fix(installer): trust verified Homebrew formula - #7555
Conversation
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe macOS OpenShell Homebrew installer now manages trust and cleanup for verified and dev formulas. Runtime tests cover trust capability and failure scenarios, while installer integrity tests reject legacy and incomplete trust lifecycles. ChangesHomebrew formula trust
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 6cc2af1 in the TypeScript / code-coverage/cliThe overall coverage in commit 6cc2af1 in the Show a code coverage summary of the most impacted files.
Updated |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
test/install-openshell-version-check.test.ts (1)
636-641: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winCover trust refusal and unsupported Homebrew.
This fixture only exercises successful trust. Add behavioral cases asserting that a nonzero
brew trustprevents installation, and that whenbrew help trustis unavailable the installer continues without invokingbrew trust.As per path instructions, verify observable installer outcomes rather than only the mocked command branches.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/install-openshell-version-check.test.ts` around lines 636 - 641, Extend the install behavior tests around the existing brew command fixture to cover both refusal and unsupported-Homebrew paths: assert that a nonzero “brew trust” result stops installation, and that an unavailable “brew help trust” result allows installation to continue without invoking “brew trust.” Verify observable installer outcomes and trust invocation, not just mock branch execution.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/install-openshell.sh`:
- Around line 693-696: Update the brew trust block to run only when the
formula’s checksum verification succeeded, matching the condition that guards
verification in the surrounding install flow. Ensure RELEASE_TAG=dev and any
other checksum-skipped path never invokes brew trust, while preserving the
existing trust command and failure handling for verified formulas.
---
Nitpick comments:
In `@test/install-openshell-version-check.test.ts`:
- Around line 636-641: Extend the install behavior tests around the existing
brew command fixture to cover both refusal and unsupported-Homebrew paths:
assert that a nonzero “brew trust” result stops installation, and that an
unavailable “brew help trust” result allows installation to continue without
invoking “brew trust.” Verify observable installer outcomes and trust
invocation, not just mock branch execution.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 47d3cbeb-396a-4f1e-ad57-811239881f00
📒 Files selected for processing (2)
scripts/install-openshell.shtest/install-openshell-version-check.test.ts
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 1 optional E2E recommendation
1 warning · 0 suggestionsWarningsWarnings do not block.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/install-openshell-version-check.test.ts`:
- Line 713: Update the assertion for refusedTrust in the relevant installation
refusal test to verify that status is non-zero rather than requiring the
specific exit code 1. Preserve the existing diagnostic message using stdout and
stderr, and keep the test focused on failure occurring before installation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 15ac1db0-4042-4d5c-8428-a9bdbd7b56fc
📒 Files selected for processing (2)
scripts/install-openshell.shtest/install-openshell-version-check.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/install-openshell.sh
|
Addressed the Advisor refusal-path warning in 7a54331. The executable installer fixture forces |
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
## Summary Temporarily authorize exactly the current OpenShell installer template and the reviewed safe Homebrew trust-lifecycle template in base-trusted CI. This prerequisite lets #7555 validate its runtime fix without allowing the mutable pull request to authorize its own installer behavior. ## Related Issue Related to #7451 ## Changes - accept the current and corrected future normalized installer-template hashes during the transition - keep the Brev installer constrained to its single existing trusted hash - model checksum-verified stable trust plus inherited and automatic dev-trust removal, including failure cleanup - preserve fail-closed rejection for any other operational installer drift - model the post-#7558 #7555 state and prove it rejects the legacy installer template ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: this is a CI-only trust anchor and does not change runtime behavior, supported versions, commands, configuration, or user guidance - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop reviewed the base-trusted boundary. The successor hash was derived from and revalidated against #7555's exact corrected installer; the dependent consumer is named, and negative coverage rejects any transition drift. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `no-docs-needed` - Evidence: At exact PR SHA `4c6f09d585eada4097f1b42dfc945986ae64470c`, this changes only the base-trusted verifier allowlist and fixtures for #7555's safe Homebrew trust lifecycle. It does not change installer runtime behavior or a supported user contract. The corrected #7555 parser proof, 75/75 installer-hash tests, `npm run build:cli`, and `npm run check:diff` passed. - Agent: Codex Desktop <!-- docs-review-head-sha: 4c6f09d --> <!-- docs-review-agents-blob-sha: be20a09 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed; `npm run build:cli` and `npm run check:diff` also passed on exact head `4c6f09d585eada4097f1b42dfc945986ae64470c` - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: `npx vitest run test/installer-hash-check.test.ts` (75/75 passed); the updated parser also accepted #7555's exact corrected installer template. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Charan Jagwani <cjagwani@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated installer/template verification to accept only templates whose computed hashes match a predefined allowlist, while continuing to reject drifted or unapproved templates with “not base-trusted” guidance. * **Tests** * Added Homebrew trust-transition fixture coverage for reviewed, drifted, and completed (legacy/current vs future/updated) scenarios. * Asserts the approved path reports “All installer hashes are current” and that drifted/unapproved and rejected completed modes fail appropriately. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
scripts/install-openshell.sh (1)
734-738: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDiagnostic references a different variable than the failing command.
