[shailendra-nv]

Summary

Backport dependency fixes onto the Windows branch and regenerate ARM64/x64 portable signing candidates from the exact tested commit 1c2521b7e839ffeb1ae0f37a77f5b9a700d3a536. Preserve the MXC host-supervisor and Windows-boundary runtime architecture.

Related Issue

Closes #5557. The author has verified repository WRITE access; the issue has no acceptance label.

Changes

• Backport TLS, trust-store, crypto, Tokio, SSH, DNS, compression, Z3 wrapper, and SDK dependency fixes; synchronize all eight Cargo lockfiles.
• Select AWS-LC for JWT/SPIFFE verification, remove the older crypto-bigint chain, and migrate PEM parsing to rustls-pki-types. Add SPIFFE signature, audience, and expiry regression coverage.
• Apply compatible patches for russh, event-listener, block-buffer, and optional Quinn dependencies. Retain the documented upstream RSA and SQLx/SQLite exceptions.
• Build and test on native Windows runners, regenerate the source SBOM, package matching SDKs, and attest candidate ZIPs.

Testing

• Rust formatting, whitespace checks, and all eight tracked Cargo lockfiles pass.
• cargo-deny advisory and license checks pass with two documented exceptions.
• Exact-version OSV comparison: 71 prior advisory groups reduced to 2; no candidate-only groups versus main at 2e5589b2180dd432320adda124c4f7bcede119b5. Counts are dependency matches, not exploitability claims or compliance approval.
• Native ARM64/x64 builds and tests: 6,659 passed, 43 skipped, zero failures per architecture. Unsupported packages and platform-gated tests are outside those counts.
• TypeScript SDK: 196 tests passed; Python SDK: 229 passed; focused JWT/TLS suites: 8/21 passed; affected Unix libraries compile.
• Downloaded ZIP checksums, GitHub attestations, manifests, architecture, executable launch, tamper rejection, and default unsigned rejection verified.
• Native ARM64 real MXC: seven scenarios plus injected-CA HTTPS passed, with zero failures/skips and unchanged product binary hashes.
• Packaged initialization, gateway information, PowerShell and TypeScript examples pass. Final manifests remain unchanged; test fixtures are excluded.
• Public package/report privacy scan passes.

The native ARM64 Python health example could not install a compatible stable grpcio wheel for Python 3.14.5. Native x64 MXC remains unqualified; downloaded x64 package smoke checks used ARM64-host emulation. Passing the MXC scenarios does not establish exclusive network mediation or live revocation.

The EXEs/DLLs remain unsigned. Production signing vetting, Authenticode signing, signed-byte retesting, and final archive attestations remain pending. The separate handoff workflow preserves the original candidate ZIPs and binds sanitized external results to their hashes. No release assets have been published.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Windows build guidance reflects the candidate workflow

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-14T03:20:22.211080Z	1c2521b	Draft marked ready
🔒 Security Review	❌ Failed 2026-11-14T03:18:55.049137Z We couldn’t complete this review. Comment @codex security review to try again.	1c2521b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.