From 483975088c6ac5805f455d9824c86fdfeef0508b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Langa?= <lukasz@langa.pl>
Date: Mon, 12 Jan 2026 17:59:13 +0100
Subject: [PATCH 1/5] Bump automatic certificate update on Windows during
 builds

---
 PCbuild/get_external.py | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/PCbuild/get_external.py b/PCbuild/get_external.py
index 27fbc311bbc1d6..78444a829049e9 100755
--- a/PCbuild/get_external.py
+++ b/PCbuild/get_external.py
@@ -1,9 +1,11 @@
 #!/usr/bin/env python3
 
 import argparse
+import functools
 import os
 import pathlib
 import platform
+import subprocess
 import sys
 import tarfile
 import time
@@ -12,6 +14,28 @@
 import zipfile
 
 
+@functools.cache
+def trigger_automatic_root_certificate_update(url: str, timeout: int = 30) -> None:
+    escaped_url = url.replace("'", "''")
+    try:
+        subprocess.run(
+            [
+                "powershell",
+                "-NoProfile",
+                "-Command",
+                f"Invoke-WebRequest -Uri '{escaped_url}'"
+                f" -UseBasicParsing -Method HEAD -MaximumRedirection 0"
+                f" -TimeoutSec {timeout} -ErrorAction SilentlyContinue"
+                f" | Out-Null",
+            ],
+            check=True,
+            capture_output=True,
+            timeout=timeout + 5,
+        )
+    except (subprocess.CalledProcessError, subprocess.TimeoutExpired):
+        pass
+
+
 def retrieve_with_retries(download_location, output_path, reporthook,
                           max_retries=7):
     """Download a file with exponential backoff retry and save to disk."""

From 0bb47ad7c88c3094b08f468f3b8d1050829bb7bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Langa?= <lukasz@langa.pl>
Date: Mon, 12 Jan 2026 18:11:43 +0100
Subject: [PATCH 2/5] so this didn't work, let's see why

---
 PCbuild/get_external.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/PCbuild/get_external.py b/PCbuild/get_external.py
index 78444a829049e9..92533929749453 100755
--- a/PCbuild/get_external.py
+++ b/PCbuild/get_external.py
@@ -14,7 +14,7 @@
 import zipfile
 
 
-@functools.cache
+#@functools.cache
 def trigger_automatic_root_certificate_update(url: str, timeout: int = 30) -> None:
     escaped_url = url.replace("'", "''")
     try:
@@ -32,8 +32,8 @@ def trigger_automatic_root_certificate_update(url: str, timeout: int = 30) -> No
             capture_output=True,
             timeout=timeout + 5,
         )
-    except (subprocess.CalledProcessError, subprocess.TimeoutExpired):
-        pass
+    except (subprocess.CalledProcessError, subprocess.TimeoutExpired) as e:
+        print(e)
 
 
 def retrieve_with_retries(download_location, output_path, reporthook,

From 778c31ce4c564866afe60d0900d3192becde3f65 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Langa?= <lukasz@langa.pl>
Date: Mon, 12 Jan 2026 18:21:55 +0100
Subject: [PATCH 3/5] debug continued

---
 PCbuild/get_external.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/PCbuild/get_external.py b/PCbuild/get_external.py
index 92533929749453..e5127276c86c94 100755
--- a/PCbuild/get_external.py
+++ b/PCbuild/get_external.py
@@ -25,8 +25,8 @@ def trigger_automatic_root_certificate_update(url: str, timeout: int = 30) -> No
                 "-Command",
                 f"Invoke-WebRequest -Uri '{escaped_url}'"
                 f" -UseBasicParsing -Method HEAD -MaximumRedirection 0"
-                f" -TimeoutSec {timeout} -ErrorAction SilentlyContinue"
-                f" | Out-Null",
+                f" -TimeoutSec {timeout}"# -ErrorAction SilentlyContinue"
+                #f" | Out-Null",
             ],
             check=True,
             capture_output=True,

From e4e4033ca192272c0a64dbce23100882e88272ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Langa?= <lukasz@langa.pl>
Date: Mon, 12 Jan 2026 18:26:45 +0100
Subject: [PATCH 4/5] new functions work better when called

---
 PCbuild/get_external.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/PCbuild/get_external.py b/PCbuild/get_external.py
index e5127276c86c94..ef80aa7220df9b 100755
--- a/PCbuild/get_external.py
+++ b/PCbuild/get_external.py
@@ -49,6 +49,7 @@ def retrieve_with_retries(download_location, output_path, reporthook,
         except (urllib.error.URLError, ConnectionError) as ex:
             if attempt == max_retries:
                 raise OSError(f'Download from {download_location} failed.') from ex
+            trigger_automatic_root_certificate_update(download_location)
             time.sleep(2.25**attempt)
         else:
             return resp

From 128e424edfba7bb8944c6c533710ef7a9677201b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Langa?= <lukasz@langa.pl>
Date: Mon, 12 Jan 2026 22:36:28 +0100
Subject: [PATCH 5/5] undebug the change

---
 PCbuild/get_external.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/PCbuild/get_external.py b/PCbuild/get_external.py
index ef80aa7220df9b..494b22809e0844 100755
--- a/PCbuild/get_external.py
+++ b/PCbuild/get_external.py
@@ -14,7 +14,7 @@
 import zipfile
 
 
-#@functools.cache
+@functools.cache
 def trigger_automatic_root_certificate_update(url: str, timeout: int = 30) -> None:
     escaped_url = url.replace("'", "''")
     try:
@@ -25,8 +25,7 @@ def trigger_automatic_root_certificate_update(url: str, timeout: int = 30) -> No
                 "-Command",
                 f"Invoke-WebRequest -Uri '{escaped_url}'"
                 f" -UseBasicParsing -Method HEAD -MaximumRedirection 0"
-                f" -TimeoutSec {timeout}"# -ErrorAction SilentlyContinue"
-                #f" | Out-Null",
+                f" -TimeoutSec {timeout}",
             ],
             check=True,
             capture_output=True,