From 2df71a0ced62cd9e7632180f4b5a9716f634b101 Mon Sep 17 00:00:00 2001
From: Christof Marti <chrmarti@microsoft.com>
Date: Tue, 14 Jul 2026 15:31:28 +0200
Subject: [PATCH] Fix pipeline

---
 azure-pipelines/cargo/config.toml             | 11 ++++++++
 azure-pipelines/publish.yml                   | 12 +++++----
 azure-pipelines/steps/authenticate-cargo.yml  | 12 +++++++++
 azure-pipelines/steps/build-linux-addon.yml   | 25 ++++---------------
 azure-pipelines/steps/build-macos-addon.yml   | 10 +++++---
 azure-pipelines/steps/build-windows-addon.yml | 13 +++++++---
 npm/scripts/build-linux-native.sh             | 17 ++++++++++++-
 7 files changed, 67 insertions(+), 33 deletions(-)
 create mode 100644 azure-pipelines/cargo/config.toml
 create mode 100644 azure-pipelines/steps/authenticate-cargo.yml

diff --git a/azure-pipelines/cargo/config.toml b/azure-pipelines/cargo/config.toml
new file mode 100644
index 0000000..fcbd6fd
--- /dev/null
+++ b/azure-pipelines/cargo/config.toml
@@ -0,0 +1,11 @@
+[registry]
+global-credential-providers = ["cargo:token"]
+
+[registries.vscode]
+index = "sparse+https://pkgs.dev.azure.com/monacotools/Monaco/_packaging/vscode/Cargo/index/"
+
+[source.crates-io]
+replace-with = "vscode"
+
+[source.vscode]
+registry = "sparse+https://pkgs.dev.azure.com/monacotools/Monaco/_packaging/vscode/Cargo/index/"
\ No newline at end of file
diff --git a/azure-pipelines/publish.yml b/azure-pipelines/publish.yml
index e56e603..f909e73 100644
--- a/azure-pipelines/publish.yml
+++ b/azure-pipelines/publish.yml
@@ -109,7 +109,7 @@ extends:
         ghCreateRelease: false
         testPlatforms: {}
         buildSteps:
-          - template: azure-pipelines/common/steps/setup-linux-toolchains.yml@templates
+          - template: /azure-pipelines/common/steps/setup-linux-toolchains.yml@templates
             parameters:
               arch: x64
               nodeVersion: 22.x
@@ -130,14 +130,15 @@ extends:
         ghCreateRelease: false
         testPlatforms: {}
         buildSteps:
-          - template: azure-pipelines/common/steps/setup-linux-toolchains.yml@templates
+          - template: /azure-pipelines/common/steps/setup-linux-toolchains.yml@templates
             parameters:
               arch: arm64
               nodeVersion: 22.x
+          # The network-isolated x64 package agent has no ARM Node runtime.
+          # GitHub CI runs the Rust wasm2c backend under QEMU for this target.
           - template: azure-pipelines/steps/build-linux-addon.yml@self
             parameters:
               target: aarch64-unknown-linux-gnu
-              test: true
 
       - name: os-proxy-resolver-linux-arm-gnueabihf
         dependsOn: os-proxy-resolver-linux-arm64-gnu
@@ -151,14 +152,15 @@ extends:
         ghCreateRelease: false
         testPlatforms: {}
         buildSteps:
-          - template: azure-pipelines/common/steps/setup-linux-toolchains.yml@templates
+          - template: /azure-pipelines/common/steps/setup-linux-toolchains.yml@templates
             parameters:
               arch: arm
               nodeVersion: 22.x
+          # The network-isolated x64 package agent has no ARMv7 Node runtime.
+          # GitHub CI runs the Rust wasm2c backend under QEMU for this target.
           - template: azure-pipelines/steps/build-linux-addon.yml@self
             parameters:
               target: armv7-unknown-linux-gnueabihf
-              test: true
 
