From 58af731a6c683907c8fa086d45f27b5393b1d4bb Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Tue, 1 Sep 2026 13:18:24 +0200 Subject: [PATCH 01/13] ci: add Fedora conformance workflow Signed-off-by: Simon Scatton --- .github/workflows/conformance.yml | 154 ++++++++++++++++++++++++++++++ 1 file changed, 154 insertions(+) create mode 100644 .github/workflows/conformance.yml diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml new file mode 100644 index 0000000000..2744884d10 --- /dev/null +++ b/.github/workflows/conformance.yml @@ -0,0 +1,154 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +name: Conformance + +on: + push: + branches: + - "pull-request/[0-9]+" + workflow_dispatch: {} + +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + pr_metadata: + name: Resolve PR metadata + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: read + outputs: + should_run: ${{ steps.gate.outputs.should_run }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - id: gate + uses: ./.github/actions/pr-gate + + version: + needs: pr_metadata + if: needs.pr_metadata.outputs.should_run == 'true' + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + outputs: + cargo: ${{ steps.version.outputs.cargo }} + rpm_version: ${{ steps.version.outputs.rpm_version }} + rpm_release: ${{ steps.version.outputs.rpm_release }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + + - name: Compute versions + id: version + run: | + cargo="$(python3 tasks/scripts/release.py get-version --cargo)" + rpm_version="$(python3 tasks/scripts/release.py get-version --rpm-version)" + rpm_release="$(python3 tasks/scripts/release.py get-version --rpm-release)" + { + echo "cargo=$cargo" + echo "rpm_version=$rpm_version" + echo "rpm_release=$rpm_release" + } >> "$GITHUB_OUTPUT" + + build-cli: + needs: version + permissions: + contents: read + uses: ./.github/workflows/build-cli-binaries.yml + with: + cargo-version: ${{ needs.version.outputs.cargo }} + checkout-ref: ${{ github.sha }} + secrets: inherit + + build-gateway: + needs: version + permissions: + contents: read + uses: ./.github/workflows/build-gateway-binaries.yml + with: + cargo-version: ${{ needs.version.outputs.cargo }} + checkout-ref: ${{ github.sha }} + secrets: inherit + + build-rpm: + needs: [version, build-cli, build-gateway] + permissions: + contents: read + uses: ./.github/workflows/rpm-package.yml + with: + checkout-ref: ${{ github.sha }} + cargo-version: ${{ needs.version.outputs.cargo }} + rpm-version: ${{ needs.version.outputs.rpm_version }} + rpm-release: ${{ needs.version.outputs.rpm_release }} + + fedora: + name: Fedora clean install + needs: build-rpm + runs-on: linux-amd64-cpu8 + timeout-minutes: 45 + permissions: + actions: read + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - uses: ./.github/actions/setup-nix + + - name: Download RPM artifacts + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: rpm-linux-x86_64 + path: rpm-input + + - name: Install RPMs and check status + shell: bash + run: | + set -euo pipefail + nix run .#test-guest -- \ + --distro fedora \ + --with podman \ + --with selinux \ + --install rpm-input/openshell-[0-9]*.rpm \ + --install rpm-input/openshell-gateway-[0-9]*.rpm \ + -- bash -s <<'EOF' + set -euo pipefail + + on_exit() { + rc=$? + trap - EXIT + if [ "$rc" -ne 0 ]; then + systemctl --user status openshell-gateway --no-pager || true + journalctl --user -u openshell-gateway --no-pager -n 200 || true + podman info || true + podman ps --all || true + getenforce || true + fi + exit "$rc" + } + trap on_exit EXIT + + . /etc/os-release + echo "Testing on $PRETTY_NAME" + podman --version + test "$(podman info --format '{{.Host.Security.Rootless}}')" = true + test "$(podman info --format '{{.Host.CgroupsVersion}}')" = v2 + test "$(getenforce)" = Enforcing + rpm -q openshell openshell-gateway + openshell --version + openshell-gateway --version + + mkdir -p "$HOME/.config/openshell" + echo 'OPENSHELL_TELEMETRY_ENABLED=false' > "$HOME/.config/openshell/gateway.env" + systemctl --user enable --now openshell-gateway + openshell gateway add --local https://127.0.0.1:17670 --name openshell + openshell status + EOF From 84a2a98285e3bc7ed5514d47f986d89d323aa5fd Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Tue, 1 Sep 2026 13:58:53 +0200 Subject: [PATCH 02/13] ci: enable KVM for Fedora conformance Signed-off-by: Simon Scatton --- .github/workflows/conformance.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 2744884d10..6b8eea0fa5 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -101,6 +101,8 @@ jobs: with: persist-credentials: false + - uses: ./.github/actions/setup-e2e-vm + - uses: ./.github/actions/setup-nix - name: Download RPM artifacts From 3beda719522c4f8dc405f38566155ff0fae1b5af Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Tue, 1 Sep 2026 14:14:15 +0200 Subject: [PATCH 03/13] ci: run Fedora conformance with KVM Signed-off-by: Simon Scatton --- .github/workflows/conformance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 6b8eea0fa5..040f01f45c 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -91,7 +91,7 @@ jobs: fedora: name: Fedora clean install needs: build-rpm - runs-on: linux-amd64-cpu8 + runs-on: ubuntu-24.04 timeout-minutes: 45 permissions: actions: read From 5d71e43298e6a8bd5deca255f110af03fd63c653 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Tue, 1 Sep 2026 14:33:41 +0200 Subject: [PATCH 04/13] ci: copy Fedora conformance script into guest Signed-off-by: Simon Scatton --- .github/workflows/conformance.yml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 040f01f45c..7a6db8e5cb 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -115,13 +115,8 @@ jobs: shell: bash run: | set -euo pipefail - nix run .#test-guest -- \ - --distro fedora \ - --with podman \ - --with selinux \ - --install rpm-input/openshell-[0-9]*.rpm \ - --install rpm-input/openshell-gateway-[0-9]*.rpm \ - -- bash -s <<'EOF' + guest_script="$RUNNER_TEMP/conformance.sh" + cat > "$guest_script" <<'EOF' set -euo pipefail on_exit() { @@ -154,3 +149,12 @@ jobs: openshell gateway add --local https://127.0.0.1:17670 --name openshell openshell status EOF + + nix run .#test-guest -- \ + --distro fedora \ + --with podman \ + --with selinux \ + --install rpm-input/openshell-[0-9]*.rpm \ + --install rpm-input/openshell-gateway-[0-9]*.rpm \ + --copy "$guest_script:/tmp/conformance.sh" \ + -- bash /tmp/conformance.sh From 112a255866d0466d484ea27311eabfafc2003747 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Tue, 1 Sep 2026 14:51:26 +0200 Subject: [PATCH 05/13] ci: limit conformance VM setup to KVM Signed-off-by: Simon Scatton --- .github/workflows/conformance.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 7a6db8e5cb..3035d8eda5 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -101,7 +101,16 @@ jobs: with: persist-credentials: false - - uses: ./.github/actions/setup-e2e-vm + - name: Enable KVM access + run: | + set -euo pipefail + if [[ ! -c /dev/kvm ]]; then + echo "::error::The runner did not expose /dev/kvm" + exit 1 + fi + sudo chmod 0666 /dev/kvm + exec 3<>/dev/kvm + exec 3>&- - uses: ./.github/actions/setup-nix From c9becba16efd913571129071e56dda6934b71113 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Tue, 1 Sep 2026 15:20:19 +0200 Subject: [PATCH 06/13] ci: streamline Fedora conformance builds Signed-off-by: Simon Scatton --- .github/workflows/build-rpm.yml | 115 ++++++++++++++++++++++++++++++ .github/workflows/conformance.yml | 60 +++++++++++----- .github/workflows/rpm-package.yml | 87 ++++------------------ .packit.yaml | 5 -- nix/test-guest/cache-seal.sh | 4 +- openshell.spec | 46 ++---------- 6 files changed, 179 insertions(+), 138 deletions(-) create mode 100644 .github/workflows/build-rpm.yml diff --git a/.github/workflows/build-rpm.yml b/.github/workflows/build-rpm.yml new file mode 100644 index 0000000000..88f03e7701 --- /dev/null +++ b/.github/workflows/build-rpm.yml @@ -0,0 +1,115 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +name: Build RPM + +on: + workflow_call: + inputs: + checkout-ref: + required: true + type: string + arch: + required: true + type: string + runner: + required: true + type: string + cli-target: + required: true + type: string + gateway-target: + required: true + type: string + rpm-version: + required: false + type: string + default: "" + rpm-release: + required: false + type: string + default: "" + cargo-version: + required: false + type: string + default: "" + +permissions: + contents: read + +defaults: + run: + shell: bash + +jobs: + build: + name: Build RPM Package (Linux ${{ inputs.arch }}) + runs-on: ${{ inputs.runner }} + timeout-minutes: 60 + container: + image: fedora:latest + steps: + - name: Install packaging dependencies + run: | + dnf install -y \ + packit rpm-build \ + cargo cargo-rpm-macros git-core \ + pandoc python3-devel systemd-rpm-macros + + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ inputs.checkout-ref }} + fetch-depth: 0 + + - name: Download CLI artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: openshell-${{ inputs.cli-target }} + path: package-binaries/ + + - name: Download gateway artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: openshell-gateway-${{ inputs.gateway-target }} + path: package-binaries/ + + - name: Configure package inputs + run: | + set -euo pipefail + chmod +x package-binaries/openshell{,-gateway} + ls -lah package-binaries + + - name: Mark workspace safe for git + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + + - name: Fetch tags + run: git fetch --tags --force + + - name: Build RPMs via Packit + env: + OPENSHELL_RPM_VERSION: ${{ inputs.rpm-version }} + OPENSHELL_RPM_RELEASE: ${{ inputs.rpm-release }} + OPENSHELL_CARGO_VERSION: ${{ inputs.cargo-version }} + OPENSHELL_PREBUILT_BINARIES_DIR: ${{ github.workspace }}/package-binaries + run: packit build locally + + - name: Collect RPM artifacts + run: | + set -euo pipefail + mkdir -p artifacts + mapfile -t rpms < <(find "$GITHUB_WORKSPACE" -maxdepth 3 -type f -name '*.rpm' ! -name '*.src.rpm' | sort) + if [ "${#rpms[@]}" -eq 0 ]; then + echo "::error::No RPM artifacts found under $GITHUB_WORKSPACE" + find "$GITHUB_WORKSPACE" -maxdepth 3 -type f | sort + exit 1 + fi + cp "${rpms[@]}" artifacts/ + echo "=== Built RPMs ===" + ls -lah artifacts/ + + - name: Upload RPM artifacts + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: rpm-linux-${{ inputs.arch }} + path: artifacts/*.rpm + retention-days: 5 diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 3035d8eda5..e984215cab 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -61,8 +61,28 @@ jobs: needs: version permissions: contents: read - uses: ./.github/workflows/build-cli-binaries.yml + uses: ./.github/workflows/build-binaries.yml with: + package: openshell-cli + binary: openshell + triple: x86_64-unknown-linux-musl + runner: linux-amd64-cpu8 + dev-shell: .#devShells.x86_64-linux.musl + cargo-version: ${{ needs.version.outputs.cargo }} + checkout-ref: ${{ github.sha }} + secrets: inherit + + build-conformance: + needs: version + permissions: + contents: read + uses: ./.github/workflows/build-binaries.yml + with: + package: openshell-conformance-cli + binary: openshell-conformance + triple: x86_64-unknown-linux-musl + runner: linux-amd64-cpu8 + dev-shell: .#devShells.x86_64-linux.musl cargo-version: ${{ needs.version.outputs.cargo }} checkout-ref: ${{ github.sha }} secrets: inherit @@ -71,9 +91,15 @@ jobs: needs: version permissions: contents: read - uses: ./.github/workflows/build-gateway-binaries.yml + uses: ./.github/workflows/build-binaries.yml with: + package: openshell-server + binary: openshell-gateway + triple: x86_64-unknown-linux-gnu + runner: linux-amd64-cpu8 + dev-shell: .#devShells.x86_64-linux.glibc-2-28 cargo-version: ${{ needs.version.outputs.cargo }} + interpreter: /lib64/ld-linux-x86-64.so.2 checkout-ref: ${{ github.sha }} secrets: inherit @@ -81,16 +107,20 @@ jobs: needs: [version, build-cli, build-gateway] permissions: contents: read - uses: ./.github/workflows/rpm-package.yml + uses: ./.github/workflows/build-rpm.yml with: checkout-ref: ${{ github.sha }} + arch: x86_64 + runner: linux-amd64-cpu8 + cli-target: x86_64-unknown-linux-musl + gateway-target: x86_64-unknown-linux-gnu cargo-version: ${{ needs.version.outputs.cargo }} rpm-version: ${{ needs.version.outputs.rpm_version }} rpm-release: ${{ needs.version.outputs.rpm_release }} fedora: name: Fedora clean install - needs: build-rpm + needs: [build-conformance, build-rpm] runs-on: ubuntu-24.04 timeout-minutes: 45 permissions: @@ -120,10 +150,17 @@ jobs: name: rpm-linux-x86_64 path: rpm-input + - name: Download conformance CLI + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: openshell-conformance-x86_64-unknown-linux-musl + path: conformance-input + - name: Install RPMs and check status shell: bash run: | set -euo pipefail + chmod +x conformance-input/openshell-conformance guest_script="$RUNNER_TEMP/conformance.sh" cat > "$guest_script" <<'EOF' set -euo pipefail @@ -142,28 +179,19 @@ jobs: } trap on_exit EXIT - . /etc/os-release - echo "Testing on $PRETTY_NAME" - podman --version - test "$(podman info --format '{{.Host.Security.Rootless}}')" = true - test "$(podman info --format '{{.Host.CgroupsVersion}}')" = v2 - test "$(getenforce)" = Enforcing - rpm -q openshell openshell-gateway - openshell --version - openshell-gateway --version - mkdir -p "$HOME/.config/openshell" echo 'OPENSHELL_TELEMETRY_ENABLED=false' > "$HOME/.config/openshell/gateway.env" systemctl --user enable --now openshell-gateway openshell gateway add --local https://127.0.0.1:17670 --name openshell - openshell status + /tmp/openshell-conformance run smoke EOF - nix run .#test-guest -- \ + OPENSHELL_TEST_GUEST_CACHE_DISABLE=1 nix run .#test-guest -- \ --distro fedora \ --with podman \ --with selinux \ --install rpm-input/openshell-[0-9]*.rpm \ --install rpm-input/openshell-gateway-[0-9]*.rpm \ --copy "$guest_script:/tmp/conformance.sh" \ + --copy conformance-input/openshell-conformance:/tmp/openshell-conformance \ -- bash /tmp/conformance.sh diff --git a/.github/workflows/rpm-package.yml b/.github/workflows/rpm-package.yml index 8701644585..5cda9a88c3 100644 --- a/.github/workflows/rpm-package.yml +++ b/.github/workflows/rpm-package.yml @@ -37,83 +37,20 @@ jobs: matrix: include: - arch: x86_64 - artifact_arch: amd64 runner: linux-amd64-cpu8 cli_target: x86_64-unknown-linux-musl - gnu_target: x86_64-unknown-linux-gnu + gateway_target: x86_64-unknown-linux-gnu - arch: aarch64 - artifact_arch: arm64 runner: linux-arm64-cpu8 cli_target: aarch64-unknown-linux-musl - gnu_target: aarch64-unknown-linux-gnu - runs-on: ${{ matrix.runner }} - timeout-minutes: 60 - container: - image: fedora:latest - steps: - - name: Install build dependencies - run: | - dnf install -y \ - packit rpm-build \ - rust cargo gcc gcc-c++ make cmake pkg-config \ - clang-devel z3-devel systemd-rpm-macros \ - pandoc python3-devel git-core \ - cargo-rpm-macros - - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - ref: ${{ inputs.checkout-ref }} - fetch-depth: 0 - - - name: Download CLI artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - with: - name: openshell-${{ matrix.cli_target }} - path: package-binaries/ - - - name: Download gateway artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - with: - name: openshell-gateway-${{ matrix.gnu_target }} - path: package-binaries/ - - - name: Configure package inputs - run: | - set -euo pipefail - chmod +x package-binaries/openshell{,-gateway} - ls -lah package-binaries - - - name: Mark workspace safe for git - run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - - - name: Fetch tags - run: git fetch --tags --force - - - name: Build RPMs via Packit - env: - OPENSHELL_RPM_VERSION: ${{ inputs['rpm-version'] }} - OPENSHELL_RPM_RELEASE: ${{ inputs['rpm-release'] }} - OPENSHELL_CARGO_VERSION: ${{ inputs['cargo-version'] }} - OPENSHELL_PREBUILT_BINARIES_DIR: ${{ github.workspace }}/package-binaries - run: packit build locally - - - name: Collect RPM artifacts - run: | - set -euo pipefail - mkdir -p artifacts - mapfile -t rpms < <(find "$GITHUB_WORKSPACE" -maxdepth 3 -type f -name '*.rpm' ! -name '*.src.rpm' | sort) - if [ "${#rpms[@]}" -eq 0 ]; then - echo "::error::No RPM artifacts found under $GITHUB_WORKSPACE" - find "$GITHUB_WORKSPACE" -maxdepth 3 -type f | sort - exit 1 - fi - cp "${rpms[@]}" artifacts/ - echo "=== Built RPMs ===" - ls -lah artifacts/ - - - name: Upload RPM artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 - with: - name: rpm-linux-${{ matrix.arch }} - path: artifacts/*.rpm - retention-days: 5 + gateway_target: aarch64-unknown-linux-gnu + uses: ./.github/workflows/build-rpm.yml + with: + checkout-ref: ${{ inputs.checkout-ref }} + arch: ${{ matrix.arch }} + runner: ${{ matrix.runner }} + cli-target: ${{ matrix.cli_target }} + gateway-target: ${{ matrix.gateway_target }} + rpm-version: ${{ inputs.rpm-version }} + rpm-release: ${{ inputs.rpm-release }} + cargo-version: ${{ inputs.cargo-version }} diff --git a/.packit.yaml b/.packit.yaml index 6379d8db83..d3b92eafae 100644 --- a/.packit.yaml +++ b/.packit.yaml @@ -11,7 +11,6 @@ specfile_path: openshell.spec # Packages needed in the SRPM build environment to create vendor tarball srpm_build_deps: - - rust - cargo - git-core @@ -45,10 +44,6 @@ actions: # dist-info stays at the RPM Version; dev build identity is carried by # Release so Fedora's Python RPM post-processing can normalize metadata. - 'bash -c "if [ -n \"${OPENSHELL_CARGO_VERSION:-}\" ]; then sed -i -r \"s/^%global openshell_cargo_version .*/%global openshell_cargo_version ${OPENSHELL_CARGO_VERSION}/\" openshell.spec; fi"' - # Override image_tag to 'latest' for tagged stable releases. - # For PR and commit-to-main builds the spec default ('dev') is kept, - # matching the :dev images pushed by release-dev.yml. - - 'bash -c "if git describe --exact-match --tags HEAD 2>/dev/null | grep -qE ''^v[0-9]+\.[0-9]+\.[0-9]+$''; then sed -i ''s/^%global image_tag.*/%global image_tag latest/'' openshell.spec; fi"' jobs: # Build on every pull request targeting main for CI validation diff --git a/nix/test-guest/cache-seal.sh b/nix/test-guest/cache-seal.sh index 9f0da8564d..04cf8dfc0c 100755 --- a/nix/test-guest/cache-seal.sh +++ b/nix/test-guest/cache-seal.sh @@ -49,7 +49,9 @@ sync # Deleted credentials can remain in allocated blocks. Fill free space with # zeroes so qemu-img convert can safely omit those blocks from the cache disk. zero_file=/var/tmp/openshell-cache-zero -dd if=/dev/zero of="${zero_file}" bs=64M status=none 2>/dev/null || true +echo "==> Cache sealing: zeroing free disk space" +dd if=/dev/zero of="${zero_file}" bs=64M status=progress || true +echo "==> Cache sealing: free disk space zeroed" rm -f "${zero_file}" sync diff --git a/openshell.spec b/openshell.spec index 3200659d73..ac57d29ee9 100644 --- a/openshell.spec +++ b/openshell.spec @@ -12,12 +12,6 @@ # in the format redhat-rpm-config expects (especially on EPEL). %global debug_package %{nil} -# Default container image tag for supervisor and sandbox images. -# Overridden to 'latest' by Packit's fix-spec-file action for tagged stable -# releases (via git describe --exact-match). PR and commit-to-main builds -# keep the default 'dev' so they track the development image stream. -%global image_tag dev - Name: openshell Version: %{openshell_version} Release: 1.20260518180028805757.podman.toml.gateway.listener.11.g8c0cb7c8%{?dist} @@ -30,21 +24,9 @@ Source1: openshell-%{openshell_version}-vendor.tar.xz ExclusiveArch: x86_64 aarch64 -# Rust build dependencies -# NOTE: MSRV is 1.88 (Rust edition 2024). As of mid-2025, this requires -# Fedora Rawhide or newer. Stable Fedora and EPEL-10 may ship older Rust; -# adjust targets in .packit.yaml accordingly or provide a supplementary -# Rust toolchain via additional_repos in the COPR build config. -BuildRequires: rust >= 1.88 +# Cargo metadata generation BuildRequires: cargo BuildRequires: cargo-rpm-macros >= 25 -BuildRequires: gcc -BuildRequires: gcc-c++ -BuildRequires: make -BuildRequires: cmake -BuildRequires: pkg-config -BuildRequires: clang-devel -BuildRequires: z3-devel BuildRequires: systemd-rpm-macros # Man page generation @@ -103,18 +85,8 @@ sed -i 's/^version = "0.0.0"/version = "%{openshell_cargo_version}"/' Cargo.toml grep -q 'version = "%{openshell_cargo_version}"' Cargo.toml || (echo "ERROR: Cargo.toml version patch failed" && exit 1) %build -# Build the CLI and gateway binaries unless the release workflow supplied the -# same prebuilt artifacts used for tarballs and Debian packages. -export CARGO_BUILD_JOBS=%{_smp_build_ncpus} -# Set the default container image tag so compiled-in image refs point at -# real tags in the ghcr.io/nvidia/openshell registry. -export OPENSHELL_IMAGE_TAG=%{image_tag} -if [ -n "${OPENSHELL_PREBUILT_BINARIES_DIR:-}" ]; then - test -x "${OPENSHELL_PREBUILT_BINARIES_DIR}/openshell" - test -x "${OPENSHELL_PREBUILT_BINARIES_DIR}/openshell-gateway" -else - cargo build --release --bin openshell --bin openshell-gateway -fi +test -x "${OPENSHELL_PREBUILT_BINARIES_DIR}/openshell" +test -x "${OPENSHELL_PREBUILT_BINARIES_DIR}/openshell-gateway" # Generate vendored crate manifest and license metadata. # cargo-vendor.txt is consumed by an RPM generator (from cargo-rpm-macros) @@ -129,18 +101,10 @@ pandoc -s -t man deploy/man/openshell-gateway.8.md -o openshell-gateway.8 %install # --- CLI binary --- -if [ -n "${OPENSHELL_PREBUILT_BINARIES_DIR:-}" ]; then - install -Dpm 0755 "${OPENSHELL_PREBUILT_BINARIES_DIR}/%{name}" %{buildroot}%{_bindir}/%{name} -else - install -Dpm 0755 target/release/%{name} %{buildroot}%{_bindir}/%{name} -fi +install -Dpm 0755 "${OPENSHELL_PREBUILT_BINARIES_DIR}/%{name}" %{buildroot}%{_bindir}/%{name} # --- Gateway binary --- -if [ -n "${OPENSHELL_PREBUILT_BINARIES_DIR:-}" ]; then - install -Dpm 0755 "${OPENSHELL_PREBUILT_BINARIES_DIR}/%{name}-gateway" %{buildroot}%{_bindir}/%{name}-gateway -else - install -Dpm 0755 target/release/%{name}-gateway %{buildroot}%{_bindir}/%{name}-gateway -fi +install -Dpm 0755 "${OPENSHELL_PREBUILT_BINARIES_DIR}/%{name}-gateway" %{buildroot}%{_bindir}/%{name}-gateway # --- Default gateway TOML config template --- # Shipped as a read-only reference in %{_datadir}. The systemd unit seeds a From f0b237cdd62fd96b3bc82a0a96d942219001b1d8 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Tue, 1 Sep 2026 17:07:24 +0200 Subject: [PATCH 07/13] ci: use dev supervisor for Fedora conformance Signed-off-by: Simon Scatton --- .github/workflows/conformance.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index e984215cab..c389f1e536 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -99,6 +99,7 @@ jobs: runner: linux-amd64-cpu8 dev-shell: .#devShells.x86_64-linux.glibc-2-28 cargo-version: ${{ needs.version.outputs.cargo }} + image-tag: dev interpreter: /lib64/ld-linux-x86-64.so.2 checkout-ref: ${{ github.sha }} secrets: inherit From 58ede2a4b9306cbf70ccf23b444ff090f21dd1d9 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Wed, 2 Sep 2026 11:42:06 +0200 Subject: [PATCH 08/13] ci: pin Fedora RPM build image Signed-off-by: Simon Scatton --- .github/workflows/build-rpm.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-rpm.yml b/.github/workflows/build-rpm.yml index 88f03e7701..d0f6e7348a 100644 --- a/.github/workflows/build-rpm.yml +++ b/.github/workflows/build-rpm.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ inputs.runner }} timeout-minutes: 60 container: - image: fedora:latest + image: docker.io/library/fedora:44@sha256:be9d65e2344d805cc11114319c685ecaa96b6d9b4350a0a6460cdb931babbd19 steps: - name: Install packaging dependencies run: | From cb0fa14045958b0eb6b91a58328b8893135b0b6d Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Wed, 2 Sep 2026 11:43:49 +0200 Subject: [PATCH 09/13] ci: cache RPM vendoring dependencies Signed-off-by: Simon Scatton --- .github/workflows/build-rpm.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/build-rpm.yml b/.github/workflows/build-rpm.yml index d0f6e7348a..f35e1e0b4d 100644 --- a/.github/workflows/build-rpm.yml +++ b/.github/workflows/build-rpm.yml @@ -61,6 +61,14 @@ jobs: ref: ${{ inputs.checkout-ref }} fetch-depth: 0 + - name: Cache Cargo dependencies + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + with: + shared-key: rpm-vendor-${{ inputs.arch }} + cache-targets: "false" + cache-bin: "false" + cache-on-failure: "true" + - name: Download CLI artifact uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: From a62bcc41ae25de6af2ae9e45789a76e011b2853c Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Wed, 2 Sep 2026 11:46:54 +0200 Subject: [PATCH 10/13] ci: clarify Fedora conformance job name Signed-off-by: Simon Scatton --- .github/workflows/conformance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index c389f1e536..9e3606cd64 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -120,7 +120,7 @@ jobs: rpm-release: ${{ needs.version.outputs.rpm_release }} fedora: - name: Fedora clean install + name: Fedora with Rootless Podman needs: [build-conformance, build-rpm] runs-on: ubuntu-24.04 timeout-minutes: 45 From 6ebcbf97ed827828fc79ba8159a2c90c5bc2b3ad Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Wed, 2 Sep 2026 12:06:49 +0200 Subject: [PATCH 11/13] ci: make conformance workflow manual only Signed-off-by: Simon Scatton --- .github/workflows/conformance.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 9e3606cd64..1daade2de9 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -4,9 +4,6 @@ name: Conformance on: - push: - branches: - - "pull-request/[0-9]+" workflow_dispatch: {} permissions: {} From 8681479c9c75c212f558fa88ffcd2c7d809c9e50 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Wed, 2 Sep 2026 12:18:42 +0200 Subject: [PATCH 12/13] ci(conformance): use new podman rootless install --- .github/workflows/conformance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 1daade2de9..df6dfa34e2 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -186,7 +186,7 @@ jobs: OPENSHELL_TEST_GUEST_CACHE_DISABLE=1 nix run .#test-guest -- \ --distro fedora \ - --with podman \ + --with podman-rootless \ --with selinux \ --install rpm-input/openshell-[0-9]*.rpm \ --install rpm-input/openshell-gateway-[0-9]*.rpm \ From afc6202f78d9caffa936319e00b7b66b4debad59 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Wed, 2 Sep 2026 13:42:01 +0200 Subject: [PATCH 13/13] fix(ci): build gateway from renamed package Signed-off-by: Simon Scatton --- .github/workflows/conformance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index df6dfa34e2..bae9e3d326 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -90,7 +90,7 @@ jobs: contents: read uses: ./.github/workflows/build-binaries.yml with: - package: openshell-server + package: openshell-gateway binary: openshell-gateway triple: x86_64-unknown-linux-gnu runner: linux-amd64-cpu8