mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-19 05:50:41 +08:00
Drew Newberry
96c08f111b
* refactor(isolation): make confirmation backend-neutral Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(sandbox): validate confirmation evidence at host boundary Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(isolation): keep fence evidence driver-owned Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(isolation)!: validate explicit fence projections Require each compute driver to map its native evidence to individual outer-fence guarantees, and reject incomplete projections before a boundary becomes ready. Exercise the assembled remote confirmation path for invalid audit, property, generation, and digest evidence. BREAKING CHANGE: BoundaryConfig and SandboxRuntimeDescriptor use outer_fence projections rather than the earlier driver_fence representation. State written by earlier builds cannot be decoded; operators must stop and recreate affected sandboxes after upgrading. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(isolation): clarify outer fence ownership Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(isolation): update confirmation test fixtures Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
32 lines
853 B
TOML
32 lines
853 B
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
[package]
|
|
name = "openshell-isolation-interface"
|
|
description = "OpenShell Isolation Backend interface (RFC 0012)"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
|
|
[dependencies]
|
|
openshell-core = { path = "../openshell-core", default-features = false }
|
|
async-trait = "0.1"
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
tokio = { workspace = true }
|
|
|
|
[target.'cfg(unix)'.dependencies]
|
|
libc = "0.2"
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
rustix = { workspace = true, features = ["fs", "process"] }
|
|
|
|
[dev-dependencies]
|
|
tokio = { workspace = true }
|
|
|
|
[lints]
|
|
workspace = true
|