diff --git a/.github/workflows/build-rpm.yml b/.github/workflows/build-rpm.yml index 71aa04ddd..0b07af316 100644 --- a/.github/workflows/build-rpm.yml +++ b/.github/workflows/build-rpm.yml @@ -21,6 +21,9 @@ on: gateway-target: required: true type: string + prover-target: + required: true + type: string rpm-version: required: false type: string @@ -81,10 +84,16 @@ jobs: name: openshell-gateway-${{ inputs.gateway-target }} path: package-binaries/ + - name: Download prover artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: openshell-prover-${{ inputs.prover-target }} + path: package-binaries/ + - name: Configure package inputs run: | set -euo pipefail - chmod +x package-binaries/openshell{,-gateway} + chmod +x package-binaries/openshell{,-gateway,-prover} ls -lah package-binaries - name: Mark workspace safe for git diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 242f8c7d0..cfab36aa7 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -97,8 +97,22 @@ jobs: checkout-ref: ${{ github.sha }} secrets: inherit + build-prover: + needs: version + permissions: + contents: read + uses: ./.github/workflows/build-binaries.yml + with: + package: openshell-prover-cli + binary: openshell-prover + triple: x86_64-unknown-linux-musl + runner: linux-amd64-cpu8 + cargo-version: ${{ needs.version.outputs.cargo }} + checkout-ref: ${{ github.sha }} + secrets: inherit + build-rpm: - needs: [version, build-cli, build-gateway] + needs: [version, build-cli, build-gateway, build-prover] permissions: contents: read uses: ./.github/workflows/build-rpm.yml @@ -108,6 +122,7 @@ jobs: runner: linux-amd64-cpu8 cli-target: x86_64-unknown-linux-musl gateway-target: x86_64-unknown-linux-gnu + prover-target: x86_64-unknown-linux-musl cargo-version: ${{ needs.version.outputs.cargo }} rpm-version: ${{ needs.version.outputs.rpm_version }} rpm-release: ${{ needs.version.outputs.rpm_release }} diff --git a/.github/workflows/deb-package.yml b/.github/workflows/deb-package.yml index 7008acd4e..1ec52dc3a 100644 --- a/.github/workflows/deb-package.yml +++ b/.github/workflows/deb-package.yml @@ -58,6 +58,12 @@ jobs: name: openshell-gateway-${{ matrix.gnu_target }} path: package-binaries/ + - name: Download prover artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: openshell-prover-${{ matrix.cli_target }} + path: package-binaries/ + - name: Download VM driver artifact uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: @@ -67,7 +73,7 @@ jobs: - name: Configure package inputs run: | set -euo pipefail - chmod +x package-binaries/openshell{,-gateway,-driver-vm} + chmod +x package-binaries/openshell{,-gateway,-prover,-driver-vm} ls -lah package-binaries - name: Build Debian package @@ -75,6 +81,7 @@ jobs: set -euo pipefail OPENSHELL_CLI_BINARY="${PWD}/package-binaries/openshell" \ OPENSHELL_GATEWAY_BINARY="${PWD}/package-binaries/openshell-gateway" \ + OPENSHELL_PROVER_BINARY="${PWD}/package-binaries/openshell-prover" \ OPENSHELL_DRIVER_VM_BINARY="${PWD}/package-binaries/openshell-driver-vm" \ OPENSHELL_DEB_VERSION="${INPUTS_DEB_VERSION}" \ OPENSHELL_DEB_ARCH="${{ matrix.deb_arch }}" \ diff --git a/.github/workflows/release-dev.yml b/.github/workflows/release-dev.yml index b41167444..1ca128a1d 100644 --- a/.github/workflows/release-dev.yml +++ b/.github/workflows/release-dev.yml @@ -253,7 +253,7 @@ jobs: build-deb: name: Build Debian Packages - needs: [compute-versions, build-cli, build-gateway, build-vm-driver] + needs: [compute-versions, build-cli, build-prover, build-gateway, build-vm-driver] uses: ./.github/workflows/deb-package.yml with: deb-version: ${{ needs.compute-versions.outputs.deb_version }} @@ -273,7 +273,7 @@ jobs: build-rpm: name: Build RPM Packages - needs: [compute-versions, build-cli, build-gateway] + needs: [compute-versions, build-cli, build-prover, build-gateway] uses: ./.github/workflows/rpm-package.yml with: checkout-ref: ${{ github.sha }} @@ -335,6 +335,7 @@ jobs: set -euo pipefail apt-get update apt-get install -y --no-install-recommends ./package-input/*.deb + openshell-prover --version LD_BIND_NOW=1 openshell-gateway --version /usr/libexec/openshell/openshell-driver-vm --version @@ -349,7 +350,11 @@ jobs: if: matrix.kind == 'rpm' run: | set -euo pipefail - dnf install -y ./package-input/openshell-[0-9]*.rpm ./package-input/openshell-gateway-*.rpm + dnf install -y \ + ./package-input/openshell-[0-9]*.rpm \ + ./package-input/openshell-gateway-*.rpm \ + ./package-input/openshell-prover-*.rpm + openshell-prover --version LD_BIND_NOW=1 openshell-gateway --version - name: Download Python wheel artifact @@ -481,6 +486,8 @@ jobs: move_one openshell-dev-aarch64.rpm release/openshell-[0-9]*.aarch64.rpm move_one openshell-gateway-dev-x86_64.rpm release/openshell-gateway-[0-9]*.x86_64.rpm move_one openshell-gateway-dev-aarch64.rpm release/openshell-gateway-[0-9]*.aarch64.rpm + move_one openshell-prover-dev-x86_64.rpm release/openshell-prover-[0-9]*.x86_64.rpm + move_one openshell-prover-dev-aarch64.rpm release/openshell-prover-[0-9]*.aarch64.rpm ls -la release/ diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml index 66ef2803e..70a8152aa 100644 --- a/.github/workflows/release-tag.yml +++ b/.github/workflows/release-tag.yml @@ -306,7 +306,7 @@ jobs: build-deb: name: Build Debian Packages - needs: [compute-versions, build-cli, build-gateway, build-vm-driver] + needs: [compute-versions, build-cli, build-prover, build-gateway, build-vm-driver] uses: ./.github/workflows/deb-package.yml with: deb-version: ${{ needs.compute-versions.outputs.deb_version }} @@ -327,7 +327,7 @@ jobs: build-rpm: name: Build RPM Packages - needs: [compute-versions, build-cli, build-gateway] + needs: [compute-versions, build-cli, build-prover, build-gateway] uses: ./.github/workflows/rpm-package.yml with: checkout-ref: ${{ inputs.tag || github.ref }} @@ -432,6 +432,7 @@ jobs: set -euo pipefail apt-get update apt-get install -y --no-install-recommends ./package-input/*.deb + openshell-prover --version LD_BIND_NOW=1 openshell-gateway --version /usr/libexec/openshell/openshell-driver-vm --version @@ -446,7 +447,11 @@ jobs: if: matrix.kind == 'rpm' run: | set -euo pipefail - dnf install -y ./package-input/openshell-[0-9]*.rpm ./package-input/openshell-gateway-*.rpm + dnf install -y \ + ./package-input/openshell-[0-9]*.rpm \ + ./package-input/openshell-gateway-*.rpm \ + ./package-input/openshell-prover-*.rpm + openshell-prover --version LD_BIND_NOW=1 openshell-gateway --version - name: Download Python wheel artifact diff --git a/.github/workflows/rpm-package.yml b/.github/workflows/rpm-package.yml index 5cda9a88c..5e2e50ac5 100644 --- a/.github/workflows/rpm-package.yml +++ b/.github/workflows/rpm-package.yml @@ -40,10 +40,12 @@ jobs: runner: linux-amd64-cpu8 cli_target: x86_64-unknown-linux-musl gateway_target: x86_64-unknown-linux-gnu + prover_target: x86_64-unknown-linux-musl - arch: aarch64 runner: linux-arm64-cpu8 cli_target: aarch64-unknown-linux-musl gateway_target: aarch64-unknown-linux-gnu + prover_target: aarch64-unknown-linux-musl