       - name: os-proxy-resolver
         dependsOn: os-proxy-resolver-linux-arm-gnueabihf
diff --git a/azure-pipelines/steps/authenticate-cargo.yml b/azure-pipelines/steps/authenticate-cargo.yml
new file mode 100644
index 0000000..9f7e26b
--- /dev/null
+++ b/azure-pipelines/steps/authenticate-cargo.yml
@@ -0,0 +1,12 @@
+steps:
+  - pwsh: |
+      $cargoHome = Join-Path "$(Agent.TempDirectory)" "cargo"
+      New-Item -ItemType Directory -Force $cargoHome | Out-Null
+      Copy-Item "$(Build.SourcesDirectory)/azure-pipelines/cargo/config.toml" (Join-Path $cargoHome "config.toml") -Force
+      Write-Host "##vso[task.setvariable variable=CARGO_HOME]$cargoHome"
+    displayName: Configure Cargo home
+
+  - task: CargoAuthenticate@0
+    inputs:
+      configFile: $(CARGO_HOME)/config.toml
+    displayName: Authenticate Cargo registry
\ No newline at end of file
diff --git a/azure-pipelines/steps/build-linux-addon.yml b/azure-pipelines/steps/build-linux-addon.yml
index 6b65027..a9f3d3d 100644
--- a/azure-pipelines/steps/build-linux-addon.yml
+++ b/azure-pipelines/steps/build-linux-addon.yml
@@ -6,6 +6,8 @@ parameters:
     default: false
 
 steps:
+  - template: authenticate-cargo.yml
+
   - bash: |
       set -e
       mkdir -p "$(Agent.TempDirectory)/wabt" pac-wasm-guest/generated
@@ -17,23 +19,6 @@ steps:
         npm/scripts/build-linux-native.sh ${{ parameters.target }}
     displayName: Build Linux addon
 
-  - ${{ if parameters.test }}:
-      - ${{ if eq(parameters.target, 'x86_64-unknown-linux-gnu') }}:
-          - script: npm run test:npm
-            displayName: Test Linux x64 addon
-      - ${{ else }}:
-          - bash: |
-              set -e
-              sudo docker run --rm --privileged \
-                tonistiigi/binfmt:qemu-v10.0.4@sha256:8f58e6214f4cc9dc83ce8f5acad1ece508eb6b20e696a8c1e9f274481982c541 \
-                --install arm64,arm
-              case '${{ parameters.target }}' in
-                aarch64-unknown-linux-gnu) platform=linux/arm64 ;;
-                armv7-unknown-linux-gnueabihf) platform=linux/arm/v7 ;;
-                *) echo 'Unsupported emulated target: ${{ parameters.target }}' >&2; exit 2 ;;
-              esac
-              sudo docker run --rm --platform "$platform" \
-                -v "$(Build.SourcesDirectory):/workspace" -w /workspace \
-                node:22.22.0-bookworm@sha256:20a424ecd1d2064a44e12fe287bf3dae443aab31dc5e0c0cb6c74bef9c78911c \
-                node npm/test/smoke.js
-            displayName: Test Linux ARM addon under QEMU
\ No newline at end of file
+  - ${{ if eq(parameters.test, true) }}:
+      - script: npm run test:npm
+        displayName: Test Linux addon
diff --git a/azure-pipelines/steps/build-macos-addon.yml b/azure-pipelines/steps/build-macos-addon.yml
index 7bd8d1f..30cd9d7 100644
--- a/azure-pipelines/steps/build-macos-addon.yml
+++ b/azure-pipelines/steps/build-macos-addon.yml
@@ -6,11 +6,15 @@ parameters:
     default: false
 
