Repository navigation
Work around certificate regression on Windows - #33142
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Certificate trust and proxy behavior need agent-level validation on the shared Windows and macOS pipelines.
Review effort: Balanced
Findings: None
What changed in this PR
Updates shared build-tool setup to address Windows certificate trust failures.
Changes:
- Installs
truststoreand enables system certificate trust for Python requests. - Adds proxy diagnostics and filters
NO_PROXYbefore launching the wrapper through PowerShell.
| File | Description |
|---|---|
tools/ci_build/run_gh_action.py |
Injects truststore into Python SSL handling. |
tools/ci_build/github/azure-pipelines/templates/setup-build-tools.yml |
Installs truststore and adjusts proxy handling and wrapper execution. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Tianlei Wu (tianleiwu)
enabled auto-merge (squash)
October 6, 2026 22:23
Tianlei Wu (tianleiwu)
approved these changes
Oct 6, 2026
eserscor
added a commit
that referenced
this pull request
Oct 7, 2026
This pull request updates the build pipeline to improve Python package installation and proxy handling, and ensures SSL certificate trust for Python requests. The most important changes are: **Build Pipeline Improvements:** * The pipeline now installs both `requests` and `truststore` Python packages to improve SSL certificate handling in Python scripts. * Added steps to inspect and sanitize the `NO_PROXY` environment variable, ensuring it does not contain invalid entries before running the Python GitHub Action wrapper. **Python Script Enhancements:** * Updated `run_gh_action.py` to import and inject `truststore` into the Python SSL context, ensuring trusted certificate handling for HTTP requests.
adrastogi
added a commit
that referenced
this pull request
Oct 27, 2026
### Description <!-- Describe your changes. --> This cherry-picks the following commit for the release: * #33142 (`38dc99fba3f5bd72e201d1d942235bf4f600a1b3`): work around the Windows certificate regression in build-tools setup by installing and injecting `truststore`, inspecting proxy settings, and sanitizing `NO_PROXY` before invoking the GitHub Action wrapper. The full two-file cherry-pick applied cleanly, with source commit provenance preserved. This branch is based on current `rel-1.30.1`, including #33524 and #33641. ### Motivation and Context <!-- - Why is this change required? What problem does it solve? - If it fixes an open issue, please link to the issue here. --> The internal release build failed in six Windows packaging jobs while downloading the build-tools action through `run_gh_action.py`: `CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate` This upstream fix enables Python to use system-trusted certificates without disabling certificate verification. The previous Python-version fix (#33561, backported through #33641) is present and package validation passed in both release runs. This PR does not address the separate macOS checkout timeout or the Maven feed connection timeout in the CUDA13 build. Those failures need targeted infrastructure retries; no additional cherry-picks are currently indicated. Validation: * The cherry-pick patch ID matches the original mainline commit. * Python AST parsing and YAML parsing/assertions passed: `truststore` installation/injection and the PowerShell wrapper invocation are present. * `git diff --cached --check` passed before committing. * No end-to-end execution on the affected release agents was performed. No release pipelines were restarted. Co-authored-by: eserscor <erscor@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3eb3fc9b-6147-4706-b7ad-47bb3476377b
This was referenced Oct 30, 2026
This was referenced Nov 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates the build pipeline to improve Python package installation and proxy handling, and ensures SSL certificate trust for Python requests. The most important changes are:
Build Pipeline Improvements:
requestsandtruststorePython packages to improve SSL certificate handling in Python scripts.NO_PROXYenvironment variable, ensuring it does not contain invalid entries before running the Python GitHub Action wrapper.Python Script Enhancements:
run_gh_action.pyto import and injecttruststoreinto the Python SSL context, ensuring trusted certificate handling for HTTP requests.