[release/10.0.3xx] Fix DownloadBlobAsync_RetriesOnFailure digest validation - #55543
Open
nagilson wants to merge 2 commits into
Open
[release/10.0.3xx] Fix DownloadBlobAsync_RetriesOnFailure digest validation#55543nagilson wants to merge 2 commits into
nagilson wants to merge 2 commits into
Conversation
The blob digest-validation feature (CopyToAndVerifyAsync) is flowing into
release/10.0.3xx from the VMR, but this test uses the placeholder digest
'sha256:testdigest1234'. That value is not valid hex, so once verification is
enabled GetEncodedValue -> Convert.FromHexString throws FormatException when the
retried download 'succeeds', failing the test on every leg.
Use the actual SHA-256 of the mock content { 1, 2, 3 }
(039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81) so digest
verification passes, matching the fix already on main (b525d46). Landing this on
release/10.0.3xx forward-flows the correction so codeflow PRs stop regressing.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6267ed77-eef8-42c1-8799-1b107460fc61
|
Azure Pipelines: Successfully started running 1 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the container registry unit test in release/10.0.3xx to use a valid SHA-256 digest for the mocked blob payload, preventing digest-parsing/verification failures when DownloadBlobAsync validates the digest.
Changes:
- Replace the placeholder digest (
sha256:testdigest1234) with the real SHA-256 for the mocked content{ 1, 2, 3 }.
nagilson
enabled auto-merge
July 30, 2026 17:57
Member
|
See the fix from https://github.com/dotnet/sdk/pull/55486/changes#diff-20922c5f9afdff958ecc5a9120f4084a06777648f981967b76a62f29f21416f8. probably only needed in the 3xx backflow PR |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9e4ad2d8-eae4-4af7-a524-6ad60a95f070
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The blob digest-validation feature (
Registry.DownloadBlobAsync->StreamExtensions.CopyToAndVerifyAsync->DigestUtils.GetEncodedValue) is flowing intorelease/10.0.3xxfrom the VMR, butRegistryTests.DownloadBlobAsync_RetriesOnFailurestill uses the placeholder digestsha256:testdigest1234.Once verification runs, the retried download "succeeds" returning bytes
{ 1, 2, 3 }and the code stripssha256:then callsConvert.FromHexString("testdigest1234"), which throwsFormatException: The input is not a valid hex string(t/saren't hex). The next retry NREs (mock exhausted) and the method throwsUnableToDownloadFromRepositoryException, failing the test on every leg (Linux/macOS/Windows/FullFramework).This blocks the codeflow PR #55455 and every codeflow into
release/10.0.3xx.Fix
Use the real SHA-256 of the mock content
{ 1, 2, 3 }(039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81) so digest verification passes. This matches the fix already onmain(commitb525d46, "Add digest validation for downloaded and cached registry blobs").Landing this on
release/10.0.3xxforward-flows the correction to the VMR so codeflow PRs stop reintroducing the broken test.Validation
SHA256({ 1, 2, 3 })==039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81(verified), soCopyToAndVerifyAsynccomputes a matching hash and the retry test passes.