Skip integration test gate for release (#1229)

* Move brew completions to post_install

* Reduce Layerizer test disk fixture size to 1GB

* Skip registry integration tests on Docker startup failure

.cirrus.yml

@@ -40,7 +40,7 @@ task:
   name: Lint
   alias: lint
   macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:sequoia
+    image: ghcr.io/cirruslabs/macos-runner:tahoe
   lint_script:
     - swift package plugin --allow-writing-to-package-directory swiftformat --cache ignore --lint --report swiftformat.json .
   always:
@@ -57,7 +57,7 @@ task:
   name: Build ($BUILD_ARCH)
   alias: build
   macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:sequoia
+    image: ghcr.io/cirruslabs/macos-runner:tahoe
   build_script: swift build --arch $BUILD_ARCH --product tart
   sign_script: codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/$BUILD_ARCH-apple-macosx/debug/tart
   binary_artifacts:
@@ -70,7 +70,7 @@ task:
     - lint
     - build
   macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:sequoia
+    image: ghcr.io/cirruslabs/macos-runner:tahoe
   env:
     MACOS_CERTIFICATE: ENCRYPTED[552b9d275d1c2bdbc1bff778b104a8f9a53cbd0d59344d4b7f6d0ca3c811a5cefb97bef9ba0ef31c219cb07bdacdd2c2]
     AC_PASSWORD: ENCRYPTED[4a761023e7e06fe2eb350c8b6e8e7ca961af193cb9ba47605f25f1d353abc3142606f412e405be48fd897a78787ea8c2]
@@ -103,10 +103,9 @@ task:
   only_if: $CIRRUS_TAG != ''
   depends_on:
     - lint
-    - test
     - build
   macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:sequoia
+    image: ghcr.io/cirruslabs/macos-runner:tahoe
   env:
     MACOS_CERTIFICATE: ENCRYPTED[552b9d275d1c2bdbc1bff778b104a8f9a53cbd0d59344d4b7f6d0ca3c811a5cefb97bef9ba0ef31c219cb07bdacdd2c2]
     AC_PASSWORD: ENCRYPTED[4a761023e7e06fe2eb350c8b6e8e7ca961af193cb9ba47605f25f1d353abc3142606f412e405be48fd897a78787ea8c2]
@@ -153,7 +152,7 @@ task:
   name: Deploy Documentation
   only_if: $CIRRUS_BRANCH == 'main'
   container:
-    image: ghcr.io/cirruslabs/mkdocs-material-insiders:latest
+    image: ghcr.io/squidfunk/mkdocs-material:latest
     registry_config: ENCRYPTED[!cf1a0f25325aa75bad3ce6ebc890bc53eb0044c02efa70d8cefb83ba9766275a994b4831706c52630a0692b2fa9cfb9e!]
   env:
     DEPLOY_TOKEN: ENCRYPTED[!45ed45666558902ed1c2400add734ec063103bec31841847e8c8764802fca229bfa6d85c690e16ad159e047574b48793!]

.goreleaser.yml

@@ -25,20 +25,26 @@ universal_binaries:
   - name_template: tart.app/Contents/MacOS/tart
     replace: true
     hooks:
-      post: gon gon.hcl
+      post:
+        - mkdir -p dist/tart_darwin_all/tart.app/Contents/Resources
+        - cp Resources/embedded.provisionprofile dist/tart_darwin_all/tart.app/Contents/
+        - cp Resources/Info.plist dist/tart_darwin_all/tart.app/Contents/
+        - cp "Resources/actool/UPW Tart.icns" "Resources/actool/Assets.car" dist/tart_darwin_all/tart.app/Contents/Resources/
+        - gon gon.hcl
 
 archives:
   - name_template: "{{ .ProjectName }}"
     files:
-      - src: Resources/embedded.provisionprofile
-        dst: tart.app/Contents
-        strip_parent: true
-      - src: Resources/Info.plist
-        dst: tart.app/Contents
-        strip_parent: true
-      - src: Resources/AppIcon.png
-        dst: tart.app/Contents/Resources
-        strip_parent: true
+      - src: dist/tart_darwin_all/tart.app/Contents/Info.plist
+        dst: tart.app/Contents/Info.plist
+      - src: dist/tart_darwin_all/tart.app/Contents/embedded.provisionprofile
+        dst: tart.app/Contents/embedded.provisionprofile
+      - src: dist/tart_darwin_all/tart.app/Contents/Resources/UPW Tart.icns
+        dst: tart.app/Contents/Resources/UPW Tart.icns
+      - src: dist/tart_darwin_all/tart.app/Contents/Resources/Assets.car
+        dst: tart.app/Contents/Resources/Assets.car
+      - src: dist/tart_darwin_all/tart.app/Contents/_CodeSignature/CodeResources
+        dst: tart.app/Contents/_CodeSignature/CodeResources
       - LICENSE
 
 release:
@@ -65,6 +71,8 @@ brews:
     install: |
       libexec.install Dir["*"]
       bin.write_exec_script "#{libexec}/tart.app/Contents/MacOS/tart"
-      generate_completions_from_executable(libexec/"tart.app/Contents/MacOS/tart", "--generate-completion-script")
     custom_block: |
       depends_on :macos => :ventura
+      def post_install
+        generate_completions_from_executable(libexec/"tart.app/Contents/MacOS/tart", "--generate-completion-script")
+      end

PROFILING.md

@@ -7,7 +7,7 @@ Perhaps, the easiest, but not the most comprehensive way to tell what's going on
 In the example below, you will run `tart pull` via `time(1)` to gather generalized CPU, I/O and memory usage metrics:
 
 ```shell
-/usr/bin/time -l tart pull ghcr.io/cirruslabs/macos-sequoia-base:latest
+/usr/bin/time -l tart pull ghcr.io/cirruslabs/macos-tahoe-base:latest
 ```
 
 **Note:** you need to specify a full path to `time(1)` binary, otherwise the shell's built-in `time` command will be invoked, which doesn't have the `-l` command-line argument.
@@ -48,7 +48,7 @@ To use it, make sure that [Xcode](https://developer.apple.com/xcode/resources/)
 Once done, you can create a CPU profile of `tart pull`:
 
 ```shell
-xctrace record --template "CPU Profiler" --target-stdout - --launch -- /opt/homebrew/bin/tart pull ghcr.io/cirruslabs/macos-sequoia-base:latest
+xctrace record --template "CPU Profiler" --target-stdout - --launch -- /opt/homebrew/bin/tart pull ghcr.io/cirruslabs/macos-tahoe-base:latest
 ```
 
 Now that `xctrace(1)` is running, you'll see the `tart pull`-related output first, and once finished, the following line will appear:

Package.resolved

@@ -1,5 +1,5 @@
 {
-  "originHash" : "0da1cc30fa3c41e8c2e2edcdd55706549908275a54f681203e0eeade279deab9",
+  "originHash" : "061dfe6cdf4e6dbf32b51c5e7023c4ae69726dcafb42a35b34e5489b0338c17f",
   "pins" : [
     {
       "identity" : "antlr4",
@@ -49,10 +49,10 @@
     {
       "identity" : "opentelemetry-swift",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/cirruslabs/opentelemetry-swift",
+      "location" : "https://github.com/open-telemetry/opentelemetry-swift",
       "state" : {
-        "branch" : "use-feedback-handler",
-        "revision" : "2040f383e2a8b0a568a7617d147f8f1e23abb298"
+        "branch" : "main",
+        "revision" : "ed37be9525081509ab62410d38b705c2b3f0d5a4"
       }
     },
     {

Package.swift

@@ -25,7 +25,7 @@ let package = Package(
     .package(url: "https://github.com/jozefizso/swift-xattr", from: "3.0.0"),
     .package(url: "https://github.com/grpc/grpc-swift.git", .upToNextMajor(from: "1.27.0")),
     .package(url: "https://buf.build/gen/swift/git/1.27.1-20260114140118-bd09c26a260f.1/cirruslabs_tart-guest-agent_grpc_swift.git", branch: "main"),
-    .package(url: "https://github.com/cirruslabs/opentelemetry-swift", branch: "use-feedback-handler"),
+    .package(url: "https://github.com/open-telemetry/opentelemetry-swift", branch: "main"),
     .package(url: "https://github.com/open-telemetry/opentelemetry-swift-core", from: "2.3.0"),
 
