Make sure other resources are signed too

.cirrus.yml

@@ -1,74 +1,8 @@
 use_compute_credits: true
 
-task:
-  name: Test
-  alias: test
-  persistent_worker:
-    labels:
-      name: dev-mini
-    resources:
-      tart-vms: 1
-  build_script:
-    - swift build
-  test_script:
-    # Add /usr/sbin to PATH, otherwise testDiskutilInfo() fails to locate "diskutil"
-    - export PATH=$PATH:/usr/sbin
-    - swift test
-  integration_test_script:
-    - codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/debug/tart
-    - export PATH=$(pwd)/.build/arm64-apple-macosx/debug:$PATH
-    # Run integration tests
-    - cd integration-tests
-    - python3 -m venv --symlinks venv
-    - source venv/bin/activate
-    - pip install -r requirements.txt
-    - pytest --verbose --junit-xml=pytest-junit.xml
-    - go test -v ./...
-  pytest_junit_result_artifacts:
-    path: "integration-tests/pytest-junit.xml"
-    format: junit
-
-task:
-  name: Markdown Lint
-  only_if: $CIRRUS_BRANCH != 'gh-pages' && changesInclude('**.md')
-  container:
-    image: node:latest
-  install_script: npm install -g markdownlint-cli
-  lint_script: markdownlint --config=docs/.markdownlint.yml docs/
-
-task:
-  name: Lint
-  alias: lint
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:tahoe
-  lint_script:
-    - swift package plugin --allow-writing-to-package-directory swiftformat --cache ignore --lint --report swiftformat.json .
-  always:
-    swiftformat_report_artifacts:
-      path: swiftformat.json
-      format: swiftformat
-
-task:
-  only_if: $CIRRUS_TAG == ''
-  env:
-    matrix:
-      BUILD_ARCH: arm64
-      BUILD_ARCH: x86_64
-  name: Build ($BUILD_ARCH)
-  alias: build
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:tahoe
-  build_script: swift build --arch $BUILD_ARCH --product tart
-  sign_script: codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/$BUILD_ARCH-apple-macosx/debug/tart
-  binary_artifacts:
-    path: .build/$BUILD_ARCH-apple-macosx/debug/tart
-
 task:
   only_if: $CIRRUS_TAG == '' && ($CIRRUS_USER_PERMISSION == 'write' || $CIRRUS_USER_PERMISSION == 'admin')
   name: Release (Dry Run)
-  depends_on:
-    - lint
-    - build
   macos_instance:
     image: ghcr.io/cirruslabs/macos-runner:tahoe
   env:
@@ -103,6 +37,7 @@ task:
   only_if: $CIRRUS_TAG != ''
   depends_on:
     - lint
+    - test
     - build
   macos_instance:
     image: ghcr.io/cirruslabs/macos-runner:tahoe
@@ -147,17 +82,3 @@ task:
     - sentry-cli releases new $SENTRY_RELEASE
     - sentry-cli releases set-commits $SENTRY_RELEASE --auto
     - sentry-cli releases finalize $SENTRY_RELEASE
-
-task:
-  name: Deploy Documentation
-  only_if: $CIRRUS_BRANCH == 'main'
-  container:
-    image: ghcr.io/squidfunk/mkdocs-material:latest
-    registry_config: ENCRYPTED[!cf1a0f25325aa75bad3ce6ebc890bc53eb0044c02efa70d8cefb83ba9766275a994b4831706c52630a0692b2fa9cfb9e!]
-  env:
-    DEPLOY_TOKEN: ENCRYPTED[!45ed45666558902ed1c2400add734ec063103bec31841847e8c8764802fca229bfa6d85c690e16ad159e047574b48793!]
-  deploy_script:
-    - git config --global user.name "Cirrus CI"
-    - git config --global user.name "hello@cirruslabs.org"
-    - git remote set-url origin https://$DEPLOY_TOKEN@github.com/cirruslabs/tart/
-    - mkdocs --verbose gh-deploy --force --remote-branch gh-pages

.goreleaser.yml

@@ -25,26 +25,28 @@ universal_binaries:
   - name_template: tart.app/Contents/MacOS/tart
     replace: true
     hooks:
-      post:
+      pre:
         - mkdir -p dist/tart_darwin_all/tart.app/Contents/Resources
-        - cp Resources/embedded.provisionprofile dist/tart_darwin_all/tart.app/Contents/
-        - cp Resources/Info.plist dist/tart_darwin_all/tart.app/Contents/
-        - cp "Resources/actool/UPW Tart.icns" "Resources/actool/Assets.car" dist/tart_darwin_all/tart.app/Contents/Resources/
+        - cp Resources/embedded.provisionprofile dist/tart_darwin_all/tart.app/Contents/embedded.provisionprofile
+        - cp Resources/Info.plist dist/tart_darwin_all/tart.app/Contents/Info.plist
+        - cp Resources/AppIcon.png dist/tart_darwin_all/tart.app/Contents/Resources/AppIcon.png
+      post:
         - gon gon.hcl
 
