Enable the Windows CEF sandbox and update x64 to CEF 6613

[summeroff]

Summary

• enable the Chromium sandbox for the Windows browser subprocess path and export the sandbox ABI through the installed libobs development package
• update Windows x64 from CEF 6533 revision 4 to CEF 6613 while leaving macOS, Linux, and Windows ARM64 on their existing platform packages
• expose CEF::Sandbox in-tree and relocatable OBS::cef-sandbox metadata for downstream hosts such as obs-studio-node
• gate Windows x64 sandbox packaging by platform and pointer size, independent of the CMake generator
• package the complete CEF runtime/resource manifest and validate all expected compatibility PDBs
• add create/destroy link-smoke and sandbox-selection tests and pin Enable the CEF sandbox for Windows browser subprocesses obs-browser#56
• add reproducible 4 KiB PDB relink/public-symbol tooling for the legacy symbol server
• rebase the combined sandbox/CEF 6613 work onto current streamlabs (32.1.1sl12)

Dependencies

• depends on Enable the CEF sandbox for Windows browser subprocesses obs-browser#56
• Update Windows x64 to CEF 6613 #774 was folded into this PR and closed; CEF 6533 is no longer an active implementation target
• downstream integration is tracked by draft Host sandboxed CEF 6613 subprocesses in obs64 obs-studio-node#1781

CEF 6613 artifact

The Windows x64 preset uses the published revision-3 archive:

• cef_binary_6613_windows_x64_v3.zip
• size: 875,189,189 bytes
• SHA-256: 32075B154BE69DB1AB716F54F98EE3D4BD4C9F65DF3EB06D381529115AD27151
• public URL: https://streamlabs-cef-dist.s3.us-west-2.amazonaws.com/cef_binary_6613_windows_x64_v3.zip

The legacy Streamlabs Windows CI workflows also select revision 3.

Revision 3 rebuilds Release/libcef.dll with native pointers for the two SandboxInterfaceInfo service fields. This matches the layout of the separately built sandbox archive used by this package. The root-flat Release-only package retains the revision-2 runtime/resource paths, headers, wrapper library, sandbox archive, and eight private PDB paths; only Release/libcef.dll and its PDB changed from revision 2.

libobs integration package

Tag 32.1.1sl12cef1 provides the earlier revision-1 package used by OSN obsproject#1781; it has not been rebuilt with revision 3:

• package: https://obsstudios3.streamlabs.com/libobs-windows64-release-32.1.1sl12cef1.7z
• size: 207,026,836 bytes
• SHA-256: 2053B6D48702E51531EA67C4E5528AA5A64DF1756BFAD13890C89C1589EF035E
• producer run: https://github.com/streamlabs/obs-studio/actions/runs/36939944738

The public bytes match the GitHub Actions artifact. The archive passes 7z t and contains CEF 128.0.6613.138, OBS::cef-sandbox, cef_sandbox.lib, the sandbox ABI and CEF headers, obs-browser.dll, libcef.dll, and the current gs_save_png_file API required by OSN staging.

Symbol strategy

Chromium 128's bundled lld-link advertises /PDBSTRIPPED but rejects it as unimplemented. Its default 8 KiB-page PDB produces EC_FORMAT with the installed pdbcopy 14.00.23615. Relink-CefWithCompatiblePdb.ps1 safely repeats only the final link from Ninja's exact response file with 4 KiB PDB pages, without changing the source build outputs. Create-CefPublicPdb.ps1 then uses the supported Windows SDK pdbcopy -p flow, verifies GUID/age identity and stripped state with llvm-pdbutil, enforces the CAB size ceiling, and replaces only the symbol-server job's temporary copy. The private PDB remains in the downloadable artifacts.

Validation

• rebased commit range is patch-equivalent to the original Enable the Windows CEF sandbox and update x64 to CEF 6613 #775 + Update Windows x64 to CEF 6613 #774 stack
• before the revision-3 pin, cmake --preset windows-x64 succeeded against 32.1.1sl12, RelWithDebInfo builds passed for obs-browser, obs-browser-helper, obs-browser-sandbox-selection-test, and cef-sandbox-link-smoke, and both sandbox tests passed locally (2/2)
• revision-3 public URL returns HTTP 200 with the expected content length; uploaded SHA-256 verified against the local package
• revision-3 build completed all 35,267 Ninja actions; runtime and symbols archives pass 7z t, and all eight private PDB paths are retained
• revision-3 DLL/private PDB match: GUID {BFB94E47-B7AB-03C6-4C4C-44205044422E}, age 1, 4 KiB PDB pages; symchk reports PDB Matched: TRUE
• earlier revision-2 symbol work converted its 2,204,463,104-byte private PDB to a matching stripped 383,627,264-byte public PDB and a valid single-CAB symbol-server entry
• the earlier 32.1.1sl12cef1 tag run passed Windows, both macOS builds, libobs publication, public CEF-symbol creation, and symbol-server ingestion
• CI for the earlier pin passed Windows, both macOS builds, formatting, compatibility/services validation, and CodeQL; CI for revision 3 is pending

Remaining gates

• build and publish a new libobs package using revision 3, then update OSN image-source: Set default size of color source to canvas size obsproject/obs-studio#1781 and run the Desktop browser-source workloads against it
• record restricted-token and job-object evidence for every supported CEF child class; absence of --no-sandbox alone is not closure evidence
• run a real Crashpad crash-report smoke test in the complete downstream stack

Supersedes #773 after the source branch was renamed to remove an internal issue identifier.

