Patch Protobuf and ONNX's cmake files and enforce BinSkim check (#13694)

Patch Protobuf and ONNX's cmake files and enforce BinSkim check. This PR has overlap with #13523 . I would prefer to get this one merged first so that we can finished the BinSkim work, and I try to make this PR as small as possible.
2026-07-30 20:18:08 +00:00 · 2022-11-18 10:09:47 -08:00 · 2022-11-18 10:09:47 -08:00 · 3e9e5e9d6d
commit 3e9e5e9d6d
parent 6160ba0692
13 changed files with 190 additions and 121 deletions
--- a/cmake/CMakeLists.txt
+++ b/cmake/CMakeLists.txt
@ -804,67 +804,69 @@ list(APPEND CMAKE_MODULE_PATH ${PROJECT_SOURCE_DIR}/external)
 #   for cross-compiling
 #2. if ONNX_CUSTOM_PROTOC_EXECUTABLE is not set, Compile everything(including protoc) from source code.

-if (onnxruntime_PREFER_SYSTEM_LIB)
-  find_package(Protobuf)
-endif()
-if (Protobuf_FOUND)
-  message("Use protobuf from preinstalled system lib")
-  if (onnxruntime_USE_FULL_PROTOBUF)
-    set(PROTOBUF_LIB protobuf::libprotobuf)
-    #We have a check here but most of the cmake users don't know the Protobuf_USE_STATIC_LIBS
-    # variable exists and may leave it in a wrong state.
-    if (NOT Protobuf_USE_STATIC_LIBS)
-      # ONNX Runtime itself can work in such a setting but it may cause compatibility issues
-      # when ONNX Runtime is integrated with the other ONNX ecosystem softwares.
-      message(WARNING "Use Protobuf_USE_STATIC_LIBS to ensure compatibility with other ONNX ecosystem components.")
-    endif()
-  else()
-    set(PROTOBUF_LIB protobuf::libprotobuf-lite)
-  endif()
+if(Patch_FOUND)
+  set(ONNXRUNTIME_PROTOBUF_PATCH_COMMAND ${Patch_EXECUTABLE} --binary --ignore-whitespace -p1 < ${PROJECT_SOURCE_DIR}/patches/protobuf/protobuf_cmake.patch)
 else()
-  message("Use protobuf from submodule")
-  # use protobuf as a submodule
-  if (CMAKE_SYSTEM_NAME STREQUAL "Android")
-    set(protobuf_BUILD_PROTOC_BINARIES OFF CACHE BOOL "Build protobuf tests" FORCE)
-    set(protobuf_WITH_ZLIB OFF CACHE BOOL "Build with zlib support" FORCE)
-  endif()
-  if (onnxruntime_DISABLE_RTTI)
-    set(protobuf_DISABLE_RTTI ON CACHE BOOL "Remove runtime type information in the binaries" FORCE)
-  endif()
-  add_subdirectory(${PROJECT_SOURCE_DIR}/external/protobuf/cmake EXCLUDE_FROM_ALL)
+  set(ONNXRUNTIME_PROTOBUF_PATCH_COMMAND "")
+endif()

+FetchContent_Declare(
+  Protobuf
+  URL https://github.com/protocolbuffers/protobuf/archive/refs/tags/v3.18.3.zip
+  URL_HASH SHA1=b95bf7e9de9c2249b6c1f2ca556ace49999e90bd
+  SOURCE_SUBDIR  cmake
+  PATCH_COMMAND ${ONNXRUNTIME_PROTOBUF_PATCH_COMMAND}
+  FIND_PACKAGE_ARGS NAMES Protobuf
+)
+
+if (CMAKE_SYSTEM_NAME STREQUAL "Android")
+  set(protobuf_BUILD_PROTOC_BINARIES OFF CACHE BOOL "Build protobuf tests" FORCE)
+  set(protobuf_WITH_ZLIB OFF CACHE BOOL "Build with zlib support" FORCE)
+endif()
+if (onnxruntime_DISABLE_RTTI)
+  set(protobuf_DISABLE_RTTI ON CACHE BOOL "Remove runtime type information in the binaries" FORCE)
+endif()
+
+FetchContent_MakeAvailable(Protobuf)
+if(Protobuf_FOUND)
+  message("Protobuf version: ${Protobuf_VERSION}")
+else()
+  # Adjust warning flags
  if (TARGET libprotoc)
    set_target_properties(libprotoc PROPERTIES FOLDER "External/Protobuf")
-    add_executable(protobuf::protoc ALIAS protoc)
+    if (NOT MSVC)
+      target_compile_options(libprotoc PRIVATE "-w")
+    endif()
  endif()
  if (TARGET protoc)
+    add_executable(protobuf::protoc ALIAS protoc)
+    if (NOT MSVC)
+      target_compile_options(protoc PRIVATE "-w")
+    endif()
    set_target_properties(protoc PROPERTIES FOLDER "External/Protobuf")
    get_target_property(PROTOC_OSX_ARCH protoc OSX_ARCHITECTURES)
    if (PROTOC_OSX_ARCH)
-        if (${CMAKE_HOST_SYSTEM_PROCESSOR} IN_LIST PROTOC_OSX_ARCH)
-           message("protoc can run")
-        else()
-           list(APPEND PROTOC_OSX_ARCH ${CMAKE_HOST_SYSTEM_PROCESSOR})
-           set_target_properties(protoc PROPERTIES OSX_ARCHITECTURES "${CMAKE_HOST_SYSTEM_PROCESSOR}")
-           set_target_properties(libprotoc PROPERTIES OSX_ARCHITECTURES "${PROTOC_OSX_ARCH}")
-           set_target_properties(libprotobuf PROPERTIES OSX_ARCHITECTURES "${PROTOC_OSX_ARCH}")
-        endif()
+      if (${CMAKE_HOST_SYSTEM_PROCESSOR} IN_LIST PROTOC_OSX_ARCH)
+        message("protoc can run")
+      else()
+        list(APPEND PROTOC_OSX_ARCH ${CMAKE_HOST_SYSTEM_PROCESSOR})
+        set_target_properties(protoc PROPERTIES OSX_ARCHITECTURES "${CMAKE_HOST_SYSTEM_PROCESSOR}")
+        set_target_properties(libprotoc PROPERTIES OSX_ARCHITECTURES "${PROTOC_OSX_ARCH}")
+        set_target_properties(libprotobuf PROPERTIES OSX_ARCHITECTURES "${PROTOC_OSX_ARCH}")
+      endif()
    endif()
+   endif()
+  if (TARGET libprotobuf AND NOT MSVC)
+    target_compile_options(libprotobuf PRIVATE "-w")
  endif()
-  if (onnxruntime_USE_FULL_PROTOBUF)
-    set(PROTOBUF_LIB libprotobuf)
-  else()
-    set(PROTOBUF_LIB libprotobuf-lite)
+  if (TARGET libprotobuf-lite AND NOT MSVC)
+    target_compile_options(libprotobuf-lite PRIVATE "-w")
  endif()
 endif()
-
-if (UNIX AND onnxruntime_ENABLE_LTO AND NOT onnxruntime_PREFER_SYSTEM_LIB)
-  #https://github.com/protocolbuffers/protobuf/issues/5923
-  target_link_options(protoc PRIVATE "-Wl,--no-as-needed")
-endif()
-
-if (MSVC AND NOT onnxruntime_PREFER_SYSTEM_LIB)
-  target_compile_options(${PROTOBUF_LIB} PRIVATE "/wd5054")
+if (onnxruntime_USE_FULL_PROTOBUF)
+  set(PROTOBUF_LIB protobuf::libprotobuf)
+else()
+  set(PROTOBUF_LIB protobuf::libprotobuf-lite)
 endif()

 include(protobuf_function.cmake)
@ -1149,8 +1151,15 @@ else()
    list(APPEND ORT_WARNING_FLAGS -Wno-deprecated-builtins)
  endif()

-  if (HAS_ENUM_CONSTEXPR_CONVERSION)
-    target_compile_options(${PROTOBUF_LIB} PRIVATE "-Wno-enum-constexpr-conversion")
+  #see:https://reviews.llvm.org/D131307
+  #It was intended that the 'enum-constexpr-conversion' type warnings can not be silenced by -w
+  if(HAS_ENUM_CONSTEXPR_CONVERSION AND NOT Protobuf_FOUND)
+    if (TARGET libprotobuf)
+      target_compile_options(libprotobuf PRIVATE "-Wno-enum-constexpr-conversion")
+    endif()
+    if (TARGET libprotobuf-lite)
+      target_compile_options(libprotobuf-lite PRIVATE "-Wno-enum-constexpr-conversion")
+    endif()
  endif()
 endif()

@ -1570,8 +1579,21 @@ else()
  set(ONNX_USE_LITE_PROTO OFF CACHE BOOL "" FORCE)
 endif()

+if(Patch_FOUND)
+  set(ONNXRUNTIME_ONNX_PATCH_COMMAND ${Patch_EXECUTABLE} --binary --ignore-whitespace -p1 < ${PROJECT_SOURCE_DIR}/patches/onnx/onnx.patch)
+else()
+  set(ONNXRUNTIME_ONNX_PATCH_COMMAND "")
+endif()
+
+FetchContent_Declare(
+  onnx
+  URL https://github.com/onnx/onnx/archive/5a5f8a5935762397aa68429b5493084ff970f774.zip
+  URL_HASH SHA1=edc8e1338c02f3ab222f3d803a24e17608c13895
+  PATCH_COMMAND ${ONNXRUNTIME_ONNX_PATCH_COMMAND}
+)
+
 if (NOT onnxruntime_MINIMAL_BUILD)
-  add_subdirectory(external/onnx EXCLUDE_FROM_ALL)
+  FetchContent_MakeAvailable(onnx)
 else()
  include(onnx_minimal)
 endif()
--- a/cmake/patches/onnx/onnx.patch
+++ b/cmake/patches/onnx/onnx.patch
@ -0,0 +1,25 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 8e595855..789ec80a 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -545,20 +545,9 @@ endif()
+ if(MSVC)
+   target_compile_options(onnx_proto
+                          PRIVATE /MP
+-                                 /wd4244 #'argument': conversion from 'google::
+-                                         #protobuf::uint64' to 'int', possible
+-                                         # loss of data
+-                                 /wd4267 # Conversion from 'size_t' to 'int',
+-                                         # possible loss of data
+                                  ${EXTRA_FLAGS})
+   target_compile_options(onnx
+                          PRIVATE /MP
+-                                 /wd4244 # 'argument': conversion from 'google::
+-                                         # protobuf::uint64' to 'int', possible
+-                                         # loss of data
+-                                 /wd4267 # Conversion from 'size_t' to 'int',
+-                                         # possible loss of data
+-                                 /wd4996 # The second parameter is ignored.
+                                  ${EXTRA_FLAGS})
+   if(ONNX_USE_PROTOBUF_SHARED_LIBS)
+       target_compile_options(onnx_proto
--- a/cmake/patches/protobuf/protobuf_cmake.patch
+++ b/cmake/patches/protobuf/protobuf_cmake.patch
@ -0,0 +1,25 @@
+diff --git a/cmake/CMakeLists.txt b/cmake/CMakeLists.txt
+index 61a5c3ded..68d7c5598 100644
+--- a/cmake/CMakeLists.txt
+++ b/cmake/CMakeLists.txt
+@@ -199,12 +199,8 @@ if (MSVC)
+   endif()
+   # MSVC warning suppressions
+   add_definitions(
+-    /wd4018 # 'expression' : signed/unsigned mismatch
+     /wd4065 # switch statement contains 'default' but no 'case' labels
+-    /wd4146 # unary minus operator applied to unsigned type, result still unsigned
+-    /wd4244 # 'conversion' conversion from 'type1' to 'type2', possible loss of data
+     /wd4251 # 'identifier' : class 'type' needs to have dll-interface to be used by clients of class 'type2'
+-    /wd4267 # 'var' : conversion from 'size_t' to 'type', possible loss of data
+     /wd4305 # 'identifier' : truncation from 'type1' to 'type2'
+     /wd4307 # 'operator' : integral constant overflow
+     /wd4309 # 'conversion' : truncation of constant value
+@@ -212,7 +208,6 @@ if (MSVC)
+     /wd4355 # 'this' : used in base member initializer list
+     /wd4506 # no definition for inline function 'function'
+     /wd4800 # 'type' : forcing value to bool 'true' or 'false' (performance warning)
+-    /wd4996 # The compiler encountered a deprecated declaration.
+   )
+   # Allow big object
+   add_definitions(/bigobj)
--- a/cmake/winml.cmake
+++ b/cmake/winml.cmake
@ -405,8 +405,7 @@ target_include_directories(winml_lib_image PRIVATE ${winml_lib_api_image_dir})
 target_include_directories(winml_lib_image PRIVATE ${winml_lib_common_dir}/inc)
 target_include_directories(winml_lib_image PRIVATE ${ONNXRUNTIME_ROOT})
 target_include_directories(winml_lib_image PRIVATE ${ONNXRUNTIME_INCLUDE_DIR})                                                        # for status.h
-target_include_directories(winml_lib_image PRIVATE ${REPO_ROOT}/cmake/external/onnx)
-target_include_directories(winml_lib_image PRIVATE ${REPO_ROOT}/cmake/external/protobuf/src)
+onnxruntime_add_include_to_target(winml_lib_image ${PROTOBUF_LIB} onnx onnx_proto)
 target_include_directories(winml_lib_image PRIVATE ${ONNXRUNTIME_INCLUDE_DIR}/core/platform/windows)
 target_include_directories(winml_lib_image PRIVATE ${REPO_ROOT}/cmake/external/flatbuffers/include)
 target_include_directories(winml_lib_image PRIVATE ${REPO_ROOT}/cmake/external/mp11/include)
@ -513,15 +512,13 @@ target_include_directories(winml_lib_api PRIVATE ${winml_lib_common_dir}/inc)

 target_include_directories(winml_lib_api PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
 target_include_directories(winml_lib_api PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/external/date/include)
-target_include_directories(winml_lib_api PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/external/onnx)

 target_include_directories(winml_lib_api PRIVATE ${ONNXRUNTIME_INCLUDE_DIR})
 target_include_directories(winml_lib_api PRIVATE ${ONNXRUNTIME_INCLUDE_DIR}/core/graph)
 target_include_directories(winml_lib_api PRIVATE ${ONNXRUNTIME_ROOT})
 target_include_directories(winml_lib_api PRIVATE ${ONNXRUNTIME_ROOT}/core/graph)
 target_include_directories(winml_lib_api PRIVATE ${REPO_ROOT}/cmake/external/eigen)
-target_include_directories(winml_lib_api PRIVATE ${REPO_ROOT}/cmake/external/onnx)
-target_include_directories(winml_lib_api PRIVATE ${REPO_ROOT}/cmake/external/protobuf/src)
+onnxruntime_add_include_to_target(winml_lib_api ${PROTOBUF_LIB} onnx onnx_proto)
 target_include_directories(winml_lib_api PRIVATE ${REPO_ROOT}/cmake/external/SafeInt)
 target_include_directories(winml_lib_api PRIVATE ${REPO_ROOT}/cmake/external/flatbuffers/include)
 target_include_directories(winml_lib_api PRIVATE ${REPO_ROOT}/cmake/external/mp11/include)
@ -607,15 +604,14 @@ target_include_directories(winml_lib_api_experimental PRIVATE ${winml_lib_common

 target_include_directories(winml_lib_api_experimental PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
 target_include_directories(winml_lib_api_experimental PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/external/date/include)
-target_include_directories(winml_lib_api_experimental PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/external/onnx)
+

 target_include_directories(winml_lib_api_experimental PRIVATE ${ONNXRUNTIME_INCLUDE_DIR})
 target_include_directories(winml_lib_api_experimental PRIVATE ${ONNXRUNTIME_INCLUDE_DIR}/core/graph)
 target_include_directories(winml_lib_api_experimental PRIVATE ${ONNXRUNTIME_ROOT})
 target_include_directories(winml_lib_api_experimental PRIVATE ${ONNXRUNTIME_ROOT}/core/graph)
 target_include_directories(winml_lib_api_experimental PRIVATE ${REPO_ROOT}/cmake/external/eigen)
-target_include_directories(winml_lib_api_experimental PRIVATE ${REPO_ROOT}/cmake/external/onnx)
-target_include_directories(winml_lib_api_experimental PRIVATE ${REPO_ROOT}/cmake/external/protobuf/src)
+onnxruntime_add_include_to_target(winml_lib_api_experimental ${PROTOBUF_LIB} onnx onnx_proto)
 target_include_directories(winml_lib_api_experimental PRIVATE ${REPO_ROOT}/cmake/external/SafeInt)
 target_include_directories(winml_lib_api_experimental PRIVATE ${REPO_ROOT}/cmake/external/flatbuffers/include)
 target_include_directories(winml_lib_api_experimental PRIVATE ${REPO_ROOT}/cmake/external/mp11/include)
@ -769,14 +765,13 @@ target_include_directories(winml_dll PRIVATE ${winml_lib_common_dir}/inc)

 target_include_directories(winml_dll PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
 target_include_directories(winml_dll PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/external/date/include)
-target_include_directories(winml_dll PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/external/onnx)
+

 target_include_directories(winml_dll PRIVATE ${ONNXRUNTIME_INCLUDE_DIR})
 target_include_directories(winml_dll PRIVATE ${ONNXRUNTIME_INCLUDE_DIR}/core/graph)
 target_include_directories(winml_dll PRIVATE ${ONNXRUNTIME_ROOT})
 target_include_directories(winml_dll PRIVATE ${ONNXRUNTIME_ROOT}/core/graph)
-target_include_directories(winml_dll PRIVATE ${REPO_ROOT}/cmake/external/onnx)
-target_include_directories(winml_dll PRIVATE ${REPO_ROOT}/cmake/external/protobuf/src)
+onnxruntime_add_include_to_target(winml_dll ${PROTOBUF_LIB} onnx onnx_proto)
 target_include_directories(winml_dll PRIVATE ${REPO_ROOT}/cmake/external/eigen)
 target_include_directories(winml_dll PRIVATE ${REPO_ROOT}/cmake/external/SafeInt)
 target_include_directories(winml_dll PRIVATE ${REPO_ROOT}/cmake/external/flatbuffers/include)
--- a/cmake/winml_unittests.cmake
+++ b/cmake/winml_unittests.cmake
@ -8,8 +8,7 @@ set(WINML_TEST_INC_DIR
  ${REPO_ROOT}/winml/lib/Common/inc
  ${REPO_ROOT}/onnxruntime
  ${REPO_ROOT}/onnxruntime/core/providers/dml/DmlExecutionProvider/src/External/D3DX12
-  ${REPO_ROOT}/cmake/external/googletest/googletest/include
-  ${REPO_ROOT}/cmake/external/protobuf/src
+  ${REPO_ROOT}/cmake/external/googletest/googletest/include  
  ${REPO_ROOT}/cmake/external/wil/include
  ${REPO_ROOT}/cmake/external/SafeInt
  ${CMAKE_CURRENT_BINARY_DIR}
@ -27,6 +26,7 @@ function(set_winml_target_properties target)
    CXX_STANDARD_REQUIRED YES
    CXX_EXTENSIONS NO
  )
+  onnxruntime_add_include_to_target(${target} ${PROTOBUF_LIB})
  target_include_directories(${target} PRIVATE ${WINML_TEST_INC_DIR})
  target_compile_definitions(${target} PRIVATE WINML_ROOT_NS=${winml_root_ns})
  target_compile_definitions(${target} PRIVATE BINARY_NAME=\"${BINARY_NAME}\")
--- a/csharp/Directory.Build.props.in
+++ b/csharp/Directory.Build.props.in
@ -4,8 +4,9 @@
    <!-- Note: build.py puts the CMake binary directory under an additional directory named for the build
               configuration, so we want the parent directory here. -->
    <OnnxRuntimeBuildDirectory>@CMAKE_BINARY_DIR@/..</OnnxRuntimeBuildDirectory>
-    
+    <OnnxSourceDirectory>@onnx_SOURCE_DIR@</OnnxSourceDirectory>
    <OnnxRuntimeCsharpRoot>$(MSBuildThisDirectory)</OnnxRuntimeCsharpRoot>
+    <ProtocDirectory>@protobuf_BINARY_DIR@</ProtocDirectory>
    <RestorePackagesPath>$(MSBuildThisFileDirectory)\packages</RestorePackagesPath>
    <RestoreConfigFile>$(MSBuildThisFileDirectory)\NuGet.CSharp.config</RestoreConfigFile>
    <MSBuildWarningsAsMessages>NU1503</MSBuildWarningsAsMessages>
--- a/csharp/test/Microsoft.ML.OnnxRuntime.Tests.NetCoreApp/Microsoft.ML.OnnxRuntime.Tests.NetCoreApp.csproj
+++ b/csharp/test/Microsoft.ML.OnnxRuntime.Tests.NetCoreApp/Microsoft.ML.OnnxRuntime.Tests.NetCoreApp.csproj
@ -9,7 +9,7 @@
    <IsLinuxBuild Condition="'$([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform($([System.Runtime.InteropServices.OSPlatform]::Linux)))' == 'true'">true</IsLinuxBuild>
    <IsWindowsBuild Condition="'$([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform($([System.Runtime.InteropServices.OSPlatform]::Windows)))' == 'true'">true</IsWindowsBuild>
    <IsMacOSBuild Condition="'$([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform($([System.Runtime.InteropServices.OSPlatform]::OSX)))' == 'true'">true</IsMacOSBuild>
-
+    <ProtoSrc>$(OnnxSourceDirectory)\onnx</ProtoSrc>
    <!-- following attributes were necessary for the migrated Tensor tests -->
    <LangVersion>7.2</LangVersion>
    <AllowUnsafeBlocks>True</AllowUnsafeBlocks>
--- a/csharp/tools/Microsoft.ML.OnnxRuntime.PerfTool/Microsoft.ML.OnnxRuntime.PerfTool.csproj
+++ b/csharp/tools/Microsoft.ML.OnnxRuntime.PerfTool/Microsoft.ML.OnnxRuntime.PerfTool.csproj
@ -10,7 +10,7 @@
    <IsLinuxBuild Condition="'$([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform($([System.Runtime.InteropServices.OSPlatform]::Linux)))' == 'true'">true</IsLinuxBuild> 
    <IsWindowsBuild Condition="'$([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform($([System.Runtime.InteropServices.OSPlatform]::Windows)))' == 'true'">true</IsWindowsBuild> 
    <IsMacOSBuild Condition="'$([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform($([System.Runtime.InteropServices.OSPlatform]::OSX)))' == 'true'">true</IsMacOSBuild> 
-    <ProtoSrc>$(OnnxRuntimeCsharpRoot)\..\cmake\external\onnx\onnx</ProtoSrc>
+    <ProtoSrc>$(OnnxSourceDirectory)\onnx</ProtoSrc>
  </PropertyGroup>

