fix(ci): guard win7 webview2 loader link against sccache

v0.6.0 shipped a win7/Server 2012 R2 installer whose dbx.exe statically linked a WebView2 loader >= 1.0.1054.31 instead of the pinned 1.0.902.49, failing on kernel 6.3 with ERROR_NOT_SUPPORTED. The loader patch rewrites a file inside the cargo registry, which no compile cache can observe, so the win7 release job stops using sccache until the loader is vendored, and a binary audit now rejects any dbx.exe carrying post-1.0.902.49 loader strings.
2026-10-21 08:13:34 +00:00 · 2026-09-02 21:08:39 +08:00
parent 7d92433689
commit 11ff1c29a6
4 changed files with 94 additions and 38 deletions
@@ -0,0 +1,54 @@
+[CmdletBinding()]
+param(
+  [Parameter(Mandatory = $true)]
+  [string]$BinaryPath
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+# The Win7 / Server 2012 R2 bundle must statically link the WebView2 loader from
+# SDK 1.0.902.49, the last one verified to work on kernel 6.1/6.3. Loader
+# 1.0.1054.31 and everything newer fail on Server 2012 R2 with
+# ERROR_NOT_SUPPORTED (0x80070032, MicrosoftEdge/WebView2Feedback#2025) and make
+# the app show "Could not find the WebView2 Runtime". Those loaders carry error
+# strings that 1.0.902.49 does not, so any of the markers below appearing in
+# dbx.exe proves the pinned loader was not the one linked. The PE import audit
+# cannot catch this: 1.0.1054.31 imports nothing newer than 1.0.902.49.
+$loaderMarkers = @(
+  "Failed to find the Web",
+  "Failed to find the app",
+  "Failed to find an inst",
+  "WebView2: Failed to find an installed"
+)
+
+if (!(Test-Path -LiteralPath $BinaryPath -PathType Leaf)) {
+  throw "Win7 WebView2 loader audit target does not exist: $BinaryPath"
+}
+
+$resolvedPath = (Resolve-Path -LiteralPath $BinaryPath).Path
+# Map every byte to one character so the ASCII needle search cannot miss on
+# arbitrary binary content.
+$latin1 = [System.Text.Encoding]::GetEncoding(28591)
+$content = $latin1.GetString([System.IO.File]::ReadAllBytes($resolvedPath))
+
+$violations = @()
+foreach ($marker in $loaderMarkers) {
+  if ($content.Contains($marker)) {
+    $violations += $marker
+  }
+}
+
+if ($violations.Count -gt 0) {
+  $summary = $violations -join "`n"
+  throw @"
+dbx.exe contains WebView2 loader strings newer than the pinned 1.0.902.49:
+$summary
+
+A loader >= 1.0.1054.31 was linked instead of the prepared one and will fail on
+Server 2012 R2 with ERROR_NOT_SUPPORTED. Do not ship this binary: rebuild the
+win7 target and investigate how the registry loader patch was bypassed.
+"@
+}
+
+Write-Host "Win7 WebView2 loader audit passed: no post-1.0.902.49 loader markers in $resolvedPath"