 archives:
   - name_template: "{{ .ProjectName }}"
     files:
-      - src: dist/tart_darwin_all/tart.app/Contents/Info.plist
-        dst: tart.app/Contents/Info.plist
-      - src: dist/tart_darwin_all/tart.app/Contents/embedded.provisionprofile
-        dst: tart.app/Contents/embedded.provisionprofile
-      - src: dist/tart_darwin_all/tart.app/Contents/Resources/UPW Tart.icns
-        dst: tart.app/Contents/Resources/UPW Tart.icns
-      - src: dist/tart_darwin_all/tart.app/Contents/Resources/Assets.car
-        dst: tart.app/Contents/Resources/Assets.car
       - src: dist/tart_darwin_all/tart.app/Contents/_CodeSignature/CodeResources
         dst: tart.app/Contents/_CodeSignature/CodeResources
+      - src: dist/tart_darwin_all/tart.app/Contents/embedded.provisionprofile
+        dst: tart.app/Contents
+        strip_parent: true
+      - src: dist/tart_darwin_all/tart.app/Contents/Info.plist
+        dst: tart.app/Contents
+        strip_parent: true
+      - src: dist/tart_darwin_all/tart.app/Contents/Resources/AppIcon.png
+        dst: tart.app/Contents/Resources
+        strip_parent: true
       - LICENSE
 
 release:
@@ -71,8 +73,6 @@ brews:
     install: |
       libexec.install Dir["*"]
       bin.write_exec_script "#{libexec}/tart.app/Contents/MacOS/tart"
+      generate_completions_from_executable(libexec/"tart.app/Contents/MacOS/tart", "--generate-completion-script")
     custom_block: |
       depends_on :macos => :ventura
-      def post_install
-        generate_completions_from_executable(libexec/"tart.app/Contents/MacOS/tart", "--generate-completion-script")
-      end

Resources/Info.plist

@@ -10,14 +10,12 @@
 	<string>com.github.cirruslabs.tart</string>
 	<key>CFBundleExecutable</key>
 	<string>tart</string>
-	<key>CFBundlePackageType</key>
-	<string>APPL</string>
-	<key>LSApplicationCategoryType</key>
-	<string>public.app-category.developer-tools</string>
-	<key>CFBundleIconFile</key>
-	<string>UPW Tart</string>
-	<key>CFBundleIconName</key>
-	<string>UPW Tart</string>
+  <key>LSApplicationCategoryType</key>
+  <string>public.app-category.developer-tools</string>
+	<key>CFBundleIconFiles</key>
+	<array>
+		<string>AppIcon.png</string>
+	</array>
 	<key>NSAppTransportSecurity</key>
 	<dict>
 		<key>NSAllowsArbitraryLoads</key>

Resources/UPW Tart.icon/icon.json

@@ -1,140 +0,0 @@
-{
-  "fill" : "automatic",
-  "groups" : [
-    {
-      "blend-mode" : "normal",
-      "blur-material" : 0.5,
-      "layers" : [
-        {
-          "hidden" : false,
-          "image-name-specializations" : [
-            {
-              "value" : "4.4-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L4.png"
-            }
-          ],
-          "name" : "UPW Tart L4"
-        }
-      ],
-      "opacity" : 1,
-      "shadow" : {
-        "kind" : "neutral",
-        "opacity" : 1
-      },
-      "specular" : true,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    },
-    {
-      "layers" : [
-        {
-          "image-name-specializations" : [
-            {
-              "value" : "3.3-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L3.png"
-            }
-          ],
-          "name" : "UPW Tart L3",
-          "position-specializations" : [
-            {
-              "idiom" : "square",
-              "value" : {
-                "scale" : 1,
-                "translation-in-points" : [
-                  0,
-                  0
-                ]
-              }
-            }
-          ]
-        }
-      ],
-      "shadow" : {
-        "kind" : "none",
-        "opacity" : 1
-      },
-      "specular" : false,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    },
-    {
-      "blur-material" : null,
-      "layers" : [
-        {
-          "image-name-specializations" : [
-            {
-              "value" : "2.2-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L2.png"
-            }
-          ],
-          "name" : "UPW Tart L2"
-        }
-      ],
-      "position-specializations" : [
-        {
-          "idiom" : "square",
-          "value" : {
-            "scale" : 1,
-            "translation-in-points" : [
-              0,
-              0
-            ]
-          }
-        }
-      ],
-      "shadow" : {
-        "kind" : "none",
-        "opacity" : 1
-      },
-      "specular" : true,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    },
-    {
-      "layers" : [
-        {
-          "image-name-specializations" : [
-            {
-              "value" : "1.1-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L1.png"
-            }
-          ],
-          "name" : "UPW Tart L1"
-        }
-      ],
-      "shadow" : {
-        "kind" : "layer-color",
-        "opacity" : 0.5
-      },
-      "specular" : true,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    }
-  ],
-  "supported-platforms" : {
-    "circles" : [
-      "watchOS"
-    ],
-    "squares" : "shared"
-  }
-}

