value })
+
+        // Populate the local cache (if requested)
+        if populateCache {
+          let ociStorage = VMStorageOCI()
+          let expectedPushedVMDir = try ociStorage.create(pushedRemoteName)
+          try localVMDir.clone(to: expectedPushedVMDir, generateMAC: false)
+          for remoteName in remoteNamesForRegistry {
+            try ociStorage.link(from: remoteName, to: pushedRemoteName)
+          }
+        }
       }
 
       Foundation.exit(0)
@@ -51,3 +63,15 @@ struct Push: AsyncParsableCommand {
     }
   }
 }
+
+extension Collection where Element == RemoteName {
+  func referenceNames() -> String {
+    let references = self.map{ $0.reference.fullyQualified }
+
+    switch count {
+    case 0: return "∅"
+    case 1: return references.first!
+    default: return "{" + references.joined(separator: ",") + "}"
+    }
+  }
+}

Sources/tart/Commands/Run.swift

@@ -5,62 +5,129 @@ import Virtualization
 
 var vm: VM?
 
+struct IPNotFound: Error {
+}
+
 struct Run: AsyncParsableCommand {
   static var configuration = CommandConfiguration(abstract: "Run a VM")
 
   @Argument(help: "VM name")
   var name: String
 
-  @Flag var noGraphics: Bool = false
+  @Flag(help: ArgumentHelp(
+          "Don't open a UI window.",
+          discussion: "Useful for integrating Tart VMs into other tools.\nUse `tart ip` in order to get an IP for SSHing or VNCing into the VM.")) 
+  var noGraphics: Bool = false
+
+  @Flag(help: "Boot into recovery mode") 
+  var recovery: Bool = false
+  
+  @Flag(help: ArgumentHelp(
+          "Use screen sharing instead of the built-in UI.",
+          discussion: "Useful since VNC supports copy/paste, drag and drop, etc.\nNote that Remote Login option should be enabled inside the VM.")) 
+  var vnc: Bool = false
+
+  @Flag var withSoftnet: Bool = false
 
   @MainActor
-  func run() async throws {
+  func run() async throws {    
     let vmDir = try VMStorageLocal().open(name)
-    vm = try VM(vmDir: vmDir)
+    vm = try VM(vmDir: vmDir, withSoftnet: withSoftnet)
 
-    Task {
+    var vncWrapper: VNCWrapper?
+
+    if vnc {
+        vncWrapper = VNCWrapper(virtualMachine: vm!.virtualMachine)
+    }
+
+    let task = Task {
       do {
-        try await vm!.run()
+        if let vncWrapper = vncWrapper {
+          let port = try await vncWrapper.waitForPort()
+
+          let url = URL(string: "vnc://:\(vncWrapper.password)@127.0.0.1:\(port)")!
+
+          if noGraphics || ProcessInfo.processInfo.environment["CI"] != nil {
+            print("VNC server is running at \(url)")
+          } else {
+            print("Opening \(url)...")
+            NSWorkspace.shared.open(url)
+          }
+        }
+
+        try await vm!.run(recovery)
+
+        if let vncWrapper = vncWrapper {
+          try vncWrapper.stop()
+        }
 
         Foundation.exit(0)
       } catch {
-        print(error)
+        if error.localizedDescription.contains("Failed to lock auxiliary storage.") {
+          print("Virtual machine \"\(name)\" is already running!")
+        } else {
+          print(error)
+        }
 
         Foundation.exit(1)
       }
     }
 
-    if noGraphics {
+    let sigintSrc = DispatchSource.makeSignalSource(signal: SIGINT)
+    sigintSrc.setEventHandler {
+      task.cancel()
+    }
+    sigintSrc.activate()
+
+    if noGraphics || vnc {
       dispatchMain()
     } else {
-      // UI mumbo-jumbo
-      let nsApp = NSApplication.shared
-      nsApp.setActivationPolicy(.regular)
-      nsApp.activate(ignoringOtherApps: true)
+      runUI()
+    }
+  }
 
-      nsApp.applicationIconImage = NSImage(data: AppIconData)
+  private func runUI() {
+    let nsApp = NSApplication.shared
+    nsApp.setActivationPolicy(.regular)
+    nsApp.activate(ignoringOtherApps: true)
 
-      struct MainApp: App {
-        var body: some Scene {
-          WindowGroup(vm!.name) {
-            Group {
-              VMView(vm: vm!).onAppear {
-                NSWindow.allowsAutomaticWindowTabbing = false
-              }
-            }.frame(width: CGFloat(vm!.config.display.width), height: CGFloat(vm!.config.display.height))
-          }.commands {
-            // Remove some standard menu options
-            CommandGroup(replacing: .help, addition: {})
-            CommandGroup(replacing: .newItem, addition: {})
-            CommandGroup(replacing: .pasteboard, addition: {})
-            CommandGroup(replacing: .textEditing, addition: {})
-            CommandGroup(replacing: .undoRedo, addition: {})
-            CommandGroup(replacing: .windowSize, addition: {})
-          }
-        }
+    nsApp.applicationIconImage = NSImage(data: AppIconData)
+
+    struct MainApp: App {
+      var body: some Scene {
+        WindowGroup(vm!.name) {
+          Group {
+            VMView(vm: vm!).onAppear {
+              NSWindow.allowsAutomaticWindowTabbing = false
+            }
+          }.frame(width: CGFloat(vm!.config.display.width), height: CGFloat(vm!.config.display.height))
+        }.commands {
+                  // Remove some standard menu options
+                  CommandGroup(replacing: .help, addition: {})
+                  CommandGroup(replacing: .newItem, addition: {})
+                  CommandGroup(replacing: .pasteboard, addition: {})
+                  CommandGroup(replacing: .textEditing, addition: {})
+                  CommandGroup(replacing: .undoRedo, addition: {})
+                  CommandGroup(replacing: .windowSize, addition: {})
+                  // Replace some standard menu options
+                  CommandGroup(replacing: .appInfo) { AboutTart() }
+                }
       }
+    }
 
-      MainApp.main()
+    MainApp.main()
+  }
+}
+
+struct AboutTart: View {
+  var body: some View {
+    Button("About Tart") {
+      NSApplication.shared.orderFrontStandardAboutPanel(options: [
+        NSApplication.AboutPanelOptionKey.applicationIcon: NSApplication.shared.applicationIconImage as Any,
+        NSApplication.AboutPanelOptionKey.applicationName: "Tart",
+        NSApplication.AboutPanelOptionKey.applicationVersion: CI.version,
+        NSApplication.AboutPanelOptionKey.credits: try! NSAttributedString(markdown: "https://github.com/cirruslabs/tart"),
+      ])
     }
   }
 }

Sources/tart/Commands/Set.swift

@@ -2,7 +2,7 @@ import ArgumentParser
 import Foundation
 
 struct Set: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Modify VM's configuration")
+  static var configuration = CommandConfiguration(commandName: "set", abstract: "Modify VM's configuration")
 
   @Argument(help: "VM name")
   var name: String
@@ -13,11 +13,11 @@ struct Set: AsyncParsableCommand {
   @Option(help: "VM memory size in megabytes")
   var memory: UInt16?
 
-  @Option(help: "VM display settings in a format of <width>x<height>(x<dpi>)?. For example, 1200x800 or 1200x800x72")
+  @Option(help: "VM display resolution in a format of <width>x<height>. For example, 1200x800")
   var display: VMDisplayConfig?
 
   @Option(help: .hidden)
-  var diskSize: UInt8?
+  var diskSize: UInt16?
 
   func run() async throws {
     do {
@@ -39,9 +39,6 @@ struct Set: AsyncParsableCommand {
         if (display.height > 0) {
           vmConfig.display.height = display.height
         }
-        if (display.dpi > 0) {
-          vmConfig.display.dpi = display.dpi
-        }
       }
 
       try vmConfig.save(toURL: vmDir.configURL)
@@ -66,8 +63,7 @@ extension VMDisplayConfig: ExpressibleByArgument {
     }
     self = VMDisplayConfig(
       width: parts[safe: 0] ?? 0,
-      height: parts[safe: 1] ?? 0,
-      dpi: parts[safe: 2] ?? 0
+      height: parts[safe: 1] ?? 0
     )
   }
 }

Sources/tart/Config.swift

@@ -6,4 +6,16 @@ struct Config {
           .appendingPathComponent(".tart", isDirectory: true)
 
   public static let tartCacheDir: URL = tartHomeDir.appendingPathComponent("cache", isDirectory: true)
+
+  static func jsonEncoder() -> JSONEncoder {
+    let encoder = JSONEncoder()
+
+    encoder.outputFormatting = [.sortedKeys]
+
+    return encoder
+  }
+
+  static func jsonDecoder() -> JSONDecoder {
+    JSONDecoder()
+  }
 }

