Signing: on Linux, verify untrusted certificates give unknown revocation doesn't affect the correctness of our code.

[heng-liu]

On linux, untrusted certificates also give unknown revocation. We need to make sure this is by design and it doesn't affect the correctness of our code.

This is one of the breakdown tasks from NuGet/NuGet.Client#2706

[zkat]

I don't really understand what this task is referring to or where to look. Any pointers, @dtivel @heng-liu?

[heng-liu]

Asked for Damon's suggestion before, as follows:

You need to verify that the extra error (unknown revocation) does not affect our verification result on Linux as compared with Windows.

It may be that enabling all our package signing tests on Linux may give you the verification you need. I'm not confident of this without knowing how good our coverage is of untrusted certificates.

[zkat]

Sounds like we need to wait until the rest of the stuff is enabled to see what to do about this one. I'll drop it for now, then. Thanks, Heng!

[heng-liu]

You may see the different behaviors from CertificateChainUtilityTests.GetCertificateChain_WithUntrustedRoot_Throws

[kartheekp-ms]

When untrusted certificates are used, observed that on netcoreapp5.0 the behavior is consistent between Windows and Linux. Chain build logic on an untrusted root in netcoreapp5.0 and net472 will raise untrustedroot, revocationstatusunknow, offlinerevocation warnings where as on Linux in netcore2.1 and netcore3.1 untrustedroot, offlinerevocation warnings are raised.

[kartheekp-ms]

Unit tests in CertificateChainUtilityTests.cs are referred while working on this issue.