Repository navigation
[release/6.0] Enable CastGuard in Windows native builds - #7896
github-actions[bot] wants to merge 1 commit into
Conversation
## Summary - Add `/guard:cast` alongside the existing options. - Replace the compiler `/DEBUG` option with `/Z7` so the object files contain compiler debug metadata that BinSkim can use to verify the hardening settings. - Add a short Windows build prerequisite noting that the C++ toolset must support `/guard:cast`. --------- Co-authored-by: Copilot App <[email protected]> Copilot-Session: a64691c7-3c54-4513-8fbf-ab39a2eb744b
There was a problem hiding this comment.
🔵 Needs a closer look
Windows/MSVC builds and BinSkim verification of release/6.0 x86, x64, and ARM64 artifacts are needed to confirm CastGuard instrumentation and usable debug metadata, which source inspection alone cannot establish.
No open issues 🎉
What changed in this PR
Backports #7793 to release/6.0, enabling CastGuard for ML.NET’s Windows native builds and improving debug metadata for hardening verification.
Changes:
- Add
/guard:castalongside the existing compiler options. - Replace compiler
/DEBUGwith/Z7to embed debug metadata in object files for BinSkim verification. - Document the requirement for a C++ toolset that supports
/guard:cast.
| File | Description |
|---|---|
src/Native/CMakeLists.txt |
Enable CastGuard and embedded compiler debug metadata on Windows. |
docs/building/windows-instructions.md |
Add the CastGuard-compatible toolset prerequisite. |
Review effort: Balanced
|
One or more custom setup steps configured for this repository failed during this Copilot code review run: Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review. Note You can configure setup steps for Copilot code review separately from Copilot cloud agent with a |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release/6.0 #7896 +/- ##
==============================================
Coverage ? 70.26%
==============================================
Files ? 1419
Lines ? 272603
Branches ? 27940
==============================================
Hits ? 191546
Misses ? 73639
Partials ? 7418
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
## Summary Partial backport of #7760 to `release/6.0`: add only `eng/install-dependencies.sh`, unchanged from the original PR and preserving its executable bit. ## Why this is needed Copilot code review uses the setup configuration from `main`, which invokes `sudo ./eng/install-dependencies.sh`, while checking out the PR's code. The wrapper is missing from `release/6.0`, so review setup for #7896 failed before dependency installation: ```text sudo: './eng/install-dependencies.sh': command not found ``` See the [failure comment](#7896 (comment)) and [workflow run](https://github.com/dotnet/machinelearning/actions/runs/43004781956). Adding the wrapper supplies the entry point expected by that setup configuration. It delegates to the existing Arcade dependency installer and adds OpenMP installation. ## Why only this part is backported The missing wrapper is sufficient to explain and fix this specific setup failure. Its required helper scripts already exist on `release/6.0`; no Arcade update is needed. The release branch's own setup workflow already installs the Arcade dependencies and `libomp-dev` directly, so changing it is unnecessary for this fix. The remaining documentation, test cleanup, and CI call-site changes from #7760 are unrelated to the missing entry point and would expand the servicing change without helping resolve this failure. ## Validation - Verified that the script contents exactly match #7760 and that its Git mode is `100755`. - Confirmed both required helper scripts exist. > [!NOTE] > This PR description and backport were prepared with GitHub Copilot. Co-authored-by: Copilot <[email protected]> Copilot-Session: c994e9a3-e808-41bd-92b6-f7f1d8791b8b
Backport of #7793 to release/6.0
/cc @matouskozak
Customer Impact
Update native builds with enabled CastGuard
Testing
Tested build passes on internal pipeline
Risk
Low, already used in main for couple weeks.