You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
CI: accept a missing trust anchor in the Windows runner trust probe - #3389
This PR refines a PASS/FAIL criterion for a trust store probe: the Windows "Compromised intermediates distrusted" check in the runner trust probe.
The check currently requires chain building to report ExplicitDistrust for all 16 compromised eMudhra intermediates, so it still fails on windows-2022, windows-latest and windows-11-arm after #3270 (run). Those images are already protected, because emSign ECC Root CA - G3 is gone from LocalMachine\Root and both test hosts are rejected. Microsoft's disallowed CTL is on the images but not enforced (DisableRootAutoUpdate=1), so chains end in UntrustedRoot or PartialChain instead.
The check now passes when each intermediate is explicitly distrusted or its chain no longer reaches a trusted root, and fails if the chain builds cleanly or the build fails for another reason. The classification is a new Get-ChainTrustState helper. It accepts UntrustedRoot or PartialChain only when no other chain status is reported, and the probe passes the vendored non-root issuers (emSign Root TLS CA - G3 from the host chains and the cross-signed emSign Root CS CA - G3 in ci/tools/runner_trust_probe_issuers/) to the chain build so a missing parent is not mistaken for a missing trust anchor. Test-ExplicitlyDistrusted, used by the stopgap action, is unchanged.
The endpoint check also changes: a non-certificate or network error (for example a timeout of dv-g3b-emudhra.we-have-a-problem.com) is retried once and then fails the probe, because the probe did not see the certificate rejected.
The first version of the criterion passed on all three Windows images (run). The tightened classification and issuer handling are verified locally with PowerShell 7 on Linux and still need a dispatched run on the Windows images.
The hosted Windows images removed the emSign roots instead of enabling Microsoft's disallowed CTL, so chain building reports UntrustedRoot or PartialChain rather than ExplicitDistrust for the compromised intermediates. Pass the check when each intermediate is explicitly distrusted or its chain no longer reaches a trusted root.
… errors
A timeout means the probe did not see the certificate rejected, so it cannot claim the runner is safe. Retry once, then fail instead of reporting INCONCLUSIVE.
No actionable comments were generated in the recent review.
Summary
Summary by CodeRabbit
Chores
Certificate checks now distinguish trusted, explicitly distrusted, no-trust-anchor, and indeterminate results, including relevant status details. The check fails if a chain is trusted or its status is indeterminate; explicitly distrusted chains and chains without a trusted anchor pass.
Endpoint probes retry network and other non-certificate errors once after five seconds. Successful responses, HTTP errors, hostname-mismatch-only errors, and errors still unresolved after the retry fail the check. Certificate-validation errors pass.
The change adds certificate chain state classification and updates the Windows runner trust probe. The probe accepts explicitly distrusted chains or chains with no trusted anchor, reports state counts, and retries unresolved endpoint errors once before failing.
Changes: Runner trust probe
Layer / File(s)
Summary
Certificate chain state classification .github/actions/upgrade-ca-certificates/emudhra_intermediates.ps1
Adds Get-ChainTrustState, which classifies chains as ExplicitDistrust, Trusted, NoTrustAnchor, or Indeterminate and returns the non-NoError status names.
Trust and endpoint probe outcomes ci/tools/runner_trust_probe.ps1, ci/tools/runner_trust_probe_issuers/README.txt, .spdx-ignore
The intermediate check accepts ExplicitDistrust and NoTrustAnchor states and reports state counts. The probe loads issuer certificates and retries unresolved endpoint errors once. Unresolved errors, successful connections, HTTP responses, and hostname-only mismatches fail; certificate-validation errors pass.
Possibly related issues
NVIDIA/cuda-python#3257: The issue tracks the temporary runner trust probe; this change updates that probe’s chain classification and acceptance criteria.
Possibly related PRs
NVIDIA/cuda-python#3270: Introduced the eMudhra certificate data and Windows runner probe that this change extends.
NVIDIA/cuda-python#3340: Updated the shared certificate helper and runner probe for PowerShell 5.1, which this change continues to modify.
NVIDIA/cuda-python#3251: Introduced the Windows runner trust probe and its endpoint and trust-store checks.
