Introduce TART_EXECUTOR_KEYCHAIN_UNLOCK environment flag

[marcusfreisleben]

This PR introduces a way to ensure the macOS keychain is unlocked in preparation of the run stage.

We've found that running macOS VMs over tart leads to somewhat misleading error messages from the git credential manager when it attempts to cache the git credentials via the (default) osxkeychain credential helper:

Preparing the "custom" executor
Using Custom executor...
2025/03/04 10:20:49 Pulling the latest version of macos-sonoma...
2025/03/04 10:20:49 Cloning and configuring a new VM...
2025/03/04 10:20:49 Waiting for the VM to boot and be SSH-able...
2025/03/04 10:21:00 Was able to SSH!
2025/03/04 10:21:00 VM is ready.
Preparing environment
Running on admins-Virtual-Machine.local...
Getting source from Git repository
Fetching changes with git depth set to 20...
Initialized empty Git repository in (...)
Created fresh repository.
fatal: Interaction with the Security Server is not allowed. [0xffff9d24]
Checking out 8ea123fd as detached HEAD (ref is foo)...
Skipping Git submodules setup
(...)

While the message is ultimately inconsequential, this functionality might also prove useful for other cases where access to the keychain is needed. Let me know what you think.

[edigaryev]

Hi Marcus 👋

Thanks for your contribution!

I wonder if you can perform sudo security unlock-keychain directly from your .gitlab-ci.yml?

It feels to me that setting the TART_EXECUTOR_KEYCHAIN_UNLOCK environment variable instead just adds an extra layer of indirection to the process.

Perhaps, we can simply document this in the README.md?

[marcusfreisleben]

Hey, thats also a possibility - yes.

My goal was minimizing the differences to a shell-Runner job you might be migrating from (I'm not observing the keychain being locked on our shell-Runners, and seems to even happen when running with TART_EXECUTOR_HEADLESS=false), and possibly not having to lug around a sudo password (if the base image does not have passwordless sudo enabled).

[edigaryev]

possibly not having to lug around a sudo password (if the base image does not have passwordless sudo enabled)

Is there a need to use sudo at all?

I think you can just do security unlock-keychain -p <PASSWORD>.

[marcusfreisleben]

Removed sudo.

I think you can just do security unlock-keychain -p <PASSWORD>.

That still means the build job needs knowledge of credentials it otherwise might now require, though.

[edigaryev]

That still means the build job needs knowledge of credentials it otherwise might now require, though.

But doesn't the build job already have knowledge of the credentials due to TART_EXECUTOR_SSH_USERNAME TART_EXECUTOR_SSH_PASSWORD?