AsnEncodedDataTests fail on Debian 13

[richlander]

Build Information

Build: https://dev.azure.com/dnceng-public/cbb18261-c48f-4abb-8651-8cdcb5474649/_build/results?buildId=927317
Build error leg or test failing: System.Security.Cryptography.Tests.AsnEncodedDataTests.TestSubjectAlternativeName_Unix
Pull request: #111768

Error Message

Fill the error message using step by step known issues guidance.

Exception Message:

Assert.Equal() Failure: Strings differ
                          ↓ (pos 15)
Expected: "othername: UPN::subjectupn1@example.org, "···
Actual:   "othername: UPN:subjectupn1@example.org, e"···
                          ↑ (pos 15)

CallStack:

   at System.Security.Cryptography.Tests.AsnEncodedDataTests.TestSubjectAlternativeName_Unix() in /_/src/libraries/System.Security.Cryptography/tests/AsnEncodedDataTests.cs:line 147
   at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args) in /_/src/mono/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.Mono.cs:line 22
   at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr) in /_/src/libraries/System.Private.CoreLib/src/System/Reflect

I did some searched for ASN breaking changes and didn't see anything.

Report

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	0	0

[bartonjs]

openssl/openssl@de8861a removed the redundant colon, so we need yet another OSSL-version check in the tests... 3.4 and higher are better formatted.

runtime/src/libraries/System.Security.Cryptography/tests/AsnEncodedDataTests.cs

Line 119 in cedf4e2

isOpenSsl3 ? "othername: UPN::subjectupn1@example.org" : "othername:<unsupported>",

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[richlander]

Thanks for finding the change. That's great.

Can you make the change, preferably in my branch? I can give you access.

Will we need to backport this change?

[bartonjs]

Will we need to backport this change?

Assuming we care about running older version tests on Debian 13 (or any other distro that upgrades to OSSL 3.4), yes

[richlander]

It would be best. Debian 12 will go out of support before .NET 8 does at which point we will need to move to Debian 13 (at the latest). Both Debian and .NET are on a 3 year support model and Debian always ships a few months earlier. We can skip .NET 9, however. Up to you folks.