Release notes from OpenShell
Articles about Release notes from OpenShell
V0.1.4-pre.3: feat(gateway): add gRPC server reflection (#3161)
feat(gateway): add gRPC server reflection Signed-off-by: Krzysztof Malczuk kmalczuk@redhat.com fix(gateway): rate limit gRPC reflection queries Signed-off-by: Krzysztof Malczuk kmalczuk@redhat.com fix(gateway): comply with gRPC reflection protocol Signed-off-by: Krzysztof Malczuk kmalczuk@redhat.com fix(gateway): complete reflection symbol lookups Signed-off-by: Krzysztof Malczuk kmalczuk@redhat.com Signed-off-by: Krzysztof Malczuk kmalczuk@redhat.com
V0.1.4-pre.2: feat(server): add operator-only provider credential retrieval (#4357)
feat(server): add operator-only provider credential retrieval Authenticate operators exclusively through verified direct gateway mTLS. Export selected runtime credentials with freshness validation and all-or-nothing delivery. Coordinate refresh across callers and replicas, preserve rotated grants across RPC cancellation, and fence credential delivery against reconfiguration. Add generated bindings, security and regression tests, and operator documentation. Signed-off-by: Seth Jennings sjenning@redhat.com
OpenShell v0.1.3
OpenShell v0.1.3 Quick install curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.3 sh What’s Changed feat(helm): make cluster-scoped RBAC optio
V0.1.4-pre.1: chore(deps): bump mermaid in /scripts/lint-mermaid (#4369)
Bumps mermaid from 11.16.0 to 11.16.1. Release notes Commits updated-dependencies: dependency-name: mermaid dependency-version: 11.16.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot]
V0.1.3-pre.8: fix(deps): update noyalib and preserve policy null rejection (#4348)
fix(deps): update noyalib and preserve policy null rejection Signed-off-by: Drew Newberry anewberry@nvidia.com fix(providers): preserve quoted YAML duration exports Signed-off-by: Drew Newberry anewberry@nvidia.com test(providers): assert YAML duration semantics instead of quoting Signed-off-by: Drew Newberry anewberry@nvidia.com fix(yaml): preserve authored input and cross-reader string semantics Signed-off-by: Drew Newberry anewberry@nvidia.com refactor(yaml): validate schema objects before standard decoding
V0.1.3-pre.6: feat(ci): add the maintainer approval decision tools (#3791)
Adds the two stdlib-only helpers that back the maintainer approval gate, ahead of the workflows that call them. check_maintainer_approval.py parses the linked handles out of MAINTAINERS.md, folds a review list to each reviewer's latest decisive position, and exits non-zero unless a maintainer's latest position is an approval. It fails closed when the list yields no handles. alert_maintainer_change.py renders the approver-set delta between two versions of MAINTAINERS.md, and prints nothing when the set is unchanged.
V0.1.3-pre.5: ci(security): use gpt-6.1-sol with high reasoning effort (#4203)
Signed-off-by: Adrien Langou alangou@nvidia.com
V0.1.3-pre.4: ci(release): notify duty engineers of prerelease failures (#4134)
ci(release): notify duty engineers of prerelease failures Signed-off-by: Jim Meyer jimeyer@nvidia.com ci(release): make Slack triage mention configurable Signed-off-by: Jim Meyer jimeyer@nvidia.com ci(release): keep Slack triage configuration in secrets Signed-off-by: Jim Meyer jimeyer@nvidia.com docs(ci): clarify prerelease Slack notifications Signed-off-by: Jim Meyer jimeyer@nvidia.com Signed-off-by: Jim Meyer jimeyer@nvidia.com
V0.1.3-pre.3: feat(snap): ship the standalone prover binary in the snap (#3717)
Signed-off-by: Oliver Calder oliver.calder@canonical.com Signed-off-by: Evan Lezar elezar@nvidia.com
V0.1.3-pre.2: refactor(auth): separate sandbox identity from TLS (#3110)
refactor(auth): separate sandbox identity from TLS Signed-off-by: Drew Newberry anewberry@nvidia.com docs(auth): clarify gateway mTLS behavior Signed-off-by: Drew Newberry anewberry@nvidia.com test(auth): include workspace scope in TLS authorization checks Signed-off-by: Drew Newberry anewberry@nvidia.com test(e2e): bound service auth sandbox names for large PIDs Signed-off-by: Drew Newberry anewberry@nvidia.com Signed-off-by: Drew Newberry anewberry@nvidia.com
V0.1.3-pre.1: fix(server): log polled request responses at debug (#3974)
log_response has always logged every gateway response at INFO, including health probes and the GetSandboxConfig and provider-readiness polls each supervisor makes. #3915 demoted the request spans for those polled paths to DEBUG, which stripped the request{method path} prefix from the log line at INFO but left the line itself, so the gateway log fills with bare 'response status=200' lines several times per second. Follow the span's level: polled requests log their response at DEBUG,
OpenShell v0.1.2
OpenShell v0.1.2 Quick install curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.2 sh What’s Changed docs(policy): clarify sandbox-local loopba
OpenShell v0.1.1
OpenShell v0.1.1 Quick install curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.1 sh What’s Changed fix(gateway): make the WebSocket tunnel op
OpenShell v0.1.0
OpenShell v0.1.0 Quick install curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.0 sh What’s Changed ci(codeql): run nightly scans on main by @
V0.1.0-pre.12: docs: refresh architecture and agent guides (#3705)
docs: refresh architecture and agent guides Signed-off-by: Drew Newberry anewberry@nvidia.com docs: describe updated security architecture neutrally Signed-off-by: Drew Newberry anewberry@nvidia.com docs: highlight new isolation primitives Signed-off-by: Drew Newberry anewberry@nvidia.com docs(sandboxes): clarify how to disconnect Signed-off-by: Drew Newberry anewberry@nvidia.com docs: align architecture and guides with current navigation Signed-off-by: Drew Newberry anewberry@nvidia.com
V0.1.0-pre.11: fix(auth): remove legacy sandbox JWT admission (#3562)
Signed-off-by: Piotr Mlocek pmlocek@nvidia.com
Release v0.1.0-pre.10 · NVIDIA/OpenShell
ci(e2e): run the Kubernetes HA and credential-driver suites on test:e
V0.1.0-pre.9: ci(release): publish prereleases with qualification summary (#3593)
Signed-off-by: Evan Lezar elezar@nvidia.com
Release v0.1.0-pre.8 · NVIDIA/OpenShell
fix(sandbox-backend): use String for CA cert/bundle in boundary proto
V0.1.0-pre.5: fix(server): serialize sandbox restart authentication (#3485)
Signed-off-by: Drew Newberry anewberry@nvidia.com
V0.1.0-pre.4: test(tmachine): verify SELinux in Fedora scenarios (#3457)
Closes #2973 Closes #2976 Signed-off-by: Simon Scatton sscatton@nvidia.com
V0.1.0-pre.3: fix(sandbox): pass declared environment to the initial process (#3392)
Apply the workload environment before stripping supervisor-only values and injecting provider placeholders in both canonical launch paths. The RFC 0012 bootstrap carries these values separately from inherited supervisor environment.
V0.1.0-pre.2: ci(release): advance seeded prereleases daily at Zurich time (#3239)
ci(release): advance seeded prereleases daily at Zurich time Signed-off-by: Simon Scatton sscatton@nvidia.com ci(release): schedule prereleases on weekdays Signed-off-by: Simon Scatton sscatton@nvidia.com Signed-off-by: Simon Scatton sscatton@nvidia.com