refactor(core): use upstream CDI name validation

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

.packit.yaml

@@ -27,8 +27,9 @@ actions:
     # Uses git ls-files + tar instead of git archive so the tarball
     # reflects any patching that Packit may have done (e.g. version bumps).
     - 'bash -c "VERSION=${PACKIT_PROJECT_VERSION} && TMPDIR=$(mktemp -d) && DIR=openshell-${VERSION} && mkdir -p ${TMPDIR}/${DIR} && git ls-files -z | xargs -0 tar cf - | tar xf - -C ${TMPDIR}/${DIR}/ && tar -czf openshell-${VERSION}.tar.gz -C ${TMPDIR} ${DIR} && rm -rf ${TMPDIR}"'
-    # Step 2: Create vendored Cargo dependencies tarball for offline RPM build.
-    - 'bash -c "VERSION=${PACKIT_PROJECT_VERSION} && CARGO_HTTP_TIMEOUT=600 CARGO_NET_RETRY=5 cargo vendor --locked --quiet && tar -cJf openshell-${VERSION}-vendor.tar.xz vendor/ && rm -rf vendor/"'
+    # Step 2: Preserve Cargo source mappings, including pinned Git dependencies,
+    # with the vendored dependencies for the offline RPM build.
+    - 'bash -c "VERSION=${PACKIT_PROJECT_VERSION} && CARGO_HTTP_TIMEOUT=600 CARGO_NET_RETRY=5 cargo vendor --locked > cargo-vendor-config.toml && tar -cJf openshell-${VERSION}-vendor.tar.xz vendor/ cargo-vendor-config.toml && rm -rf vendor/ cargo-vendor-config.toml"'
     # Step 3: Return the primary archive name. Packit expects create-archive
     # to print one path for Source0; Source1 is patched explicitly below.
     - 'bash -c "echo openshell-${PACKIT_PROJECT_VERSION}.tar.gz"'

Cargo.lock

@@ -84,6 +84,7 @@ rustix = { version = "1.1", features = ["process"] }
 socket2 = "0.6"
 
 # Serialization
+container-device-interface = { git = "https://github.com/cncf-tags/container-device-interface-rs", rev = "b3fec145b213afc4dfd6900c578edb42dc99e5df", default-features = false }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_path_to_error = "0.1"

Cargo.toml

@@ -46,6 +46,9 @@ openshell-otel = { path = "../openshell-otel", optional = true }
 nix = { workspace = true }
 rustix = { workspace = true }
 
+[target.'cfg(target_os = "linux")'.dependencies]
+container-device-interface = { workspace = true }
+
 [features]
 default = ["telemetry"]
 ## Compile in anonymous telemetry emission support. On by default; disable with

crates/openshell-core/Cargo.toml

@@ -0,0 +1,32 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Portable CDI name checking for non-Linux targets.
+
+/// Check `<vendor>/<class>=<name>` syntax without resolving or authorizing devices.
+/// Input is neither trimmed nor normalized.
+#[must_use]
+pub fn is_qualified_name(device: &str) -> bool {
+    let Some((kind, name)) = device.split_once('=') else {
+        return false;
+    };
+    let Some((vendor, class)) = kind.split_once('/') else {
+        return false;
+    };
+    let valid_component = |value: &str, device_name: bool| {
+        let bytes = value.as_bytes();
+        bytes.first().is_some_and(|byte| {
+            if device_name {
+                byte.is_ascii_alphanumeric()
+            } else {
+                byte.is_ascii_alphabetic()
+            }
+        }) && bytes.last().is_some_and(u8::is_ascii_alphanumeric)
+            && bytes.iter().all(|byte| {
+                byte.is_ascii_alphanumeric()
+                    || matches!(byte, b'_' | b'-' | b'.')
+                    || (device_name && *byte == b':')
+            })
+    };
+    valid_component(vendor, false) && valid_component(class, false) && valid_component(name, true)
+}

crates/openshell-core/src/cdi_name.rs

@@ -302,39 +302,15 @@ fn cdi_nvidia_gpu_suffix(id: &str) -> Option<&str> {
     id.strip_prefix(CDI_NVIDIA_GPU_PREFIX)
 }
 
-// Local equivalent of the upstream CDI parser until its public API is released:
-// https://github.com/cncf-tags/container-device-interface-rs/pull/177
-fn is_qualified_name(device: &str) -> bool {
-    let Some((kind, name)) = device.split_once('=') else {
-        return false;
-    };
-    let Some((vendor, class)) = kind.split_once('/') else {
-        return false;
-    };
-    let valid_component = |value: &str, device_name: bool| {
-        let bytes = value.as_bytes();
-        bytes.first().is_some_and(|byte| {
-            if device_name {
-                byte.is_ascii_alphanumeric()
-            } else {
-                byte.is_ascii_alphabetic()
-            }
-        }) && bytes.last().is_some_and(u8::is_ascii_alphanumeric)
-            && bytes.iter().all(|byte| {
-                byte.is_ascii_alphanumeric()
-                    || matches!(byte, b'_' | b'-' | b'.')
-                    || (device_name && *byte == b':')
-            })
-    };
-    valid_component(vendor, false) && valid_component(class, false) && valid_component(name, true)
-}
-
 /// Validate vendor-agnostic CDI qualified names without resolving or authorizing devices.
 ///
 /// # Errors
 /// Returns an error for host paths or malformed `<vendor>/<class>=<name>` selectors.
 pub fn validate_cdi_device_names(devices: &[String], field: &str) -> Result<(), String> {
-    if devices.iter().any(|device| !is_qualified_name(device)) {
+    if devices
+        .iter()
+        .any(|device| !crate::cdi_name::is_qualified_name(device))
+    {
         return Err(format!(
             "{field} must contain CDI qualified names (<vendor>/<class>=<name>)"
         ));

crates/openshell-core/src/gpu.rs

@@ -11,6 +11,12 @@
 
 pub mod activity;
 pub mod auth;
+#[cfg(target_os = "linux")]
+pub mod cdi_name {
+    pub use container_device_interface::parser::is_qualified_name;
+}
+#[cfg(not(target_os = "linux"))]
+pub mod cdi_name;
 pub mod config;
 pub mod container_paths;
 pub mod denial;

crates/openshell-core/src/lib.rs

@@ -69,4 +69,4 @@ external-default-features = "allow"
 unknown-registry = "deny"
 unknown-git = "deny"
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
-allow-git = []
+allow-git = ["https://github.com/cncf-tags/container-device-interface-rs"]