Skip to content

Updated PCA of DAC cert #116507

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 12, 2025
Merged

Updated PCA of DAC cert #116507

merged 2 commits into from
Jun 12, 2025

Conversation

hoyosjs
Copy link
Member

@hoyosjs hoyosjs commented Jun 10, 2025

No description provided.

@hoyosjs hoyosjs marked this pull request as ready for review June 10, 2025 23:14
@Copilot Copilot AI review requested due to automatic review settings June 10, 2025 23:14
@github-actions github-actions bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Jun 10, 2025
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Update the expected PCA issuer in the DAC certificate signing script.

  • Change the issuer check from “Microsoft Code Signing PCA 2010” to “Microsoft Code Signing PCA 2024”
Comments suppressed due to low confidence (2)

eng/native/sign-with-dac-certificate.ps1:42

  • [nitpick] Consider extracting the expected subject and issuer values into named variables or script parameters to avoid hard-coded magic strings and ease future updates.
if ($signingCert.Subject -ne "CN=.NET DAC, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" `

eng/native/sign-with-dac-certificate.ps1:43

  • Add or update automated tests to cover the new PCA 2024 issuer value, ensuring the script fails when encountering the old PCA 2010 certificate.
-        -or $signingCert.Issuer -ne "CN=Microsoft Code Signing PCA 2024, O=Microsoft Corporation, L=Redmond, S=Washington, C=US")

@hoyosjs
Copy link
Member Author

hoyosjs commented Jun 12, 2025

/ba-g this doesn't get tested in CI. The errors are from the Helix Auth service outages and android timeouts.

@hoyosjs hoyosjs merged commit 2f6cdcb into main Jun 12, 2025
128 of 150 checks passed
@hoyosjs hoyosjs deleted the hoyosjs-patch-3 branch June 12, 2025 23:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants