From 42b69529d8eff7458f51085bb4219a1e026d9999 Mon Sep 17 00:00:00 2001 From: Manuel Candales Date: Tue, 17 Mar 2026 21:27:29 -0400 Subject: [PATCH 1/3] Windows wheels: init submodules in pre-build script with OpenSSL The previous fix (setting sslBackend in pre_build_script.sh) only applied to nested tokenizer submodules. The top-level submodule checkout still used schannel via the reusable workflow's `submodules: true`, causing SEC_E_ILLEGAL_MESSAGE errors when cloning from git.gitlab.arm.com. Move all submodule initialization into the pre-build script where we can control the SSL backend, and disable submodule checkout in the workflow. --- .ci/scripts/wheel/pre_build_script.sh | 10 +++++++++- .github/workflows/build-wheels-windows.yml | 4 +++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.ci/scripts/wheel/pre_build_script.sh b/.ci/scripts/wheel/pre_build_script.sh index bf48d3bc29f..6a73fa36b36 100755 --- a/.ci/scripts/wheel/pre_build_script.sh +++ b/.ci/scripts/wheel/pre_build_script.sh @@ -21,12 +21,20 @@ if [[ "$(uname -m)" == "aarch64" ]]; then echo "the file $file has been modified for atomic to use full path" fi +# Initialize submodules here instead of during checkout so we can use OpenSSL +# on Windows (schannel fails with SEC_E_ILLEGAL_MESSAGE on some gitlab hosts). +UNAME_S=$(uname -s) +if [[ $UNAME_S == *"MINGW"* || $UNAME_S == *"MSYS"* ]]; then + git -c http.sslBackend=openssl submodule update --init +else + git submodule update --init +fi + # Clone nested submodules for tokenizers - this is a workaround for recursive # submodule clone failing due to path length limitations on Windows. Eventually, # we should update the core job in test-infra to enable long paths before # checkout to avoid needing to do this. pushd extension/llm/tokenizers -UNAME_S=$(uname -s) if [[ $UNAME_S == *"MINGW"* || $UNAME_S == *"MSYS"* ]]; then git -c http.sslBackend=openssl submodule update --init else diff --git a/.github/workflows/build-wheels-windows.yml b/.github/workflows/build-wheels-windows.yml index 7fe6f880878..f4ded5dc3de 100644 --- a/.github/workflows/build-wheels-windows.yml +++ b/.github/workflows/build-wheels-windows.yml @@ -64,4 +64,6 @@ jobs: smoke-test-script: ${{ matrix.smoke-test-script }} trigger-event: ${{ github.event_name }} wheel-build-params: "--verbose" - submodules: true + # Submodules are initialized in pre_build_script.sh with OpenSSL to avoid + # schannel SSL errors on Windows when cloning from non-GitHub hosts. + submodules: false From 77989a2d3833d863b824890eebc71ba1564b044d Mon Sep 17 00:00:00 2001 From: Manuel Candales Date: Tue, 17 Mar 2026 21:38:19 -0400 Subject: [PATCH 2/3] Move submodule init before aarch64 workaround, deduplicate UNAME_S Move submodule initialization above the aarch64 sed workaround so the file it edits is guaranteed to exist even if the caller disables submodule checkout. Also remove the redundant UNAME_S assignment later in the script. --- .ci/scripts/wheel/pre_build_script.sh | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/.ci/scripts/wheel/pre_build_script.sh b/.ci/scripts/wheel/pre_build_script.sh index 6a73fa36b36..365398d27a4 100755 --- a/.ci/scripts/wheel/pre_build_script.sh +++ b/.ci/scripts/wheel/pre_build_script.sh @@ -9,18 +9,6 @@ set -euxo pipefail # This script is run before building ExecuTorch binaries -if [[ "$(uname -m)" == "aarch64" ]]; then - # On some Linux aarch64 systems, the "atomic" library is not found during linking. - # To work around this, replace "atomic" with the literal ${ATOMIC_LIB} so the - # build system uses the full path to the atomic library. - file="extension/llm/tokenizers/third-party/sentencepiece/src/CMakeLists.txt" - sed 's/list(APPEND SPM_LIBS "atomic")/list(APPEND SPM_LIBS ${ATOMIC_LIB})/' \ - "$file" > "${file}.tmp" && mv "${file}.tmp" "$file" - - grep -n 'list(APPEND SPM_LIBS ${ATOMIC_LIB})' "$file" && \ - echo "the file $file has been modified for atomic to use full path" -fi - # Initialize submodules here instead of during checkout so we can use OpenSSL # on Windows (schannel fails with SEC_E_ILLEGAL_MESSAGE on some gitlab hosts). UNAME_S=$(uname -s) @@ -42,9 +30,20 @@ else fi popd +if [[ "$(uname -m)" == "aarch64" ]]; then + # On some Linux aarch64 systems, the "atomic" library is not found during linking. + # To work around this, replace "atomic" with the literal ${ATOMIC_LIB} so the + # build system uses the full path to the atomic library. + file="extension/llm/tokenizers/third-party/sentencepiece/src/CMakeLists.txt" + sed 's/list(APPEND SPM_LIBS "atomic")/list(APPEND SPM_LIBS ${ATOMIC_LIB})/' \ + "$file" > "${file}.tmp" && mv "${file}.tmp" "$file" + + grep -n 'list(APPEND SPM_LIBS ${ATOMIC_LIB})' "$file" && \ + echo "the file $file has been modified for atomic to use full path" +fi + # On Windows, enable symlinks and re-checkout the current revision to create # the symlinked src/ directory. This is needed to build the wheel. -UNAME_S=$(uname -s) if [[ $UNAME_S == *"MINGW"* || $UNAME_S == *"MSYS"* ]]; then echo "Enabling symlinks on Windows" git config core.symlinks true From 8033f32805f7e4fb688fe71e63d3411ba648320f Mon Sep 17 00:00:00 2001 From: Manuel Candales Date: Wed, 18 Mar 2026 10:03:11 -0400 Subject: [PATCH 3/3] Windows wheels: increase build timeout to 2 hours The default 60-minute timeout from pytorch/test-infra is too tight for the Windows wheel build + smoke test, causing jobs to be cancelled. --- .github/workflows/build-wheels-windows.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build-wheels-windows.yml b/.github/workflows/build-wheels-windows.yml index f4ded5dc3de..d1151e47b76 100644 --- a/.github/workflows/build-wheels-windows.yml +++ b/.github/workflows/build-wheels-windows.yml @@ -64,6 +64,7 @@ jobs: smoke-test-script: ${{ matrix.smoke-test-script }} trigger-event: ${{ github.event_name }} wheel-build-params: "--verbose" + timeout: 120 # Submodules are initialized in pre_build_script.sh with OpenSSL to avoid # schannel SSL errors on Windows when cloning from non-GitHub hosts. submodules: false