Virtual-environments: Spectre Mitigated Libraries missing

[davidhesselbomvcc]

Describe the bug
msbuild.exe spits out warnings about missing Spectre mitigation libraries when building a v141 vcxproj, and later fails the build with LINK : fatal error LNK1104: cannot open file 'msvcprt.lib'. This did not happen when building the very same commit 10 days ago.

Area for Triage:
C/C++

Question, Bug, or Feature?:
Bug

Virtual environments affected

• [ ] macOS 10.15
• [ ] Ubuntu 16.04 LTS
• [ ] Ubuntu 18.04 LTS
• [ ] Windows Server 2016 R2
• [X] Windows Server 2019

Expected behavior
The build was fine 10 days ago, and since I didn't change anything (same commit), the expected behavior is that the build should be fine today as well.

Actual behavior
msbuild.exe spits out warnings about missing Spectre mitigation libraries when building a v141 vcxproj on windows-latest:

19>C:\Program Files (x86)\Microsoft Visual Studio2019\Enterprise\MSBuild\Microsoft\VC\v150\Microsoft.CppBuild.targets(402,5): warning MSB8038: Spectre mitigation is enabled but Spectre mitigated libraries are not found. Verify that the Visual Studio Workload includes the Spectre mitigated libraries. See https://aka.ms/Ofhn4c for more information.

It later fails the build:

LINK : fatal error LNK1104: cannot open file 'msvcprt.lib'

The very same commit built successfully 10 days ago, so something must have changed in the VM since then (I have made no builds in the interim, so I unfortunately can't give you a more precise timeframe, but the fact that no one else has reported this problem suggests it's a recent change). If it helps, the WindowsTargetPlatformVersion specified in the vcxproj is 10.0.17134.0.

I notice there's a /Qspectre option among the build flags in the log now that was not present in the build logs 10 days ago, and the vcxproj itself has never specified the option. According to some several months old forum threads I found while googling the issue, this flag originates from a Microsoft.Cpp.targets or Microsoft.CppBuild.targets or .props file somewhere in the Visual Studio install folder. Perhaps such a file was modified recently on the VM?

I also found this discussion, but its original post is 16 months old.

It also looks like the "missing" package is in fact installed (unless this particular one doesn't cover v141, for some reason), so I don't know why the error would appear at all, /Qspectre or no:
https://github.com/actions/virtual-environments/blob/2cf30548201d0d341ab2375edbe0e4da7006aa22/images/win/scripts/Installers/Windows2019/Install-VS2019.ps1#L110

[davidhesselbomvcc]

Update: I mentioned this discussion above, and can confirm that the suggested workaround works for me: Add a file named Directory.Build.props to the project folder and give it the following contents to override the /Qspectre option being set:

<Project>
  <PropertyGroup Label="Configuration">
    <SpectreMitigation>false</SpectreMitigation>
  </PropertyGroup>
</Project>

Removing the file and building again breaks the build once more.

So, to summarize: The /Qspectre option is set by the VM, but the VS components required to build a project with my configuration when that option is set are not installed on the VM.

I'll try changing v141 to v142 to see if that fixes the issue.

[miketimofeev]

@davidhesselbomvcc thanks for reporting this. I assume this PR is the root cause
https://github.com/actions/virtual-environments/pull/431
We will investigate what could be done from our side to mitigate the issue.

[miketimofeev]

I've made an initial investigation and yes, it looks like we have spectre mitigated libraries only for 142 at the moment.

[davidhesselbomvcc]

Thanks for confirming.

There's a component in the installer called "MSVC v141 - VS 2017 C++ x64/x86 Spectre-mitigated libs (v14.16)" (Microsoft.VisualStudio.Component.VC.v141.x86.x64.Spectre) - maybe adding that to images/win/scripts/Installers/Windows2019/Install-VS2019.ps1 is all that needs doing to fix this?

In the meantime, the Directory.Build.props workaround I mentioned is good enough for me for the time being.

[miketimofeev]

@davidhesselbomvcc thanks for the suggestion, I also found these components yesterday and doing some tests at the moment before publishing PR. This is the list of components according to the doc

              '--add Microsoft.VisualStudio.Component.VC.v141.ATL.ARM.Spectre ' + `
              '--add Microsoft.VisualStudio.Component.VC.v141.ATL.ARM64.Spectre ' + `
              '--add Microsoft.VisualStudio.Component.VC.v141.ATL.Spectre ' + `
              '--add Microsoft.VisualStudio.Component.VC.v141.MFC.ARM.Spectre ' + `
              '--add Microsoft.VisualStudio.Component.VC.v141.MFC.ARM64.Spectre ' + `
              '--add Microsoft.VisualStudio.Component.VC.v141.MFC.Spectre ' + `

And it seems VisualStudio.Component.VC.v141.x86.x64.Spectre has to be added as well

[davidhesselbomvcc]

I'm not personally using ATL or MFC in the particular project I'm currently having trouble building, but yes, I suppose it makes sense to add those components as well. Thanks again for looking into this.

[miketimofeev]

@davidhesselbomvcc the PR has been merged. Changes will be rolled out next week with the new VM image.

[davidhesselbomvcc]

Cool, thanks! Are you going to close this now, or shall I, once I've made sure it works?

[miketimofeev]

@davidhesselbomvcc I'll let you know when the image is deployed to check the issue is resolved.

[miketimofeev]

@davidhesselbomvcc the image has been deployed. Could you check v141, please?

[davidhesselbomvcc]

@miketimofeev I removed my Directory.Build.props and can still build without errors, so yes, the problem appears to be fixed. Feel free to close.