   ],

Resources/Info.plist

@@ -7,15 +7,17 @@
 	<key>CFBundleDisplayName</key>
 	<string>Tart</string>
 	<key>CFBundleIdentifier</key>
-	<string>org.cirruslabs.tart</string>
+	<string>com.github.cirruslabs.tart</string>
 	<key>CFBundleExecutable</key>
 	<string>tart</string>
-  <key>LSApplicationCategoryType</key>
-  <string>public.app-category.developer-tools</string>
-	<key>CFBundleIconFiles</key>
-	<array>
-		<string>AppIcon.png</string>
-	</array>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>LSApplicationCategoryType</key>
+	<string>public.app-category.developer-tools</string>
+	<key>CFBundleIconFile</key>
+	<string>UPW Tart</string>
+	<key>CFBundleIconName</key>
+	<string>UPW Tart</string>
 	<key>NSAppTransportSecurity</key>
 	<dict>
 		<key>NSAllowsArbitraryLoads</key>

Resources/UPW Tart.icon/icon.json

@@ -0,0 +1,140 @@
+{
+  "fill" : "automatic",
+  "groups" : [
+    {
+      "blend-mode" : "normal",
+      "blur-material" : 0.5,
+      "layers" : [
+        {
+          "hidden" : false,
+          "image-name-specializations" : [
+            {
+              "value" : "4.4-–-layer.png"
+            },
+            {
+              "idiom" : "square",
+              "value" : "UPW Tart L4.png"
+            }
+          ],
+          "name" : "UPW Tart L4"
+        }
+      ],
+      "opacity" : 1,
+      "shadow" : {
+        "kind" : "neutral",
+        "opacity" : 1
+      },
+      "specular" : true,
+      "translucency" : {
+        "enabled" : true,
+        "value" : 0.25
+      }
+    },
+    {
+      "layers" : [
+        {
+          "image-name-specializations" : [
+            {
+              "value" : "3.3-–-layer.png"
+            },
+            {
+              "idiom" : "square",
+              "value" : "UPW Tart L3.png"
+            }
+          ],
+          "name" : "UPW Tart L3",
+          "position-specializations" : [
+            {
+              "idiom" : "square",
+              "value" : {
+                "scale" : 1,
+                "translation-in-points" : [
+                  0,
+                  0
+                ]
+              }
+            }
+          ]
+        }
+      ],
+      "shadow" : {
+        "kind" : "none",
+        "opacity" : 1
+      },
+      "specular" : false,
+      "translucency" : {
+        "enabled" : true,
+        "value" : 0.25
+      }
+    },
+    {
+      "blur-material" : null,
+      "layers" : [
+        {
+          "image-name-specializations" : [
+            {
+              "value" : "2.2-–-layer.png"
+            },
+            {
+              "idiom" : "square",
+              "value" : "UPW Tart L2.png"
+            }
+          ],
+          "name" : "UPW Tart L2"
+        }
+      ],
+      "position-specializations" : [
+        {
+          "idiom" : "square",
+          "value" : {
+            "scale" : 1,
+            "translation-in-points" : [
+              0,
+              0
+            ]
+          }
+        }
+      ],
+      "shadow" : {
+        "kind" : "none",
+        "opacity" : 1
+      },
+      "specular" : true,
+      "translucency" : {
+        "enabled" : true,
+        "value" : 0.25
+      }
+    },
+    {
+      "layers" : [
+        {
+          "image-name-specializations" : [
+            {
+              "value" : "1.1-–-layer.png"
+            },
+            {
+              "idiom" : "square",
+              "value" : "UPW Tart L1.png"
+            }
+          ],
+          "name" : "UPW Tart L1"
+        }
+      ],
+      "shadow" : {
+        "kind" : "layer-color",
+        "opacity" : 0.5
+      },
+      "specular" : true,
+      "translucency" : {
+        "enabled" : true,
+        "value" : 0.25
+      }
+    }
+  ],
+  "supported-platforms" : {
+    "circles" : [
+      "watchOS"
+    ],
+    "squares" : "shared"
+  }
+}

Resources/actool/Info.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleIconFile</key>
+	<string>UPW Tart</string>
+	<key>CFBundleIconName</key>
+	<string>UPW Tart</string>
+</dict>
+</plist>

Sources/tart/Commands/Exec.swift

@@ -47,8 +47,16 @@ struct Exec: AsyncParsableCommand {
       try! group.syncShutdownGracefully()
     }
 
+    // Change the current working directory to a VM's base directory
+    // to work around Unix domain socket 104 byte limitation [1]
+    //
+    // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
+    if let baseURL = vmDir.controlSocketURL.baseURL {
+      FileManager.default.changeCurrentDirectoryPath(baseURL.path())
+    }
+
     let channel = try GRPCChannelPool.with(
-      target: .unixDomainSocket(vmDir.controlSocketURL.path()),
+      target: .unixDomainSocket(vmDir.controlSocketURL.relativePath),
       transportSecurity: .plaintext,
       eventLoopGroup: group,
     )

Sources/tart/Commands/IP.swift

@@ -68,7 +68,15 @@ struct IP: AsyncParsableCommand {
           throw RuntimeError.Generic("Cannot perform IP resolution via Tart Guest Agent when control socket URL is not set")
         }
 
-        if let ip = try await AgentResolver.ResolveIP(controlSocketURL) {
+        // Change the current working directory to a VM's base directory
+        // to work around Unix domain socket 104 byte limitation [1]
+        //
+        // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
+        if let baseURL = controlSocketURL.baseURL {
+          FileManager.default.changeCurrentDirectoryPath(baseURL.path())
+        }
+
+        if let ip = try await AgentResolver.ResolveIP(controlSocketURL.relativePath) {
           return ip
         }
       }

Sources/tart/Commands/List.swift

@@ -7,7 +7,7 @@ fileprivate struct VMInfo: Encodable {
   let Name: String
   let Disk: Int
   let Size: Int
-  let SizeOnDisk: Int
+  let Accessed: String
   let Running: Bool
   let State: String
 }
@@ -39,13 +39,29 @@ struct List: AsyncParsableCommand {
 
     if source == nil || source == "local" {
       infos += sortedInfos(try VMStorageLocal().list().map { (name, vmDir) in
-        try VMInfo(Source: "local", Name: name, Disk: vmDir.sizeGB(), Size: vmDir.allocatedSizeGB(), SizeOnDisk: vmDir.allocatedSizeGB() - vmDir.deduplicatedSizeGB(), Running: vmDir.running(), State: vmDir.state().rawValue)
+        try VMInfo(
+          Source: "local",
+          Name: name,
+          Disk: vmDir.sizeGB(),
+          Size: vmDir.allocatedSizeGB(),
+          Accessed: formatAccessDate(try vmDir.accessDate()),
+          Running: vmDir.running(),
+          State: vmDir.state().rawValue
+        )
       })
     }
 
     if source == nil || source == "oci" {
       infos += sortedInfos(try VMStorageOCI().list().map { (name, vmDir, _) in
-        try VMInfo(Source: "OCI", Name: name, Disk: vmDir.sizeGB(), Size: vmDir.allocatedSizeGB(), SizeOnDisk: vmDir.allocatedSizeGB() - vmDir.deduplicatedSizeGB(), Running: vmDir.running(), State: vmDir.state().rawValue)
+        try VMInfo(
+          Source: "OCI",
+          Name: name,
+          Disk: vmDir.sizeGB(),
+          Size: vmDir.allocatedSizeGB(),
+          Accessed: formatAccessDate(try vmDir.accessDate()),
+          Running: vmDir.running(),
+          State: vmDir.state().rawValue
+        )
       })
     }
 
@@ -61,4 +77,16 @@ struct List: AsyncParsableCommand {
   private func sortedInfos(_ infos: [VMInfo]) -> [VMInfo] {
     infos.sorted(by: { left, right in left.Name < right.Name })
   }
+
+  private func formatAccessDate(_ accessDate: Date) -> String {
+    switch format {
+    case .text:
+      let formatter = RelativeDateTimeFormatter()
+      formatter.unitsStyle = .full
+      return formatter.localizedString(for: accessDate, relativeTo: Date())
+    case .json:
+      let formatter = ISO8601DateFormatter()
+      return formatter.string(from: accessDate)
+    }
+  }
 }

Sources/tart/Commands/Push.swift

@@ -31,9 +31,6 @@ struct Push: AsyncParsableCommand {
                                                            discussion: "Can be specified multiple times to attach multiple labels."))
   var labels: [String] = []
 
-  @Option(help: .hidden)
-  var diskFormat: String = "v2"
-
   @Flag(help: ArgumentHelp("cache pushed images locally",
                            discussion: "Increases disk usage, but saves time if you're going to pull the pushed images later."))
   var populateCache: Bool = false
@@ -85,7 +82,6 @@ struct Push: AsyncParsableCommand {
           registry: registry,
           references: references,
           chunkSizeMb: chunkSize,
-          diskFormat: diskFormat,
           concurrency: concurrency,
           labels: parseLabels()
         )

Sources/tart/Commands/Run.swift

@@ -137,7 +137,7 @@ struct Run: AsyncParsableCommand {
   To work with block devices, the easiest way is to modify their permissions to be accessible to the current user:
 
   sudo chown $USER /dev/diskX
-  tart run sequoia --disk=/dev/diskX
+  tart run macos --disk=/dev/diskX
 
   Warning: after running the chown command above, all software running under the current user will be able to access /dev/diskX. If that violates your threat model, we recommend avoiding mounting block devices altogether.
   """, valueName: "path[:options]"), completion: .file())

Sources/tart/ControlSocket.swift

@@ -21,8 +21,16 @@ class ControlSocket {
     // if any, otherwise we may get the "address already in use" error
     try? FileManager.default.removeItem(atPath: controlSocketURL.path())
 
+    // Change the current working directory to a VM's base directory
+    // to work around Unix domain socket 104 byte limitation [1]
+    //
+    // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
+    if let baseURL = controlSocketURL.baseURL {
+      FileManager.default.changeCurrentDirectoryPath(baseURL.path())
+    }
+
     let serverChannel = try await ServerBootstrap(group: eventLoopGroup)
-      .bind(unixDomainSocketPath: controlSocketURL.path()) { childChannel in
+      .bind(unixDomainSocketPath: controlSocketURL.relativePath) { childChannel in
         childChannel.eventLoop.makeCompletedFuture {
           return try NIOAsyncChannel<ByteBuffer, ByteBuffer>(
             wrappingChannelSynchronously: childChannel

Sources/tart/Credentials/StdinCredentials.swift

@@ -15,7 +15,7 @@ class StdinCredentials {
     return (user, password)
   }
 
-  private static func readStdinCredential(name: String, prompt: String, maxCharacters: Int = 1024, isSensitive: Bool) throws -> String {
+  private static func readStdinCredential(name: String, prompt: String, maxCharacters: Int = 8192, isSensitive: Bool) throws -> String {
     var buf = [CChar](repeating: 0, count: maxCharacters + 1 /* sentinel */ + 1 /* NUL */)
     guard let rawCredential = readpassphrase(prompt, &buf, buf.count, isSensitive ? RPP_ECHO_OFF : RPP_ECHO_ON) else {
       throw StdinCredentialsError.CredentialRequired(which: name)

Sources/tart/MACAddressResolver/AgentResolver.swift

@@ -6,15 +6,15 @@ import Cirruslabs_TartGuestAgent_Apple_Swift
 import Cirruslabs_TartGuestAgent_Grpc_Swift
 
 class AgentResolver {
-  static func ResolveIP(_ controlSocketURL: URL) async throws -> IPv4Address? {
+  static func ResolveIP(_ controlSocketPath: String) async throws -> IPv4Address? {
     do {
-      return try await resolveIP(controlSocketURL)
+      return try await resolveIP(controlSocketPath)
     } catch let error as GRPCConnectionPoolError {
       return nil
     }
   }
 
-  private static func resolveIP(_ controlSocketURL: URL) async throws -> IPv4Address? {
+  private static func resolveIP(_ controlSocketPath: String) async throws -> IPv4Address? {
     // Create a gRPC channel connected to the VM's control socket
     let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
     defer {
@@ -22,7 +22,7 @@ class AgentResolver {
     }
 
     let channel = try GRPCChannelPool.with(
-      target: .unixDomainSocket(controlSocketURL.path()),
+      target: .unixDomainSocket(controlSocketPath),
       transportSecurity: .plaintext,
       eventLoopGroup: group,
     )

Sources/tart/OCI/Layerizer/DiskV1.swift

@@ -1,75 +0,0 @@
-import Foundation
-import Compression
-
-class DiskV1: Disk {
-  private static let bufferSizeBytes = 4 * 1024 * 1024
-  private static let layerLimitBytes = 500 * 1000 * 1000
-
-  static func push(diskURL: URL, registry: Registry, chunkSizeMb: Int, concurrency: UInt, progress: Progress) async throws -> [OCIManifestLayer] {
-    var pushedLayers: [OCIManifestLayer] = []
-
-    // Open the disk file
-    let mappedDisk = try Data(contentsOf: diskURL, options: [.alwaysMapped])
-    var mappedDiskReadOffset = 0
-
-    // Compress the disk file as a single stream
-    let compressingFilter = try InputFilter(.compress, using: .lz4, bufferCapacity: Self.bufferSizeBytes) { (length: Int) -> Data? in
-      // Determine the size of the next chunk
-      let bytesRead = min(length, mappedDisk.count - mappedDiskReadOffset)
-
-      // Read the next uncompressed chunk
-      let data = mappedDisk.subdata(in: mappedDiskReadOffset ..< mappedDiskReadOffset + bytesRead)
-
-      // Advance the offset
-      mappedDiskReadOffset += bytesRead
-
-      // Provide the uncompressed chunk to the compressing filter
-      return data
-    }
-
-    // Cut the compressed stream into layers, each equal exactly ``Self.layerLimitBytes`` bytes,
-    // except for the last one, which may be smaller
-    while let compressedData = try compressingFilter.readData(ofLength: Self.layerLimitBytes) {
-      let layerDigest = try await registry.pushBlob(fromData: compressedData, chunkSizeMb: chunkSizeMb)
-
-      pushedLayers.append(OCIManifestLayer(
-        mediaType: diskV1MediaType,
-        size: compressedData.count,
-        digest: layerDigest
-      ))
-
-      // Update progress using an absolute value
-      progress.completedUnitCount = Int64(mappedDiskReadOffset)
-    }
-
-    return pushedLayers
-  }
-
-  static func pull(registry: Registry, diskLayers: [OCIManifestLayer], diskURL: URL, concurrency: UInt, progress: Progress, localLayerCache: LocalLayerCache? = nil, deduplicate: Bool = false) async throws {
-    if !FileManager.default.createFile(atPath: diskURL.path, contents: nil) {
-      throw OCIError.FailedToCreateVmFile
-    }
-
-    // Open the disk file
-    let disk = try FileHandle(forWritingTo: diskURL)
-    defer { try! disk.close() }
-
-    // Decompress the layers onto the disk in a single stream
-    let filter = try OutputFilter(.decompress, using: .lz4, bufferCapacity: Self.bufferSizeBytes) { data in
-      if let data = data {
-        try disk.write(contentsOf: data)
-      }
-    }
-
-    for diskLayer in diskLayers {
-      try await registry.pullBlob(diskLayer.digest) { data in
-        try filter.write(data)
-
-        // Update the progress
-        progress.completedUnitCount += Int64(data.count)
-      }
-    }
-
-    try filter.finalize()
-  }
-}

