Bug 2566994

Spec URL: https://download.copr.fedorainfracloud.org/results/quinnb/openshell-v015/fedora-44-x86_64/11228415-openshell/openshell.spec
SRPM URL: https://download.copr.fedorainfracloud.org/results/quinnb/openshell-v015/fedora-44-x86_64/11228415-openshell/openshell-0.1.6-1.fc44.src.rpm

Description:
OpenShell provides safe sandbox runtimes for autonomous AI agents. It offers a CLI for managing gateway registrations, sandboxes and providers, with policy enforced egress routing, a credential proxy and profile backed model provider access. The gateway runs sandboxes through Podman.

Upstream: https://github.com/NVIDIA/OpenShell (Apache-2.0)
Subpackages: openshell (CLI), openshell-gateway, openshell-prover, python3-openshell

Fedora Account System user: quinnb
This is my first package, and I will need a sponsor.

AI assistance disclosure: I used Claude (Anthropic), through Claude Code, to help prepare and test this package.

Review notes (things I would like a reviewer to look at first):

1. Rust vendoring. Fedora does not package most of the dependency tree, so the build uses a `cargo vendor` tarball (Source1) and `Provides: bundled(crate(...))` for every vendored crate, generated by %cargo_vendor_manifest. The spec documents how to regenerate the tarball.No git or patched crates.

2. SQLite is not bundled. Upstream enables sqlx's "sqlite" feature, which compiles SQLite into the binary. Patch0 switches it to "sqlite-unbundled", so the gateway links the system libsqlite3. This adds bindgen and its dependencies to the lock file, and clang-devel and pkgconfig(sqlite3) to BuildRequires. Tested: the gateway starts, migrates its database and runs a sandbox with this change. Re-verified on 0.1.6, including a gateway restart against an existing database.

3. TLS and aws-lc. TLS uses rustls with the aws-lc-rs and aws-lc-sys crates, statically linked from the vendored sources. FESCo ticket 3679 allows aws-lc through these crates for TLS via Rustls. These crates cannot read the system crypto policies.

4. Architectures. ExclusiveArch is x86_64 and aarch64, the two that upstream builds and tests. COPR builds succeed on Fedora 44 and Rawhide, for both x86_64 and aarch64. I have only run the x86_64 binaries. On aarch64 I checked that the build succeeds and that the gateway links the system libsqlite3.

5. The gateway subpackage ships a user systemd unit and a read only system gateway entry under /etc/openshell so the CLI finds the packaged gateway.

COPR build: https://copr.fedorainfracloud.org/coprs/build/11228415
fedora-review output: attached as review.txt (fedora-review 0.12.0, Fedora 44 x86_64)

Reproducible: Always