Skip to content

Enable IL trimming and NativeAOT on AzureKeyVaultProvider #3401

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 16, 2025

Conversation

edwardneal
Copy link
Contributor

Description

We can safely enable IL trimming and NativeAOT support on the AzureKeyVaultProvider project for the .NET targets. This PR simply sets the IsTrimmable and IsAotCompatible properties.

This doesn't enable these features on SqlClient itself, and the addon isn't particularly useful on its own - but when the library itself is compatible, the addon isn't going to hold it back.

Issues

Relates to #1947.

Testing

The IL trimming and NativeAOT support is mostly flagged by compile-time warnings. A sample application which directly references the DLL runs successfully - I can successfully publish and run the code below.

const string AkvPath = "...";
var keyVaultProvider = new SqlColumnEncryptionAzureKeyVaultProvider(new DefaultAzureCredential(true));
var signedCMKM = keyVaultProvider.SignColumnMasterKeyMetadata(AkvPath, false);
var verifiedMetadata = keyVaultProvider.VerifyColumnMasterKeyMetadata(AkvPath, false, signedCMKM);

if (!verifiedMetadata)
    throw new Exception("Signed CMK metadata does not match.");

var cek = new byte[32];
var encryptedCek = keyVaultProvider.EncryptColumnEncryptionKey(AkvPath, "RSA-OAEP", cek);
var decryptedCek = keyVaultProvider.DecryptColumnEncryptionKey(AkvPath, "RSA-OAEP", encryptedCek);

if (!decryptedCek.SequenceEqual(cek))
    throw new Exception("Column encryption key does not roundtrip.");

I've not added a unit test - as per dotnet/runtime#97013 this isn't a good way to perform testing.

@edwardneal edwardneal requested a review from a team as a code owner June 6, 2025 22:24
@paulmedynski
Copy link
Contributor

/azp run

Copy link

Azure Pipelines successfully started running 2 pipeline(s).

@paulmedynski paulmedynski added this to the 7.0-preview1 milestone Jun 11, 2025
Copy link

codecov bot commented Jun 12, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 61.86%. Comparing base (55095ef) to head (7e3e3ad).
Report is 10 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #3401      +/-   ##
==========================================
- Coverage   65.34%   61.86%   -3.49%     
==========================================
  Files         300      295       -5     
  Lines       65603    65321     -282     
==========================================
- Hits        42871    40412    -2459     
- Misses      22732    24909    +2177     
Flag Coverage Δ
addons ?
netcore 66.91% <ø> (-1.63%) ⬇️
netfx 60.35% <ø> (-6.43%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Contributor

@benrr101 benrr101 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to run this through our "official" AKV provider pipeline before accepting it - let me kick it off and see what we get. I'm guessing it'll be fine, but since I wrote the new AKV official pipeline, I just want to double check.

No changes required, just want to hold it until I can run the check.

Copy link
Contributor

@benrr101 benrr101 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image
LGTM! (that stands for "Let's get this merged", right?)

@benrr101 benrr101 merged commit 78dec95 into dotnet:main Jun 16, 2025
237 checks passed
@edwardneal edwardneal deleted the aot/azurekeyvaultprovider branch June 16, 2025 18:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants