From cf28b2ff610db07bde7769668aa643a018347073 Mon Sep 17 00:00:00 2001 From: Bhagirath Mehta Date: Sun, 20 Sep 2026 05:55:07 -0500 Subject: [PATCH 1/5] Standardize ONNX Runtime telemetry dependencies Delegate self-contained Linux curl/mbedTLS construction to 1DS, use Apple system SQLite/libz with host-owned process lifecycle, and use minimal private SQLite on other non-Windows platforms. Preserve static-package dependency targets and the released-SDK compatibility patch. Files changed: - cmake/CMakeLists.txt - cmake/deps.txt - cmake/external/onnxruntime_external_deps.cmake - cmake/external/telemetry_linux_http.cmake - cmake/onnxruntime_common.cmake - cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch - cmake/vcpkg-ports/cpp-client-telemetry/vcpkg.json - onnxruntime/core/platform/posix/telemetry.cc Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- cmake/CMakeLists.txt | 13 + cmake/deps.txt | 2 +- .../external/onnxruntime_external_deps.cmake | 22 +- cmake/external/telemetry_linux_http.cmake | 298 ------------------ cmake/onnxruntime_common.cmake | 21 +- .../cpp_client_telemetry.patch | 21 ++ .../cpp-client-telemetry/vcpkg.json | 8 +- onnxruntime/core/platform/posix/telemetry.cc | 5 + 8 files changed, 64 insertions(+), 326 deletions(-) delete mode 100644 cmake/external/telemetry_linux_http.cmake diff --git a/cmake/CMakeLists.txt b/cmake/CMakeLists.txt index a0edf161eb334..0dfce21e32624 100644 --- a/cmake/CMakeLists.txt +++ b/cmake/CMakeLists.txt @@ -1982,6 +1982,19 @@ else() "find_dependency(MSTelemetry CONFIG)\n\ ") endif() + if(onnxruntime_USE_TELEMETRY AND APPLE + AND NOT onnxruntime_TELEMETRY_USES_EXTERNAL_PACKAGE) + string(APPEND PROJECT_CONFIG_CONTENT + "if(NOT TARGET MSTelemetry::sqlite_dependency)\n\ + add_library(MSTelemetry::sqlite_dependency INTERFACE IMPORTED)\n\ + set_property(TARGET MSTelemetry::sqlite_dependency PROPERTY INTERFACE_LINK_LIBRARIES sqlite3)\n\ + endif()\n\ + if(NOT TARGET MSTelemetry::zlib_dependency)\n\ + add_library(MSTelemetry::zlib_dependency INTERFACE IMPORTED)\n\ + set_property(TARGET MSTelemetry::zlib_dependency PROPERTY INTERFACE_LINK_LIBRARIES z)\n\ + endif()\n\ + ") + endif() if(onnxruntime_USE_TELEMETRY AND NOT WIN32 AND NOT APPLE AND NOT CMAKE_SYSTEM_NAME STREQUAL "Android" AND NOT onnxruntime_TELEMETRY_USES_EXTERNAL_PACKAGE diff --git a/cmake/deps.txt b/cmake/deps.txt index 8e1807151edcf..1dd5dbb898991 100644 --- a/cmake/deps.txt +++ b/cmake/deps.txt @@ -69,6 +69,6 @@ vulkan_headers;https://codeload.github.com/KhronosGroup/Vulkan-Headers/tar.gz/re # cpp_client_telemetry (1DS SDK) for cross-platform telemetry on non-Windows platforms. # Pinned to the stable release plus the ORT-maintained compatibility patch. cpp_client_telemetry;https://github.com/microsoft/cpp_client_telemetry/archive/refs/tags/v3.10.240.1.zip;96cd290d746b86a31c8e08dd167cf39d390c0134 -# Static HTTP transport used by 1DS on non-vcpkg Linux builds. +# Transitive 1DS Linux transport dependencies, retained here for dependency inventory generation. curl;https://github.com/curl/curl/releases/download/curl-8_21_0/curl-8.21.0.tar.xz;c3b4712175609f1e1662e716efd4fd48901e863d