Customer/openvmm static baseline

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+charset = utf-8
+
+[*.rs]
+indent_style = space
+indent_size = 4
+
+[*.{yml,yaml,toml}]
+indent_style = space
+indent_size = 2

.gitattributes

@@ -1 +1,2 @@
+* text=auto eol=lf
 *.sh text eol=lf

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,16 +1,15 @@
-### Description of Changes:
-
-
-
-### Breaking Changes if any:
-
-
-
-
-### ✅ Admin Checklist
-- [ ] Review the PR description and ensure all necessary details are included.
-- [ ] Update/add unit tests for changed code.
-- [ ] Update/add documentation for new or changed APIs.
-- [ ] Run `cargo test --all-features` on `Windows` and `WSL`.
-
-Check the Developer Guidelines in [DEVELOPER.md](./DEVELOPER.md) for more info.
+### Description of Changes:
+
+
+
+### Breaking Changes if any:
+
+
+
+### ✅ Admin Checklist
+- [ ] PR targets the active `release/X.Y.Z` branch.
+- [ ] Review the PR description and ensure all necessary details are included.
+- [ ] Update/add unit tests for changed code.
+- [ ] Update/add documentation for new or changed APIs.
+
+Check the guidelines in [`CONTRIBUTING.md`](../CONTRIBUTING.md) for more info.

.github/workflows/bindgen.yml

@@ -5,6 +5,9 @@ on:
     branches: [ "main" ]
   pull_request:
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
 

.github/workflows/build_linux.yml

@@ -1,77 +1,72 @@
-name: Build Linux
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-
-env:
-  CARGO_TERM_COLOR: always
-  FEATURES_TO_TEST: md5,sha1,pkcs1-encrypt-decrypt
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - target: x86_64-unknown-linux-gnu
-          os: ubuntu-latest
-          runs-on: ubuntu-latest
-          run-tests: true
-        - target: aarch64-unknown-linux-gnu
-          os: ubuntu-24.04-arm
-          runs-on: ubuntu-24.04-arm
-          run-tests: true
-
-    runs-on: ${{ matrix.os }}
-    name: ${{ matrix.target }}    
-    env:
-      CARGO_BUILD_TARGET: ${{ matrix.target }}
-
-    steps:
-    - uses: actions/checkout@v4 # Checks out SymCrypt based on Github submodule
-      with:
-        submodules: true
-
-    - uses: Swatinem/rust-cache@v2
-
-    # Download SymCrypt via PMC
-    - name: Install SymCrypt via PMC
-      shell: bash
-      run: |
-        curl -sSL -O https://packages.microsoft.com/config/ubuntu/24.04/packages-microsoft-prod.deb
-        sudo dpkg -i packages-microsoft-prod.deb
-        sudo apt-get update
-        sudo apt-get install -y symcrypt
-
-    - name: Install host target
-      shell: pwsh
-      run: |
-        rustup target add ${{ matrix.target }}
-        if ("${{ matrix.target }}" -match "aarch64-unknown-linux-gnu") {
-          sudo apt update
-          sudo apt install gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
-        }
-
-    - name: Debug build
-      run: cargo build --locked --verbose --target ${{ matrix.target }}
-
-    - name: Release build
-      run: cargo build --release --locked --verbose --target ${{ matrix.target }}
-
-    - name: Run tests (Debug, dynamic)
-      if: matrix.run-tests
-      run: cargo test --locked --verbose --all-features --target ${{ matrix.target }}
-
-    - name: Run tests (Release, dynamic)
-      if: matrix.run-tests
-      run: cargo test --release --locked --verbose --all-features --target ${{ matrix.target }}
-
-    - name: Run test (Debug, static)
-      if: matrix.run-tests
-      run: cargo test --features ${{ env.FEATURES_TO_TEST }} --locked --target ${{ matrix.target }}
-
-    - name: Run test (Release, static)
-      if: matrix.run-tests
-      run: cargo test --features ${{ env.FEATURES_TO_TEST }} --locked --target ${{ matrix.target }}
+name: Build Linux
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  FEATURES_TO_TEST: md5,sha1,pkcs1-encrypt-decrypt
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - target: x86_64-unknown-linux-gnu
+          os: ubuntu-latest
+          runs-on: ubuntu-latest
+          run-tests: true
+        - target: aarch64-unknown-linux-gnu
+          os: ubuntu-24.04-arm
+          runs-on: ubuntu-24.04-arm
+          run-tests: true
+
+    runs-on: ${{ matrix.os }}
+    name: ${{ matrix.target }}    
+    env:
+      CARGO_BUILD_TARGET: ${{ matrix.target }}
+
+    steps:
+    - uses: actions/checkout@v4 # Checks out SymCrypt based on Github submodule
+      with:
+        submodules: true
+
+    - uses: Swatinem/rust-cache@v2
+
+    # Download SymCrypt via PMC
+    - name: Install SymCrypt via PMC
+      shell: bash
+      run: |
+        curl -sSL -O https://packages.microsoft.com/config/ubuntu/24.04/packages-microsoft-prod.deb
+        sudo dpkg -i packages-microsoft-prod.deb
+        sudo apt-get update
+        sudo apt-get install -y symcrypt
+
+    - name: Install host target
+      shell: pwsh
+      run: |
+        rustup target add ${{ matrix.target }}
+        if ("${{ matrix.target }}" -match "aarch64-unknown-linux-gnu") {
+          sudo apt update
+          sudo apt install gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+        }
+
+    - name: Debug build
+      run: cargo build --locked --verbose --target ${{ matrix.target }}
+
+    - name: Release build
+      run: cargo build --release --locked --verbose --target ${{ matrix.target }}
+
+    - name: Run tests (Debug)
+      if: matrix.run-tests
+      run: cargo test --locked --verbose --all-features --target ${{ matrix.target }}
+
+    - name: Run tests (Release)
+      if: matrix.run-tests
+      run: cargo test --release --locked --verbose --all-features --target ${{ matrix.target }}

