Repository navigation
[release/8.0] CertificateContentType fails for PKCS#7 with compatibility switch enabled on Unix #136062
Description
Build information
- Public PR: Merging internal commits for release/8.0 #135733
- Build: 1638347
- Build Analysis check
- Branch:
release/8.0
Failing test
System.Security.Cryptography.Xml.Tests.KeyInfoX509DataTest.CertificateContentType(contentType: Pkcs7, switchValue: "true")
Failing configurations
Configuration names and individual result links from Build Analysis:
- Alpine.323.Arm32.Open
- Alpine.323.Amd64.Open
- AzureLinux.3.ArmArch.Open
- Ubuntu.2204.Amd64.Open
- net8.0-osx-Debug-x64-Mono_release-OSX.15.Amd64.Open
- Debian.12.Amd64.Open
- Alpine.323.Amd64.Open
- net8.0-linux-Release-x64-CoreCLR_checked-AzureLinux.3.Amd64.Open
- net8.0-linux-Debug-x64-CoreCLR_release-Ubuntu.2204.Amd64.Open
- AzureLinux.3.Amd64.Open
- Centos.10.Amd64.Open
- Alpine.323.Arm64.Open
- net8.0-osx-Debug-x64-CoreCLR_checked-OSX.15.Amd64.Open
- net8.0-osx-Debug-x64-CoreCLR_release-OSX.15.Amd64.Open
- Ubuntu.2204.Arm64.Open
Exception
Excerpt from the linked Linux failure:
Microsoft.DotNet.RemoteExecutor.RemoteExecutionException : Remote process failed with an unhandled exception.
Child exception:
System.Security.Cryptography.CryptographicException: Cannot find the original signer.
at System.Security.Cryptography.X509Certificates.OpenSslPkcsFormatReader.TryReadPkcs7(...) in /_/src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/OpenSslPkcsFormatReader.cs:line 221
at System.Security.Cryptography.Xml.KeyInfoX509Data.LoadXml(XmlElement element) in /_/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/KeyInfoX509Data.cs:line 265
at System.Security.Cryptography.Xml.Tests.KeyInfoX509DataTest.AssertCertificateContentType(X509ContentType contentType, Boolean allowNonCertificate) in /_/src/libraries/System.Security.Cryptography.Xml/tests/KeyInfoX509DataTest.cs:line 215
Child arguments:
Pkcs7, true
Observed behavior
The Pkcs7 case with switchValue: "true" fails in the 15 listed Unix configurations. The representative Linux failure reaches KeyInfoX509Data.LoadXml, where certificate import throws CryptographicException: Cannot find the original signer.
Activity
dotnet-policy-service commentedon Oct 19, 2026
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.
[release/8.0] Fix PKCS#7 and deep XML tests (#136200)