Bind and connect to Unix domain sockets using relative paths (#1192)

.cirrus.yml

@@ -72,17 +72,25 @@ task:
   macos_instance:
     image: ghcr.io/cirruslabs/macos-runner:sequoia
   env:
-    MACOS_SIGN_P12: ENCRYPTED[!183482723ca1a95f9c4439f7a79c9d3b115472bb18c739ed1586e12d3914ccf94ade8169eeda7332fc204f8be9c27d9f!]
+    MACOS_CERTIFICATE: ENCRYPTED[552b9d275d1c2bdbc1bff778b104a8f9a53cbd0d59344d4b7f6d0ca3c811a5cefb97bef9ba0ef31c219cb07bdacdd2c2]
-    MACOS_SIGN_PASSWORD: ENCRYPTED[!417423346c567f12007f42d084bff1cfee30ee14f7e8258550157679a269c70d541c9f19224224ab0293b10f2c6d4c5e!]
+    AC_PASSWORD: ENCRYPTED[4a761023e7e06fe2eb350c8b6e8e7ca961af193cb9ba47605f25f1d353abc3142606f412e405be48fd897a78787ea8c2]
-    MACOS_NOTARY_ISSUER_ID: ENCRYPTED[!74076906e9fa36bca3c1da1637b0759b58bb009eb1a707446896eefad3767e8dba1d0f87e71106b98cde98ac4b037a2a!]
-    MACOS_NOTARY_KEY_ID: ENCRYPTED[!af9e5da1010a6b04e548ef494acc77a6e0ce176549de98f81c5b5cdd72856de09f77e51cf0849e3c4b7a2d2c22f25ca8!]
-    MACOS_NOTARY_KEY: ENCRYPTED[!c70c53f3e6c163931c7cdf9d90aff8934ef21d5dd1090158688e00b94e97c68257d9cf4ae1df873e6ae0d949866aee72!]
     GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
     GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
+  setup_script:
+    - cd $HOME
+    - echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
+    - security create-keychain -p password101 build.keychain
+    - security default-keychain -s build.keychain
+    - security unlock-keychain -p password101 build.keychain
+    - security import certificate.p12 -k build.keychain -P password101 -T /usr/bin/codesign -T /usr/bin/pkgbuild
+    - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k password101 build.keychain
+    - xcrun notarytool store-credentials "notarytool" --apple-id "hello@cirruslabs.org" --team-id "9M2P8L4D89" --password $AC_PASSWORD
   install_script:
     - brew install go
+    - brew install mitchellh/gon/gon
     - brew install --cask goreleaser/tap/goreleaser-pro
   info_script:
+    - security find-identity -v
     - xcodebuild -version
     - swift -version
   goreleaser_script: goreleaser release --skip=publish --snapshot --clean
@@ -100,20 +108,28 @@ task:
   macos_instance:
     image: ghcr.io/cirruslabs/macos-runner:sequoia
   env:
-    MACOS_SIGN_P12: ENCRYPTED[!183482723ca1a95f9c4439f7a79c9d3b115472bb18c739ed1586e12d3914ccf94ade8169eeda7332fc204f8be9c27d9f!]
+    MACOS_CERTIFICATE: ENCRYPTED[552b9d275d1c2bdbc1bff778b104a8f9a53cbd0d59344d4b7f6d0ca3c811a5cefb97bef9ba0ef31c219cb07bdacdd2c2]
-    MACOS_SIGN_PASSWORD: ENCRYPTED[!417423346c567f12007f42d084bff1cfee30ee14f7e8258550157679a269c70d541c9f19224224ab0293b10f2c6d4c5e!]
+    AC_PASSWORD: ENCRYPTED[4a761023e7e06fe2eb350c8b6e8e7ca961af193cb9ba47605f25f1d353abc3142606f412e405be48fd897a78787ea8c2]
-    MACOS_NOTARY_ISSUER_ID: ENCRYPTED[!74076906e9fa36bca3c1da1637b0759b58bb009eb1a707446896eefad3767e8dba1d0f87e71106b98cde98ac4b037a2a!]
-    MACOS_NOTARY_KEY_ID: ENCRYPTED[!af9e5da1010a6b04e548ef494acc77a6e0ce176549de98f81c5b5cdd72856de09f77e51cf0849e3c4b7a2d2c22f25ca8!]
-    MACOS_NOTARY_KEY: ENCRYPTED[!c70c53f3e6c163931c7cdf9d90aff8934ef21d5dd1090158688e00b94e97c68257d9cf4ae1df873e6ae0d949866aee72!]
     GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
     GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
     SENTRY_ORG: cirrus-labs
     SENTRY_PROJECT: persistent-workers
     SENTRY_AUTH_TOKEN: ENCRYPTED[!9eaf2875d51b113e2f68598441ff8e6b2e53242e48fcb93633bd75a373fbe2e7caa900d837cc92f0b142b65579731644!]
+  setup_script:
+    - cd $HOME
+    - echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
+    - security create-keychain -p password101 build.keychain
+    - security default-keychain -s build.keychain
+    - security unlock-keychain -p password101 build.keychain
+    - security import certificate.p12 -k build.keychain -P password101 -T /usr/bin/codesign -T /usr/bin/pkgbuild
+    - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k password101 build.keychain
+    - xcrun notarytool store-credentials "notarytool" --apple-id "hello@cirruslabs.org" --team-id "9M2P8L4D89" --password $AC_PASSWORD
   install_script:
     - brew install go getsentry/tools/sentry-cli
+    - brew install mitchellh/gon/gon
     - brew install --cask goreleaser/tap/goreleaser-pro
   info_script:
+    - security find-identity -v
     - xcodebuild -version
     - swift -version
   release_script: goreleaser

