Skip to content

Commit 24d3556

Browse files
rluo8rluo8
authored
Merge branch 'main' into fix/dlpack-derived-view-owner
2 parents 7952575 + ddc2a2a commit 24d3556

32 files changed

Lines changed: 3360 additions & 2341 deletions

‎.github/actions/upgrade-ca-certificates/emudhra_intermediates.ps1‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,3 +69,56 @@ function Test-ExplicitlyDistrusted([System.Security.Cryptography.X509Certificate
6969
$chain.Dispose()
7070
}
7171
}
72+
73+
# Classifies how Windows chain building treats the certificate, using only the
74+
# local trust state (no revocation, no AIA downloads):
75+
# ExplicitDistrust : in LocalMachine\Disallowed or Microsoft's disallowed list
76+
# NoTrustAnchor : the chain no longer ends in a trusted root, and
77+
# UntrustedRoot / PartialChain are the only problems
78+
# reported, e.g. because the root was removed
79+
# Trusted : the chain builds cleanly, so the compromised key is usable
80+
# Indeterminate : the build failed for some other reason; never a pass
81+
# Verification time is pinned (the instant used by runner_trust_probe.sh) so an
82+
# expired certificate cannot masquerade as untrusted.
83+
# A PartialChain only shows that the root is untrusted if the issuers are
84+
# available to the build, so callers pass the non-root issuers in
85+
# $ExtraCertificates. Issuers that are roots need not be supplied: a missing
86+
# root is exactly the condition this function reports as NoTrustAnchor.
87+
function Get-ChainTrustState(
88+
[System.Security.Cryptography.X509Certificates.X509Certificate2]$Cert,
89+
[System.Security.Cryptography.X509Certificates.X509Certificate2[]]$ExtraCertificates = @()
90+
) {
91+
$explicitDistrust = [System.Security.Cryptography.X509Certificates.X509ChainStatusFlags]::ExplicitDistrust
92+
$noAnchor = [int]([System.Security.Cryptography.X509Certificates.X509ChainStatusFlags]::UntrustedRoot -bor
93+
[System.Security.Cryptography.X509Certificates.X509ChainStatusFlags]::PartialChain)
94+
$chain = [System.Security.Cryptography.X509Certificates.X509Chain]::new()
95+
try {
96+
foreach ($extra in $ExtraCertificates) {
97+
[void]$chain.ChainPolicy.ExtraStore.Add($extra)
98+
}
99+
$chain.ChainPolicy.RevocationMode = [System.Security.Cryptography.X509Certificates.X509RevocationMode]::NoCheck
100+
$chain.ChainPolicy.VerificationTime = [DateTime]::new(2026, 10, 23, 0, 0, 0, [DateTimeKind]::Utc)
101+
# DisableCertificateDownloads does not exist on .NET Framework (Windows PowerShell 5.1).
102+
if ($chain.ChainPolicy | Get-Member -Name DisableCertificateDownloads) {
103+
$chain.ChainPolicy.DisableCertificateDownloads = $true
104+
}
105+
$built = $chain.Build($Cert)
106+
$statuses = @($chain.ChainStatus) + @($chain.ChainElements | ForEach-Object { $_.ChainElementStatus })
107+
$names = @($statuses | ForEach-Object { $_.Status.ToString() } | Where-Object { $_ -ne 'NoError' } | Sort-Object -Unique)
108+
if ($statuses | Where-Object { $_.Status.HasFlag($explicitDistrust) }) {
109+
$state = 'ExplicitDistrust'
110+
} elseif ($built) {
111+
$state = 'Trusted'
112+
} elseif (
113+
($statuses | Where-Object { ([int]$_.Status -band $noAnchor) -ne 0 }) -and
114+
-not ($statuses | Where-Object { ([int]$_.Status -band (-bnot $noAnchor)) -ne 0 })
115+
) {
116+
$state = 'NoTrustAnchor'
117+
} else {
118+
$state = 'Indeterminate'
119+
}
120+
return [pscustomobject]@{ State = $state; Statuses = ($names -join ',') }
121+
} finally {
122+
$chain.Dispose()
123+
}
124+
}

‎.spdx-ignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,4 @@ cuda_core/cuda/**/*.pyi
2424

2525
# Third-party eMudhra disclosure data, kept byte-identical to the published files
2626
ci/tools/runner_trust_probe_chains/**
27+
ci/tools/runner_trust_probe_issuers/**

‎ci/tools/runner_trust_probe.ps1‎

Lines changed: 81 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -47,62 +47,107 @@ $inDisallowed = [bool](Get-ChildItem -Path 'Cert:\LocalMachine\Disallowed' -Erro
4747
Where-Object { (Get-CertificateSha256 $_) -eq $EmSignG3Hex })
4848
Record-Check 'emSign ECC Root CA - G3 store state' 'INFO' "LocalMachine\Root=$inRoot ($($rootCerts.Count) certs), LocalMachine\Disallowed=$inDisallowed"
4949

50-
# 2. All compromised intermediates and cross-signs explicitly distrusted (gating)
50+
# 2. No compromised intermediate or cross-sign is usable as a trust path (gating).
51+
# Pass = explicitly distrusted, or the chain no longer reaches a trusted root
52+
# (the hosted images have removed the roots rather than enabling the disallowed CTL).
5153
$certs = @(Get-EmudhraIntermediates)
54+
# Supply the non-root issuers so a missing parent is not mistaken for a missing trust
55+
# anchor: emSign Root TLS CA - G3 comes with the vendored host chains, and
56+
# emSign Root CS CA - G3 (cross-signed by emSign ECC Root CA - G3) with the issuers.
57+
$issuerCerts = @()
58+
foreach ($dirName in 'runner_trust_probe_chains', 'runner_trust_probe_issuers') {
59+
$found = @(
60+
Get-ChildItem -LiteralPath (Join-Path $PSScriptRoot $dirName) -Filter '*.pem' |
61+
ForEach-Object {
62+
[regex]::Matches((Get-Content -LiteralPath $_.FullName -Raw), '-----BEGIN CERTIFICATE-----([^-]+)-----END CERTIFICATE-----') |
63+
ForEach-Object {
64+
[System.Security.Cryptography.X509Certificates.X509Certificate2]::new([System.Convert]::FromBase64String(($_.Groups[1].Value -replace '\s', '')))
65+
}
66+
}
67+
)
68+
if ($found.Count -eq 0) {
69+
throw "No certificates found in $PSScriptRoot\$dirName."
70+
}
71+
$issuerCerts += $found
72+
}
73+
$usable = @()
74+
$states = @()
75+
$statusNames = @()
5276
try {
53-
$notDistrusted = @($certs | Where-Object { -not (Test-ExplicitlyDistrusted $_) } | ForEach-Object { $_.EmudhraLabel })
77+
foreach ($c in $certs) {
78+
$r = Get-ChainTrustState $c $issuerCerts
79+
$states += $r.State
80+
$statusNames += $r.Statuses -split ',' | Where-Object { $_ }
81+
if ($r.State -notin @('ExplicitDistrust', 'NoTrustAnchor')) {
82+
$usable += "$($c.EmudhraLabel) [$($r.State): $($r.Statuses)]"
83+
}
84+
}
5485
} finally {
5586
$certs | ForEach-Object { $_.Dispose() }
87+
$issuerCerts | ForEach-Object { $_.Dispose() }
5688
}
57-
if ($notDistrusted.Count -eq 0) {
58-
Record-Check 'Compromised intermediates distrusted' 'PASS' "All $($certs.Count) explicitly distrusted"
89+
$counts = ($states | Group-Object | ForEach-Object { "$($_.Name)=$($_.Count)" }) -join ', '
90+
$flags = ($statusNames | Sort-Object -Unique) -join ','
91+
if ($usable.Count -eq 0) {
92+
Record-Check 'Compromised intermediates distrusted' 'PASS' "All $($certs.Count) rejected ($counts; chain status: $flags)"
5993
} else {
60-
Record-Check 'Compromised intermediates distrusted' 'FAIL' "$($notDistrusted.Count) of $($certs.Count) not explicitly distrusted: $($notDistrusted -join '; ')"
94+
Record-Check 'Compromised intermediates distrusted' 'FAIL' "$($usable.Count) of $($certs.Count) usable or indeterminate: $($usable -join '; ')"
6195
$GatingFailures++
6296
}
6397

