mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-14 04:59:28 +08:00
Polite_realismandAdam Miller
0e9a44cfa9
* feat(build): add system CA root mode Allow distro builds to use native trust stores for supervisor upstream TLS while keeping bundled Mozilla roots as the default. Avoid bundled root crates in system-ca-roots builds by using native-root TLS features and z3 0.20. Signed-off-by: Adam Miller <admiller@redhat.com> * fix(build): keep CA root feature in telemetry-off verification The telemetry-off task uses --no-default-features which now disables bundled-ca-roots in addition to telemetry, triggering the compile_error guard. Re-enable bundled-ca-roots explicitly so the task verifies only telemetry compilation. Signed-off-by: Scott Burdine <sburdine@nvidia.com> Signed-off-by: politerealism <burdcat17@gmail.com> * fix(sdk): disable oauth2 default features to prevent webpki-roots leak The bare `oauth2 = "5"` dependency re-enabled default features (rustls-tls → reqwest/rustls-tls → webpki-roots), defeating the system-ca-roots feature gate. Mirror the CLI fix: disable defaults and enable only the `reqwest` feature. Signed-off-by: Quinn Burdine <sburdine@redhat.com> Signed-off-by: politerealism <burdcat17@gmail.com> * refactor(build): simplify CA root selection to single feature toggle Replace mutually exclusive bundled-ca-roots / system-ca-roots features with a single bundled-ca-roots toggle. Disabling it implies system roots via rustls-native-certs, which is now a regular (non-optional) dependency. This fixes cargo --all-features and simplifies the distro build interface from --no-default-features --features system-ca-roots to just --no-default-features. Signed-off-by: Quinn Burdine <sburdine@redhat.com> Signed-off-by: politerealism <burdcat17@gmail.com> * feat(build): add system-ca-roots convenience alias and fix verify task Add a system-ca-roots feature alias on openshell-sandbox that includes all other defaults (telemetry) except bundled-ca-roots, so distro builds can use --no-default-features --features system-ca-roots without manually re-adding unrelated defaults. Update the verify CI task to use the alias and scope checks to the sandbox package. Fix task description to use "build mode" terminology instead of implying a Cargo feature. Signed-off-by: Quinn Burdine <sburdine@redhat.com> Signed-off-by: politerealism <burdcat17@gmail.com> * ci: fix system CA roots step name to use build mode terminology Signed-off-by: Quinn Burdine <sburdine@redhat.com> Signed-off-by: politerealism <burdcat17@gmail.com> * refactor(sandbox): reorder features to place system-ca-roots alias near default Signed-off-by: Quinn Burdine <sburdine@redhat.com> Signed-off-by: politerealism <burdcat17@gmail.com> * fix(proxy): unwrap Result from build_upstream_client_config in tests The function signature changed to return Result but the test call sites were not updated, causing type mismatch compilation errors in CI. Signed-off-by: Quinn Burdine <sburdine@redhat.com> Signed-off-by: politerealism <burdcat17@gmail.com> --------- Signed-off-by: Adam Miller <admiller@redhat.com> Signed-off-by: Scott Burdine <sburdine@nvidia.com> Signed-off-by: politerealism <burdcat17@gmail.com> Signed-off-by: Quinn Burdine <sburdine@redhat.com> Co-authored-by: Adam Miller <admiller@redhat.com>
60 lines
2.7 KiB
TOML
60 lines
2.7 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Rust check, lint, and format tasks
|
|
|
|
["rust:check"]
|
|
description = "Check all Rust crates for errors"
|
|
run = "cargo check --workspace"
|
|
hide = true
|
|
|
|
["rust:lint"]
|
|
description = "Lint Rust code with Clippy (deny warnings)"
|
|
run = [
|
|
"cargo clippy --workspace --all-targets -- -D warnings",
|
|
"cargo clippy --manifest-path e2e/rust/Cargo.toml --all-targets -- -D warnings",
|
|
]
|
|
hide = true
|
|
|
|
["rust:format"]
|
|
description = "Format Rust code"
|
|
run = [
|
|
"cargo fmt --all",
|
|
"cargo fmt --manifest-path e2e/rust/Cargo.toml --all",
|
|
]
|
|
hide = true
|
|
|
|
["rust:format:check"]
|
|
description = "Check Rust formatting"
|
|
run = [
|
|
"cargo fmt --all -- --check",
|
|
"cargo fmt --manifest-path e2e/rust/Cargo.toml --all -- --check",
|
|
]
|
|
hide = true
|
|
|
|
["rust:verify:telemetry-off"]
|
|
description = "Verify telemetry emission code is compiled out with --no-default-features"
|
|
run = [
|
|
# Positive control: the default (telemetry-on) gateway must contain the
|
|
# markers, so the absent checks below can never become silently vacuous.
|
|
"cargo build -p openshell-server --bin openshell-gateway",
|
|
"tasks/scripts/verify-telemetry-compiled-out.sh present target/debug/openshell-gateway",
|
|
# Guard: telemetry-free builds must contain no telemetry markers.
|
|
"cargo build -p openshell-server --bin openshell-gateway --no-default-features",
|
|
"tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-gateway",
|
|
"cargo build -p openshell-sandbox --bin openshell-sandbox --no-default-features --features bundled-ca-roots",
|
|
"tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-sandbox",
|
|
]
|
|
|
|
["rust:verify:system-ca-roots"]
|
|
description = "Verify system CA roots build mode compiles and excludes bundled Mozilla root crates"
|
|
run = [
|
|
# Check that the sandbox compiles cleanly in system CA roots mode (all
|
|
# defaults except bundled-ca-roots).
|
|
"cargo check -p openshell-sandbox --all-targets --no-default-features --features system-ca-roots",
|
|
# Guard: webpki-roots must not appear in the dependency graph.
|
|
"bash -c 'if cargo tree -p openshell-sandbox -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then echo \"ERROR: webpki-roots found in system CA roots build\" >&2; exit 1; fi'",
|
|
# Guard: webpki-root-certs must not appear either (webpki-roots re-exports it).
|
|
"bash -c 'if cargo tree -p openshell-sandbox -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then echo \"ERROR: webpki-root-certs found in system CA roots build\" >&2; exit 1; fi'",
|
|
]
|