Does this open up our requests to someone spoofing AzDo with a revoked certificate? Any risk here to disabling this? @bartonjs was suggesting a more targeted disabling of just X509VerificationFlags.IgnoreEndRevocationUnknown | X509VerificationFlags.IgnoreCertificateAuthorityRevocationUnknown and VerificationTimeIgnored = true

It looks like we had the better fix here --

@mmitche added, mentioning it was for mac in 346db01

@copilot can you improve this to use the method in the linked code, preserving the other AllowAutoRedirect that is set by this handler.

@copilot respond to comments

It looks like we had the better fix here --

arcade/src/Microsoft.DotNet.Arcade.Sdk/src/DownloadFile.cs

Lines 131 to 156 in 7d717a4

	#if NET
	using SocketsHttpHandler handler = new SocketsHttpHandler();
	handler.SslOptions.CertificateChainPolicy = new X509ChainPolicy
	{
	// Yes, check revocation.
	// Yes, allow it to be downloaded if needed.
	// Online is the default, but it doesn't hurt to be explicit.
	RevocationMode = X509RevocationMode.Online,
	// Roots never bother with revocation.
	// ExcludeRoot is the default, but it doesn't hurt to be explicit.
	RevocationFlag = X509RevocationFlag.ExcludeRoot,
	// RevocationStatusUnknown at the EndEntity/Leaf certificate will not fail the chain build.
	// RevocationStatusUnknown for any intermediate CA will not fail the chain build.
	// IgnoreRootRevocationUnknown could also be specified, but it won't apply given ExcludeRoot above.
	// The default is that all status codes are bad, this is not the default.
	VerificationFlags =
	X509VerificationFlags.IgnoreCertificateAuthorityRevocationUnknown |
	X509VerificationFlags.IgnoreEndRevocationUnknown,
	// Always use the "now" when building the chain, rather than the "now" of when this policy object was constructed.
	VerificationTimeIgnored = true,
	};
	using (var httpClient = new HttpClient(handler))
	#else
	using (var httpClient = new HttpClient(new HttpClientHandler { CheckCertificateRevocationList = true }))
	#endif

@mmitche ad...

Improved to use the fail-open pattern from DownloadFile.cs with fine-grained X509VerificationFlags that only ignore unknown revocation status rather than disabling all checks. Preserved AllowAutoRedirect = false. (087f1c7)

Does this open up our requests to someone spoofing AzDo with a revoked certificate? Any risk here to disabling this? @bartonjs was suggesting a more targeted disabling of just `X509VerificationFlags...

Good point. I've updated to use the more secure fail-open approach with IgnoreEndRevocationUnknown | IgnoreCertificateAuthorityRevocationUnknown and VerificationTimeIgnored = true. This still validates revoked certificates but handles unknown status gracefully. (087f1c7)

I don't know why the PR includes a new copy of nuget.exe, but the cert-related code looks good.

@copilot Delete copy of nuget.exe

@copilot Delete copy of nuget.exe

Removed the accidentally added nuget.exe file. (832c1b9)

/ba-g android timeout in running helix work items (after submitting job - so it's past the portion changed by this PR)