Handle partial Linux certificate trust in CI - #17447
Merged
David Fowler (davidfowl) merged 2 commits intoMay 24, 2026
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
David Fowler (davidfowl)
requested review from
James Newton-King (JamesNK) and
Mitch Denny (mitchdenny)
as code owners
May 24, 2026 15:54
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17447Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17447" |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Aspire CLI certificate trust flow to treat partial trust on Linux CI (non-interactive) as a successful outcome (with a warning), while preserving failure semantics for interactive Linux and true trust failures. This aligns exit codes with the practical usability of partial OpenSSL trust for CLI/AppHost HTTPS diagnostics.
Changes:
- Adjusted
CertificateServiceto accept and return success forPartiallyFailedToTrustTheCertificateonly when non-interactive on Linux and a post-check confirmsTrustLevel.Partial. - Updated
certs trustcommand output to warn (instead of reporting full success) when continuing after partial trust. - Added/updated CLI unit tests and localized resources for the new warning message.
Show a summary per file
| File | Description |
|---|---|
| tests/Aspire.Cli.Tests/Commands/CertificatesCommandTests.cs | Adds an integration-style command test asserting partial-trust on non-interactive Linux returns exit code 0 and emits a warning. |
| tests/Aspire.Cli.Tests/Certificates/CertificateServiceTests.cs | Expands unit coverage for interactive vs non-interactive Linux partial-trust behavior and adjusts Linux simulation in tests. |
| src/Aspire.Cli/Certificates/CertificateService.cs | Implements “partial trust accepted” success path gated on non-interactive Linux + post-check confirmation. |
| src/Aspire.Cli/Commands/CertificatesTrustCommand.cs | Emits a warning message (not success) when the trust operation succeeded via partial trust acceptance. |
| src/Aspire.Cli/Resources/CertificatesCommandStrings.resx | Adds the new TrustPartialSuccess resource string. |
| src/Aspire.Cli/Resources/CertificatesCommandStrings.Designer.cs | Updates generated resource accessor for TrustPartialSuccess. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.cs.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.de.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.es.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.fr.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.it.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.ja.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.ko.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.pl.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.pt-BR.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.ru.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.tr.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.zh-Hans.xlf | Adds TrustPartialSuccess localization entry. |
| src/Aspire.Cli/Resources/xlf/CertificatesCommandStrings.zh-Hant.xlf | Adds TrustPartialSuccess localization entry. |
Copilot's findings
Files not reviewed (1)
- src/Aspire.Cli/Resources/CertificatesCommandStrings.Designer.cs: Language not supported
Comments suppressed due to low confidence (1)
tests/Aspire.Cli.Tests/Certificates/CertificateServiceTests.cs:127
- Same issue as above: the test asserts a hard-coded ".aspnet/dev-certs/trust" substring which is path-separator dependent. With
isLinux: () => truethe code still uses OS path separators for the dev-certs trust path, so this assertion can fail on Windows/macOS. UsePath.Combine(...)/separator normalization for the expected path portion, or skip the test outside Linux.
Assert.True(result.EnvironmentVariables.ContainsKey("SSL_CERT_DIR"));
Assert.Contains(".aspnet/dev-certs/trust", result.EnvironmentVariables["SSL_CERT_DIR"]);
}
- Files reviewed: 18/19 changed files
- Comments generated: 1
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Author
|
Regarding review 4353075525: thanks for the overview. No code change was needed for this informational review summary; the actionable separator feedback was addressed in the follow-up commit. |
Collaborator
|
This same issue happens with |
David Negstad (danegsta)
approved these changes
May 24, 2026
Contributor
|
❓ CLI E2E Tests unknown — 96 passed, 0 failed, 5 unknown (commit View all recordings
📹 Recordings uploaded automatically from CI run #26366088312 |
Contributor
|
✅ No documentation update needed. A documentation update was drafted for |
Contributor
Author
|
David Pine (@IEvangelist) the doc bot is not working again |
1 task
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
On non-interactive Linux CI runners,
aspire certs trust --non-interactivecan successfully install the development certificate for OpenSSL while still reportingPartiallyFailedToTrustTheCertificatebecause browser/NSS trust could not be completed. That partial state is useful for CLI diagnostics and AppHost HTTPS checks, but the command previously returned a hard failure.This change treats partial trust as success only for non-interactive Linux runs, and only after the post-trust check confirms the certificate is actually partially trusted. Interactive Linux runs and real trust failures still fail. The command now prints a warning explaining that CLI HTTPS diagnostics can continue while browser trust may remain incomplete.
User-facing usage
Partial Linux trust now exits successfully with guidance:
aspire doctorstill reports the partial trust state and guidance to setSSL_CERT_DIR; it does not hide that browser/user trust may be incomplete.Security considerations
This change affects certificate trust command success semantics. It does not skip the trust operation or convert full trust failures into success. The success path is limited to non-interactive Linux and requires the post-trust certificate check to report
TrustLevel.Partial, preserving failure behavior for untrusted certificates and interactive runs.Validation:
dotnet test --project tests/Aspire.Cli.Tests/Aspire.Cli.Tests.csproj --no-launch-profile -- --filter-class "*.CertificateServiceTests" --filter-class "*.CertificatesCommandTests" --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"aspire certs trust --non-interactivereturnedEXIT:0with the new partial-trust warning.Fixes # (issue)
Checklist
<remarks />and<code />elements on your triple slash comments?