Tags: NVIDIA/cuda-python
Tags
feat(pathfinder): add CTK-root canary fallback for NVIDIA binaries (#… …2196) * fix(pathfinder): make find_nvidia_binary_utility deterministic, never search CWD find_nvidia_binary_utility assembled a bounded list of trusted directories (NVIDIA wheel bin/, CONDA_PREFIX, CUDA_HOME/CUDA_PATH) and then delegated to shutil.which(name, path=trusted_dirs). On Windows shutil.which prepends the process current working directory to the search even when an explicit path= is supplied, so a binary located in an arbitrary (possibly attacker-writable) CWD could be returned in preference to the trusted CUDA / Conda / wheel binary. That violates the pathfinder contract of a deterministic lookup over a documented, bounded set of trusted roots. Replace the shutil.which delegation with an explicit resolver that searches only the trusted directories, in order, returning the first executable match. The current working directory and ambient PATH are never consulted. POSIX execute-bit (X_OK) and Windows extension semantics are preserved, so behavior is unchanged except for removing the CWD/PATH leakage. Names resolved in the existing trusted dirs return exactly as before. Rewrites the search-path tests to assert the deterministic probe order and adds TestResolveInTrustedDirs covering CWD isolation, first-match-wins, empty/duplicate dir skipping, and POSIX non-executable rejection. Fixes #2119 * feat(pathfinder): add CTK-root canary fallback to find_nvidia_binary_utility After the deterministic search over the explicit trusted directories (NVIDIA wheel bin/, CONDA_PREFIX, CUDA_HOME/CUDA_PATH) misses, fall back to a CTK-root canary probe: resolve cudart through the OS dynamic loader, which honors LD_LIBRARY_PATH on Linux and the native DLL search on Windows, derive the CUDA Toolkit root from its absolute path, and search that root's bin layout. This addresses the concern raised on #2196: users who follow the CUDA Linux installation guide set LD_LIBRARY_PATH for libraries and PATH for executables. The bounded finder alone would stop finding the utility for them because PATH is intentionally never consulted. The canary fallback recovers that case through LD_LIBRARY_PATH instead of PATH. LD_LIBRARY_PATH is still an attack vector, but a significantly harder one to exploit than PATH, and the ambient PATH and process CWD remain unused. The canary runs only after the explicit trusted dirs miss, so the common wheel/conda/CUDA_HOME cases never spawn the resolver subprocess. The canary -> CTK-root resolution is factored into a shared resolve_ctk_root_via_canary helper reused by the dynamic-library CTK-root canary flow. Adds tests for the fallback (found, ordering, Windows bin layout, not consulted when found earlier, cached) and for resolve_ctk_root_via_canary. Adds 1.6.0 release notes for the minor version bump. * fix(pathfinder): satisfy mypy no-any-return in canary helpers pre-commit.ci mypy flagged returning Any from resolve_ctk_root_via_canary and _resolve_ctk_root_via_canary (both declared -> str | None), because derive_ctk_root resolves to Any under the pathfinder mypy config. Bind the result to an annotated local before returning, matching the pattern used elsewhere in the package. * fix(pathfinder): address binary finder review * docs(pathfinder): prepare 1.6.0 release notes * refactor(pathfinder): apply review feedback on binary finder - Rename _is_executable_file to _is_executable_candidate; the helper marks a return candidate rather than proving OS executability. Drop its docstring now that the name is self-explanatory, and update the test patch target. - Drop the 'ambient PATH is never consulted' sentence from resolve_ctk_root_via_canary; it is not universally true. Signed-off-by: Aryan <aryansputta@gmail.com> --------- Signed-off-by: Aryan <aryansputta@gmail.com> Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
[doc-only] Release notes for CUDA Python 13.3.1 (#2155) * Add CUDA Python 13.3.1 release notes Document the checkpoint restore-argument patch release and expose the new version in the docs selectors. * List all CUDA Python 13.3 components in release notes Include cuda-core and cuda-pathfinder in the top-level 13.3 release notes so the component set is explicit.
Support CUDA 13.3 (#2139) * run_cybind_cython_gen 13.3.0 ../ctk-next (NO MANUAL CHANGES) * run_cybind_native 13.3.0 ../ctk-next (NO MANUAL CHANGES) * git apply --index /home/rgrossekunst/stash/squash_merge_into_public_main_preview_2026-05-26+0012_non_gen_transfer.patch (NO MANUAL CHANGES) * Update ci/versions.yml: build with 13.3.0 * Guard NVLink 6 mapping for older bindings * Add cuda-pathfinder 1.5.5 release notes * Consolidate cuda-bindings 13.3.0 release notes * Add CUDA Python 13.3.0 release notes * Add 12.9.7 release notes * Enable security scans on ctk-next Run Bandit and CodeQL on ctk-next pushes and grant the scanner jobs the read permissions needed to checkout private repository contents and inspect workflow runs. * Xfail MCDM mempool OOM with older bindings Keep cuda-core tests using published older cuda-bindings wheels from failing when the shared mempool xfail helper is unavailable. --------- Co-authored-by: Keith Kraus <keith.j.kraus@gmail.com>
Support CUDA 13.3 (#2139) * run_cybind_cython_gen 13.3.0 ../ctk-next (NO MANUAL CHANGES) * run_cybind_native 13.3.0 ../ctk-next (NO MANUAL CHANGES) * git apply --index /home/rgrossekunst/stash/squash_merge_into_public_main_preview_2026-05-26+0012_non_gen_transfer.patch (NO MANUAL CHANGES) * Update ci/versions.yml: build with 13.3.0 * Guard NVLink 6 mapping for older bindings * Add cuda-pathfinder 1.5.5 release notes * Consolidate cuda-bindings 13.3.0 release notes * Add CUDA Python 13.3.0 release notes * Add 12.9.7 release notes * Enable security scans on ctk-next Run Bandit and CodeQL on ctk-next pushes and grant the scanner jobs the read permissions needed to checkout private repository contents and inspect workflow runs. * Xfail MCDM mempool OOM with older bindings Keep cuda-core tests using published older cuda-bindings wheels from failing when the shared mempool xfail helper is unavailable. --------- Co-authored-by: Keith Kraus <keith.j.kraus@gmail.com>
Merge pull request #324 from rwgk/merge-public-main-2026-05-25+1456 [no-ci] merge-public-main-2026-05-25+1456
Merge pull request #321 from Andy-Jost/ctk-next-merge-main-2026-05-22… …+1443 ctk-next-merge-main-2026-05-22+1443
PreviousNext