fix(snap): pass config preflight and detect the mTLS gateway reliably

An explicit [openshell.gateway.mtls_auth] table fails config preflight,
which validates mTLS auth before the local TLS bundle supplies the client
CA. Write a default that pins the Docker driver instead; with the wrapper's
TLS bundle the gateway requires client certificates and enables mTLS user
auth automatically, as the native packages do.

The mTLS gateway rejects TLS handshakes without a client certificate, and
it still answers plaintext loopback HTTP for sandbox service routing, so the
installer could misdetect it as a legacy plaintext gateway. Probe HTTPS with
the root-owned client bundle, and treat a gateway as legacy only when a
plaintext gRPC Health call succeeds.

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

install.sh

@@ -1331,24 +1331,30 @@ register_snap_gateway() {
 }
 
 # Wait for the snap gateway and record its scheme in SNAP_GATEWAY_SCHEME.
-# Current revisions serve mTLS; earlier revisions serve plaintext HTTP. Probe
-# HTTPS first because a TLS gateway also answers plaintext loopback requests
-# for sandbox service routing.
+# Current revisions require a client certificate during the TLS handshake, so
+# probe HTTPS with the root-owned client bundle. Earlier revisions serve
+# plaintext gRPC; a TLS gateway also answers plaintext loopback HTTP for
+# sandbox service routing, so only a successful plaintext gRPC Health call
+# identifies a legacy gateway.
 wait_for_snap_gateway_listener() {
   _timeout="${OPENSHELL_INSTALL_GATEWAY_TIMEOUT:-30}"
   _elapsed=0
   _last_output=""
+  _tls_dir="${OPENSHELL_SNAP_TLS_DIR:-/var/snap/openshell/common/tls}"
   _probe_url="https://127.0.0.1:${LOCAL_GATEWAY_PORT}/"
 
   info "waiting for local gateway listener to become reachable..."
   while [ "$_elapsed" -lt "$_timeout" ]; do
-    # The probe only checks reachability; the CLI verifies the gateway CA.
-    if _last_output="$(curl -sS -k --max-time 2 -o /dev/null "$_probe_url" 2>&1)"; then
+    if _last_output="$(as_root curl -sS --max-time 2 \
+      --cacert "${_tls_dir}/ca.crt" \
+      --cert "${_tls_dir}/client/tls.crt" \
+      --key "${_tls_dir}/client/tls.key" \
+      -o /dev/null "$_probe_url" 2>&1)"; then
       SNAP_GATEWAY_SCHEME=https
       info "local gateway listener is reachable"
       return 0
     fi
-    if curl -sS --max-time 2 -o /dev/null "http://127.0.0.1:${LOCAL_GATEWAY_PORT}/" >/dev/null 2>&1; then
+    if [ "$(snap_legacy_grpc_health_status)" = "200" ]; then
       SNAP_GATEWAY_SCHEME=http
       info "local gateway listener is reachable"
       return 0
@@ -1362,6 +1368,16 @@ wait_for_snap_gateway_listener() {
   error "local gateway listener did not become reachable at ${_probe_url} within ${_timeout}s"
 }
 
+# Print the HTTP status of an empty plaintext gRPC Health call.
+snap_legacy_grpc_health_status() {
+  printf '\000\000\000\000\000' |
+    curl -s --max-time 2 --http2-prior-knowledge -o /dev/null -w '%{http_code}' \
+      -X POST -H 'content-type: application/grpc' -H 'te: trailers' \
+      --data-binary @- \
+      "http://127.0.0.1:${LOCAL_GATEWAY_PORT}/openshell.v1.OpenShell/Health" 2>/dev/null ||
+    true
+}
+
 install_linux_snap() {
   require_cmd snap
   set_linux_target_runtime_dir

snap/hooks/install

@@ -4,8 +4,13 @@
 
 # Bootstrap the snap gateway config. Operator-owned configs are never touched,
 # except that the exact config written by earlier snap revisions, which allowed
-# unauthenticated local access, is replaced with the mTLS default. The
-# post-refresh hook runs this script too so existing installs are migrated.
+# unauthenticated local access, is replaced with the default. The post-refresh
+# hook runs this script too so existing installs are migrated.
+#
+# The default pins the Docker driver and leaves user auth unset: with the
+# wrapper's local TLS bundle, the gateway requires client certificates and
+# enables mTLS user auth automatically. Setting mtls_auth explicitly would fail
+# config preflight, which runs before the local TLS defaults are applied.
 
 set -eu
 
@@ -41,9 +46,7 @@ cat >"$temporary_file" <<'CONFIG'
 version = 2
 
 [openshell.gateway]
-
-[openshell.gateway.mtls_auth]
-enabled = true
+compute_driver = "docker"
 CONFIG
 
 if [ "$replace" = true ]; then

tasks/scripts/test-install-sh.sh

@@ -490,6 +490,40 @@ if ! grep -Fq "without client authentication" "$err"; then
   exit 1
 fi
 
+assert_snap_listener_scheme() {
+  local name=$1
+  local https_ok=$2
+  local grpc_status=$3
+  local expected=$4
+  local actual
+
+  actual="$(
+    as_root() { "$@"; }
+    curl() {
+      case " $* " in
+        *" --cert "*) [ "$https_ok" = "1" ] ;;
+        *) return 1 ;;
+      esac
+    }
+    snap_legacy_grpc_health_status() { printf '%s' "$grpc_status"; }
+    sleep() { :; }
+    info() { :; }
+    dump_local_gateway_diagnostics() { :; }
+    error() { printf 'timeout\n'; exit 0; }
+    OPENSHELL_INSTALL_GATEWAY_TIMEOUT=2
+    wait_for_snap_gateway_listener 2>/dev/null
+    printf '%s\n' "${SNAP_GATEWAY_SCHEME:-none}"
+  )"
+  if [ "$actual" != "$expected" ]; then
+    echo "FAIL: ${name}: expected ${expected}, got ${actual}" >&2
+    exit 1
+  fi
+}
+
+assert_snap_listener_scheme "mTLS gateway accepts the client bundle" 1 404 https
+assert_snap_listener_scheme "legacy gateway answers plaintext gRPC" 0 200 http
+assert_snap_listener_scheme "plaintext service routing is not a legacy gateway" 0 404 timeout
+
 snap_tls_src="${tmpdir}/snap-tls"
 mkdir -p "${snap_tls_src}/client"
 printf 'ca\n' >"${snap_tls_src}/ca.crt"

tasks/scripts/test-packaging-assets.sh

@@ -123,7 +123,7 @@ if [[ ! -x "$snap_install_hook" ]]; then
   echo "FAIL: Snap install hook must be executable" >&2
   exit 1
 fi
-assert_contains "$snap_install_hook" '[openshell.gateway.mtls_auth]'
+assert_contains "$snap_install_hook" 'compute_driver = "docker"'
 if [[ ! -x "$(dirname "$snap_install_hook")/post-refresh" ]]; then
   echo "FAIL: Snap post-refresh hook must be executable" >&2
   exit 1

tasks/scripts/test-snap-install-hook.sh

@@ -16,9 +16,7 @@ cat >"$expected" <<'EOF'
 version = 2
 
 [openshell.gateway]
-
-[openshell.gateway.mtls_auth]
-enabled = true
+compute_driver = "docker"
 EOF
 
 legacy="${work}/legacy.toml"