 Drew NewberryandPiotr Mlocek
|
8b77925eb7
|
feat(installer): support prerelease installations (#3364)
* feat(installer): support prerelease installations
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs(readme): clarify 0.1.0 production readiness
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs(readme): refine production readiness message
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* fix(release): publish rolling prerelease channels
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* fix(release): keep prereleases out of GitHub releases
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs(readme): refine 0.1.0 notice
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs(readme): expand 0.1.0 notice
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs(readme): simplify 0.1.0 notice
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* refactor(installer): simplify prerelease alias
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* fix(installer): require successful prerelease runs
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* refactor(release): reuse exact prerelease artifacts
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* fix(installer): include prover in prerelease bundle
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* ci: remove prerelease post-publish validation
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs(fern): sync announcement configuration
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* docs: remove stale prerelease canary claim
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs(fern): defer announcement synchronization
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* docs(fern): simplify release announcement
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
---------
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Co-authored-by: Piotr Mlocek <pmlocek@nvidia.com>
|
2026-09-18 00:53:36 +00:00 |
|
|
Johnny Greco
|
58b5f8f976
|
feat(prover): add standalone policy boundary checker (#3289)
* feat(prover): add standalone policy maximum checker
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): simplify check scope schema
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): align containment and cancellation with runtime
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): stabilize containment checks in CI
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(prover): avoid solver in fast-path guard test
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): align string containment with runtime
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): reject ambiguous z3 string escapes
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): align containment with runtime boundaries
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover-cli): harden cancellation and invalid input
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* feat(packaging): install policy prover with OpenShell
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(prover): clarify installation and check results
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(build): describe prover distribution directly
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): rename maximum policy to boundary
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* refactor(prover): localize fail-closed validation
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(prover): cover fail-closed CLI surfaces
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* test(prover): allow CI load for REST solver proof
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): use canonical policy schema for containment
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): preserve uncertainty for runtime binary globs
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): bound policy validation work
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(prover): document validation resource limits
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(prover): make containment API extensible
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* docs(prover): define containment API contract
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(ci): integrate prover with consolidated builds
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
* fix(ci): declare release packaging dependency
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
---------
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
2026-09-17 17:30:03 +00:00 |
|
|
Drew Newberry
|
f12f3ef8d5
|
fix(macos): restore Homebrew sandbox callbacks (#2739)
* fix(macos): restore Docker gateway callbacks
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* fix(gateway): reuse reachable primary callback listener
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
---------
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-08-14 18:38:20 +00:00 |
|
|
Evan LezarandDrew Newberry
|
d220d89468
|
feat(compute): negotiate gateway callback listeners (#2492)
* feat(compute): query gateway listener requirements
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* feat(compute): add Podman listener requirements
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* test(docker): use default gateway bind address
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* fix(gateway): avoid wildcard primary listener
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* fix(podman): validate callback listener discovery
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* fix(server): support split dual-stack listeners
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* fix(podman): support legacy rootless listener discovery
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* test(e2e): accept loopback plaintext rejection
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* docs(agent): add callback listener diagnostics
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* fix(server): restrict compute callback listeners
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* fix(podman): validate local callback port
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* test(server): clarify callback listener contract
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* fix(podman): require pasta for local callbacks
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* docs(gateway): document RPM listener default
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* refactor(server): keep listener provenance diagnostic-only
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* fix(compute): preserve callback listener isolation
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* test(e2e): remove Podman callback relay
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* fix(packaging): preserve Podman callback loopback
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* ci(e2e): run VM smoke on nested-virt runner
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* ci(e2e): gate VM smoke on usable KVM
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* ci(e2e): probe KVM through VM driver
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* ci(e2e): tolerate hosted KVM denial
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* test(server): close traced futures before assertions
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* revert: remove tracing test stabilization
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
---------
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Co-authored-by: Drew Newberry <anewberry@nvidia.com>
|
2026-07-31 16:41:06 +00:00 |
|
|
Piotr Mlocek
|
82d03f1c98
|
fix(linux): lower host glibc floor to 2.28 to support RHEL/Rocky 8 (#1934)
|
2026-06-22 14:09:26 -07:00 |
|
|
Piotr Mlocek
|
0dc08a185e
|
fix(release): build host Linux binaries with glibc floor (#1490)
|
2026-05-22 12:12:03 -07:00 |
|