fix(cpp): scope the GenAI Android AAR cache by version and never cache a failed download

[sheetalarkadam]

Problem

Two independent caching defects in the Android GenAI AAR path. Both produce a build that silently disagrees with the pinned version, and both are invisible in CI.

1. Stale reuse across version bumps

The archive was stored as onnxruntime-genai-android.aar and extracted to a single genai-android-aar/ directory — neither includes the version. Both steps are guarded by EXISTS:

set(_GENAI_AAR_FILE "${_GENAI_AAR_DIR}/onnxruntime-genai-android.aar")
if(NOT EXISTS "${_GENAI_AAR_FILE}")   # bump -> still exists -> skipped
if(NOT EXISTS "${_GENAI_AAR_DIR}/jni") # bump -> still exists -> skipped

So bumping ORT_GENAI_VERSION reuses whichever AAR was downloaded first, while logging the new version. A warm build directory produces binaries from the old release.

This is not hypothetical. v0.14.1 has no Android AAR attached to its GitHub release, so a machine that had previously fetched 0.14.0 kept building against 0.14.0 while reporting 0.14.1 — and the missing release went unnoticed.

CI never sees this: every run starts from a fresh binary directory. Developers hit it on every bump.

2. Poisoned cache entry on a failed download

file(DOWNLOAD) writes its destination even when the transfer fails. Verified against a real unpublished release:

STATUS = 22;"HTTP response code said error"
file exists, size = 0 bytes

The FATAL_ERROR left that 0-byte file in place, so the next configure saw EXISTS, skipped the download, and failed inside ARCHIVE_EXTRACT instead — permanently, until someone deleted it by hand. The second failure gives no hint that the real cause was a missing release.

Fix

• Scope both the archive and the extracted tree by version, so a bump fetches its own copy and cannot collide.
• Download to a temporary path and file(RENAME) only on success, so a failed fetch leaves no cache entry and the next attempt genuinely retries.
• Name the version and URL in the error, and point at the likely cause — a missing Android AAR on an otherwise healthy release is the common failure.

Also stages libmat.so, which GenAI 0.15.0+ splits out of libonnxruntime-genai.so and records as a DT_NEEDED. It is Android-only; the desktop package is still monolithic, so the copy is guarded on existence and 0.14.x is unaffected.

Verification

• HTTP 404 leaves no cache entry, and a retry re-attempts rather than reusing garbage.
• 0.15.0 downloads (21,556,055 bytes), hits cache on re-run, and lands in a directory separate from 0.14.0 (38.19 MB vs 20.56 MB side by side — under the old scheme the second fetch was skipped entirely).
• Clean Android arm64 build against the GitHub AAR: all four .so staged and the DT_NEEDED closure resolves (libonnxruntime-genai.so -> libmat.so).

Built with -DORT_GENAI_VERSION=0.15.0, since the currently pinned 0.15.1 has no GitHub release yet. That gap is being addressed separately by the GenAI team; this PR is about the caching behavior, which is wrong regardless of which versions are published.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
foundry-local	Ready	Preview	Aug 7, 2026 8:52pm