NVX: Replace native DLL handling with aci_edge_sandboxes crate by huzaifa-d · Pull Request #1672 · microsoft/mxc

Huzaifa Danish (huzaifa-d) · 2026-11-04T20:43:40Z

📖 Description

Replace the active native integration for the existing NVX backend with published aci_edge_sandboxes = "=0.1.1" crate and its agent-bundled feature.

🔗 References

🔍 Validation

Tests ran locally on Windows x64. Cargo commands ran from src; Node commands ran from the repository root.

✅ Checklist

Signed the Contributor License Agreement
Linked to an issue
For features or changes requiring a spec: linked the issue with maintainer-applied feature-accepted
For implementation: linked the required approved and merged design/API spec, or explained why no spec is required
Feature issue remains open unless this PR completes all agreed implementation, validation, and documentation
Updated documentation (if applicable)
Updated Copilot instructions (if build, architecture, or conventions changed)
If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

Bug fix
Feature
Task

Microsoft Reviewers: Open in CodeFlow

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Verify Authenticode trust and Microsoft publisher identity during build, artifact/package validation and before runtime use. Retain file and directory guards through client ownership, and remove unrelated integration hunks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Rebuild the verified signer's chain with explicit revocation checking and reject every raw chain trust error, independently of permissive Authenticode policy. Preserve the verified signing time and cover unknown, offline and untrusted status bits. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Apply strict chain checks to timestamp countersigners as well as the Microsoft publisher, without imposing the publisher identity on timestamp authorities. Cover successful publisher chains with revoked or indeterminate timestamps and missing countersigner data. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Check that signed OpenVMM and image-tool help commands can launch while the signature guards prevent replacement, without provisioning a VM. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Reuse the existing module pin before opening the agent client. Exercise a public JSON failure without filesystem grants and keep a simulated worker alive across library unload; require the scenario in Windows CI. Correct archive-override digest guidance. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Represent the successfully allocated chain with NonNull before inspecting trust status. Preserve fail-closed null handling and release the same context after the read. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

Security-sensitive Windows trust and lifecycle changes need maintainer validation, with current-head VM/cross-platform runs and key certificate fixtures still unverified, plus unresolved dependency-feed and integration prerequisites.

No open issues 🎉

What changed in this PR

Replaces the existing experimental Windows x64 NVX backend’s active native integration with aci_edge_sandboxes 0.1.1, continuing the work from #1538 without adding public SDK APIs or schema fields. Disconnected legacy files remain for separate cleanup.

Changes:

Delegates bundle acquisition, native bindings, policy types, and lifecycle operations to the published crate.
Adds Microsoft Authenticode verification, file/directory guards, and module retention for background-worker safety.
Extends regression tests, packaged/staged validation, CI gates, and backend documentation.

The PR remains a draft: dependency-feed availability, a clean current-head real-VM run, and cross-platform/remote validation remain outstanding, as documented in the description.

File	Description
`src/mxc-sdk/tests/nvx/crate_bundle_integrity.rs`	Adds signature, integrity, file-locking, and pre-load rejection tests.
`src/mxc-sdk/tests/nvx_e2e.rs`	Extends environment, ingress, and proxy-port validation scenarios.
`src/mxc-sdk/tests/module_lifetime.rs`	Adds an isolated NVX module-retention regression.
`src/mxc-sdk/tests/fixtures/module_lifetime.rs`	Models a pending worker after a native validation error.
`src/mxc-sdk/src/backends/nvx/signature_verification.rs`	Verifies publisher trust and certificate chains; guards verified files.
`src/mxc-sdk/src/backends/nvx/runner.rs`	Adapts execution orchestration and tests to crate-owned types.
`src/mxc-sdk/src/backends/nvx/policy.rs`	Maps MXC policy and process settings into crate types.
`src/mxc-sdk/src/backends/nvx/mod.rs`	Selects the crate-backed runtime and signature verifier.
`src/mxc-sdk/src/backends/nvx/crate_runtime.rs`	Implements crate-backed lifecycle, capture, cancellation, and cleanup.
`src/mxc-sdk/Cargo.toml`	Pins the Windows x64 dependency and registers integrity tests.
`src/mxc-sdk/build/build_nvx_signatures.rs`	Checks crate-staged and profile bundles during builds.
`src/mxc-sdk/build.rs`	Replaces the legacy downloader hook with signature validation.
`src/Cargo.lock`	Locks the new crate and its dependency graph.
`scripts/tests/microvm-validation.test.js`	Tests packaging, staging, and module-lifetime gate failures.
`scripts/ci/stage-nvx-validation-tests.ps1`	Requires staged bundle signature and integrity validation.
`scripts/ci/Invoke-CratePackage.ps1`	Runs integrity validation from the extracted crate package.
`docs/development/build-and-test/ci-validation-infrastructure.md`	Documents updated bundle and module-lifetime validation gates.
`docs/backends/nvx/nvx.md`	Documents crate ownership, trust requirements, overrides, and cleanup limits.
`.github/workflows/Build.Windows.Job.yml`	Builds the unload fixture and requires the x64 NVX regression to pass.

_{Review effort: Balanced}

Rename the helper and explain its build-time checks. Update its callers and remove the requested module-lifetime documentation paragraph. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Combine the CI artifact documentation changes and retain main's host CPU profile in the active crate-backed adapter. Preserve the renamed signature helper and requested documentation removal. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

The native runtime replacement relies on an unavailable dependency implementation for cancellation and teardown guarantees, while Windows x64 validation of worker cleanup and Authenticode enforcement remains outstanding.

