Pull request overview

This pull request adds support for generating PKCS#12 format certificate trust store bundles to enable Java-based services (e.g., Kafka, Elasticsearch) to consume trusted CA certificates via javax.net.ssl.trustStore. The implementation follows the existing tracked-reference pattern used for HTTPS termination certificates, ensuring the PKCS#12 trust store is only generated when a resource's configuration callback actually references the bundle path.

Changes:

• Added PKCS#12 bundle path and password properties to certificate trust configuration contexts, enabling Java services to reference trust stores in their preferred format
• Implemented lazy generation of PKCS#12 trust stores using the tracked reference pattern, ensuring bundles are only created when actually needed
• Extended both executable and container resource flows in DcpExecutor to conditionally generate and deploy truststore.p12 files when referenced
• Added comprehensive tests covering tracked reference behavior, PKCS#12 generation, and password handling

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

    /// <summary>
    /// A value provider that will resolve to a path to a PKCS#12 trust store bundle.
    /// Referencing this path in a callback will trigger generation of the PKCS#12 trust store.
    /// </summary>
    public required ReferenceExpression Pkcs12BundlePath { get; init; }

    /// <summary>
    /// The password for the PKCS#12 trust store bundle. Defaults to an empty string.
    /// </summary>
    public required string Pkcs12BundlePassword { get; init; }

    /// <summary>
    /// The path to the PKCS#12 trust store bundle file in the resource context (e.g., container filesystem).
    /// Only generated if a resource's certificate trust configuration callback references this path.
    /// </summary>
    public required ReferenceExpression Pkcs12BundlePath { get; init; }

    /// <summary>
    /// The password for the PKCS#12 trust store bundle. Defaults to an empty string.
    /// </summary>
    public string Pkcs12BundlePassword { get; init; } = string.Empty;

/// <summary>
/// Creates a PKCS#12 trust store from the specified certificates (public keys only).
/// </summary>

    /// <summary>
    /// Creates a PKCS#12 trust store containing the specified certificates (public keys only, no private keys).
    /// The resulting trust store is compatible with Java's keytool and can be used as a javax.net.ssl.trustStore.
    /// </summary>
    internal static byte[] CreatePkcs12TrustStore(X509Certificate2Collection certificates, string password)

Thanks for adding the extensible CreateCustomBundle API — the design of keeping PKCS#12 details out of the hosting infrastructure and letting consumers bring their own format is clean.

I found a few issues to address:

Bugs

1. Executable path mismatch: In DcpExecutor for executables, custom bundle files are written to certificatesRootDir/{bundleId}, but the reference expression points to {RootCertificatesPath}/bundles/{bundleId}. The bundles/ subdirectory is missing from the write path and the directory isn't created. This means the env var will reference a non-existent path. (The container path is correct.)

2. IsContainer is never set: The CertificateTrustConfigurationCallbackAnnotationContext.IsContainer property is never initialized in the gatherer, so it's always null. The IsContainer == true condition in CreateCustomBundle is thus always false. Additionally, the branches appear inverted — for containers you should use forward slashes (not Path.Join which gives backslashes on Windows).

Cleanup

3. Dead TrackedReference class: Added to CertificateTrustExecutionConfigurationData but never instantiated anywhere. Appears to be leftover from a prior approach.

4. Unnecessary System.Security.Cryptography.Pkcs dependency on Aspire.Hosting: No file under src/Aspire.Hosting/ imports this namespace. The PKCS#12 logic is entirely in the consumer's callback. This package reference should be on the test project if needed, not on the hosting package.

5. RootCertificatesPath is nullable but used without null guard: Consider making it required string or adding a null check.

Nits

6. Minor style: List<ContainerFileSystemEntry>? with new() — either remove the ? or defer allocation. Use .Count > 0 instead of .Any().
7. XML doc on CreateCustomBundle says "return the bundle name and contents" but only byte[] (contents) is returned. Needs <remarks> and <example> per repo doc standards.