Repository navigation
Conversation
…tic RemoteExecutor helper (#125907) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: danmoseley <6385855+danmoseley@users.noreply.github.com> Co-authored-by: adamsitnik <6011991+adamsitnik@users.noreply.github.com> (cherry picked from commit a4bfa0d)
|
Azure Pipelines: Successfully started running 4 pipeline(s). 11 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @karelz, @dotnet/ncl |
akoeplinger
approved these changes
Nov 11, 2026
Contributor
|
Tagging subscribers to this area: @dotnet/runtime-infrastructure |
steveisok
approved these changes
Nov 11, 2026
lewing
enabled auto-merge (squash)
November 11, 2026 20:27
…135273) <!-- --> Resumed initial TLS handshakes now skip certificate revalidation and user validation callbacks by default (#133174). HttpClient tests that require those callbacks, certificate-policy checks, or certificate rejection can therefore fail or bypass their assertions after another connection populates the session cache. This follows the SslStream test-isolation approach in #135083. Add an optional `allowTlsResume = true` option to the existing handler helpers and request full handshakes only in validation-dependent tests. Preserve parameterless helper behavior, version-specific certificate defaults, and unrelated tests. The option reaches `SocketsHttpHandler.SslOptions.AllowTlsResume`; WinHTTP and native mobile handlers retain their native behavior because they do not expose this setting. Custom-policy tests set the option in their replacement SSL options rather than losing it when replacing the bag. Add coverage for default/true/false helper forwarding and repeated callback execution across fresh connections. The repeated test follows the existing .NET Framework loopback certificate-ownership convention. No product code or public API changes. With resumption enabled, the repeated self-signed test reproduced a failure on the second fresh connection: expected callback count 2, actual 1. With resumption disabled, all three callbacks execute. Sampled CI stacks also show callback-not-called and missing-certificate-rejection assertions. Separate badssl handshake resets and connection timeouts are not established resumption failures and are not claimed fixed here. HTTP/3 callback coverage passes, but QUIC does not currently consume `AllowTlsResume`; this is not a claimed QUIC-resumption fix. Validation was on Windows x64 only, with Release CoreCLR and Debug libraries. Other platforms and enterprise tests were not run. All commands ran from a short `subst` path (`W:\`). - `.\build.cmd clr+libs -rc release`: passed, zero warnings/errors. Each project below was built and tested with `.\.dotnet\dotnet.exe build <project> /t:Test /p:RuntimeConfiguration=Release`: | Project | Result | |---|---| | `src\libraries\System.Net.Http\tests\FunctionalTests\System.Net.Http.Functional.Tests.csproj` | Passed: 5,435 passed, 48 skipped, zero failures | | `src\libraries\System.Net.Http\tests\UnitTests\System.Net.Http.Unit.Tests.csproj` | Passed: 2,677 passed, four skipped, zero failures | | `src\libraries\System.Net.Http.WinHttpHandler\tests\FunctionalTests\System.Net.Http.WinHttpHandler.Functional.Tests.csproj` | Passed: net11.0-windows 1,710 passed / 41 skipped; net481 640 passed / 28 skipped; zero failures | | `src\libraries\System.Net.Http.WinHttpHandler\tests\UnitTests\System.Net.Http.WinHttpHandler.Unit.Tests.csproj` | Passed: 173 passed, zero failures | External certificate and SSL-protocol coverage: ```powershell .\.dotnet\dotnet.exe build src\libraries\System.Net.Http\tests\FunctionalTests\System.Net.Http.Functional.Tests.csproj /t:Test /p:RuntimeConfiguration=Release /p:Outerloop=true "/p:XUnitOptions=-class System.Net.Http.Functional.Tests.SocketsHttpHandler_HttpClientHandler_ServerCertificates_Test -class System.Net.Http.Functional.Tests.SocketsHttpHandler_HttpClientHandler_SslProtocols_Test" ``` Passed: 53 passed, zero skipped/failures. Negative control, with `allowTlsResume` temporarily enabled in the repeated self-signed test: ```powershell .\.dotnet\dotnet.exe build src\libraries\System.Net.Http\tests\FunctionalTests\System.Net.Http.Functional.Tests.csproj /t:Test /p:RuntimeConfiguration=Release "/p:XUnitOptions=-method *UseCallback_SelfSignedCertificate_ExpectedPolicyErrors" ``` Expected failure: one passed, one failed due to the skipped second callback. Restored `allowTlsResume: false` before the final successful full-suite and outerloop runs. `git diff --check`: passed. > [!NOTE] > This PR description and code changes were generated with assistance from GitHub Copilot. --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> (cherry picked from commit a4802e5)
<!-- --> HTTP certificate validation tests currently depend on public badssl.com endpoints, making their results sensitive to external availability and certificate configuration. Replace the applicable cases with loopback servers and certificates generated by the existing test helpers. - Cover expired, self-signed, and wrong-host certificates with default validation, custom callbacks, and validation-disabled handlers. These cases now run in the inner loop. - Use scoped `X509ChainPolicy` custom trust to isolate SocketsHttpHandler validation errors, and the existing local PKI/revocation responder to exercise both revocation settings without installing trusted roots. - Dispose provisional TLS streams when loopback authentication fails, with a regression test for deterministic cleanup. The two external, no-callback WinHTTP revocation tests are intentionally retained. WinHttpHandler cannot use scoped custom trust, and callback-enabled replacements would test managed chain validation rather than native WinHTTP revocation enforcement. Windows x64, using the `X:` subst path: - `build.cmd clr+libs -rc release`: passed. - Focused System.Net.Http certificate classes: 27 passed, none skipped. - Focused WinHTTP HTTP/1.1 and HTTP/2 certificate classes on `net11.0-windows`: 44 passed, none skipped. - Shared WinHTTP certificate tests on `net481`: 11 passed, none skipped. - Fourteen certificate/cleanup scenarios passed three consecutive reruns. - The cleanup regression failed before the helper fix and passed afterward. Linux, macOS, mobile, and the retained external WinHTTP revocation cases were not run. No product code or public API changes. > [!NOTE] > This pull request description was generated by GitHub Copilot. --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Miha Zupan <mihazupan.zupan1@gmail.com> Copilot-Session: 63463cf1-4bfe-42e3-ad96-49f35e245dd1 (cherry picked from commit f521600)
(cherry picked from commit 39ab468)
…or.IsSupported (#136119) `EncryptedXml_DecryptDocument_MaxCount_Default` (added in #135741) calls `RemoteExecutor.Invoke` from a plain `[Fact]`, so it throws `PlatformNotSupportedException` where RemoteExecutor isn't supported, e.g. the `runtime-coreclr crossgen2` outerloop R2R library runs ([build 1639697](https://dev.azure.com/dnceng-public/cbb18261-c48f-4abb-8651-8cdcb5474649/_build/results?buildId=1639697)). This changes it to `[ConditionalFact(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]`, matching its sibling `_AppContext` tests. > [!NOTE] > This PR was generated with the assistance of GitHub Copilot. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> (cherry picked from commit 677ab53)
…test release/10.0's Configuration.Certificates.GenerateCertificates has no forceRsaCertificate parameter (added on main by #119265) and always generates RSA-2048 certificates, which is what forceRsaCertificate: true selects on main. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Partial backport of #127868: on 32-bit platforms DetermineTolerance cast doubleTolerance instead of floatTolerance for NFloat, so callers that only pass floatTolerance hit 'Nullable object must have a value'. The rest of #127868 (the stricter AssertEqualWithTolerance helper) is not backported because it exposes Hypot special-value differences on release/10.0 x64/x86 that do not reproduce on main. (cherry picked from part of commit 7aa830a) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
lewing
force-pushed
the
lewing-release10-test-only-backports
branch
from
November 11, 2026 22:41
ccf4309 to
c685e5e
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes Issue N/A (recurring test failures in release/10.0 non-PR CI)
main PR #125907, #127868, #135273, #135618, #135975, #136119
Description
Backports six test-only fixes from
main, cherry-picked with-xin this order:Helpers.DetermineToleranceNFloat 32-bit fix (see below)EncryptedXml_DecryptDocument_MaxCount_DefaultwithRemoteExecutor.IsSupportedNone of these were already on release/10.0. All changes are under
tests/,Common/testsorTestUtilities. There are no product changes.These failures show up in release/10.0 non-PR CI over the last 21 days (Kusto
engsrvprod/engineeringdataAzureDevOpsTests) but not onmain:ProcessTests.MainWindowTitle_GetWithGui_ShouldRefresh_WindowsandMainWindowHandle_GetWithGui_ShouldRefresh_Windowsfail onWindows.11.Amd64.Client.Openwith an empty title or handle (26 builds). Fix flaky MainWindow tests by replacing notepad.exe with a deterministic RemoteExecutor helper #125907 fixes this.NFloatGenericTensorPrimitives.*fail on x86 and arm32 withNullable object must have a value. On release/10.0, theIntPtr.Size == 4branch ofHelpers.DetermineTolerancecastsdoubleToleranceinstead offloatTolerance(32 builds). Fix tensor EqualWithTolerance test helper #127868 fixes this.Connection reset by peeragainst external*.badssl.comhosts (up to 49 builds). Replace badssl HTTP certificate tests with loopback servers #135618 and Fix Android HTTP certificate validation tests #135975 fix this, and Isolate HttpClient certificate validation tests from TLS resumption #135273 is their prerequisite.EncryptedXml_DecryptDocument_MaxCount_Defaultfails on Android because RemoteExecutor isn't supported there. Guard EncryptedXml_DecryptDocument_MaxCount_Default with RemoteExecutor.IsSupported #136119 fixes this.Conflict resolutions, all keeping the main-side test intent:
usingblock inProcessTests.Windows.cs.DetermineTolerancefix is backported, so the 32-bit NFloat branch now usesfloatTolerance. The full backport, with the stricterAssertEqualWithTolerancehelper, madeSingle/DoubleGenericTensorPrimitives.SpanSpanDestination_SpecialValuesfail deterministically forHypoton every x64/x86 configuration:TensorPrimitives.Hypot(±MaxValue, y)returned+∞where scalarT.HypotreturnsMaxValue. Main has never failed this test, and the test,VectorMath.HypotDoubleand the TensorPrimitives code are the same on both branches, so this looks like a release/10.0 vector-path difference to follow up separately.ClientWebSocketOptionsTests.cs, took main's(secure, connectionCount)theory data and callback counting. Kept release'sConditionalTheory(nameof(...))form and itsIsWindows7early return.MemberDatatheories in favor of the new loopback theories, inAcceptAllCerts.csandServerCertificates.cs.forceRsaCertificate: trueargument (added on main by Use forTls parameter to enable TLS-compatible certificate key types while maintaining platform compatibility #119265) fromNoCallback_RevokedCertificate_RevocationChecking_MatchesExpected. On release/10.0,GenerateCertificatesalways creates RSA-2048 certificates, so the test's behavior is the same.Customer Impact
None, since this is test-only. It removes recurring false failures from release/10.0 CI, including the dependency on external badssl.com hosts.
Regression
No.
Testing
Nothing was built or run locally. There was no baseline build because of local disk constraints, and these library test projects need a live-built shared framework. CI on this PR is the validation.
Static checks that were run:
git diff --check: clean, and no conflict markers remain.ProcessTestBase.CreateProcess(Func<int>)TestHelper.CreateServerSelfSignedCertificate(name, expired)LoopbackServer.Connection.CreateAsync(SocketWrapper, Stream, Options)LoopbackServer.Options.AllowTlsResumeandSslClientAuthenticationOptions.AllowTlsResumePlatformDetectionmembers usedTestHelpercompiled into the WebSockets client tests, andDelegateStreamcompiled into the HTTP and WinHttpHandler functional testsRisk
Low. Only test code changes, and it's the same code already running on
main.Package authoring no longer needed in .NET 9
IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.
Note
This PR description and the conflict resolutions were AI-generated with GitHub Copilot.