runspec-linux 0.17.0__tar.gz → 0.18.0__tar.gz

{runspec_linux-0.17.0 → runspec_linux-0.18.0}/CHANGELOG.md

@@ -1,5 +1,23 @@
 # runspec-linux Changelog
 
+## [0.18.0] — 2026-09-29
+
+### Added
+
+- **`create-venv` sets up the logs inbox** (`logs/inbox`, `01777`, owned by the
+  venv's owner). Operators' and root's runs of the venv's runnables then reach
+  its history with no group admin (runspec >= 0.66). `logs/` is owner-only
+  (`0755`) unless `--group` is given. `--no-inbox` keeps the pre-inbox `2775`
+  layout and writes a `.no-inbox` opt-out marker.
+- **`share-venv-logs` sets up the logs inbox** on an existing venv (run it with
+  `--run-as <owner>`). `--group` still adds the `2775` setgid group share, and
+  `--no-inbox` does only the group share, as before.
+
+### Changed
+
+- **`install-into-venv` keeps `logs/`'s mode** instead of forcing `2775`.
+- Requires `runspec-linux-core >= 0.12.0`.
+
 ## [0.17.0] — 2026-09-26
 
 ### Added

{runspec_linux-0.17.0 → runspec_linux-0.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: runspec-linux
-Version: 0.17.0
+Version: 0.18.0
 Summary: Linux system admin runnables for runspec
 Project-URL: Documentation, https://runspec.app/
 Project-URL: Source, https://github.com/jasonfinestone/runspec/tree/main/packages/python/runspec-linux
@@ -9,7 +9,7 @@ Project-URL: Issues, https://github.com/jasonfinestone/runspec/issues
 Keywords: linux,ops,runnable,runspec,ssh,sysadmin,venv
 Requires-Python: >=3.10
 Requires-Dist: runspec-fs-core>=0.5.0
-Requires-Dist: runspec-linux-core>=0.11.0
+Requires-Dist: runspec-linux-core>=0.12.0
 Requires-Dist: runspec-webops-core>=0.3.0
 Requires-Dist: runspec>=0.50.1
 Provides-Extra: dev

{runspec_linux-0.17.0 → runspec_linux-0.18.0}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux"
-version = "0.17.0"
+version = "0.18.0"
 requires-python = ">=3.10"
 description = "Linux system admin runnables for runspec"
 readme = "README.md"
 keywords = ["runspec", "runnable", "linux", "sysadmin", "ops", "ssh", "venv"]
 dependencies = [
     "runspec>=0.50.1",
-    "runspec-linux-core>=0.11.0",
+    "runspec-linux-core>=0.12.0",
     "runspec-webops-core>=0.3.0",
     "runspec-fs-core>=0.5.0",
 ]

{runspec_linux-0.17.0 → runspec_linux-0.18.0}/runspec_linux/runspec.toml

@@ -680,7 +680,7 @@ required    = false
 
 [create-venv]
 serve       = ["local"]
-description = "Create a Python virtualenv (always --symlinks) from a specific interpreter, optionally as a service account, with a shared 2775 logs/ dir"
+description = "Create a Python virtualenv (always --symlinks) from a specific interpreter, optionally as a service account, with a logs inbox so every account's runs reach its history"
 autonomy    = "confirm"
 output      = "json"
 
@@ -711,6 +711,11 @@ short       = "-g"
 description = "Optional shared group to chgrp the venv to (e.g. consoles), so every connected console can read/write"
 required    = false
 
+[create-venv.args.no-inbox]
+type        = "flag"
+description = "Don't set up the logs inbox (logs/inbox, 01777) — keep the pre-inbox layout (logs/ 2775) and write a logs/.no-inbox opt-out marker. Default: the inbox is created, so operators' and root's runs reach this venv's history with no group admin (runspec >= 0.66)"
+default     = false
+
 [create-venv.args.system-site-packages]
 type        = "flag"
 description = "Give the venv access to the system site-packages"
@@ -862,12 +867,13 @@ description = "How to escalate to run-as: sudo (passwordless, -n) or su"
 
 [share-venv-logs]
 serve       = ["local"]
-description = "Make an existing venv's logs/ dir shared (2775 + setgid, optional chgrp) so the per-venv runs DB and audit logs are writable across a console group — the repair for a venv not built with create-venv --group"
+description = "Make an existing venv's logs shared: set up the logs inbox (logs/inbox, 01777) so every account's runs reach its history — plus, with --group, the 2775 setgid group share. Run as the venv owner (--run-as)"
 autonomy    = "confirm"
 output      = "json"
 
 examples = [
-  {cmd = "share-venv-logs --venv /opt/venvs/app",                            description = "Make /opt/venvs/app/logs group-writable + setgid (keeps its current group)"},
+  {cmd = "share-venv-logs --venv /opt/venvs/app --run-as svc",               description = "Set up the logs inbox as the venv's owner — the recommended setup"},
+  {cmd = "share-venv-logs --venv /opt/venvs/app --no-inbox",                 description = "The pre-inbox group share only: logs/ group-writable + setgid"},
   {cmd = "share-venv-logs --venv /opt/venvs/app --group consoles",           description = "...and chgrp the logs dir to the shared 'consoles' group"},
   {cmd = "share-venv-logs --venv /opt/venvs/app --group consoles --run-as svc", description = "Run as the service account that owns the venv (via sudo -n -u)"},
 ]
@@ -884,6 +890,11 @@ short       = "-g"
 description = "Optional shared group to chgrp the logs/ dir to (e.g. consoles), so every connected console can read/write. Omit to keep the current group"
 required    = false
 
+[share-venv-logs.args.no-inbox]
+type        = "flag"
+description = "Skip the logs inbox — only the group share (logs/ 2775 setgid, optional chgrp)"
+default     = false
+
 [share-venv-logs.args.run-as]
 type        = "str"
 short       = "-u"

{runspec_linux-0.17.0 → runspec_linux-0.18.0}/runspec_linux/venvs.py

@@ -19,6 +19,7 @@ def main_create_venv() -> None:
             upgrade_deps=spec.upgrade_deps.value,
             clear=spec.clear.value,
             prompt=spec.prompt.value or None,
+            inbox=not spec.no_inbox.value,
         )
         print(json.dumps(result))
     except CommandError as e:
@@ -62,6 +63,7 @@ def main_share_venv_logs() -> None:
             group=spec.group.value or None,
             run_as=spec.run_as.value or None,
             become_method=spec.become_method.value,
+            inbox=not spec.no_inbox.value,
         )
         print(json.dumps(result))
     except CommandError as e: