Skip to content

Conversation

@bkonyi
Copy link
Contributor

@bkonyi bkonyi commented Jul 30, 2025

Powershell instances running in ConstrainedLanguage mode can't always access .NET APIs due to system administrator security configurations, including gWindows VMs.

This change removes the use of System.* APIs from update_engine_version.ps1 in favor of dedicated Powershell APIs.

Fixes #172895

Powershell instances running in `ConstrainedLanguage` mode can't always
access .NET APIs due to system administrator security configurations,
including gWindows VMs.

This change removes the use of `System.*` APIs from
update_engine_version.ps1 in favor of dedicated Powershell APIs.

Fixes #172895
@bkonyi bkonyi requested a review from jtmcdole July 30, 2025 15:50
@bkonyi bkonyi requested a review from matanlurey as a code owner July 30, 2025 15:50
@flutter-dashboard
Copy link

It looks like this pull request may not have tests. Please make sure to add tests or get an explicit test exemption before merging.

If you are not sure if you need tests, consider this rule of thumb: the purpose of a test is to make sure someone doesn't accidentally revert the fix. Ask yourself, is there anything in your PR that you feel it is important we not accidentally revert back to how it was before your fix?

Reviewers: Read the Tree Hygiene page and make sure this patch meets those guidelines before LGTMing.If you believe this PR qualifies for a test exemption, contact "@test-exemption-reviewer" in the #hackers channel in Discord (don't just cc them here, they won't see it!). The test exemption team is a small volunteer group, so all reviewers should feel empowered to ask for tests, without delegating that responsibility entirely to the test exemption group.

@bkonyi bkonyi added cp: beta cherry pick this pull request to beta release candidate branch cp: stable cherry pick this pull request to stable release candidate branch labels Jul 30, 2025
@bkonyi
Copy link
Contributor Author

bkonyi commented Jul 30, 2025

This fix was verified by @johnniwinther, who encountered the issue on his gWindows environment. I was unable to reproduce this locally.

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request correctly identifies a potential issue with using .NET APIs in constrained PowerShell environments and replaces them with idiomatic PowerShell cmdlets. This is a great improvement for the script's robustness.

My review focuses on a potential regression related to file encoding. The proposed changes might unintentionally add a Byte Order Mark (BOM) to the generated files, which could affect downstream tooling. I've suggested using -Encoding Ascii to prevent this and maintain the original behavior.

Overall, this is a valuable change, and with the suggested adjustments, it will be ready to merge.

@loic-sharma
Copy link
Member

loic-sharma commented Jul 30, 2025

@bkonyi 2 months from now we'll likely forget about PowerShell Constrained Mode, and someone might accidentally re-add .NET API usages. Is there an easy way to add a test that enables PowerShell Constrained Mode and runs a Flutter command to verify we didn't regress gWindows?

Feel free to land this PR without adding such a test to unblock customers immediately.

@bkonyi
Copy link
Contributor Author

bkonyi commented Jul 30, 2025

@bkonyi 2 months from now we'll likely forget about PowerShell Constrained Mode, and someone might accidentally re-add .NET API usages. Is there an easy way to add a test that enables PowerShell Constrained Mode and runs a Flutter command to verify we didn't regress gWindows?

We could update our infra to set the __PSLockdownPolicy environment variable to 4, which supposedly enables constrained language mode to run with it enabled for all of our tests.

Another option is that we could just update our scripts to force constrained language mode (i.e., adding $ExecutionContext.SessionState.LanguageMode = "ConstrainedLanguage" to our powershell scripts), although that may have unintended consequences if that setting is somehow inherited by a powershell instance spawned by a Dart program like flutter_tools.

@bkonyi bkonyi added the autosubmit Merge PR when tree becomes green via auto submit App label Jul 30, 2025
@bkonyi
Copy link
Contributor Author

bkonyi commented Jul 30, 2025

However, that's not a guarantee that we would have caught this failure in the first place. For some reason, I was never able to reproduce this issue on my gWindows machine but Johnni was able to consistently.

@auto-submit auto-submit bot added this pull request to the merge queue Jul 30, 2025
Merged via the queue into master with commit 71b8458 Jul 30, 2025
152 of 153 checks passed
@auto-submit auto-submit bot deleted the fix_issue_172895 branch July 30, 2025 19:19
@flutter-dashboard flutter-dashboard bot removed the autosubmit Merge PR when tree becomes green via auto submit App label Jul 30, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jul 31, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jul 31, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jul 31, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jul 31, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jul 31, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jul 31, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jul 31, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jul 31, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jul 31, 2025
@jtmcdole
Copy link
Member

However, that's not a guarantee that we would have caught this failure in the first place. For some reason, I was never able to reproduce this issue on my gWindows machine but Johnni was able to consistently.

I suspect you have your windows machine exempt?

@bkonyi
Copy link
Contributor Author

bkonyi commented Aug 1, 2025

However, that's not a guarantee that we would have caught this failure in the first place. For some reason, I was never able to reproduce this issue on my gWindows machine but Johnni was able to consistently.

I suspect you have your windows machine exempt?

I do, but I've also confirmed that my Powershell is also running in constrained language mode as well.

engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Aug 1, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Aug 1, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Aug 1, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Aug 1, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Aug 1, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Aug 1, 2025
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Aug 1, 2025
ksokolovskyi pushed a commit to ksokolovskyi/flutter that referenced this pull request Aug 19, 2025
…172974)

Powershell instances running in `ConstrainedLanguage` mode can't always
access .NET APIs due to system administrator security configurations,
including gWindows VMs.

This change removes the use of `System.*` APIs from
update_engine_version.ps1 in favor of dedicated Powershell APIs.

Fixes flutter#172895
mboetger pushed a commit to mboetger/flutter that referenced this pull request Sep 18, 2025
…172974)

Powershell instances running in `ConstrainedLanguage` mode can't always
access .NET APIs due to system administrator security configurations,
including gWindows VMs.

This change removes the use of `System.*` APIs from
update_engine_version.ps1 in favor of dedicated Powershell APIs.

Fixes flutter#172895
korca0220 pushed a commit to korca0220/flutter that referenced this pull request Sep 22, 2025
…172974)

Powershell instances running in `ConstrainedLanguage` mode can't always
access .NET APIs due to system administrator security configurations,
including gWindows VMs.

This change removes the use of `System.*` APIs from
update_engine_version.ps1 in favor of dedicated Powershell APIs.

Fixes flutter#172895
engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Nov 12, 2025
lucaantonelli pushed a commit to lucaantonelli/flutter that referenced this pull request Nov 21, 2025
…172974)

Powershell instances running in `ConstrainedLanguage` mode can't always
access .NET APIs due to system administrator security configurations,
including gWindows VMs.

This change removes the use of `System.*` APIs from
update_engine_version.ps1 in favor of dedicated Powershell APIs.

Fixes flutter#172895
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cp: beta cherry pick this pull request to beta release candidate branch cp: stable cherry pick this pull request to stable release candidate branch

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Flutter doesn't support ConstrainedLanguage PowerShell language mode

3 participants