Sources/tart/OCI/Manifest.swift

@@ -6,7 +6,6 @@ let ociConfigMediaType = "application/vnd.oci.image.config.v1+json"
 
 // Layer media types
 let configMediaType = "application/vnd.cirruslabs.tart.config.v1"
-let diskV1MediaType = "application/vnd.cirruslabs.tart.disk.v1"
 let diskV2MediaType = "application/vnd.cirruslabs.tart.disk.v2"
 let nvramMediaType = "application/vnd.cirruslabs.tart.nvram.v1"
 

Sources/tart/VMDirectory+OCI.swift

@@ -2,6 +2,8 @@ import Compression
 import Foundation
 import OpenTelemetryApi
 
+let legacyDiskV1MediaType = "application/vnd.cirruslabs.tart.disk.v1"
+
 enum OCIError: Error {
   case ShouldBeExactlyOneLayer
   case ShouldBeAtLeastOneLayer
@@ -29,16 +31,12 @@ extension VMDirectory {
     try configFile.close()
 
     // Pull VM's disk layers and decompress them into a disk file
-    let diskImplType: Disk.Type
-    let layers: [OCIManifestLayer]
+    if manifest.layers.contains(where: { $0.mediaType == legacyDiskV1MediaType }) {
+      throw RuntimeError.Generic("Pulling OCI images with legacy disk media type \(legacyDiskV1MediaType) is no longer supported, please re-push the image using a current Tart version")
+    }
 
-    if manifest.layers.contains(where: { $0.mediaType == diskV1MediaType }) {
-      diskImplType = DiskV1.self
-      layers = manifest.layers.filter { $0.mediaType == diskV1MediaType }
-    } else if manifest.layers.contains(where: { $0.mediaType == diskV2MediaType }) {
-      diskImplType = DiskV2.self
-      layers = manifest.layers.filter { $0.mediaType == diskV2MediaType }
-    } else {
+    let layers = manifest.layers.filter { $0.mediaType == diskV2MediaType }
+    if layers.isEmpty {
       throw OCIError.ShouldBeAtLeastOneLayer
     }
 
@@ -55,10 +53,10 @@ extension VMDirectory {
     ProgressObserver(progress).log(defaultLogger)
 
     do {
-      try await diskImplType.pull(registry: registry, diskLayers: layers, diskURL: diskURL,
-                                  concurrency: concurrency, progress: progress,
-                                  localLayerCache: localLayerCache,
-                                  deduplicate: deduplicate)
+      try await DiskV2.pull(registry: registry, diskLayers: layers, diskURL: diskURL,
+                            concurrency: concurrency, progress: progress,
+                            localLayerCache: localLayerCache,
+                            deduplicate: deduplicate)
     } catch let error where error is FilterError {
       throw RuntimeError.PullFailed("failed to decompress disk: \(error.localizedDescription)")
     }
@@ -90,7 +88,7 @@ extension VMDirectory {
     try manifest.toJSON().write(to: manifestURL)
   }
 
-  func pushToRegistry(registry: Registry, references: [String], chunkSizeMb: Int, diskFormat: String, concurrency: UInt, labels: [String: String] = [:]) async throws -> RemoteName {
+  func pushToRegistry(registry: Registry, references: [String], chunkSizeMb: Int, concurrency: UInt, labels: [String: String] = [:]) async throws -> RemoteName {
     var layers = Array<OCIManifestLayer>()
 
     // Read VM's config and push it as blob
@@ -111,14 +109,7 @@ extension VMDirectory {
     let progress = Progress(totalUnitCount: diskSize)
     ProgressObserver(progress).log(defaultLogger)
 
-    switch diskFormat {
-    case "v1":
-      layers.append(contentsOf: try await DiskV1.push(diskURL: diskURL, registry: registry, chunkSizeMb: chunkSizeMb, concurrency: concurrency, progress: progress))
-    case "v2":
-      layers.append(contentsOf: try await DiskV2.push(diskURL: diskURL, registry: registry, chunkSizeMb: chunkSizeMb, concurrency: concurrency, progress: progress))
-    default:
-      throw RuntimeError.OCIUnsupportedDiskFormat(diskFormat)
-    }
+    layers.append(contentsOf: try await DiskV2.push(diskURL: diskURL, registry: registry, chunkSizeMb: chunkSizeMb, concurrency: concurrency, progress: progress))
 
     // Read VM's NVRAM and push it as blob
     defaultLogger.appendNewLine("pushing NVRAM...")

Sources/tart/VMDirectory.swift

@@ -27,7 +27,7 @@ struct VMDirectory: Prunable {
     baseURL.appendingPathComponent("manifest.json")
   }
   var controlSocketURL: URL {
-    baseURL.appendingPathComponent("control.sock")
+    URL(fileURLWithPath: "control.sock", relativeTo: baseURL)
   }
 
   var explicitlyPulledMark: URL {

Sources/tart/VMStorageHelper.swift

@@ -74,7 +74,6 @@ enum RuntimeError : Error {
   case ImportFailed(_ message: String)
   case SoftnetFailed(_ message: String)
   case OCIStorageError(_ message: String)
-  case OCIUnsupportedDiskFormat(_ format: String)
   case SuspendFailed(_ message: String)
   case PullFailed(_ message: String)
   case VirtualMachineLimitExceeded(_ hint: String)
@@ -139,8 +138,6 @@ extension RuntimeError : CustomStringConvertible {
       return "Softnet failed: \(message)"
     case .OCIStorageError(let message):
       return "OCI storage error: \(message)"
-    case .OCIUnsupportedDiskFormat(let format):
-      return "OCI disk format \(format) is not supported by this version of Tart"
     case .SuspendFailed(let message):
       return "Failed to suspend the VM: \(message)"
     case .PullFailed(let message):

Tests/TartTests/LayerizerTests.swift

@@ -14,7 +14,7 @@ final class LayerizerTests: XCTestCase {
     do {
       registryRunner = try await RegistryRunner()
     } catch {
-      try XCTSkipIf(ProcessInfo.processInfo.environment["CI"] == nil)
+      try XCTSkip("Registry is unavailable: \(error)")
     }
   }
 
@@ -24,30 +24,9 @@ final class LayerizerTests: XCTestCase {
     registryRunner = nil
   }
 
-  func testDiskV1() async throws {
-    // Original disk file to be pushed to the registry
-    let originalDiskFileURL = try fileWithRandomData(sizeBytes: 5 * 1024 * 1024 * 1024)
-    addTeardownBlock {
-      try FileManager.default.removeItem(at: originalDiskFileURL)
-    }
-
-    // Disk file to be pulled from the registry
-    // and compared against the original disk file
-    let pulledDiskFileURL = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
-
-    print("pushing disk...")
-    let diskLayers = try await DiskV1.push(diskURL: originalDiskFileURL, registry: registry, chunkSizeMb: 0, concurrency: 4, progress: Progress())
-
-    print("pulling disk...")
-    try await DiskV1.pull(registry: registry, diskLayers: diskLayers, diskURL: pulledDiskFileURL, concurrency: 16, progress: Progress())
-
-    print("comparing disks...")
-    try XCTAssertEqual(Digest.hash(originalDiskFileURL), Digest.hash(pulledDiskFileURL))
-  }
-
   func testDiskV2() async throws {
     // Original disk file to be pushed to the registry
-    let originalDiskFileURL = try fileWithRandomData(sizeBytes: 5 * 1024 * 1024 * 1024)
+    let originalDiskFileURL = try fileWithRandomData(sizeBytes: 1 * 1024 * 1024 * 1024)
     addTeardownBlock {
       try FileManager.default.removeItem(at: originalDiskFileURL)
     }

Tests/TartTests/RegistryTests.swift

@@ -10,7 +10,7 @@ final class RegistryTests: XCTestCase {
     do {
       registryRunner = try await RegistryRunner()
     } catch {
-      try XCTSkipIf(ProcessInfo.processInfo.environment["CI"] == nil)
+      try XCTSkip("Registry is unavailable: \(error)")
     }
   }
 

Tests/TartTests/Util/RegistryRunner.swift

@@ -13,7 +13,7 @@ class RegistryRunner {
     let stdoutPipe = Pipe()
 
     let proc = Process()
-    proc.executableURL = URL(fileURLWithPath: "/usr/local/bin/docker")
+    proc.executableURL = URL(fileURLWithPath: "/opt/homebrew/bin/docker")
     proc.arguments = arguments
     proc.standardOutput = stdoutPipe
     try proc.run()
@@ -31,7 +31,7 @@ class RegistryRunner {
 
   init() async throws {
     // Start container
-    let container = try Self.dockerCmd("run", "-d", "--rm", "-p", "127.0.0.1:0:5000", "registry:2")
+    let container = try Self.dockerCmd("run", "-d", "--rm", "-p", "127.0.0.1::5000", "registry:2")
       .trimmingCharacters(in: CharacterSet.newlines)
     containerID = container
 

actool.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+# Set shell options to enable fail-fast behavior
+#
+# * -e: fail the script when an error occurs or command fails
+# * -u: fail the script when attempting to reference unset parameters
+# * -o pipefail: by default an exit status of a pipeline is that of its
+#                last command, this fails the pipe early if an error in
+#                any of its commands occurs
+#
+set -euo pipefail
+
+OUTPUT_PATH="Resources/actool"
+PLIST_PATH="$OUTPUT_PATH/Info.plist"
+
+rm -rf "${OUTPUT_PATH}"
+mkdir -p "${OUTPUT_PATH}"
+
+actool "Resources/UPW Tart.icon" \
+  --compile "${OUTPUT_PATH}" \
+  --output-format human-readable-text \
+  --notices \
+  --warnings \
+  --errors \
+  --app-icon "UPW Tart" \
+  --output-partial-info-plist $PLIST_PATH \
+  --include-all-app-icons \
+  --target-device mac \
+  --minimum-deployment-target 13.0 \
+  --platform macosx

benchmark/README.md

@@ -13,7 +13,7 @@ brew install go
 Finally, run the following command from this (`benchmark/`) directory:
 
 ```shell
-go run cmd/main.go fio --image ghcr.io/cirruslabs/macos-sequoia-base:latest --prepare 'sudo purge && sync'
+go run cmd/main.go fio --image ghcr.io/cirruslabs/macos-tahoe-base:latest --prepare 'sudo purge && sync'
 ```
 
 You can also enable the debugging output to diagnose issues:

benchmark/internal/command/xcode/xcode.go

@@ -23,7 +23,7 @@ func NewCommand() *cobra.Command {
 	}
 
 	cmd.Flags().BoolVar(&debug, "debug", false, "enable debug logging")
-	cmd.Flags().StringVar(&image, "image", "ghcr.io/cirruslabs/macos-sequoia-xcode:latest", "image to use for testing")
+	cmd.Flags().StringVar(&image, "image", "ghcr.io/cirruslabs/macos-tahoe-xcode:latest", "image to use for testing")
 	cmd.Flags().StringVar(&prepare, "prepare", "", "command to run before running each benchmark")
 
 	return cmd

docs/blog/posts/2023-02-11-changing-tart-license.md

@@ -60,10 +60,14 @@ device without a physical display connected. For example, a Mac Mini with a HDMI
 but a Mac Mini on a desk with a connected physical display is considered a personal computer. **Usage on personal computers
 and before reaching the 100 CPU cores limit is royalty-free and does not have the viral properties of AGPL.**
 
+!!! note "Pricing update"
+    This post announced Tart licensing in February 2023 and originally listed monthly prices.
+    Pricing has since changed to yearly billing. See [Licensing and Support](../../licensing.md#license-tiers) for the latest terms.
+
 When an organization surpasses the 100 CPU cores limit, they will be required to obtain a [Gold Tier License](../../licensing.md#license-tiers),
-which costs \$1000 per month. Upon reaching a limit of 500 CPU cores, a [Platinum Tier License](../../licensing.md#license-tiers)
-(\$3000 per month) will be required, and for organizations that exceed 3000 CPU cores, a custom [Diamond Tier License](../../licensing.md#license-tiers)
-(\$1 per core per month) will be necessary. **All paid license tiers will include priority feature development and SLAs on support with urgent issues.**
+which costs \$12,000 per year. Upon reaching a limit of 500 CPU cores, a [Platinum Tier License](../../licensing.md#license-tiers)
+(\$36,000 per year) will be required, and for organizations that exceed 3000 CPU cores, a custom [Diamond Tier License](../../licensing.md#license-tiers)
+(\$12 per core per year) will be necessary. **All paid license tiers will include priority feature development and SLAs on support with urgent issues.**
 
 ## Have we considered alternatives?
 

docs/faq.md

@@ -59,7 +59,7 @@ Remote images are pulled into `~/.tart/cache/OCIs/`.
 ## Nested virtualization support?
 
 Tart is limited by functionality of Apple's `Virtualization.Framework`. At the moment `Virtualization.Framework`
-supports nested virtualization only on M3 or M4 chips running macOS 15 (Sequoia). By default, it is disabled, but can be enabled by passing the `--nested` flag to `tart run`.
+supports nested virtualization only on M3 or M4 chips running macOS 15 (Sequoia) or later. By default, it is disabled, but can be enabled by passing the `--nested` flag to `tart run`.
 
 ## Connecting to a service running on host
 
@@ -77,6 +77,21 @@ Note: that accessing host is only possible with the default NAT network. If you
 [Softnet](https://github.com/cirruslabs/softnet) (via `tart run --net-softnet <VM NAME>)`, then the network isolation
 is stricter and it's not possible to access the host.
 
+## Avoiding the "Local Network" permission pop-up
+
+Starting from macOS 15 (Sequoia), a GUI "Local Network" permission pop-up might appear when Tart is used by another tool that needs to connect to a VM over a private IPv4 network, for example [Packer](https://developer.hashicorp.com/packer/integrations/cirruslabs/tart/latest/components/builder/tart).
+
+This is not caused by Tart itself, but by the host-side process that needs network access into the guest.
+
+If you need a non-interactive workaround, you can configure the [local network privacy preferences](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy#macOS-considerations) on the host so that all [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918#section-3) address ranges that Tart VMs commonly use are excluded from the prompt:
+
+```shell
+sudo defaults write com.apple.network.local-network AllowedEthernetLocalNetworkAddresses -array "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"
+sudo defaults write com.apple.network.local-network AllowedWiFiLocalNetworkAddresses -array "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"
+```
+
+After applying these settings, reboot the host.
+
 ## Changing the default NAT subnet
 
 To change the default network to `192.168.77.1`:
@@ -184,7 +199,7 @@ security unlock-keychain login.keychain
 
 This command also supports the `-p` command-line argument that allows you to supply a password and unlock non-interactively, which is great for scripts.
 
-Alternatively, you can pass the credentials via the environment variables, see [Registry Authorization](integrations/vm-management.md#registry-authorization) for more details on how to do that.
+Alternatively, you can pass the credentials via the environment variables, see [Registry Authorization](quick-start.md#registry-authorization) for more details on how to do that.
 
