Repository navigation
[release/9.0.3xx] Trusted roots: 2026-08 CTL - #56202
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: Successfully started running 1 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
8 tasks done
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The updated test baselines introduce a HARICA code-signing root fingerprint that appears inconsistent with the PR/issue-described CTL changes and the provided PEM diffs, and should be reconciled before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Lite
Findings: 2
New issues introduced by this change (2)
| Severity | Finding |
|---|---|
 |
test/trustedroots.Tests/GivenCodeSigningCtlFile.cs — This adds HARICA Code Signing RSA Root CA 2021 to the expected fingerprints, but the PR… |
|
test/trustedroots.Tests/GivenTimestampingCtlFile.cs — The newly added expected fingerprint is annotated as a code signing root (HARICA Code Signing RSA… |
What changed in this PR
Cherry-picks the August 2026 Microsoft Trusted Root Program CTL update onto release/9.0.3xx, updating the shipped trusted root bundles and refreshing the corresponding test baselines.
Changes:
- Update
timestampctl.pemwith additional timestamping trusted roots included in the August 2026 CTL refresh. - Update
codesignctl.pemwith additional code-signing trusted roots included in the August 2026 CTL refresh. - Update trustedroots test baselines to reflect the new/expected certificate fingerprints.
| File | Description |
|---|---|
| test/trustedroots.Tests/GivenTimestampingCtlFile.cs | Updates expected SHA-256 fingerprint list for the timestamp CTL bundle test. |
| test/trustedroots.Tests/GivenCodeSigningCtlFile.cs | Updates expected SHA-256 fingerprint list for the code-signing CTL bundle test. |
| src/Layout/redist/trustedroots/timestampctl.pem | Adds new certificates to the timestamp trusted roots bundle shipped in the SDK layout. |
| src/Layout/redist/trustedroots/codesignctl.pem | Adds new certificates to the code-signing trusted roots bundle shipped in the SDK layout. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
39
to
43
| [InlineData("bfff8fd04433487d6a8aa60c1a29767a9fc2bbb05e420f713a13b992891d3893")] // CN=GDCA TrustAUTH R5 ROOT, O="GUANG DONG CERTIFICATE AUTHORITY CO.,LTD.", C=CN | ||
| [InlineData("c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4")] // OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US | ||
| [InlineData("c40ebdcd75a90e4b7496abb23e789a48e33c03284f75d95130575ae6860ae13c")] // CN=HARICA Code Signing RSA Root CA 2021, O=Hellenic Academic and Research Institutions CA, C=GR | ||
| [InlineData("c766a9bef2d4071c863a31aa4920e813b2d198608cb7b7cfe21143b836df09ea")] // CN=StartCom Certification Authority, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL | ||
| [InlineData("cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b")] // CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3 |
Comment on lines
29
to
33
| [InlineData("85666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69")] // CN=SSL.com Root Certification Authority RSA, O=SSL Corporation, L=Houston, S=Texas, C=US | ||
| [InlineData("8a866fd1b276b57e578e921c65828a2bed58e9f2f288054134b7f1f4bfc9cc74")] // CN=QuoVadis Root CA 1 G3, O=QuoVadis Limited, C=BM | ||
| [InlineData("a45ede3bbbf09c8ae15c72efc07268d693a21c996fd51e67ca079460fd6d8873")] // CN=QuoVadis Root Certification Authority, OU=Root Certification Authority, O=QuoVadis Limited, C=BM | ||
| [InlineData("c40ebdcd75a90e4b7496abb23e789a48e33c03284f75d95130575ae6860ae13c")] // CN=HARICA Code Signing RSA Root CA 2021, O=Hellenic Academic and Research Institutions CA, C=GR | ||
| [InlineData("cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b")] // CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3 |
donnie-msft
approved these changes
Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick of e556370 from main (12.0.100) to release/9.0.3xx.
Progress on #56108.
This is the August 2026 update from the Microsoft Trusted Root Program team.
I also updated test baselines.
CC @aortiz-msft, @dotnet/nuget-team