[ci-scan] Test failure: System.Security.Cryptography.Pkcs.Tests entitlement failure on Apple NativeAOT

[github-actions]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection results could not be parsed.

Review the workflow run logs for details.

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1500658
Build error leg or test failing: iossimulator-x64 Release AllSubsets_NativeAOT - System.Security.Cryptography.Pkcs.Tests

Error Details

On the Apple NativeAOT library-test legs (iossimulator AllSubsets_NativeAOT), the entire System.Security.Cryptography.Pkcs.Tests work item fails: 195 of its tests throw the same exception. Interop.AppleCrypto.KeychainEnumerateIdentities() cannot access the keychain because the NativeAOT test app is missing a required entitlement, so every Pkcs decrypt/sign test that reaches identity enumeration fails:

[FAIL] System.Security.Cryptography.Pkcs.EnvelopedCmsTests.Tests.DecryptTestsRsaPaddingMode.DecryptEnvelopedEmptyOctetString
Interop+AppleCrypto+AppleCommonCryptoCryptographicException : A required entitlement isn't present.
   at Interop.AppleCrypto.KeychainEnumerateIdentities() in /_/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Keychain.iOS.cs:line 60

This is a leg-level failure: >80% of the work item's tests fail on the single shared signal above. NativeAOT library tests on Apple mobile were newly enabled by #125437 (merged 2026-07-02). Observed on source build 1500658 (2026-07-09) and again on follow-up build 1502636 (2026-07-10), reproducing on the iossimulator-x64/iossimulator-arm64 AllSubsets_NativeAOT legs.

First build it occurred: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1500658

Error Message

{
  "ErrorMessage": [
    "[FAIL] System.Security.Cryptography.Pkcs.EnvelopedCmsTests",
    "Interop+AppleCrypto+AppleCommonCryptoCryptographicException : A required entitlement isn't present."
  ],
  "ErrorPattern": "",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

---

Filed by ci-failure-scan (detection only). ci-failure-fix walks open [ci-scan] KBEs and either opens a small fix PR or comments here to loop in owners — it never disables the test.

Note

This issue was generated by an AI agent (Copilot CI Outer-Loop Failure Scanner).

Generated by CI Outer-Loop Failure Scanner · 375.4 AIC · ⊞ 19.5K · ◷

Report

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	0	0

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[github-actions]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection results could not be parsed.

Review the workflow run logs for details.

Workflow artifact: ci-fix
Artifact kind: handoff
Linked KBE: #130485

Note

AI/Copilot-generated root-cause hand-off (ci-failure-fix). No automated code change was produced: the failure is a missing Apple keychain entitlement/provisioning decision on the newly-enabled NativeAOT iOS-simulator test app. Declaring a keychain entitlement (and any associated code-signing/provisioning) is a maintainer judgement I should not guess at blindly, and it cannot be built or validated on this Linux runner. The only in-bounds test-side alternative would be to skip the Pkcs tests on that leg (muting), which this workflow must not do. Looping in owners to fix forward.

Root cause (read-only analysis)

On the Apple NativeAOT library-test legs (iossimulator-x64/iossimulator-arm64 AllSubsets_NativeAOT), the entire System.Security.Cryptography.Pkcs.Tests work item fails (195 tests) on a single shared signal — keychain identity enumeration is denied because the NativeAOT test app lacks a required entitlement:

Interop+AppleCrypto+AppleCommonCryptoCryptographicException : A required entitlement isn't present.
   at Interop.AppleCrypto.KeychainEnumerateIdentities() in /_/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Keychain.iOS.cs:line 60

Every Pkcs decrypt/sign test that reaches identity enumeration throws the same exception. The managed interop is correct; the failure is that the NativeAOT iOS-simulator test app is not provisioned/entitled for keychain access.

These NativeAOT library tests on Apple mobile were newly enabled by #125437 (merged 2026-07-02), which wires the trim+ILC step and consumes the static library in AppleAppBuilder library mode. The app entitlements are emitted by src/tasks/AppleAppBuilder/Xcode.cs (see the entitlements list around lines 326-346); it currently adds only com.apple.security.cs.allow-jit, disable-library-validation (MacCatalyst), app-sandbox, and network.client — no keychain-access-groups/keychain-access entitlement. Whether the correct fix is to add a keychain entitlement (and how to provision it on the simulator), to run these Pkcs tests under a different configuration, or to exclude keychain-dependent Pkcs scenarios on this leg, is a provisioning/security decision for the mobile + security owners — so I am handing off rather than guessing at an entitlement value that I cannot validate.

Evidence

• Failing leg: iossimulator-x64 Release AllSubsets_NativeAOT — System.Security.Cryptography.Pkcs.Tests (per the KBE Build error leg or test failing: line).
• Error signature: AppleCommonCryptoCryptographicException : A required entitlement isn't present. at KeychainEnumerateIdentities() (Interop.Keychain.iOS.cs:60).
• Reproduces on source build 1500658 (2026-07-09) and follow-up build 1502636 (2026-07-10).
• Suspected enabling change: [mobile] Enable NativeAOT library tests on Apple mobile platforms #125437 (newly enabled NativeAOT library tests on Apple mobile).
• Entitlement emission point: src/tasks/AppleAppBuilder/Xcode.cs (no keychain entitlement is currently added).

Suggested reviewers / area contacts

• NativeAOT Apple mobile test enablement (os-ios, author of [mobile] Enable NativeAOT library tests on Apple mobile platforms #125437): @kotlarmilos; area owners @vitek-karas.
• Security area (area-System.Security, keychain/entitlement semantics): @bartonjs @vcsjones (@dotnet/area-system-security).

Please verify before acting; the keychain entitlement/provisioning decision for the NativeAOT iOS-simulator test app is the key call here.

Generated by CI Outer-Loop Failure Fixer · 358.6 AIC · ⊞ 18.2K · ◷

[jeffschwMSFT]

removing blocking-clean-ci as it has not failed in 30 days

Summary
24-Hour Hit Count 7-Day Hit Count 1-Month Count
0 0 0