64-
# 3. OS-store client (Invoke-WebRequest) rejects each test endpoint (only a successful connection fails the job).
98+
# 3. OS-store client (Invoke-WebRequest) rejects each test endpoint (a successful connection, or no verdict after a retry, fails the job).
6599
# -SkipHttpErrorCheck is PowerShell 7+ only, so HTTP error statuses are caught below instead:
66100
# any response at all means the TLS handshake (and thus the certificate chain) succeeded.
67101
$progTmp = $ProgressPreference
68102
$ProgressPreference = 'SilentlyContinue'
69103
try {
70104
foreach ($endpoint in $TestEndpoints) {
71105
$checkName = "Invoke-WebRequest rejects ``$endpoint``"
72-
try {
73-
$res = Invoke-WebRequest -Uri $endpoint -UseBasicParsing -TimeoutSec 15
74-
Record-Check $checkName 'FAIL' "Connection succeeded with HTTP $($res.StatusCode) (certificate was trusted)"
75-
$GatingFailures++
76-
} catch {
77-
if ($null -ne $_.Exception.Response) {
78-
Record-Check $checkName 'FAIL' "Connection succeeded with HTTP $([int]$_.Exception.Response.StatusCode) (certificate was trusted)"
106+
# Retry non-certificate/network errors once; if the second attempt also fails,
107+
# the probe could not show that the certificate is rejected, so the check fails.
108+
for ($attempt = 1; $attempt -le 2; $attempt++) {
109+
try {
110+
$res = Invoke-WebRequest -Uri $endpoint -UseBasicParsing -TimeoutSec 15
111+
Record-Check $checkName 'FAIL' "Connection succeeded with HTTP $($res.StatusCode) (certificate was trusted)"
79112
$GatingFailures++
80-
continue
81-
}
82-
$certRejected = $false
83-
$hostnameMismatchOnly = $false
84-
$ex = $_.Exception
85-
while ($null -ne $ex) {
86-
if (
87-
($ex -is [System.Security.Authentication.AuthenticationException] -and $ex.Message -match 'certificate chain|UntrustedRoot|RemoteCertificateChainErrors') -or
88-
($ex -is [System.Net.WebException] -and $ex.Status -eq [System.Net.WebExceptionStatus]::TrustFailure)
89-
) {
90-
$certRejected = $true
113+
break
114+
} catch {
115+
if ($null -ne $_.Exception.Response) {
116+
Record-Check $checkName 'FAIL' "Connection succeeded with HTTP $([int]$_.Exception.Response.StatusCode) (certificate was trusted)"
117+
$GatingFailures++
91118
break
92119
}
93-
if ($ex -is [System.Security.Authentication.AuthenticationException] -and $ex.Message -match 'RemoteCertificateNameMismatch') {
94-
$hostnameMismatchOnly = $true
120+
$certRejected = $false
121+
$hostnameMismatchOnly = $false
122+
$ex = $_.Exception
123+
while ($null -ne $ex) {
124+
if (
125+
($ex -is [System.Security.Authentication.AuthenticationException] -and $ex.Message -match 'certificate chain|UntrustedRoot|RemoteCertificateChainErrors') -or
126+
($ex -is [System.Net.WebException] -and $ex.Status -eq [System.Net.WebExceptionStatus]::TrustFailure)
127+
) {
128+
$certRejected = $true
129+
break
130+
}
131+
if ($ex -is [System.Security.Authentication.AuthenticationException] -and $ex.Message -match 'RemoteCertificateNameMismatch') {
132+
$hostnameMismatchOnly = $true
133+
}
134+
$ex = $ex.InnerException
135+
}
136+
$cleanMsg = ($_.Exception.Message -replace '[\r\n]+', ' ' -replace '\|', '\|')
137+
if ($certRejected) {
138+
Record-Check $checkName 'PASS' "Rejected with certificate validation error ($cleanMsg)"
139+
break
140+
} elseif ($hostnameMismatchOnly) {
141+
Record-Check $checkName 'FAIL' "Certificate chain was trusted; failed only hostname check ($cleanMsg)"
142+
$GatingFailures++
143+
break
144+
} elseif ($attempt -lt 2) {
145+
Write-Output "[INFO] ${checkName}: attempt $attempt failed with a non-certificate or network error ($cleanMsg); retrying"
146+
Start-Sleep -Seconds 5
147+
} else {
148+
Record-Check $checkName 'FAIL' "Could not determine whether the certificate is rejected after $attempt attempts: non-certificate or network error ($cleanMsg)"
149+
$GatingFailures++
95150
}
96-
$ex = $ex.InnerException
97-
}
98-
$cleanMsg = ($_.Exception.Message -replace '[\r\n]+', ' ' -replace '\|', '\|')
99-
if ($certRejected) {
100-
Record-Check $checkName 'PASS' "Rejected with certificate validation error ($cleanMsg)"
101-
} elseif ($hostnameMismatchOnly) {
102-
Record-Check $checkName 'FAIL' "Certificate chain was trusted; failed only hostname check ($cleanMsg)"
103-
$GatingFailures++
104-
} else {
105-
Record-Check $checkName 'INCONCLUSIVE' "Non-certificate or network error ($cleanMsg)"
106151
}
107152
}
108153
}

