Quarantine Microsoft.AspNetCore.DataProtection.DataProtectionProviderTests.System_UsesProvidedCertificateNotFromStore

[github-actions]

Failing Test(s)

Microsoft.AspNetCore.DataProtection.DataProtectionProviderTests.System_UsesProvidedCertificateNotFromStore

Error Message

Interop+AppleCrypto+AppleCommonCryptoCryptographicException : The specified keychain could not be found.

Stacktrace

Details

   at Interop.AppleCrypto.X509StoreAddCertificate(SafeKeychainItemHandle certOrIdentity, SafeKeychainHandle keychain)
   at Microsoft.AspNetCore.DataProtection.DataProtectionProviderTests.System_UsesProvidedCertificateNotFromStore() in /_/src/DataProtection/Extensions/test/DataProtectionProviderTests.cs:line 178
   at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
   at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)

Logs

Details

[xUnit.net 00:00:00.75]     Microsoft.AspNetCore.DataProtection.DataProtectionProviderTests.System_UsesProvidedCertificateNotFromStore [FAIL]
[xUnit.net 00:00:00.75]       Interop+AppleCrypto+AppleCommonCryptoCryptographicException : The specified keychain could not be found.
[xUnit.net 00:00:00.75]       Stack Trace:
[xUnit.net 00:00:00.75]            at Interop.AppleCrypto.X509StoreAddCertificate(SafeKeychainItemHandle certOrIdentity, SafeKeychainHandle keychain)
[xUnit.net 00:00:00.75]         /_/src/DataProtection/Extensions/test/DataProtectionProviderTests.cs(178,0): at Microsoft.AspNetCore.DataProtection.DataProtectionProviderTests.System_UsesProvidedCertificateNotFromStore()
[xUnit.net 00:00:00.75]            at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
[xUnit.net 00:00:00.75]            at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)

  Failed Microsoft.AspNetCore.DataProtection.DataProtectionProviderTests.System_UsesProvidedCertificateNotFromStore [36 ms]
  Error Message:
   Interop+AppleCrypto+AppleCommonCryptoCryptographicException : The specified keychain could not be found.
  Stack Trace:
     at Interop.AppleCrypto.X509StoreAddCertificate(SafeKeychainItemHandle certOrIdentity, SafeKeychainHandle keychain)
   at Microsoft.AspNetCore.DataProtection.DataProtectionProviderTests.System_UsesProvidedCertificateNotFromStore() in /_/src/DataProtection/Extensions/test/DataProtectionProviderTests.cs:line 178
   at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
   at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)

Build

https://dev.azure.com/dnceng-public/public/_build/results?buildId=1414721

Note

🔒 Integrity filter blocked 12 items

The following items were blocked because they don't meet the GitHub integrity level.

• #66624 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66625 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66613 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66583 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66584 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66586 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66577 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66578 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66532 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66531 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #65815 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #65817 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Daily Test Quarantine Management · ● 5.8M · ◷

[github-actions]

Investigation

The test System_UsesProvidedCertificateNotFromStore has failed 2 times in the aspnetcore-ci pipeline (definition 83) on the main branch within the last 30 days:

• Build 1414721 (2026-05-10)
• Build 1413909 (2026-05-08)

Error

Both failures show the same error:

Interop+AppleCrypto+AppleCommonCryptoCryptographicException : The specified keychain could not be found.

at Interop.AppleCrypto.X509StoreAddCertificate.

Root Cause

This test opens the macOS user keychain (X509Store(StoreName.My, StoreLocation.CurrentUser)) and attempts to add a test certificate to it. On Helix macOS agents, the default keychain is not always available in the test execution context, causing the X509StoreAddCertificate call to fail with "The specified keychain could not be found."

This is a known macOS Helix environment limitation — the user keychain may not be initialized or accessible in the ephemeral build environment. This is an infrastructure/environment flakiness issue, not a code bug.

The test is protected by [X509StoreIsAvailable] which should skip it on machines where the store isn't available, but this conditional check apparently passes even when the keychain operations later fail.

Recommended Fix

Investigate whether X509StoreIsAvailable can be improved to also check that keychain operations succeed, or whether the test should be skipped entirely on macOS CI environments. For now, quarantining is appropriate.

Note

🔒 Integrity filter blocked 12 items

The following items were blocked because they don't meet the GitHub integrity level.

• #66624 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66625 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66613 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66583 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66584 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66586 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66577 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66578 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66532 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #66531 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #65815 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #65817 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Daily Test Quarantine Management · ● 5.8M · ◷

[EduardF1]

@Youssef1313 — heads up on this one. PR #66532 is approved and ready to merge, but it has been blocked for 2 days by consecutive failures of System_UsesProvidedCertificateNotFromStore on every /azp run attempt (3 failures so far). This issue (#66637) was filed by the quarantine bot on 2026-05-10 with the Helix macOS keychain environment identified as the root cause, but no action has been taken yet.

Two asks:

1. Land the quarantine for this test so CI stops treating it as a blocking failure.
2. Once that is in, trigger a fresh /azp run on feat: add missing [StringSyntax(DateTimeFormat)] to DateTimeOffset methods in BindConverter #66532 so it can get a clean signal and be merged.

Thanks for looking into it.

[Youssef1313]

#66638 is merged already and the test is already quarantined.