Repository navigation
chore: sync with upstream NVIDIA/OpenShell (2026-10-16) - #17
Merged
Merged
Conversation
* fix(snap): require mTLS for the snap gateway Replace the installer opt-in with an authenticated snap gateway. The wrapper no longer forces plaintext, so the gateway serves TLS from the bundle it already generates in $SNAP_COMMON/tls. The install hook writes a config that enables mTLS user auth instead of unauthenticated access, and a new post-refresh hook migrates the exact legacy default on existing installs. install.sh waits for the gateway, detects whether it serves TLS, copies the client bundle into the target user's snap state directory, and registers the gateway over HTTPS. Older plaintext snap revisions still register over HTTP with a warning. The release canary asserts mTLS auth and HTTPS registration. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): pass config preflight and detect the mTLS gateway reliably An explicit [openshell.gateway.mtls_auth] table fails config preflight, which validates mTLS auth before the local TLS bundle supplies the client CA. Write a default that pins the Docker driver instead; with the wrapper's TLS bundle the gateway requires client certificates and enables mTLS user auth automatically, as the native packages do. The mTLS gateway rejects TLS handshakes without a client certificate, and it still answers plaintext loopback HTTP for sandbox service routing, so the installer could misdetect it as a legacy plaintext gateway. Probe HTTPS with the root-owned client bundle, and treat a gateway as legacy only when a plaintext gRPC Health call succeeds. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * chore(snap): simplify install hook comment Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): migrate insecure gateway configs on refresh Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(snap): simplify mTLS detection and config migration Detect the mTLS snap from the installed revision's post-refresh hook instead of probing plaintext gRPC, and drop the scheme global. Remove the installer's pre-hook config fallback, which is dead now that every channel ships the install hook and which wrote the insecure default. Give the install hook a single write path with a simple backup name, and shorten the manual client certificate steps. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): stop keeping a copy of replaced insecure configs Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(install): make the snap an opt-in install method Stop selecting the OpenShell snap just because the snap command exists. Linux installs default to the Debian or RPM package; OPENSHELL_INSTALL_METHOD=snap (or deb, rpm) selects the package explicitly. Hosts that already have the OpenShell snap keep refreshing it rather than gaining a second gateway on the same port. The release canary and snap repro script opt in explicitly. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): let the gateway auto-detect its compute driver Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): restart the gateway after refresh Published revisions use refresh-mode: endure, and snapd honors the old revision's setting during a refresh, so the plaintext gateway kept running with the migrated config unused until a manual restart. Restart the gateway from the post-refresh hook so the mTLS config takes effect immediately. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(snap): drop refresh notes from the snap description Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(snap): trim snap refresh notes from installation docs Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs(readme): show Rust SDK installation command Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(architecture): lead with policy enforcement Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(architecture): reuse README how it works text Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(architecture): refresh architecture page and diagrams Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(extensibility): simplify extension points diagram and overview Redraw the extension points diagram as two left-to-right rows for the data plane and control plane, describe which layers each extension point extends, and move authentication after Building Extensions as Authenticating Extensions with updated cross-page links. Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
…NECT header (NVIDIA#3745) The proxy read the synthesized CONNECT header of a mediated open with a full-width read into an 8192-byte buffer through a BufReader of the same size, so the workload's request could arrive in the same read. The CONNECT path never looked past the header, and the request was lost until the workload timed out. Take the header out of the BufReader with fill_buf and consume only through the terminator, so the bytes behind it stay buffered for the relay. Signed-off-by: Davanum Srinivas <dsrinivas@nvidia.com>
…VIDIA#3752) Closes NVIDIA#3746 Use Homebrew atomic_write for exact legacy config migrations and keep the first-install write distinct in the formula test. Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* fix(docs): sync redirects with versioned snapshots Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(docs): make redirect validation types explicit Signed-off-by: Johnny Greco <jogreco@nvidia.com> --------- Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs: align page file names and nav labels with published URLs Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs: redirect moved dev pages and fix agent guide redirects Signed-off-by: Johnny Greco <jogreco@nvidia.com> * ci(docs): check that page URLs match their file paths Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(docs): align navigation checks with repo conventions Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs: omit historical redirect aliases Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(docs): preserve published overview and TypeScript URLs Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(docs): redirect unversioned overview and TypeScript URLs Signed-off-by: Johnny Greco <jogreco@nvidia.com> --------- Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Closes NVIDIA#3756 Replace the idle 50 ms procfs scan with SIGCHLD notifications and a 30 second recovery sweep. Preserve managed-child wait ownership and cover idle and exit behavior in isolated tests. Signed-off-by: Drew Newberry <anewberry@nvidia.com>
The gateway chart always rendered the ClusterRole and ClusterRoleBinding, so
every install and upgrade required cluster-admin even when only namespaced
objects were needed. Installers that are namespace-admin GitOps or platform
controllers could not run the release at all, and clusters where cluster-scoped
RBAC is owned by a separate team had no supported way to split the install.
Add an rbac values block so a cluster-admin can apply the cluster-scoped objects
once and a namespace-admin can install and upgrade the release without
cluster-scoped permissions:
rbac:
create: true
clusterScoped:
create: true
clusterRoleName: ""
clusterRoleBindingName: ""
rbac.clusterScoped.create gates the ClusterRole and ClusterRoleBinding, and is
independent of the workspace mode. rbac.create additionally gates the namespaced
sandbox Role and RoleBinding, which matters because Kubernetes escalation
prevention stops an installer holding only the built-in admin role from creating
a Role that grants agents.x-k8s.io verbs it does not itself hold. The certgen
hook and credential driver RBAC keep their existing flags.
Both flags default to true, so current installs are unchanged. The helpers treat
a missing rbac block as enabled so upgrades with --reuse-values do not drop RBAC,
matching the existing workspaceResources pattern. The ClusterRoleBinding roleRef
follows clusterRoleName so a separately applied ClusterRole can carry a name the
cluster-admin chooses.
Document the migration for a release that already owns the cluster-scoped
objects: Helm deletes objects that leave the manifest, so annotate them with
helm.sh/resource-policy=keep before setting the flag, otherwise the gateway
loses TokenReview until a cluster-admin re-applies them.
Signed-off-by: ansjindal <ansjindal@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* test(cli): migrate gateway-free smoke coverage Signed-off-by: Evan Lezar <elezar@nvidia.com> * fix(e2e): remove migrated tests from podman CI Signed-off-by: Evan Lezar <elezar@nvidia.com> --------- Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* test(e2e): remove superseded podman userns coverage Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(tmachine): run podman e2e archive Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(tmachine): generate podman e2e archive inventory Signed-off-by: Evan Lezar <elezar@nvidia.com> --------- Signed-off-by: Evan Lezar <elezar@nvidia.com>
…VIDIA#3753) * fix(network): refuse protocol upgrades on JSON-RPC and MCP endpoints JSON-RPC and MCP rules apply to each HTTP request, but the proxy could forward a request that also carried upgrade headers. After an upstream answered 101, route selection and the forward proxy relayed the connection without inspection. Refuse any request that carries an Upgrade header on JSON-RPC-family endpoints before the L7 policy decision, in every enforcement mode. Share the check with the existing h2c refusal and call it from relay_jsonrpc as well. Record the refusal as a policy denial and answer with the unsupported_l7_protocol error, because no policy rule can allow the request. If a JSON-RPC-family endpoint still receives 101, close the connection instead of relaying raw bytes. Document the refusal and the WebSocket alternative. Signed-off-by: Shiju <shiju@nvidia.com> * docs(observability): remove duplicate protocol error definition Keep unsupported_l7_protocol in the response error-code list and retain its explanation in the policy troubleshooting table. Signed-off-by: Shiju <shiju@nvidia.com> --------- Signed-off-by: Shiju <shiju@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
…IDIA#3335) * fix(sandbox-backend): sort boundary request objects before hashing Sort boundary request objects recursively before hashing so serde_json's preserve_order feature cannot change digest identity. Cover canonical bytes, envelope round trips, and rejection of modified provider values and operations. Signed-off-by: Shiju <shiju@nvidia.com> * feat(mcp): upgrade tower-mcp-types to 0.22.2 Upgrade tower-mcp-types from 0.12.0 to an exact-pinned 0.22.2 and use its inspection APIs to validate MCP requests against the selected revision. Carry inspection metadata into policy evaluation and validate requests after header rewriting, before forwarding. Add explicit support for the sessionless 2026-07-28 revision while keeping 2025-11-25 as the default. Validate per-request metadata and standard HTTP header mirrors, and support discovery, tools, and subscription requests. Delegate batch availability and parameter schemas to Tower. Share typed request names between policy and HTTP checks, retain the local batch resource cap, and centralize MCP policy version parsing and ordering. Keep supported MCP revisions and shared allowlist parsing in the canonical policy schema; core re-exports those types. Tower owns wire-profile semantics, and every supported policy revision must map to the matching inspector profile. Reject duplicate JSON keys, invalid known-method parameters, unavailable methods, and unsupported batches. Keep exact extension allow rules and deny precedence. Document request inspection boundaries and add unit, forwarding, and sandbox coverage. Refs NVIDIA#2174. Signed-off-by: Shiju <shiju@nvidia.com> * test(mcp): prove authorization at the forwarding boundary Cover March batch denial in both member orders, valid and malformed controls, and audit behavior across both relay entry paths. Exercise real middleware tool rewrites with matching metadata and assert the exact upstream representation or zero forwarded bytes. Verify legacy bodyless SSE GET remains usable while GET tool bodies and unsupported DELETE cleanup are rejected. Clarify request-selected profile and middleware mutation comments without changing production behavior. Signed-off-by: Shiju <shiju@nvidia.com> * test(mcp): exercise permitted profiles through the sandbox proxy Cover March and June singleton policies and select November and July separately under one endpoint allowlist. Capture upstream tool receipts to distinguish proxy policy denial from an upstream rejection. Extend middleware rewrite coverage to June and multi-version policies, and preserve the sessionless discovery and subscription checks through the shared fixture helpers. Signed-off-by: Shiju <shiju@nvidia.com> * test(kubernetes): box the admission check future Keep the admission test future below Clippy's size limit when the workspace dependency features are unified. Signed-off-by: Shiju <shiju@nvidia.com> * test(mcp): reuse the forwarding fixture identity cache Share the binary identity cache across protocol-profile cases, matching the proxy lifecycle and avoiding repeated hashes of the test executable. Keep procfs authorization and all forwarding assertions intact. Signed-off-by: Shiju <shiju@nvidia.com> --------- Signed-off-by: Shiju <shiju@nvidia.com>
* feat(sandbox): add main restart policy Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(sandbox): harden policy-driven restarts Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(sandbox): address restart review feedback Signed-off-by: Drew Newberry <385+drew@users.noreply.github.com> * fix(sandbox): port restart policy to current runtime Signed-off-by: Drew Newberry <anewberry@nvidia.com> * perf(sandbox): restart promptly after terminal delivery Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com> Signed-off-by: Drew Newberry <385+drew@users.noreply.github.com>
…A#3700) - Kubernetes now checks supervisor readiness by connecting to TCP port 5501 - Stop starting a supervisor process in every sandbox each second - The supervisor opens the port only while its gateway session is up - Accept IPv4 and IPv6 probes, even when net.ipv6.bindv6only is set - Keep the health socket for Docker, Podman, and debugging - Add tests and update the docs Signed-off-by: divesh <dgude@nvidia.com>
* feat(docker): support corporate proxy CA bundles Closes NVIDIA#3545 Validate and stage operator-owned proxy CA bundles for Docker supervisors, add corporate proxy E2E coverage, and document the trust contract. Signed-off-by: Philippe Martin <phmartin@redhat.com> * fix(docker): validate proxy config on startup Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> * test(docker): use the E2E workload image for proxy tests Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> * test(docker): generate strict corporate proxy certificates Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> * test(docker): surface intercepted TLS fixture errors Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> * test(docker): drain buffered TLS proxy data Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> * test(docker): relay intercepted HTTP deterministically Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> --------- Signed-off-by: Philippe Martin <phmartin@redhat.com> Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> Co-authored-by: John Myers <9696606+johntmyers@users.noreply.github.com>
