From 77ee6fe488a10449c23fc0518db8617e45a1cc1f Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Mon, 14 Sep 2026 14:17:11 +0200 Subject: [PATCH] Pin dxc to dxc_2026_07_29 and verify its SHA256 get-dxc.ps1 fetched releases/latest with no pin or hash, so the compiler that defines parity could change under the tests. It now downloads v1.9.2607's dxc_2026_07_29.zip (dxcompiler 1.9.0.5402) and refuses a zip whose SHA256 is not A1DFB116...CD241. The hash was taken from the zip downloaded from Microsoft's GitHub release and matches the digest GitHub publishes for the asset. Script ran end to end and installed 1.9.0.5402. Co-Authored-By: Claude Opus 5 --- packages/cultmath/tools/get-dxc.ps1 | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/packages/cultmath/tools/get-dxc.ps1 b/packages/cultmath/tools/get-dxc.ps1 index 2f3363f3..d9b12593 100644 --- a/packages/cultmath/tools/get-dxc.ps1 +++ b/packages/cultmath/tools/get-dxc.ps1 @@ -8,26 +8,27 @@ $repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..") $installPath = Join-Path $repoRoot $InstallRoot New-Item -ItemType Directory -Force -Path $installPath | Out-Null -$release = Invoke-RestMethod ` - -Uri "https://api.github.com/repos/microsoft/DirectXShaderCompiler/releases/latest" ` - -Headers @{ "User-Agent" = "CultMath-DXC-Bootstrap" } +# Pinned: parity means this compiler's lowering (dxcompiler 1.9.0.5402). The hash is the SHA256 +# of dxc_2026_07_29.zip downloaded from Microsoft's GitHub release v1.9.2607, and matches the +# digest GitHub publishes for that asset. +$zipName = "dxc_2026_07_29.zip" +$zipUrl = "https://github.com/microsoft/DirectXShaderCompiler/releases/download/v1.9.2607/$zipName" +$zipSha256 = "A1DFB116BA3EEAE6A1582291B53A8E7BF65AD760676BD3194685C8F7367CD241" -$asset = $release.assets | - Where-Object { $_.name -like "dxc_*.zip" } | - Select-Object -First 1 - -if (-not $asset) { - throw "No Windows dxc_*.zip asset found on the latest DirectXShaderCompiler release." -} - -$zipPath = Join-Path $installPath $asset.name +$zipPath = Join-Path $installPath $zipName Remove-Item -LiteralPath $zipPath -Force -ErrorAction SilentlyContinue -& curl.exe -L --retry 5 --retry-delay 2 --fail -o $zipPath $asset.browser_download_url +& curl.exe -L --retry 5 --retry-delay 2 --fail -o $zipPath $zipUrl if ($LASTEXITCODE -ne 0) { throw "curl.exe failed with exit code $LASTEXITCODE." } +$actualSha256 = (Get-FileHash -LiteralPath $zipPath -Algorithm SHA256).Hash +if ($actualSha256 -ne $zipSha256) { + Remove-Item -LiteralPath $zipPath -Force + throw "$zipName SHA256 is $actualSha256, expected $zipSha256." +} + $currentPath = Join-Path $installPath "current" Remove-Item -LiteralPath $currentPath -Recurse -Force -ErrorAction SilentlyContinue New-Item -ItemType Directory -Force -Path $currentPath | Out-Null