Disable ONNX Runtime telemetry in every package

.github/workflows/release.yml

@@ -30,6 +30,7 @@ jobs:
     outputs:
       ort_ref: ${{ steps.meta.outputs.ort_ref }}
       ort_version: ${{ steps.meta.outputs.ort_version }}
+      ort_telemetry: ${{ steps.meta.outputs.ort_telemetry }}
       package_channel: ${{ steps.meta.outputs.package_channel }}
       package_revision: ${{ steps.meta.outputs.package_revision }}
       package_label: ${{ steps.meta.outputs.package_label }}
@@ -44,6 +45,10 @@ jobs:
         run: |
           set -euo pipefail
           source versions.env
+          [[ "$ORT_TELEMETRY" == disabled ]] || {
+            echo "ORT_TELEMETRY must be disabled; found ${ORT_TELEMETRY:-<unset>}" >&2
+            exit 1
+          }
           case "$PACKAGE_CHANNEL" in
             pilot) package_label="pilot.$PACKAGE_REVISION"; expected_prerelease=true ;;
             stable) package_label="r$PACKAGE_REVISION"; expected_prerelease=false ;;
@@ -67,6 +72,7 @@ jobs:
           {
             echo "ort_ref=$ORT_REF"
             echo "ort_version=$ORT_VERSION"
+            echo "ort_telemetry=$ORT_TELEMETRY"
             echo "package_channel=$PACKAGE_CHANNEL"
             echo "package_revision=$PACKAGE_REVISION"
             echo "package_label=$package_label"
@@ -566,6 +572,7 @@ jobs:
         env:
           ORT_REF: ${{ needs.release-meta.outputs.ort_ref }}
           ORT_VERSION: ${{ needs.release-meta.outputs.ort_version }}
+          ORT_TELEMETRY: ${{ needs.release-meta.outputs.ort_telemetry }}
           PACKAGE_CHANNEL: ${{ needs.release-meta.outputs.package_channel }}
           PACKAGE_REVISION: ${{ needs.release-meta.outputs.package_revision }}
           PACKAGE_LABEL: ${{ needs.release-meta.outputs.package_label }}
@@ -592,6 +599,7 @@ jobs:
             [ "$actual" = "$expected" ]
             grep -Fqx "ORT_REF=$ORT_REF" "$manifest"
             grep -Fqx "ORT_VERSION=$ORT_VERSION" "$manifest"
+            grep -Fqx "ORT_TELEMETRY=$ORT_TELEMETRY" "$manifest"
             grep -Fqx "PACKAGING_COMMIT=$GITHUB_SHA" "$manifest"
             grep -Fqx "PACKAGE_CHANNEL=$PACKAGE_CHANNEL" "$manifest"
             grep -Fqx "PACKAGE_REVISION=$PACKAGE_REVISION" "$manifest"
@@ -612,6 +620,7 @@ jobs:
               "packaging_commit": os.environ["GITHUB_SHA"],
               "upstream_ort_ref": os.environ["ORT_REF"],
               "upstream_ort_version": os.environ["ORT_VERSION"],
+              "ort_telemetry": os.environ["ORT_TELEMETRY"],
               "package_channel": os.environ["PACKAGE_CHANNEL"],
               "package_revision": int(os.environ["PACKAGE_REVISION"]),
               "package_label": os.environ["PACKAGE_LABEL"],
@@ -647,7 +656,7 @@ jobs:
           cat >"$notes" <<EOF
           Custom ONNX Runtime packaging build for ${{ needs.release-meta.outputs.ort_ref }}.
 