 steps:
+  - template: authenticate-cargo.yml
+
   - bash: |
       set -e
       brew install wabt
       wasm2c --version
       node npm/scripts/build-native.js ${{ parameters.target }}
-      ${{ if parameters.test }}:
-        npm run test:npm
-    displayName: ${{ parameters.test && 'Build and test macOS addon' || 'Build macOS addon' }}
\ No newline at end of file
+    displayName: Build macOS addon
+
+  - ${{ if eq(parameters.test, true) }}:
+      - script: npm run test:npm
+        displayName: Test macOS addon
diff --git a/azure-pipelines/steps/build-windows-addon.yml b/azure-pipelines/steps/build-windows-addon.yml
index 844944b..f16075c 100644
--- a/azure-pipelines/steps/build-windows-addon.yml
+++ b/azure-pipelines/steps/build-windows-addon.yml
@@ -6,6 +6,8 @@ parameters:
     default: false
 
 steps:
+  - template: authenticate-cargo.yml
+
   - pwsh: |
       $ErrorActionPreference = "Stop"
       $wabt = "$(Agent.TempDirectory)/wabt"
@@ -19,7 +21,10 @@ steps:
       if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
       node npm/scripts/build-native.js ${{ parameters.target }}
       if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-      ${{ if parameters.test }}:
-        npm run test:npm
-        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-    displayName: ${{ parameters.test && 'Build and test Windows addon' || 'Build Windows addon' }}
\ No newline at end of file
+    displayName: Build Windows addon
+
+  - ${{ if eq(parameters.test, true) }}:
+      - pwsh: |
+          npm run test:npm
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+        displayName: Test Windows addon
diff --git a/npm/scripts/build-linux-native.sh b/npm/scripts/build-linux-native.sh
index 7659976..71a40a9 100755
--- a/npm/scripts/build-linux-native.sh
+++ b/npm/scripts/build-linux-native.sh
@@ -33,11 +33,26 @@ toolchain_root="/tmp/vscode-${sysroot_arch}-sysroot/${toolchain}"
 sysroot="${toolchain_root}/${toolchain}/sysroot"
 compiler="${toolchain_root}/bin/${toolchain}-gcc"
 objdump="${toolchain_root}/${toolchain}/bin/objdump"
+rust_sysroot=$(rustc --print sysroot)
+rust_host=$(rustc -vV | sed -n 's/^host: //p')
+rust_lld="${rust_sysroot}/lib/rustlib/${rust_host}/bin/gcc-ld/ld.lld"
+linker_directory="${TMPDIR:-/tmp}/os-proxy-resolver-linker-${target}"
 
 if [[ ! -x "$compiler" || ! -d "$sysroot" || ! -x "$objdump" ]]; then
 	echo "VS Code glibc 2.28 sysroot for ${sysroot_arch} is not installed" >&2
 	exit 1
 fi
+if [[ ! -x "$rust_lld" ]]; then
+	echo "Rust toolchain does not provide the modern linker ${rust_lld}" >&2
+	exit 1
+fi
+
+# The glibc 2.28 sysroot's GCC driver selects the correct CRT and libraries,
+# but its binutils linker cannot read zstd-compressed debug sections in current
+# Rust rlibs. GCC's -B option keeps it as the driver while making it invoke the
+# modern ld.lld shipped with Rust for the final link.
+mkdir -p "$linker_directory"
+ln -sf "$rust_lld" "${linker_directory}/ld"
 
 target_env=$(printf '%s' "$target" | tr '[:lower:]-' '[:upper:]_')
 cc_env="CC_$(printf '%s' "$target" | tr '-' '_')"
@@ -48,7 +63,7 @@ rustflags_env="CARGO_TARGET_${target_env}_RUSTFLAGS"
 export "$cc_env=$compiler"
 export "$cflags_env=--sysroot=$sysroot"
 export "$linker_env=$compiler"
-export "$rustflags_env=-C link-arg=--sysroot=$sysroot -C link-arg=-L${sysroot}/usr/lib/${library_arch} -C link-arg=-L${sysroot}/lib/${library_arch}"
+export "$rustflags_env=-C link-arg=-B${linker_directory} -C link-arg=--sysroot=$sysroot -C link-arg=-L${sysroot}/usr/lib/${library_arch} -C link-arg=-L${sysroot}/lib/${library_arch}"
 
 cd "$root"
 node npm/scripts/build-native.js "$target"