[TaylorMutch]

Summary

Restore compatibility for Podman gateway configurations using [openshell.drivers.podman].additional_ca_bundle, introduced in v0.1.5. Accept the old key as a deprecated alias only when Podman is the effective compute driver, so the v0.1.7 patch upgrade preserves existing configurations without changing other drivers' destination trust.

Related Issue

Closes #5154

Removal of the deprecated alias in 0.2.0 is tracked in #5172.

Changes

• Resolve the effective compute driver before interpreting the legacy TOML key, honoring CLI, environment, config, and runtime auto-detection selection.
• For selected Podman, normalize the alias into the shared supervisor network setting before CA validation and staging, and remove it before driver decoding. Emit migration guidance after tracing is installed.
• Leave inactive Podman settings uninterpreted: they cannot add trust, cause conflicts, trigger file reads, or emit a deprecation warning for another selected driver.
• Accept matching old and new paths for selected Podman; reject conflicting paths and malformed alias values.
• Apply the same selection rule to explicit-driver preflight. Detection-free preflight validates each configured auto-detection candidate independently, without sharing Podman's alias-derived trust with other candidates or creating artifacts.

Release Notes

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated
• E2E tests added/updated (not run; changes are confined to gateway configuration preparation)

Validation:

• Server configuration tests: 74 passed.
• CLI tests: 99 passed, including startup and preflight with invalid, missing, valid, and conflicting inactive Podman CA settings; selected Podman CA staging through CLI, environment, config, and auto-detection; and unchanged global trust behavior.
• Rust formatting checks for both changed files passed.
• cargo clippy -p openshell-server --lib --tests --no-deps --offline -- -D warnings passed.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. configuration — No explicit risk acceptance found

An unselected openshell.drivers.podman.additional_ca_bundle was ignored; it is now unconditionally validated and promoted to global supervisor trust.

• Impact: Existing openshell-gateway --compute-driver docker --config gateway.toml invocations now fail with a conflict error when a retained, inactive Podman CA path differs from the active global CA path.
• Action: Preserve v0.1.7 patch compatibility by applying the legacy alias only when Podman is selected and leaving unselected driver tables inert.
• PR: fix(gateway): preserve the legacy Podman CA bundle setting #5155

Review details

• Execution: complete
• Candidate: PR #5155 (5e95c9340b5d491cfcaa602965ae302953c4e87c)
• Baseline: 9cc5f6e4ccb8d5740c9a8dc7b4c0dc4e1d0f97f2 (9cc5f6e4ccb8d5740c9a8dc7b4c0dc4e1d0f97f2)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[github-actions]

Label test:e2e applied for b87c677. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.