microsandbox-rb 0.13.0 → 0.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7f062583f2c7fd83962ad03246dfbf6ad8c86be39756f75cf61c7c4a5e96d09e
-  data.tar.gz: 23cc401545bb10273d470af66f182f06e9c0be6956ccace5dc6d2b43de93c92d
+  metadata.gz: 241dfe5d94b8c98d3c790994698b004a591d66229d9965799fc5886b01e5a19d
+  data.tar.gz: a134b4cbb4b58a60d72d6a7ace30ab6333da4057d0868c1a6e351396b7ff4d00
 SHA512:
-  metadata.gz: b95c8b95460e7fdf03d95241e4e8d3c028a9656e00aeaefa7df28f387c7caaddecc767fae14bb82871d55074f7b24b841d739497cfbd430559c4cf9e8427214c
-  data.tar.gz: f780f6378522e1296eae3914687f7b77e534068f7c30b194f56603234920fff951dde5fade2201e5b94dd04ca3dc9a356f287c51339c694477aa6ff56ca90dfc
+  metadata.gz: c326c0481781ae1f3fc19994dfd8e4c004c4bdc8aa81b33e67386538f4fa9ff58cb84514955079c39daa09817c8eba65ac7d4ebe91ab34698ac5fce8cfa9c574
+  data.tar.gz: 1d93018f5982d2767cd66e29c50a195a3d138d7f60f93a2a3e6020384f41ce843e3a0b85d5152a2d17995a724ed9cc6169e72c0bcfc506017e7ae84b3acbe73f

data/CHANGELOG.md

@@ -6,6 +6,106 @@ All notable changes to this gem are documented here. The format is based on
 microsandbox runtime it embeds; each release notes the upstream runtime tag it
 wraps, and the README's Versioning section keeps the full gem→runtime map.
 
