mirror of
https://github.com/openai/codex.git
synced 2026-09-16 12:13:30 +00:00
ce7fbb373b
## Why Windows release packages need the voice helper and native audio libraries. Realtime TLS connections on fresh Windows installations also need platform certificate validation so Windows can retrieve missing trusted roots on demand. ## What changed - Build and sign the voice helper and audio DLLs for Windows x64 and ARM64, bundle a pinned Microsoft CRT DLL, and verify signatures and runtime receipts before packaging. - Add verified, pinned Cygwin and native build tools plus MSVC linker, compiler, and path handling fixes for the Windows Bazel builds. - Include voice resources in primary release archives and WinGet packages. Preserve WinGet executable names, update manifest hashes, and recognize the package root through matching entrypoint metadata. Keep Python runtime wheels voice-free to preserve their existing Windows support floor. - Use Windows platform TLS validation for realtime WebSockets when no custom CA bundle is configured, preserving custom CA behavior. ## Testing Add coverage for build-input integrity and unsafe paths, signed Windows runtime assembly, WinGet file and hash preservation, package discovery, and TLS trust selection, untrusted certificate rejection, and hostname validation. GitOrigin-RevId: 423da35872fa5549d69fd4ca97d922bb49599386
110 lines
5.0 KiB
Diff
110 lines
5.0 KiB
Diff
--- a/rust/private/rustc.bzl
|
|
+++ b/rust/private/rustc.bzl
|
|
@@ -438,4 +438,11 @@
|
|
use_bpf_linker = toolchain.target_arch in ("bpfeb", "bpfel") and toolchain.linker
|
|
- if not ld or toolchain.linker_preference == "rust" or use_bpf_linker:
|
|
+ use_windows_msvc_linker = (
|
|
+ toolchain.target_arch in ("x86_64", "aarch64") and
|
|
+ toolchain.target_os == "windows" and
|
|
+ toolchain.target_abi == "msvc" and
|
|
+ toolchain.linker != None and
|
|
+ toolchain.linker_preference != "cc"
|
|
+ )
|
|
+ if not ld or toolchain.linker_preference == "rust" or use_bpf_linker or use_windows_msvc_linker:
|
|
ld = toolchain.linker.path
|
|
ld_is_direct_driver = toolchain.linker_type == "direct"
|
|
@@ -468,11 +468,25 @@
|
|
filtered_args.append(version)
|
|
# Keep library search path flags
|
|
|
|
+ elif processed_arg == "-L" and i + 1 < len(link_args):
|
|
+ path = link_args[i + 1]
|
|
+ if ld_is_direct_driver and toolchain.target_os == "windows" and toolchain.target_abi == "msvc":
|
|
+ skip_next = True
|
|
+ continue
|
|
+ filtered_args.extend([processed_arg, path])
|
|
+ skip_next = True
|
|
+
|
|
elif processed_arg.startswith("-L"):
|
|
+ if ld_is_direct_driver and toolchain.target_os == "windows" and toolchain.target_abi == "msvc":
|
|
+ continue
|
|
filtered_args.append(processed_arg)
|
|
# Keep sysroot flags (as single or two-part arguments)
|
|
|
|
elif processed_arg == "--sysroot" or processed_arg.startswith("--sysroot="):
|
|
+ if ld_is_direct_driver and toolchain.target_os == "windows" and toolchain.target_abi == "msvc":
|
|
+ if processed_arg == "--sysroot" and i + 1 < len(link_args):
|
|
+ skip_next = True
|
|
+ continue
|
|
filtered_args.append(processed_arg)
|
|
if processed_arg == "--sysroot" and i + 1 < len(link_args):
|
|
# Two-part argument, keep the next arg too
|
|
@@ -2943,8 +2957,10 @@
|
|
use_pic,
|
|
ambiguous_libs,
|
|
get_lib_name,
|
|
+ for_windows = False,
|
|
for_darwin = False,
|
|
- flavor_msvc = False):
|
|
+ flavor_msvc = False,
|
|
+ use_direct_driver = False):
|
|
"""_summary_
|
|
|
|
Args:
|
|
@@ -2952,8 +2968,10 @@
|
|
use_pic (_type_): _description_
|
|
ambiguous_libs (_type_): _description_
|
|
get_lib_name (_type_): _description_
|
|
+ for_windows (bool, optional): _description_. Defaults to False.
|
|
for_darwin (bool, optional): _description_. Defaults to False.
|
|
flavor_msvc (bool, optional): _description_. Defaults to False.
|
|
+ use_direct_driver (bool, optional): _description_. Defaults to False.
|
|
|
|
Returns:
|
|
_type_: _description_
|
|
@@ -2997,6 +3015,11 @@
|
|
):
|
|
return [] if for_darwin else ["-lstatic=%s" % get_lib_name(artifact)]
|
|
|
|
+ if for_windows and flavor_msvc and use_direct_driver and not artifact.basename.endswith(".lib"):
|
|
+ return [
|
|
+ "-Clink-arg={}".format(artifact.path),
|
|
+ ]
|
|
+
|
|
if flavor_msvc:
|
|
return [
|
|
"-lstatic=%s" % get_lib_name(artifact),
|
|
@@ -3045,7 +3068,7 @@
|
|
])
|
|
elif include_link_flags:
|
|
get_lib_name = get_lib_name_for_windows if flavor_msvc else get_lib_name_default
|
|
- ret.extend(portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, flavor_msvc = flavor_msvc))
|
|
+ ret.extend(portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, for_windows = True, flavor_msvc = flavor_msvc, use_direct_driver = use_direct_driver))
|
|
|
|
# Windows toolchains can inherit POSIX defaults like -pthread from C deps,
|
|
# which fails to link with the MinGW/LLD toolchain. Drop them here.
|
|
@@ -3257,11 +3280,18 @@
|
|
format_each = "-Lnative=%s",
|
|
)
|
|
if include_link_flags:
|
|
- args.add_all(
|
|
- runtime_libs,
|
|
- map_each = get_lib_name,
|
|
- format_each = static_runtime_link_format,
|
|
- )
|
|
+ if toolchain.target_os == "windows" and toolchain.target_abi == "msvc" and use_direct_link_driver:
|
|
+ for runtime_lib in runtime_libs.to_list():
|
|
+ if runtime_lib.basename.endswith(".lib"):
|
|
+ args.add(get_lib_name(runtime_lib), format = static_runtime_link_format)
|
|
+ else:
|
|
+ args.add(runtime_lib.path, format = "--codegen=link-arg=%s")
|
|
+ else:
|
|
+ args.add_all(
|
|
+ runtime_libs,
|
|
+ map_each = get_lib_name,
|
|
+ format_each = static_runtime_link_format,
|
|
+ )
|
|
|
|
def _get_dirname(file):
|
|
"""A helper function for `_add_native_link_flags`.
|