Repository navigation
Backport various fixes to the 2.7 release branch - #41351
Merged
Merged
Conversation
…ests & release creation (#41158) * Experiment with keyvault * Iterate * Iterate * Prepare for PR
Blue (OneBlue)
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR backports a set of fixes onto the 2.7 release branch, including a security/behavior fix to mount plugin-backed folders using the WSL session user token (instead of the service identity), plus CI pipeline adjustments for fetching GitHub tokens from Azure Key Vault.
Changes:
- Mount root-namespace Plan9 shares using the session user token to ensure correct host filesystem access semantics.
- Extend the plugin test suite with a new “MountFolderAccess” scenario that validates denied host permissions are enforced through the mount.
- Update Azure DevOps pipeline YAMLs to fetch GitHub tokens from Azure Key Vault (and adjust env usage accordingly), plus a PCH warning disable tweak.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| test/windows/testplugin/Plugin.cpp | Adds a new plugin test mode that mounts a host folder and attempts a write to validate access enforcement. |
| test/windows/PluginTests.h | Extends PluginTestType and adds a registry value name for the mount folder path. |
| test/windows/PluginTests.cpp | Adds a new test that sets a deny-write ACL and verifies the plugin mount can’t write as the user. |
| src/windows/service/exe/WslCoreVm.cpp | Passes the session user token into AddPlan9Share when mounting root-namespace folders. |
| src/windows/common/precomp.h | Disables warning 4875 globally for this PCH. |
| .pipelines/wsl-build-notice.yml | Fetches GitHub PR token from Key Vault for NOTICE PR automation. |
| .pipelines/wsl-build-nightly-localization.yml | Fetches GitHub PR token from Key Vault for localization PR automation (conditioned). |
| .pipelines/flight-stage.yml | Fetches GitHub release token from Key Vault and updates the release token variable used by the release script. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+172
to
+174
| const auto testFolder = std::filesystem::current_path() / "deny-write"; | ||
| VERIFY_IS_TRUE(std::filesystem::create_directory(testFolder)); | ||
|
|
Comment on lines
+49
to
+56
| - task: AzureKeyVault@2 | ||
| displayName: Fetch GitHub PR token from Key Vault | ||
| condition: and(succeeded(), in(variables['Build.Reason'], 'Schedule', 'Manual')) | ||
| inputs: | ||
| azureSubscription: 'Azure-Connection' | ||
| KeyVaultName: 'wsl-ci-key-vault' | ||
| SecretsFilter: 'GithubPRToken' | ||
|
|
Collaborator
Author
There was a problem hiding this comment.
This doesn't matter for this backport. I'll rather cherry-pick changes as-is to avoid diverging too much from master
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.
Suppressed comments (2)
test/windows/PluginTests.cpp:173
std::filesystem::create_directory(testFolder)will fail if a previous run left the directory behind (or if multiple runs share the same working directory), because the path is hard-coded todeny-writeand there’s no pre-clean. Consider using a per-run unique directory name and removing any pre-existing path first to avoid test flakiness.
const auto testFolder = std::filesystem::current_path() / "deny-write";
VERIFY_IS_TRUE(std::filesystem::create_directory(testFolder));
test/windows/PluginTests.cpp:198
VERIFY_ARE_EQUALis typically used asVERIFY_ARE_EQUAL(expected, actual)in this test suite (e.g. above for ERROR_FILE_NOT_FOUND). Swapping the argument order here makes failure diagnostics misleading.
VERIFY_ARE_EQUAL(GetLastError(), ERROR_ACCESS_DENIED);
Ben Hillis (benhillis)
approved these changes
Aug 13, 2026
Ben Hillis (benhillis)
added a commit
that referenced
this pull request
Sep 3, 2026
…sion" (#41331) (#41516) Temporarily reverting the identity-based plugin folder mount change (both the WslCoreVm.cpp behavior change and the accompanying MountFolderAccess test coverage) that was backported to release/2.7 via #41351. This reverts the plugin-mount-identity portion of commit f6bd5d2. Co-authored-by: Ben Hillis <[email protected]> Co-authored-by: Copilot <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of the Pull Request
This PR backports various issues to fix the build, release, and #41331 to the 2.7 release branch
PR Checklist
Detailed Description of the Pull Request / Additional comments
Validation Steps Performed