Resources/actool/Info.plist

@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleIconFile</key>
-	<string>UPW Tart</string>
-	<key>CFBundleIconName</key>
-	<string>UPW Tart</string>
-</dict>
-</plist>

Sources/tart/ControlSocket.swift

@@ -19,7 +19,7 @@ class ControlSocket {
   func run() async throws {
     // Remove control socket file from previous "tart run" invocations,
     // if any, otherwise we may get the "address already in use" error
-    try? FileManager.default.removeItem(atPath: controlSocketURL.path)
+    try? FileManager.default.removeItem(atPath: controlSocketURL.path())
 
     // Change the current working directory to a VM's base directory
     // to work around Unix domain socket 104 byte limitation [1]

Tests/TartTests/ControlSocketURLTests.swift

@@ -1,28 +0,0 @@
-import XCTest
-@testable import tart
-
-final class ControlSocketURLTests: XCTestCase {
-  func testControlSocketURLResolvesToAbsolutePath() throws {
-    let baseURL = URL(fileURLWithPath: "/Users/test/.tart/vms/myvm/")
-    let vmDir = VMDirectory(baseURL: baseURL)
-
-    // The .path property resolves relative URLs to absolute paths,
-    // which is required for stale socket cleanup in ControlSocket.run()
-    // since it happens before the working directory is changed.
-    XCTAssertEqual(
-      vmDir.controlSocketURL.path,
-      "/Users/test/.tart/vms/myvm/control.sock"
-    )
-  }
-
-  func testControlSocketURLRelativePathIsJustFilename() throws {
-    let baseURL = URL(fileURLWithPath: "/Users/test/.tart/vms/myvm/")
-    let vmDir = VMDirectory(baseURL: baseURL)
-
-    // The .relativePath is used for socket binding after cwd is changed
-    XCTAssertEqual(
-      vmDir.controlSocketURL.relativePath,
-      "control.sock"
-    )
-  }
-}

Tests/TartTests/LayerizerTests.swift

@@ -14,7 +14,7 @@ final class LayerizerTests: XCTestCase {
     do {
       registryRunner = try await RegistryRunner()
     } catch {
-      try XCTSkip("Registry is unavailable: \(error)")
+      try XCTSkipIf(ProcessInfo.processInfo.environment["CI"] == nil)
     }
   }
 
@@ -26,7 +26,7 @@ final class LayerizerTests: XCTestCase {
 
   func testDiskV2() async throws {
     // Original disk file to be pushed to the registry
-    let originalDiskFileURL = try fileWithRandomData(sizeBytes: 1 * 1024 * 1024 * 1024)
+    let originalDiskFileURL = try fileWithRandomData(sizeBytes: 5 * 1024 * 1024 * 1024)
     addTeardownBlock {
       try FileManager.default.removeItem(at: originalDiskFileURL)
     }

Tests/TartTests/RegistryTests.swift

@@ -10,7 +10,7 @@ final class RegistryTests: XCTestCase {
     do {
       registryRunner = try await RegistryRunner()
     } catch {
-      try XCTSkip("Registry is unavailable: \(error)")
+      try XCTSkipIf(ProcessInfo.processInfo.environment["CI"] == nil)
     }
   }
 

Tests/TartTests/Util/RegistryRunner.swift

@@ -13,7 +13,7 @@ class RegistryRunner {
     let stdoutPipe = Pipe()
 
     let proc = Process()
-    proc.executableURL = URL(fileURLWithPath: "/opt/homebrew/bin/docker")
+    proc.executableURL = URL(fileURLWithPath: "/usr/local/bin/docker")
     proc.arguments = arguments
     proc.standardOutput = stdoutPipe
     try proc.run()
@@ -31,7 +31,7 @@ class RegistryRunner {
 
   init() async throws {
     // Start container
-    let container = try Self.dockerCmd("run", "-d", "--rm", "-p", "127.0.0.1::5000", "registry:2")
+    let container = try Self.dockerCmd("run", "-d", "--rm", "-p", "127.0.0.1:0:5000", "registry:2")
       .trimmingCharacters(in: CharacterSet.newlines)
     containerID = container
 

actool.sh

@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-
-# Set shell options to enable fail-fast behavior
-#
-# * -e: fail the script when an error occurs or command fails
-# * -u: fail the script when attempting to reference unset parameters
-# * -o pipefail: by default an exit status of a pipeline is that of its
-#                last command, this fails the pipe early if an error in
-#                any of its commands occurs
-#
-set -euo pipefail
-
-OUTPUT_PATH="Resources/actool"
-PLIST_PATH="$OUTPUT_PATH/Info.plist"
-
-rm -rf "${OUTPUT_PATH}"
-mkdir -p "${OUTPUT_PATH}"
-
-actool "Resources/UPW Tart.icon" \
-  --compile "${OUTPUT_PATH}" \
-  --output-format human-readable-text \
-  --notices \
-  --warnings \
-  --errors \
-  --app-icon "UPW Tart" \
-  --output-partial-info-plist $PLIST_PATH \
-  --include-all-app-icons \
-  --target-device mac \
-  --minimum-deployment-target 13.0 \
-  --platform macosx

docs/faq.md

@@ -59,7 +59,7 @@ Remote images are pulled into `~/.tart/cache/OCIs/`.
 ## Nested virtualization support?
 
 Tart is limited by functionality of Apple's `Virtualization.Framework`. At the moment `Virtualization.Framework`
-supports nested virtualization only on M3 or M4 chips running macOS 15 (Sequoia) or later and [only for Linux VMs](https://github.com/cirruslabs/tart/issues/1231#issuecomment-4410915463). By default, it is disabled, but can be enabled by passing the `--nested` flag to `tart run`.
+supports nested virtualization only on M3 or M4 chips running macOS 15 (Sequoia) or later. By default, it is disabled, but can be enabled by passing the `--nested` flag to `tart run`.
 
 ## Connecting to a service running on host
 

docs/theme/overrides/home.html

@@ -1,11 +1,5 @@
 {% extends "base.html" %}
 
-{% block announce %}
-<a href="https://cirruslabs.org/">
-  ️🎉🎉🎉️&nbsp&nbspBig milestone for Cirrus Labs &mdash; we’re joining <strong>OpenAI</strong> to work on Agent Infrastructure&nbsp;&nbsp;🎉🎉🎉
-</a>
-{% endblock %}
-
 <!-- Render landing page under tabs -->
 {% block tabs %} {{ super() }}
 

integration-tests/docker_registry.py

@@ -1,5 +1,7 @@
+import requests
+
+from testcontainers.core.waiting_utils import wait_container_is_ready
 from testcontainers.core.container import DockerContainer
-from testcontainers.core.wait_strategies import HttpWaitStrategy
 
 
 class DockerRegistry(DockerContainer):
@@ -8,9 +10,11 @@ class DockerRegistry(DockerContainer):
     def __init__(self):
         super().__init__("registry:2")
         self.with_exposed_ports(self._default_exposed_port)
-        self.waiting_for(HttpWaitStrategy(self._default_exposed_port, "/v2/").for_status_code(200))
 
+    @wait_container_is_ready(requests.exceptions.ConnectionError)
     def remote_name(self, for_vm: str):
         exposed_port = self.get_exposed_port(self._default_exposed_port)
 
+        requests.get(f"http://127.0.0.1:{exposed_port}/v2/")
+
         return f"127.0.0.1:{exposed_port}/tart/{for_vm}:latest"

integration-tests/test_oci.py

@@ -46,7 +46,7 @@ def vm_with_random_disk(tart):
     disk_path = os.path.join(tart.home(), "vms", vm_name, "disk.img")
 
     with tempfile.NamedTemporaryFile(delete=False) as tf:
-        tf.write(os.urandom(int(amount_to_transfer.bytes)))
+        tf.write(os.urandom(amount_to_transfer.bytes))
         tf.close()
         os.rename(tf.name, disk_path)
 

scripts/run-signed.sh

@@ -6,14 +6,13 @@
 set -e
 
 swift build --product tart
+codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/debug/tart
 
 rm -Rf .build/tart.app/
 mkdir -p .build/tart.app/Contents/MacOS .build/tart.app/Contents/Resources
 cp -c .build/debug/tart .build/tart.app/Contents/MacOS/tart
 cp -c Resources/embedded.provisionprofile .build/tart.app/Contents/embedded.provisionprofile
 cp -c Resources/Info.plist .build/tart.app/Contents/Info.plist
-cp -c "Resources/actool/UPW Tart.icns" "Resources/actool/Assets.car" .build/tart.app/Contents/Resources/
-
-codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/tart.app
+cp -c Resources/AppIcon.png .build/tart.app/Contents/Resources
 
 .build/tart.app/Contents/MacOS/tart "$@"