Sources/tart/Credentials.swift

@@ -1,64 +0,0 @@
-import Foundation
-
-class Credentials {
-  static func retrieveKeychain(host: String) throws -> (String, String)? {
-    let query: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
-                                kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
-                                kSecAttrServer as String: host,
-                                kSecMatchLimit as String: kSecMatchLimitOne,
-                                kSecReturnAttributes as String: true,
-                                kSecReturnData as String: true,
-                                kSecAttrLabel as String: "Tart Credentials",
-    ]
-
-    var item: CFTypeRef?
-    let status = SecItemCopyMatching(query as CFDictionary, &item)
-
-    if status != errSecSuccess {
-      if status == errSecItemNotFound {
-        return nil
-      }
-
-      throw RegistryError.AuthFailed(why: "Keychain returned unsuccessful status \(status)")
-    }
-
-    guard let item = item as? [String: Any],
-          let user = item[kSecAttrAccount as String] as? String,
-          let passwordData = item[kSecValueData as String] as? Data,
-          let password = String(data: passwordData, encoding: .utf8)
-      else {
-      throw RegistryError.AuthFailed(why: "Keychain item has unexpected format")
-    }
-
-    return (user, password)
-  }
-
-  static func retrieveStdin() throws -> (String, String) {
-    print("User: ", terminator: "")
-    let user = readLine() ?? ""
-
-    let rawPass = getpass("Password: ")
-    let pass = String(cString: rawPass!, encoding: .utf8)!
-
-    return (user, pass)
-  }
-
-  static func store(host: String, user: String, password: String) throws {
-    let attributes: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
-                                     kSecAttrAccount as String: user,
-                                     kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
-                                     kSecAttrServer as String: host,
-                                     kSecValueData as String: password,
-                                     kSecAttrLabel as String: "Tart Credentials",
-    ]
-
-    let status = SecItemAdd(attributes as CFDictionary, nil)
-
-    switch status {
-    case errSecSuccess, errSecDuplicateItem:
-      return
-    default:
-      throw RegistryError.AuthFailed(why: "Keychain returned unsuccessful status \(status)")
-    }
-  }
-}

Sources/tart/Credentials/CredentialsProvider.swift

@@ -0,0 +1,10 @@
+import Foundation
+
+enum CredentialsProviderError: Error {
+    case Failed(message: String)
+}
+
+protocol CredentialsProvider {
+    func retrieve(host: String) throws -> (String, String)?
+    func store(host: String, user: String, password: String) throws
+}

Sources/tart/Credentials/KeychainCredentialsProvider.swift

@@ -0,0 +1,54 @@
+import Foundation
+
+class KeychainCredentialsProvider: CredentialsProvider {
+    func retrieve(host: String) throws -> (String, String)? {
+        let query: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
+                                    kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
+                                    kSecAttrServer as String: host,
+                                    kSecMatchLimit as String: kSecMatchLimitOne,
+                                    kSecReturnAttributes as String: true,
+                                    kSecReturnData as String: true,
+                                    kSecAttrLabel as String: "Tart Credentials",
+        ]
+
+        var item: CFTypeRef?
+        let status = SecItemCopyMatching(query as CFDictionary, &item)
+
+        if status != errSecSuccess {
+            if status == errSecItemNotFound {
+                return nil
+            }
+
+            throw CredentialsProviderError.Failed(message: "Keychain returned unsuccessful status \(status)")
+        }
+
+        guard let item = item as? [String: Any],
+              let user = item[kSecAttrAccount as String] as? String,
+              let passwordData = item[kSecValueData as String] as? Data,
+              let password = String(data: passwordData, encoding: .utf8)
+        else {
+            throw CredentialsProviderError.Failed(message: "Keychain item has unexpected format")
+        }
+
+        return (user, password)
+    }
+
+    func store(host: String, user: String, password: String) throws {
+        let attributes: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
+                                         kSecAttrAccount as String: user,
+                                         kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
+                                         kSecAttrServer as String: host,
+                                         kSecValueData as String: password,
+                                         kSecAttrLabel as String: "Tart Credentials",
+        ]
+
+        let status = SecItemAdd(attributes as CFDictionary, nil)
+
+        switch status {
+        case errSecSuccess, errSecDuplicateItem:
+            return
+        default:
+            throw CredentialsProviderError.Failed(message: "Keychain returned unsuccessful status \(status)")
+        }
+    }
+}

Sources/tart/Credentials/StdinCredentials.swift

@@ -0,0 +1,31 @@
+import Foundation
+
+enum StdinCredentialsError: Error {
+  case CredentialRequired(which: String)
+  case CredentialTooLong(message: String)
+}
+
+class StdinCredentials {
+  static func retrieve() throws -> (String, String) {
+    let user = try readStdinCredential(name: "username", prompt: "User: ", isSensitive: false)
+    let password = try readStdinCredential(name: "password", prompt: "Password: ", isSensitive: true)
+
+    return (user, password)
+  }
+
+  private static func readStdinCredential(name: String, prompt: String, maxCharacters: Int = 255, isSensitive: Bool) throws -> String {
+    var buf = [CChar](repeating: 0, count: maxCharacters + 1 /* sentinel */ + 1 /* NUL */)
+    guard let rawCredential = readpassphrase(prompt, &buf, buf.count, isSensitive ? RPP_ECHO_OFF : RPP_ECHO_ON) else {
+      throw StdinCredentialsError.CredentialRequired(which: name)
+    }
+
+    let credential = String(cString: rawCredential).trimmingCharacters(in: .newlines)
+
+    if credential.count > maxCharacters {
+      throw StdinCredentialsError.CredentialTooLong(
+        message: "\(name) should contain no more than \(maxCharacters) characters")
+    }
+
+    return credential
+  }
+}

Sources/tart/Logging/ProgressObserver.swift

@@ -3,6 +3,7 @@ import Foundation
 public class ProgressObserver: NSObject {
   @objc var progressToObserve: Progress
   var observation: NSKeyValueObservation?
+  var lastTimeUpdated = Date.now
 
   public init(_ progress: Progress) {
     progressToObserve = progress
@@ -11,7 +12,11 @@ public class ProgressObserver: NSObject {
   func log(_ renderer: Logger) {
     renderer.appendNewLine(ProgressObserver.lineToRender(progressToObserve))
     observation = observe(\.progressToObserve.fractionCompleted) { progress, _ in
-      renderer.updateLastLine(ProgressObserver.lineToRender(self.progressToObserve))
+      let currentTime = Date.now
+      if self.progressToObserve.isFinished || currentTime.timeIntervalSince(self.lastTimeUpdated) >= 1.0 {
+        self.lastTimeUpdated = currentTime
+        renderer.updateLastLine(ProgressObserver.lineToRender(self.progressToObserve))
+      }
     }
   }
 

Sources/tart/MACAddressResolver/Lease.swift

@@ -0,0 +1,32 @@
+import Network
+
+struct Lease {
+  var mac: MACAddress
+  var ip: IPv4Address
+
+  init?(fromRawLease: [String : String]) {
+    // Retrieve the required fields
+    guard let hwAddress = fromRawLease["hw_address"] else { return nil }
+    guard let ipAddress = fromRawLease["ip_address"] else { return nil }
+
+    // Parse MAC address
+    let hwAddressSplits = hwAddress.split(separator: ",")
+    if hwAddressSplits.count != 2 {
+      return nil
+    }
+    if let hwAddressProto = Int(hwAddressSplits[0]), hwAddressProto != ARPHRD_ETHER {
+      return nil
+    }
+    guard let mac = MACAddress(fromString: String(hwAddressSplits[1])) else {
+      return nil
+    }
+
+    // Parse IP address
+    guard let ip = IPv4Address(ipAddress) else {
+      return nil
+    }
+
+    self.ip = ip
+    self.mac = mac
+  }
+}

Sources/tart/MACAddressResolver/Leases.swift

@@ -0,0 +1,106 @@
+import Foundation
+import Network
+
+enum LeasesError: Error {
+  case UnexpectedFormat(name: String = "unexpected DHCPD leases file format", message: String, line: Int)
+  case Truncated(name: String = "truncated DHCPD leases file")
+
+  var description: String {
+    switch self {
+
+    case .UnexpectedFormat(name: let name, message: let message, line: let line):
+      return "\(name) on line \(line): \(message)"
+    case .Truncated(name: let name):
+      return "\(name)"
+    }
+  }
+}
+
+class Leases {
+  private let leases: [MACAddress : Lease]
+
+  convenience init() throws {
+    try self.init(URL(fileURLWithPath: "/var/db/dhcpd_leases"))
+  }
+
+  convenience init(_ fromURL: URL) throws {
+    let fileContents = try String(contentsOf: fromURL, encoding: .utf8)
+
+    try self.init(fileContents)
+  }
+
+  init(_ fromString: String) throws {
+    var leases: [MACAddress : Lease] = Dictionary()
+
+    for lease in try Self.retrieveRawLeases(fromString).compactMap({ Lease(fromRawLease: $0) }) {
+      leases[lease.mac] = lease
+    }
+
+    self.leases = leases
+  }
+
+  /// Parse leases from the host cache similarly to the PLCache_read() function found in Apple's Open Source releases.
+  ///
+  /// [1]: https://github.com/apple-opensource/bootp/blob/master/bootplib/NICache.c#L285-L391
+  private static func retrieveRawLeases(_ dhcpdLeasesContents: String) throws -> [[String : String]] {
+    var rawLeases: [[String : String]] = Array()
+
+    enum State {
+      case Nowhere
+      case Start
+      case Body
+      case End
+    }
+    var state = State.Nowhere
+
+    var currentRawLease: [String : String] = Dictionary()
+
+    for (lineNumber, line) in dhcpdLeasesContents.split(separator: "\n").enumerated().map({ ($0 + 1, $1) }) {
+      if line == "{" {
+        // Handle lease block start
+        if state != .Nowhere && state != .End {
+          throw LeasesError.UnexpectedFormat(message: "unexpected lease block start ({)", line: lineNumber)
+        }
+
+        state = .Start
+      } else if line == "}" {
+        // Handle lease block end
+        if state != .Body {
+          throw LeasesError.UnexpectedFormat(message: "unexpected lease block end (})", line: lineNumber)
+        }
+
+        rawLeases.append(currentRawLease)
+        currentRawLease = Dictionary()
+
+        state = .End
+      } else {
+        // Handle lease block contents
+        let lineWithoutTabs = String(line.drop { $0 == " " || $0 == "\t"})
+
+        if lineWithoutTabs.isEmpty {
+          continue
+        }
+
+        let splits = lineWithoutTabs.split(separator: "=", maxSplits: 1)
+        if splits.count != 2 {
+          throw LeasesError.UnexpectedFormat(message: "key-value pair with only a key", line: lineNumber)
+        }
+        let (key, value) = (String(splits[0]), String(splits[1]))
+
+        currentRawLease[key] = value
+
+        state = .Body
+      }
+    }
+
+    if state == .Start || state == .Body {
+      throw LeasesError.Truncated()
+    }
+
+    return rawLeases
+  }
+
+  func resolveMACAddress(macAddress: MACAddress) throws -> IPv4Address? {
+    leases[macAddress]?.ip
+  }
+}

