[release/13.5] Ensure the typescript app host trusts the dev cert - #19365
Conversation
* Build a PEM bundle for the dev cert * Use response from cert bundle directly * Combine existing Node CA certificate bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refine TypeScript development certificate handling Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f0f2521e-b6ba-4441-9d8d-08483d863485 * Handle duplicate certificate environment aliases Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f0f2521e-b6ba-4441-9d8d-08483d863485 * Clarify certificate trust scope Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f0f2521e-b6ba-4441-9d8d-08483d863485 * Handle case-sensitive certificate bundle paths Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f0f2521e-b6ba-4441-9d8d-08483d863485 * Use standard Windows path comparison Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f0f2521e-b6ba-4441-9d8d-08483d863485 * Address certificate bundle review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f0f2521e-b6ba-4441-9d8d-08483d863485 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f0f2521e-b6ba-4441-9d8d-08483d863485
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19365Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19365" |
Tests selector (audit mode)The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement. 100 / 100 test projects · 8 jobs, from 26 changed files. Selected test projects (100 / 100)
Selected jobs (8)
How these were chosen — grouped by what changed
🔧 show 89
🔧 🔧 📦 affected project 📦 affected project 🔧 🧪 🧪 🧪 🧪 🧪 🧪 🧪 🧪 🧪 🧪 🧪 🧪 🧪 🧪 Job reasons
Selection computed for commit |
There was a problem hiding this comment.
Pull request overview
Backports TypeScript AppHost development-certificate trust support to release/13.5.
Changes:
- Adds runtime metadata for PEM certificate bundles.
- Exports and securely caches trusted development certificates.
- Preserves existing CA bundles and adds unit/E2E coverage.
Reviewed changes
Copilot reviewed 26 out of 26 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
tests/Aspire.Hosting.CodeGeneration.TypeScript.Tests/TypeScriptLanguageSupportTests.cs |
Tests TypeScript certificate metadata. |
tests/Aspire.Cli.Tests/Utils/TestExecutionContextHelper.cs |
Supports custom Aspire home paths. |
tests/Aspire.Cli.Tests/Utils/CliTestHelper.cs |
Updates certificate service construction. |
tests/Aspire.Cli.Tests/TestServices/TestCertificateToolRunner.cs |
Adds certificate export test hook. |
tests/Aspire.Cli.Tests/TestServices/TestCertificateService.cs |
Implements the new test contract. |
tests/Aspire.Cli.Tests/Templating/DotNetTemplateFactoryTests.cs |
Updates certificate test stub. |
tests/Aspire.Cli.Tests/Projects/TypeScriptAppHostToolchainResolverTests.cs |
Verifies metadata preservation. |
tests/Aspire.Cli.Tests/Projects/GuestAppHostProjectTests.cs |
Tests bundle merging, caching, and fallback. |
tests/Aspire.Cli.Tests/Commands/RunCommandTests.cs |
Updates certificate stub. |
tests/Aspire.Cli.Tests/Commands/NewCommandTests.cs |
Updates certificate stub. |
tests/Aspire.Cli.Tests/Commands/CertificatesCommandTests.cs |
Updates service dependencies. |
tests/Aspire.Cli.Tests/Certificates/NativeCertificateToolRunnerTests.cs |
Tests export and secure caching. |
tests/Aspire.Cli.Tests/Certificates/CertificateServiceTests.cs |
Tests explicit export behavior. |
tests/Aspire.Cli.EndToEnd.Tests/TypeScriptEmptyAppHostTemplateTests.cs |
Verifies the launched AppHost receives a PEM path. |
src/Shared/X509Certificate2Extensions.cs |
Shares trusted-certificate selection logic. |
src/Aspire.TypeSystem/RuntimeSpec.cs |
Adds certificate bundle metadata. |
src/Aspire.TypeSystem/ILanguageSupport.cs |
Adds language-level certificate metadata. |
src/Aspire.Hosting/DeveloperCertificateService.cs |
Reuses shared trust filtering. |
src/Aspire.Hosting.CodeGeneration.TypeScript/TypeScriptLanguageSupport.cs |
Enables NODE_EXTRA_CA_CERTS. |
src/Aspire.Cli/Projects/TypeScriptAppHostToolchainResolver.cs |
Preserves certificate metadata. |
src/Aspire.Cli/Projects/GuestRuntime.cs |
Exposes runtime certificate metadata. |
src/Aspire.Cli/Projects/GuestAppHostProject.cs |
Configures and combines certificate bundles. |
src/Aspire.Cli/Certificates/NativeCertificateToolRunner.cs |
Exports trusted certificates as PEM. |
src/Aspire.Cli/Certificates/ICertificateToolRunner.cs |
Adds the export contract. |
src/Aspire.Cli/Certificates/CertificateService.cs |
Coordinates best-effort export. |
src/Aspire.Cli/Certificates/CertificateCacheWriter.cs |
Adds secure atomic cache writes. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
Jose Perez Rodriguez (joperezr)
left a comment
Jose Perez Rodriguez (joperezr)
left a comment
There was a problem hiding this comment.
Merging this to fix this issue which impacts callbacks to resources from the apphost. Given risk is not low, let's do some extra bashing here across OSes to ensure things are good to go once we have a build.
f05c52d
into
release/13.5
|
✅ No documentation update needed. Step 5 branch taken: This PR is a backport (
No documentation PR was drafted. |
Backport of #15634 to release/13.5
/cc David Negstad (@danegsta)
Customer Impact
TypeScript AppHosts cannot validate Aspire-managed development certificates when custom AppHost code connects to TLS-enabled resources, forcing customers to disable certificate validation as a workaround.
Testing
Validated real Node TLS connections on macOS and Linux, existing CA preservation, secure cache permissions and reuse, missing-bundle fallback, and the publish-mode boundary. On release/13.5, 105 focused unit tests passed and the CLI E2E test project built successfully.
Risk
Medium — this changes cross-platform certificate export, caching, and TypeScript AppHost process environment setup, but is scoped to run mode and has extensive platform and regression coverage.
Regression?
No — this fixes an existing gap.