Change: Bug fix
Merge Risk: Minimal · up to 4d78c
No confirmed blocking defect remains. Run the probe on the targeted Windows runners as part of normal validation.
- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Reviewing files that changed from the base of the PR and between 464c5db and 4d78c04.
Files ignored due to path filters: 1
ci/tools/runner_trust_probe_issuers/emsign-root-cs-ca-g3-cross.pem is excluded by !**/*.pem
Files selected for processing: 3
.spdx-ignore
ci/tools/runner_trust_probe.ps1
ci/tools/runner_trust_probe_issuers/README.txt
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
Build($Cert) receives only the compromised certificate, with no issuers in ExtraStore. If its parent is absent from the cache and AIA downloads are disabled or unavailable, it can return PartialChain even while the root remains trusted. The helper then incorrectly reports NoTrustAnchor. Missing intermediates can prevent chain construction independently of root trust. Microsoft documentation
Supply the complete known issuer chains through ExtraStore before accepting this result. The two live TLS endpoints don’t cover the code-signing intermediates.
Validation: with the checked-in DV G3B certificate and the same trusted root, OpenSSL verification failed without its issuer and passed when the issuer was supplied. Windows/PowerShell execution remains unverified; neither runtime is available locally. No repository changes made.
… build
Classify a chain as NoTrustAnchor only when UntrustedRoot and PartialChain are the only reported problems, and pass the vendored non-root issuer to the chain build so a missing parent is not mistaken for a missing trust anchor.
The vendored host chains supply emSign Root TLS CA - G3, but omit emSign Root CS CA - G3 cross-signed by ECC G3. That cross-certificate exists in eMudhra’s repository. Without it cached, the two native code-signing intermediates can still produce PartialChain and incorrectly pass as NoTrustAnchor.
I reproduced this for both CS G3B and G3C: verification failed using the current vendored certificates, then passed after adding the missing cross-certificate, with the same trusted root. Vendor that certificate and include it in ExtraStore to complete the fix.
The TLS reproducer now passes as expected. Windows/PowerShell execution remains unverified locally; the PR description also says the tightened implementation still needs a Windows runner run.
… probe
The code-signing intermediates are issued by the cross-signed emSign Root CS CA - G3, which the test hosts' chains do not carry. Without it a trusted emSign ECC Root CA - G3 would still produce PartialChain and be mistaken for a missing trust anchor.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CI/CDCI/CD infrastructuregithub_actionsPull requests that update GitHub Actions code
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Description
This PR refines a PASS/FAIL criterion for a trust store probe: the Windows "Compromised intermediates distrusted" check in the runner trust probe.
The check currently requires chain building to report
ExplicitDistrustfor all 16 compromised eMudhra intermediates, so it still fails onwindows-2022,windows-latestandwindows-11-armafter #3270 (run). Those images are already protected, becauseemSign ECC Root CA - G3is gone fromLocalMachine\Rootand both test hosts are rejected. Microsoft's disallowed CTL is on the images but not enforced (DisableRootAutoUpdate=1), so chains end inUntrustedRootorPartialChaininstead.The check now passes when each intermediate is explicitly distrusted or its chain no longer reaches a trusted root, and fails if the chain builds cleanly or the build fails for another reason. The classification is a new
Get-ChainTrustStatehelper. It acceptsUntrustedRootorPartialChainonly when no other chain status is reported, and the probe passes the vendored non-root issuers (emSign Root TLS CA - G3from the host chains and the cross-signedemSign Root CS CA - G3inci/tools/runner_trust_probe_issuers/) to the chain build so a missing parent is not mistaken for a missing trust anchor.Test-ExplicitlyDistrusted, used by the stopgap action, is unchanged.The endpoint check also changes: a non-certificate or network error (for example a timeout of
dv-g3b-emudhra.we-have-a-problem.com) is retried once and then fails the probe, because the probe did not see the certificate rejected.The first version of the criterion passed on all three Windows images (run). The tightened classification and issuer handling are verified locally with PowerShell 7 on Linux and still need a dispatched run on the Windows images.
Checklist