Sources/tart/MACAddressResolver/MACAddress.swift

@@ -1,6 +1,6 @@
 import Foundation
 
-struct MACAddress: Equatable, CustomStringConvertible {
+struct MACAddress: Equatable, Hashable, CustomStringConvertible {
   var mac: [UInt8] = Array(repeating: 0, count: 6)
 
   init?(fromString: String) {

Sources/tart/OCI/Manifest.swift

@@ -3,26 +3,70 @@ import Foundation
 let ociManifestMediaType = "application/vnd.oci.image.manifest.v1+json"
 let ociConfigMediaType = "application/vnd.oci.image.config.v1+json"
 
-struct OCIManifest: Encodable, Decodable {
+// Annotations
+let uncompressedDiskSizeAnnotation = "org.cirruslabs.tart.uncompressed-disk-size"
+
+struct OCIManifest: Codable, Equatable {
   var schemaVersion: Int = 2
   var mediaType: String = ociManifestMediaType
   var config: OCIManifestConfig
   var layers: [OCIManifestLayer] = Array()
+  var annotations: Dictionary<String, String>?
+
+  init(config: OCIManifestConfig, layers: [OCIManifestLayer], uncompressedDiskSize: UInt64? = nil) {
+    self.config = config
+    self.layers = layers
+
+    if let uncompressedDiskSize = uncompressedDiskSize {
+      annotations = [
+        uncompressedDiskSizeAnnotation: String(uncompressedDiskSize)
+      ]
+    }
+  }
+
+  init(fromJSON: Data) throws {
+    self = try Config.jsonDecoder().decode(Self.self, from: fromJSON)
+  }
+
+  func toJSON() throws -> Data {
+    try Config.jsonEncoder().encode(self)
+  }
+
+  func digest() throws -> String {
+    try Digest.hash(toJSON())
+  }
+
+  func uncompressedDiskSize() -> UInt64? {
+    guard let value = annotations?[uncompressedDiskSizeAnnotation] else {
+      return nil
+    }
+
+    return UInt64(value)
+  }
 }
 
-struct OCIManifestConfig: Encodable, Decodable {
+struct OCIConfig: Codable {
+  var architecture: String = "arm64"
+  var os: String = "darwin"
+
+  func toJSON() throws -> Data {
+    try Config.jsonEncoder().encode(self)
+  }
+}
+
+struct OCIManifestConfig: Codable, Equatable {
   var mediaType: String = ociConfigMediaType
   var size: Int
   var digest: String
 }
 
-struct OCIManifestLayer: Encodable, Decodable {
+struct OCIManifestLayer: Codable, Equatable {
   var mediaType: String
   var size: Int
   var digest: String
 }
 
-struct Descriptor {
+struct Descriptor: Equatable {
   var size: Int
   var digest: String
 }

Sources/tart/OCI/Registry.swift

@@ -1,12 +1,30 @@
 import Foundation
+import NIOCore
+import NIOHTTP1
+import AsyncHTTPClient
 
 enum RegistryError: Error {
-  case UnexpectedHTTPStatusCode(when: String, code: Int, details: String = "")
+  case UnexpectedHTTPStatusCode(when: String, code: UInt, details: String = "")
   case MissingLocationHeader
   case AuthFailed(why: String, details: String = "")
   case MalformedHeader(why: String)
 }
 
+extension HTTPClientResponse.Body {
+  func readTextResponse() async throws -> String? {
+    let data = try await readResponse()
+    return String(decoding: data, as: UTF8.self)
+  }
+
+  func readResponse() async throws -> Data {
+    var result = Data()
+    for try await part in self {
+      result.append(Data(buffer: part))
+    }
+    return result
+  }
+}
+
 struct TokenResponse: Decodable {
   let defaultIssuedAt = Date()
   let defaultExpiresIn = 60
@@ -16,7 +34,7 @@ struct TokenResponse: Decodable {
   var issuedAt: Date?
 
   static func parse(fromData: Data) throws -> Self {
-    let decoder = JSONDecoder()
+    let decoder = Config.jsonDecoder()
 
     decoder.keyDecodingStrategy = .convertFromSnakeCase
 
@@ -46,7 +64,7 @@ struct TokenResponse: Decodable {
       (issuedAt ?? defaultIssuedAt) + TimeInterval(expiresIn ?? defaultExpiresIn)
     }
   }
-  
+
   var isValid: Bool {
     get {
       Date() < tokenExpiresAt
@@ -55,52 +73,79 @@ struct TokenResponse: Decodable {
 }
 
 class Registry {
-  var baseURL: URL
-  var namespace: String
+  private let httpClient = HTTPClient(eventLoopGroupProvider: .createNew)
+  
+  deinit {
+    try! httpClient.syncShutdown()
+  }
+  
+  let baseURL: URL
+  let namespace: String
+  let credentialsProvider: CredentialsProvider
 
   var currentAuthToken: TokenResponse? = nil
 
-  init(host: String, namespace: String) throws {
+  init(urlComponents: URLComponents,
+       namespace: String,
+       credentialsProvider: CredentialsProvider = KeychainCredentialsProvider()
+  ) throws {
+    baseURL = urlComponents.url!
+    self.namespace = namespace
+    self.credentialsProvider = credentialsProvider
+  }
+
+  convenience init(
+          host: String,
+          namespace: String,
+          credentialsProvider: CredentialsProvider = KeychainCredentialsProvider()
+  ) throws {
     var baseURLComponents = URLComponents()
+
     baseURLComponents.scheme = "https"
     baseURLComponents.host = host
     baseURLComponents.path = "/v2/"
 
-    baseURL = baseURLComponents.url!
-    self.namespace = namespace
+    try self.init(urlComponents: baseURLComponents, namespace: namespace, credentialsProvider: credentialsProvider)
   }
 
-  func pushManifest(reference: String, config: Descriptor, layers: [OCIManifestLayer]) async throws -> String {
-    let manifest = OCIManifest(config: OCIManifestConfig(size: config.size, digest: config.digest),
-      layers: layers)
-    let manifestJSON = try JSONEncoder().encode(manifest)
+  func ping() async throws {
+    let response = try await endpointRequest(.GET, "/v2/")
+    if response.status != .ok {
+      throw RegistryError.UnexpectedHTTPStatusCode(when: "doing ping", code: response.status.code)
+    }
+  }
 
-    let (responseData, response) = try await endpointRequest("PUT", "\(namespace)/manifests/\(reference)",
+  func pushManifest(reference: String, manifest: OCIManifest) async throws -> String {
+    let manifestJSON = try manifest.toJSON()
+
+    let response = try await endpointRequest(.PUT, "\(namespace)/manifests/\(reference)",
       headers: ["Content-Type": manifest.mediaType],
       body: manifestJSON)
-    if response.statusCode != 201 {
-      throw RegistryError.UnexpectedHTTPStatusCode(when: "pushing manifest", code: response.statusCode,
-        details: String(decoding: responseData, as: UTF8.self))
+    if response.status != .created {
+      throw RegistryError.UnexpectedHTTPStatusCode(when: "pushing manifest", code: response.status.code,
+        details: try await response.body.readTextResponse() ?? "")
     }
 
     return Digest.hash(manifestJSON)
   }
 
   public func pullManifest(reference: String) async throws -> (OCIManifest, Data) {
-    let (responseData, response) = try await endpointRequest("GET", "\(namespace)/manifests/\(reference)",
+    let response = try await endpointRequest(.GET, "\(namespace)/manifests/\(reference)",
       headers: ["Accept": ociManifestMediaType])
-    if response.statusCode != 200 {
-      throw RegistryError.UnexpectedHTTPStatusCode(when: "pulling manifest", code: response.statusCode,
-        details: String(decoding: responseData, as: UTF8.self))
+    if response.status != .ok {
+      let body = try await response.body.readTextResponse()
+      throw RegistryError.UnexpectedHTTPStatusCode(when: "pulling manifest", code: response.status.code,
+        details: body ?? "")
     }
 
-    let manifest = try JSONDecoder().decode(OCIManifest.self, from: responseData)
+    let manifestData = try await response.body.readResponse()
+    let manifest = try OCIManifest(fromJSON: manifestData)
 
-    return (manifest, responseData)
+    return (manifest, manifestData)
   }
 
-  private func uploadLocationFromResponse(response: HTTPURLResponse) throws -> URLComponents {
-    guard let uploadLocationRaw = response.value(forHTTPHeaderField: "Location") else {
+  private func uploadLocationFromResponse(_ response: HTTPClientResponse) throws -> URLComponents {
+    guard let uploadLocationRaw = response.headers.first(name: "Location") else {
       throw RegistryError.MissingLocationHeader
     }
 
@@ -113,15 +158,16 @@ class Registry {
 
   public func pushBlob(fromData: Data, chunkSize: Int = 5 * 1024 * 1024) async throws -> String {
     // Initiate a blob upload
-    let (postData, postResponse) = try await endpointRequest("POST", "\(namespace)/blobs/uploads/",
+    let postResponse = try await endpointRequest(.POST, "\(namespace)/blobs/uploads/",
       headers: ["Content-Length": "0"])
-    if postResponse.statusCode != 202 {
-      throw RegistryError.UnexpectedHTTPStatusCode(when: "pushing blob (POST)", code: postResponse.statusCode,
-        details: String(decoding: postData, as: UTF8.self))
+    if postResponse.status != .accepted {
+      let body = try await postResponse.body.readTextResponse()
+      throw RegistryError.UnexpectedHTTPStatusCode(when: "pushing blob (POST)", code: postResponse.status.code,
+        details: body ?? "")
     }
 
     // Figure out where to upload the blob
-    let uploadLocation = try uploadLocationFromResponse(response: postResponse)
+    let uploadLocation = try uploadLocationFromResponse(postResponse)
 
     // Upload the blob
     let headers = [
@@ -134,33 +180,39 @@ class Registry {
       "digest": digest,
     ]
 
-    let (putData, putResponse) = try await rawRequest("PUT", uploadLocation, headers: headers, parameters: parameters,
+    let putResponse = try await rawRequest(.PUT, uploadLocation, headers: headers, parameters: parameters,
       body: fromData)
-    if putResponse.statusCode != 201 {
-      throw RegistryError.UnexpectedHTTPStatusCode(when: "pushing blob (PUT)", code: putResponse.statusCode,
-        details: String(decoding: putData, as: UTF8.self))
+    if putResponse.status != .created {
+      let body = try await postResponse.body.readTextResponse()
+      throw RegistryError.UnexpectedHTTPStatusCode(when: "pushing blob (PUT) to \(uploadLocation)",
+              code: putResponse.status.code, details: body ?? "")
     }
 
     return digest
   }
 
-  public func pullBlob(_ digest: String) async throws -> Data {
-    let (putData, putResponse) = try await endpointRequest("GET", "\(namespace)/blobs/\(digest)")
-    if putResponse.statusCode != 200 {
-      throw RegistryError.UnexpectedHTTPStatusCode(when: "pulling blob", code: putResponse.statusCode,
-        details: String(decoding: putData, as: UTF8.self))
+  public func pullBlob(_ digest: String, handler: (ByteBuffer) throws -> Void) async throws {
+    let response = try await endpointRequest(.GET, "\(namespace)/blobs/\(digest)")
+    if response.status != .ok {
+      let body = try await response.body.readTextResponse()
+      throw RegistryError.UnexpectedHTTPStatusCode(when: "pulling blob", code: response.status.code,
+        details: body ?? "")
     }
 
-    return putData
+    for try await part in response.body {
+      try Task.checkCancellation()
+
+      try handler(part)
+    }
   }
 
   private func endpointRequest(
-    _ method: String,
+    _ method: HTTPMethod,
     _ endpoint: String,
     headers: Dictionary<String, String> = Dictionary(),
     parameters: Dictionary<String, String> = Dictionary(),
     body: Data? = nil
-  ) async throws -> (Data, HTTPURLResponse) {
+  ) async throws -> HTTPClientResponse {
     let url = URL(string: endpoint, relativeTo: baseURL)!
     let urlComponents = URLComponents(url: url, resolvingAgainstBaseURL: true)!
 
@@ -168,12 +220,12 @@ class Registry {
   }
 
   private func rawRequest(
-    _ method: String,
+    _ method: HTTPMethod,
     _ urlComponents: URLComponents,
     headers: Dictionary<String, String> = Dictionary(),
     parameters: Dictionary<String, String> = Dictionary(),
     body: Data? = nil
-  ) async throws -> (Data, HTTPURLResponse) {
+  ) async throws -> HTTPClientResponse {
     var urlComponents = urlComponents
 
     if urlComponents.queryItems == nil {
@@ -183,31 +235,33 @@ class Registry {
       URLQueryItem(name: key, value: value)
     })
 
-    var request = URLRequest(url: urlComponents.url!)
-    request.httpMethod = method
+    var request = HTTPClientRequest(url: urlComponents.string!)
+    request.method = method
     for (key, value) in headers {
-      request.addValue(value, forHTTPHeaderField: key)
+      request.headers.add(name: key, value: value)
+    }
+    if body != nil {
+      request.body = HTTPClientRequest.Body.bytes(body!)
     }
-    request.httpBody = body
 
     // Invalidate token if it has expired
     if currentAuthToken?.isValid == false {
       currentAuthToken = nil
     }
 
-    var (data, response) = try await authAwareRequest(request: request)
+    var response = try await authAwareRequest(request: request)
 
-    if response.statusCode == 401 {
+    if response.status == .unauthorized {
       try await auth(response: response)
-      (data, response) = try await authAwareRequest(request: request)
+      response = try await authAwareRequest(request: request)
     }
 
-    return (data, response)
+    return response
   }
 
-  private func auth(response: HTTPURLResponse) async throws {
+  private func auth(response: HTTPClientResponse) async throws {
     // Process WWW-Authenticate header
-    guard let wwwAuthenticateRaw = response.value(forHTTPHeaderField: "WWW-Authenticate") else {
+    guard let wwwAuthenticateRaw = response.headers.first(name: "WWW-Authenticate") else {
       throw RegistryError.AuthFailed(why: "got HTTP 401, but WWW-Authenticate header is missing")
     }
 
@@ -242,29 +296,29 @@ class Registry {
 
     var headers: Dictionary<String, String> = Dictionary()
 
-    if let (user, password) = try Credentials.retrieveKeychain(host: baseURL.host!) {
+    if let (user, password) = try credentialsProvider.retrieve(host: baseURL.host!) {
       let encodedCredentials = "\(user):\(password)".data(using: .utf8)?.base64EncodedString()
       headers["Authorization"] = "Basic \(encodedCredentials!)"
     }
 
-    let (tokenResponseRaw, response) = try await rawRequest("GET", authenticateURL, headers: headers)
-    if response.statusCode != 200 {
-      throw RegistryError.AuthFailed(why: "received unexpected HTTP status code \(response.statusCode) "
-        + "while retrieving an authentication token", details: String(decoding: tokenResponseRaw, as: UTF8.self))
+    let response = try await rawRequest(.GET, authenticateURL, headers: headers)
+    if response.status != .ok {
+      let body = try await response.body.readTextResponse() ?? ""
+      throw RegistryError.AuthFailed(why: "received unexpected HTTP status code \(response.status.code) "
+        + "while retrieving an authentication token", details: body)
     }
 
-    currentAuthToken = try TokenResponse.parse(fromData: tokenResponseRaw)
+    let bodyData = try await response.body.readResponse()
+    currentAuthToken = try TokenResponse.parse(fromData: bodyData)
   }
 
-  private func authAwareRequest(request: URLRequest) async throws -> (Data, HTTPURLResponse) {
+  private func authAwareRequest(request: HTTPClientRequest) async throws -> HTTPClientResponse {
     var request = request
 
     if let token = currentAuthToken {
-      request.addValue("Bearer \(token.token)", forHTTPHeaderField: "Authorization")
+      request.headers.add(name: "Authorization", value: "Bearer \(token.token)")
     }
 
-    let (responseData, response) = try await URLSession.shared.data(for: request)
-
-    return (responseData, response as! HTTPURLResponse)
+    return try await httpClient.execute(request, deadline: .distantFuture)
   }
 }

Sources/tart/OCI/RemoteName.swift

@@ -1,31 +1,57 @@
 import Foundation
 import Parsing
 
-struct Tail {
-  enum TailType {
+struct Reference: Comparable, Hashable, CustomStringConvertible {
+  enum ReferenceType: Comparable {
     case Tag
     case Digest
   }
 
-  var type: TailType
-  var value: String
-}
+  let type: ReferenceType
+  let value: String
 