uses: ./.github/workflows/build-rpm.yml with: checkout-ref: ${{ inputs.checkout-ref }} @@ -51,6 +53,7 @@ jobs: runner: ${{ matrix.runner }} cli-target: ${{ matrix.cli_target }} gateway-target: ${{ matrix.gateway_target }} + prover-target: ${{ matrix.prover_target }} rpm-version: ${{ inputs.rpm-version }} rpm-release: ${{ inputs.rpm-release }} cargo-version: ${{ inputs.cargo-version }} diff --git a/architecture/build.md b/architecture/build.md index 4390fffd0..3f9e8f8b3 100644 --- a/architecture/build.md +++ b/architecture/build.md @@ -86,13 +86,14 @@ HTTP/TLS support behind explicit build features, so default system-Z3 builds do not reintroduce bundled Mozilla roots. Release builds that need bundled Z3 continue to opt in with `bundled-z3`. -The standalone `openshell-prover` executable is distributed independently of -the main CLI. Release workflows build Linux musl x86_64 and aarch64 binaries -and a macOS Apple Silicon binary, then publish one archive per target plus a -dedicated SHA-256 manifest. Before publication, target-native jobs extract each -archive, reject host Z3 or Nix store linkage, and run a real local containment -check. The tool therefore requires neither an OpenShell installation nor a -separately installed Z3 runtime. +Release workflows build the standalone `openshell-prover` executable for Linux +musl x86_64 and aarch64 and macOS Apple Silicon. The standard Debian, RPM, and +Homebrew installations include it, following the same package-managed pattern +as `openshell-gateway`. Releases also publish one standalone archive per target +plus a dedicated SHA-256 manifest. Before publication, target-native jobs +extract each archive, reject host Z3 or Nix store linkage, and run a real local +containment check. The standalone artifact therefore requires neither an +OpenShell installation nor a separately installed Z3 runtime. ## Linux Runtime Environments diff --git a/deploy/deb/control.in b/deploy/deb/control.in index 9f77f8775..e0975d4d4 100644 --- a/deploy/deb/control.in +++ b/deploy/deb/control.in @@ -9,8 +9,9 @@ Homepage: https://github.com/NVIDIA/OpenShell Description: Safe, sandboxed runtimes for autonomous AI agents OpenShell provides host-side command-line and gateway components for launching and managing policy-enforced AI agent sandboxes. The package - installs the openshell CLI, openshell-gateway daemon, and the VM compute - driver helper, plus a per-user systemd unit for running the gateway. + installs the openshell CLI, standalone policy prover, openshell-gateway daemon, + and the VM compute driver helper, plus a per-user systemd unit for running the + gateway. . The systemd unit is user-scope (under /usr/lib/systemd/user/). To start it, run `systemctl --user enable --now openshell-gateway`. diff --git a/docs/about/installation.mdx b/docs/about/installation.mdx index a40d908fa..33b4dfc95 100644 --- a/docs/about/installation.mdx +++ b/docs/about/installation.mdx @@ -16,7 +16,7 @@ Install OpenShell with a single command: curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh ``` -The script detects your operating system and installs the OpenShell CLI and gateway with your native package manager. It then starts the local gateway server so you can begin creating sandboxes. +The script detects your operating system and installs the OpenShell CLI, standalone policy prover, and gateway with your native package manager. It then starts the local gateway server so you can begin creating sandboxes. You can also download release