* fix(e2e): stop sandbox leaks from async Drop cleanup Closes NVIDIA#2922 SandboxGuard::Drop spawned a detached thread to delete the sandbox. The thread got killed with the test process before the delete finished. Switch to a blocking command in Drop, like ManagedCleanup already does. Also wrap two tests' manual cleanup in RAII guards so a panic does not leak a sandbox. Signed-off-by: Eric Curtin <eric.curtin@docker.com> * test(e2e): arm sandbox guards before create Address review: install guards with explicit names first. Signed-off-by: Eric Curtin <eric.curtin@docker.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com>
Reuse character-safe truncation for policy history errors so a multibyte character cannot panic the table renderer. Distinguish unavailable provider-profile YAML from an absent profile, display a bounded diagnostic, and preserve strict serialization and redacted object navigation. Cover the actual CLI renderer and TUI display/navigation paths, including invalid and absent profiles, Unicode input, and redacted errors. Signed-off-by: Shiju <shiju@nvidia.com>
* feat(server): write gateway OCSF events to JSONL Previously, gateway security activity was available only in diagnostic output, and events not associated with a sandbox, such as TLS certificate reloads, had no independent structured record. Now, configuring `openshell.gateway.ocsf_log` writes every gateway-produced OCSF record to a bounded JSONL destination independently of `RUST_LOG`. The destination supports daily or disabled rotation, retention limits, queue bounds, and optional schema downgrade to OCSF 1.1 or 1.3. Additionally, existing gateway emitters (TLS reloads, service routing, and policy approval and auto-approval audits) emit structured events, so they reach the JSONL destination, console shorthand, and the affected sandbox's log stream. Records identify the gateway by its configured name in `device.uid` and `device.name`, shared across replicas, with `device.hostname` identifying the replica and `device.os` the gateway's operating system. Metrics and warnings expose known best-effort losses. Refs NVIDIA#2762 Signed-off-by: Kris Hicks <khicks@nvidia.com> * fix(mxc): attribute ETW events to gateway Signed-off-by: Evan Lezar <elezar@nvidia.com> --------- Signed-off-by: Kris Hicks <khicks@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> Co-authored-by: Evan Lezar <elezar@nvidia.com>
…VIDIA#3872) The test reserved a loopback port, released it, and rebound it inside the workload. A concurrent nextest process could claim the port in between, failing the bind and surfacing only as a RecvError on the ready channel. Bind port 0 in the workload and send the assigned address instead, and report the workload error when the listener never becomes ready. Signed-off-by: Kris Hicks <khicks@nvidia.com>
…VIDIA#3861) * fix(network): preserve pipelined requests after chunked inspection Stop chunked MCP and JSON-RPC body reads at each framing boundary so the connection reader retains the next request for independent inspection. Keep payload reads bounded by the remaining chunk length and scan framing lines incrementally. Cover buffered prefixes, fragmented framing, trailers, and malformed input. Verify allowed and denied pipelined requests through both relay entry paths. Signed-off-by: Shiju <shiju@nvidia.com> * fix(network): share bounded HTTP body inspection with GraphQL Remove GraphQL's duplicate chunk decoder so all buffered HTTP inspectors preserve the next request on a persistent connection. Keep GraphQL's header checks, configured body limit and query classification. Cover GraphQL trailers and fragmented framing, and exercise subsequent request authorization for REST, GraphQL, MCP and JSON-RPC through both persistent relay entry paths. Signed-off-by: Shiju <shiju@nvidia.com> --------- Signed-off-by: Shiju <shiju@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* fix(vm): launch sandbox directly in guest root Signed-off-by: Adrien Langou <alangou@nvidia.com> * test(vm): explain guest init launch assertions Signed-off-by: Adrien Langou <alangou@nvidia.com> * refactor(vm): inline guest bootstrap path Signed-off-by: Adrien Langou <alangou@nvidia.com> * fix(vm): require bootstrap sandbox at guest startup Signed-off-by: Adrien Langou <alangou@nvidia.com> --------- Signed-off-by: Adrien Langou <alangou@nvidia.com>
