Repository navigation
ORT 1.30.1 Cherry Picks - 3 - #33651
Merged
Merged
Conversation
This pull request updates the build pipeline to improve Python package installation and proxy handling, and ensures SSL certificate trust for Python requests. The most important changes are: **Build Pipeline Improvements:** * The pipeline now installs both `requests` and `truststore` Python packages to improve SSL certificate handling in Python scripts. * Added steps to inspect and sanitize the `NO_PROXY` environment variable, ensuring it does not contain invalid entries before running the Python GitHub Action wrapper. **Python Script Enhancements:** * Updated `run_gh_action.py` to import and inject `truststore` into the Python SSL context, ensuring trusted certificate handling for HTTP requests. (cherry picked from commit 38dc99f) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3eb3fc9b-6147-4706-b7ad-47bb3476377b
eserscor
approved these changes
Oct 27, 2026
Akshay Sonawane (apsonawane)
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This cherry-picks the following commit for the release:
38dc99fba3f5bd72e201d1d942235bf4f600a1b3): work around the Windows certificate regression in build-tools setup by installing and injectingtruststore, inspecting proxy settings, and sanitizingNO_PROXYbefore invoking the GitHub Action wrapper.The full two-file cherry-pick applied cleanly, with source commit provenance preserved. This branch is based on current
rel-1.30.1, including #33524 and #33641.Motivation and Context
The internal release build failed in six Windows packaging jobs while downloading the build-tools action through
run_gh_action.py:CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificateThis upstream fix enables Python to use system-trusted certificates without disabling certificate verification.
The previous Python-version fix (#33561, backported through #33641) is present and package validation passed in both release runs.
This PR does not address the separate macOS checkout timeout or the Maven feed connection timeout in the CUDA13 build. Those failures need targeted infrastructure retries; no additional cherry-picks are currently indicated.
Validation:
truststoreinstallation/injection and the PowerShell wrapper invocation are present.git diff --cached --checkpassed before committing.