artifacts directly from the [OpenShell GitHub Releases](https://github.com/NVIDIA/OpenShell/releases) page. @@ -42,7 +42,7 @@ For detailed driver behavior, refer to [Sandbox Compute Drivers](/reference/sand ## macOS -On macOS, the install script uses Homebrew. The Homebrew package installs the `openshell` CLI, the gateway binary, and a Homebrew-managed gateway service. +On macOS, the install script uses Homebrew. The Homebrew package installs the `openshell` CLI, `openshell-prover`, the gateway binary, and a Homebrew-managed gateway service. The Homebrew service uses the gateway's built-in `127.0.0.1:17670` listener and generates a local mTLS bundle on install. The installer registers `https://localhost:17670` with the CLI so TLS uses a DNS name covered by the generated certificate. The formula creates a Homebrew prefix config, such as `/opt/homebrew/var/openshell/gateway.toml`, without overriding `bind_address`. Docker Desktop and Podman Machine reuse the primary listener for sandbox callbacks when they can reach it. The gateway reads `~/.config/openshell/gateway.toml` instead when that file exists. Homebrew upgrades migrate exact package-generated schema-v1 prefix configs, including the affected IPv6 variant. They preserve edited prefix configs and all user configs. Follow the [schema version 2 migration steps](/reference/gateway-config#migrate-to-schema-version-2) for an edited v1 file. @@ -57,9 +57,9 @@ brew services restart openshell ## Linux -On Fedora and RHEL, the install script uses RPM packages. The RPM installs the `openshell` CLI, the `openshell-gateway` daemon, and a systemd user service. +On Fedora and RHEL, the install script uses RPM packages. The RPMs install the `openshell` CLI, `openshell-prover`, the `openshell-gateway` daemon, and a systemd user service. -On Debian and Ubuntu, the install script uses a Debian package. The Debian package installs the `openshell` CLI, the `openshell-gateway` daemon, VM sandbox support, and a systemd user service. +On Debian and Ubuntu, the install script uses a Debian package. The Debian package installs the `openshell` CLI, `openshell-prover`, the `openshell-gateway` daemon, VM sandbox support, and a systemd user service. Linux packages require glibc 2.28 or newer. The installer checks libc before downloading packages and exits with an error on older glibc versions, Alpine, musl-based distributions, or unknown libc environments. diff --git a/docs/reference/support-matrix.mdx b/docs/reference/support-matrix.mdx index cfa5b6954..22fd35bca 100644 --- a/docs/reference/support-matrix.mdx +++ b/docs/reference/support-matrix.mdx @@ -10,7 +10,7 @@ This page lists the host platform, compute driver, software, runtime, and kernel ## Supported Platforms -OpenShell publishes multi-architecture gateway images for `linux/amd64` and `linux/arm64`. The CLI, package-managed gateway, and standalone gateway binary are supported on the following host platforms: +OpenShell publishes multi-architecture gateway images for `linux/amd64` and `linux/arm64`. The CLI, policy prover, package-managed gateway, and standalone gateway binary are supported on the following host platforms: | Platform | Architecture | Status | | -------------------------------- | --------------------- | --------- | @@ -35,6 +35,18 @@ These artifacts are attached to GitHub releases. Kubernetes deployments should u On Linux, `openshell-gateway` requires glibc 2.28 or newer. Compatible systems include, for example, Ubuntu 20.04+, RHEL 8+, Rocky Linux 