* test(tmachine): pin k3s to Kubernetes 1.29 Signed-off-by: Simon Scatton <sscatton@nvidia.com> * fix(tmachine): retry k3s node readiness during startup Signed-off-by: Simon Scatton <sscatton@nvidia.com> --------- Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* ci(compatibility): require explicit risk acceptance Signed-off-by: Simon Scatton <sscatton@nvidia.com> * test(compatibility): remove report regression tests Signed-off-by: Simon Scatton <sscatton@nvidia.com> --------- Signed-off-by: Simon Scatton <sscatton@nvidia.com>
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* feat(tmachine): build local Debian artifacts Signed-off-by: Evan Lezar <elezar@nvidia.com> * refactor(tmachine): separate VM driver artifact build Signed-off-by: Evan Lezar <elezar@nvidia.com> --------- Signed-off-by: Evan Lezar <elezar@nvidia.com>
…ws (NVIDIA#4419) * refactor(ci): extract release qualification and serialize Codex reviews Signed-off-by: Simon Scatton <sscatton@nvidia.com> * fix(ci): queue Codex reviews without security ordering Signed-off-by: Simon Scatton <sscatton@nvidia.com> * fix(ci): retain qualification evidence after build failures Signed-off-by: Simon Scatton <sscatton@nvidia.com> * docs(ci): shorten compatibility review guidance Signed-off-by: Simon Scatton <sscatton@nvidia.com> --------- Signed-off-by: Simon Scatton <sscatton@nvidia.com>
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
Signed-off-by: Eric Curtin <eric.curtin@docker.com>
* ci(release): notify Slack when a prerelease succeeds Post a top-level message to the triage webhook when a prerelease completes, so recovery after failures is visible. The message omits the triage mention. Closes NVIDIA#4604 Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * ci(release): link the prerelease tag in the success notification Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
…IA#4420) * ci(release): publish prereleases before qualification Signed-off-by: Simon Scatton <sscatton@nvidia.com> * ci(release): decouple prerelease publication from qualification Signed-off-by: Simon Scatton <sscatton@nvidia.com> --------- Signed-off-by: Simon Scatton <sscatton@nvidia.com>
Signed-off-by: Adrien Langou <alangou@nvidia.com>
* fix(sandbox): distinguish descriptor lookup outcomes Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> * fix(sandbox): preserve bad-descriptor errors in native fallback Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> --------- Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>
* feat(providers): report bounded token-grant failures Signed-off-by: Shiju <shiju@nvidia.com> * test(providers): align policy metadata and TLS lockfile Signed-off-by: Shiju <shiju@nvidia.com> * test(providers): fix trusted grant recovery fixture Signed-off-by: Shiju <shiju@nvidia.com> * test(providers): enable denial API in recovery fixture Signed-off-by: Shiju <shiju@nvidia.com> * refactor(providers): simplify token-grant failure reporting Remove duplication and dead paths from the token-grant failure reporting without changing classification, the workload-visible 502 response, or the wire format. - Build the gRPC failure envelope with tonic-types, store the typed failure in EndpointFailure, and share one request-ID rule and one endpoint-status authority check. - Merge the gateway exchange client wrapper, drop forwarding validators, and name the request field when a reported cause is rejected. - Inject fallback credentials only from live provider state and delete the unread per-connection credential copy. Keep one 502 writer per path and restore the base token-cache handling. - Check the token endpoint after the cache lookup, still before any credential acquisition. - Document 429 and 5xx classification as implemented, and drop tests that repeat retained assertions through the same code path. Signed-off-by: Shiju <shiju@nvidia.com> * refactor(providers): trim token-grant failure tests and supervisor API Cut the token-grant failure tests to one test per distinct behavior across core, gateway, supervisor, CLI and Go, and replace the 794-line closure E2E with status assertions in the existing route-recovery E2E: the refused grant appears in sandbox status with the response's request ID, code, stage and upstream status, and the matching grant's later success clears it. - Pin the live provider snapshot with one helper used by inspected and fallback forwarding, and inject selector-matched grants through inject_for_selectors, which borrows the pinned context. Move the test-only wrapper into test_support. - Drop the 35-second wrappers around the gateway grant RPC. The shared channel bounds the connection attempt and the gateway bounds its token-service calls. - Log the token service's OAuth error and error_description, without control characters and limited to 256 characters each, with the request ID in the gateway or supervisor log. Status and the workload response still carry only the bounded cause. - Keep one check that an untrusted token-service certificate cannot assert a cause. Signed-off-by: Shiju <shiju@nvidia.com> * fix(providers): restore test import and features lockfile The injection tests named EndpointObservationSender through the parent module, which no longer imports it. The features suite lockfile kept the tonic TLS dependency that the removed E2E fixture added. Signed-off-by: Shiju <shiju@nvidia.com> * test(providers): fix body-bound fixture width and table type Pass the response-size width as a named argument; an implicitly captured constant panics at runtime. Name the mutation type in the validation table for Clippy. Signed-off-by: Shiju <shiju@nvidia.com> * test(providers): pad exact-bound body without a format width MAX_TOKEN_RESPONSE_BYTES exceeds u16::MAX, the largest format width, so the padded fixture panicked. Pad with repeat_n as before. Signed-off-by: Shiju <shiju@nvidia.com> * test(server): update public RPC schema hash after rebase Main added the ListProvidersRequest label selector. The merged public schema hash comes from the Branch Checks storage_proto test output. Signed-off-by: Shiju <shiju@nvidia.com> * fix(providers): keep token-service error text out of grant logs A token service can echo a submitted credential in its OAuth error or error_description. Log only the classified failure code, HTTP status and request ID, and cover the canary echo in a dedicated test binary. Signed-off-by: Shiju <shiju@nvidia.com> * docs(providers): tighten token grant failure documentation Signed-off-by: Shiju <shiju@nvidia.com> * docs(providers): condense token grant failure guidance Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> --------- Signed-off-by: Shiju <shiju@nvidia.com> Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> Co-authored-by: John Myers <9696606+johntmyers@users.noreply.github.com>
* docs(kubernetes): document managed workspaces setup Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(kubernetes): rename workspace guide title Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
…ss (NVIDIA#3996) * fix(podman): trust an operator-supplied additional CA for direct egress Since v0.1.2 the Podman supervisor runs as its own container, separate from the workload image, so it can no longer inherit a private CA baked into the workload's system trust store. Policy-allowed, inspected HTTPS requests to destinations signed by that CA fail upstream TLS establishment, and the only workaround is rebuilding the supervisor image with the CA baked in. Add a Podman-only additional_ca_bundle setting, independent of the existing proxy_ca_bundle (which requires https_proxy), that bind-mounts an operator PEM into the supervisor container and folds it into the upstream trust store alongside the system CA bundle. Validated on the gateway host at sandbox-create time, matching the existing corporate proxy CA bundle's validation, so a misconfigured path or certificate-free bundle fails closed immediately rather than producing a failed sandbox once the supervisor container starts. Scoped to Podman only, reusing the existing additive-bundle mechanism without new gateway.toml schema, proto fields, or cross-driver