-struct RemoteName: Comparable, CustomStringConvertible {
-  var host: String
-  var namespace: String
-  var reference: String = "latest"
-  var fullyQualifiedReference: String {
+  var fullyQualified: String {
     get {
-      if reference.starts(with: "sha256:") {
-        return "@" + reference
+      switch type {
+      case .Tag:
+        return ":" + value
+      case .Digest:
+        return "@" + value
       }
-
-      return ":" + reference
     }
   }
 
-  init(host: String, namespace: String, reference: String) {
+  init(tag: String) {
+    type = .Tag
+    value = tag
+  }
+
+  init(digest: String) {
+    type = .Digest
+    value = digest
+  }
+
+  static func <(lhs: Reference, rhs: Reference) -> Bool {
+    if lhs.type != rhs.type {
+      return lhs.type < rhs.type
+    } else {
+      return lhs.value < rhs.value
+    }
+  }
+
+  var description: String {
+    get {
+      fullyQualified
+    }
+  }
+}
+
+struct RemoteName: Comparable, Hashable, CustomStringConvertible {
+  var host: String
+  var namespace: String
+  var reference: Reference
+
+  init(host: String, namespace: String, reference: Reference) {
     self.host = host
     self.namespace = namespace
     self.reference = reference
@@ -34,6 +60,7 @@ struct RemoteName: Comparable, CustomStringConvertible {
   init(_ name: String) throws {
     let csNormal = [
       UInt8(ascii: "a")...UInt8(ascii: "z"),
+      UInt8(ascii: "A")...UInt8(ascii: "Z"),
       UInt8(ascii: "0")...UInt8(ascii: "9"),
     ].asCharacterSet().union(CharacterSet(charactersIn: "_-."))
 
@@ -57,13 +84,13 @@ struct RemoteName: Comparable, CustomStringConvertible {
           Parse {
             ":"
             csNormal.map {
-              Tail(type: .Tag, value: String($0))
+              Reference(tag: String($0))
             }
           }
           Parse {
             "@sha256:"
             csHex.map {
-              Tail(type: .Digest, value: "sha256:" + String($0))
+              Reference(digest: "sha256:" + String($0))
             }
           }
         }
@@ -75,9 +102,7 @@ struct RemoteName: Comparable, CustomStringConvertible {
 
     host = String(result.0)
     namespace = String(result.1)
-    if let tail = result.2 {
-      reference = tail.value
-    }
+    reference = result.2 ?? Reference(tag: "latest")
   }
 
   static func <(lhs: RemoteName, rhs: RemoteName) -> Bool {
@@ -91,7 +116,7 @@ struct RemoteName: Comparable, CustomStringConvertible {
   }
 
   var description: String {
-    "\(host)/\(namespace)\(fullyQualifiedReference)"
+    "\(host)/\(namespace)\(reference.fullyQualified)"
   }
 }
 

Sources/tart/Passphrase/PassphraseGenerator.swift

@@ -0,0 +1,13 @@
+import Foundation
+
+struct PassphraseGenerator: Sequence {
+    func makeIterator() -> PassphraseIterator {
+        PassphraseIterator()
+    }
+}
+
+struct PassphraseIterator: IteratorProtocol {
+    mutating func next() -> String? {
+        passphrases[Int(arc4random_uniform(UInt32(passphrases.count)))]
+    }
+}

Sources/tart/Root.swift

@@ -1,9 +1,11 @@
 import ArgumentParser
+import Foundation
 
 @main
 struct Root: AsyncParsableCommand {
   static var configuration = CommandConfiguration(
     commandName: "tart",
+    version: CI.version,
     subcommands: [
       Create.self,
       Clone.self,
@@ -16,4 +18,30 @@ struct Root: AsyncParsableCommand {
       Push.self,
       Delete.self,
     ])
+
+  public static func main() async throws {
+    // Ensure the default SIGINT handled is disabled,
+    // otherwise there's a race between two handlers
+    signal(SIGINT, SIG_IGN);
+    // Handle cancellation by Ctrl+C ourselves
+    let task = withUnsafeCurrentTask { $0 }!
+    let sigintSrc = DispatchSource.makeSignalSource(signal: SIGINT)
+    sigintSrc.setEventHandler {
+      task.cancel()
+    }
+    sigintSrc.activate()
+
+    // Parse and run command
+    do {
+      var command = try parseAsRoot()
+
+      if var asyncCommand = command as? AsyncParsableCommand {
+        try await asyncCommand.run()
+      } else {
+        try command.run()
+      }
+    } catch {
+      exit(withError: error)
+    }
+  }
 }

Sources/tart/Softnet.swift

@@ -0,0 +1,77 @@
+import Foundation
+
+enum SoftnetError: Error {
+  case InitializationFailed(why: String)
+}
+
+class Softnet {
+  private let process = Process()
+
+  let vmFD: Int32
+
+  init(vmMACAddress: String) throws {
+    let binaryName = "softnet"
+
+    guard let executableURL = Self.resolveBinaryPath(binaryName) else {
+      throw SoftnetError.InitializationFailed(why: "\(binaryName) not found in PATH")
+    }
+
+    let fds = UnsafeMutablePointer<Int32>.allocate(capacity: MemoryLayout<Int>.stride * 2)
+
+    let ret = socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)
+    if ret != 0 {
+      throw SoftnetError.InitializationFailed(why: "socketpair() failed with exit code \(ret)")
+    }
+
+    vmFD = fds[0]
+    let softnetFD = fds[1]
+
+    try setSocketBuffers(vmFD, 1 * 1024 * 1024);
+    try setSocketBuffers(softnetFD, 1 * 1024 * 1024);
+
+    process.executableURL = executableURL
+    process.arguments = ["--vm-fd", String(STDIN_FILENO), "--vm-mac-address", vmMACAddress]
+    process.standardInput = FileHandle(fileDescriptor: softnetFD, closeOnDealloc: false)
+  }
+
+  func run() throws {
+    try process.run()
+  }
+
+  func stop() throws {
+    process.interrupt()
+    process.waitUntilExit()
+  }
+
+  private static func resolveBinaryPath(_ name: String) -> URL? {
+    guard let path = ProcessInfo.processInfo.environment["PATH"] else {
+      return nil
+    }
+
+    for pathComponent in path.split(separator: ":") {
+      let url = URL(fileURLWithPath: String(pathComponent))
+              .appendingPathComponent(name, isDirectory: false)
+
+      if FileManager.default.fileExists(atPath: url.path) {
+        return url
+      }
+    }
+
+    return nil
+  }
+
+  private func setSocketBuffers(_ fd: Int32, _ sizeBytes: Int) throws {
+    var option_value = sizeBytes
+    let option_len = socklen_t(MemoryLayout<Int>.size)
+
+    var ret = setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &option_value, option_len)
+    if ret != 0 {
+      throw SoftnetError.InitializationFailed(why: "setsockopt(SO_RCVBUF) returned \(ret)")
+    }
+
+    ret = setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &option_value, option_len)
+    if ret != 0 {
+      throw SoftnetError.InitializationFailed(why: "setsockopt(SO_SNDBUF) returned \(ret)")
+    }
+  }
+}

Sources/tart/VM+Recovery.swift

@@ -0,0 +1,37 @@
+import Foundation
+import Virtualization
+import Dynamic
+
+// Kudos to @saagarjha's VirtualApple for finding about _VZVirtualMachineStartOptions
+
+extension VZVirtualMachine {
+  func start(_ recovery: Bool) async throws {
+    if !recovery {
+      // just use the regular API
+      return try await withCheckedThrowingContinuation { continuation in
+        DispatchQueue.main.async {
+          self.start(completionHandler: { result in
+            continuation.resume(with: result)
+          })
+        }
+      }
+    }
+
+    // use some private stuff only for recovery
+    return try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<Void, Error>) in
+      DispatchQueue.main.async {
+        let handler: @convention(block) (_ result: Any?) -> Void = { result in
+          if let error = result as? Error {
+            continuation.resume(throwing: error)
+          } else {
+            continuation.resume(returning: ())
+          }
+        }
+        // dynamic magic
+        let options = Dynamic._VZVirtualMachineStartOptions()
+        options.bootMacOSRecovery = recovery
+        Dynamic(self)._start(withOptions: options, completionHandler: handler)
+      }
+    }
+  }
+}

Sources/tart/VM.swift

@@ -23,17 +23,24 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
   // VM's config
   var config: VMConfig
 
-  init(vmDir: VMDirectory) throws {
+  var softnet: Softnet? = nil
+
+  init(vmDir: VMDirectory, withSoftnet: Bool = false) throws {
     let auxStorage = VZMacAuxiliaryStorage(contentsOf: vmDir.nvramURL)
 
     name = vmDir.name
     config = try VMConfig.init(fromURL: vmDir.configURL)
 
-    let configuration = try VM.craftConfiguration(diskURL: vmDir.diskURL, auxStorage: auxStorage, vmConfig: config)
+    // Initialize the virtual machine and its configuration
+    if withSoftnet {
+      softnet = try Softnet(vmMACAddress: config.macAddress.string)
+    }
+
+    let configuration = try Self.craftConfiguration(diskURL: vmDir.diskURL, auxStorage: auxStorage, vmConfig: config,
+      softnet: softnet)
     virtualMachine = VZVirtualMachine(configuration: configuration)
 
     super.init()
-
     virtualMachine.delegate = self
   }
 
@@ -77,8 +84,17 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     try data.write(to: expectedIPSWLocation, options: [.atomic])
     return expectedIPSWLocation
   }
+  
+  var inFinalState: Bool {
+    get {
+      virtualMachine.state == VZVirtualMachine.State.stopped ||
+        virtualMachine.state == VZVirtualMachine.State.paused ||
+        virtualMachine.state == VZVirtualMachine.State.error
+      
+    }
+  }
 
-  init(vmDir: VMDirectory, ipswURL: URL?, diskSizeGB: UInt8) async throws {
+  init(vmDir: VMDirectory, ipswURL: URL?, diskSizeGB: UInt16, withSoftnet: Bool = false) async throws {
     let ipswURL = ipswURL != nil ? ipswURL! : try await VM.retrieveLatestIPSW();
 
     // Load the restore image and try to get the requirements
@@ -106,14 +122,20 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
       cpuCountMin: requirements.minimumSupportedCPUCount,
       memorySizeMin: requirements.minimumSupportedMemorySize
     )
+    // allocate at least 4 CPUs because otherwise VMs are frequently freezing
+    try config.setCPU(cpuCount: max(4, requirements.minimumSupportedCPUCount))
     try config.save(toURL: vmDir.configURL)
 
     // Initialize the virtual machine and its configuration
-    let configuration = try VM.craftConfiguration(diskURL: vmDir.diskURL, auxStorage: auxStorage, vmConfig: config)
+    if withSoftnet {
+      softnet = try Softnet(vmMACAddress: config.macAddress.string)
+    }
+
+    let configuration = try Self.craftConfiguration(diskURL: vmDir.diskURL, auxStorage: auxStorage, vmConfig: config,
+      softnet: softnet)
     virtualMachine = VZVirtualMachine(configuration: configuration)
 
     super.init()
-
     virtualMachine.delegate = self
 
     // Run automated installation
@@ -131,19 +153,38 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     }
   }
 
-  func run() async throws {
-    try await withCheckedThrowingContinuation { continuation in
-      DispatchQueue.main.async {
-        self.virtualMachine.start(completionHandler: { result in
-          continuation.resume(with: result)
-        })
+  func run(_ recovery: Bool) async throws {
+    if let softnet = softnet {
+      try softnet.run()
+    }
+
+    try await virtualMachine.start(recovery)
+
+    await withTaskCancellationHandler(operation: {
+      sema.wait()
+    }, onCancel: {
+      sema.signal()
+    })
+
+    if Task.isCancelled {
+      DispatchQueue.main.sync {
+        Task {
+          try await self.virtualMachine.stop()
+        }
       }
     }
 
-    sema.wait()
+    if let softnet = softnet {
+      try softnet.stop();
+    }
   }
 
-  static func craftConfiguration(diskURL: URL, auxStorage: VZMacAuxiliaryStorage, vmConfig: VMConfig) throws -> VZVirtualMachineConfiguration {
+  static func craftConfiguration(
+    diskURL: URL,
+    auxStorage: VZMacAuxiliaryStorage,
+    vmConfig: VMConfig,
+    softnet: Softnet? = nil
+  ) throws -> VZVirtualMachineConfiguration {
     let configuration = VZVirtualMachineConfiguration()
 
     // Boot loader
@@ -164,22 +205,44 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
 
     // Display
     let graphicsDeviceConfiguration = VZMacGraphicsDeviceConfiguration()
-    graphicsDeviceConfiguration.displays = [
-      VZMacGraphicsDisplayConfiguration(
-        widthInPixels: vmConfig.display.width,
-        heightInPixels: vmConfig.display.height,
-        pixelsPerInch: vmConfig.display.dpi
+    if let hostMainScreen = NSScreen.main {
+      let vmScreenSize = NSSize(
+        width: vmConfig.display.width,
+        height: vmConfig.display.height
       )
-    ]
+      graphicsDeviceConfiguration.displays = [
+        VZMacGraphicsDisplayConfiguration(for: hostMainScreen, sizeInPoints: vmScreenSize)
+      ]
+    } else {
+      graphicsDeviceConfiguration.displays = [
+        VZMacGraphicsDisplayConfiguration(
+          widthInPixels: vmConfig.display.width,
+          heightInPixels: vmConfig.display.height,
+          // Reasonable guess like https://developer.apple.com/documentation/coregraphics/1456599-cgdisplayscreensize    
+          pixelsPerInch: 72
+        )
+      ]
+    }
     configuration.graphicsDevices = [graphicsDeviceConfiguration]
 
+    // Audio
+    let soundDeviceConfiguration = VZVirtioSoundDeviceConfiguration()
+    soundDeviceConfiguration.streams = [VZVirtioSoundDeviceInputStreamConfiguration(), VZVirtioSoundDeviceOutputStreamConfiguration()]
+    configuration.audioDevices = [soundDeviceConfiguration]
+
     // Keyboard and mouse
     configuration.keyboards = [VZUSBKeyboardConfiguration()]
     configuration.pointingDevices = [VZUSBScreenCoordinatePointingDeviceConfiguration()]
 
     // Networking
     let vio = VZVirtioNetworkDeviceConfiguration()
-    vio.attachment = VZNATNetworkDeviceAttachment()
+
+    if let softnet = softnet {
+      let fh = FileHandle.init(fileDescriptor: softnet.vmFD)
+      vio.attachment = VZFileHandleNetworkDeviceAttachment(fileHandle: fh)
+    } else {
+      vio.attachment = VZNATNetworkDeviceAttachment()
+    }
     vio.macAddress = vmConfig.macAddress
     configuration.networkDevices = [vio]
 
@@ -207,7 +270,7 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
   }
 
   func virtualMachine(_ virtualMachine: VZVirtualMachine, networkDevice: VZNetworkDevice, attachmentWasDisconnectedWithError error: Error) {
-    print("virtual machine's network attachment has been disconnected")
+    print("virtual machine's network attachment \(networkDevice) has been disconnected with error: \(error)")
     sema.signal()
   }
 }

Sources/tart/VMConfig.swift

@@ -29,7 +29,6 @@ enum CodingKeys: String, CodingKey {
 struct VMDisplayConfig: Codable {
   var width: Int = 1024
   var height: Int = 768
-  var dpi: Int = 72
 }
 
 struct VMConfig: Codable {
@@ -60,12 +59,16 @@ struct VMConfig: Codable {
     memorySize = memorySizeMin
   }
 
-  init(fromData: Data) throws {
-    self = try JSONDecoder().decode(VMConfig.self, from: fromData)
+  init(fromJSON: Data) throws {
+    self = try Config.jsonDecoder().decode(Self.self, from: fromJSON)
   }
 
   init(fromURL: URL) throws {
-    self = try Self(fromData: try Data(contentsOf: fromURL))
+    self = try Self(fromJSON: try Data(contentsOf: fromURL))
+  }
+
+  func toJSON() throws -> Data {
+    try Config.jsonEncoder().encode(self)
   }
 
   func save(toURL: URL) throws {

Sources/tart/VMDirectory+OCI.swift

@@ -4,7 +4,7 @@ import Compression
 enum OCIError: Error {
   case ShouldBeExactlyOneLayer
   case ShouldBeAtLeastOneLayer
-  case FailedToCreateDiskFile
+  case FailedToCreateVmFile
 }
 
 extension VMDirectory {
@@ -31,8 +31,14 @@ extension VMDirectory {
     if configLayers.count != 1 {
       throw OCIError.ShouldBeExactlyOneLayer
     }
-    let configData = try await registry.pullBlob(configLayers.first!.digest)
-    try VMConfig(fromData: configData).save(toURL: configURL)
+    if !FileManager.default.createFile(atPath: configURL.path, contents: nil) {
+      throw OCIError.FailedToCreateVmFile
+    }
+    let configFile = try FileHandle(forWritingTo: configURL)
+    try await registry.pullBlob(configLayers.first!.digest) { buffer in
+      configFile.write(Data(buffer: buffer))
+    }
+    try configFile.close()
 
     // Pull VM's disk layers and decompress them sequentially into a disk file
     let diskLayers = manifest.layers.filter {
@@ -42,7 +48,7 @@ extension VMDirectory {
       throw OCIError.ShouldBeAtLeastOneLayer
     }
     if !FileManager.default.createFile(atPath: diskURL.path, contents: nil) {
-      throw OCIError.FailedToCreateDiskFile
+      throw OCIError.FailedToCreateVmFile
     }
     let disk = try FileHandle(forWritingTo: diskURL)
     let filter = try OutputFilter(.decompress, using: .lz4, bufferCapacity: Self.bufferSizeBytes) { data in
@@ -52,18 +58,23 @@ extension VMDirectory {
     }
 
