OpenShell

mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-23 06:30:28 +08:00

Files

T

John T. Myers c6f579279e fix(ci): bump ci-image tooling versions to address vendored CVEs (#929 )

Bumps the CI image tool pins to clear High-severity container findings
flagged by nSpect against ghcr.io/nvidia/openshell/ci. These tools
vendor the Go modules reported in the nSpect tracker.

Changes:
  - DOCKER_VERSION  29.3.1     -> 29.4.1
  - BUILDX_VERSION  v0.32.1    -> v0.33.0  (bundles buildkit v0.29.0,
                                            supersedes 0.28.1 fix)
  - GH_VERSION      2.74.1     -> 2.91.0
  - MISE_VERSION    v2026.3.13 -> v2026.4.18

Covers (via vendored deps in the above binaries):
  - GHSA-p77j-4mvh-x3m3  grpc-go authorization bypass
  - GHSA-4c29-8rgm-jvjj  BuildKit malicious-frontend file escape
  - GHSA-4vrq-3vrq-g6gg  BuildKit Git subdir access to restricted files
  - GHSA-9h8m-3fm2-qjrq  OpenTelemetry Go SDK PATH hijacking
  - GHSA-92mm-2pjq-r785  hashicorp/go-getter arbitrary file reads
  - GHSA-78h2-9frx-2jm8  go-jose JWE decryption panic
  - GHSA-4qg8-fj49-pxjh  sigstore timestamp-authority excessive memory
  - GHSA-x744-4wpc-v9h2  Moby AuthZ plugin bypass

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

2026-04-23 09:37:08 -07:00

.dockerignore

chore: cleanup docker/kube/helm infra

2026-02-04 23:00:17 -08:00

cluster-entrypoint.sh

feat(vm): add openshell-vm crate with libkrun microVM gateway (#611 )

2026-04-08 22:00:01 -07:00

cluster-healthcheck.sh

feat(server): serve health endpoints on separate unauthenticated port (#903 )

2026-04-21 13:26:09 -07:00

cross-build.sh

fix(docker): add openshell-prover to Dockerfile skeleton stages and provide z3 (#800 )