‎ci/tools/runner_trust_probe_issuers/README.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
Issuer certificates for the Windows runner trust probe
2+
======================================================
3+
4+
ci/tools/runner_trust_probe.ps1 passes these certificates to Windows chain
5+
building, together with the chains in ../runner_trust_probe_chains, so a missing
6+
parent certificate is not mistaken for a missing trust anchor.
7+
8+
emsign-root-cs-ca-g3-cross.pem
9+
emSign Root CS CA - G3, issued by emSign ECC Root CA - G3 (the
10+
cross-certificate of the self-signed emSign Root CS CA - G3). It is the
11+
issuer of the two native code-signing intermediates (EM OV CS CA - G3B
12+
and G3C), which the test hosts' chains do not cover.
13+
14+
Source: https://repository.emsign.com/certs/crosssign/rootcscag3.crt
15+
(DER; converted to PEM without other changes)
16+
SHA-256: 7137FA71AD46BA686F746D1014AC57E8E6C6E9AF4AA2F73C0C44A5CF27DEBB59
17+
Valid: 2024-07-11 to 2039-07-09
18+
Checked: same public key as the self-signed emSign Root CS CA - G3, and
19+
its key verifies the signatures of both code-signing
20+
intermediates in impacted-intermediates.json.

‎ci/tools/runner_trust_probe_issuers/emsign-root-cs-ca-g3-cross.pem‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDaDCCAu2gAwIBAgIPFMZ1TpPl2UxjjT/JD612MAoGCCqGSM49BAMDMGsxCzAJ
3+
BgNVBAYTAklOMRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJh
4+
IFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDExdlbVNpZ24gRUNDIFJvb3Qg
5+
Q0EgLSBHMzAeFw0yNDA3MTExNjEwMzBaFw0zOTA3MDkxODMwMDBaMFUxCzAJBgNV
6+
BAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMR8w
7+
HQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMHYwEAYHKoZIzj0CAQYFK4EE
8+
ACIDYgAESl9kM5D0VA/Og76dz5Xzw1hnGQ4fSR9993/qBkkvI48pXQVKOdyHCgAZ
9+
ThgWejQ8OpFRiTISjpabn4tfRFOYuzhApR/XxGbkg9X+2cEtbyghF9CdoF91W22V
10+
/R2EVe4xo4IBazCCAWcwHwYDVR0jBBgwFoAUfF0ChBPUzIqbgc4XHC4pHpxIY0Iw
11+
HQYDVR0OBBYEFGh0A/iFyo1UUFcdFuDI3kUNq80tMBMGA1UdJQQMMAoGCCsGAQUF
12+
BwMDMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwOi8vcmVw
13+
b3NpdG9yeS5lbXNpZ24uY29tMHgGCCsGAQUFBwEBBGwwajAiBggrBgEFBQcwAYYW
14+
aHR0cDovL29jc3AuZW1zaWduLmNvbTBEBggrBgEFBQcwAoY4aHR0cDovL3JlcG9z
15+