Line 736 interpolates
${formula_ref}while the command operates on$OPENSHELL_HOMEBREW_UNTRUST_FORMULA_REF. Identical today, but the message should report the ref actually passed tobrew untrust.♻️ Proposed tweak
- || fail "Homebrew refused to remove temporary trust for the unverified OpenShell dev formula ${formula_ref}" + || fail "Homebrew refused to remove temporary trust for the unverified OpenShell dev formula ${OPENSHELL_HOMEBREW_UNTRUST_FORMULA_REF}"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/install-openshell.sh` around lines 734 - 738, Update the failure message in the OPENSHELL_HOMEBREW_UNTRUST_FORMULA_REF cleanup block to interpolate that same variable, rather than formula_ref, so diagnostics report the exact ref passed to brew untrust.test/install-openshell-version-check.test.ts (1)
784-810: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winTrap-path untrust failure is untested.
NEMOCLAW_TEST_BREW_UNTRUST_STATUS=1makes the pre-install untrust fail, so the script exits before recordingOPENSHELL_HOMEBREW_UNTRUST_FORMULA_REF. The cleanup trap's untrust-failure branch inscripts/install-openshell.sh(the warn + exit path) is therefore never exercised. A fixture that succeeds on the first untrust and fails on a subsequent one would cover it — and would surface the temp-directory leak flagged on that branch.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/install-openshell-version-check.test.ts` around lines 784 - 810, Update the refusedUntrust test fixture to make the first Homebrew untrust succeed and a subsequent trap cleanup untrust fail, so the cleanup trap’s warning-and-exit branch in install-openshell.sh is exercised. Configure the fake brew behavior and assertions around refusedUntrust to verify the trap failure output and ensure the temporary directory is cleaned up.test/installer-hash-check.test.ts (1)
325-330: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse a replacer function to avoid
String.replace()'s special$-pattern footgun.
current.replace(reviewed, legacy)passeslegacyas a raw string replacement. Per the JS spec, replacement strings interpret$$,$&,$`,$', and$nspecially — this applies even though the search argument (reviewed) is a plain string, not a regex. None of the current 6 snippets happen to contain such sequences, but any future addition to this fixture table (e.g. a shell snippet referencing$$as the PID variable, or text near a backtick/quote) would silently corrupt the generated "legacy" template without any test failure signal beyond a confusing hash mismatch.🛡️ Proposed fix
const restoreLegacyHomebrewTrustLifecycle = (source: string): string => { return HOMEBREW_TRUST_TRANSITION_REPLACEMENTS.reduce((current, [legacy, reviewed, label]) => { assert.ok(current.includes(reviewed), `installer Homebrew ${label} marker must exist`); - return current.replace(reviewed, legacy); + return current.replace(reviewed, () => legacy); }, source); };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/installer-hash-check.test.ts` around lines 325 - 330, Update restoreLegacyHomebrewTrustLifecycle to pass legacy through a replacer function in current.replace, ensuring the replacement text is inserted literally and cannot interpret special $ replacement patterns. Keep the existing reviewed-marker assertion and replacement flow unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/install-openshell.sh`:
- Around line 665-675: Update the cleanup flow around
OPENSHELL_HOMEBREW_UNTRUST_FORMULA_REF so a failed brew untrust records failure
by setting status instead of exiting immediately. Allow execution to fall
through to the existing rm -rf cleanup for OPENSHELL_HOMEBREW_FORMULA_TMPDIR,
then exit with the accumulated status.
