FIX+SECURITY: PR #744 review (Sumit) — PE presence gate, secret TLS conn, small fixes

- assert_pe_machine.py: assert the native binding (ddbc_bindings*.pyd) AND the vendored
  ODBC driver DLLs are BOTH present, independently (win-arm64 skips the runtime import,
  so this is its presence gate); +2 tests.
- conda-build-pipeline.yml: source the TLS probe connection string from a SECRET variable
  (variable group / Key Vault), not a plaintext queue-time parameter that ADO leaves
  unmasked in the run UI/logs.
- driver_load_probe.py: drop "missing companion" from the failure label (self-contained
  package -- vendors the ODBC payload; there is no separate companion).
- tests/test_028: add a }} escaped-brace case for _split_top_level (MS-ODBCSTR: '}}' is a
  literal '}', so a value with '}}' + internal ';' must not be mis-split).
- audit_bundled_binaries.py: document that the Linux audit does not assert a required
  distro SET (the repackaged wheel is the source of truth).

96 probe/audit unit tests pass; black clean.

Author: jahnvi480

OneBranchPipelines/conda-build-pipeline.yml

@@ -40,14 +40,6 @@ parameters:
     displayName: 'Python versions (comma-separated)'
     type: string
     default: '3.10,3.11,3.12,3.13,3.14'
-  # H1: the Encrypt=yes probe connection string. OpenSSL is dlopen'd lazily (not in
-  # DT_NEEDED), so ONLY a live TLS handshake proves libssl/libcrypto resolve from
-  # $PREFIX/lib -- no static audit can. Supply a reachable server (from a secret var)
-  # to activate conda/tls_connect_probe.py on the Linux leg; empty = the probe SKIPs.
-  - name: condaTlsProbeConn
-    displayName: 'TLS probe: a full SQL Server connection string; NOT a yes/no toggle; empty = skip'
-    type: string
-    default: ''
   # H1: enable the minimal-base ldd reachability gate (CONDA_ASSERT_PREFIX_REACHABLE).
   # It fails CLOSED if the driver binds a system (or absent) krb5/gssapi/libltdl, so it
   # is only valid on a leg with NO system copies of those libs -- set true ONLY when
@@ -261,10 +253,14 @@ extends:
               vmImage: 'ubuntu-latest'
             variables:
               ob_outputDirectory: '$(Build.ArtifactStagingDirectory)'
-              # H1: activate the runtime gates in build-conda-packages.sh. The TLS probe
-              # runs when a connection string is supplied; the ldd reachability gate runs
-              # (fail-closed) only when explicitly enabled on a minimal base.
-              CONDA_TLS_PROBE_CONN: ${{ parameters.condaTlsProbeConn }}
+              # H1: activate the runtime gates in build-conda-packages.sh. The TLS probe's
+              # Encrypt=yes connection string carries a password, so it is sourced from a
+              # SECRET variable -- NOT a queue-time parameter, which ADO leaves UNMASKED in
+              # the run UI/logs. Define `condaTlsProbeConn` as a secret in a variable group /
+              # Key Vault linked to this pipeline; unset = the probe SKIPs loudly. The ldd
+              # reachability gate runs (fail-closed) only when explicitly enabled on a
+              # minimal base.
+              CONDA_TLS_PROBE_CONN: $(condaTlsProbeConn)
               ${{ if parameters.enableMinimalReachabilityGate }}:
                 CONDA_ASSERT_PREFIX_REACHABLE: '1'
             steps:

conda/driver_load_probe.py

@@ -109,7 +109,7 @@ def main():
     if driver_loaded(outcome):
         print("DRIVER_LOADED (" + describe(outcome) + ")")
         return
-    sys.exit("DRIVER DID NOT LOAD / wrong arch / missing companion: " + describe(outcome))
+    sys.exit("DRIVER DID NOT LOAD / wrong arch: " + describe(outcome))
 
 
 if __name__ == "__main__":

eng/scripts/assert_pe_machine.py

@@ -141,10 +141,17 @@ def audit_package(path: str) -> list[str]:
 
     errors: list[str] = []
     native_seen = 0
+    binding_seen = 0
+    driver_dll_seen = 0
     for name, data in _iter_payload_members(path):
         if not name.lower().endswith(_NATIVE_SUFFIXES):
             continue
         native_seen += 1
+        low = name.replace("\\", "/").lower()
+        if "/mssql_python/" in low and "ddbc_bindings" in low and low.endswith(".pyd"):
+            binding_seen += 1
+        if "/mssql_python_odbc/libs/windows/" in low and low.endswith(".dll"):
+            driver_dll_seen += 1
         machine = pe_machine(data)
         if machine is None:
             errors.append(f"{name}: not a valid PE binary (no MZ/PE header).")
@@ -157,11 +164,25 @@ def audit_package(path: str) -> list[str]:
         else:
             print(f"  {subdir}/{os.path.basename(name)}: PE machine={_MACHINES[expected]} OK")
 