aXRvcnkuZW1zaWduLmNvbS9jZXJ0cy9lbVNpZ25FQ0NSb290Q0FHMy5jcnQwMwYD
16+
VR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5lbXNpZ24uY29tP1Jvb3RDQUczLmNy
17+
bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAKBggqhkjOPQQD
18+
AwNpADBmAjEAuFH6M20dolyKkZ9AD7DsgJyo8MkQTAc05niLQzoyqo60+mYdtseW
19+
P2tOfXULs3XBAjEA7r4peOh9eWi+vDbjD8kB2lxRGYW2n/I2+KTLKYAOzp/9GBmx
20+
x0cnzyQU+QX3koAd
21+
-----END CERTIFICATE-----

‎cuda_bindings_12/cuda/bindings/_internal/driver_linux.pyx‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# SPDX-License-Identifier: Apache-2.0
44
#
55
# This code was automatically generated with version 12.9.0. Do not modify it directly.
6-
# CYTHON-BINDINGS-GENERATED-DO-NOT-MODIFY-THIS-FILE: format=1; content-sha256=c4957d188c7c3258823fd50e2eb0cba162810911af7294ab726f1e49769642c8
6+
# CYTHON-BINDINGS-GENERATED-DO-NOT-MODIFY-THIS-FILE: format=1; content-sha256=d382464130e581b718a589e652053c30057e65ddc824b2c79a903341858f1e88
77

88

99
# <<<< PREAMBLE CONTENT >>>>
@@ -1894,19 +1894,19 @@ cdef int _init_driver() except -1 nogil:
18941894
cuGetProcAddress_v2('cuGreenCtxStreamCreate', <void **>&__cuGreenCtxStreamCreate, 12050, ptds_mode, NULL)
18951895

18961896
global __cuLogsRegisterCallback
1897-
cuGetProcAddress_v2('cuLogsRegisterCallback', <void **>&__cuLogsRegisterCallback, 12080, ptds_mode, NULL)
1897+
cuGetProcAddress_v2('cuLogsRegisterCallback', <void **>&__cuLogsRegisterCallback, 12090, ptds_mode, NULL)
18981898

18991899
global __cuLogsUnregisterCallback
1900-
cuGetProcAddress_v2('cuLogsUnregisterCallback', <void **>&__cuLogsUnregisterCallback, 12080, ptds_mode, NULL)
1900+
cuGetProcAddress_v2('cuLogsUnregisterCallback', <void **>&__cuLogsUnregisterCallback, 12090, ptds_mode, NULL)
19011901

19021902
global __cuLogsCurrent
1903-
cuGetProcAddress_v2('cuLogsCurrent', <void **>&__cuLogsCurrent, 12080, ptds_mode, NULL)
1903+
cuGetProcAddress_v2('cuLogsCurrent', <void **>&__cuLogsCurrent, 12090, ptds_mode, NULL)
19041904

19051905
global __cuLogsDumpToFile
1906-
cuGetProcAddress_v2('cuLogsDumpToFile', <void **>&__cuLogsDumpToFile, 12080, ptds_mode, NULL)
1906+
cuGetProcAddress_v2('cuLogsDumpToFile', <void **>&__cuLogsDumpToFile, 12090, ptds_mode, NULL)
19071907

