Skip to content

Disallowed cloaked PFX binaries in external packages#4803

Merged
ellahathaway merged 2 commits intodotnet:mainfrom
ellahathaway:cloaked-binaries
Feb 17, 2026
Merged

Disallowed cloaked PFX binaries in external packages#4803
ellahathaway merged 2 commits intodotnet:mainfrom
ellahathaway:cloaked-binaries

Conversation

@ellahathaway
Copy link
Copy Markdown
Member

@ellahathaway ellahathaway commented Feb 11, 2026

Copilot AI review requested due to automatic review settings February 11, 2026 22:11
@ellahathaway ellahathaway requested review from a team as code owners February 11, 2026 22:11
Copilot AI reviewed Feb 11, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the source-build binary allowlist to stop permitting certain PFX (certificate) binaries that are present in external package sources, aligning with the goal of disallowing “cloaked” PFX binaries during source-build prep.

Changes:

  • Removed the allowlist entry for Humanizer test PFX files under src/source-build-reference-packages.
  • Removed the allowlist entry for Azure IdentityModel test certificate PFX files under src/source-build-reference-packages.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@NikolaMilosavljevic
Copy link
Copy Markdown
Member

NikolaMilosavljevic commented Feb 11, 2026 •
edited
Loading

Should these PFX binaries be cloaked again? Was this file the reason why cloaking didn't work after #4609

cc @premun

@ellahathaway
Copy link
Copy Markdown
Member Author

ellahathaway commented Feb 11, 2026

Merging this PR is contingent on the binaries being cloaked from the VMR. Otherwise, the VMR tests fail continue to fail with new detected binaries:

2026-02-11T23:15:23.8427932Z   Failed Microsoft.DotNet.Tests.BinaryScanTest.ScanForBinaries [8 ms]
2026-02-11T23:15:23.8430452Z   Error Message:
2026-02-11T23:15:23.8431411Z    The following binaries were detected:
2026-02-11T23:15:23.8432191Z src/source-build-reference-packages/src/externalPackages/src/humanizer/src/Humanizer.Tests.Uwp/Humanizer.Tests.Uwp_TemporaryKey.pfx
2026-02-11T23:15:23.8448559Z src/source-build-reference-packages/src/externalPackages/src/humanizer/src/Humanizer.Tests.Uwp.Runner/Humanizer.Tests.Uwp.Runner_TemporaryKey.pfx
2026-02-11T23:15:23.8449577Z src/source-build-reference-packages/src/externalPackages/src/azure-activedirectory-identitymodel-extensions-for-dotnet/test/Certs/SelfSigned1024_SHA1.pfx
2026-02-11T23:15:23.8450472Z src/source-build-reference-packages/src/externalPackages/src/azure-activedirectory-identitymodel-extensions-for-dotnet/test/Certs/SelfSigned1024_SHA256.pfx
2026-02-11T23:15:23.8451394Z src/source-build-reference-packages/src/externalPackages/src/azure-activedirectory-identitymodel-extensions-for-dotnet/test/Certs/SelfSigned2048_SHA384.pfx
2026-02-11T23:15:23.8452333Z src/source-build-reference-packages/src/externalPackages/src/azure-activedirectory-identitymodel-extensions-for-dotnet/test/Certs/SelfSigned2048_SHA256.pfx
2026-02-11T23:15:23.8453270Z src/source-build-reference-packages/src/externalPackages/src/azure-activedirectory-identitymodel-extensions-for-dotnet/test/Certs/SelfSigned2048_SHA256_2.pfx
2026-02-11T23:15:23.8454208Z src/source-build-reference-packages/src/externalPackages/src/azure-activedirectory-identitymodel-extensions-for-dotnet/test/Certs/SelfSigned2048_SHA512.pfx
2026-02-11T23:15:23.8454791Z 
2026-02-11T23:15:23.8455477Z See https://github.com/dotnet/dotnet/blob/main/docs/VMR-Permissible-Sources.md for information on how to resolve these failures.

@premun
Copy link
Copy Markdown
Member

premun commented Feb 12, 2026

  1. spectre is under src/externalPackages/src/spectre-console, your rule has src/externalPackages/spectre-console/docs/**/*
  2. Cloaking packages which are already in the VMR won't remove the packages, it will only stop syncing them into the VMR. So you need to remove any already synchronized ones manually from the VMR

@NikolaMilosavljevic
Copy link
Copy Markdown
Member

NikolaMilosavljevic commented Feb 12, 2026

  1. spectre is under src/externalPackages/src/spectre-console, your rule has src/externalPackages/spectre-console/docs/**/*
  2. Cloaking packages which are already in the VMR won't remove the packages, it will only stop syncing them into the VMR. So you need to remove any already synchronized ones manually from the VMR

The PFX files were removed with https://github.com/dotnet/dotnet/pull/4609/changes and the pattern seems correct for those: src/externalPackages/**/*.pfx

Do we know why they showed up again with 4c474d7#diff-88c628c55921c35a7fcaee849f15bbb6a7cad031f421b2aeb8e40d1fb4007aef

We'll fix the Spectre pattern.

@ellahathaway ellahathaway mentioned this pull request Feb 12, 2026
Closed
@ellahathaway ellahathaway added the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label Feb 12, 2026
@ellahathaway
Copy link
Copy Markdown
Member Author

ellahathaway commented Feb 12, 2026

Adding the no-merge label until we cloak the offending binaries.

@ellahathaway
Copy link
Copy Markdown
Member Author

ellahathaway commented Feb 17, 2026

Will merge once #4914 goes in

@NikolaMilosavljevic
Copy link
Copy Markdown
Member

NikolaMilosavljevic commented Feb 17, 2026

@ellahathaway I've merged the dependent PR - #4914

@ellahathaway ellahathaway removed the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label Feb 17, 2026
@ellahathaway ellahathaway enabled auto-merge (squash) February 17, 2026 21:14
@ellahathaway ellahathaway merged commit 1db02cb into dotnet:main Feb 17, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@NikolaMilosavljevic NikolaMilosavljevic NikolaMilosavljevic approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@ellahathaway @NikolaMilosavljevic @premun @ViktorHofer