.github/workflows/build_windows.yml

@@ -1,76 +1,76 @@
-name: Build Windows
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-
-env:
-  CARGO_TERM_COLOR: always
-  FEATURES_TO_TEST: md5,sha1,pkcs1-encrypt-decrypt
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - target: x86_64-pc-windows-msvc
-          os: windows-latest
-          runs-on: windows-latest
-          symcrypt: "https://github.com/microsoft/SymCrypt/releases/download/v103.8.0/symcrypt-windows-amd64-release-103.8.0-53be637d.zip"
-          run-tests: true
-        - target: aarch64-pc-windows-msvc
-          os: windows-latest
-          runs-on: windows-latest
-          symcrypt: "https://github.com/microsoft/SymCrypt/releases/download/v103.8.0/symcrypt-windows-arm64-release-103.8.0-53be637d.zip"
-          run-tests: false # Windows doesn't support ARM64 emulation
-    runs-on: ${{ matrix.os }}
-    name: ${{ matrix.target }}    
-    env:
-      CARGO_BUILD_TARGET: ${{ matrix.target }}
-
-    steps:
-    - uses: actions/checkout@v4 # Checks out SymCrypt based on Github submodule
-      with:
-        submodules: true
-
-    - uses: Swatinem/rust-cache@v2
-    
-    # Install host architecture, required for cross-compilation since there is no arm64-windows-msvc runner
-    - name: Install host target
-      shell: pwsh
-      run: |
-        rustup target add ${{ matrix.target }}
-
-    - name: Download SymCrypt and Set Environment Variables
-      shell: pwsh
-      run: |
-          Invoke-WebRequest -Uri ${{ matrix.symcrypt }} -OutFile symcrypt.zip
-          New-Item -ItemType Directory -Force -Path symcrypt
-          Expand-Archive -Path symcrypt.zip -DestinationPath symcrypt
-          echo "$env:GITHUB_WORKSPACE\symcrypt\dll" >> $env:GITHUB_PATH
-          echo "SYMCRYPT_LIB_PATH=$env:GITHUB_WORKSPACE\symcrypt\dll" >> $env:GITHUB_ENV
-          echo "PATH=$env:GITHUB_WORKSPACE\symcrypt\dll;$env:PATH" >> $env:GITHUB_ENV  
-    
-    - name: Debug build
-      run: cargo build --locked --verbose --target ${{ matrix.target }}
-
-    - name: Release build
-      run: cargo build --release --locked --verbose --target ${{ matrix.target }}
-
-    - name: Run tests (Debug, dynamic)
-      if: matrix.run-tests
-      run: cargo test --locked --verbose --all-features --target ${{ matrix.target }}
-
-    - name: Run tests (Release, dynamic)
-      if: matrix.run-tests
-      run: cargo test --release --locked --verbose --all-features --target ${{ matrix.target }}
-
-    - name: Run test (Debug, static)
-      if: matrix.run-tests
-      run: cargo test --features ${{ env.FEATURES_TO_TEST }} --locked --target ${{ matrix.target }}
-
-    - name: Run test (Release, static)
-      if: matrix.run-tests
-      run: cargo test --features ${{ env.FEATURES_TO_TEST }} --locked --target ${{ matrix.target }}
+# TODO: Re-enable once Azure host images ship with SymCrypt >= v103.11.0.