 ## How is Tart different from Anka?
 

docs/integrations/buildkite.md

@@ -18,9 +18,9 @@ steps:
 - command: uname -a
   plugins:
   - cirruslabs/tart#main:
-    image: ghcr.io/cirruslabs/macos-sequoia-base:latest
+    image: ghcr.io/cirruslabs/macos-tahoe-base:latest
 ```
 
-This will run `uname -r` in a macOS Tart VM cloned from `ghcr.io/cirruslabs/macos-sequoia-base:latest`.
+This will run `uname -r` in a macOS Tart VM cloned from `ghcr.io/cirruslabs/macos-tahoe-base:latest`.
 
 See plugin's [Configuration section](https://github.com/cirruslabs/tart-buildkite-plugin#configuration) for the full list of available options.

docs/integrations/cirrus-cli.md

@@ -18,7 +18,7 @@ task:
   name: hello
   macos_instance:
     # can be a remote or a local virtual machine
-    image: ghcr.io/cirruslabs/macos-sequoia-base:latest
+    image: ghcr.io/cirruslabs/macos-tahoe-base:latest
   hello_script:
     - echo "Hello from within a Tart VM!"
     - echo "Here is my CPU info:"
@@ -50,7 +50,7 @@ exposes it via [`artifacts` instruction](https://cirrus-ci.org/guide/writing-tas
 task:
   name: Build
   macos_instance:
-    image: ghcr.io/cirruslabs/macos-sequoia-xcode:latest
+    image: ghcr.io/cirruslabs/macos-tahoe-xcode:latest
   build_script: swift build --product tart
   binary_artifacts:
     path: .build/debug/tart

docs/integrations/gitlab-runner.md

@@ -42,7 +42,7 @@ Now you can use Tart Images in your `.gitlab-ci.yml`:
 ```yaml
 # You can use any remote Tart Image.
 # Tart Executor will pull it from the registry and use it for creating ephemeral VMs.
-image: ghcr.io/cirruslabs/macos-sequoia-base:latest
+image: ghcr.io/cirruslabs/macos-tahoe-base:latest
 
 test:
   tags:

docs/integrations/packer.md

@@ -0,0 +1,41 @@
+---
+title: Automating VM image building with Packer
+description: Use Packer to build custom VM images, configure VMs and work with remote OCI registries.
+---
+
+Please refer to [Tart Packer Plugin repository](https://github.com/cirruslabs/packer-plugin-tart) for setup instructions.
+Here is an example of a template to build a local image based of a remote image:
+
+```hcl
+packer {
+  required_plugins {
+    tart = {
+      version = ">= 0.5.3"
+      source  = "github.com/cirruslabs/tart"
+    }
+  }
+}
+
+source "tart-cli" "tart" {
+  vm_base_name = "ghcr.io/cirruslabs/macos-tahoe-base:latest"
+  vm_name      = "my-custom-tahoe"
+  cpu_count    = 4
+  memory_gb    = 8
+  disk_size_gb = 70
+  ssh_password = "admin"
+  ssh_timeout  = "120s"
+  ssh_username = "admin"
+}
+
+build {
+  sources = ["source.tart-cli.tart"]
+
+  provisioner "shell" {
+    inline = ["echo 'Disabling spotlight indexing...'", "sudo mdutil -a -i off"]
+  }
+
+  # more provisioners
+}
+```
+
+Here is a [repository with Packer templates](https://github.com/cirruslabs/macos-image-templates) used to build [all the images managed by us](https://github.com/orgs/cirruslabs/packages?tab=packages&q=macos).

docs/integrations/vm-management.md

@@ -1,143 +0,0 @@
----
-title: Managing Virtual Machine
-description: Use Packer to build custom VM images, configure VMs and work with remote OCI registries.
----
-
-# Managing Virtual Machine
-
-## Creating from scratch
-
-Tart supports macOS and Linux virtual machines. All commands like `run` and `pull` work the same way regardless of the underlying OS a particular VM image has.
-The only difference is how such VM images are created. Please check sections below for [macOS](#creating-a-macos-vm-image-from-scratch) and [Linux](#creating-a-linux-vm-image-from-scratch) instructions.
-
-### Creating a macOS VM image from scratch
-
-Tart can create VMs from `*.ipsw` files. You can download a specific `*.ipsw` file [here](https://ipsw.me/) or you can
-use `latest` instead of a path to `*.ipsw` to download the latest available version:
-
-```bash
-tart create --from-ipsw=latest sequoia-vanilla
-tart run sequoia-vanilla
-```
-
-After the initial booting of the VM, you'll need to manually go through the macOS installation process. As a convention we recommend creating an `admin` user with an `admin` password. After the regular installation please do some additional modifications in the VM:
-
-1. Enable Auto-Login. Users & Groups -> Login Options -> Automatic login -> admin.
-2. Allow SSH. Sharing -> Remote Login
-3. Disable Lock Screen. Preferences -> Lock Screen -> disable "Require Password" after 5.
-4. Disable Screen Saver.
-5. Run `sudo visudo` in Terminal, find `%admin ALL=(ALL) ALL` add `admin ALL=(ALL) NOPASSWD: ALL` to allow sudo without a password.
-
-### Creating a Linux VM image from scratch
-
-Linux VMs are supported on hosts running macOS 13.0 (Ventura) or newer.
-
-```bash
-# Create a bare VM
-tart create --linux ubuntu
-
-# Install Ubuntu
-tart run --disk focal-desktop-arm64.iso ubuntu
-
-# Run VM
-tart run ubuntu
-```
-
-After the initial setup please make sure your VM can be SSH-ed into by running the following commands inside your VM:
-
-```bash
-sudo apt update
-sudo apt install -y openssh-server
-sudo ufw allow ssh
-```
-
-## Configuring a VM
-
-By default, a Tart VM uses 2 CPUs and 4 GB of memory with a `1024x768` display. This can be changed after VM creation with `tart set` command.
-Please refer to `tart set --help` for additional details.
-
-## Building with Packer
-
-Please refer to [Tart Packer Plugin repository](https://github.com/cirruslabs/packer-plugin-tart) for setup instructions.
-Here is an example of a template to build a local image based of a remote image:
-
-```hcl
-packer {
-  required_plugins {
-    tart = {
-      version = ">= 0.5.3"
-      source  = "github.com/cirruslabs/tart"
-    }
-  }
-}
-
-source "tart-cli" "tart" {
-  vm_base_name = "ghcr.io/cirruslabs/macos-sequoia-base:latest"
-  vm_name      = "my-custom-sequoia"
-  cpu_count    = 4
-  memory_gb    = 8
-  disk_size_gb = 70
-  ssh_password = "admin"
-  ssh_timeout  = "120s"
-  ssh_username = "admin"
-}
-
-build {
-  sources = ["source.tart-cli.tart"]
-
-  provisioner "shell" {
-    inline = ["echo 'Disabling spotlight indexing...'", "sudo mdutil -a -i off"]
-  }
-
-  # more provisioners
-}
-```
-
-Here is a [repository with Packer templates](https://github.com/cirruslabs/macos-image-templates) used to build [all the images managed by us](https://github.com/orgs/cirruslabs/packages?tab=packages&q=macos).
-
-## Working with a Remote OCI Container Registry
-
-Tart supports interacting with Open Container Initiative (OCI) registries, but only runs images created and pushed by Tart. This means images created for container engines, like Docker, can't be pulled. Instead, create a custom image as documented above.
-
-For example, let's say you want to push/pull images to an OCI registry hosted at `https://acme.io/`.
-
-### Registry Authorization
-
-First, you need to login to `acme.io` with the `tart login` command:
-
-```bash
-tart login acme.io
-```
-
-If you login to your registry with OAuth, you may need to create an access token to use as the password.
-Credentials are securely stored in Keychain.
-
-In addition, Tart supports [Docker credential helpers](https://docs.docker.com/engine/reference/commandline/login/#credential-helpers)
-if defined in `~/.docker/config.json`.
-
-Finally, `TART_REGISTRY_USERNAME` and `TART_REGISTRY_PASSWORD` environment variables allow to override authorization
-for all registries which might useful for integrating with your CI's secret management.
-
-### Pushing a Local Image
-
-Once credentials are saved for `acme.io`, run the following command to push a local images remotely with two tags:
-
-```bash
-tart push my-local-vm-name acme.io/remoteorg/name:latest acme.io/remoteorg/name:v1.0.0
-```
-
-### Pulling a Remote Image
-
-You can either pull an image:
-
-```bash
-tart pull acme.io/remoteorg/name:latest
-```
-
-or create a VM from a remote image:
-
-```bash
-tart clone acme.io/remoteorg/name:latest my-local-vm-name
-```
-
-If the specified image is not already present, this invocation calls the `tart pull` implicitly before cloning.

docs/legal/terms.md

@@ -14,7 +14,7 @@ This page covers Terms of Service only for Cirrus Runners and Tart Documentation
 Cirrus Labs Inc ("Cirrus Labs") operates the [Cirrus Runners service](https://cirrus-runners.app/) which we hope you use.
 If you use it, please use it responsibly. If you don't, we'll have to terminate your subscription.
 