---
Nitpick comments:
In `@scripts/install-openshell.sh`:
- Around line 734-738: Update the failure message in the
OPENSHELL_HOMEBREW_UNTRUST_FORMULA_REF cleanup block to interpolate that same
variable, rather than formula_ref, so diagnostics report the exact ref passed to
brew untrust.
In `@test/install-openshell-version-check.test.ts`:
- Around line 784-810: Update the refusedUntrust test fixture to make the first
Homebrew untrust succeed and a subsequent trap cleanup untrust fail, so the
cleanup trap’s warning-and-exit branch in install-openshell.sh is exercised.
Configure the fake brew behavior and assertions around refusedUntrust to verify
the trap failure output and ensure the temporary directory is cleaned up.
In `@test/installer-hash-check.test.ts`:
- Around line 325-330: Update restoreLegacyHomebrewTrustLifecycle to pass legacy
through a replacer function in current.replace, ensuring the replacement text is
inserted literally and cannot interpret special $ replacement patterns. Keep the
existing reviewed-marker assertion and replacement flow unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 95f03789-b735-48b9-bfc0-b4aed6dfd76f
📒 Files selected for processing (4)
scripts/checks/extract-installer-pins.mtsscripts/install-openshell.shtest/install-openshell-version-check.test.tstest/installer-hash-check.test.ts
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
prekshivyas
left a comment
prekshivyas
left a comment
There was a problem hiding this comment.
Security review: changes required on exact head aa914f4c331260afc0ce4f1b2c5d0c5ce226db35.
scripts/install-openshell.sh:723-737 trusts the checksum-verified stable formula, but the stable branch never assigns OPENSHELL_HOMEBREW_UNTRUST_FORMULA_REF. Both the normal post-install brew untrust and the EXIT-trap cleanup are gated on that variable, so a stable install leaves persistent Homebrew trust behind; the trust also remains if install/reinstall fails after brew trust. This contradicts the temporary-trust lifecycle claimed by the PR and is a security-blocking cleanup defect.
Please make the stable path record the trusted formula immediately after brew trust succeeds so both successful installation and all later failure exits remove that trust. Add behavioral regression coverage that asserts stable trust -> install/reinstall -> untrust, plus a stable install/reinstall failure case that proves the EXIT trap still untrusts. The current stable success fixture explicitly ends after install and therefore encodes the leak, while the cleanup tests cover only the dev/unverified path.
Because this installer operational template is protected by the base-trusted hash boundary, do not authorize the corrected template hash from this mutable PR. Land a separate trusted-base prerequisite for the corrected exact template, then update/rebase this PR onto it.
