From bb635ed44acc37cf451310276f32fca22c51017b Mon Sep 17 00:00:00 2001 From: Daniel Jurek Date: Thu, 13 Aug 2026 11:01:47 -0700 Subject: [PATCH] Point vcpkg asset cache at the Terrapin mirror Route vcpkg asset (source tarball) downloads through the Microsoft-hosted Terrapin mirror instead of the azuresdkartifacts storage account, so vcpkg builds fetch upstream sources from an approved mirror under network isolation. set-vcpkg-cache-vars.yml now sets X_VCPKG_ASSET_SOURCES to the Terrapin mirror with x-block-origin, which fails the build if a source is missing from the mirror rather than silently falling back to the public internet. The value is no longer a secret because it carries no SAS token, so it can be set directly instead of being plumbed through X_VCPKG_ASSET_SOURCES_SECRET. Set-VcpkgWriteModeCache.ps1 no longer sets a write-mode asset source. That line overrode the read-only Terrapin mirror in internal builds and would have sent asset downloads back to the storage account. The binary cache is unchanged and remains read/write there. The tools-local copy at eng/scripts/Set-VcpkgWriteModeCache.ps1 is not synced to language repos and is left alone. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f3a428db-e276-4363-afd9-a944e8533203 --- .../pipelines/templates/steps/set-vcpkg-cache-vars.yml | 5 +++-- eng/common/scripts/Set-VcpkgWriteModeCache.ps1 | 1 - 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml b/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml index c7ece396e0..7827494c5c 100644 --- a/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml +++ b/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml @@ -6,9 +6,10 @@ parameters: steps: - pwsh: | - Write-Host "Setting vcpkg cache variables for read only access to vcpkg binary and asset caches" + Write-Host "Setting vcpkg cache variables for read only access to the vcpkg binary cache" Write-Host '##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azcopy,https://azuresdkartifacts.blob.core.windows.net/public-vcpkg-container,read' - Write-Host '##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES_SECRET;issecret=true;]clear;x-azurl,https://azuresdkartifacts.blob.core.windows.net/public-vcpkg-container,,read' + Write-Host "Setting Terrapin asset source for read only access to the vcpkg source mirror" + Write-Host '##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES]clear;x-azurl,https://vcpkg.storage.devpackages.microsoft.io/artifacts/;x-block-origin' displayName: Set vcpkg variables - ${{if eq(variables['System.TeamProject'], 'internal') }}: diff --git a/eng/common/scripts/Set-VcpkgWriteModeCache.ps1 b/eng/common/scripts/Set-VcpkgWriteModeCache.ps1 index 37bca90019..27bdef477d 100755 --- a/eng/common/scripts/Set-VcpkgWriteModeCache.ps1 +++ b/eng/common/scripts/Set-VcpkgWriteModeCache.ps1 @@ -20,4 +20,3 @@ Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SAS_TOKEN;issecret=true Write-Host "Setting vcpkg binary cache to read and write" Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azcopy-sas,https://$StorageAccountName.blob.core.windows.net/$StorageContainerName,$vcpkgBinarySourceSas,readwrite" -Write-Host "##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES_SECRET;issecret=true;]clear;x-azurl,https://$StorageAccountName.blob.core.windows.net/$StorageContainerName,$vcpkgBinarySourceSas,readwrite"