+    # Presence: assert BOTH required binary categories independently, not just >=1 native
+    # file -- win-arm64 skips the runtime import, so this IS its presence gate. A package
+    # with the binding .pyd but missing driver DLLs (or vice versa) must fail here.
     if native_seen == 0:
         errors.append(
             f"{base_name}: no .pyd/.dll found in a '{subdir}' package -- the native binding "
             f"(ddbc_bindings*.pyd) + the vendored ODBC driver DLLs must be present."
         )
+    else:
+        if binding_seen == 0:
+            errors.append(
+                f"{base_name}: no native binding (mssql_python/ddbc_bindings*.pyd) found in a "
+                f"'{subdir}' package."
+            )
+        if driver_dll_seen == 0:
+            errors.append(
+                f"{base_name}: no vendored ODBC driver DLL "
+                f"(mssql_python_odbc/libs/windows/**/*.dll) found in a '{subdir}' package."
+            )
     return errors
 
 

eng/scripts/audit_bundled_binaries.py

@@ -464,7 +464,10 @@ def audit_package(path: str) -> list[str]:
         )
     # Per-subdir presence: EVERY discovered driver lib dir must ship BOTH a driver and
     # libodbcinst.so.2. A package-global count would let a driver missing from ONE
-    # distro subdir (alpine/debian_ubuntu/rhel/suse) slip past.
+    # distro subdir (alpine/debian_ubuntu/rhel/suse) slip past. NOTE: this checks every
+    # DISCOVERED distro/arch dir but does NOT assert a required distro SET -- the
+    # repackaged wheel is the source of truth for which distro payloads exist, so a
+    # wholesale-missing distro is a wheel-build concern, not enforced here.
     if not lib_dirs:
         errors.append(
             f"{base_name}: no mssql_python_odbc/libs/linux/*/*/lib directory found in a "

tests/test_028_tls_connect_probe.py

@@ -187,6 +187,17 @@ def test_split_top_level_respects_braces():
     ]
 
 
+def test_split_top_level_handles_escaped_braces():
+    """MS-ODBCSTR: '}}' inside a braced value is a literal '}', not a close -- so a value
+    containing '}}' and an internal ';' must NOT be split (matches the shipped parser)."""
+    probe = _load_probe()
+    assert probe._split_top_level("Server=x;Pwd={p}}w;d};Encrypt=no") == [
+        "Server=x",
+        "Pwd={p}}w;d}",
+        "Encrypt=no",
+    ]
+
+
 def test_redact_masks_values_and_flags_bare_segments():
     """The debug line must never leak a value and must surface a no-value segment."""
     probe = _load_probe()

tests/test_030_pe_machine_assert.py

@@ -160,6 +160,34 @@ def test_win_package_without_native_fails(tmp_path):
     assert any("no .pyd/.dll" in e for e in errors)
 
 
+@pytest.mark.skipif(not _zstd_available(), reason="no zstandard backend available")
+def test_win_missing_driver_dll_fails(tmp_path):
+    # Correct-arch binding present, but the vendored ODBC driver DLLs are missing.
+    p = _make_conda(
+        tmp_path,
+        "win-arm64",
+        {"Lib/site-packages/mssql_python/ddbc_bindings.cp312-arm64.pyd": _fake_pe(_ARM64)},
+    )
+    errors = ape.audit_package(p)
+    assert any("driver DLL" in e for e in errors)
+
+
+@pytest.mark.skipif(not _zstd_available(), reason="no zstandard backend available")
+def test_win_missing_binding_fails(tmp_path):
+    # Correct-arch driver DLL present, but the native binding .pyd is missing.
+    p = _make_conda(
+        tmp_path,
+        "win-arm64",
+        {
+            "Lib/site-packages/mssql_python_odbc/libs/windows/arm64/msodbcsql18.dll": _fake_pe(
+                _ARM64
+            )
+        },
+    )
+    errors = ape.audit_package(p)
+    assert any("native binding" in e for e in errors)
+
+
 @pytest.mark.skipif(not _zstd_available(), reason="no zstandard backend available")
 def test_non_windows_package_skipped(tmp_path):
     # A linux-64 package has no PE payload -> skipped clean (not failed).