plumbing -- a narrower alternative to the in-flight cross-driver implementation in NVIDIA#3292, which remains the intended long-term direction. Fixes NVIDIA#3781. Signed-off-by: politerealism <burdcat17@gmail.com> * fix(podman): keep additional CA mount on the supervisor build_isolation_specs() keeps only trusted_mount() destinations on the supervisor, and the additional CA path was not in that list. The bind mount stayed on the workload while the supervisor received --additional-ca-bundle for a file it did not have, so startup failed. Add the path to trusted_mount() and cover the final supervisor and workload specs with a test. Correct the docs and a code comment to say the bundle is validated when the driver starts, and add Podman troubleshooting guidance to the debug-openshell-cluster skill. Signed-off-by: politerealism <burdcat17@gmail.com> --------- Signed-off-by: politerealism <burdcat17@gmail.com>
…IA#3854) Signed-off-by: Yuedong Wu <dwcn22@outlook.com>
) * feat(docker): select supervisor networking for ECI workloads Signed-off-by: Drew Newberry <anewberry@nvidia.com> * test(docker): use automatic networking in e2e Signed-off-by: Drew Newberry <anewberry@nvidia.com> * test(docker): rely on existing e2e networking coverage Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(docker): shorten supervisor networking configuration Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(docker): let local gateway discover supervisor endpoint Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(docker): make supervisor networking operator-selected Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(docker): resolve host gateway in the driver Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(docker): simplify host networking guidance Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(docker): trim configuration guidance Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(docker): discover host gateway once at driver startup Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Keep iAiFy overlay files where better; take upstream elsewhere. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
WalkthroughWarning Review details and warnings were omitted to fit the comment limit. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+15
to
+17
| - uses: ./.github/actions/setup-nix | ||
|
|
||
| - name: Check protobuf compatibility |
Comment on lines
+69
to
+71
| - uses: ./.github/actions/setup-nix | ||
|
|
||
| - name: Cache tmachine disks |
Comment on lines
+68
to
+70
| - uses: ./.github/actions/setup-nix | ||
|
|
||
| - name: Download CLI artifact |
Comment on lines
+139
to
+143
| - uses: ./.github/actions/check-protobuf-compatibility | ||
| with: | ||
| ref: refs/tags/${{ env.RELEASE_TAG }} | ||
|
|
||
| compatibility-review: |
|
|
||
| SLUG_RE = re.compile(r"^[A-Za-z0-9._-]+$") | ||
| DISPLAY_VERSION_RE = re.compile(r"\bv?(\d+\.\d+\.\d+(?:[.-]?[A-Za-z0-9]+)*)\b") |
| concurrency: | ||
| group: codex-release-review | ||
| cancel-in-progress: false | ||
| queue: max |
| concurrency: | ||
| group: codex-release-review | ||
| cancel-in-progress: false | ||
| queue: max |
| concurrency: | ||
| group: docs-website | ||
| cancel-in-progress: false | ||
| queue: max |
| concurrency: | ||
| group: docs-website | ||
| cancel-in-progress: false | ||
| queue: max |
| sudo snap install ./release/*.snap --dangerous | ||
| systemctl --user set-environment \ | ||
| "OPENSHELL_TELEMETRY_ENABLED=${OPENSHELL_TELEMETRY_ENABLED}" | ||
| curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/${{ github.event.workflow_run.head_sha || github.sha }}/install.sh | |
| - name: Verify installer rejects missing Docker | ||
| run: | | ||
| set -euo pipefail | ||
| curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/${{ github.event.workflow_run.head_sha || github.sha }}/install.sh -o install.sh |
Orphaned old upstream files (e.g. crates/openshell-server/src/grpc.rs, old sphinx docs) that upstream has since removed or moved. Fork-only docs/guardrails kept. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Comment on lines
+1256
to
+1257
| "{} Authenticated to gateway '{name}' as {user}", | ||
| "✓".green().bold(), |
Comment on lines
+40
to
+45