  <PropertyGroup Condition="'$(IsLinuxBuild)'=='true'">
--- a/tools/ci_build/github/azure-pipelines/c-api-noopenmp-packaging-pipelines.yml
+++ b/tools/ci_build/github/azure-pipelines/c-api-noopenmp-packaging-pipelines.yml
@ -662,7 +662,7 @@ jobs:
    ArtifactSuffix: 'GPU'
    NugetPackageName : 'Microsoft.ML.OnnxRuntime.Gpu'

- template: nuget/templates/win-ci-2019.yml
+- template: nuget/templates/dml-vs-2019.yml
  parameters:
    AgentPool : 'aiinfra-dml-winbuild'
    ArtifactName: 'drop-nuget-dml'
@ -685,7 +685,7 @@ jobs:
     mkdir $(Build.ArtifactStagingDirectory)\testdata
     copy $(Build.BinariesDirectory)\RelWithDebInfo\RelWithDebInfo\custom_op_library.* $(Build.ArtifactStagingDirectory)\testdata

- template: nuget/templates/win-ci-2019.yml
+- template: nuget/templates/dml-vs-2019.yml
  parameters:
    AgentPool : 'aiinfra-dml-winbuild'
    ArtifactName: 'drop-win-dml-x86-zip'
@ -707,7 +707,7 @@ jobs:
     mkdir $(Build.ArtifactStagingDirectory)\testdata
     copy $(Build.BinariesDirectory)\RelWithDebInfo\RelWithDebInfo\custom_op_library.* $(Build.ArtifactStagingDirectory)\testdata

- template: nuget/templates/win-ci-2019.yml
+- template: nuget/templates/dml-vs-2019.yml
  parameters:
    AgentPool : 'Win-CPU-2021'
    ArtifactName: 'drop-win-dml-arm64-zip'
@ -729,7 +729,7 @@ jobs:
     mkdir $(Build.ArtifactStagingDirectory)\testdata
     copy $(Build.BinariesDirectory)\RelWithDebInfo\RelWithDebInfo\custom_op_library.* $(Build.ArtifactStagingDirectory)\testdata

- template: nuget/templates/win-ci-2019.yml
+- template: nuget/templates/dml-vs-2019.yml
  parameters:
    AgentPool : 'Win-CPU-2021'
    ArtifactName: 'drop-win-dml-arm-zip'
--- a/tools/ci_build/github/azure-pipelines/nuget/templates/dml-vs-2019.yml
+++ b/tools/ci_build/github/azure-pipelines/nuget/templates/dml-vs-2019.yml
@ -3,7 +3,6 @@ parameters:
  DoCompliance: 'false'
  BuildCommand: ''
  JobName: 'Windows_CI_Dev'
-  BuildCSharp: 'true'
  DoNugetPack:  'false'
  NuPackScript : ''
  ArtifactName: 'drop-nuget'
@ -102,7 +101,7 @@ jobs:
      displayName: 'Generate cmake config'
      inputs:
        scriptPath: '$(Build.SourcesDirectory)\tools\ci_build\build.py'
-        arguments: '$(BuildCommand) --update --config $(BuildConfig) ${{ variables.build_py_lto_flag }}'
+        arguments: '$(BuildCommand) --build_csharp --update --config $(BuildConfig) ${{ variables.build_py_lto_flag }}'
        workingDirectory: '$(Build.BinariesDirectory)'

    - ${{ if notIn(parameters['sln_platform'], 'Win32', 'x64') }}:
@ -123,53 +122,48 @@ jobs:
        createLogFile: true

    # The Configuration variable is required to build C#
-    - ${{ if eq(parameters.BuildCSharp, true) }}:
-      - script: |
-         @echo ##vso[task.setvariable variable=Configuration]$(BuildConfig)
-        displayName: 'Set Configuration variable'
+    - script: |
+       @echo ##vso[task.setvariable variable=Configuration]$(BuildConfig)
+      displayName: 'Set Configuration variable'


-    - ${{ if eq(parameters.BuildCSharp, true) }}:
-      - task: NuGetToolInstaller@0
-        displayName: Use Nuget 5.7.0
-        inputs:
-          versionSpec: 5.7.0
+    - task: NuGetToolInstaller@0
+      displayName: Use Nuget 5.7.0
+      inputs:
+        versionSpec: 5.7.0

