Repository navigation
Conversation
… backport) Backport the CI hardening that main received for the eMudhra/emSign CA key compromise (CVE-2026-111943, CVE-2026-115557), so that wheels released from this branch, and the cuda-core wheels on main that are built against this branch's cuda-bindings wheels, are built with patched tooling and verified downloads: - upgrade-ca-certificates: upgrade ca-certificates on GitHub-hosted Linux and distrust the compromised intermediates on GitHub-hosted Windows, as the first step of build-wheel.yml (NVIDIA#3270). - setup-hardened-python: install interpreters with a pinned uv and fail on unpatched ones, replacing actions/setup-python + harden-pip in build-wheel.yml and test-wheel-{linux,windows}.yml (NVIDIA#3275). This branch still builds and tests Python 3.10, which has no fixed release; for series older than 3.11 the action warns and installs pip from the sha256-pinned 26.2.2 wheel instead of failing. cibuildwheel now runs with the hardened host Python (`python-path`), and the Python include path is derived from sysconfig because uv interpreters are not at Python3_ROOT_DIR. - cibuildwheel: install the sha256-pinned pip 26.2.2 in CIBW_BEFORE_BUILD_LINUX and CIBW_BEFORE_BUILD_WINDOWS before anything else is downloaded (Linux had no before-build step; Windows ran an unpinned `pip install delvewheel`). - fetch_ctk: verify the CTK redistrib JSON against a pinned sha256 and every component archive against the sha256 in that JSON before extracting it, failing closed on a mismatch (ci/tools/fetch_ctk_redistrib.py, with tests). Also stop passing `-k` to curl, which disabled TLS verification for the archive downloads. - install_gpu_driver.ps1: verify the fixed Windows driver installer against a pinned sha256 before running it as admin (NVIDIA#3249 for this branch's single installer). This branch has no sccache and no Linux driver install script, so the install-sccache action and the Linux part of NVIDIA#3249 do not apply. Not backported: the runner trust probe and the "Enable Git symlinks" steps. Refs NVIDIA#3195
Contributor
Contributor
Author
|
/ok to test 09b94e2 |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Refs #3195
Backports the CI hardening that
mainreceived for the eMudhra/emSign CA key compromise (CVE-2026-111943, CVE-2026-115557) to12.9.x. The cuda-bindings wheels built here are also consumed bymain, whose previous-CUDA-major cuda-core wheel is built against the latest12.9.xCI run, so this branch's build workflow affectsmainreleases as well.upgrade-ca-certificatesaction: first step ofbuild-wheel.yml(CI: add eMudhra/emSign CA stopgap for GitHub-hosted Windows runners #3270).setup-hardened-pythonaction: replacesactions/setup-pythonplusharden-pipinbuild-wheel.ymlandtest-wheel-{linux,windows}.yml(CI: install eMudhra-fixed Pythons with a pinned uv #3275). This branch still builds and tests Python 3.10, which has no fixed release, so for series older than 3.11 the action warns and installs the sha256-pinned pip 26.2.2 wheel instead of failing. The Python include path is derived fromsysconfigbecause uv interpreters are not atPython3_ROOT_DIR. cibuildwheel now runs with the hardened host Python (python-path).CIBW_BEFORE_BUILD_LINUXandCIBW_BEFORE_BUILD_WINDOWSbefore anything else is downloaded. Linux had no before-build step and Windows ran an unpinnedpip install delvewheel.fetch_ctk: verify the CTK redistrib JSON against a pinned sha256 and each component archive against the sha256 in that JSON before extracting it, failing closed on a mismatch (newci/tools/fetch_ctk_redistrib.py, with unit tests). The curl download no longer passes-k, which disabled TLS verification. Pinned versions: 11.8.0, 12.0.1, 12.6.3, 12.9.1, 13.0.1, 13.0.2 and 13.4.2; unpinned versions only warn.install_gpu_driver.ps1: verify the fixed Windows driver installer against a pinned sha256 before running it as admin (CI: verify GPU driver installer SHA-256 before execution #3249, for this branch's single installer).This branch has no sccache and no Linux driver install script, so
install-sccacheand the Linux part of #3249 do not apply. Not backported: the runner trust probe and the "Enable Git symlinks" steps.Notes for reviewers
The
harden-pipaction is removed becausesetup-hardened-pythonsubsumes it. This branch keeps the pip frontend in cibuildwheel and fixes pip instead of switching tobuild[uv].Validation: the new unit tests pass locally, the pre-commit hooks pass, and the pinned redistrib hashes were re-checked against the live JSONs (the 12.9.1 hash matches the one pinned on
13.4.x). The driver installer hash was computed from two independent downloads that agree. The workflow changes have not run on GitHub Actions yet, so CI on this PR is the real test, in particular the Windows jobs and the Python 3.10 fallback.Checklist