-For paid plans, you'll be charged on a monthly basis. You can cancel anytime, but there are no refunds.
+For paid plans, you'll be charged on a yearly basis. You can cancel anytime, but there are no refunds.
 
 The Terms of Service and our prices can change at any time unless specified in your agreement. We'll warn you 30 days in advance of any price changes.
 We'll try to warn you about major changes to the Terms of Service, but we make no guarantees.

docs/licensing.md

@@ -36,19 +36,19 @@ Free Tier license has a 100 CPU core limit for Tart and 4 Orchard Workers limit
 
 ### Gold Tier
 
-If an organization wishes to exceed the limits of the Free Tier license, a purchase of the [Gold Tier License](#get-the-license) is required, which costs \$1000 per month.
+If an organization wishes to exceed the limits of the Free Tier license, a purchase of the [Gold Tier License](#get-the-license) is required, which costs \$12,000 per year.
 
 Gold Tier license has a 500 CPU core limit for Tart and 20 Orchard Workers limit for Orchard.
 
 ### Platinum Tier
 
-If an organization wishes to exceed the limits of the Gold Tier license, a purchase of the [Platinum Tier License](#get-the-license) is required, which costs \$3000 per month.
+If an organization wishes to exceed the limits of the Gold Tier license, a purchase of the [Platinum Tier License](#get-the-license) is required, which costs \$36,000 per year.
 
 Platinum Tier license has a 3,000 CPU core limit for Tart and 200 Orchard Workers limit for Orchard.
 
 ### Diamond Tier
 
-For organizations that wish to exceed the limits of the Platinum Tier license, a purchase of a [custom Diamond Tier License](#get-the-license) is required, which costs \$1 per CPU core per month and gives the ability to run unlimited Orchard Workers.
+For organizations that wish to exceed the limits of the Platinum Tier license, a purchase of a [custom Diamond Tier License](#get-the-license) is required, which costs \$12 per CPU core per year and gives the ability to run unlimited Orchard Workers.
 
 ## Get the license
 

docs/orchard/integration-guide.md

@@ -85,7 +85,7 @@ def main():
   # Create VM
   response = requests.post("http://127.0.0.1:6120/v1/vms", auth=basic_auth, json={
     "name": vm_name,
-    "image": "ghcr.io/cirruslabs/macos-sequoia-base:latest",
+    "image": "ghcr.io/cirruslabs/macos-tahoe-base:latest",
     "cpu": 4,
     "memory": 4096,
     "startup_script": {
@@ -144,7 +144,7 @@ func main() {
     Meta: v1.Meta{
       Name: vmName,
     },
-    Image:  "ghcr.io/cirruslabs/macos-sequoia-base:latest",
+    Image:  "ghcr.io/cirruslabs/macos-tahoe-base:latest",
     CPU:    4,
     Memory: 4096,
     StartupScript: &v1.VMScript{

docs/orchard/quick-start.md

@@ -26,7 +26,7 @@ more information.
 Now, let's create a Virtual Machine:
 
 ```shell
-orchard create vm --image ghcr.io/cirruslabs/macos-sequoia-base:latest sequoia-base
+orchard create vm --image ghcr.io/cirruslabs/macos-tahoe-base:latest tahoe-base
 ```
 
 You can check a list of VM resources to see if the Virtual Machine we've created above is already running:
@@ -48,7 +48,7 @@ instance. Orchard Controller instance is secured by default and all API calls ar
 To SSH into a VM, use the `orchard ssh` command:
 
 ```shell
-orchard ssh vm sequoia-base
+orchard ssh vm tahoe-base
 ```
 
 You can specify the `--username` and `--password` flags to specify the username/password pair to use for the SSH
@@ -58,14 +58,14 @@ You can also execute remote commands instead of spawning a login shell, similarl
 a command argument:
 
 ```shell
-orchard ssh vm sequoia-base "uname -a"
+orchard ssh vm tahoe-base "uname -a"
 ```
 
 You can execute scripts remotely this way, by telling the remote command-line interpreter to read from the standard
 input and using the redirection operator as follows:
 
 ```shell
-orchard ssh vm sequoia-base "bash -s" < script.sh
+orchard ssh vm tahoe-base "bash -s" < script.sh
 ```
 
 ### VNC
@@ -73,7 +73,7 @@ orchard ssh vm sequoia-base "bash -s" < script.sh
 Similarly to `ssh` command, you can use `vnc` command to open Screen Sharing into a remote VM:
 
 ```shell
-orchard vnc vm sequoia-base
+orchard vnc vm tahoe-base
 ```
 
 You can specify the `--username` and `--password` flags to specify the username/password pair to use for the VNC
@@ -84,7 +84,7 @@ protocol. By default, `admin`/`admin` is used.
 The following command will delete the VM we've created above and clean-up the resources associated with it:
 
 ```shell
-orchard delete vm sequoia-base
+orchard delete vm tahoe-base
 ```
 
 ## Environment variables

docs/quick-start.md

@@ -9,8 +9,8 @@ Try running a Tart VM on your Apple Silicon device running macOS 13.0 (Ventura)
 
 ```bash
 brew install cirruslabs/cli/tart
-tart clone ghcr.io/cirruslabs/macos-sequoia-base:latest sequoia-base
-tart run sequoia-base
+tart clone ghcr.io/cirruslabs/macos-tahoe-base:latest tahoe-base
+tart run tahoe-base
 ```
 
 ??? info "Manual installation from a release archive"
@@ -19,8 +19,8 @@ tart run sequoia-base
     ```bash
     curl -LO https://github.com/cirruslabs/tart/releases/latest/download/tart.tar.gz
     tar -xzvf tart.tar.gz
-    ./tart.app/Contents/MacOS/tart clone ghcr.io/cirruslabs/macos-sequoia-base:latest sequoia-base
-    ./tart.app/Contents/MacOS/tart run sequoia-base
+    ./tart.app/Contents/MacOS/tart clone ghcr.io/cirruslabs/macos-tahoe-base:latest tahoe-base
+    ./tart.app/Contents/MacOS/tart run tahoe-base
     ```
 
     Please note that `./tart.app/Contents/MacOS/tart` binary is required to be used in order to trick macOS
@@ -34,6 +34,10 @@ tart run sequoia-base
 
 The following macOS images are currently available:
 
+* macOS 26 (Tahoe)
+    * `ghcr.io/cirruslabs/macos-tahoe-vanilla:latest`
+    * `ghcr.io/cirruslabs/macos-tahoe-base:latest`
+    * `ghcr.io/cirruslabs/macos-tahoe-xcode:latest`
 * macOS 15 (Sequoia)
     * `ghcr.io/cirruslabs/macos-sequoia-vanilla:latest`
     * `ghcr.io/cirruslabs/macos-sequoia-base:latest`
@@ -86,7 +90,7 @@ These credentials work both for logging in via GUI, console (Linux) and SSH.
 If the guest VM is running and configured to accept incoming SSH connections you can conveniently connect to it like so:
 
 ```bash
-ssh admin@$(tart ip sequoia-base)
+ssh admin@$(tart ip tahoe-base)
 ```
 
 !!! tip "Running scripts inside Tart virtual machines"
@@ -95,10 +99,61 @@ ssh admin@$(tart ip sequoia-base)
 
     ```bash
     brew install cirruslabs/cli/sshpass
-    sshpass -p admin ssh -o "StrictHostKeyChecking no" -o "UserKnownHostsFile=/dev/null" admin@$(tart ip sequoia-base) "uname -a"
-    sshpass -p admin ssh -o "StrictHostKeyChecking no" -o "UserKnownHostsFile=/dev/null" admin@$(tart ip sequoia-base) < script.sh
+    sshpass -p admin ssh -o "StrictHostKeyChecking no" -o "UserKnownHostsFile=/dev/null" admin@$(tart ip tahoe-base) "uname -a"
+    sshpass -p admin ssh -o "StrictHostKeyChecking no" -o "UserKnownHostsFile=/dev/null" admin@$(tart ip tahoe-base) < script.sh
     ```
 
+## Creating VM images
+
+Tart supports macOS and Linux virtual machines. All commands like `run` and `pull` work the same way regardless of the underlying OS a particular VM image has.
+The only difference is how such VM images are created. Please check sections below for [macOS](#creating-a-macos-vm-image-from-scratch) and [Linux](#creating-a-linux-vm-image-from-scratch) instructions.
+
+### Creating a macOS VM image from scratch
+
+Tart can create VMs from `*.ipsw` files. You can download a specific `*.ipsw` file [here](https://ipsw.me/) or you can
+use `latest` instead of a path to `*.ipsw` to download the latest available version:
+
+```bash
+tart create --from-ipsw=latest tahoe-vanilla
+tart run tahoe-vanilla
+```
+
+After the initial booting of the VM, you'll need to manually go through the macOS installation process. As a convention we recommend creating an `admin` user with an `admin` password. After the regular installation please do some additional modifications in the VM:
+
+1. Enable Auto-Login. Users & Groups -> Login Options -> Automatic login -> admin.
+2. Allow SSH. Sharing -> Remote Login
+3. Disable Lock Screen. Preferences -> Lock Screen -> disable "Require Password" after 5.
+4. Disable Screen Saver.
+5. Run `sudo visudo` in Terminal, find `%admin ALL=(ALL) ALL` add `admin ALL=(ALL) NOPASSWD: ALL` to allow sudo without a password.
+
+### Creating a Linux VM image from scratch
+
+Linux VMs are supported on hosts running macOS 13.0 (Ventura) or newer.
+
+```bash
+# Create a bare VM
+tart create --linux ubuntu
+
+# Install Ubuntu
+tart run --disk focal-desktop-arm64.iso ubuntu
+
+# Run VM
+tart run ubuntu
+```
+
+After the initial setup please make sure your VM can be SSH-ed into by running the following commands inside your VM:
+
+```bash
+sudo apt update
+sudo apt install -y openssh-server
+sudo ufw allow ssh
+```
+
+### Configuring a VM
+
+By default, a Tart VM uses 2 CPUs and 4 GB of memory with a `1024x768` display. This can be changed after VM creation with `tart set` command.
+Please refer to `tart set --help` for additional details.
+
 ## Mounting directories
 
 To mount a directory, run the VM with the `--dir` argument:
@@ -161,3 +216,52 @@ The directory we've mounted above will be accessible from the `/mnt/shared/proje
     ```shell
     com.apple.virtio-fs.automount /mnt/shared virtiofs rw,relatime 0 0
     ```
+
+## Working with a Remote OCI Container Registry
+
+Tart supports interacting with Open Container Initiative (OCI) registries, but only runs images created and pushed by Tart. This means images created for container engines, like Docker, can't be pulled. Instead, create a custom image as documented above.
+
+For example, let's say you want to push/pull images to an OCI registry hosted at `https://acme.io/`.
+
+### Registry Authorization
+
+First, you need to login to `acme.io` with the `tart login` command:
+
+```bash
+tart login acme.io
+```
+
+If you login to your registry with OAuth, you may need to create an access token to use as the password.
+Credentials are securely stored in Keychain.
+
+In addition, Tart supports [Docker credential helpers](https://docs.docker.com/engine/reference/commandline/login/#credential-helpers)
+if defined in `~/.docker/config.json`.
+
+Finally, `TART_REGISTRY_USERNAME` and `TART_REGISTRY_PASSWORD` environment variables allow to override authorization
+for all registries, which might be useful for integrating with your CI's secret management.
+
+You can also set the `TART_REGISTRY_HOSTNAME` environment variable to apply these overrides only to a specific host.
+
+### Pushing a Local Image
+
+Once credentials are saved for `acme.io`, run the following command to push a local images remotely with two tags:
+
+```bash
+tart push my-local-vm-name acme.io/remoteorg/name:latest acme.io/remoteorg/name:v1.0.0
+```
+
+### Pulling a Remote Image
+
+You can either pull an image:
+
+```bash
+tart pull acme.io/remoteorg/name:latest
+```
+
+or create a VM from a remote image:
+
+```bash
+tart clone acme.io/remoteorg/name:latest my-local-vm-name
+```
+
+If the specified image is not already present, this invocation calls the `tart pull` implicitly before cloning.

docs/theme/overrides/home.html

@@ -1,5 +1,11 @@
 {% extends "base.html" %}
 
+{% block announce %}
+<a href="https://cirruslabs.org/">
+  ️🎉🎉🎉️&nbsp&nbspBig milestone for Cirrus Labs &mdash; we’re joining <strong>OpenAI</strong> to work on Agent Infrastructure&nbsp;&nbsp;🎉🎉🎉
+</a>
+{% endblock %}
+
 <!-- Render landing page under tabs -->
 {% block tabs %} {{ super() }}
 

gon.hcl

@@ -1,4 +1,4 @@
-source = [ "dist/tart_darwin_all/tart.app/Contents/MacOS/tart" ]
+source = [ "dist/tart_darwin_all/tart.app" ]
 bundle_id = "com.github.cirruslabs.tart"
 
 apple_id {

mkdocs.yml

@@ -53,6 +53,9 @@ plugins:
       debug: true
   - search
   - minify
+  - redirects:
+      redirect_maps:
+        'integrations/vm-management.md': quick-start.md
 
 markdown_extensions:
   - markdown.extensions.admonition
@@ -96,7 +99,7 @@ nav:
       - "GitHub Actions": https://cirrus-runners.app/
       - "GitLab Runner": integrations/gitlab-runner.md
       - "Buildkite": integrations/buildkite.md
-      - "Managing VMs": integrations/vm-management.md
+      - "Packer": integrations/packer.md
   - "Support & Licensing": licensing.md
   - "Orchestration":
       - "Quick Start": orchard/quick-start.md

scripts/build-docs.sh

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash
 
-docker run --pull=always --rm -it -p 8000:8000 -v ${PWD}:/docs ghcr.io/cirruslabs/mkdocs-material-insiders:latest build
+docker run --pull=always --rm -it -p 8000:8000 -v ${PWD}:/docs ghcr.io/squidfunk/mkdocs-material:latest build

scripts/run-signed.sh

@@ -1,18 +1,19 @@
 #!/bin/sh
 
 # helper script to build and run a signed tart binary
-# usage: ./scripts/run-signed.sh run sequoia-base
+# usage: ./scripts/run-signed.sh run macos
 
 set -e
 
 swift build --product tart
-codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/debug/tart
 
 rm -Rf .build/tart.app/
 mkdir -p .build/tart.app/Contents/MacOS .build/tart.app/Contents/Resources
 cp -c .build/debug/tart .build/tart.app/Contents/MacOS/tart
 cp -c Resources/embedded.provisionprofile .build/tart.app/Contents/embedded.provisionprofile
 cp -c Resources/Info.plist .build/tart.app/Contents/Info.plist
-cp -c Resources/AppIcon.png .build/tart.app/Contents/Resources
+cp -c "Resources/actool/UPW Tart.icns" "Resources/actool/Assets.car" .build/tart.app/Contents/Resources/
+
+codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/tart.app
 
 .build/tart.app/Contents/MacOS/tart "$@"

scripts/start-docs.sh

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash
 
-docker run --pull=always --rm -it -p 8000:8000 -v ${PWD}:/docs ghcr.io/cirruslabs/mkdocs-material-insiders:latest
+docker run --pull=always --rm -it -p 8000:8000 -v ${PWD}:/docs ghcr.io/squidfunk/mkdocs-material:latest