-    - ${{ if eq(parameters.BuildCSharp, true) }}:
-      - task: MSBuild@1
-        displayName: 'Restore NuGet Packages'
-        inputs:
-          solution: '$(Build.SourcesDirectory)\csharp\OnnxRuntime.CSharp.sln'
-          platform: 'Any CPU'
-          configuration: '$(BuildConfig)'
-          msbuildArguments: '-t:restore -p:OrtPackageId=${{ parameters.OrtPackageId }}'
-          workingDirectory: '$(Build.SourcesDirectory)\csharp'
+    - task: MSBuild@1
+      displayName: 'Restore NuGet Packages'
+      inputs:
+        solution: '$(Build.SourcesDirectory)\csharp\OnnxRuntime.CSharp.sln'
+        platform: 'Any CPU'
+        configuration: '$(BuildConfig)'
+        msbuildArguments: '-t:restore -p:OrtPackageId=${{ parameters.OrtPackageId }}'
+        workingDirectory: '$(Build.SourcesDirectory)\csharp'

-    - ${{ if eq(parameters.BuildCSharp, true) }}:
-      - task: MSBuild@1
-        displayName: 'Build C#'
-        inputs:
-          solution: '$(Build.SourcesDirectory)\csharp\OnnxRuntime.CSharp.sln'
-          configuration: '$(BuildConfig)'
-          platform: 'Any CPU'
-          msbuildArguments: '-p:OnnxRuntimeBuildDirectory="$(Build.BinariesDirectory)" -p:OrtPackageId=${{ parameters.OrtPackageId }}'
-          workingDirectory: '$(Build.SourcesDirectory)\csharp'
+    - task: MSBuild@1
+      displayName: 'Build C#'
+      inputs:
+        solution: '$(Build.SourcesDirectory)\csharp\OnnxRuntime.CSharp.sln'
+        configuration: '$(BuildConfig)'
+        platform: 'Any CPU'
+        msbuildArguments: '-p:OnnxRuntimeBuildDirectory="$(Build.BinariesDirectory)" -p:OrtPackageId=${{ parameters.OrtPackageId }}'
+        workingDirectory: '$(Build.SourcesDirectory)\csharp'

-      - script: |
-         mklink /D /J models C:\local\models
-        workingDirectory: '$(Build.BinariesDirectory)'
-        displayName: 'Create models link'
+    - script: |
+       mklink /D /J models C:\local\models
+      workingDirectory: '$(Build.BinariesDirectory)'
+      displayName: 'Create models link'

    - ${{ if in(parameters['sln_platform'], 'Win32', 'x64') }}:
-      - ${{ if eq(parameters.BuildCSharp, true) }}:
-        - task: DotNetCoreCLI@2
-          displayName: 'Test C#'
-          inputs:
-            command: test
-            projects: '$(Build.SourcesDirectory)\csharp\test\Microsoft.ML.OnnxRuntime.Tests.NetCoreApp\Microsoft.ML.OnnxRuntime.Tests.NetCoreApp.csproj'
-            configuration: '$(BuildConfig)'
-            arguments: '--configuration $(BuildConfig) -p:Platform="Any CPU" -p:OnnxRuntimeBuildDirectory="$(Build.BinariesDirectory)" -p:OrtPackageId=${{ parameters.OrtPackageId }}'
-            workingDirectory: '$(Build.SourcesDirectory)\csharp'
+      - task: DotNetCoreCLI@2
+        displayName: 'Test C#'
+        inputs:
+          command: test
+          projects: '$(Build.SourcesDirectory)\csharp\test\Microsoft.ML.OnnxRuntime.Tests.NetCoreApp\Microsoft.ML.OnnxRuntime.Tests.NetCoreApp.csproj'
+          configuration: '$(BuildConfig)'
+          arguments: '--configuration $(BuildConfig) -p:Platform="Any CPU" -p:OnnxRuntimeBuildDirectory="$(Build.BinariesDirectory)" -p:OrtPackageId=${{ parameters.OrtPackageId }}'
+          workingDirectory: '$(Build.SourcesDirectory)\csharp'

      - ${{ if eq(parameters.RunTests, true) }}:
        - script: |
@ -194,7 +188,7 @@ jobs:
        condition: succeededOrFailed()