[Copilot]

Copilot review overview

🟡 Changes recommended

The relink path can select the wrong linker, and an active tag workflow bypasses public-PDB conversion.

Review effort: Balanced
Findings: 1 · 2

Open (3)

• Convert CEF PDB before publishing symbols for tags · New
• Prefer Ninja's parsed linker over PATH resolution · New
• Require 64-bit Windows regardless of sandbox configuration · New

What changed in this PR

Enables Windows CEF sandbox integration, upgrades Windows x64 to CEF 6613, and adds downstream packaging and symbol tooling.

Changes:

• Exports in-tree and installed CEF sandbox targets.
• Packages complete CEF runtimes and validates symbols.
• Adds compatible public-PDB generation and sandbox smoke tests.

File	Description
.github/​actions/​streamlabs-windows-artifacts/​action.yaml	Validates and packages CEF symbols.
.github/​actions/​upload-debug-symbols/​action.yaml	Adds PDB exclusion support.
.github/​scripts/​Create-CefPublicPdb.ps1	Generates validated public PDBs.
.github/​scripts/​Relink-CefWithCompatiblePdb.ps1	Relinks CEF with 4 KiB PDB pages.
.github/​workflows/​main-streamlabs.yml	Updates legacy CI to CEF 6613.
.github/​workflows/​main.yml	Updates Windows CEF cache/build versions.
.github/​workflows/​streamlabs-windows-release.yaml	Converts CEF symbols before upload.
CMakePresets.json	Selects CEF 6613 for Windows x64.
cmake/​common/​buildspec_common.cmake	Supports platform-specific dependency versions.
cmake/​finders/​FindCEF.cmake	Defines the CEF sandbox target.
cmake/​windows/​cef-sandbox-link-smoke.cpp	Tests sandbox lifecycle linking.
cmake/​windows/​helpers.cmake	Packages CEF runtime and sandbox development files.
libobs/​cmake/​libobsConfig.cmake.in	Exports relocatable sandbox metadata.
plugins/​obs-browser	Pins the sandbox-enabled browser integration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Existing build trees can retain cached CEF 6533 paths and combine them with the newly selected 6613 sandbox.

Review effort: Balanced
Findings: 1

Open (1)

• Invalidate cached CEF discovery when the dependency version changes · New

Resolved since last review (3)

• Convert CEF PDB before publishing symbols for tags
• Require 64-bit Windows regardless of sandbox configuration
• Prefer Ninja's parsed linker over PATH resolution

[Copilot]

Copilot review overview

🟡 Changes recommended

Package-discovery regressions, response-file overwrite risk, and incomplete test-target dependencies remain unresolved.

Review effort: Balanced
Findings: 3 · 1

Open (4)

• Unlink temporary response files before replacing them · New
• Gate sandbox export on packaged sandbox payload · New
• Generate sandbox metadata for build-tree package consumers · New
• Invalidate cached CEF discovery when the dependency version changes

Previously missed (1)

In code that hasn't changed since last review

Add cef-sandbox-link-smoke to the BUILD_TESTING tests target

cmake/​windows/​helpers.cmake:225

Add cef-sandbox-link-smoke to the tests target when BUILD_TESTING is enabled. The documented Windows sequence builds only --target tests before running CTest (test/libobs/README.md:12–14,32–34). This executable is not in that dependency graph, so on a clean build CTest registers it but reports it as Not Run because the executable is missing.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Sandbox confinement and downstream Crashpad validation remain outstanding, alongside unresolved discovery and PDB-preservation issues.

Review effort: Balanced
Findings: 3 · 1

Open (4)

• Reject junction aliases to private PDB before replacement · New
• Preserve explicit CEF cache overrides during discovery invalidation · New
• Generate sandbox metadata for build-tree package consumers
• Invalidate cached CEF discovery when the dependency version changes

Resolved since last review (2)

• Gate sandbox export on packaged sandbox payload
• Unlink temporary response files before replacing them

Previously missed (1)

In code that hasn't changed since last review

Load Windows runtime manifest for 32-bit configurations

cmake/​finders/​FindCEF.cmake:115

Windows browser packaging now requires CEF_BINARY_FILES and CEF_RESOURCE_FILES (cmake/windows/helpers.cmake:120), but this include loads them only when the 64-bit sandbox is required. A 32-bit Windows browser configuration therefore fails the new manifest check even when its CEF distribution supplies the manifest. Load the Windows runtime manifest independently of the sandbox requirement.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Sandbox confinement and downstream Crashpad validation remain outstanding, alongside an unresolved installed-package lookup defect.

Review effort: Balanced
Findings: 1

Open (1)

• Preserve OBS prefix across find_dependency calls · New

Resolved since last review (4)

• Preserve explicit CEF cache overrides during discovery invalidation
• Reject junction aliases to private PDB before replacement
• Generate sandbox metadata for build-tree package consumers
• Invalidate cached CEF discovery when the dependency version changes

[Copilot]

Copilot review overview

🔵 Needs a closer look

Runtime sandbox confinement evidence and end-to-end Crashpad validation remain outstanding for this security-sensitive integration.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Preserve OBS prefix across find_dependency calls