From e75fc86244b84aa129bc208a016528696bb8b18f Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Wed, 21 Oct 2026 17:01:48 +0200 Subject: [PATCH 1/4] fix(deps): refresh toolchains and container trust stores Signed-off-by: Adrien Langou --- .../skills/launch-openshell-gator/SKILL.md | 3 +- .github/workflows/branch-docs.yml | 2 +- .github/workflows/e2e-docker-test.yml | 3 + .github/workflows/release-dev.yml | 8 ++ .github/workflows/release.yml | 2 +- .github/workflows/sync-docs.yml | 2 +- deploy/docker/Dockerfile.ci | 1 + deploy/docker/Dockerfile.gateway | 2 +- deploy/docker/Dockerfile.supervisor | 2 +- docs/sdk/go.mdx | 5 +- docs/security/verify-image-contents.mdx | 6 ++ .../Dockerfile.external-kubernetes-gateway | 2 +- e2e/mcp-conformance/Dockerfile.client | 3 +- e2e/python/Dockerfile.workload | 2 +- e2e/rust/src/harness/sandbox.rs | 2 +- flake.lock | 6 +- mise.lock | 76 +++++++++---------- mise.toml | 6 +- scripts/agents/gator/Dockerfile | 17 +++-- sdk/go/README.md | 2 +- sdk/go/docs/src/getting-started.md | 2 +- sdk/go/go.mod | 2 +- sdk/go/mise.toml | 2 +- skills/debug-openshell-cluster/SKILL.md | 11 ++- 24 files changed, 99 insertions(+), 70 deletions(-) diff --git a/.agents/skills/launch-openshell-gator/SKILL.md b/.agents/skills/launch-openshell-gator/SKILL.md index 85553a4f01..9d692017f0 100644 --- a/.agents/skills/launch-openshell-gator/SKILL.md +++ b/.agents/skills/launch-openshell-gator/SKILL.md @@ -371,7 +371,8 @@ Symptoms: Dockerfile step failure, missing package, incompatible Codex CLI, regi Actions: - Confirm the build context is `scripts/agents/gator/` or the intended temporary `--from` context. -- Confirm Docker or the selected gateway runtime can pull `nvcr.io/nvidia/base/ubuntu:noble-20251013`. +- Confirm Docker or the selected gateway runtime can pull the pinned Ubuntu and Node.js images. +- The Dockerfile copies Node.js from its pinned official image into `/usr`, keeping npm packages under `/usr/lib/node_modules`. - For Codex CLI version experiments, adjust a temporary Docker context first. - Do not commit Dockerfile version changes unless the repo should permanently use that version. diff --git a/.github/workflows/branch-docs.yml b/.github/workflows/branch-docs.yml index b6ad5efeea..03983cc9a5 100644 --- a/.github/workflows/branch-docs.yml +++ b/.github/workflows/branch-docs.yml @@ -56,7 +56,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0 with: - version: "0.10.12" + version: "0.13.4" python-version: "3.13" - name: Test docs navigation check diff --git a/.github/workflows/e2e-docker-test.yml b/.github/workflows/e2e-docker-test.yml index 96353688b8..427f5d3fc2 100644 --- a/.github/workflows/e2e-docker-test.yml +++ b/.github/workflows/e2e-docker-test.yml @@ -100,6 +100,9 @@ jobs: - name: Log in to GHCR run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin + - name: Install pinned uv + run: mise install --locked uv + - name: Install Python dependencies and generate protobuf stubs if: matrix.python_proto run: uv sync --frozen && mise run --no-deps python:proto diff --git a/.github/workflows/release-dev.yml b/.github/workflows/release-dev.yml index aec77972ee..f15711cbc7 100644 --- a/.github/workflows/release-dev.yml +++ b/.github/workflows/release-dev.yml @@ -45,6 +45,11 @@ jobs: - name: Fetch tags run: git fetch --tags --force + - name: Install pinned uv + env: + MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: mise install --locked uv + - name: Compute all versions id: v run: | @@ -220,6 +225,9 @@ jobs: - name: Mark workspace safe for git run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Install pinned uv + run: mise install --locked uv + - name: Sync Python dependencies run: uv sync diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 05f07f19ca..059de77c67 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -63,7 +63,7 @@ jobs: - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: - version: "0.10.12" + version: "0.13.4" python-version: "3.13" - name: Select candidate and verify qualification evidence diff --git a/.github/workflows/sync-docs.yml b/.github/workflows/sync-docs.yml index f5e6303dd3..1f1266f3e4 100644 --- a/.github/workflows/sync-docs.yml +++ b/.github/workflows/sync-docs.yml @@ -163,7 +163,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: - version: "0.10.12" + version: "0.13.4" python-version: "3.13" - name: Update docs snapshot diff --git a/deploy/docker/Dockerfile.ci b/deploy/docker/Dockerfile.ci index 9bfc72420d..17232a7051 100644 --- a/deploy/docker/Dockerfile.ci +++ b/deploy/docker/Dockerfile.ci @@ -41,6 +41,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ rsync \ zstd \ && apt-get install -y --only-upgrade gpgv python3 \ + && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20260816ubuntu0.24.04.1 \ && rm -rf /var/lib/apt/lists/* # Install Docker CLI and buildx plugin used by CI jobs diff --git a/deploy/docker/Dockerfile.gateway b/deploy/docker/Dockerfile.gateway index 413605617a..ed96d754cc 100644 --- a/deploy/docker/Dockerfile.gateway +++ b/deploy/docker/Dockerfile.gateway @@ -8,7 +8,7 @@ # # Distroless Debian provides the glibc runtime required by the binary. -ARG GATEWAY_BASE_IMAGE=gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 +ARG GATEWAY_BASE_IMAGE=gcr.io/distroless/cc-debian13:nonroot@sha256:b7e81cb1af38d9345680e68bcf564d388f96304e25222030fc8c051faf8565b3 FROM ${GATEWAY_BASE_IMAGE} AS gateway ARG TARGETARCH diff --git a/deploy/docker/Dockerfile.supervisor b/deploy/docker/Dockerfile.supervisor index e0483d5094..fa8615b45c 100644 --- a/deploy/docker/Dockerfile.supervisor +++ b/deploy/docker/Dockerfile.supervisor @@ -8,7 +8,7 @@ # Keep the GNU runtime and CA roots without a shell or unused native TLS libraries. # The default variant preserves UID 0 and /; compute drivers set the runtime UID. -ARG SUPERVISOR_BASE_IMAGE=gcr.io/distroless/base-nossl-debian13@sha256:af5cb8dd589b8520b8c06bebb9efb73d7e16406cab58e85c51761fff49d370a0 +ARG SUPERVISOR_BASE_IMAGE=gcr.io/distroless/base-nossl-debian13@sha256:5ed6ba458b0e71eb06dba4395bfc9a86a8b914a858fea139fd45f92cf88c79d0 FROM ${SUPERVISOR_BASE_IMAGE} AS supervisor ARG TARGETARCH diff --git a/docs/sdk/go.mdx b/docs/sdk/go.mdx index 86a011e00d..91f8578d5c 100644 --- a/docs/sdk/go.mdx +++ b/docs/sdk/go.mdx @@ -14,7 +14,10 @@ patterns. Use the SDK and gateway from the same OpenShell release when possible. ## Install the SDK -The SDK requires Go 1.25.13 or later. Add it to your Go module: +The SDK requires Go 1.26.10 or later. On Go 1.27, use at least 1.27.3. +Rebuild existing SDK applications after upgrading Go. + +Add it to your Go module: ```shell go get github.com/NVIDIA/OpenShell/sdk/go@latest diff --git a/docs/security/verify-image-contents.mdx b/docs/security/verify-image-contents.mdx index 86273a4762..630387de6e 100644 --- a/docs/security/verify-image-contents.mdx +++ b/docs/security/verify-image-contents.mdx @@ -35,6 +35,12 @@ The same commands work for `ghcr.io/nvidia/openshell/supervisor`. Every SBOM lists the base-image packages. Release Dev, Release, and Pre-release images also list the Rust crates compiled into their OpenShell binary. +CA trust-store fixes can change a certificate bundle without changing the +package version reported in the SBOM. Verify the certificate bundle from the +deployed image as well. Updating a binary does not replace the system trust +store in gateway, supervisor, or workload images; rebuild and redeploy those +images to apply trust-store fixes. + OpenShell also publishes minimal SLSA provenance. It records how BuildKit produced the image, including its source revision, build platform, and base-image materials, without the extra build parameters included by full provenance. diff --git a/e2e/docker/Dockerfile.external-kubernetes-gateway b/e2e/docker/Dockerfile.external-kubernetes-gateway index ffa1072bb7..378e479a3b 100644 --- a/e2e/docker/Dockerfile.external-kubernetes-gateway +++ b/e2e/docker/Dockerfile.external-kubernetes-gateway @@ -3,7 +3,7 @@ # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 -ARG GATEWAY_BASE_IMAGE=gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775 +ARG GATEWAY_BASE_IMAGE=gcr.io/distroless/cc-debian13:nonroot@sha256:b7e81cb1af38d9345680e68bcf564d388f96304e25222030fc8c051faf8565b3 FROM ${GATEWAY_BASE_IMAGE} ARG TARGETARCH diff --git a/e2e/mcp-conformance/Dockerfile.client b/e2e/mcp-conformance/Dockerfile.client index e40e23df52..1d8a68492f 100644 --- a/e2e/mcp-conformance/Dockerfile.client +++ b/e2e/mcp-conformance/Dockerfile.client @@ -1,10 +1,11 @@ # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 -FROM public.ecr.aws/docker/library/node:22-bookworm-slim +FROM public.ecr.aws/docker/library/node:22.23.4-bookworm-slim@sha256:5991875dfb80938dd8a6ba3fe3e96fd04929e70792762b3319d8caadbbe229bc RUN apt-get update \ && apt-get install -y --no-install-recommends ca-certificates iproute2 \ + && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419~deb12u2 \ && rm -rf /var/lib/apt/lists/* ARG SANDBOX_UID=1000660000 diff --git a/e2e/python/Dockerfile.workload b/e2e/python/Dockerfile.workload index f25c05d7cf..1ff177b0b0 100644 --- a/e2e/python/Dockerfile.workload +++ b/e2e/python/Dockerfile.workload @@ -2,7 +2,7 @@ # SPDX-License-Identifier: Apache-2.0 ARG WORKLOAD_BASE=nvcr.io/nvidia/base/ubuntu:24.04 -FROM ghcr.io/astral-sh/uv:0.12.17@sha256:10787c682e4184e4f290de1171fd4703dc63de99221f10fe1c99002ce7fa9acc AS uv +FROM ghcr.io/astral-sh/uv:0.13.4@sha256:9f130421e930bfbdc563c00740466603f8723158e90297d07957c2294640262b AS uv FROM ${WORKLOAD_BASE} COPY --from=uv /uv /uvx /usr/local/bin/ diff --git a/e2e/rust/src/harness/sandbox.rs b/e2e/rust/src/harness/sandbox.rs index 0d6ff621dd..f706ab202b 100644 --- a/e2e/rust/src/harness/sandbox.rs +++ b/e2e/rust/src/harness/sandbox.rs @@ -29,7 +29,7 @@ pub const E2E_WORKLOAD_IMAGE: &str = "openshell/e2e-python:dev"; /// Preserve the existing pullable fixture for E2E lanes that cannot build the /// local container-engine fixture. #[cfg(not(any(feature = "e2e-docker", feature = "e2e-podman")))] -pub const E2E_WORKLOAD_IMAGE: &str = "ghcr.io/astral-sh/uv:0.12.17-python3.12-trixie-slim@sha256:9a59bb7206905ccaae4f7dab222fbac47c125a21e5fc16f43f427cd6c940ade3"; +pub const E2E_WORKLOAD_IMAGE: &str = "ghcr.io/astral-sh/uv:0.13.4-python3.12-trixie-slim@sha256:0d42b7b065ada5139af940bf3fb178b926675450e786badc854c9f73736cc6c4"; /// Extract the sandbox name from CLI create output. /// diff --git a/flake.lock b/flake.lock index b5861792ac..db9624c4dd 100644 --- a/flake.lock +++ b/flake.lock @@ -20,11 +20,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1787135253, - "narHash": "sha256-RD2kNWCG+Bjo6h+JVjWVNntZs2GtRoeY2xHjts/FNkA=", + "lastModified": 1792514193, + "narHash": "sha256-q8qbDVZy0GmabhCOnQTqFVho1hgJd85GePju462d7mc=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "ffb3c9b700e759be2ef13237c9d8f953b32a1e46", + "rev": "7bfe60fe75d8c7171b95e6ec2d610d4778cc549b", "type": "github" }, "original": { diff --git a/mise.lock b/mise.lock index ec8cccf089..6627f54511 100644 --- a/mise.lock +++ b/mise.lock @@ -260,28 +260,28 @@ url = "https://github.com/rust-secure-code/cargo-auditable/releases/download/v0. url_api = "https://api.github.com/repos/rust-secure-code/cargo-auditable/releases/assets/426566657" [[tools.go]] -version = "1.26.7" +version = "1.26.10" backend = "core:go" [tools.go."platforms.linux-arm64"] -checksum = "sha256:5a4ec883379d51ee9ce1040d5e87f8d35e20387574dd8c947feb01eabc3c1b37" -url = "https://dl.google.com/go/go1.26.7.linux-arm64.tar.gz" +checksum = "sha256:3f4227ce7b206a513e794f1393adb473a07b46e94d18bd15d1c684bbb7319797" +url = "https://dl.google.com/go/go1.26.10.linux-arm64.tar.gz" [tools.go."platforms.linux-x64"] -checksum = "sha256:ffb5f8de10c62550dfddab66b36b57030721e0a44a3218e9e1181d7b59f121ca" -url = "https://dl.google.com/go/go1.26.7.linux-amd64.tar.gz" +checksum = "sha256:ccfe7ae822d2c2f41f4fe7c956199967a4dac22d0ee0d2b2bfdb440aab3b20c5" +url = "https://dl.google.com/go/go1.26.10.linux-amd64.tar.gz" [tools.go."platforms.macos-arm64"] -checksum = "sha256:020a1e8224811be75163e920bc77e0926a1390a6aeea19bdcf23f74b9d749f6d" -url = "https://dl.google.com/go/go1.26.7.darwin-arm64.tar.gz" +checksum = "sha256:0b5183492292ada170f9b561a834863808dd02edba599e4ad0e89899330020b3" +url = "https://dl.google.com/go/go1.26.10.darwin-arm64.tar.gz" [tools.go."platforms.windows-arm64"] -checksum = "sha256:6f1b08de9e2dd94f69c52e524ab6834737275253291e8fd7f1c12ed4eceeda89" -url = "https://dl.google.com/go/go1.26.7.windows-arm64.zip" +checksum = "sha256:6831fd8c31091243d5695c8fa3a721c9f4ae2bb36482763e77e57ee01b76489f" +url = "https://dl.google.com/go/go1.26.10.windows-arm64.zip" [tools.go."platforms.windows-x64"] -checksum = "sha256:f4f534a486e4bc3387fa18f08208f2f854b7aaea8a08f2a2d829a914a05abb11" -url = "https://dl.google.com/go/go1.26.7.windows-amd64.zip" +checksum = "sha256:7ecd2d7260e82c59bcbd7f1077a07cee2dea607295b858df67195a1e4e09629b" +url = "https://dl.google.com/go/go1.26.10.windows-amd64.zip" [[tools."go:github.com/golangci/golangci-lint/v2/cmd/golangci-lint"]] version = "2.12.2" @@ -412,28 +412,28 @@ checksum = "sha256:538f4229eee91a17b34724da7daade7687393d6988e33b723c6c306572c13 url = "https://dl.k8s.io/v1.36.1/bin/windows/amd64/kubectl.exe" [[tools.node]] -version = "24.15.0" +version = "24.22.1" backend = "core:node" [tools.node."platforms.linux-arm64"] -checksum = "sha256:73afc234d558c24919875f51c2d1ea002a2ada4ea6f83601a383869fefa64eed" -url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-arm64.tar.gz" +checksum = "sha256:33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-arm64.tar.gz" [tools.node."platforms.linux-x64"] -checksum = "sha256:44836872d9aec49f1e6b52a9a922872db9a2b02d235a616a5681b6a85fec8d89" -url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-x64.tar.gz" +checksum = "sha256:eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.gz" [tools.node."platforms.macos-arm64"] -checksum = "sha256:372331b969779ab5d15b949884fc6eaf88d5afe87bde8ba881d6400b9100ffc4" -url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-darwin-arm64.tar.gz" +checksum = "sha256:89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-darwin-arm64.tar.gz" [tools.node."platforms.windows-arm64"] -checksum = "sha256:c9eb7402eda26e2ba7e44b6727fc85a8de56c5095b1f71ebd3062892211aa116" -url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-win-arm64.zip" +checksum = "sha256:a0c807319fede24c4a0d8f84564c82a619bd313b16b10c007c383c2609e99171" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-win-arm64.zip" [tools.node."platforms.windows-x64"] -checksum = "sha256:cc5149eabd53779ce1e7bdc5401643622d0c7e6800ade18928a767e940bb0e62" -url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-win-x64.zip" +checksum = "sha256:d2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-win-x64.zip" [[tools."npm:markdownlint-cli2"]] version = "0.22.0" @@ -531,37 +531,37 @@ checksum = "sha256:a257da2988782b4c1971bb58b9c7bb52176f8a0b587b6520dec0064f271fa url = "https://storage.googleapis.com/skaffold/releases/v2.20.0/skaffold-windows-amd64.exe" [[tools.uv]] -version = "0.10.12" +version = "0.13.4" backend = "aqua:astral-sh/uv" [tools.uv."platforms.linux-arm64"] -checksum = "sha256:0ed7d20f49f6b9b60d45fdfcac28f3ac01a671a6ef08672401ed2833423fea2a" -url = "https://github.com/astral-sh/uv/releases/download/0.10.12/uv-aarch64-unknown-linux-gnu.tar.gz" -url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/377491938" +checksum = "sha256:1ae72b4718729e2ccc4f1ae2c6d1e531ca8467800e0546e9130b3886023a60ab" +url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-gnu.