| const ADMIN: IdentityScenario = IdentityScenario { | ||
| gateway_name: "oidc-pkce-admin", | ||
| username: "admin@test", | ||
| password: "admin", | ||
| expected_role: "openshell-admin", | ||
| }; |
Comment on lines
+47
to
+52
| const USER: IdentityScenario = IdentityScenario { | ||
| gateway_name: "oidc-pkce-user", | ||
| username: "user@test", | ||
| password: "user", | ||
| expected_role: "openshell-user", | ||
| }; |
Comment on lines
+54
to
+59
| const USER_B: IdentityScenario = IdentityScenario { | ||
| gateway_name: "oidc-pkce-user-b", | ||
| username: "user-b@test", | ||
| password: "user-b", | ||
| expected_role: "openshell-user", | ||
| }; |
Comment on lines
+1361
to
+1363
| "{} should be allowed to {action}:\n{}", | ||
| session.identity.username, | ||
| combined_output(&output) |
Comment on lines
+1377
to
+1379
| "{} should be allowed to {action} in workspace {workspace}:\n{}", | ||
| session.identity.username, | ||
| combined_output(&output) |
Comment on lines
+1448
to
+1449
| "{} should be allowed to delete workspace {workspace}:\n{stderr}", | ||
| admin.identity.username |
Comment on lines
+1484
to
+1485
| "{} should be allowed to create sandbox {sandbox_name}:\n{create_output}", | ||
| session.identity.username |
Comment on lines
+1533
to
+1534
| "{} should be allowed to delete sandbox {sandbox_name}:\n{delete_output}", | ||
| session.identity.username |
Author
|
Follow-up commit removes 8 orphaned pre-sync copies of upstream files (crates/openshell-server/src/grpc.rs, old sphinx docs) that upstream has since removed or moved; fork-only docs/guardrails kept. Remaining red at merge: CodeQL, Trivy Changes, Scan changed deployment configuration, zizmor (upstream security jobs scanning the full synced diff, no Code Security in fork); Branch Checks/Helm Lint/preview never reported. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sync with upstream
NVIDIA/OpenShell(main)Merge commit (upstream history preserved) of
upstream/mainintomain. Fork was diverged.Conflict resolution (per file)
Our fork carried an older force-synced snapshot of upstream plus the iAiFy overlay; most conflicting files were stale copies of upstream.
.agents/skills/*/SKILL.md(12 files),skills/generate-sandbox-policy/{SKILL,examples}.mdcrates/openshell-router/src/backend.rs.timeout(route.timeout)tweak targeted code that no longer exists.docs/sandboxes/policies.mdx.github/CODEOWNERS.github/workflows/codeql.ymlworkflow_call..github/workflows/release-dev.yml,release-tag.yml.github/workflows/security-scan.ymlsecurity-scan.ymlexposedworkflow_callinputs (candidate_ref, ...) used by its release workflows, so those release-time scan calls will not match until the orchestrator replaces the caller.AGENTS.mdREADME.mdFiles we changed ourselves (first 40)
.agents/skills/build-from-issue/SKILL.md.agents/skills/create-github-issue/SKILL.md.agents/skills/create-github-pr/SKILL.md.agents/skills/create-spike/SKILL.md.agents/skills/debug-inference/SKILL.md.agents/skills/fix-security-issue/SKILL.md.agents/skills/generate-sandbox-policy/SKILL.md.agents/skills/generate-sandbox-policy/examples.md.agents/skills/openshell-cli/SKILL.md.agents/skills/openshell-cli/cli-reference.md.agents/skills/review-github-pr/SKILL.md.agents/skills/review-security-issue/SKILL.md.agents/skills/sbom/SKILL.md.agents/skills/sync-agent-infra/SKILL.md.agents/skills/triage-issue/SKILL.md.agents/skills/tui-development/SKILL.md.agents/skills/watch-github-actions/SKILL.md.github/CODEOWNERS.github/copilot-instructions.md.github/dependabot.yml.github/workflows/codeql.yml.github/workflows/dev-version.yml.github/workflows/docs-build.yml.github/workflows/docs-preview-pr.yml.github/workflows/release-dev.yml.github/workflows/release-tag.yml.github/workflows/release.yml.github/workflows/repo-hygiene-consumer.yml.github/workflows/sbom.yml.github/workflows/security-scan.ymlAGENTS.mdCLAUDE.mdFORK-CUSTOMIZATIONS.mdREADME.mdcrates/openshell-router/src/backend.rscrates/openshell-server/src/grpc.rsdocs/conf.pydocs/guardrails/README.mddocs/guardrails/observer.yamldocs/guardrails/power-user.yamlOur ECC caller workflows (security-scan, repo-hygiene-consumer, release, sbom, dev-version, iaify-*) were not edited by this PR.
🤖 Generated with Claude Code