     // Progress
-    let diskCompressedSize: Int64 = Int64(diskLayers.map {$0.size}.reduce(0) {$0 + $1})
+    let diskCompressedSize: Int64 = Int64(diskLayers.map {
+              $0.size
+            }
+            .reduce(0) {
+              $0 + $1
+            })
     let prettyDiskSize = String(format: "%.1f", Double(diskCompressedSize) / 1_000_000_000.0)
     defaultLogger.appendNewLine("pulling disk (\(prettyDiskSize) GB compressed)...")
     let progress = Progress(totalUnitCount: diskCompressedSize)
     ProgressObserver(progress).log(defaultLogger)
 
     for diskLayer in diskLayers {
-      let diskData = try await registry.pullBlob(diskLayer.digest)
-      try filter.write(diskData)
-
-      // Progress
-      progress.completedUnitCount += Int64(diskLayer.size)
+      try await registry.pullBlob(diskLayer.digest) { buffer in
+        let data = Data(buffer: buffer)
+        try filter.write(data)
+        progress.completedUnitCount += Int64(data.count)
+      }
     }
     try filter.finalize()
     try disk.close()
@@ -77,11 +88,17 @@ extension VMDirectory {
     if nvramLayers.count != 1 {
       throw OCIError.ShouldBeExactlyOneLayer
     }
-    let nvramData = try await registry.pullBlob(nvramLayers.first!.digest)
-    try nvramData.write(to: nvramURL)
+    if !FileManager.default.createFile(atPath: nvramURL.path, contents: nil) {
+      throw OCIError.FailedToCreateVmFile
+    }
+    let nvram = try FileHandle(forWritingTo: nvramURL)
+    try await registry.pullBlob(nvramLayers.first!.digest) { buffer in
+      nvram.write(Data(buffer: buffer))
+    }
+    try nvram.close()
   }
 
-  func pushToRegistry(registry: Registry, references: [String]) async throws {
+  func pushToRegistry(registry: Registry, references: [String]) async throws -> RemoteName {
     var layers = Array<OCIManifestLayer>()
 
     // Read VM's config and push it as blob
@@ -92,7 +109,7 @@ extension VMDirectory {
 
     // Progress
     let diskSize = try FileManager.default.attributesOfItem(atPath: diskURL.path)[.size] as! Int64
-    
+
     defaultLogger.appendNewLine("pushing disk... this will take a while...")
     let progress = Progress(totalUnitCount: diskSize)
     ProgressObserver(progress).log(defaultLogger)
@@ -100,9 +117,11 @@ extension VMDirectory {
     // Read VM's compressed disk as chunks
     // and sequentially upload them as blobs
     let disk = try FileHandle(forReadingFrom: diskURL)
+    var diskReadBytes: UInt64 = 0
     let compressingFilter = try InputFilter<Data>(.compress, using: .lz4, bufferCapacity: Self.bufferSizeBytes) { _ in
       let data = try disk.read(upToCount: Self.bufferSizeBytes)
-      
+      diskReadBytes += UInt64(data?.count ?? 0)
+
       progress.completedUnitCount += Int64(data?.count ?? 0)
 
       return data
@@ -120,21 +139,23 @@ extension VMDirectory {
     layers.append(OCIManifestLayer(mediaType: Self.nvramMediaType, size: nvram.count, digest: nvramDigest))
 
     // Craft a stub OCI config for Docker Hub compatibility
-    struct OCIConfig: Encodable, Decodable {
-      var architecture: String = "arm64"
-      var os: String = "darwin"
-    }
-
-    let ociConfigJSON = try JSONEncoder().encode(OCIConfig())
+    let ociConfigJSON = try OCIConfig().toJSON()
     let ociConfigDigest = try await registry.pushBlob(fromData: ociConfigJSON)
-    let ociConfigDescriptor = Descriptor(size: ociConfigJSON.count, digest: ociConfigDigest)
+    let manifest = OCIManifest(
+            config: OCIManifestConfig(size: ociConfigJSON.count, digest: ociConfigDigest),
+            layers: layers,
+            uncompressedDiskSize: diskReadBytes
+    )
 
     // Manifest
     for reference in references {
       defaultLogger.appendNewLine("pushing manifest for \(reference)...")
 
-      _ = try await registry.pushManifest(reference: reference, config: ociConfigDescriptor, layers: layers)
+      _ = try await registry.pushManifest(reference: reference, manifest: manifest)
     }
+
+    let pushedReference = Reference(digest: try manifest.digest())
+    return RemoteName(host: registry.baseURL.host!, namespace: registry.namespace, reference: pushedReference)
   }
 }
 

Sources/tart/VMDirectory.swift

@@ -24,6 +24,13 @@ struct VMDirectory {
     baseURL.lastPathComponent
   }
 
+  static func temporary() throws -> VMDirectory {
+    let tmpDir = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    try FileManager.default.createDirectory(at: tmpDir, withIntermediateDirectories: false)
+
+    return VMDirectory(baseURL: tmpDir)
+  }
+
   var initialized: Bool {
     FileManager.default.fileExists(atPath: configURL.path) &&
       FileManager.default.fileExists(atPath: diskURL.path) &&
@@ -61,7 +68,7 @@ struct VMDirectory {
     try newVMConfig.save(toURL: to.configURL)
   }
 
-  func resizeDisk(_ sizeGB: UInt8) throws {
+  func resizeDisk(_ sizeGB: UInt16) throws {
     if !FileManager.default.fileExists(atPath: diskURL.path) {
       FileManager.default.createFile(atPath: diskURL.path, contents: nil, attributes: nil)
     }

Sources/tart/VMStorageLocal.swift

@@ -27,6 +27,11 @@ class VMStorageLocal {
     return vmDir
   }
 
+  func move(_ name: String, from: VMDirectory) throws {
+    _ = try FileManager.default.createDirectory(at: baseURL, withIntermediateDirectories: true)
+    _ = try FileManager.default.replaceItemAt(vmURL(name), withItemAt: from.baseURL)
+  }
+
   func delete(_ name: String) throws {
     try FileManager.default.removeItem(at: vmURL(name))
   }
@@ -36,9 +41,13 @@ class VMStorageLocal {
       return try FileManager.default.contentsOfDirectory(
         at: baseURL,
         includingPropertiesForKeys: [.isDirectoryKey],
-        options: .skipsSubdirectoryDescendants).map { url in
+        options: .skipsSubdirectoryDescendants).compactMap { url in
         let vmDir = VMDirectory(baseURL: url)
 
+        if !vmDir.initialized {
+          return nil
+        }
+
         return (vmDir.name, vmDir)
       }
     } catch {

Sources/tart/VMStorageOCI.swift

@@ -27,6 +27,17 @@ class VMStorageOCI {
     return vmDir
   }
 
+  func move(_ name: RemoteName, from: VMDirectory) throws{
+    let targetURL = vmURL(name)
+
+    // Pre-create intermediate directories (e.g. creates ~/.tart/cache/OCIs/github.com/org/repo/
+    // for github.com/org/repo:latest)
+    try FileManager.default.createDirectory(at: targetURL.deletingLastPathComponent(),
+            withIntermediateDirectories: true)
+
+    _ = try FileManager.default.replaceItemAt(targetURL, withItemAt: from.baseURL)
+  }
+
   func delete(_ name: RemoteName) throws {
     try FileManager.default.removeItem(at: vmURL(name))
   }
@@ -64,35 +75,43 @@ class VMStorageOCI {
   func pull(_ name: RemoteName, registry: Registry) async throws {
     defaultLogger.appendNewLine("pulling manifest...")
 
-    let (manifest, manifestData) = try await registry.pullManifest(reference: name.reference)
+    let (manifest, _) = try await registry.pullManifest(reference: name.reference.value)
+
+    var digestName = RemoteName(host: name.host, namespace: name.namespace,
+            reference: Reference(digest: try manifest.digest()))
 
-    // Create directory for manifest's digest
-    var digestName = name
-    digestName.reference = Digest.hash(manifestData)
     if !exists(digestName) {
-      let vmDir = try create(digestName)
-      try await vmDir.pullFromRegistry(registry: registry, manifest: manifest)
+      let tmpVMDir = try VMDirectory.temporary()
+      try await withTaskCancellationHandler(operation: {
+        try await tmpVMDir.pullFromRegistry(registry: registry, manifest: manifest)
+        try move(digestName, from: tmpVMDir)
+      }, onCancel: {
+        try? FileManager.default.removeItem(at: tmpVMDir.baseURL)
+      })
     } else {
-      defaultLogger.appendNewLine("\(digestName.reference) image is already cached! creating a symlink...")   
+      defaultLogger.appendNewLine("\(digestName) image is already cached! creating a symlink...")
     }
 
-    // Create directory for reference if it's different
-    if digestName != name {
+    if name != digestName {
       // Overwrite the old symbolic link
-      if FileManager.default.fileExists(atPath: vmURL(name).path) {
-        try FileManager.default.removeItem(at: vmURL(name))
-      }
-
-      try FileManager.default.createSymbolicLink(at: vmURL(name), withDestinationURL: vmURL(digestName))
+      try link(from: digestName, to: name)
     }
   }
+
+  func link(from: RemoteName, to: RemoteName) throws {
+    if FileManager.default.fileExists(atPath: vmURL(to).path) {
+      try FileManager.default.removeItem(at: vmURL(to))
+    }
+
+    try FileManager.default.createSymbolicLink(at: vmURL(to), withDestinationURL: vmURL(from))
+  }
 }
 
 extension URL {
   func appendingRemoteName(_ name: RemoteName) -> URL {
     var result: URL = self
 