+# The current runner images have an older symcrypt.dll in System32 that causes
+# SymCryptModuleInit to crash with STATUS_STACK_BUFFER_OVERRUN. Our downloaded
+# v103.11.0 DLL cannot override it reliably via PATH or DLL staging.
+
+# name: Build Windows
+#
+# on:
+#   push:
+#     branches: [ "main" ]
+#   pull_request:
+#
+# permissions:
+#   contents: read
+#
+# env:
+#   CARGO_TERM_COLOR: always
+#   FEATURES_TO_TEST: md5,sha1,pkcs1-encrypt-decrypt
+#
+# jobs:
+#   build:
+#     strategy:
+#       fail-fast: false
+#       matrix:
+#         include:
+#         - target: x86_64-pc-windows-msvc
+#           os: windows-latest
+#           runs-on: windows-latest
+#           symcrypt: "https://github.com/microsoft/SymCrypt/releases/download/v103.11.0/symcrypt-windows-amd64-release-103.11.0-748c20f1.zip"
+#           run-tests: true
+#         - target: aarch64-pc-windows-msvc
+#           os: windows-latest
+#           runs-on: windows-latest
+#           symcrypt: "https://github.com/microsoft/SymCrypt/releases/download/v103.11.0/symcrypt-windows-arm64-release-103.11.0-748c20f1.zip"
+#           run-tests: false # Windows doesn't support ARM64 emulation
+#     runs-on: ${{ matrix.os }}
+#     name: ${{ matrix.target }}
+#     env:
+#       CARGO_BUILD_TARGET: ${{ matrix.target }}
+#
+#     steps:
+#     - uses: actions/checkout@v4 # Checks out SymCrypt based on Github submodule
+#       with:
+#         submodules: true
+#
+#     - uses: Swatinem/rust-cache@v2
+#
+#     # Install host architecture, required for cross-compilation since there is no arm64-windows-msvc runner
+#     - name: Install host target
+#       shell: pwsh
+#       run: |
+#         rustup target add ${{ matrix.target }}
+#
+#     - name: Download SymCrypt and Set Environment Variables
+#       shell: pwsh
+#       run: |
+#           Invoke-WebRequest -Uri ${{ matrix.symcrypt }} -OutFile symcrypt.zip
+#           New-Item -ItemType Directory -Force -Path symcrypt
+#           Expand-Archive -Path symcrypt.zip -DestinationPath symcrypt
+#           echo "$env:GITHUB_WORKSPACE\symcrypt\dll" >> $env:GITHUB_PATH
+#           echo "SYMCRYPT_LIB_PATH=$env:GITHUB_WORKSPACE\symcrypt\dll" >> $env:GITHUB_ENV
+#           echo "PATH=$env:GITHUB_WORKSPACE\symcrypt\dll;$env:PATH" >> $env:GITHUB_ENV
+#
+#     - name: Debug build
+#       run: cargo build --locked --verbose --target ${{ matrix.target }}
+#
+#     - name: Release build
+#       run: cargo build --release --locked --verbose --target ${{ matrix.target }}
+#
+#     - name: Run tests (Debug)
+#       if: matrix.run-tests
+#       run: cargo test --locked --verbose --all-features --target ${{ matrix.target }}
+#
+#     - name: Run tests (Release)
+#       if: matrix.run-tests
+#       run: cargo test --release --locked --verbose --all-features --target ${{ matrix.target }}