* chore: remove SSH handshake secret residuals and fix agent memory
Removes three artifacts left behind by the #1274 removal of
OPENSHELL_SSH_HANDSHAKE_SECRET, then corrects a sweep of stale and
inaccurate notes in .claude/agent-memory/arch-doc-writer/MEMORY.md
that were discovered during the audit.
Artifact removal (Refs OS-174):
- openshell.spec: stale comment claiming init-gateway-env.sh generates
an SSH handshake secret
- e2e/with-podman-gateway.sh: dead podman secret rm for
openshell-handshake-<id>, which is never created since #1274
Agent memory corrections:
- ssh_tunnel.rs no longer exists; replaced by ssh_sessions.rs
- Object types list was missing service_endpoint and provider_profile
- Pre-exec chain now includes harden_child_process() and uses the
linux::prepare()/enforce() two-phase pattern on Linux
- CLI SSH function list had nonexistent sandbox_rsync; corrected to
actual exported functions
- ExecSandbox is in grpc/sandbox.rs (not grpc.rs) and operates over
a supervisor relay DuplexStream, not a direct TCP connection
- resolve_ssh_gateway() moved to openshell-core/src/forward.rs
- SSH transport note rewrote: NSSH1 is an OCSF-only label (not a live
protocol preface); actual path is ForwardTcp -> DuplexStream ->
RelayStream -> Unix socket; access gated by CreateSshSession token;
TLS follows endpoint scheme (https:// = mTLS, http:// = plaintext;
Podman driver does not yet inject mTLS client materials)
- CLI flag note was self-contradictory; corrected to --gateway-endpoint
with resolution priority chain
* fix(vm): collapse nested if blocks to satisfy clippy::collapsible_if
Three nested if blocks in connect_local_container_engine() were
flagged by clippy after #1370. Collapse to single if-let chains
using && as suggested.
* feat(rpm): use :dev image tag for non-release builds
Add a %global image_tag macro to the spec file (default: dev) that
controls the container image tag baked into RPM-built binaries and
the installed systemd unit.
Packit's fix-spec-file action detects tagged stable releases via
git describe --exact-match and overrides the macro to 'latest'.
PR and commit-to-main builds keep the 'dev' default, matching the
:dev images pushed by release-dev.yml.
The init-gateway-env.sh installed copy is also patched at RPM build
time so its commented image defaults stay consistent with the tag
the RPM actually expects from the registry.
Signed-off-by: Adam Miller <admiller@redhat.com>
* fix(rpm): scope image_tag to supervisor only; sandbox base stays latest
The community sandbox base image (ghcr.io/nvidia/openshell-community/
sandboxes/base) does not publish :dev tags -- only :latest and version-
pinned tags are available. Applying %{image_tag} to it caused a
manifest unknown error when pulling the image on non-release builds.
Scope the dynamic tag to the supervisor image only, which is part of
the core OpenShell release pipeline and does receive :dev tags from
release-dev.yml. The sandbox base image unconditionally uses :latest.
Also tighten the sed in %install to target only the supervisor image
line in init-gateway-env.sh rather than blanket-replacing all :latest
occurrences.
Signed-off-by: Adam Miller <admiller@redhat.com>
* fix(rpm): restore %%{openshell_python_version} in Python dist-info METADATA
The Version field inside the METADATA heredoc was hardcoded to 0.0.37
instead of using the %%{openshell_python_version} macro. This caused
the installed Python dist-info to always report the wrong version on
non-release builds.
Signed-off-by: Adam Miller <admiller@redhat.com>
---------
Signed-off-by: Adam Miller <admiller@redhat.com>
Adam Miller