deps: update Hyperlight to v0.9.0#434
Merged
Merged
Conversation
Signed-off-by: danbugs <danilochiarlone@gmail.com>
huzaifa-d
approved these changes
May 27, 2026
MGudgin
added a commit
that referenced
this pull request
May 28, 2026
* ci: stop shipping tier2_bfs in ADO-built release binaries The `1ES.Build.Rust.Run@1` task defaults to `--all-features` when no `features:` input is supplied. That was harmless until commit 8c57211 ("feat(wxc_common): gate Tier 2 (BFS) behind tier2_bfs Cargo feature") landed via #410 on 2026-05-26, which introduced `tier2_bfs` with the explicit constraint that production binaries on Win 11 25H2 must NOT carry it; otherwise the embedded `bfscfg.exe` invocation risks an OS hang. The GH Actions workflow already respects this — its build line in `.github/workflows/build.yml` does not pass `--all-features` — but the ADO pipeline silently enables every feature including `tier2_bfs`, and ships that binary via `release-binaries.zip` and the npm SDK. Confirmed by inspecting the actual `Cargo build (1ES PT)` step log of build 147990337 (PR #434): Running: cargo build --locked --offline --target x86_64-pc-windows-msvc --profile release --all-features Override the task default by setting `allFeatures: false` and listing the production feature set explicitly. This keeps every runtime backend that IS intended for production (`hyperlight`, `isolation_session`, `microvm`, `wslc`) compiled in while dropping `tier2_bfs`. Lint.Job.yml is intentionally left alone; clippy with `--all-features` gives broader coverage of conditionally compiled code and does not produce a shipping binary. Closes #442 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: probe candidate input names for 1ES Rust features list PR-build 148026004 confirmed `allFeatures: false` correctly drops the task's `--all-features` default, but `features: '...'` was silently ignored — the resulting cargo line had no `--features` at all, so the binary lost hyperlight/isolation_session/microvm/wslc backends. Shotgun several candidate input names in one push so the next CI run narrows down which spelling the task actually consumes. Unknown inputs are silently ignored by the 1ES PT task layer (already proven), so this is safe. Once we identify the canonical name we will collapse to a single key. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: use `activatedFeatures` (correct 1ES Rust task input name) Per the 1ES Rust virtual task schema (eng.ms doc), the inputs at `1ES.Build.Rust.Run@1` level are: allFeatures: boolean # default: true activatedFeatures: string[] Build 148028047 confirmed `allFeatures: false` correctly drops `--all-features` from the cargo line, but the previous commit's `features: '...'` (and four other guessed names) were silently ignored, so the binary lost hyperlight/isolation_session/microvm/wslc backends. Replace the shotgun with the documented `activatedFeatures` YAML array spelling. This should produce a cargo line of the form: cargo build --locked --offline --target ... --profile release \\ --features hyperlight,isolation_session,microvm,wslc Schema: https://eng.ms/docs/coreai/devdiv/one-engineering-system-1es/1es-docs/1es-pipeline-templates/features/buildworkflows/rust-virtual-task Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: pass activatedFeatures as whitespace-separated string Build 148041192 rejected the previous commit at YAML validation: /.azure-pipelines/templates/Rust.Build.Job.yml (Line: 136, Col: 13): A sequence was not expected Even though the 1ES Rust virtual task documents `activatedFeatures: string[]`, AzDO task `inputs:` only accept scalar values at the YAML schema layer; the 1ES task itself splits the scalar internally. Use a whitespace-separated string instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: scope activatedFeatures by OS (WXC vs LXC) Build 148041225's WXC jobs got the correct cargo line: cargo build ... --features hyperlight isolation_session microvm wslc But the LXC jobs failed because `lxc/Cargo.toml` only defines the `hyperlight` feature (no microvm/isolation_session/wslc). Previously this was hidden because `--all-features` enables only the features defined on the package being built, and lxc only has `hyperlight`. Split activatedFeatures by `item.os`: - windows (WXC) -> hyperlight isolation_session microvm wslc - linux (LXC) -> hyperlight Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Microsoft Reviewers: Open in CodeFlow