-    for pathComponent in (name.host + "/" + name.namespace + "/" + name.reference).split(separator: "/") {
+    for pathComponent in (name.host + "/" + name.namespace + "/" + name.reference.value).split(separator: "/") {
       result = result.appendingPathComponent(String(pathComponent))
     }
 

Sources/tart/VNCWrapper.swift

@@ -0,0 +1,38 @@
+import Foundation
+import Dynamic
+import Virtualization
+
+class VNCWrapper {
+    let password: String
+    private let vnc: Dynamic
+
+    init(virtualMachine: VZVirtualMachine) {
+        password = Array(PassphraseGenerator().prefix(4)).joined(separator: "-")
+        let securityConfiguration = Dynamic._VZVNCAuthenticationSecurityConfiguration(password: password)
+        vnc = Dynamic._VZVNCServer(port: 0, queue: DispatchQueue.global(),
+                securityConfiguration: securityConfiguration)
+        vnc.virtualMachine = virtualMachine
+        vnc.start()
+    }
+
+    func stop() throws {
+        vnc.stop()
+    }
+
+    deinit {
+        try? stop()
+    }
+
+    func waitForPort() async throws -> UInt16 {
+        while true {
+            // Port is 0 shortly after start(),
+            // but will be initialized later
+            if let port = vnc.port.asUInt16, port != 0 {
+                return port
+            }
+
+            // Wait 50 ms.
+            try await Task.sleep(nanoseconds: 50_000_000)
+        }
+    }
+}

Tests/TartTests/MACAddressResolverTests.swift

@@ -0,0 +1,35 @@
+import XCTest
+import Network
+@testable import tart
+
+final class MACAddressResolverTests: XCTestCase {
+  func testSingleEntry() throws {
+    let leases = try Leases("""
+                            {
+                              ip_address=1.2.3.4
+                              hw_address=1,00:11:22:33:44:55
+                            }
+                            """)
+
+    XCTAssertEqual(IPv4Address("1.2.3.4"),
+      try leases.resolveMACAddress(macAddress: MACAddress(fromString: "00:11:22:33:44:55")!))
+  }
+
+  func testMultipleEntries() throws {
+    let leases = try Leases("""
+                            {
+                              ip_address=1.2.3.4
+                              hw_address=1,00:11:22:33:44:55
+                            }
+                            {
+                              ip_address=5.6.7.8
+                              hw_address=1,AA:BB:CC:DD:EE:FF
+                            }
+                            """)
+
+    XCTAssertEqual(IPv4Address("1.2.3.4"),
+      try leases.resolveMACAddress(macAddress: MACAddress(fromString: "00:11:22:33:44:55")!))
+    XCTAssertEqual(IPv4Address("5.6.7.8"),
+      try leases.resolveMACAddress(macAddress: MACAddress(fromString: "AA:BB:CC:DD:EE:FF")!))
+  }
+}

Tests/TartTests/RegistryTests.swift

@@ -0,0 +1,89 @@
+import XCTest
+@testable import tart
+
+final class RegistryTests: XCTestCase {
+    var registryRunner: RegistryRunner?
+
+    override func setUp() async throws {
+        try await super.setUp()
+
+        do {
+            registryRunner = try await RegistryRunner()
+        } catch {
+            try XCTSkipIf(ProcessInfo.processInfo.environment["CI"] == nil)
+        }
+    }
+
+    override func tearDown() async throws {
+        try await super.tearDown()
+
+        registryRunner = nil
+    }
+
+    var registry: Registry {
+        registryRunner!.registry
+    }
+
+    func testPushPullBlobSmall() async throws {
+        // Generate a simple blob
+        let pushedBlob = Data("The quick brown fox jumps over the lazy dog".utf8)
+
+        // Push it
+        let pushedBlobDigest = try await registry.pushBlob(fromData: pushedBlob)
+        XCTAssertEqual("sha256:d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592", pushedBlobDigest)
+
+        // Pull it
+        var pulledBlob = Data()
+        try await registry.pullBlob(pushedBlobDigest) { buffer in
+            pulledBlob.append(Data(buffer: buffer))
+        }
+
+        // Ensure that both blobs are identical
+        XCTAssertEqual(pushedBlob, pulledBlob)
+    }
+
+    func testPushPullBlobHuge() async throws {
+        // Generate a large enough blob
+        let fh = FileHandle(forReadingAtPath: "/dev/urandom")!
+        let largeBlobToPush = try fh.read(upToCount: 768 * 1024 * 1024)!
+
+        // Push it
+        let largeBlobDigest = try await registry.pushBlob(fromData: largeBlobToPush)
+
+        // Pull it
+        var pulledLargeBlob = Data()
+        try await registry.pullBlob(largeBlobDigest) { buffer in
+            pulledLargeBlob.append(Data(buffer: buffer))       
+        }
+
+        // Ensure that both blobs are identical
+        XCTAssertEqual(largeBlobToPush, pulledLargeBlob)
+    }
+
+    func testPushPullManifest() async throws {
+        // Craft a basic config
+        let configData = try OCIConfig().toJSON()
+        let configDigest = try await registry.pushBlob(fromData: configData)
+
+        // Craft a basic layer
+        let layerData = Data("doesn't matter".utf8)
+        let layerDigest = try await registry.pushBlob(fromData: layerData)
+
+        // Craft a basic manifest and push it
+        let manifest = OCIManifest(
+                config: OCIManifestConfig(size: configData.count, digest: configDigest),
+                layers: [
+                    OCIManifestLayer(mediaType: "application/octet-stream", size: layerData.count, digest: layerDigest)
+                ]
+        )
+        let pushedManifestDigest = try await registry.pushManifest(reference: "latest", manifest: manifest)
+
+        // Ensure that the manifest pulled by tag matches with the one pushed above
+        let (pulledByTagManifest, _) = try await registry.pullManifest(reference: "latest")
+        XCTAssertEqual(manifest, pulledByTagManifest)
+
+        // Ensure that the manifest pulled by digest matches with the one pushed above
+        let (pulledByDigestManifest, _) = try await registry.pullManifest(reference: "\(pushedManifestDigest)")
+        XCTAssertEqual(manifest, pulledByDigestManifest)
+    }
+}

Tests/TartTests/RemoteNameTests.swift

@@ -3,16 +3,22 @@ import XCTest
 
 final class RemoteNameTests: XCTestCase {
   func testTag() throws {
-    let expectedRemoteName = RemoteName(host: "ghcr.io", namespace: "a/b", reference: "latest")
+    let expectedRemoteName = RemoteName(host: "ghcr.io", namespace: "a/b", reference: Reference(tag: "latest"))
 
     XCTAssertEqual(expectedRemoteName, try RemoteName("ghcr.io/a/b:latest"))
   }
+  
+  func testComplexTag() throws {
+    let expectedRemoteName = RemoteName(host: "ghcr.io", namespace: "a/b", reference: Reference(tag: "1.2.3-RC-1"))
+
+    XCTAssertEqual(expectedRemoteName, try RemoteName("ghcr.io/a/b:1.2.3-RC-1"))
+  }
 
   func testDigest() throws {
     let expectedRemoteName = RemoteName(
       host: "ghcr.io",
       namespace: "a/b",
-      reference: "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+      reference: Reference(digest: "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855")
     )
 
     XCTAssertEqual(expectedRemoteName,

Tests/TartTests/Util/RegistryRunner.swift

@@ -0,0 +1,54 @@
+import Foundation
+@testable import tart
+
+enum RegistryRunnerError: Error {
+    case DockerFailed(exitCode: Int32)
+}
+
+class RegistryRunner {
+    let containerID: String
+    let registry: Registry
+
+    static func dockerCmd(_ arguments: String...) throws -> String {
+        let stdoutPipe = Pipe()
+
+        let proc = Process()
+        proc.executableURL = URL(fileURLWithPath: "/usr/local/bin/docker")
+        proc.arguments = arguments
+        proc.standardOutput = stdoutPipe
+        try proc.run()
+
+        let stdoutData = stdoutPipe.fileHandleForReading.readDataToEndOfFile()
+
+        proc.waitUntilExit()
+
+        if proc.terminationStatus != 0 {
+            throw RegistryRunnerError.DockerFailed(exitCode: proc.terminationStatus)
+        }
+
+        return String(data: stdoutData, encoding: .utf8) ?? ""
+    }
+
+    init() async throws {
+        // Start container
+        let container = try Self.dockerCmd("run", "-d", "--rm", "-p", "5000", "registry:2")
+                .trimmingCharacters(in: CharacterSet.newlines)
+        containerID = container
+
+        // Get forwarded port
+        let port = try Self.dockerCmd("inspect", containerID, "--format", "{{(index (index .NetworkSettings.Ports \"5000/tcp\") 0).HostPort}}")
+                .trimmingCharacters(in: CharacterSet.newlines)
+
+        registry = try Registry(urlComponents: URLComponents(string: "http://127.0.0.1:\(port)/v2/")!,
+                namespace: "vm-image")
+
+        // Wait for the Docker Registry to start
+        while ((try? await registry.ping()) == nil) {
+            try await Task.sleep(nanoseconds: 100_000_000)
+        }
+    }
+
+    deinit {
+        _ = try! Self.dockerCmd("kill", containerID)
+    }
+}