fix(mxc): complete proxy CA staging isolation - #3535
Merged
pkhodade-NV merged 2 commits intoSep 22, 2026
Merged
pkhodade-NV merged 2 commits into
pkhodade-NV merged 2 commits into
Conversation
Signed-off-by: Prekshi Vyas <prekshivyas@nvidia.com>
prekshivyas
requested review from
a team,
derekwaynecarr,
mrunalp and
sjenning
as code owners
September 21, 2026 23:23
2 tasks
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
prekshivyas
changed the title
Contributor
Author
Final holistic Windows qualificationThe corrected head Focused validation:
Combined validation:
|
Collaborator
|
@prekshivyas you want to migrate changes required in #3496 from this PR ? |
pkhodade-NV
merged commit Sep 22, 2026
92e2f2a
into
NVIDIA:fix/mxc-egress-proxy-ca-staging-env-tier
63 checks passed
shailendra-nv
pushed a commit
that referenced
this pull request
Sep 22, 2026
* fix(mxc): stage egress-proxy CA files regardless of env tier stage_tls_ca_files was only invoked when pc_minimal_env was set, but a curated ProcessContainer can't read the host proxy's private temp folder under any env tier. With the default pc_minimal_env=false, the CA env vars pointed at a path the sandboxed process couldn't read at all, breaking TLS validation for allow-listed HTTPS requests through the egress proxy. Extract the staging decision into resolve_agent_proxy_ca_paths, which takes no env-tier argument, so the gap can't silently regress; existing tests never exercised this path since mocked invokers skip host-proxy startup entirely. Signed-off-by: Prashant Khodade <pkhodade@nvidia.com> (cherry picked from commit d0346af96aef9a93aca26a7e1825d8678a25567d) * fix(mxc): complete proxy CA staging isolation (#3535) * test(mxc): provide workload dir for CA staging Signed-off-by: Prekshi Vyas <prekshivyas@nvidia.com> * fix(mxc): isolate staged proxy CA files Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> --------- Signed-off-by: Prekshi Vyas <prekshivyas@nvidia.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> --------- Signed-off-by: Prashant Khodade <pkhodade@nvidia.com> Signed-off-by: Prekshi Vyas <prekshivyas@nvidia.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up for #3496 from the holistic Windows qualification run. This branch is based directly on #3496 and is intended for the owner to merge or cherry-pick.
It completes the change in two places:
<cwd>/.openshell-proxy/<sandbox-id>, the host proxy's private temporary CA directory is no longer added to MXCreadwritePaths, and the source comments and MXC README now describe that behavior.The lifecycle regression test inspects the effective MXC configuration for the default (
pc_minimal_env = false) tier. It requires all six TLS trust variables to reference existing staged files and verifies that the host proxy source directory is absent fromreadwritePaths.Native Windows ARM64 validation:
cargo fmt --all -- --checkcargo clippy -p openshell-driver-mxc --all-targets --target aarch64-pc-windows-msvc -- -D warnings ...driver::lifecycle_tests::governed_egress_puts_only_provider_placeholder_in_mxc_process_env(1 passed)driver::lifecycle_tests::explicit_network_policies_start_and_cleanup_host_proxy(1 passed)Signed-off-by: Prekshi Vyas prekshiv@nvidia.com