fix(install): trust OpenShell v0.0.85 manifests by apurvvkumaria · Pull Request #7070 · NVIDIA/NemoClaw

apurvvkumaria · 2026-07-17T03:13:06Z

Summary

Trust the three reviewed immutable OpenShell v0.0.85 release-manifest digests before the separate version-pin update in #6726. Runtime selectors remain unchanged, preserving the base-trusted two-step rollout.

Related Issue

Prerequisite for #6726.

Changes

Add the OpenShell v0.0.85 CLI, gateway, and sandbox release-manifest digests to the trusted allowlist.
Keep every installer and blueprint version selector unchanged so chore(openshell): upgrade supported version to 0.0.85 #6726 cannot authorize its own release digests.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification: test/installer-hash-check.test.ts covers complete alternate allowlist releases and the required two-step trust-anchor prerequisite; test/dependency-pins-check.test.ts validates the dependency-pin contract.
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification: this changes only the internal trusted release-manifest allowlist and does not alter user-facing behavior or selectors.
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: pending independent review.
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration test/installer-hash-check.test.ts test/dependency-pins-check.test.ts (78 passed); bash scripts/check-installer-hash.sh (all current OpenShell v0.0.72 assets verified).
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: not applicable to a three-entry trusted-data addition.
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

Bug Fixes
- Added support for verifying OpenShell v0.0.85 release manifests during installer integrity checks.
- Installer validation now accepts and confirms the latest checksum files for the core, gateway, and sandbox components.

Add the reviewed immutable release-manifest digests required before the separate OpenShell v0.0.85 pin update can pass the base-trusted verifier. Co-authored-by: Aaron Erickson <aerickson@nvidia.com> Co-authored-by: Charan Jagwani <cjagwani@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

coderabbitai · 2026-07-17T03:13:33Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4d3b9156-d653-4901-a32e-f3bfe2b4969c

📥 Commits

Reviewing files that changed from the base of the PR and between a9fac78 and dbd69f5.

📒 Files selected for processing (1)

scripts/check-installer-hash.sh

📝 Walkthrough

Walkthrough

The installer hash validation allowlist adds pinned SHA-256 digests for three OpenShell v0.0.85 checksum manifest files.

Changes

Installer hash validation

Layer / File(s)	Summary
Add v0.0.85 manifest digests `scripts/check-installer-hash.sh`	Adds trusted SHA-256 entries for the OpenShell, gateway, and sandbox checksum manifests at version 0.0.85.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

NVIDIA/NemoClaw#7069: Updates the same installer hash allowlist with OpenShell v0.0.85 manifest digests.

Suggested labels: area: security, chore

Suggested reviewers: ericksoa

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding trust for OpenShell v0.0.85 release manifests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/6726-openshell-0.0.85-trust-anchor

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-07-17T03:13:53Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/6726-openshell... branch remains at 80%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main `a9fac78`	codex/6726-openshell... `dbd69f5`	+/-
`src/lib/state/registry.ts`	86%	83%	-3%
`src/lib/credentials/store.ts`	59%	64%	+5%
`src/lib/inferen...er-lifecycle.ts`	65%	71%	+6%
`src/lib/core/pr...mpt-activity.ts`	67%	92%	+25%
`src/lib/inferen...lama/process.ts`	50%	100%	+50%

_{Updated July 17, 2026 03:21 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

github-actions · 2026-07-17T03:16:21Z

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

openshell-version-pin

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

apurvvkumaria · 2026-07-17T03:16:58Z

Closing as superseded by #7069, which merged the exact same three reviewed OpenShell v0.0.85 manifest digests into main at 8297d20. The two PRs were opened concurrently; no additional change from this branch is needed. Original contributors remain credited in this PR's signed commit and #7069 carries Charan Jagwani's authored fix.

apurvvkumaria added the v0.0.85 Release target label Jul 17, 2026

apurvvkumaria self-assigned this Jul 17, 2026

apurvvkumaria closed this Jul 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(install): trust OpenShell v0.0.85 manifests#7070

fix(install): trust OpenShell v0.0.85 manifests#7070
apurvvkumaria wants to merge 1 commit into
mainfrom
codex/6726-openshell-0.0.85-trust-anchor

apurvvkumaria commented Jul 17, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Jul 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 17, 2026 •

edited

Loading

Uh oh!

apurvvkumaria commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

apurvvkumaria commented Jul 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Quality Gates

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — Informational

Model lanes

E2E guidance

Uh oh!

apurvvkumaria commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

apurvvkumaria commented Jul 17, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading

github-code-quality Bot commented Jul 17, 2026 •

edited

Loading

github-actions Bot commented Jul 17, 2026 •

edited

Loading