fix(ENG-RELEASE-WINDOWS): set up MSVC dev environment for dumpbin/cl in build-windows-release.ps1 - #3172
Merged
Merged
Conversation
mudler
force-pushed
the
fix/windows-msvc-dumpbin
branch
2 times, most recently
from
September 13, 2026 05:09
37a9441 to
68a36e4
Compare
… fix PE import validation The CRT audit in build-windows-release.ps1 calls dumpbin to inspect PE imports, but dumpbin and cl were not on PATH because vcvars64.bat was never run. The CMake configure uses the Visual Studio generator, which finds the compiler through the registry, so the build itself succeeded. But the post-build CRT audit and PE audit steps failed because the MSVC tools were unavailable. This was masked by the 0xC0000409 crash (fixed in #3168), which prevented execution from reaching the dumpbin calls. Initialize-MsvcEnvironment uses vswhere to find the VS installation, runs vcvars64.bat via cmd, captures the environment variables, and imports them into the PowerShell session. Contract tests verify the function is called and that $PSNativeCommandUseErrorActionPreference is set to $false so native commands like dumpbin do not trigger ErrorActionPreference Stop. The dumpbin ErrorRecord output is converted to strings with [string]$_ to avoid the empty-string DirectiveOutput error. CMake CompilerId probe objects (compiled with default /MD) are excluded from artifact collection so they do not trip the static-CRT policy. The release archive PE import validator rejected every import not in WINDOWS_SYSTEM_DLLS, even when the manifest declared it as a dynamic dependency. OpenSSL DLLs (LIBCRYPTO-3-X64.DLL, LIBSSL-3-X64.DLL) are legitimate runtime dependencies, declared by release_metadata.py, but the system-DLL check caught them as forbidden. Allow declared dynamic dependencies through the system-DLL check. CRT and MinGW checks fire unconditionally and still reject declared forbidden runtime DLLs. FOLLOWING_AGENTS_PROTOCOL Following-Agents-Protocol: true AI-Assisted: true Assisted-by: AGENT:GLM5.2 [MAKI]
mudler
force-pushed
the
fix/windows-msvc-dumpbin
branch
from
September 13, 2026 05:11
68a36e4 to
fad292b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CRT audit in
build-windows-release.ps1callsdumpbinto inspect PE imports, butdumpbinandclwere not on PATH becausevcvars64.batwas never run. The CMake configure uses the Visual Studio generator, which finds the compiler through the registry, so the build itself succeeded. But the post-build CRT audit and PE audit steps failed because the MSVC tools were unavailable. This was masked by the0xC0000409crash (fixed in #3168), which prevented execution from reaching thedumpbincalls.Initialize-MsvcEnvironmentusesvswhereto find the VS installation, runsvcvars64.batviacmd, captures the environment variables, and imports them into the PowerShell session. Contract tests verify the function is called and that$PSNativeCommandUseErrorActionPreferenceis set to$falseso native commands likedumpbindo not triggerErrorActionPreference Stop.The
dumpbinErrorRecordoutput is converted to strings with[string]$_to avoid the empty-stringDirectiveOutputerror. CMakeCompilerIdprobe objects (compiled with default/MD) are excluded from artifact collection so they do not trip the static-CRT policy.The release archive PE import validator rejected every import not in
WINDOWS_SYSTEM_DLLS, even when the manifest declared it as a dynamic dependency. OpenSSL DLLs (LIBCRYPTO-3-X64.DLL,LIBSSL-3-X64.DLL) are legitimate runtime dependencies, declared byrelease_metadata.py, but the system-DLL check caught them as forbidden. Allow declared dynamic dependencies through the system-DLL check. CRT and MinGW checks fire unconditionally and still reject declared forbidden runtime DLLs.Closes #3171
FOLLOWING_AGENTS_PROTOCOL
Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: AGENT:regolo/glm5.2 [MAKI]