-          Package channel: ${{ needs.release-meta.outputs.package_channel }} (${{ needs.release-meta.outputs.package_label }}). Android assets contain a custom ONNX Runtime core with WebGPU and XNNPACK built in. Linux and Windows runtime bundles contain a matching custom ONNX Runtime core and WebGPU plugin; Linux packages support Ubuntu 20.04 and newer with GLIBC no newer than 2.28 and GLIBCXX no newer than 3.4.28, and Windows archives include the checksum-pinned DXC runtime DLLs and their licenses. macOS archives contain a CoreML-enabled ORT core targeting macOS 13.3 and later, with no WebGPU provider. The iOS ZIP contains one static-library XCFramework with device and ARM64 Simulator slices, CoreML and CPU support, and an iOS 15.1 deployment target. Custom-built binaries are stripped of or packaged without debug symbol data. $validation_note Every binary has a verified SHA-256 sidecar and build manifest. The build-provenance.json asset records the source commits and release inputs.
+          Package channel: ${{ needs.release-meta.outputs.package_channel }} (${{ needs.release-meta.outputs.package_label }}). Telemetry is compiled out of every package. Android assets contain a custom ONNX Runtime core with WebGPU and XNNPACK built in. Linux and Windows runtime bundles contain a matching custom ONNX Runtime core and WebGPU plugin; Linux packages support Ubuntu 20.04 and newer with GLIBC no newer than 2.28 and GLIBCXX no newer than 3.4.28, and Windows archives include the checksum-pinned DXC runtime DLLs and their licenses. macOS archives contain a CoreML-enabled ORT core targeting macOS 13.3 and later, with no WebGPU provider. The iOS ZIP contains one static-library XCFramework with device and ARM64 Simulator slices, CoreML and CPU support, and an iOS 15.1 deployment target. Custom-built binaries are stripped of or packaged without debug symbol data. $validation_note Every binary has a verified SHA-256 sidecar and build manifest. The build-provenance.json asset records the source commits and release inputs.
           EOF
           if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
             echo "Release $RELEASE_TAG already exists; immutable releases cannot be overwritten." >&2

.github/workflows/validate.yml

@@ -24,6 +24,10 @@ jobs:
           shellcheck -x -P scripts scripts/*.sh
           for script in scripts/*.sh; do bash -n "$script"; done
           jq --exit-status . config/*.json >/dev/null
+          source versions.env
+          [ "$ORT_TELEMETRY" = disabled ]
+          jq --exit-status ".build_params | index(\"--no_telemetry\") != null" config/android-webgpu.json >/dev/null
+          jq --exit-status ".build_params.base | index(\"--no_telemetry\") != null" config/ios-coreml.json >/dev/null
           # shellcheck disable=SC2016
           pwsh -NoProfile -Command '$errors = $null; Get-ChildItem scripts/*.ps1 | ForEach-Object { [System.Management.Automation.Language.Parser]::ParseFile($_.FullName, [ref]$null, [ref]$errors) | Out-Null }; if ($errors.Count) { $errors | Format-List; exit 1 }'
 

CHANGELOG.md

@@ -4,6 +4,8 @@
 
 - Update the pinned upstream runtime to ONNX Runtime `v1.29.0` (`2e2543fbe9fae542f921d47a72d21d5a4ef0b710`).
 - Include the upstream 1.29 security hardening, runtime fixes, and WebGPU execution-provider improvements.
+- Compile telemetry out of every package and fail builds or publishing if telemetry is enabled.
+- Keep Windows ARM64 warning validation strict without depending on upstream source line numbers.
 - Revalidate the CoreML runtime-availability and public-vcpkg patches against the new upstream tag.
 - Build every supported target from source for the first stable 1.29 packaging revision.
 

README.md

@@ -16,6 +16,8 @@ This repository's release tags describe a **custom packaging** of upstream ONNX
 
 The provider in an asset name is intentional: Android/Linux/Windows support WebGPU, while Apple packages intentionally use CoreML rather than WebGPU. Do not mix a packaged runtime, plugin, or headers with another ONNX Runtime build.
 
+Telemetry is compiled out of every package. Build entrypoints pass ONNX Runtime's `--no_telemetry` option and reject generated CMake configurations unless `onnxruntime_USE_TELEMETRY=OFF`, so an upstream default change cannot silently enable telemetry in a future release.
+
 ## Consumer requirements
 
 - Android: the AAR has a package minimum of API 24. WebGPU still depends on the physical device's Android/Vulkan GPU support; CPU and XNNPACK remain fallbacks.
@@ -60,7 +62,7 @@ GitHub release immutability must be enabled under **Settings → General → Rel
 
 ## Verification and provenance
 
-Every binary asset includes a `.sha256` checksum and `.manifest.env` file. Manifests record the upstream ref and commit, packaging commit, package channel/revision/label, target, provider topology, and build configuration. The release also includes `SHA256SUMS` and `build-provenance.json`.
+Every binary asset includes a `.sha256` checksum and `.manifest.env` file. Manifests record the upstream ref and commit, packaging commit, telemetry policy, package channel/revision/label, target, provider topology, and build configuration. The release also includes `SHA256SUMS` and `build-provenance.json`.
 
 Custom-built binaries are stripped of or packaged without debug-symbol data. Linux and Android builds additionally reject debug/symbol-table sections and executable stacks. Archives contain the ONNX Runtime licence and third-party notices; Android AARs store them under `META-INF/`. Windows archives include the licence files shipped with the pinned DXC runtime.
 

RELEASE-CHECKLIST.md

@@ -6,6 +6,6 @@ Use this checklist for a non-prerelease package release. Pilot tags remain immut
 2. Ensure the packaging branch is merged into `main` through a PR with the `Validate / scripts` check passing.
 3. Confirm representative-device correctness and performance evidence, including Android WebGPU on the supported physical-device matrix.
 4. Dispatch `release.yml` from `main` with the computed tag and `prerelease=false`. Every release builds and tests all targets from source.
-5. Monitor every native build and the publish job. A successful publish verifies the release is immutable and has 35 assets: 11 binaries, 11 checksums, 11 manifests, `SHA256SUMS`, and `build-provenance.json`.
-6. Independently download the release, verify `SHA256SUMS`, inspect the manifests and provenance, and retain the device-test record with the release notes.
+5. Monitor every native build and the publish job. A successful publish verifies that telemetry is disabled, that the release is immutable, and that it has 35 assets: 11 binaries, 11 checksums, 11 manifests, `SHA256SUMS`, and `build-provenance.json`.
+6. Independently download the release, verify `SHA256SUMS`, confirm `ORT_TELEMETRY=disabled` in every manifest and provenance, and retain the device-test record with the release notes.
 7. If a packaging correction is needed, increment `PACKAGE_REVISION` and create the next immutable `r<n>` tag. Never replace or retag an existing release.

config/android-webgpu.json

@@ -10,6 +10,7 @@
     "--build_shared_lib",
     "--use_webgpu",
     "--use_xnnpack",
+    "--no_telemetry",
     "--skip_tests",
     "--disable_rtti",
     "--enable_lto",

config/ios-coreml.json

@@ -12,6 +12,7 @@
       "--parallel",
       "--build_apple_framework",
       "--use_coreml",
+      "--no_telemetry",
       "--skip_tests",
       "--no_kleidiai",
       "--cmake_extra_defines=onnxruntime_BUILD_UNIT_TESTS=OFF"

scripts/build-android.sh

@@ -12,6 +12,7 @@ case "$abi" in
 esac
 
 require_cmd cmp
+require_cmd jar
 require_cmd python3
 require_cmd unzip
 require_cmd zip
@@ -43,6 +44,8 @@ if actual != expected:
     raise SystemExit(
         f"Android build configuration uses minSdk {actual}; expected {expected} from versions.env"
     )
+if "--no_telemetry" not in settings.get("build_params", []):
+    raise SystemExit("Android build configuration must disable telemetry")
 PY
 
 prepare_ort_source
@@ -62,6 +65,7 @@ python3 "$ORT_SOURCE_DIR/tools/ci_build/github/android/build_aar_package.py" \
   --android_sdk_path "$ANDROID_HOME" \
   --android_ndk_path "$ANDROID_NDK_HOME" \
   "$settings"
+verify_ort_telemetry_disabled "$build_dir"
 
 aar="$(find "$build_dir/aar_out/Release" -type f -name '*.aar' -print -quit)"
 require_file "$aar"
@@ -71,6 +75,11 @@ asset="$dist_dir/onnxruntime-webgpu-android-$abi-$ORT_VERSION-$(package_label).a
 package_dir="$build_dir/package"
 mkdir -p "$package_dir"
 unzip -q "$aar" -d "$package_dir"
+require_file "$package_dir/classes.jar"
+jar tf "$package_dir/classes.jar" >"$build_dir/java-classes.txt"
+if grep -Eq "^ai/onnxruntime/telemetry/" "$build_dir/java-classes.txt"; then
+  die "Android AAR contains ONNX Runtime telemetry classes"
+fi
 
 while IFS= read -r -d '' library; do
   "$ndk_strip" --strip-unneeded "$library"

