Skip to content

Permit fail-open to avoid CRL check failures on Mac #15546

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
mmitche merged 2 commits into from
Feb 20, 2025
Merged

Permit fail-open to avoid CRL check failures on Mac #15546

mmitche merged 2 commits into from
Feb 20, 2025

Conversation

@mmitche
Copy link
Member

@mmitche mmitche commented Feb 18, 2025

To double check:

bartonjs
bartonjs previously approved these changes Feb 18, 2025
View reviewed changes
@mmitche mmitche enabled auto-merge (squash) February 19, 2025 22:33
@mmitche mmitche merged commit 346db01 into main Feb 20, 2025
11 checks passed
@mmitche mmitche deleted the mmitche-patch-11 branch February 20, 2025 00:55
YuliiaKovalova pushed a commit that referenced this pull request Mar 20, 2025
@mmitche @YuliiaKovalova
Permit fail-open to avoid CRL check failures on Mac (#15546)
513d7a4
jonathanpeppers added a commit to dotnet/android that referenced this pull request Mar 25, 2025
@jonathanpeppers
[xaprepare] log exceptions, and handle CRL check failures
db04004 
Context: dotnet/arcade#15546

Right now failures just print:

    Downloading dotnet-install script...
    -> https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh
    Error: Download of dotnet-install from 'https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh' failed

Let's log the exception message, as it retries.

After this change, we get the intermittent error on macOS only:

    Warning: Download of 'https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh' failed: System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
    ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: RevocationStatusUnknown

In dotnet/arcade#15546, they addressed this problem by using
`SocketsHttpHandler` and configuring the `CertificateChainPolicy` to
ignore the `RevocationStatusUnknown` error.

Let's use the same approach here.
@jonathanpeppers jonathanpeppers mentioned this pull request Mar 25, 2025
Merged
jonathanpeppers added a commit to dotnet/android that referenced this pull request Mar 25, 2025
@jonathanpeppers
[xaprepare] log exceptions, and handle CRL check failures
c96acd2 
Context: dotnet/arcade#15546

Right now failures just print:

    Downloading dotnet-install script...
    -> https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh
    Error: Download of dotnet-install from 'https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh' failed

Let's log the exception message, as it retries.

After this change, we get the intermittent error on macOS only:

    Warning: Download of 'https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh' failed: System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
    ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: RevocationStatusUnknown

In dotnet/arcade#15546, they addressed this problem by using
`SocketsHttpHandler` and configuring the `CertificateChainPolicy` to
ignore the `RevocationStatusUnknown` error.

Let's use the same approach here.
dellis1972 pushed a commit to dotnet/android that referenced this pull request Mar 25, 2025
@jonathanpeppers
[xaprepare] log exceptions, and handle CRL check failures (#9965)
fe655a4 
Context: dotnet/arcade#15546

Right now failures just print:

    Downloading dotnet-install script...
    -> https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh
    Error: Download of dotnet-install from 'https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh' failed

Let's log the exception message, as it retries.

After this change, we get the intermittent error on macOS only:

    Warning: Download of 'https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh' failed: System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
    ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: RevocationStatusUnknown

In dotnet/arcade#15546, they addressed this problem by using
`SocketsHttpHandler` and configuring the `CertificateChainPolicy` to
ignore the `RevocationStatusUnknown` error.

Let's use the same approach here.
jonathanpeppers added a commit to dotnet/android that referenced this pull request Mar 26, 2025
@jonathanpeppers
[xaprepare] log exceptions, and handle CRL check failures (#9965)
fed5ae0 
Context: dotnet/arcade#15546

Right now failures just print:

    Downloading dotnet-install script...
    -> https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh
    Error: Download of dotnet-install from 'https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh' failed

Let's log the exception message, as it retries.

After this change, we get the intermittent error on macOS only:

    Warning: Download of 'https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh' failed: System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
    ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: RevocationStatusUnknown

In dotnet/arcade#15546, they addressed this problem by using
`SocketsHttpHandler` and configuring the `CertificateChainPolicy` to
ignore the `RevocationStatusUnknown` error.

Let's use the same approach here.
@mmitche
Copy link
Member Author

mmitche commented Apr 8, 2025

/backport to release/9.0

@github-actions
Copy link
Contributor

github-actions bot commented Apr 8, 2025

Started backporting to release/9.0: https://github.com/dotnet/arcade/actions/runs/14342828755

@github-actions github-actions bot mentioned this pull request Apr 8, 2025
Merged
@wtgodbe
Copy link
Member

wtgodbe commented Apr 8, 2025

/backport to release/8.0

@github-actions
Copy link
Contributor

github-actions bot commented Apr 8, 2025

Started backporting to release/8.0: https://github.com/dotnet/arcade/actions/runs/14342855378

@github-actions github-actions bot mentioned this pull request Apr 8, 2025
Merged
@rzikm rzikm mentioned this pull request Jul 18, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wtgodbe wtgodbe wtgodbe approved these changes

@bartonjs bartonjs bartonjs left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@mmitche @wtgodbe @bartonjs