8+, Amazon Linux 2023+, and Fedora 32+. +## Standalone Policy Prover + +OpenShell publishes standalone `openshell-prover` release assets for manual download on these platforms: + +| Platform | Artifact pattern | +| --------------------- | ----------------------------------------------------- | +| Linux x86_64 (amd64) | `openshell-prover-x86_64-unknown-linux-musl.tar.gz` | +| Linux aarch64 (arm64) | `openshell-prover-aarch64-unknown-linux-musl.tar.gz` | +| macOS Apple Silicon | `openshell-prover-aarch64-apple-darwin.tar.gz` | + +These artifacts are attached to GitHub releases. The Linux binaries are static and do not require glibc. All prover archives include the required solver linkage. + ## Compute Drivers The gateway can manage sandboxes through several compute drivers. diff --git a/install.sh b/install.sh index faa10c3e3..7f8673614 100755 --- a/install.sh +++ b/install.sh @@ -583,6 +583,10 @@ find_rpm_asset() { _dev_name="openshell-gateway-dev-${_arch}.rpm" _fallback_re="^openshell-gateway-[0-9].*\\.${_arch}\\.rpm$" ;; + openshell-prover) + _dev_name="openshell-prover-dev-${_arch}.rpm" + _fallback_re="^openshell-prover-[0-9].*\\.${_arch}\\.rpm$" + ;; *) error "unknown RPM package selector: ${_package}" ;; @@ -944,9 +948,14 @@ install_linux_rpm() { error "no openshell-gateway RPM package found for architecture: ${_arch}" fi - info "selected ${_rpm_file} and ${_gateway_rpm_file}" + _prover_rpm_file="$(find_rpm_asset "${_tmpdir}/${CHECKSUMS_NAME}" "$_arch" openshell-prover)" + if [ -z "$_prover_rpm_file" ]; then + error "no openshell-prover RPM package found for architecture: ${_arch}" + fi - for _package_file in "$_rpm_file" "$_gateway_rpm_file"; do + info "selected ${_rpm_file}, ${_gateway_rpm_file}, and ${_prover_rpm_file}" + + for _package_file in "$_rpm_file" "$_gateway_rpm_file" "$_prover_rpm_file"; do _package_url="${GITHUB_URL}/releases/download/${RELEASE_TAG}/${_package_file}" _package_path="${_tmpdir}/${_package_file}" @@ -960,8 +969,11 @@ install_linux_rpm() { verify_checksum "$_package_path" "${_tmpdir}/${CHECKSUMS_NAME}" "$_package_file" done - info "installing ${_rpm_file} and ${_gateway_rpm_file}..." - install_rpm_packages "${_tmpdir}/${_rpm_file}" "${_tmpdir}/${_gateway_rpm_file}" + info "installing ${_rpm_file}, ${_gateway_rpm_file}, and ${_prover_rpm_file}..." + install_rpm_packages \ + "${_tmpdir}/${_rpm_file}" \ + "${_tmpdir}/${_gateway_rpm_file}" \ + "${_tmpdir}/${_prover_rpm_file}" info "installed ${APP_NAME} RPM packages from ${RELEASE_TAG}" start_user_gateway } diff --git a/openshell.spec b/openshell.spec index ce35f7379..ee9d7d5f5 100644 --- a/openshell.spec +++ b/openshell.spec @@ -58,6 +58,14 @@ lifecycle management. This package installs Podman-oriented defaults in gateway TOML while leaving compute driver selection to gateway auto-detection or explicit operator configuration. +# --- Standalone policy prover sub-package --- +%package prover +Summary: Standalone OpenShell policy boundary prover + +%description prover +OpenShell policy prover for checking whether a local candidate policy stays +within an operator-supplied maximum without connecting to a gateway. + # --- Python SDK sub-package --- %package -n python3-%{name} Summary: OpenShell Python SDK for agent execution and management @@ -87,6 +95,7 @@ grep -q 'version = "%{openshell_cargo_version}"' Cargo.toml || (echo "ERROR: Car %build test -x "${OPENSHELL_PREBUILT_BINARIES_DIR}/openshell" test -x "${OPENSHELL_PREBUILT_BINARIES_DIR}/openshell-gateway" +test -x "${OPENSHELL_PREBUILT_BINARIES_DIR}/openshell-prover" # Generate vendored crate manifest and license metadata. # cargo-vendor.txt is consumed by an RPM generator (from cargo-rpm-macros) @@ -103,6 +112,9 @@ pandoc -s -t man deploy/man/openshell-gateway.8.md -o openshell-gateway.8 # --- CLI binary --- install -Dpm 0755 "${OPENSHELL_PREBUILT_BINARIES_DIR}/%{name}" %{buildroot}%{_bindir}/%{name} +# --- Standalone policy prover --- +install -Dpm 0755 "${OPENSHELL_PREBUILT_BINARIES_DIR}/%{name}-prover" %{buildroot}%{_bindir}/%{name}-prover + # --- Gateway binary --- install -Dpm 0755 "${OPENSHELL_PREBUILT_BINARIES_DIR}/%{name}-gateway" %{buildroot}%{_bindir}/%{name}-gateway @@ -209,6 +221,9 @@ touch %{buildroot}%{python3_sitelib}/%{name}-%{openshell_python_version}.dist-in # Smoke-test the CLI binary %{buildroot}%{_bindir}/%{name} --version +# Smoke-test the standalone policy prover +%{buildroot}%{_bindir}/%{name}-prover --version + # Smoke-test the gateway binary %{buildroot}%{_bindir}/%{name}-gateway --version @@ -246,6 +261,12 @@ grep -q 'gateway.toml.default.v1' %{buildroot}%{_userunitdir}/%{name}-gateway.se %{_bindir}/%{name} %{_mandir}/man1/openshell.1* +%files prover +%license LICENSE +%license LICENSE.dependencies +%license cargo-vendor.txt +%{_bindir}/%{name}-prover + %files gateway %license LICENSE %license LICENSE.dependencies diff --git a/python/openshell/release_formula_test.py b/python/openshell/release_formula_test.py index 684809745..671577d70 100644 --- a/python/openshell/release_formula_test.py +++ b/python/openshell/release_formula_test.py @@ -29,6 +29,10 @@ def test_generate_homebrew_formula_uses_tagged_macos_driver_asset_without_defaul "d" * 64 + " openshell-gateway-aarch64-apple-darwin.tar.gz\n", encoding="utf-8", ) + (release_dir / "openshell-prover-checksums-sha256.txt").write_text( + "e" * 64 + " openshell-prover-aarch64-apple-darwin.tar.gz\n", + encoding="utf-8", + ) repo_root = Path(__file__).resolve().parents[2] output = tmp_path / "openshell.rb" @@ -53,6 +57,14 @@ def test_generate_homebrew_formula_uses_tagged_macos_driver_asset_without_defaul "v0.0.10/openshell-driver-vm-aarch64-apple-darwin.tar.gz" ) in formula assert 'sha256 "' + "b" * 64 + '"' in formula + assert ( + "https://github.com/NVIDIA/OpenShell/releases/download/" + "v0.0.10/openshell-prover-aarch64-apple-darwin.tar.gz" + ) in formula + assert 'sha256 "' + "e" * 64 + '"' in formula + assert 'resource("openshell-prover").stage' in formula + assert 'bin.install "openshell-prover"' in formula + assert "#{bin}/openshell-prover --version" in formula assert "OPENSHELL_COMPUTE_DRIVER: " not in formula assert 'OPENSHELL_GATEWAY_CONFIG: "#{var}/openshell/gateway.toml"' not in formula assert "init-gateway-config.sh" not in formula diff --git a/tasks/scripts/package-deb-install.sh b/tasks/scripts/package-deb-install.sh index e20d409bb..bd95a13e4 100755 --- a/tasks/scripts/package-deb-install.sh +++ b/tasks/scripts/package-deb-install.sh @@ -7,7 +7,7 @@ # or on the gateway-as-a-service flow. # # Steps: -# 1. cargo build --release the three binaries that go into the deb. +# 1. cargo build --release the four binaries that go into the deb. # 2. Run tasks/scripts/package-deb.sh against those binaries. # 3. sudo dpkg -i the resulting artifact. # 4. Start the packaged user gateway service and register it locally. @@ -57,11 +57,13 @@ echo "==> Building release binaries" cargo build --release \ -p openshell-cli \ -p openshell-gateway \ + -p openshell-prover-cli \ -p openshell-driver-vm echo "==> Building Debian package" OPENSHELL_CLI_BINARY="${repo_root}/target/release/openshell" \ OPENSHELL_GATEWAY_BINARY="${repo_root}/target/release/openshell-gateway" \ + OPENSHELL_PROVER_BINARY="${repo_root}/target/release/openshell-prover" \ OPENSHELL_DRIVER_VM_BINARY="${repo_root}/target/release/openshell-driver-vm" \ OPENSHELL_DEB_VERSION="$VERSION" \ OPENSHELL_DEB_ARCH="$ARCH" \ @@ -79,6 +81,7 @@ sudo dpkg -i "$deb_path" openshell --version openshell-gateway --version +openshell-prover --version echo "==> Starting user gateway service" systemctl --user daemon-reload diff --git a/tasks/scripts/package-deb.sh b/tasks/scripts/package-deb.sh index 3e20f6256..c2492dd24 100755 --- a/tasks/scripts/package-deb.sh +++ b/tasks/scripts/package-deb.sh @@ -21,6 +21,7 @@ Build the openshell Debian package. Required environment: OPENSHELL_CLI_BINARY Path to openshell OPENSHELL_GATEWAY_BINARY Path to openshell-gateway + OPENSHELL_PROVER_BINARY Path to openshell-prover OPENSHELL_DRIVER_VM_BINARY Path to openshell-driver-vm OPENSHELL_DEB_VERSION Debian package version @@ -69,6 +70,7 @@ infer_deb_arch() { require_env OPENSHELL_CLI_BINARY require_env OPENSHELL_GATEWAY_BINARY +require_env OPENSHELL_PROVER_BINARY require_env OPENSHELL_DRIVER_VM_BINARY require_env OPENSHELL_DEB_VERSION @@ -110,6 +112,7 @@ mkdir -p "$pkgroot/DEBIAN" # Binaries. stage_binary "$OPENSHELL_CLI_BINARY" "$pkgroot/usr/bin/openshell" stage_binary "$OPENSHELL_GATEWAY_BINARY" "$pkgroot/usr/bin/openshell-gateway" +stage_binary "$OPENSHELL_PROVER_BINARY" "$pkgroot/usr/bin/openshell-prover" stage_binary "$OPENSHELL_DRIVER_VM_BINARY" "$pkgroot/usr/libexec/openshell/openshell-driver-vm" # Per-user systemd unit. Each user enables it via `systemctl --user`. diff --git a/tasks/scripts/release.py b/tasks/scripts/release.py index 3b0afe5ec..78695824c 100644 --- a/tasks/scripts/release.py +++ b/tasks/scripts/release.py @@ -37,6 +37,7 @@ HOMEBREW_TARGET = "aarch64-apple-darwin" HOMEBREW_CLI_ASSET = f"openshell-{HOMEBREW_TARGET}.tar.gz" HOMEBREW_GATEWAY_ASSET = f"openshell-gateway-{HOMEBREW_TARGET}.tar.gz" HOMEBREW_DRIVER_VM_ASSET = f"openshell-driver-vm-{HOMEBREW_TARGET}.tar.gz" +HOMEBREW_PROVER_ASSET = f"openshell-prover-{HOMEBREW_TARGET}.tar.gz" GITHUB_RELEASE_DOWNLOADS = "https://github.com/NVIDIA/OpenShell/releases/download" LOCAL_GATEWAY_PORT = 17670 _SHA256_RE = re.compile(r"^[0-9a-fA-F]{64}$") @@ -310,6 +311,7 @@ def render_homebrew_formula( cli_sha256: str, gateway_sha256: str, driver_vm_sha256: str, + prover_sha256: str, ) -> str: if not _RELEASE_TAG_RE.fullmatch(release_tag): raise ValueError(f"release tag contains unsupported characters: {release_tag}") @@ -341,6 +343,11 @@ class Openshell < Formula sha256 "{driver_vm_sha256}" end + resource "openshell-prover" do + url "{_asset_url(release_tag, HOMEBREW_PROVER_ASSET)}" + sha256 "{prover_sha256}" + end + def install odie "OpenShell Homebrew formula currently supports macOS only" unless OS.mac? @@ -354,6 +361,10 @@ class Openshell < Formula libexec.install "openshell-driver-vm" end + resource("openshell-prover").stage do + bin.install "openshell-prover" + end + (libexec/"openshell-gateway-homebrew-service").write <<~SH #!