mbedtls;https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-3.6.7/mbedtls-3.6.7.tar.bz2;e892e98cff90cf7e0736c525bf357626a2513c4c diff --git a/cmake/external/onnxruntime_external_deps.cmake b/cmake/external/onnxruntime_external_deps.cmake index 7e56d910c3fb2..4dc4dddae08f6 100644 --- a/cmake/external/onnxruntime_external_deps.cmake +++ b/cmake/external/onnxruntime_external_deps.cmake @@ -1013,11 +1013,6 @@ if(onnxruntime_USE_TELEMETRY AND NOT WIN32) message(STATUS "Telemetry: using the vcpkg MSTelemetry::mat package") set(onnxruntime_TELEMETRY_USES_EXTERNAL_PACKAGE ON) else() - # Linux packages must not depend on a host libcurl. Build an internal HTTP(S)-only static curl - # before configuring 1DS so its CURL::libcurl reference resolves to the pinned target. - if(CMAKE_SYSTEM_NAME STREQUAL "Linux") - include(external/telemetry_linux_http.cmake) - endif() set(_ort_requested_apple_architectures "${CMAKE_OSX_ARCHITECTURES}") # Android always uses this path, including vcpkg-based AAR builds. The vcpkg port selects @@ -1043,12 +1038,19 @@ if(onnxruntime_USE_TELEMETRY AND NOT WIN32) if(APPLE) set(MATSDK_BUILD_APPLE_HTTP ON CACHE BOOL "Build the 1DS Apple HTTP client" FORCE) endif() - # ORT supplies CURL::libcurl on Linux through its pinned static mbedTLS - # transport. On Apple/Android the SDK selects the native transport. - set(MATSDK_CURL_PROVIDER SYSTEM CACHE STRING "Use ORT's selected 1DS curl target" FORCE) set(MATSDK_CURL_TLS_BACKEND MBEDTLS CACHE STRING "Use mbedTLS for 1DS curl" FORCE) - set(MATSDK_SQLITE_PROVIDER VENDORED CACHE STRING "Use bundled 1DS SQLite" FORCE) - set(MATSDK_ZLIB_PROVIDER VENDORED CACHE STRING "Use bundled 1DS zlib" FORCE) + if(CMAKE_SYSTEM_NAME STREQUAL "Linux") + set(MATSDK_CURL_PROVIDER FETCH CACHE STRING "Build the SDK's pinned curl with mbedTLS" FORCE) + else() + set(MATSDK_CURL_PROVIDER SYSTEM CACHE STRING "Use the platform HTTP transport" FORCE) + endif() + if(APPLE) + set(MATSDK_SQLITE_PROVIDER SYSTEM CACHE STRING "Use Apple's system SQLite" FORCE) + set(MATSDK_ZLIB_PROVIDER SYSTEM CACHE STRING "Use Apple's system libz" FORCE) + else() + set(MATSDK_SQLITE_PROVIDER MINIMAL CACHE STRING "Build the SDK's minimal private SQLite" FORCE) + set(MATSDK_ZLIB_PROVIDER VENDORED CACHE STRING "Build the SDK's private zlib" FORCE) + endif() # BUILD_SHARED_LIBS is a global that ORT's own targets read after this block, and the SDK selects # mat's library type from it (lib/CMakeLists.txt). Save it, force static for the SDK, restore below. set(BUILD_SHARED_LIBS_SAVED "${BUILD_SHARED_LIBS}") diff --git a/cmake/external/telemetry_linux_http.cmake b/cmake/external/telemetry_linux_http.cmake deleted file mode 100644 index 3875651bc1818..0000000000000 --- a/cmake/external/telemetry_linux_http.cmake +++ /dev/null @@ -1,298 +0,0 @@ -# Copyright (c) Microsoft Corporation. All rights reserved. -# Licensed under the MIT License. - -if(NOT CMAKE_SYSTEM_NAME STREQUAL "Linux") - message(FATAL_ERROR "The embedded curl transport is supported only on Linux.") -endif() - -if(TARGET CURL::libcurl) - message(FATAL_ERROR - "A CURL::libcurl target already exists. Linux telemetry requires its pinned static curl target " - "so packaged binaries never depend on a system libcurl.") -endif() - -function(onnxruntime_telemetry_save_cache_variable