You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[no-ci] CI: verify the Authenticode signature of vc_redist.x64.exe - #3443
The nightly PyTorch rows in test-wheel-windows.yml download vc_redist.x64.exe from aka.ms and run it silently with admin rights, without checking its signature. Start-Process -Wait without -PassThru also ignored the installer's exit code, so a failed install went unnoticed until PyTorch failed to import.
This PR:
Requires a Valid Authenticode signature from O=Microsoft Corporation before running the installer. Get-AuthenticodeSignature only reports Valid after Windows builds the chain to a trusted root, so a tampered or redirected download fails the step.
Fails the step on installer errors. Exit codes 1638 (a newer version is already installed) and 3010 (success, reboot required) are accepted.
Downloads into RUNNER_TEMP instead of the workspace.
Validation
pre-commit (including actionlint) passes. This step only runs in ci-nightly.yml (test-mode: nightly-pytorch), so PR CI does not exercise it; the next nightly run will.
The nightly PyTorch rows in test-wheel-windows.yml downloaded and silently
ran vc_redist.x64.exe without checking its signature or the installer's exit
code. Require a valid Microsoft Authenticode signature before running it,
fail on installer errors (allowing 1638 and 3010), and download into
RUNNER_TEMP. This matches the existing vc_redist.arm64.exe check.
Refs NVIDIA#3195
juenglin
changed the title
CI: verify the Authenticode signature of vc_redist.x64.exe
[no-ci] CI: verify the Authenticode signature of vc_redist.x64.exe
Nov 10, 2026
No actionable comments were generated in the recent review.
Summary
Summary by CodeRabbit
Chores
Improved reliability checks for the Windows nightly build’s runtime installation. The setup verifies the installer’s Microsoft signature, waits for installation to finish, and checks the result. It accepts successful, already-installed, and restart-required outcomes; other results fail the setup. The installer is removed after an accepted installation.
The Windows nightly-pytorch workflow downloads the VC++ Redistributable to a temporary directory, verifies its signature and signer, checks the installer exit code, and removes the installer after an accepted result.
The step verifies that the downloaded installer has a valid Authenticode signature from Microsoft Corporation. It waits for installation to finish and accepts exit codes 0, 1638, or 3010. Other exit codes fail the step. The step removes the installer after an accepted result.
Suggested labels:github_actions, to-be-backported
Suggested reviewers:leofang
Change: Bug fix
Merge Risk: Minimal · up to 9e1c0
No demonstrated issue blocks merging. The nightly Windows PyTorch run will still need to confirm that the new installer step works on its runners.
Architecture risk: Low · up to 9e1c0
The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.
Changed systems: None identified.
Architecture concerns
No architecture-level concerns identified.
Review details
Before / after behavior
observed — Modified behavior in .github/workflows/test-wheel-windows.yml: The nightly-pytorch step now downloads the redistributable to RUNNER_TEMP, rejects invalid signatures or signer organizations other than exactly Microsoft Corporation, and checks the installer exit code, accepting only 0, 1638, or 3010. The previous flow started the installer without checking its result or verifying the downloaded file. The installer file is removed after an accepted result.
- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Reviewing files that changed from the base of the PR and between 7978973 and 9e1c0e1.
Files selected for processing: 1
.github/workflows/test-wheel-windows.yml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.
Reviewing files that changed from the base of the PR and between 8b66bdc and 7978973.
Files selected for processing: 1
.github/workflows/test-wheel-windows.yml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.
The substring check on SignerCertificate.Subject also accepted an
organization such as "Microsoft Corporation Services Ltd" or a CN that
embeds "O=Microsoft Corporation". Compare the parsed organization
attribute (OID 2.5.4.10) instead, and check the signature status first so
an unsigned file gets a clear error.
Refs NVIDIA#3195
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
juenglin
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Description
Refs #3195.
The nightly PyTorch rows in
test-wheel-windows.ymldownloadvc_redist.x64.exefromaka.msand run it silently with admin rights, without checking its signature.Start-Process -Waitwithout-PassThrualso ignored the installer's exit code, so a failed install went unnoticed until PyTorch failed to import.This PR:
ValidAuthenticode signature fromO=Microsoft Corporationbefore running the installer.Get-AuthenticodeSignatureonly reportsValidafter Windows builds the chain to a trusted root, so a tampered or redirected download fails the step.RUNNER_TEMPinstead of the workspace.Validation
pre-commit (including actionlint) passes. This step only runs in
ci-nightly.yml(test-mode: nightly-pytorch), so PR CI does not exercise it; the next nightly run will.A
13.4.xbackport follows.Checklist