Repository navigation
[release/8.0] RSA-384/SHA1 signature verification fails on Android - fix from #118366 not backported #134002
Description
Build Information
Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1597620
Build error leg or test failing: net8.0-android-Release-arm64-Mono_Release / System.Security.Cryptography.Rsa.Tests.SignVerify_*.VerifySignature_SHA1_384, PublicKeyTests.TestKey_RSA384_ValidatesSignature
Pull request: #133957 (release/8.0-staging -> release/8.0 merge)
Assert.True() Failure
Expected: True
Actual: False
at System.Security.Cryptography.Rsa.Tests.SignVerify.VerifySignature(Byte[] signature, Byte[] data, String hashAlgorithmName, RSAParameters rsaParameters) in /_/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/SignVerify.cs:line 1552
First reported here: #118366
Fixed on main by #118880 (backported to main via #118950), but that fix was never backported to release/8.0 — confirmed neither release/8.0 nor release/8.0-staging contains commit 1765399 or deae3d2. Requesting the fix be backported to release/8.0.
Error Message
{
"ErrorMessage": "Assert.True() Failure\nExpected: True\nActual: False",
"ErrorPattern": "SignVerify_.*\\.VerifySignature_SHA1_384",
"BuildRetry": false,
"ExcludeConsoleLog": false
}Note
This issue was filed with AI assistance (GitHub Copilot CLI).
Known issue validation
Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1597620
Error message validated: [SignVerify_.*\.VerifySignature_SHA1_384]
Result validation: ❌ Known issue did not match with the provided build.
Validation performed at: 9/15/2026 10:52:27 PM UTC
Report
Summary
| 24-Hour Hit Count | 7-Day Hit Count | 1-Month Count |
|---|---|---|
| 0 | 7 | 41 |
Activity
dotnet-policy-service commentedon Sep 15, 2026
Tagging subscribers to 'arch-android': @vitek-karas, @simonrozsival, @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.
dotnet-policy-service commentedon Sep 15, 2026
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.
vcsjones commentedon Sep 15, 2026
I don't think the actual fix would meet the backport bar for release/8.0 at this point. We should just disable the test for the ~2 months left on the release 8.0 cycle.
bartonjs commentedon Sep 16, 2026
agreed, let's disable the test for Android
[release/8.0-staging] Disable RSA SHA1/384 signature tests on Android
[release/9.0-staging] Disable RSA SHA1/384 signature tests on Android
akoeplinger commentedon Sep 23, 2026
tests were disabled
vcsjones commentedon Sep 23, 2026
@akoeplinger they are only disabled in the
-stagingbranches, which I don't think have flowed the release branches. Should we keep this open so the tests don't trip build analysis?akoeplinger commentedon Sep 23, 2026
ah sorry yeah, I thought they already made it to release/8.0
akoeplinger commentedon Oct 27, 2026
Tests are now disabled in release/8.0