From 33b9e4f5028160e9598198f34e59cdead3039221 Mon Sep 17 00:00:00 2001 From: Ralf Juengling Date: Tue, 27 Oct 2026 10:23:00 -0700 Subject: [PATCH 1/3] CI: pin and verify sccache via a shared composite action Signed-off-by: Ralf Juengling --- .github/actions/install-sccache/action.yml | 69 ++++++++++++++++++++++ .github/workflows/build-wheel.yml | 7 +-- .github/workflows/test-sdist-linux.yml | 11 +--- 3 files changed, 74 insertions(+), 13 deletions(-) create mode 100644 .github/actions/install-sccache/action.yml diff --git a/.github/actions/install-sccache/action.yml b/.github/actions/install-sccache/action.yml new file mode 100644 index 00000000000..e1f264f780e --- /dev/null +++ b/.github/actions/install-sccache/action.yml @@ -0,0 +1,69 @@ +# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# +# SPDX-License-Identifier: Apache-2.0 + +name: Install pinned rapidsai/sccache +description: Download, verify, and install a pinned rapidsai/sccache binary on Linux + +# Regenerate hashes when bumping SCCACHE_VERSION: +# for arch in x86_64 aarch64; do +# curl -fsSL "https://github.com/rapidsai/sccache/releases/download//sccache-${arch}-unknown-linux-musl.tar.gz" | sha256sum +# done +# Cross-check against the `.sha256` files published on the GitHub release. +# +# Security note (eMudhra/emSign CA incident): +# - Every version bump MUST repeat the embedded-roots check on the downloaded +# binaries (confirming either no embedded `webpki-roots` root list -- deferring +# to the OS trust store via `rustls-platform-verifier` -- or an embedded +# `webpki-roots` list at 1.0.10 or later that excludes `emSign ECC Root CA - G3`). +# - Do NOT switch to or bump `mozilla/sccache` to v0.19.0 (or later without +# repeating the roots check): `mozilla/sccache` v0.19.0 re-embeds +# `webpki-roots` 1.0.5, which still trusts the affected eMudhra root. + +runs: + using: composite + steps: + - name: Install pinned rapidsai/sccache + shell: bash --noprofile --norc -xeuo pipefail {0} + env: + SCCACHE_VERSION: v0.18.0-rapids.7 + run: | + if [[ "$(uname -s)" != "Linux" ]]; then + echo "::error::install-sccache only supports Linux (got $(uname -s))" >&2 + exit 1 + fi + + arch="$(uname -m)" + case "${arch}" in + x86_64) + expected_sha256="44106a2e01aeff99767e66b1a5ae6be074306c518458b367f75287de4532974c" + ;; + aarch64) + expected_sha256="1bad10208481786f2c2e943d7cca8006eaa7e620d122859ef2d61861a733d3d1" + ;; + *) + echo "::error::Unsupported architecture for install-sccache: ${arch}" >&2 + exit 1 + ;; + esac + + tarball="sccache-${arch}-unknown-linux-musl.tar.gz" + url="https://github.com/rapidsai/sccache/releases/download/${SCCACHE_VERSION}/${tarball}" + + tmp_dir="$(mktemp -d)" + trap 'rm -rf "${tmp_dir}"' EXIT + + curl -fsSL -o "${tmp_dir}/${tarball}" "${url}" + ( + cd "${tmp_dir}" + echo "${expected_sha256} ${tarball}" | sha256sum --check --strict - + ) + + if [[ "$(id -u)" -eq 0 ]]; then + tar -C /usr/local/bin -xvzf "${tmp_dir}/${tarball}" --wildcards --strip-components=1 -x '*/sccache' + else + sudo tar -C /usr/local/bin -xvzf "${tmp_dir}/${tarball}" --wildcards --strip-components=1 -x '*/sccache' + fi + + echo "SCCACHE_PATH=/usr/local/bin/sccache" >> "${GITHUB_ENV}" + /usr/local/bin/sccache --version diff --git a/.github/workflows/build-wheel.yml b/.github/workflows/build-wheel.yml index 2f92940b1cd..1daf83eed9b 100644 --- a/.github/workflows/build-wheel.yml +++ b/.github/workflows/build-wheel.yml @@ -79,12 +79,9 @@ jobs: # the job level instead of linking into the diff. run: echo "::add-matcher::.github/matchers/compiler.json" - - name: Install latest rapidsai/sccache + - name: Install rapidsai/sccache if: ${{ startsWith(inputs.host-platform, 'linux') && (env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true') }} - run: | - curl -fsSL "https://github.com/rapidsai/sccache/releases/latest/download/sccache-$(uname -m)-unknown-linux-musl.tar.gz" \ - | sudo tar -C /usr/local/bin -xvzf - --wildcards --strip-components=1 -x '*/sccache' - echo "SCCACHE_PATH=/usr/local/bin/sccache" >> "$GITHUB_ENV" + uses: ./.github/actions/install-sccache # The runner only exposes these values to actions, not to `run:` steps or # the cibuildwheel container, so re-export them for sccache's GHA backend. diff --git a/.github/workflows/test-sdist-linux.yml b/.github/workflows/test-sdist-linux.yml index 6e38032edd2..124a61966cb 100644 --- a/.github/workflows/test-sdist-linux.yml +++ b/.github/workflows/test-sdist-linux.yml @@ -87,15 +87,10 @@ jobs: pathfinder_uri="file://$(realpath "${pathfinder_wheels[0]}")" printf 'cuda-pathfinder @ %s\n' "${pathfinder_uri}" | tee wheel-constraints/cuda-bindings.txt - # Cython packages need CTK + sccache. - # The env vars ACTIONS_CACHE_SERVICE_V2, ACTIONS_RESULTS_URL, and ACTIONS_RUNTIME_TOKEN - # are exposed by this action. - - name: Enable sccache + # Cython packages need CTK + sccache (local disk cache only in this job). + - name: Install rapidsai/sccache if: ${{ env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true' }} - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # 0.0.11 - with: - version: v0.18.0 - disable_annotations: 'true' + uses: ./.github/actions/install-sccache - name: Setup proxy cache if: ${{ env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true' }} From 4b09d114e79c9599f32244d3f90fdf24e923d399 Mon Sep 17 00:00:00 2001 From: Ralf Juengling Date: Tue, 27 Oct 2026 13:52:01 -0700 Subject: [PATCH 2/3] CI: document embedded-roots check recipe in install-sccache Signed-off-by: Ralf Juengling --- .github/actions/install-sccache/action.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/actions/install-sccache/action.yml b/.github/actions/install-sccache/action.yml index e1f264f780e..46b83847d74 100644 --- a/.github/actions/install-sccache/action.yml +++ b/.github/actions/install-sccache/action.yml @@ -12,13 +12,17 @@ description: Download, verify, and install a pinned rapidsai/sccache binary on L # Cross-check against the `.sha256` files published on the GitHub release. # # Security note (eMudhra/emSign CA incident): -# - Every version bump MUST repeat the embedded-roots check on the downloaded -# binaries (confirming either no embedded `webpki-roots` root list -- deferring -# to the OS trust store via `rustls-platform-verifier` -- or an embedded -# `webpki-roots` list at 1.0.10 or later that excludes `emSign ECC Root CA - G3`). +# - Every version bump MUST repeat the embedded-roots check on the extracted +# `sccache` binary: +# grep -ac 'ISRG Root X1' sccache # >0 means a root list is embedded +# grep -ac 'emSign' sccache # must be 0 +# Pass criteria: either no embedded root list (both return 0; binary defers +# to the OS trust store via `rustls-platform-verifier`, as verified for +# `rapidsai/sccache` v0.18.0-rapids.7), or an embedded `webpki-roots` list +# at 1.0.10+ where `ISRG Root X1` matches and `emSign` returns 0. # - Do NOT switch to or bump `mozilla/sccache` to v0.19.0 (or later without # repeating the roots check): `mozilla/sccache` v0.19.0 re-embeds -# `webpki-roots` 1.0.5, which still trusts the affected eMudhra root. +# `webpki-roots` 1.0.5, which still trusts `emSign ECC Root CA - G3`. runs: using: composite From 5762894710e803eca5a9bd261ee60cb188edb5b0 Mon Sep 17 00:00:00 2001 From: Ralf Juengling Date: Tue, 27 Oct 2026 13:59:28 -0700 Subject: [PATCH 3/3] CI: match the specific emSign root in the install-sccache roots check webpki-roots 1.0.10 removes only emSign ECC Root CA - G3 and keeps the other emSign roots, so grepping for 'emSign' would reject a fixed root list. Signed-off-by: Ralf Juengling --- .github/actions/install-sccache/action.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/actions/install-sccache/action.yml b/.github/actions/install-sccache/action.yml index 46b83847d74..890b47fc2ea 100644 --- a/.github/actions/install-sccache/action.yml +++ b/.github/actions/install-sccache/action.yml @@ -14,12 +14,14 @@ description: Download, verify, and install a pinned rapidsai/sccache binary on L # Security note (eMudhra/emSign CA incident): # - Every version bump MUST repeat the embedded-roots check on the extracted # `sccache` binary: -# grep -ac 'ISRG Root X1' sccache # >0 means a root list is embedded -# grep -ac 'emSign' sccache # must be 0 +# grep -ac 'ISRG Root X1' sccache # >0 means a root list is embedded +# grep -ac 'emSign ECC Root CA - G3' sccache # must be 0 # Pass criteria: either no embedded root list (both return 0; binary defers # to the OS trust store via `rustls-platform-verifier`, as verified for # `rapidsai/sccache` v0.18.0-rapids.7), or an embedded `webpki-roots` list -# at 1.0.10+ where `ISRG Root X1` matches and `emSign` returns 0. +# at 1.0.10+ where `ISRG Root X1` matches and `emSign ECC Root CA - G3` +# returns 0. Match the full root name: 1.0.10 removes only that emSign root +# and still ships other emSign roots. # - Do NOT switch to or bump `mozilla/sccache` to v0.19.0 (or later without # repeating the roots check): `mozilla/sccache` v0.19.0 re-embeds # `webpki-roots` 1.0.5, which still trusts `emSign ECC Root CA - G3`.