.goreleaser.yml

@@ -1,4 +1,3 @@
-# yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
 version: 2
 
 project_name: tart
@@ -18,25 +17,15 @@ builds:
     goarch:
       - arm64
       - amd64
-    binary: tart
+    binary: tart.app/Contents/MacOS/tart
     prebuilt:
       path: '.build/{{- if eq .Arch "arm64" }}arm64{{- else }}x86_64{{ end }}-apple-macosx/release/tart'
 
 universal_binaries:
   - name_template: tart.app/Contents/MacOS/tart
     replace: true
-
+    hooks:
-notarize:
+      post: gon gon.hcl
-  macos:
-    - enabled: '{{ isEnvSet "MACOS_SIGN_P12" }}'
-      sign:
-        certificate: "{{.Env.MACOS_SIGN_P12}}"
-        password: "{{.Env.MACOS_SIGN_PASSWORD}}"
-        entitlements: ./Resources/tart-prod.entitlements
-      notarize:
-        issuer_id: "{{.Env.MACOS_NOTARY_ISSUER_ID}}"
-        key_id: "{{.Env.MACOS_NOTARY_KEY_ID}}"
-        key: "{{.Env.MACOS_NOTARY_KEY}}"
 
 archives:
   - name_template: "{{ .ProjectName }}"

Package.resolved

@@ -1,5 +1,5 @@
 {
-  "originHash" : "0da1cc30fa3c41e8c2e2edcdd55706549908275a54f681203e0eeade279deab9",
+  "originHash" : "061dfe6cdf4e6dbf32b51c5e7023c4ae69726dcafb42a35b34e5489b0338c17f",
   "pins" : [
     {
       "identity" : "antlr4",
@@ -49,10 +49,10 @@
     {
       "identity" : "opentelemetry-swift",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/cirruslabs/opentelemetry-swift",
+      "location" : "https://github.com/open-telemetry/opentelemetry-swift",
       "state" : {
-        "branch" : "use-feedback-handler",
+        "branch" : "main",
-        "revision" : "2040f383e2a8b0a568a7617d147f8f1e23abb298"
+        "revision" : "ed37be9525081509ab62410d38b705c2b3f0d5a4"
       }
     },
     {

Package.swift

@@ -25,7 +25,7 @@ let package = Package(
     .package(url: "https://github.com/jozefizso/swift-xattr", from: "3.0.0"),
     .package(url: "https://github.com/grpc/grpc-swift.git", .upToNextMajor(from: "1.27.0")),
     .package(url: "https://buf.build/gen/swift/git/1.27.1-20260114140118-bd09c26a260f.1/cirruslabs_tart-guest-agent_grpc_swift.git", branch: "main"),
-    .package(url: "https://github.com/cirruslabs/opentelemetry-swift", branch: "use-feedback-handler"),
+    .package(url: "https://github.com/open-telemetry/opentelemetry-swift", branch: "main"),
     .package(url: "https://github.com/open-telemetry/opentelemetry-swift-core", from: "2.3.0"),
 
   ],

Sources/tart/Commands/Exec.swift

@@ -47,8 +47,16 @@ struct Exec: AsyncParsableCommand {
       try! group.syncShutdownGracefully()
     }
 
+    // Change the current working directory to a VM's base directory
+    // to work around Unix domain socket 104 byte limitation [1]
+    //
+    // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
+    if let baseURL = vmDir.controlSocketURL.baseURL {
+      FileManager.default.changeCurrentDirectoryPath(baseURL.path())
+    }
+
     let channel = try GRPCChannelPool.with(
-      target: .unixDomainSocket(vmDir.controlSocketURL.path()),
+      target: .unixDomainSocket(vmDir.controlSocketURL.relativePath),
       transportSecurity: .plaintext,
       eventLoopGroup: group,
     )

Sources/tart/Commands/IP.swift

@@ -68,7 +68,15 @@ struct IP: AsyncParsableCommand {
           throw RuntimeError.Generic("Cannot perform IP resolution via Tart Guest Agent when control socket URL is not set")
         }
 
-        if let ip = try await AgentResolver.ResolveIP(controlSocketURL) {
+        // Change the current working directory to a VM's base directory
+        // to work around Unix domain socket 104 byte limitation [1]
+        //
+        // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
+        if let baseURL = controlSocketURL.baseURL {
+          FileManager.default.changeCurrentDirectoryPath(baseURL.path())
+        }
+
+        if let ip = try await AgentResolver.ResolveIP(controlSocketURL.relativePath) {
           return ip
         }
       }

Sources/tart/ControlSocket.swift

@@ -21,8 +21,16 @@ class ControlSocket {
     // if any, otherwise we may get the "address already in use" error
     try? FileManager.default.removeItem(atPath: controlSocketURL.path())
 
+    // Change the current working directory to a VM's base directory
+    // to work around Unix domain socket 104 byte limitation [1]
+    //
+    // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
+    if let baseURL = controlSocketURL.baseURL {
+      FileManager.default.changeCurrentDirectoryPath(baseURL.path())
+    }
+
     let serverChannel = try await ServerBootstrap(group: eventLoopGroup)
-      .bind(unixDomainSocketPath: controlSocketURL.path()) { childChannel in
+      .bind(unixDomainSocketPath: controlSocketURL.relativePath) { childChannel in
         childChannel.eventLoop.makeCompletedFuture {
           return try NIOAsyncChannel<ByteBuffer, ByteBuffer>(
             wrappingChannelSynchronously: childChannel

Sources/tart/MACAddressResolver/AgentResolver.swift

@@ -6,15 +6,15 @@ import Cirruslabs_TartGuestAgent_Apple_Swift
 import Cirruslabs_TartGuestAgent_Grpc_Swift
 
 class AgentResolver {
-  static func ResolveIP(_ controlSocketURL: URL) async throws -> IPv4Address? {
+  static func ResolveIP(_ controlSocketPath: String) async throws -> IPv4Address? {
     do {
-      return try await resolveIP(controlSocketURL)
+      return try await resolveIP(controlSocketPath)
     } catch let error as GRPCConnectionPoolError {
       return nil
     }
   }
 
-  private static func resolveIP(_ controlSocketURL: URL) async throws -> IPv4Address? {
+  private static func resolveIP(_ controlSocketPath: String) async throws -> IPv4Address? {
     // Create a gRPC channel connected to the VM's control socket
     let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
     defer {
@@ -22,7 +22,7 @@ class AgentResolver {
     }
 
     let channel = try GRPCChannelPool.with(
-      target: .unixDomainSocket(controlSocketURL.path()),
+      target: .unixDomainSocket(controlSocketPath),
       transportSecurity: .plaintext,
       eventLoopGroup: group,
     )

Sources/tart/VMDirectory.swift

@@ -27,7 +27,7 @@ struct VMDirectory: Prunable {
     baseURL.appendingPathComponent("manifest.json")
   }
   var controlSocketURL: URL {
-    baseURL.appendingPathComponent("control.sock")
+    URL(fileURLWithPath: "control.sock", relativeTo: baseURL)
   }
 
   var explicitlyPulledMark: URL {

docs/quick-start.md

@@ -19,7 +19,6 @@ tart run sequoia-base
     ```bash
     curl -LO https://github.com/cirruslabs/tart/releases/latest/download/tart.tar.gz
     tar -xzvf tart.tar.gz
-    xattr -dr com.apple.quarantine tart.app
     ./tart.app/Contents/MacOS/tart clone ghcr.io/cirruslabs/macos-sequoia-base:latest sequoia-base
     ./tart.app/Contents/MacOS/tart run sequoia-base
     ```

gon.hcl

@@ -0,0 +1,12 @@
+source = [ "dist/tart_darwin_all/tart.app/Contents/MacOS/tart" ]
+bundle_id = "com.github.cirruslabs.tart"
+
+apple_id {
+  username = "hello@cirruslabs.org"
+  password = "@env:AC_PASSWORD"
+}
+
+sign {
+  application_identity = "Developer ID Application: Cirrus Labs, Inc."
+  entitlements_file = "Resources/tart-prod.entitlements"
+}