Fix test sensitivity to PKCS7 certificate ordering

[vcsjones]

Android exports PKCS7 certificates in a different order, and the xunit assertion is sensitive to order. So we sort them first.

Fixes #59777.

After this PR and #59812 is merged, the X509Certificates test suite back to fully passing on Android.

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Android exports PKCS7 certificates in a different order, and the xunit assertion is sensitive to order. So we sort them first.

Fixes #59777.

After this PR and #59812 is merged, the X509Certificates test suite back to fully passing on Android.

Author:	vcsjones
Assignees:	-
Labels:	area-System.Security
Milestone:	-

[ghost]

Tagging subscribers to 'arch-android': @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Android exports PKCS7 certificates in a different order, and the xunit assertion is sensitive to order. So we sort them first.

Fixes #59777.

After this PR and #59812 is merged, the X509Certificates test suite back to fully passing on Android.

Author:	vcsjones
Assignees:	-
Labels:	os-android
Milestone:	-

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Android exports PKCS7 certificates in a different order, and the xunit assertion is sensitive to order. So we sort them first.

Fixes #59777.

After this PR and #59812 is merged, the X509Certificates test suite back to fully passing on Android.

Author:	vcsjones
Assignees:	-
Labels:	area-System.Security, os-android, community-contribution
Milestone:	-

[vcsjones]

and removed area-System.Security community-contribution labels 5 minutes ago

Quietly files an internal bug ticket.

[bartonjs]

Android exports PKCS7 certificates in a different order

My initial thought was "is it just reversed? can we just feed them in in a different order on Android?", but a few more seconds thought makes me guess that our other platforms end up sorting the certs by size as part of a DER SET OF ordering, and that Android is probably just taking them in the order presented.

If it's the DER sort thing, then only like 20 people on the planet can reason about it, so it's not worth "normalizing" the Android behavior.

[vcsjones]

If it's the DER sort thing, then only like 20 people on the planet can reason about it, so it's not worth "normalizing" the Android behavior.

CMS/PKCS#7 as a specification talks a lot about BER, and only requires DER where canonical encoding is required, liked SignedAttributes. I don't think the SET OF CertificateChoices needs to be DER sorted. We already know that macOS uses indefinite length encoding where possible.