19081908
global __cuLogsDumpToMemory
1909-
cuGetProcAddress_v2('cuLogsDumpToMemory', <void **>&__cuLogsDumpToMemory, 12080, ptds_mode, NULL)
1909+
cuGetProcAddress_v2('cuLogsDumpToMemory', <void **>&__cuLogsDumpToMemory, 12090, ptds_mode, NULL)
19101910

19111911
global __cuCheckpointProcessGetRestoreThreadId
19121912
cuGetProcAddress_v2('cuCheckpointProcessGetRestoreThreadId', <void **>&__cuCheckpointProcessGetRestoreThreadId, 12080, ptds_mode, NULL)

‎cuda_bindings_12/cuda/bindings/_internal/driver_windows.pyx‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# SPDX-License-Identifier: Apache-2.0
44
#
55
# This code was automatically generated with version 12.9.0. Do not modify it directly.
6-
# CYTHON-BINDINGS-GENERATED-DO-NOT-MODIFY-THIS-FILE: format=1; content-sha256=d36a59b7d4c8939f88b07a4600cbd4251a2ed69571b425bb6009a626cfd4dc3e
6+
# CYTHON-BINDINGS-GENERATED-DO-NOT-MODIFY-THIS-FILE: format=1; content-sha256=895c345db6512915d2c6c9f27757175413ce053e7356b6eeb890478159cdc918
77

88

99
# <<<< PREAMBLE CONTENT >>>>
@@ -1897,19 +1897,19 @@ cdef int _init_driver() except -1 nogil:
18971897
cuGetProcAddress_v2('cuGreenCtxStreamCreate', <void **>&__cuGreenCtxStreamCreate, 12050, ptds_mode, NULL)
18981898

18991899
global __cuLogsRegisterCallback
1900-
cuGetProcAddress_v2('cuLogsRegisterCallback', <void **>&__cuLogsRegisterCallback, 12080, ptds_mode, NULL)
1900+
cuGetProcAddress_v2('cuLogsRegisterCallback', <void **>&__cuLogsRegisterCallback, 12090, ptds_mode, NULL)
19011901

19021902
global __cuLogsUnregisterCallback
1903-
cuGetProcAddress_v2('cuLogsUnregisterCallback', <void **>&__cuLogsUnregisterCallback, 12080, ptds_mode, NULL)
1903+
cuGetProcAddress_v2('cuLogsUnregisterCallback', <void **>&__cuLogsUnregisterCallback, 12090, ptds_mode, NULL)
19041904

19051905
global __cuLogsCurrent
1906-
cuGetProcAddress_v2('cuLogsCurrent', <void **>&__cuLogsCurrent, 12080, ptds_mode, NULL)
1906+
cuGetProcAddress_v2('cuLogsCurrent', <void **>&__cuLogsCurrent, 12090, ptds_mode, NULL)
19071907

19081908
global __cuLogsDumpToFile
1909-
cuGetProcAddress_v2('cuLogsDumpToFile', <void **>&__cuLogsDumpToFile, 12080, ptds_mode, NULL)
1909+
cuGetProcAddress_v2('cuLogsDumpToFile', <void **>&__cuLogsDumpToFile, 12090, ptds_mode, NULL)
19101910

19111911
global __cuLogsDumpToMemory
1912-
cuGetProcAddress_v2('cuLogsDumpToMemory', <void **>&__cuLogsDumpToMemory, 12080, ptds_mode, NULL)
1912+
cuGetProcAddress_v2('cuLogsDumpToMemory', <void **>&__cuLogsDumpToMemory, 12090, ptds_mode, NULL)
19131913

19141914
global __cuCheckpointProcessGetRestoreThreadId
19151915
cuGetProcAddress_v2('cuCheckpointProcessGetRestoreThreadId', <void **>&__cuCheckpointProcessGetRestoreThreadId, 12080, ptds_mode, NULL)

0 commit comments

Comments
 (0)