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/659693320" provenance = "github-attestations" [tools.uv."platforms.linux-x64"] -checksum = "sha256:ec72570c9d1f33021aa80b176d7baba390de2cfeb1abcbefca346d563bf17484" -url = "https://github.com/astral-sh/uv/releases/download/0.10.12/uv-x86_64-unknown-linux-gnu.tar.gz" -url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/377491996" +checksum = "sha256:2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f" +url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/659693663" provenance = "github-attestations" [tools.uv."platforms.macos-arm64"] -checksum = "sha256:ae738b5661a900579ec621d3918c0ef17bdec0da2a8a6d8b161137cd15f25414" -url = "https://github.com/astral-sh/uv/releases/download/0.10.12/uv-aarch64-apple-darwin.tar.gz" -url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/377491929" +checksum = "sha256:e0b1d4743ce64c55d9f0f4a444afa6b81125680070ee04e853fcd0f6c1ebf8f1" +url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/659693291" provenance = "github-attestations" [tools.uv."platforms.windows-arm64"] -checksum = "sha256:4c1d55501869b3330d4aabf45ad6024ce2367e0f3af83344395702d272c22e88" -url = "https://github.com/astral-sh/uv/releases/download/0.10.12/uv-x86_64-pc-windows-msvc.zip" -url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/377491992" +checksum = "sha256:ccec7508a07d9933d7cb1261880633efcf1f30d6e6eddab21823f1dae6f23225" +url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-pc-windows-msvc.zip" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/659693635" provenance = "github-attestations" [tools.uv."platforms.windows-x64"] -checksum = "sha256:4c1d55501869b3330d4aabf45ad6024ce2367e0f3af83344395702d272c22e88" -url = "https://github.com/astral-sh/uv/releases/download/0.10.12/uv-x86_64-pc-windows-msvc.zip" -url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/377491992" +checksum = "sha256:ccec7508a07d9933d7cb1261880633efcf1f30d6e6eddab21823f1dae6f23225" +url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-pc-windows-msvc.zip" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/659693635" provenance = "github-attestations" [[tools.yq]] diff --git a/mise.toml b/mise.toml index 9504f82781..1c8507bdf9 100644 --- a/mise.toml +++ b/mise.toml @@ -21,11 +21,11 @@ lockfile_platforms = ["linux-x64", "linux-arm64", "macos-arm64", "windows-x64", [tools] python = "3.14.5" rust = "1.95.0" -node = "24.15.0" +node = "24.22.1" kubectl = { version = "1.36.1", version_prefix = "v" } -uv = "0.10.12" +uv = "0.13.4" protoc = "29.6" -go = "1.26.7" +go = "1.26.10" "go:github.com/golangci/golangci-lint/v2/cmd/golangci-lint" = "2.12" "go:google.golang.org/protobuf/cmd/protoc-gen-go" = "1.36.11" "go:google.golang.org/grpc/cmd/protoc-gen-go-grpc" = "1.6.2" diff --git a/scripts/agents/gator/Dockerfile b/scripts/agents/gator/Dockerfile index db1f5218a1..639e893313 100644 --- a/scripts/agents/gator/Dockerfile +++ b/scripts/agents/gator/Dockerfile @@ -9,7 +9,9 @@ # tooling, but keeps the initial agent surface focused on Codex + GitHub tooling # for the gator-gate workflow. -FROM nvcr.io/nvidia/base/ubuntu:noble-20251013 AS system +FROM public.ecr.aws/docker/library/node:22.23.4-bookworm-slim@sha256:5991875dfb80938dd8a6ba3fe3e96fd04929e70792762b3319d8caadbbe229bc AS node + +FROM public.ecr.aws/docker/library/ubuntu:24.04@sha256:68ee22004a9109b44973313b02ff7b1de250f1de0f5ecb628d73f579aaff33ac AS system ENV DEBIAN_FRONTEND=noninteractive \ PYTHONDONTWRITEBYTECODE=1 \ @@ -35,6 +37,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ openssh-sftp-server \ procps \ traceroute \ + && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20260816ubuntu0.24.04.1 \ && rm -rf /var/lib/apt/lists/* RUN groupadd -r supervisor && useradd -r -g supervisor -s /usr/sbin/nologin supervisor && \ @@ -42,20 +45,20 @@ RUN groupadd -r supervisor && useradd -r -g supervisor -s /usr/sbin/nologin supe FROM system AS devtools -# Node.js 22 + build toolchain. Keep the default apt installs aligned with the -# workload, then add the small CLI tools gator commonly needs. -RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \ - apt-get install -y --no-install-recommends \ +COPY --from=node /usr/local/bin/node /usr/bin/node +COPY --from=node /usr/local/lib/node_modules/npm /usr/lib/node_modules/npm +COPY --from=node /usr/local/include/node /usr/include/node + +RUN apt-get update && apt-get install -y --no-install-recommends \ build-essential \ git \ jq \ less \ - nodejs=22.22.1-1nodesource1 \ ripgrep \ vim-tiny \ nano \ && rm -rf /var/lib/apt/lists/* \ - && npm install -g npm@11.11.0 + && node /usr/lib/node_modules/npm/bin/npm-cli.js install -g npm@11.11.0 # GitHub CLI RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \ diff --git a/sdk/go/README.md b/sdk/go/README.md index 80e71aebee..e8ec54a1a1 100644 --- a/sdk/go/README.md +++ b/sdk/go/README.md @@ -316,7 +316,7 @@ stream completion. ## Prerequisites -- Go 1.25.13 or later +- Go 1.26.10 or later. On Go 1.27, use at least 1.27.3. - [mise](https://mise.jdx.dev) (recommended for reproducible builds) ## Build and Test diff --git a/sdk/go/docs/src/getting-started.md b/sdk/go/docs/src/getting-started.md index c59dc450a6..d2f664ad62 100644 --- a/sdk/go/docs/src/getting-started.md +++ b/sdk/go/docs/src/getting-started.md @@ -4,7 +4,7 @@ This guide walks you through installing the OpenShell Go SDK, connecting to a ga ## Prerequisites -- Go 1.25.13 or later +- Go 1.26.10 or later. On Go 1.27, use at least 1.27.3. - Access to an OpenShell gateway (address and authentication token) ## Installation diff --git a/sdk/go/go.mod b/sdk/go/go.mod index e5d3f921ef..63a0fe472f 100644 --- a/sdk/go/go.mod +++ b/sdk/go/go.mod @@ -1,6 +1,6 @@ module github.com/NVIDIA/OpenShell/sdk/go -go 1.25.13 +go 1.26.10 require ( github.com/coder/websocket v1.8.15 diff --git a/sdk/go/mise.toml b/sdk/go/mise.toml index 2618b146ee..4abeb26684 100644 --- a/sdk/go/mise.toml +++ b/sdk/go/mise.toml @@ -2,7 +2,7 @@ # SPDX-License-Identifier: Apache-2.0 [tools] -go = "1.25.14" +go = "1.26.10" buf = "1.72.0" "go:github.com/golangci/golangci-lint/v2/cmd/golangci-lint" = "2.12" "go:google.golang.org/protobuf/cmd/protoc-gen-go" = "1.36.11" diff --git a/skills/debug-openshell-cluster/SKILL.md b/skills/debug-openshell-cluster/SKILL.md index 1dab79be80..8aca0654a8 100644 --- a/skills/debug-openshell-cluster/SKILL.md +++ b/skills/debug-openshell-cluster/SKILL.md @@ -94,10 +94,13 @@ Use gateway metadata, deployment values, or the user's setup notes to identify t Before debugging the compute platform, inspect gateway logs for failures in dependencies initialized before the listener becomes ready. -The gateway container uses a Distroless Debian runtime. For OS-library -vulnerability findings, check the deployed image digest and package version; -deploy a rebuilt gateway image with the patched base. Updating the gateway -binary alone does not update the libraries supplied by its container image. +The gateway and supervisor containers use Distroless Debian runtimes. For +OS-library or CA trust-store findings, check the deployed image digests and +their package and certificate-bundle contents. A CA bundle can be patched +without changing the package version. Deploy rebuilt gateway and supervisor +images with the patched bases. Updating a binary alone does not update its +container's libraries or system CA bundle. Workload images carry their own +trust stores and need rebuilding and redeployment separately. For stable releases, inspect the version tag or deployed digest. Promotion preserves the qualified prerelease's commit-SHA image tags; those tags do not From e22687318ad1901fe427afd4f5f5a267c3617c8b Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Thu, 22 Oct 2026 