+## [0.15.0] - 2026-08-24
+
+Adopts upstream runtime **`v0.6.9` → `v0.6.14`**, stepping through every
+intermediate tag (v0.6.10, v0.6.11, v0.6.12, v0.6.13 each verified and
+committed individually).
+
+### Added
+
+- `ssh.open_client` and `ssh.prepare_server` accept `inactivity_timeout:` —
+  a per-session SSH inactivity timeout in seconds (upstream #1341, `v0.6.10`).
+  `nil` (the default) inherits the global config (600s out of the box), `0`
+  disables the timeout, and a negative or non-finite value raises
+  `ArgumentError`, matching the Python binding's `ValueError` semantics. The
+  SSH inactivity timeout stays separate from the sandbox lifecycle
+  `idle_timeout`.
+
+### Changed
+
+- Upstream runtime highlights carried without further Ruby surface:
+  - `v0.6.10` — bind-mount correctness (contained rootfs patches, parent-first
+    nested destinations, path formatting), guest bootstrap moved off the kernel
+    command line, DNS pins required for deferred domain allows, host-loopback
+    family fallback, configurable global ssh inactivity timeout.
+  - `v0.6.11` / `v0.6.12` — release-pipeline fixes (Linux glibc baseline
+    lowered to 2.28; bundled `msb` executable mode preserved), reflected in the
+    prebuilt bundles the companion binaries gem vendors.
+  - `v0.6.13` — legacy ext4 upper-disk resize support; temporary exec
+    sandboxes stopped on errors; `LocalBackendBuilder::try_build_lazy()` added
+    upstream (embedding-host API — not adopted here, matching the Python
+    binding; the ext stays on `LocalBackend::lazy()`).
+  - `v0.6.14` — `msb_krun` VMM stack bumped to 0.1.32.
+
+## [0.14.0] - 2026-08-24
+
+Runtime tag unchanged — still upstream **`v0.6.9`**.
+
+### Added
+
+- **Companion gem `microsandbox-rb-binaries`** (source in `binaries/`): the
+  prebuilt `msb` microVM runtime and the `libkrunfw` firmware, shipped as one
+  gem per platform (`arm64-darwin`, `x86_64-linux-gnu`, `aarch64-linux-gnu`;
+  the Linux binaries are glibc-linked, hence `required_rubygems_version >=
+  3.3.11`). Install it alongside `microsandbox-rb` at the same version and your
+  bundle carries the runtime instead of downloading it into `~/.microsandbox`
+  on first use. There is no dependency edge in either direction — RubyGems has
+  no optional dependencies, and cloud-only users should not be made to fetch
+  ~50 MB of binaries. Motivated by upstream
+  [superradcompany/microsandbox#1305](https://github.com/superradcompany/microsandbox/issues/1305).
+- **A new tier in the runtime resolver.** `require "microsandbox"` activates the
+  companion gem (if installed at the same version and built for the same
+  upstream runtime) and hands
+  its `msb` to the core's set-once SDK slot; the firmware is found by the
+  runtime's `../lib` adjacency, exactly as in the Python/Node SDKs. The
+  effective order is now `MSB_PATH` → `microsandbox-rb-binaries` → config file →
+  `~/.microsandbox/bin/msb` → `msb` on `PATH`, and
+  `Microsandbox.runtime_path` reports the winner. Activation never raises: a
+  missing gem is silent, and a gem built for a *different* runtime is reported
+  with a warning and skipped rather than handed to the core.
+- **Lock-step guard for the new gem.** `Microsandbox::Binaries::VERSION` must
+  equal `Microsandbox::VERSION` and `Microsandbox::Binaries::RUNTIME_VERSION`
+  must equal `Microsandbox::RUNTIME_VERSION`; `spec/unit/version_spec.rb`
+  asserts both, so a stale companion can't ship.
+- **Vendoring/build pipeline** for the companion gem:
+  `rake -C binaries vendor[<platform>]` downloads the upstream release bundle and
+  verifies every file against that release's `checksums.sha256` as committed
+  in `binaries/checksums/<tag>.sha256` (fail-closed — a missing entry, a digest
+  mismatch, an unexpected file, or a live release file that disagrees with the
+  committed one aborts), `rake -C binaries build[<platform>]` re-verifies the staged tree
+  against its manifest before packaging, `rake -C binaries verify` runs the
+  vendored `msb` on the host, and `vendor:all` covers every platform from any
+  host. CI builds all three platform gems on every run, and `release.yml`
+  builds and publishes them on each version tag in a separate
+  `publish-binaries` job that runs after the SDK gem is live (a companion-gem
+  failure is its own red job and never blocks the SDK release; re-runs are
+  idempotent). The companion gem has its own RubyGems trusted-publisher entry.
+
+### Changed
+
+- **The SDK gem is now SDK-only: nothing is provisioned at build or install
+  time.** The core crate's default `prebuilt` feature — whose `build.rs`
+  downloaded the *host* runtime into `~/.microsandbox` while compiling the
+  extension — is off (`default-features = false`, features `keyring`, `net`,
+  `ssh`, matching the official SDKs). The *guest* agent `agentd` is still
+  embedded into the extension at build time, via a direct
+  `microsandbox-runtime` dependency with just the `prebuilt` sub-feature that
+  fetches it. Host runtime provisioning is now the companion gem's job, with the
+  first-use download as fallback.
+- **`Microsandbox.runtime_path=` is a no-op when the companion gem is active** —
+  it targets the same set-once slot the gem already claimed at load time. Use
+  the `MSB_PATH` environment variable to override a bundled runtime.
+- **`Microsandbox.ensure_runtime!` skips the installer entirely** when the
+  resolved runtime is the companion gem's `msb`: those binaries are already the
+  matching version, so nothing is downloaded or touched in `~/.microsandbox`.
+  Without the gem, behaviour is unchanged — the version-correcting first-use
+  download into `~/.microsandbox` remains the lowest tier, still opt-out-able
+  with `MICROSANDBOX_NO_AUTO_INSTALL`.
+- `Gemfile` now uses `gemspec glob: "{,*}.gemspec"` so Bundler resolves only the
+  root gemspec; its default glob would also evaluate the nested
+  `binaries/microsandbox-rb-binaries.gemspec` in every `bundle exec` process.
+
 ## [0.13.0] - 2026-08-18
 
 Adopts upstream runtime **`v0.6.8` → `v0.6.9`**.
@@ -963,7 +1063,8 @@ microsandbox runtime, aligned with the official Python/Node/Go SDKs.
   core crate has Apple-native deps). Until precompiled gems are published,
   installing from source requires a Rust toolchain (stable >= 1.91).
 
-[Unreleased]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.9.0...HEAD
+[Unreleased]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.14.0...HEAD
+[0.14.0]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.13.0...v0.14.0
 [0.9.0]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.8.2...v0.9.0
 [0.8.2]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.8.1...v0.8.2
 [0.8.1]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.8.0...v0.8.1