    # Nuget packaging if needed
-    - ${{ if and(eq(parameters.BuildCSharp, true), eq(parameters['DoNugetPack'], 'true')) }}:
+    - ${{ if eq(parameters['DoNugetPack'], 'true') }}:
      - task: BatchScript@1
        displayName: 'Setup VS2019 env vars'
        inputs:
--- a/tools/ci_build/github/azure-pipelines/templates/win-ci.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/win-ci.yml
@ -148,7 +148,7 @@ jobs:
    - task: PublishPipelineArtifact@1
      condition: and(succeeded(), eq('${{ parameters.packageName}}', 'x64'))
      inputs:
-        targetPath: '$(Build.BinariesDirectory)\RelWithDebInfo\external\protobuf\cmake\RelWithDebInfo\protoc.exe' 
+        targetPath: '$(Build.BinariesDirectory)\RelWithDebInfo\_deps\protobuf-build\RelWithDebInfo\protoc.exe'
        artifactName: 'drop-extra' 


@ -164,7 +164,7 @@ jobs:
    - task: PublishPipelineArtifact@1
      condition: and(succeeded(), eq('${{ parameters.packageName}}', 'x64'))
      inputs:
-        targetPath: '$(Build.BinariesDirectory)\RelWithDebInfo\external\protobuf\cmake\RelWithDebInfo\protoc.exe' 
+        targetPath: '$(Build.BinariesDirectory)\RelWithDebInfo\_deps\protobuf-build\RelWithDebInfo\protoc.exe'
        artifactName: 'drop-nuget'


@ -262,6 +262,13 @@ jobs:
          msBuildCommandline: '"C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin\amd64\msbuild.exe" "$(Build.BinariesDirectory)\Debug\onnxruntime.sln" /p:platform="$(MsbuildPlatform)" /p:configuration=Debug /p:VisualStudioVersion="16.0" /m /p:PreferredToolArchitecture=x64'
          excludedPaths: '$(Build.BinariesDirectory)#$(Build.SourcesDirectory)\cmake#C:\program files (x86)'

+      - task: PostAnalysis@2
+        inputs:
+          GdnBreakAllTools: false
+          GdnBreakGdnToolBinSkim: true
+          GdnBreakPolicy: M365
+          GdnBreakPolicyMinSev: Error
+
      - task: TSAUpload@2
        displayName: 'TSA upload'
        condition: and (succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
@ -276,4 +283,4 @@ jobs:

    - task: mspremier.PostBuildCleanup.PostBuildCleanup-task.PostBuildCleanup@3
      displayName: 'Clean Agent Directories'
-      condition: always()
+      condition: always()
--- a/tools/ci_build/github/windows/extract_nuget_files.ps1
+++ b/tools/ci_build/github/windows/extract_nuget_files.ps1
@ -53,10 +53,10 @@ elseif ($aars.Count -gt 1) {
 }


-New-Item -Path $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\external\protobuf\cmake\RelWithDebInfo -ItemType directory
+New-Item -Path $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\_deps\protobuf-build\RelWithDebInfo -ItemType directory

 Copy-Item -Path $nuget_artifacts_dir\onnxruntime-win-x64-*\lib\* -Destination $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\RelWithDebInfo
-Copy-Item -Path $Env:BUILD_BINARIESDIRECTORY\extra-artifact\protoc.exe $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\external\protobuf\cmake\RelWithDebInfo
+Copy-Item -Path $Env:BUILD_BINARIESDIRECTORY\extra-artifact\protoc.exe $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\_deps\protobuf-build\RelWithDebInfo

 "Get-ChildItem -Directory -Path $nuget_artifacts_dir\onnxruntime-*"
 $ort_dirs = Get-ChildItem -Directory -Path $nuget_artifacts_dir\onnxruntime-*
--- a/tools/ci_build/github/windows/extract_nuget_files_gpu.ps1
+++ b/tools/ci_build/github/windows/extract_nuget_files_gpu.ps1
@ -26,10 +26,10 @@ Foreach-Object {
 }


-New-Item -Path $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\external\protobuf\cmake\RelWithDebInfo -ItemType directory
+New-Item -Path $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\_deps\protobuf-build\RelWithDebInfo -ItemType directory

 Copy-Item -Path $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\RelWithDebInfo\nuget-artifacts\onnxruntime-win-x64-cuda-*\lib\* -Destination $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\RelWithDebInfo
-Copy-Item -Path $Env:BUILD_BINARIESDIRECTORY\extra-artifact\protoc.exe $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\external\protobuf\cmake\RelWithDebInfo
+Copy-Item -Path $Env:BUILD_BINARIESDIRECTORY\extra-artifact\protoc.exe $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\_deps\protobuf-build\RelWithDebInfo

 $ort_dirs = Get-ChildItem -Path $Env:BUILD_BINARIESDIRECTORY\RelWithDebInfo\RelWithDebInfo\nuget-artifacts\onnxruntime-* -Directory
 foreach ($ort_dir in $ort_dirs)