Polite_realism
f73928322d
rcgen 0.13.2 declares its optional x509-parser dependency with the verify feature, which pulls in ring. The workspace enabled rcgen's x509-parser feature for every crate, so the CLI and gateway linked ring alongside aws-lc even though nothing in them verifies signatures with x509-parser. Only SandboxCa::from_pem in openshell-supervisor-network needs CertificateParams::from_ca_cert_pem. Enable the feature there alone. ring no longer appears in the dependency trees of openshell, openshell-gateway or openshell-prover; it remains in openshell-supervisor until rcgen is upgraded. Release builds compile one package at a time, so the feature does not leak into the other binaries. Signed-off-by: politerealism <burdcat17@gmail.com>
Network supervisor
This crate forbids unsafe code, including its local tests. Typed socket APIs provide original-destination lookup for transparent proxying.
Socket attribution tests pass a duplicate connected socket as a spawned child's stdin. Re-executing the test binary checks multiple holders with the same binary identity; executing a different binary checks ambiguous shared-socket identity. The fixture kills and reaps the child when the parent test ends.
The manual proxy performance baseline still counts allocations. Its test-only
global allocator uses openshell-driver-vm::allocation_tracking; the unsafe
allocator implementation belongs to the VM crate. The VM dependency disables
default features, so this instrumentation does not
require the compute runtime or Unix-only sandbox library. It is a development
dependency only.