name) - get_property(is_set CACHE "${name}" PROPERTY TYPE SET) - set("_onnxruntime_telemetry_cache_${name}_is_set" "${is_set}" PARENT_SCOPE) - if(is_set) - get_property(type CACHE "${name}" PROPERTY TYPE) - get_property(help CACHE "${name}" PROPERTY HELPSTRING) - get_property(value CACHE "${name}" PROPERTY VALUE) - set("_onnxruntime_telemetry_cache_${name}_type" "${type}" PARENT_SCOPE) - set("_onnxruntime_telemetry_cache_${name}_help" "${help}" PARENT_SCOPE) - set("_onnxruntime_telemetry_cache_${name}_value" "${value}" PARENT_SCOPE) - endif() -endfunction() - -function(onnxruntime_telemetry_restore_cache_variable name) - if(_onnxruntime_telemetry_cache_${name}_is_set) - set(cache_type "${_onnxruntime_telemetry_cache_${name}_type}") - if(cache_type STREQUAL "UNINITIALIZED") - set(cache_type STRING) - endif() - set(${name} - "${_onnxruntime_telemetry_cache_${name}_value}" - CACHE "${cache_type}" - "${_onnxruntime_telemetry_cache_${name}_help}" - FORCE) - else() - unset(${name} CACHE) - endif() -endfunction() - -# Isolate all dependency options from parent normal variables and cache entries. Keep only the -# HTTP/HTTPS feature surface required by 1DS and restore the caller's cache after creating targets. -block(SCOPE_FOR VARIABLES POLICIES) - set(CMAKE_POLICY_DEFAULT_CMP0077 NEW) - set(CMAKE_POLICY_DEFAULT_CMP0126 NEW) - - set(_onnxruntime_telemetry_off_options - BUILD_SHARED_LIBS - BUILD_STATIC_CURL - BUILD_TESTING - SHARE_LIB_OBJECT - ENABLE_PROGRAMS - ENABLE_TESTING - ENABLE_DEBUG - ENABLE_UNICODE - CURL_BUILD_EVERYTHING - CURL_CLANG_TIDY - CURL_CODE_COVERAGE - CURL_DEBUG_GLOBAL_MEM - CURL_DROP_UNUSED - CURL_GCC_ANALYZER - CURL_LINT - CURL_LTO - CURL_STATIC_CRT - CURL_WERROR - CURL_WINDOWS_SSPI - PICKY_COMPILER - MSVC_STATIC_RUNTIME - USE_APPLE_IDN - USE_APPLE_SECTRUST - USE_WIN32_IDN - USE_WIN32_LDAP - GEN_FILES - UNSAFE_BUILD - INSTALL_MBEDTLS_HEADERS - MBEDTLS_FATAL_WARNINGS - USE_SHARED_MBEDTLS_LIBRARY - LINK_WITH_TRUSTED_STORAGE - BUILD_CURL_EXE - BUILD_EXAMPLES - BUILD_LIBCURL_DOCS - BUILD_MISC_DOCS - ENABLE_CURL_MANUAL - CURL_ENABLE_EXPORT_TARGET - CURL_ENABLE_NTLM - CURL_ENABLE_SMB - CURL_DISABLE_HTTP - CURL_DISABLE_BASIC_AUTH - CURL_DISABLE_BINDLOCAL - CURL_DISABLE_FORM_API - CURL_DISABLE_GETOPTIONS - CURL_DISABLE_HEADERS_API - CURL_DISABLE_HTTP_AUTH - CURL_DISABLE_LIBCURL_OPTION - CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG - CURL_DISABLE_PARSEDATE - CURL_DISABLE_PROGRESS_METER - CURL_DISABLE_PROXY - CURL_DISABLE_SHA512_256 - CURL_DISABLE_SHUFFLE_DNS - CURL_DISABLE_SOCKETPAIR - CURL_DISABLE_TYPECHECK - CURL_DISABLE_VERBOSE_STRINGS - CURL_USE_OPENSSL - CURL_USE_SCHANNEL - CURL_USE_WOLFSSL - CURL_USE_GNUTLS - CURL_USE_RUSTLS - CURL_USE_PKGCONFIG - CURL_USE_CMAKECONFIG - CURL_CA_FALLBACK - CURL_CA_NATIVE - CURL_CA_SEARCH_SAFE - USE_LIBIDN2 - CURL_USE_LIBPSL - CURL_USE_LIBSSH2 - CURL_USE_LIBSSH - CURL_USE_GSSAPI - CURL_USE_GSASL - CURL_USE_LIBBACKTRACE - CURL_USE_LIBUV - USE_NGHTTP2 - USE_NGTCP2 - USE_QUICHE - USE_HTTPSRR - USE_ECH - USE_SSLS_EXPORT - USE_PROXY_HTTP3 - ENABLE_ARES - ENABLE_UNIX_SOCKETS) - - set(_onnxruntime_telemetry_on_options - BUILD_STATIC_LIBS - USE_STATIC_MBEDTLS_LIBRARY - LINK_WITH_PTHREAD - DISABLE_PACKAGE_CONFIG_AND_INSTALL - CURL_DISABLE_INSTALL - CURL_ENABLE_SSL - CURL_USE_MBEDTLS - ENABLE_THREADED_RESOLVER - ENABLE_IPV6 - HTTP_ONLY - HAVE_MBEDTLS_DES_CRYPT_ECB - CURL_DISABLE_ALTSVC - CURL_DISABLE_CA_SEARCH - CURL_DISABLE_SRP - CURL_DISABLE_HSTS - CURL_DISABLE_COOKIES - CURL_DISABLE_DICT - CURL_DISABLE_FILE - CURL_DISABLE_FTP - CURL_DISABLE_GOPHER - CURL_DISABLE_IMAP - CURL_DISABLE_LDAP - CURL_DISABLE_LDAPS - CURL_DISABLE_MQTT - CURL_DISABLE_NETRC - CURL_DISABLE_MIME - CURL_DISABLE_POP3 - CURL_DISABLE_RTSP - CURL_DISABLE_SMTP - CURL_DISABLE_TELNET - CURL_DISABLE_TFTP - CURL_DISABLE_WEBSOCKETS - CURL_DISABLE_IPFS - CURL_DISABLE_DOH - CURL_DISABLE_AWS - CURL_DISABLE_BEARER_AUTH - CURL_DISABLE_DIGEST_AUTH - CURL_DISABLE_KERBEROS_AUTH - CURL_DISABLE_NEGOTIATE_AUTH) - - set(_onnxruntime_telemetry_string_options - MBEDTLS_CONFIG_FILE - MBEDTLS_USER_CONFIG_FILE - MBEDTLS_TARGET_PREFIX - CURL_CA_BUNDLE - CURL_CA_PATH - CURL_CA_EMBED - CURL_DEFAULT_SSL_BACKEND - CURL_ZLIB - CURL_BROTLI - CURL_ZSTD) - - set(_onnxruntime_telemetry_all_options - ${_onnxruntime_telemetry_off_options} - ${_onnxruntime_telemetry_on_options} - ${_onnxruntime_telemetry_string_options}) - list(REMOVE_DUPLICATES _onnxruntime_telemetry_all_options) - - foreach(option IN LISTS _onnxruntime_telemetry_all_options) - onnxruntime_telemetry_save_cache_variable(${option}) - endforeach() - foreach(option IN LISTS _onnxruntime_telemetry_off_options) - set(${option} OFF) - set(${option} OFF CACHE BOOL "Disable optional embedded telemetry dependency feature" FORCE) - endforeach() - foreach(option IN LISTS _onnxruntime_telemetry_on_options) - set(${option} ON) - set(${option} ON CACHE BOOL "Enable required embedded telemetry dependency feature" FORCE) - endforeach() - - set(MBEDTLS_CONFIG_FILE "") - set(MBEDTLS_USER_CONFIG_FILE "") - set(MBEDTLS_TARGET_PREFIX "") - set(CURL_CA_BUNDLE none) - set(CURL_CA_PATH none) - set(CURL_CA_EMBED "") - set(CURL_DEFAULT_SSL_BACKEND mbedtls) - set(CURL_ZLIB OFF) - set(CURL_BROTLI OFF) - set(CURL_ZSTD OFF) - set(MBEDTLS_CONFIG_FILE "" CACHE FILEPATH "Use the default mbedTLS configuration" FORCE) - set(MBEDTLS_USER_CONFIG_FILE "" CACHE FILEPATH "Do not append a caller mbedTLS configuration" FORCE) - set(MBEDTLS_TARGET_PREFIX "" CACHE STRING "Use the expected embedded mbedTLS target names" FORCE) - set(CURL_CA_BUNDLE none CACHE STRING "Select the target Linux CA bundle at runtime" FORCE) - set(CURL_CA_PATH none CACHE STRING "Select the target Linux CA path at runtime" FORCE) - set(CURL_CA_EMBED "" CACHE STRING "Do not embed a build-host CA bundle" FORCE) - set(CURL_DEFAULT_SSL_BACKEND mbedtls CACHE STRING "Use the pinned mbedTLS backend" FORCE) - set(CURL_ZLIB OFF CACHE BOOL "Disable zlib" FORCE) - set(CURL_BROTLI OFF CACHE BOOL "Disable brotli" FORCE) - set(CURL_ZSTD OFF CACHE BOOL "Disable zstd" FORCE) - - onnxruntime_fetchcontent_declare( - onnxruntime_mbedtls - URL ${DEP_URL_mbedtls} - URL_HASH SHA1=${DEP_SHA1_mbedtls} - DOWNLOAD_EXTRACT_TIMESTAMP TRUE - EXCLUDE_FROM_ALL) - onnxruntime_fetchcontent_makeavailable(onnxruntime_mbedtls) - - foreach(target mbedtls mbedx509 mbedcrypto) - if(NOT TARGET ${target}) - message(FATAL_ERROR "Embedded telemetry dependency target not found: ${target}") - endif() - endforeach() - - # curl's FindMbedTLS module accepts target names through these variables, avoiding host discovery. - set(MBEDTLS_INCLUDE_DIR "${onnxruntime_mbedtls_SOURCE_DIR}/include") - set(MBEDTLS_LIBRARY MbedTLS::mbedtls) - set(MBEDX509_LIBRARY MbedTLS::mbedx509) - set(MBEDCRYPTO_LIBRARY MbedTLS::mbedcrypto) - set(MBEDTLS_USE_STATIC_LIBS ON) - - onnxruntime_fetchcontent_declare( - onnxruntime_curl - URL ${DEP_URL_curl} - URL_HASH SHA1=${DEP_SHA1_curl} - DOWNLOAD_EXTRACT_TIMESTAMP TRUE - EXCLUDE_FROM_ALL) - onnxruntime_fetchcontent_makeavailable(onnxruntime_curl) - - if(NOT TARGET CURL::libcurl OR NOT TARGET libcurl_static) - message(FATAL_ERROR "The pinned static CURL::libcurl target was not created.") - endif() - - # The sentinel defaults above mask inherited variables and disable build-host CA detection. - # Remove them from curl's generated config so 1DS can set the target host's CA bundle at runtime. - set(_onnxruntime_telemetry_curl_config - "${onnxruntime_curl_BINARY_DIR}/lib/curl_config.h") - file(READ "${_onnxruntime_telemetry_curl_config}" - _onnxruntime_telemetry_curl_config_contents) - foreach(definition CURL_CA_BUNDLE CURL_CA_PATH) - string(REGEX REPLACE - "#define ${definition} \"[^\"]*\"" - "/* #undef ${definition} */" - _onnxruntime_telemetry_curl_config_contents - "${_onnxruntime_telemetry_curl_config_contents}") - endforeach() - file(WRITE "${_onnxruntime_telemetry_curl_config}" - "${_onnxruntime_telemetry_curl_config_contents}") - - # Replace curl's non-exportable imported helper with the underlying target so ORT's static package - # export can rewrite it into the onnxruntime namespace. - get_target_property(_onnxruntime_telemetry_curl_link_libraries - libcurl_static INTERFACE_LINK_LIBRARIES) - list(FILTER _onnxruntime_telemetry_curl_link_libraries EXCLUDE REGEX "CURL::mbedtls") - set_target_properties(libcurl_static PROPERTIES - INTERFACE_LINK_LIBRARIES "${_onnxruntime_telemetry_curl_link_libraries}") - target_link_libraries(libcurl_static PRIVATE mbedtls) - - foreach(target mbedtls mbedx509 mbedcrypto libcurl_static) - set_target_properties(${target} PROPERTIES - POSITION_INDEPENDENT_CODE ON - C_VISIBILITY_PRESET hidden) - target_compile_options(${target} PRIVATE - $<$:-ffunction-sections;-fdata-sections>) - target_compile_definitions(${target} PRIVATE - MBEDTLS_THREADING_C - MBEDTLS_THREADING_PTHREAD) - endforeach() - - foreach(option IN LISTS _onnxruntime_telemetry_all_options) - onnxruntime_telemetry_restore_cache_variable(${option}) - endforeach() -endblock() diff --git a/cmake/onnxruntime_common.cmake b/cmake/onnxruntime_common.cmake index 659699c370f1f..b4666ef596272 100644 --- a/cmake/onnxruntime_common.cmake +++ b/cmake/onnxruntime_common.cmake @@ -317,21 +317,12 @@ if(onnxruntime_USE_TELEMETRY AND NOT WIN32) endif() # Platform-specific system libraries required only for the Apple static-package path. if(APPLE AND NOT onnxruntime_BUILD_SHARED_LIB) - if(CMAKE_SYSTEM_NAME STREQUAL "iOS") - # mat already links the SDK's bundled sqlite3/zlib archives, so no system SQLite is needed here. - # A bare sqlite3 name would reach Xcode as -framework SQLite3, which the iOS SDK does not provide. - target_link_libraries(onnxruntime_common PRIVATE - "-framework CoreFoundation" - "-framework Security" - ) - else() - target_link_libraries(onnxruntime_common PRIVATE - "-framework CoreFoundation" - "-framework Security" - z - sqlite3 - ) - endif() + target_link_libraries(onnxruntime_common PRIVATE + "-framework CoreFoundation" + "-framework Security" + "-lz" + "-lsqlite3" + ) endif() if (NOT onnxruntime_BUILD_SHARED_LIB) diff --git a/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch b/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch index 4c32e6f6a136e..b53283560c3f4 100644 --- a/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch +++ b/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch @@ -61,3 +61,24 @@ + (void)ex; LOG_ERROR("Unhandled exception in worker task: %s", ex.what()); } + +--- a/cmake/MatsdkFetchCurl.cmake ++++ b/cmake/MatsdkFetchCurl.cmake +@@ -33,5 +33,4 @@ + MBEDTLS_FATAL_WARNINGS + USE_SHARED_MBEDTLS_LIBRARY +- LINK_WITH_PTHREAD + BUILD_CURL_EXE + BUILD_EXAMPLES +@@ -85,3 +84,4 @@ + if(MATSDK_CURL_TLS_BACKEND_UPPER STREQUAL "MBEDTLS") ++ set(LINK_WITH_PTHREAD ON) + set(USE_STATIC_MBEDTLS_LIBRARY ON) + set(CURL_USE_MBEDTLS ON) +@@ -96,3 +96,6 @@ + foreach(target mbedtls mbedx509 mbedcrypto) + matsdk_configure_fetched_static_target("${target}") ++ target_compile_definitions("${target}" PRIVATE ++ MBEDTLS_THREADING_C ++ MBEDTLS_THREADING_PTHREAD) + endforeach() diff --git a/cmake/vcpkg-ports/cpp-client-telemetry/vcpkg.json b/cmake/vcpkg-ports/cpp-client-telemetry/vcpkg.json index 28115bdaa1cd3..deaf253569362 100644 --- a/cmake/vcpkg-ports/cpp-client-telemetry/vcpkg.json +++ b/cmake/vcpkg-ports/cpp-client-telemetry/vcpkg.json @@ -24,7 +24,8 @@ "nlohmann-json", { "name": "sqlite3", - "default-features": false + "default-features": false, + "platform": "!osx & !ios" }, { "name": "vcpkg-cmake", @@ -34,6 +35,9 @@ "name": "vcpkg-cmake-config", "host": true }, - "zlib" + { + "name": "zlib", + "platform": "!osx & !ios" + } ] } diff --git a/onnxruntime/core/platform/posix/telemetry.cc b/onnxruntime/core/platform/posix/telemetry.cc index c621bc20065ca..915c95e2f6726 100644 --- a/onnxruntime/core/platform/posix/telemetry.cc +++ b/onnxruntime/core/platform/posix/telemetry.cc @@ -494,6 +494,11 @@ void PosixTelemetry::Initialize() { config[CFG_BOOL_ENABLE_TRACE] = false; // Disable SDK internal logging config[CFG_INT_TRACE_LEVEL_MASK] = 0; config[CFG_INT_SDK_MODE] = SdkModeTypes::SdkModeTypes_CS; // Common Schema 4.0 mode +#if defined(__APPLE__) + // Apple system SQLite is process-global. Multiple libraries may embed 1DS in the same process, + // so let SQLite initialize lazily and never let an individual SDK copy shut it down. + config["skipSqliteInitAndShutdown"] = "true"; +#endif #if defined(ORT_TELEMETRY_USES_STATIC_CURL) if (std::string ca_bundle = GetCertificateAuthorityBundlePath(); !ca_bundle.empty()) { config[CFG_MAP_HTTP][CFG_STR_HTTP_SSL_CAINFO] = ca_bundle; From 2f0c15f1ddf42047969e3f4b2f5ef3cc7d5f1d91 Mon Sep 17 00:00:00 2001 From: Bhagirath Mehta Date: Mon, 28 Sep 2026 23:57:47 -0500 Subject: [PATCH 2/5] Keep telemetry CA selection on the target machine Restore curl CA-path sanitization in the 3.10.240.1 compatibility patch so Linux packages do not embed build-host trust paths.