No open issues 🎉

_{Review effort: Balanced}

Bound cancellation and result observation without joining stalled native calls. Anchor the full runtime inventory to an independently approved checksum-list hash, including guest assets and metadata, and keep verified files guarded. Extend package/staging verification with public pre-load negative controls. Clarify disconnected-host trust requirements and remove the four obsolete implementation files. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

Native worker lifetime, cancellation/teardown, and Windows signature enforcement require maintainer verification because dependency internals were unavailable and Windows x64/WHP validation could not be run.

No open issues 🎉

_{Review effort: Balanced}

Huzaifa Danish (huzaifa-d) · 2026-11-07T00:45:44Z

Copilot resolve the merge conflicts in this pull request

Resolve the runtime, policy, manifest, documentation and test conflicts. Adapt streaming output, lifecycle IDs, provision metadata and persistent state locks to crate-owned execution while retaining independent bundle authentication and bounded cancellation. Keep main's memory support and add boundary and stream-ordering regressions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Describe the extended SDK JSON scenario and distinguish caller-owned lifecycle containers from create-and-run cleanup. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

An elevated first lifecycle call can leave the nvx directory owned by Administrators, causing later non-elevated calls by the same user to fail ownership validation and block retained-container lifecycle operations.

1 open issue

Set current user as owner when creating protected directories · New

_{Review effort: Balanced}

huzaifa-msft and others added 7 commits November 3, 2026 14:00

Integrate NVX through aci_edge_sandboxes 0.1.1

5a8ebae

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Exercise verified NVX tools while file guards are held

6e63ddf

Check that signed OpenVMM and image-tool help commands can launch while the signature guards prevent replacement, without provisioning a VM. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings November 4, 2026 20:43

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) November 4, 2026 20:44

View session

Copilot AI reviewed Nov 4, 2026

View reviewed changes

Huzaifa Danish (huzaifa-d) marked this pull request as ready for review November 4, 2026 21:15

Huzaifa Danish (huzaifa-d) requested a review from a team as a code owner November 4, 2026 21:15

huzaifa-msft and others added 2 commits November 4, 2026 13:28

Clarify the NVX signature build helper

2691b60

Rename the helper and explain its build-time checks. Update its callers and remove the requested module-lifetime documentation paragraph. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings November 4, 2026 21:35

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) November 4, 2026 21:36

View session

Copilot AI reviewed Nov 4, 2026

View reviewed changes

Huzaifa Danish (huzaifa-d) changed the title ~~Add crate-backed NVX integration with aci_edge_sandboxes 0.1.1~~ NVX: Replace native DLL handling with aci_edge_sandboxes crate Nov 4, 2026

Huzaifa Danish (huzaifa-d) closed this Nov 4, 2026

Huzaifa Danish (huzaifa-d) reopened this Nov 4, 2026

Soham Das (SohamDas2021) requested changes Nov 5, 2026

View reviewed changes

Comment thread src/mxc-sdk/src/backends/nvx/crate_runtime.rs Resolved

Comment thread src/mxc-sdk/build.rs Resolved

Comment thread src/mxc-sdk/src/backends/nvx/signature_verification.rs Resolved

Comment thread src/mxc-sdk/src/backends/nvx/mod.rs Resolved

microsoft-github-policy-service Bot assigned Huzaifa Danish (huzaifa-d) Nov 5, 2026

Copilot AI balanced review requested due to automatic review settings November 5, 2026 19:53

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) November 5, 2026 19:54

View session

Copilot AI reviewed Nov 5, 2026

View reviewed changes

Soham Das (SohamDas2021) previously approved these changes Nov 5, 2026

View reviewed changes

Praveen Barli (praveenbarli) mentioned this pull request Nov 7, 2026

Report execution release failures that wait cannot (0.1.2) Azure/aci-edge-sandbox#23

Merged

huzaifa-msft and others added 2 commits November 9, 2026 09:56

Clarify Phase 3 validation and cleanup guidance

28a4ba3

Describe the extended SDK JSON scenario and distinguish caller-owned lifecycle containers from create-and-run cleanup. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings November 9, 2026 18:03

Huzaifa Danish (huzaifa-d) dismissed Soham Das (SohamDas2021)’s stale review via 28a4ba3 November 9, 2026 18:03

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) November 9, 2026 18:03

View session

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Comment thread src/mxc-sdk/src/backends/nvx/crate_runtime.rs Resolved

Huzaifa Danish (huzaifa-d) mentioned this pull request Nov 9, 2026

NVX: Keep lifecycle state usable after elevated directory creation #1710

Open

Soham Das (SohamDas2021) approved these changes Nov 9, 2026

View reviewed changes

Huzaifa Danish (huzaifa-d) merged commit 9bc16c0 into microsoft:main Nov 9, 2026
40 of 45 checks passed

microsoft-github-policy-service Bot removed the Needs-Attention Requires attention or a decision from the MXC maintainers. label Nov 9, 2026

Pedro Henrique Penna (ppenna) mentioned this pull request Nov 10, 2026

NVX: Start MicroVMs from platform snapshot templates #1693

Draft

5 of 11 tasks

Navigation Menu

Repository navigation

NVX: Replace native DLL handling with aci_edge_sandboxes crate - #1672

NVX: Replace native DLL handling with aci_edge_sandboxes crate#1672
Huzaifa Danish (huzaifa-d) merged 12 commits into
microsoft:mainfrom
huzaifa-d:user/modanish/nvx-crate-integration

Huzaifa Danish (huzaifa-d) commented Nov 4, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Huzaifa Danish (huzaifa-d) commented Nov 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Huzaifa Danish (huzaifa-d) commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📖 Description

🔗 References

🔍 Validation

✅ Checklist

📋 Issue Type

Microsoft Reviewers: Open in CodeFlow

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Huzaifa Danish (huzaifa-d) commented Nov 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Huzaifa Danish (huzaifa-d) commented Nov 4, 2026 •

edited

Loading