scripts/build-desktop.sh

@@ -64,6 +64,7 @@ build_args=(
   --build_shared_lib
   --use_vcpkg
   "${provider_args[@]}"
+  --no_telemetry
   --disable_rtti
 )
 if [[ "$target" == linux-* ]] && [ "$EUID" -eq 0 ]; then
@@ -80,6 +81,7 @@ build_args+=(
 )
 build_log="$build_dir/build.log"
 python3 "${build_args[@]}" 2>&1 | tee "$build_log"
+verify_ort_telemetry_disabled "$build_dir"
 
 if [[ "$target" == macos-* ]]; then
   if grep -Fq "built for newer 'macOS' version" "$build_log"; then

scripts/build-ios.sh

@@ -41,6 +41,8 @@ for sysroot in ("iphoneos", "iphonesimulator"):
 base = settings["build_params"]["base"]
 if "--use_coreml" not in base:
     raise SystemExit("CoreML is not enabled")
+if "--no_telemetry" not in base:
+    raise SystemExit("iOS build configuration must disable telemetry")
 for forbidden in ("--use_webgpu", "--use_xnnpack"):
     if any(param == forbidden or param.startswith(f"{forbidden}=") for params in settings["build_params"].values() for param in params):
         raise SystemExit(f"forbidden iOS provider enabled: {forbidden}")
@@ -52,6 +54,7 @@ python3 "$ORT_SOURCE_DIR/tools/ci_build/github/apple/build_apple_framework.py" \
   --build_dir "$build_dir" \
   --config Release \
   "$settings" 2>&1 | tee "$build_log"
+verify_ort_telemetry_disabled "$build_dir"
 
 if grep -Fq -- '-Wunguarded-availability-new' "$build_log"; then
   die "iOS build emitted an unguarded runtime availability warning"

scripts/build-windows.ps1

@@ -7,6 +7,24 @@ Get-Content (Join-Path $RepoRoot "versions.env") | ForEach-Object {
     if ($_ -match '^([^#=]+)=(.*)$') { $versions[$Matches[1]] = $Matches[2] }
 }
 
+if ($versions.ORT_TELEMETRY -ne "disabled") { throw "ORT_TELEMETRY must be disabled" }
+
+function Assert-OrtTelemetryDisabled {
+    param([string]$Root)
+
+    $ortCaches = @()
+    Get-ChildItem $Root -Filter CMakeCache.txt -Recurse -File | ForEach-Object {
+        $settings = @(Select-String -Path $_.FullName -Pattern "^onnxruntime_USE_TELEMETRY:[^=]+=")
+        if ($settings.Count -gt 0) {
+            $ortCaches += $_.FullName
+            if ($settings.Count -ne 1 -or $settings[0].Line -notmatch "^onnxruntime_USE_TELEMETRY:[^=]+=OFF$") {
+                throw "ONNX Runtime telemetry is not disabled in $($_.FullName)"
+            }
+        }
+    }
+    if ($ortCaches.Count -eq 0) { throw "no ONNX Runtime telemetry setting found below $Root" }
+}
+
 $target = if ($args.Count -gt 0) { $args[0] } else { "" }
 if ($target -notin @("windows-x64", "windows-arm64")) {
     throw "usage: build-windows.ps1 <windows-x64|windows-arm64>"
@@ -59,6 +77,7 @@ $buildArgs = @(
     "--use_vcpkg",
     "--use_webgpu", "shared_lib",
     "--wgsl_template", "static",
+    "--no_telemetry",
     "--disable_rtti",
     "--enable_lto",
     "--cmake_generator", "Visual Studio 17 2022",
@@ -83,6 +102,7 @@ if ($target -eq "windows-arm64") {
 $buildLog = Join-Path $buildDir "build.log"
 python @buildArgs 2>&1 | Tee-Object -FilePath $buildLog
 if ($LASTEXITCODE -ne 0) { throw "ONNX Runtime build failed" }
+Assert-OrtTelemetryDisabled $buildDir
 
 if ($target -eq "windows-arm64") {
     $warnings = @(Select-String -Path $buildLog -Pattern 'warning C\d{4}:' | ForEach-Object { $_.Line })
@@ -93,9 +113,9 @@ if ($target -eq "windows-arm64") {
 