14:26:46 +0200 Subject: [PATCH 2/4] fix(docker): simplify CA updates with upstream packages Signed-off-by: Adrien Langou --- .agents/skills/launch-openshell-gator/SKILL.md | 3 +-- deploy/docker/Dockerfile.ci | 3 +-- e2e/mcp-conformance/Dockerfile.client | 1 - scripts/agents/gator/Dockerfile | 17 +++++++---------- 4 files changed, 9 insertions(+), 15 deletions(-) diff --git a/.agents/skills/launch-openshell-gator/SKILL.md b/.agents/skills/launch-openshell-gator/SKILL.md index 9d692017f0..aca5ec8b62 100644 --- a/.agents/skills/launch-openshell-gator/SKILL.md +++ b/.agents/skills/launch-openshell-gator/SKILL.md @@ -371,8 +371,7 @@ Symptoms: Dockerfile step failure, missing package, incompatible Codex CLI, regi Actions: - Confirm the build context is `scripts/agents/gator/` or the intended temporary `--from` context. -- Confirm Docker or the selected gateway runtime can pull the pinned Ubuntu and Node.js images. -- The Dockerfile copies Node.js from its pinned official image into `/usr`, keeping npm packages under `/usr/lib/node_modules`. +- Confirm Docker or the selected gateway runtime can pull `nvcr.io/nvidia/base/ubuntu:noble-20260917`. - For Codex CLI version experiments, adjust a temporary Docker context first. - Do not commit Dockerfile version changes unless the repo should permanently use that version. diff --git a/deploy/docker/Dockerfile.ci b/deploy/docker/Dockerfile.ci index 17232a7051..ae63705ced 100644 --- a/deploy/docker/Dockerfile.ci +++ b/deploy/docker/Dockerfile.ci @@ -6,7 +6,7 @@ # CI runner image with all development tools pre-installed # Rebuild triggered automatically when mise.toml, mise.lock, tasks, or this file changes -FROM nvcr.io/nvidia/base/ubuntu:noble-20251013 +FROM nvcr.io/nvidia/base/ubuntu:noble-20260917 ARG DOCKER_VERSION=29.5.1 ARG BUILDX_VERSION=v0.34.0 @@ -41,7 +41,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ rsync \ zstd \ && apt-get install -y --only-upgrade gpgv python3 \ - && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20260816ubuntu0.24.04.1 \ && rm -rf /var/lib/apt/lists/* # Install Docker CLI and buildx plugin used by CI jobs diff --git a/e2e/mcp-conformance/Dockerfile.client b/e2e/mcp-conformance/Dockerfile.client index 1d8a68492f..fe22f0a0a7 100644 --- a/e2e/mcp-conformance/Dockerfile.client +++ b/e2e/mcp-conformance/Dockerfile.client @@ -5,7 +5,6 @@ FROM public.ecr.aws/docker/library/node:22.23.4-bookworm-slim@sha256:5991875dfb8 RUN apt-get update \ && apt-get install -y --no-install-recommends ca-certificates iproute2 \ - && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419~deb12u2 \ && rm -rf /var/lib/apt/lists/* ARG SANDBOX_UID=1000660000 diff --git a/scripts/agents/gator/Dockerfile b/scripts/agents/gator/Dockerfile index 639e893313..565b82bb7c 100644 --- a/scripts/agents/gator/Dockerfile +++ b/scripts/agents/gator/Dockerfile @@ -9,9 +9,7 @@ # tooling, but keeps the initial agent surface focused on Codex + GitHub tooling # for the gator-gate workflow. -FROM public.ecr.aws/docker/library/node:22.23.4-bookworm-slim@sha256:5991875dfb80938dd8a6ba3fe3e96fd04929e70792762b3319d8caadbbe229bc AS node - -FROM public.ecr.aws/docker/library/ubuntu:24.04@sha256:68ee22004a9109b44973313b02ff7b1de250f1de0f5ecb628d73f579aaff33ac AS system +FROM nvcr.io/nvidia/base/ubuntu:noble-20260917 AS system ENV DEBIAN_FRONTEND=noninteractive \ PYTHONDONTWRITEBYTECODE=1 \ @@ -37,7 +35,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ openssh-sftp-server \ procps \ traceroute \ - && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20260816ubuntu0.24.04.1 \ && rm -rf /var/lib/apt/lists/* RUN groupadd -r supervisor && useradd -r -g supervisor -s /usr/sbin/nologin supervisor && \ @@ -45,20 +42,20 @@ RUN groupadd -r supervisor && useradd -r -g supervisor -s /usr/sbin/nologin supe FROM system AS devtools -COPY --from=node /usr/local/bin/node /usr/bin/node -COPY --from=node /usr/local/lib/node_modules/npm /usr/lib/node_modules/npm -COPY --from=node /usr/local/include/node /usr/include/node - -RUN apt-get update && apt-get install -y --no-install-recommends \ +# Node.js 22 + build toolchain. Keep the default apt installs aligned with the +# workload, then add the small CLI tools gator commonly needs. +RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \ + apt-get install -y --no-install-recommends \ build-essential \ git \ jq \ less \ + nodejs=22.23.4-1nodesource1 \ ripgrep \ vim-tiny \ nano \ && rm -rf /var/lib/apt/lists/* \ - && node /usr/lib/node_modules/npm/bin/npm-cli.js install -g npm@11.11.0 + && npm install -g npm@11.11.0 # GitHub CLI RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \ From 59c472f53379f5a7459c9e19c242994b30c11a41 Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Thu, 22 Oct 2026 15:02:52 +0200 Subject: [PATCH 3/4] fix(nix): isolate uv update from build toolchains Signed-off-by: Adrien Langou --- flake.lock | 23 ++++++++++++++++++++--- flake.nix | 4 +++- 2 files changed, 23 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index db9624c4dd..461f985141 100644 --- a/flake.lock +++ b/flake.lock @@ -20,11 +20,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1792514193, - "narHash": "sha256-q8qbDVZy0GmabhCOnQTqFVho1hgJd85GePju462d7mc=", + "lastModified": 1787135253, + "narHash": "sha256-RD2kNWCG+Bjo6h+JVjWVNntZs2GtRoeY2xHjts/FNkA=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "7bfe60fe75d8c7171b95e6ec2d610d4778cc549b", + "rev": "ffb3c9b700e759be2ef13237c9d8f953b32a1e46", "type": "github" }, "original": { @@ -50,11 +50,28 @@ "type": "github" } }, + "nixpkgs-uv": { + "locked": { + "lastModified": 1792514193, + "narHash": "sha256-q8qbDVZy0GmabhCOnQTqFVho1hgJd85GePju462d7mc=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "7bfe60fe75d8c7171b95e6ec2d610d4778cc549b", + "type": "github" + }, + "original": { + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "7bfe60fe75d8c7171b95e6ec2d610d4778cc549b", + "type": "github" + } + }, "root": { "inputs": { "flake-utils": "flake-utils", "nixpkgs": "nixpkgs", "nixpkgs-test-guest": "nixpkgs-test-guest", + "nixpkgs-uv": "nixpkgs-uv", "rust-overlay": "rust-overlay", "treefmt-nix": "treefmt-nix" } diff --git a/flake.nix b/flake.nix index 7fac354cac..5d7d2d5db5 100644 --- a/flake.nix +++ b/flake.nix @@ -14,6 +14,7 @@ inputs = { flake-utils.url = "github:numtide/flake-utils"; nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + nixpkgs-uv.url = "github:NixOS/nixpkgs/7bfe60fe75d8c7171b95e6ec2d610d4778cc549b"; # Keep the QEMU and OVMF runtime used by Apple Silicon test guests on a # known-good release. Development shells and cross toolchains use nixpkgs. nixpkgs-test-guest.url = "github:NixOS/nixpkgs/0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5"; @@ -32,6 +33,7 @@ { flake-utils, nixpkgs, + nixpkgs-uv, nixpkgs-test-guest, treefmt-nix, rust-overlay, @@ -70,7 +72,7 @@ kubernetes-helm syft trivy - uv + nixpkgs-uv.legacyPackages.${system}.uv yq-go zizmor zstd From 91a4f0721100413ee7673836086bcb9d100b70db Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Thu, 22 Oct 2026 15:53:11 +0200 Subject: [PATCH 4/4] fix(ci): align Docker E2E runner image Signed-off-by: Adrien Langou --- .github/workflows/e2e-docker-test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/e2e-docker-test.yml b/.github/workflows/e2e-docker-test.yml index 427f5d3fc2..697511ac78 100644 --- a/.github/workflows/e2e-docker-test.yml +++ b/.github/workflows/e2e-docker-test.yml @@ -46,7 +46,7 @@ jobs: matrix: include: ${{ fromJSON(inputs.suite-matrix) }} container: - image: ghcr.io/nvidia/openshell/ci:37072ee81cd7b294c714bfa5ecc829b6927b3d70@sha256:ffa96b8009de6e28bbf157060440c3abb312d3bcda444e9571c539c8c6115615 + image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684 credentials: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }}