Repository navigation
[ci-scan] Test failure: System.Security.Cryptography.X509Certificates.Tests.RevocationTests.AiaTests.AiaCompletionHasLimits #130947
Description
Build Information
Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1513558
Build error leg or test failing: Libraries Test Run release coreclr windows x64 Debug - System.Security.Cryptography.X509Certificates.Tests.RevocationTests.AiaTests.AiaCompletionHasLimits
Pull request: #130816
Error Details
Flaky assertion in the AIA revocation test: the expected AIA fetch count (4) does not match the observed count, and the failure persists through all RetryHelper attempts (observed actual values 5, 7, 8). The sibling flake AiaAcceptsCertTypesAndIgnoresNonCertTypes is already tracked by #107364, but with a different method name, assertion type, and OS, so Build Analysis does not match this failure against it.
System.AggregateException : One or more errors occurred. (Assert.Equal() Failure: Values differ
Expected: 4
Actual: 5) (Assert.Equal() Failure: Values differ
Expected: 4
Actual: 7) (Assert.Equal() Failure: Values differ
Expected: 4
Actual: 8)
---- Assert.Equal() Failure: Values differ
Expected: 4
Actual: 8
Stack Trace:
/_/src/libraries/Common/tests/TestUtilities/System/RetryHelper.cs(54,0): at System.RetryHelper.Execute(...)
/_/src/libraries/System.Security.Cryptography/tests/X509Certificates/RevocationTests/AiaTests.cs(241,0): at System.Security.Cryptography.X509Certificates.Tests.RevocationTests.AiaTests.AiaCompletionHasLimits()
Error Message
{
"ErrorMessage": "System.Security.Cryptography.X509Certificates.Tests.RevocationTests.AiaTests.AiaCompletionHasLimits [FAIL]",
"ErrorPattern": "",
"BuildRetry": false,
"ExcludeConsoleLog": false
}Note
This issue draft was prepared with GitHub Copilot assistance and reviewed by the submitting developer.
Known issue validation
Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1513558
Error message validated: [System.Security.Cryptography.X509Certificates.Tests.RevocationTests.AiaTests.AiaCompletionHasLimits [FAIL]]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 7/17/2026 2:37:41 AM UTC
Report
Summary
| 24-Hour Hit Count | 7-Day Hit Count | 1-Month Count |
|---|---|---|
| 4 | 52 | 53 |
Activity
dotnet-policy-service commentedon Jul 17, 2026
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.
github-actions commentedon Jul 17, 2026
Caution
agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.
Details
The threat detection results could not be parsed.
Review the workflow run logs for details.
Workflow artifact: ci-fix
Artifact kind: handoff
Linked KBE: #130947
Note
AI/Copilot-generated root-cause hand-off (
ci-failure-fix). No automated code change was produced: removing this failure requires either understanding platform AIA-download batching (product behavior) or relaxing an intentionally strict count assertion (a coverage/design judgement), neither of which is a small validated non-muting fix. Looping in owners to fix forward.Root cause (read-only analysis)
AiaTests.AiaCompletionHasLimitsasserts the exact number of chain elements produced as AIA fetching proceeds in fixed batches:The expected sequence is
4, 6, 8(the test asserts "we only download two certificates at a time"), but the failing run observed5, 7, 8— one extra certificate fetched at each intermediate stage. The whole assertion block is wrapped inRetryHelper.Execute, so the retries (actual values 5, 7, 8 across attempts) confirm the discrepancy is stable within the run rather than a transient hiccup.The test source itself flags this count as fragile black-box behavior:
So the exact per-stage fetch count depends on platform AIA-download batching that is not guaranteed to be exactly two-at-a-time on every OS/build configuration. On the failing
windows x64 Debugleg the chain builder resolved one additional certificate per stage.Why no in-bounds automated fix:
X509Chainlayer — outside small-fix bounds and not something to alter to satisfy a test.Evidence
Libraries Test Run release coreclr windows x64 Debug—System.Security.Cryptography.X509Certificates.Tests.RevocationTests.AiaTests.AiaCompletionHasLimits(per the KBEBuild error leg or test failing:line).src/libraries/System.Security.Cryptography/tests/X509Certificates/RevocationTests/AiaTests.cs(AiaCompletionHasLimits), which documents the count as fragile black-box behavior.AiaAcceptsCertTypesAndIgnoresNonCertTypesis tracked by Test assert failure in X509Certificates.Tests.RevocationTests.AiaTests.AiaAcceptsCertTypesAndIgnoresNonCertTypes #107364 (different method/assertion/OS), so this is a distinct signature.Suggested reviewers / area contacts
area-System.Security):@bartonjs,@vcsjones(@dotnet/area-system-security)A fix would likely either pin the AIA download batching so the asserted counts hold across the CI OS/build matrix, or (with owner sign-off) adjust the assertion to tolerate the documented platform variance without losing the intent of the limit check.
vcsjones commentedon Jul 17, 2026
This is likely a regression from #130456. Will take a look.
vcsjones commentedon Jul 17, 2026
Hm, actually not likely that PR affected this as that PR is Linux and this failure is Windows.
JulieLeeMSFT commentedon Jul 17, 2026
Failed in (2):
Console Log: Console Log
Source: runtime-coreclr libraries-jitstress / net11.0-windows-Release-x64-jitstress1_tiered-Windows.10.Amd64.Open / System.Security.Cryptography.X509Certificates.Tests.RevocationTests.AiaTests.AiaCompletionHasLimits
Failed tests:
bartonjs commentedon Jul 17, 2026
It seems like at least some of the machines in the test pool have an actual AIA limit of 3. So some have an off by one, some don't.
So, it's caused by #130456, in that that's the PR that created the test.
JulieLeeMSFT commentedon Jul 22, 2026
@bartonjs, it's failing every day in both innerloop and outerloop. What's your plan? Should we disable the test?
bartonjs commentedon Jul 22, 2026
I'll either fix it or disable it today.
[ci-scan-feedback] Route platform-specific crypto-config failures to …