     $missingReturnWarnings = @($warnings | Where-Object { $_ -match 'warning C4715:' })
     $allowedWarnings = @(
-        'BackendD3D\.cpp\(73\): warning C4715: .*ToDXGIPowerPreference',
-        'UtilsD3D\.cpp\(420\): warning C4715: .*DXGITextureFormat',
-        'UtilsD3D\.cpp\(265\): warning C4715: .*DXGITypelessTextureFormat'
+        "warning C4715: \x27.*::ToDXGIPowerPreference\x27: not all control paths return a value",
+        "warning C4715: \x27.*::DXGITextureFormat\x27: not all control paths return a value",
+        "warning C4715: \x27.*::DXGITypelessTextureFormat\x27: not all control paths return a value"
     )
     foreach ($warning in $missingReturnWarnings) {
         if (-not ($allowedWarnings | Where-Object { $warning -match $_ })) {
@@ -162,6 +182,7 @@ $utf8NoBom = [System.Text.UTF8Encoding]::new($false)
 $manifestText = (@(
     "ORT_REF=$($versions.ORT_REF)",
     "ORT_VERSION=$($versions.ORT_VERSION)",
+    "ORT_TELEMETRY=$($versions.ORT_TELEMETRY)",
     "ORT_COMMIT=$commit",
     "PACKAGING_COMMIT=$packagingCommit",
     "PACKAGE_CHANNEL=$($versions.PACKAGE_CHANNEL)",

scripts/common.sh

@@ -35,6 +35,29 @@ require_dir() {
   [ -d "$1" ] || die "missing directory: $1"
 }
 
+require_telemetry_disabled() {
+  [ "${ORT_TELEMETRY:-}" = disabled ] || die "ORT_TELEMETRY must be disabled"
+}
+
+verify_ort_telemetry_disabled() {
+  local root="$1"
+  local cache count=0
+  require_dir "$root"
+  while IFS= read -r -d '' cache; do
+    local setting_count
+    setting_count=$(grep -Ec '^onnxruntime_USE_TELEMETRY:[^=]+=' "$cache" || true)
+    if [ "$setting_count" -gt 0 ]; then
+      count=$((count + 1))
+      if [ "$setting_count" -ne 1 ] || ! grep -Eq '^onnxruntime_USE_TELEMETRY:[^=]+=OFF$' "$cache"; then
+        die "ONNX Runtime telemetry is not disabled in $cache"
+      fi
+    fi
+  done < <(find "$root" -type f -name CMakeCache.txt -print0)
+  [ "$count" -gt 0 ] || die "no ONNX Runtime telemetry setting found below $root"
+}
+
+require_telemetry_disabled
+
 sha256_file() {
   if command -v sha256sum >/dev/null 2>&1; then
     sha256sum "$1" | awk '{print $1}'
@@ -85,6 +108,7 @@ write_manifest() {
   {
     printf 'ORT_REF=%s\n' "$ORT_REF"
     printf 'ORT_VERSION=%s\n' "$ORT_VERSION"
+    printf 'ORT_TELEMETRY=%s\n' "$ORT_TELEMETRY"
     printf 'ORT_COMMIT=%s\n' "$ort_commit_value"
     printf 'PACKAGING_COMMIT=%s\n' "$packaging_commit_value"
     printf 'PACKAGE_CHANNEL=%s\n' "$PACKAGE_CHANNEL"

scripts/repackage-release.sh

@@ -49,6 +49,7 @@ expected = {
     "release_tag": sys.argv[2],
     "upstream_ort_ref": sys.argv[3],
     "upstream_ort_version": sys.argv[4],
+    "ort_telemetry": "disabled",
 }
 for key, value in expected.items():
     if provenance.get(key) != value:
@@ -117,6 +118,7 @@ verify_source_asset() {
     die "source SHA256SUMS does not contain $(basename "$source_asset")"
   grep -Fqx "ORT_REF=$ORT_REF" "$source_manifest"
   grep -Fqx "ORT_VERSION=$ORT_VERSION" "$source_manifest"
+  grep -Fqx "ORT_TELEMETRY=$ORT_TELEMETRY" "$source_manifest"
   grep -Fqx "PACKAGING_COMMIT=$source_packaging_commit" "$source_manifest"
   grep -Fqx "PACKAGE_LABEL=$source_label" "$source_manifest"
   grep -Fqx 'ORT_CORE_INCLUDED=1' "$source_manifest"

versions.env

@@ -1,5 +1,6 @@
 ORT_REF=v1.29.0
 ORT_VERSION=1.29.0
+ORT_TELEMETRY=disabled
 PACKAGE_CHANNEL=stable
 PACKAGE_REVISION=1
 PYTHON_VERSION=3.12