\n\nFiles changed: cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2d3afa07-bc40-4851-bc49-ccf0a37e6da0 --- .../cpp_client_telemetry.patch | 42 +++++++++++++++---- 1 file changed, 34 insertions(+), 8 deletions(-) diff --git a/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch b/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch index b53283560c3f4..0a7671d19a37f 100644 --- a/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch +++ b/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch @@ -70,15 +70,41 @@ - LINK_WITH_PTHREAD BUILD_CURL_EXE BUILD_EXAMPLES -@@ -85,3 +84,4 @@ - if(MATSDK_CURL_TLS_BACKEND_UPPER STREQUAL "MBEDTLS") +@@ -85,3 +84,8 @@ ++ set(CURL_CA_BUNDLE none) ++ set(CURL_CA_PATH none) ++ set(CURL_CA_EMBED "") ++ + if(MATSDK_CURL_TLS_BACKEND_UPPER STREQUAL "MBEDTLS") + set(LINK_WITH_PTHREAD ON) - set(USE_STATIC_MBEDTLS_LIBRARY ON) - set(CURL_USE_MBEDTLS ON) -@@ -96,3 +96,6 @@ - foreach(target mbedtls mbedx509 mbedcrypto) - matsdk_configure_fetched_static_target("${target}") + set(USE_STATIC_MBEDTLS_LIBRARY ON) + set(CURL_USE_MBEDTLS ON) +@@ -96,3 +100,6 @@ + foreach(target mbedtls mbedx509 mbedcrypto) + matsdk_configure_fetched_static_target("${target}") + target_compile_definitions("${target}" PRIVATE + MBEDTLS_THREADING_C + MBEDTLS_THREADING_PTHREAD) - endforeach() + endforeach() +@@ -128,1 +135,21 @@ ++ set(_matsdk_curl_config "${matsdk_curl_BINARY_DIR}/lib/curl_config.h") ++ if(NOT EXISTS "${_matsdk_curl_config}") ++ message(FATAL_ERROR ++ "The embedded curl configuration was not generated: ${_matsdk_curl_config}") ++ endif() ++ file(READ "${_matsdk_curl_config}" _matsdk_curl_config_contents) ++ foreach(definition CURL_CA_BUNDLE CURL_CA_PATH) ++ string(REGEX REPLACE ++ "#define ${definition} \"[^\"]*\"" ++ "/* #undef ${definition} */" ++ _matsdk_curl_config_contents ++ "${_matsdk_curl_config_contents}") ++ endforeach() ++ if(_matsdk_curl_config_contents MATCHES ++ "#define CURL_CA_(BUNDLE|PATH)") ++ message(FATAL_ERROR ++ "Embedded curl retained a build-time certificate authority path.") ++ endif() ++ file(WRITE "${_matsdk_curl_config}" "${_matsdk_curl_config_contents}") ++ + matsdk_configure_fetched_static_target(libcurl_static) From fe6fa87b8ff5deb06eb1eadc6c78f993d1cff958 Mon Sep 17 00:00:00 2001 From: Bhagirath Mehta Date: Tue, 29 Sep 2026 00:07:53 -0500 Subject: [PATCH 3/5] Keep exported telemetry curl dependencies resolvable Strip curl's directory-scoped CURL::mbedtls helper from the exported static target and link the bundled mbedtls target instead. This preserves self-contained ORT static packages after delegating curl construction to the SDK. Files changed: cmake/external/onnxruntime_external_deps.cmake. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2d3afa07-bc40-4851-bc49-ccf0a37e6da0 --- cmake/external/onnxruntime_external_deps.cmake | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/cmake/external/onnxruntime_external_deps.cmake b/cmake/external/onnxruntime_external_deps.cmake index 4dc4dddae08f6..06550b9363009 100644 --- a/cmake/external/onnxruntime_external_deps.cmake +++ b/cmake/external/onnxruntime_external_deps.cmake @@ -1075,6 +1075,14 @@ if(onnxruntime_USE_TELEMETRY AND NOT WIN32) EXCLUDE_FROM_ALL ) onnxruntime_fetchcontent_makeavailable(cpp_client_telemetry) + if(CMAKE_SYSTEM_NAME STREQUAL "Linux" AND NOT onnxruntime_BUILD_SHARED_LIB) + # curl's imported mbedTLS helper is not exported with ORT's static package. + get_target_property(_ort_curl_link_libraries libcurl_static INTERFACE_LINK_LIBRARIES) + list(FILTER _ort_curl_link_libraries EXCLUDE REGEX "CURL::mbedtls") + set_target_properties(libcurl_static PROPERTIES + INTERFACE_LINK_LIBRARIES "${_ort_curl_link_libraries}") + target_link_libraries(libcurl_static PRIVATE mbedtls) + endif() target_compile_definitions(mat PRIVATE MATSDK_DISABLE_LOGGING) if(ANDROID) target_compile_definitions(mat PRIVATE ANDROID_SUPPRESS_LOGCAT) From fa0550dc092d76c333f830bcc1d07abd77a284ce Mon Sep 17 00:00:00 2001 From: Bhagirath Mehta Date: Tue, 29 Sep 2026 00:15:10 -0500 Subject: [PATCH 4/5] Declare Apple telemetry system libraries in framework metadata Static framework assembly cannot carry system SQLite and zlib archives; advertise both in CocoaPods framework metadata so consumers resolve telemetry symbols. Files changed: cmake/onnxruntime.cmake. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2d3afa07-bc40-4851-bc49-ccf0a37e6da0 --- cmake/onnxruntime.cmake | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/cmake/onnxruntime.cmake b/cmake/onnxruntime.cmake index e64e5c3f2043a..137a426d120a9 100644 --- a/cmake/onnxruntime.cmake +++ b/cmake/onnxruntime.cmake @@ -122,14 +122,13 @@ if(onnxruntime_BUILD_SHARED_LIB) endif() if(onnxruntime_USE_TELEMETRY) + set(APPLE_SYSTEM_LIBRARIES "\\\"z\\\", \\\"sqlite3\\\"") if(CMAKE_SYSTEM_NAME STREQUAL "iOS") set(APPLE_SYSTEM_FRAMEWORKS "\\\"CoreFoundation\\\", \\\"Foundation\\\", \\\"Network\\\", \\\"Security\\\", \\\"SystemConfiguration\\\", \\\"UIKit\\\"") - set(APPLE_SYSTEM_LIBRARIES "") else() set(APPLE_SYSTEM_FRAMEWORKS "\\\"CoreFoundation\\\", \\\"Foundation\\\", \\\"IOKit\\\", \\\"Network\\\", \\\"Security\\\", \\\"SystemConfiguration\\\"") - set(APPLE_SYSTEM_LIBRARIES "") endif() endif() From 1f1dfb0465a2c1eaf55623ad4b0e4f1fc7e42a34 Mon Sep 17 00:00:00 2001 From: Bhagirath Mehta Date: Tue, 29 Sep 2026 00:22:39 -0500 Subject: [PATCH 5/5] Propagate telemetry mbedTLS threading settings to curl The 3.10.240.1 compatibility patch now exports mbedTLS threading defines to fetched libcurl, matching the upstream SDK policy and avoiding inconsistent header configuration. Files changed: cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2d3afa07-bc40-4851-bc49-ccf0a37e6da0 --- cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch b/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch index 0a7671d19a37f..fda176be222f3 100644 --- a/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch +++ b/cmake/patches/cpp_client_telemetry/cpp_client_telemetry.patch @@ -82,7 +82,7 @@ @@ -96,3 +100,6 @@ foreach(target mbedtls mbedx509 mbedcrypto) matsdk_configure_fetched_static_target("${target}") -+ target_compile_definitions("${target}" PRIVATE ++ target_compile_definitions("${target}" PUBLIC + MBEDTLS_THREADING_C + MBEDTLS_THREADING_PTHREAD) endforeach()