<!-- markdownlint-disable MD041 --> ## Summary Add the base-trusted installer transition needed for #7555 to make stable Homebrew formula trust temporary. The verifier now accepts the current installer plus the exact reviewed successor template and rejects the superseded template that could leave stable trust behind. ## Related Issue Related to #7451. ## Changes - Replace the superseded future normalized installer hash with the exact corrected successor hash `0fa737a64cf2a7a6a437dc5f203dad81f66f191dc316214c2f343f762ad9b0a5`, while retaining the current `main` hash for the transition. - Model successful stable-formula trust as temporary: record the trusted formula immediately, revoke it after installation, and preserve EXIT-trap revocation for failures. - Use the exact pending-untrust variable in the cleanup diagnostic. - Add a regression that reconstructs and rejects the superseded `ee10afa...` template, alongside the existing drift coverage. - Establish the trust anchor consumed by #7555. A direct change in #7555 is insufficient because the mutable installer cannot authorize its own successor template; the base-trusted verifier must recognize that exact operational contract first. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: this is a CI trust-anchor update for an exact future installer template; it does not change shipped runtime behavior. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: exact-head review of `69a2c57edde4c5986b35574bb414545a158e8cec` passed all nine repository security categories. The accepted set is exact and transitional, the insecure predecessor is denied by regression, and no secrets, authentication, dependencies, logging, cryptographic primitives, or runtime configuration are introduced. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `no-docs-needed` - Evidence: At exact merged head `69a2c57edde4c5986b35574bb414545a158e8cec`, reviewed the two-file installer trust-anchor diff. The corrected `0fa737a...` template revokes temporary stable-formula trust on success or failure, the superseded `ee10afa...` template is rejected, and the change creates no user-facing surface. The trusted hash check, 76 focused tests, CLI build, and `npm run check:diff` passed. - Agent: Codex Desktop <!-- docs-review-head-sha: 69a2c57 --> <!-- docs-review-agents-blob-sha: be20a09 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: `./node_modules/.bin/vitest run --project integration test/installer-hash-check.test.ts` (76 passed); `npm run build:cli` passed. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Charan Jagwani <cjagwani@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated installer trust verification to recognize the latest approved installer template. * Added validation for a Homebrew trust-transition scenario that leaves persistent trust behind, ensuring such installers are rejected. * Improved installer trust-transition checks and error handling for more reliable security validation. * **Tests** * Expanded coverage for installer template integrity and Homebrew trust cleanup behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Charan Jagwani <cjagwani@nvidia.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
Approved exact head 6cc2af1. Product scope PASS; all nine security categories PASS; prior persistent stable-trust finding and requested install/reinstall failure coverage are resolved. Focused installer/hash suite: 116 passed, 1 skipped. check:diff, growth scan, commit hooks, pre-push TypeScript, DCO, and GitHub signature verification pass. Documentation writer: no-docs-needed (AGENTS blob be20a0952).
prekshivyas
left a comment
prekshivyas
left a comment
There was a problem hiding this comment.
Reviewed exact head 6cc2af1 against base fdf14f5. The #7601/#7555 two-step installer trust transition is explicit and correctly completed: only the reviewed successor template remains trusted; checksum-verified stable formula trust is revoked on success and failure; dev trust is removed; cleanup fails closed. All nine security categories passed with no findings, focused installer/hash/ShellCheck validation passed, the exact documentation receipt passed, and all current required CI/E2E gates are green.
wscurran
added
area: install
5 participants
Summary
Current Homebrew rejects the checksum-pinned OpenShell formula after installation because its local tap is not trusted. Trust the verified stable formula before Homebrew loads it, remove that trust after installation, and fail closed if the trust boundary cannot be restored. Homebrew versions that predate trust enforcement retain their existing behavior.
The base-trusted installer-template transition required by this runtime fix landed in #7601.
Related Issue
Related to #7451.
This corrects the existing supported macOS Homebrew installer path; it does not create or expand a product surface.
Changes
brew trustafter the stable OpenShell formula digest passes verification.nvidia/openshell/openshell; fail closed if current Homebrew refuses the transition.brew untrustfails, return a failure and retain the temporary formula artifact so cleanup cannot hide an unresolved trust state.Type of Change
Quality Gates
6cc2af1a9391d82144f13a8f3cb0822e15ceb640; all nine required security-review categories passed with no findings. Stable trust follows pinned SHA-256 verification, the exact pending reference drives normal and EXIT cleanup, dev trust is removed, and cleanup fails closed without deleting the diagnostic artifact when untrust fails.Documentation Writer Review
no-docs-needed6cc2af1a9. No documentation paths changed. Existing documentation describes the supported Homebrew installation path without specifying transient formula trust state.DGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailable6cc2af1a9: installer hash integration 76 passed; installer integration 40 passed, 1 skipped; repository ShellCheck and the live installer hash checker passed.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: exact-head required CI/E2E gates passed;npm run check:installer-hashpassed locally at6cc2af1a9.npm run docsbuilds without warnings (doc changes only)Signed-off-by: Charan Jagwani cjagwani@nvidia.com
Summary by CodeRabbit
Bug Fixes
Tests
Chores