Skip to content

Commit 72dff4d

Browse files
juenglinjuenglin
committed
CI: bootstrap hash-pinned pip 26.2.2 after setup-python
Andy-Jost noted on #3197 that setup-python ships the old ensurepip pip, and our `pip>=25.1`/`pip>=25.3` floors neither force 26.2.2 nor protect the upgrade download itself. Any pip before 26.2.2 loads its vendored certifi, which trusts the compromised eMudhra/emSign intermediate CAs. Add a reusable `.github/actions/harden-pip` composite action that installs pip 26.2.2 from a sha256-pinned wheel (integrity is guaranteed by the hash even when the bootstrapping pip's trust store is compromised), and invoke it right after each setup-python / `python -m venv` and before the first pip network call in the affected workflows: - build-wheel.yml (both setup-python steps; covers twine and the shipped pathfinder/cuda-python `pip wheel` builds) - test-wheel-linux.yml, test-wheel-windows.yml - test-sdist-linux.yml, test-sdist-windows.yml (drop the now-redundant "pip>=25.3" token) - coverage.yml (all four venv/setup-python jobs; replaces the "pip>=25.3" upgrades) - pre-commit.yml (drops the unprotected `--upgrade pip`) - ci-nightly.yml (CI-tools job on the runner's system python) - lychee-links composite action (covers lychee.yml and build-docs.yml link checks) Refs #3195, #3197 Signed-off-by: Ralf Juengling <[email protected]>
1 parent a417bd8 commit 72dff4d

10 files changed

Lines changed: 77 additions & 6 deletions

File tree

‎.github/actions/harden-pip/action.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
name: Harden pip
6+
description: >-
7+
Install the security-fixed pip (26.2.2) from a hash-pinned wheel so that later
8+
pip invocations do not fall back on the vendored certifi bundle that trusts the
9+
compromised eMudhra/emSign intermediate CAs. The sha256 fragment guarantees the
10+
bootstrap download's integrity even if the bootstrapping pip's trust store is
11+
compromised. See https://github.com/NVIDIA/cuda-python/issues/3195 and
12+
https://discuss.python.org/t/109576.
13+
14+
inputs:
15+
python:
16+
description: Python interpreter whose pip should be hardened (e.g. a venv's python).
17+
default: python
18+
19+
runs:
20+
using: composite
21+
steps:
22+
- name: Install hash-pinned pip 26.2.2
23+
shell: bash --noprofile --norc -xeuo pipefail {0}
24+
env:
25+
HARDEN_PIP_PYTHON: ${{ inputs.python }}
26+
run: |
27+
"${HARDEN_PIP_PYTHON}" -m pip install \
28+
"pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

‎.github/actions/lychee-links/action.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,9 @@ runs:
113113
printf '[Open the cache refresh workflow](%s).\n' "$WORKFLOW_URL"
114114
} >> "$GITHUB_STEP_SUMMARY"
115115
116+
- name: Harden pip
117+
uses: ./.github/actions/harden-pip
118+
116119
- name: Check links through the configured pre-commit hook
117120
shell: bash --noprofile --norc -euo pipefail {0}
118121
env:

‎.github/workflows/build-wheel.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,9 @@ jobs:
115115
python-version: "3.12"
116116
architecture: ${{ ((inputs.host-platform == 'linux-aarch64' || inputs.host-platform == 'win-arm64') && 'arm64') || 'x64' }}
117117

118+
- name: Harden pip
119+
uses: ./.github/actions/harden-pip
120+
118121
- name: Set up MSVC
119122
if: ${{ startsWith(inputs.host-platform, 'win') && (env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true' || env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true') }}
120123
uses: step-security/msvc-dev-cmd@22c98154b708dbd743e6f27a933cf6ceba3305c4 # v1.13.1
@@ -446,6 +449,10 @@ jobs:
446449
python-version: ${{ matrix.python-version }}
447450
allow-prereleases: ${{ startsWith(matrix.python-version, '3.16') }}
448451

452+
- name: Harden pip
453+
if: ${{ env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true' }}
454+
uses: ./.github/actions/harden-pip
455+
449456
- name: verify free-threaded build
450457
if: ${{ (env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true') && endsWith(matrix.python-version, 't') }}
451458
run: python -c 'import sys; assert not sys._is_gil_enabled()'

‎.github/workflows/ci-nightly.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ jobs:
5858
with:
5959
fetch-depth: 1
6060

61+
- name: Harden pip
62+
uses: ./.github/actions/harden-pip
63+
6164
- name: Run CI tools unit tests
6265
run: |
6366
python -m pip install pytest pyyaml==6.0.3

‎.github/workflows/coverage.yml‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,10 @@ jobs:
121121
run: |
122122
python -m venv .venv
123123
124-
- name: Install pip with build-constraint support
125-
run: .venv/bin/python -m pip install "pip>=25.3"
124+
- name: Harden pip
125+
uses: ./.github/actions/harden-pip
126+
with:
127+
python: .venv/bin/python
126128

127129
- name: Build and install cuda-pathfinder wheel
128130
run: |
@@ -266,9 +268,14 @@ jobs:
266268
run: |
267269
python -m venv .venv
268270
271+
- name: Harden pip
272+
uses: ./.github/actions/harden-pip
273+
with:
274+
python: .venv/Scripts/python
275+
269276
- name: Build cuda.pathfinder wheel
270277
run: |
271-
.venv/Scripts/python -m pip install "pip>=25.3" wheel setuptools Cython
278+
.venv/Scripts/python -m pip install wheel setuptools Cython
272279
.venv/Scripts/pip wheel -v --no-deps ./cuda_pathfinder -w ./wheels/
273280
274281
- name: Constrain builds to the local cuda.pathfinder wheel
@@ -408,6 +415,11 @@ jobs:
408415
run: |
409416
python -m venv .venv
410417
418+
- name: Harden pip
419+
uses: ./.github/actions/harden-pip
420+
with:
421+
python: .venv/Scripts/python
422+
411423
- name: Install wheels from build job
412424
run: |
413425
.venv/Scripts/pip install ./wheels/cuda_pathfinder*.whl
@@ -491,6 +503,9 @@ jobs:
491503
with:
492504
python-version: ${{ env.PY_VER }}
493505

506+
- name: Harden pip
507+
uses: ./.github/actions/harden-pip
508+
494509
- name: Install coverage
495510
run: |
496511
# .coveragerc enables Cython.Coverage plugin; ensure it's available here too.

‎.github/workflows/pre-commit.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,11 @@ jobs:
8585
restore-keys: |
8686
pre-commit-${{ runner.os }}-py${{ env.PYTHON_VERSION }}
8787
88+
- name: Harden pip
89+
uses: ./.github/actions/harden-pip
90+
8891
- name: Install pre-commit
89-
run: python -m pip install --upgrade pip pre-commit
92+
run: python -m pip install pre-commit
9093

9194
# Keep this offline hook smoke check before network-dependent Lychee steps,
9295
# so hook setup and invocation failures surface before link-check retries.

‎.github/workflows/test-sdist-linux.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,11 @@ jobs:
5151
with:
5252
python-version: "3.12"
5353

54+
- name: Harden pip
55+
uses: ./.github/actions/harden-pip
56+
5457
- name: Install build tools
55-
run: python -m pip install "pip>=25.3" build
58+
run: python -m pip install build
5659

5760
# Pure Python packages -- no CTK needed.
5861
- name: Build cuda.pathfinder sdist and wheel-from-sdist

‎.github/workflows/test-sdist-windows.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,12 +60,15 @@ jobs:
6060
with:
6161
python-version: "3.12"
6262

63+
- name: Harden pip
64+
uses: ./.github/actions/harden-pip
65+
6366
- name: Set up MSVC
6467
if: ${{ env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true' }}
6568
uses: step-security/msvc-dev-cmd@22c98154b708dbd743e6f27a933cf6ceba3305c4 # v1.13.1
6669

6770
- name: Install build tools
68-
run: python -m pip install "pip>=25.3" build
71+
run: python -m pip install build
6972

7073
# Pure Python packages -- no CTK needed.
7174
- name: Build cuda.pathfinder sdist and wheel-from-sdist

‎.github/workflows/test-wheel-linux.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,9 @@ jobs:
332332
# we use self-hosted runners on which setup-python behaves weirdly (Python include can't be found)...
333333
AGENT_TOOLSDIRECTORY: "/opt/hostedtoolcache"
334334

335+
- name: Harden pip
336+
uses: ./.github/actions/harden-pip
337+
335338
- name: Set up mini CTK
336339
if: ${{ matrix.LOCAL_CTK == '1' }}
337340
uses: ./.github/actions/fetch_ctk

‎.github/workflows/test-wheel-windows.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,9 @@ jobs:
311311
python-version: ${{ matrix.PY_VER }}
312312
allow-prereleases: ${{ startsWith(matrix.PY_VER, '3.16') }}
313313

314+
- name: Harden pip
315+
uses: ./.github/actions/harden-pip
316+
314317
- name: Verify LongPathsEnabled
315318
run: |
316319
$val = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name 'LongPathsEnabled').LongPathsEnabled

0 commit comments

Comments
 (0)