/bin/sh set -eu @@ -475,6 +486,7 @@ class Openshell < Formula test do assert_match "openshell ", shell_output("#{{bin}}/openshell --version") + assert_match "openshell-prover ", shell_output("#{{bin}}/openshell-prover --version") end end """ @@ -488,8 +500,10 @@ def generate_homebrew_formula( ) -> None: checksums_path = release_dir / "openshell-checksums-sha256.txt" gateway_checksums_path = release_dir / "openshell-gateway-checksums-sha256.txt" + prover_checksums_path = release_dir / "openshell-prover-checksums-sha256.txt" checksums = _parse_sha256_file(checksums_path) gateway_checksums = _parse_sha256_file(gateway_checksums_path) + prover_checksums = _parse_sha256_file(prover_checksums_path) formula = render_homebrew_formula( release_tag=release_tag, @@ -504,6 +518,11 @@ def generate_homebrew_formula( HOMEBREW_DRIVER_VM_ASSET, checksums_path, ), + prover_sha256=_required_checksum( + prover_checksums, + HOMEBREW_PROVER_ASSET, + prover_checksums_path, + ), ) output.parent.mkdir(parents=True, exist_ok=True) output.write_text(formula, encoding="utf-8") diff --git a/tasks/scripts/test-install-sh.sh b/tasks/scripts/test-install-sh.sh index 5a20399b6..b9d5f980f 100755 --- a/tasks/scripts/test-install-sh.sh +++ b/tasks/scripts/test-install-sh.sh @@ -110,4 +110,15 @@ if [ "$(PLATFORM=linux local_gateway_endpoint)" != "https://127.0.0.1:17670" ]; exit 1 fi +cat >"${tmpdir}/checksums" <<'EOF' +aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa openshell-dev-x86_64.rpm +bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb openshell-gateway-dev-x86_64.rpm +cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc openshell-prover-dev-x86_64.rpm +EOF + +if [ "$(find_rpm_asset "${tmpdir}/checksums" x86_64 openshell-prover)" != "openshell-prover-dev-x86_64.rpm" ]; then + echo "FAIL: RPM prover package selection" >&2 + exit 1 +fi + echo "install.sh focused tests passed" diff --git a/tasks/scripts/test-packaging-assets.sh b/tasks/scripts/test-packaging-assets.sh index 9c9d3011f..02ecdb007 100755 --- a/tasks/scripts/test-packaging-assets.sh +++ b/tasks/scripts/test-packaging-assets.sh @@ -58,6 +58,9 @@ assert_contains \ "$spec" \ 'ExecStartPre=/usr/bin/openshell-gateway generate-certs --output-dir ${OPENSHELL_LOCAL_TLS_DIR} --server-san host.openshell.internal' assert_contains "$spec" 'ExecStartPre=/usr/bin/openshell-gateway config preflight' +assert_contains "$spec" '%package prover' +assert_contains "$spec" '%files prover' +assert_contains "$spec" '%{_bindir}/%{name}-prover' assert_not_contains "$spec" '%%S/openshell/tls' # Schema-v2 package startup wiring. @@ -95,12 +98,13 @@ if command -v dpkg-deb >/dev/null 2>&1; then package_work=$(mktemp -d "${TMPDIR:-/tmp}/openshell-package-assets.XXXXXX") trap 'rm -rf "$package_work"' EXIT mkdir -p "$package_work/bin" "$package_work/output" - for binary in openshell openshell-gateway openshell-driver-vm; do + for binary in openshell openshell-gateway openshell-prover openshell-driver-vm; do printf '#!/bin/sh\nexit 0\n' >"$package_work/bin/$binary" chmod +x "$package_work/bin/$binary" done OPENSHELL_CLI_BINARY="$package_work/bin/openshell" \ OPENSHELL_GATEWAY_BINARY="$package_work/bin/openshell-gateway" \ + OPENSHELL_PROVER_BINARY="$package_work/bin/openshell-prover" \ OPENSHELL_DRIVER_VM_BINARY="$package_work/bin/openshell-driver-vm" \ OPENSHELL_DEB_VERSION=0.0.0 \ OPENSHELL_DEB_ARCH=amd64 \ @@ -113,6 +117,11 @@ if command -v dpkg-deb >/dev/null 2>&1; then echo "FAIL: package-deb did not stage the current Debian service" >&2 exit 1 fi + if ! dpkg-deb --fsys-tarfile "$package_work/output/openshell_0.0.0_amd64.deb" \ + | tar -tf - | grep -x './usr/bin/openshell-prover' >/dev/null; then + echo "FAIL: package-deb did not stage openshell-prover" >&2 + exit 1 + fi else echo "SKIP: dpkg-deb unavailable; Debian artifact staging requires its assigned lane" fi