FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Fix BuildChainCustomTrustStore test by vcsjones · Pull Request #117734 · dotnet/runtime · GitHub

  1. dotnet
  2. runtime

Repository navigation

Fix BuildChainCustomTrustStore test - #117734

Merged
vcsjones merged 5 commits into
dotnet:mainfrom
vcsjones:fix-failing-test
Jul 17, 2025
ConversationCommits (5)ChecksFiles changed
Merged

Fix BuildChainCustomTrustStore test#117734
vcsjones merged 5 commits into
dotnet:mainfrom
vcsjones:fix-failing-test

Conversation

vcsjones commented Jul 16, 2025

Copy link
Copy Markdown
Member

The test BuildChainCustomTrustStore started failing in Alpine 3.22.

This is failing because the root certificate of the chain, "C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root" expired May 12 23:59:00 2025. Since the root certificate is expired, it was completely removed from the trust store in an update to Alpine.

This unit test was relying on the certificate being in the system trust store, which is no longer true.

This pull request changes the "use the system trust store" case to permit an untrusted root. This is consistent with what we are doing in other tests that use this chain:

runtime/src/libraries/System.Security.Cryptography/tests/X509Certificates/ChainTests.cs

Lines 46 to 49 in a436284

chain.ChainPolicy.ExtraStore.Add(unrelated);
chain.ChainPolicy.ExtraStore.Add(microsoftDotComRoot);
chain.ChainPolicy.ExtraStore.Add(microsoftDotComIssuer);
chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllowUnknownCertificateAuthority;

Contributes to #117723

Copilot AI review requested due to automatic review settings July 16, 2025 21:12
vcsjones added the test-bug Problem in test source code (most likely) label Jul 16, 2025
github-actions Bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Jul 16, 2025
Copilot AI reviewed Jul 16, 2025
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Pull Request Overview

This PR fixes the BuildChainCustomTrustStore test that started failing in Alpine 3.22 due to the expiration of the Baltimore CyberTrust Root certificate on May 12, 2025. The certificate was subsequently removed from the system trust store, causing the test to fail when it expected the certificate to be available.

  • Modifies the system trust store test case to allow untrusted root certificates
  • Adds appropriate verification flags and chain status handling for expired certificates
  • Aligns the test behavior with other similar tests in the codebase

Comment thread src/libraries/System.Security.Cryptography/tests/X509Certificates/ChainTests.cs
vcsjones added area-System.Security and removed needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Jul 16, 2025
vcsjones requested a review from bartonjs July 16, 2025 21:13

dotnet-policy-service Bot commented Jul 16, 2025

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

vcsjones enabled auto-merge (squash) July 16, 2025 21:54
build-analysis Bot mentioned this pull request Jul 17, 2025
Open
3 tasks
vcsjones merged commit 3f0d8d9 into dotnet:main Jul 17, 2025
build-analysis Bot mentioned this pull request Jul 17, 2025
Closed
vcsjones deleted the fix-failing-test branch July 17, 2025 05:21

vcsjones commented Jul 17, 2025

Copy link
Copy Markdown
Member Author

Passed on Alpine 3.22.

We should back port this.

vcsjones commented Jul 17, 2025

Copy link
Copy Markdown
Member Author

/backport to release/9.0-staging

vcsjones commented Jul 17, 2025

Copy link
Copy Markdown
Member Author

/backport to release/8.0-staging

github-actions Bot commented Jul 17, 2025

Copy link
Copy Markdown
Contributor

Started backporting to release/8.0-staging: https://github.com/dotnet/runtime/actions/runs/16347511153

github-actions Bot commented Jul 17, 2025

Copy link
Copy Markdown
Contributor

Started backporting to release/9.0-staging: https://github.com/dotnet/runtime/actions/runs/16347508992

This was referenced Jul 17, 2025
Merged
Merged
vcsjones added this to the 10.0.0 milestone Jul 24, 2025
krwq mentioned this pull request Aug 7, 2025
Closed
github-actions Bot locked and limited conversation to collaborators Aug 23, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
bartonjs bartonjs approved these changes

Assignees

vcsjones

Labels

area-System.Security test-bug Problem in test source code (most likely)

Projects

None yet

Milestone

10.0.0

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL