Codespaces builds are failing any C# compilation with Interop+Crypto+OpenSslCryptographicException

[baronfel]

Any build.sh builds (or normal dotnet build builds) from a new codespace are failing catastrophically with the following stack for any C# compilation:

  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error : Unhandled exception. Interop+Crypto+OpenSslCryptographicException: error:03000098:digital envelope routines::invalid digest [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Interop.Crypto.RsaSignHash(SafeEvpPKeyHandle pkey, RSASignaturePaddingMode paddingMode, HashAlgorithmName digestAlgorithm, ReadOnlySpan`1 hash, Span`1 destination) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at System.Security.Cryptography.RSAOpenSsl.SignHash(Byte[] hash, HashAlgorithmName hashAlgorithm, RSASignaturePadding padding) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.SigningUtilities.CalculateRsaSignature(IEnumerable`1 content, RSAParameters privateKey) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.DesktopStrongNameProvider.<>c__DisplayClass12_0.<SignBuilder>b__0(IEnumerable`1 content) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at System.Reflection.PortableExecutable.PEBuilder.Sign(BlobBuilder peImage, Blob strongNameSignatureFixup, Func`2 signatureProvider) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.Cci.PeWriter.WritePeToStream(EmitContext context, CommonMessageProvider messageProvider, Func`1 getPeStream, Func`1 getPortablePdbStreamOpt, PdbWriter nativePdbWriterOpt, String pdbPathOpt, Boolean metadataOnly, Boolean isDeterministic, Boolean emitTestCoverageData, Nullable`1 privateKeyOpt, CancellationToken cancellationToken) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.Compilation.SerializePeToStream(CommonPEModuleBuilder moduleBeingBuilt, DiagnosticBag metadataDiagnostics, CommonMessageProvider messageProvider, Func`1 getPeStream, Func`1 getMetadataPeStreamOpt, Func`1 getPortablePdbStreamOpt, PdbWriter nativePdbWriterOpt, String pdbPathOpt, RebuildData rebuildData, Boolean metadataOnly, Boolean includePrivateMembers, Boolean isDeterministic, Boolean emitTestCoverageData, Nullable`1 privateKeyOpt, CancellationToken cancellationToken) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.Compilation.SerializeToPeStream(CommonPEModuleBuilder moduleBeingBuilt, EmitStreamProvider peStreamProvider, EmitStreamProvider metadataPEStreamProvider, EmitStreamProvider pdbStreamProvider, RebuildData rebuildData, Func`2 testSymWriterFactory, DiagnosticBag diagnostics, EmitOptions emitOptions, Nullable`1 privateKeyOpt, CancellationToken cancellationToken) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.CommonCompiler.CompileAndEmit(TouchedFileLogger touchedFilesLogger, Compilation& compilation, ImmutableArray`1 analyzers, ImmutableArray`1 generators, ImmutableArray`1 additionalTextFiles, AnalyzerConfigSet analyzerConfigSet, ImmutableArray`1 sourceFileAnalyzerConfigOptions, ImmutableArray`1 embeddedTexts, DiagnosticBag diagnostics, ErrorLogger errorLogger, CancellationToken cancellationToken, CancellationTokenSource& analyzerCts, AnalyzerDriver& analyzerDriver, Nullable`1& generatorTimingInfo) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.CommonCompiler.RunCore(TextWriter consoleOutput, ErrorLogger errorLogger, CancellationToken cancellationToken) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.CommonCompiler.Run(TextWriter consoleOutput, CancellationToken cancellationToken) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.CSharp.CommandLine.Csc.Run(String[] args, BuildPaths buildPaths, TextWriter textWriter, IAnalyzerAssemblyLoader analyzerLoader) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.CommandLine.BuildClient.RunCompilation(IEnumerable`1 originalArguments, BuildPaths buildPaths, TextWriter textWriter, String pipeName) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.CommandLine.BuildClient.Run(IEnumerable`1 arguments, RequestLanguage language, CompileFunc compileFunc, CompileOnServerFunc compileOnServerFunc, ICompilerServerLogger logger) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.CSharp.CommandLine.Program.MainCore(String[] args) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]
  /workspaces/dotnet/.dotnet/sdk/10.0.100-preview.7.25322.101/Roslyn/Microsoft.CSharp.Core.targets(84,5): error :    at Microsoft.CodeAnalysis.CSharp.CommandLine.Program.Main(String[] args) [/workspaces/dotnet/src/arcade/src/Microsoft.DotNet.XliffTasks/Microsoft.DotNet.XliffTasks.csproj::TargetFramework=net472]

[baronfel]

@akoeplinger, @ViktorHofer thought that this might be a side-effect of the container changes?

[ViktorHofer]

@akoeplinger maybe regressed with 0beb8d8?

[akoeplinger]

so this is basically dotnet/runtime#65874 but I don't know why we don't hit it in the VMR build which is using the same container

[akoeplinger]

I guess it's because we likely override to not do desktop strongname signing in source-build somewhere

[ViktorHofer]

Should we add the env var back to the container image as with centos9?

[akoeplinger]

that would risk that we accidentally introduce some dependency on the disabled algorithms again. I guess we could disable just in the codespaces config

[ViktorHofer]

If we already had that env var in the centos9 image, I'm not concerned about adding it to centos10 as well.

[baronfel]

Adding that env to my codespace that I'm using for working on #1385 worked wonderfully and I'm unblocked.

[akoeplinger]

@MichaelSimons thoughts on adding OPENSSL_ENABLE_SHA1_SIGNATURES back to the centos10 image? you removed it in dotnet/dotnet-buildtools-prereqs-docker#1357

We could probably also switch the codespaces container to e.g. Ubuntu. Do we know if more distros will turn off SHA1 in the future?

[MichaelSimons]

@MichaelSimons thoughts on adding OPENSSL_ENABLE_SHA1_SIGNATURES back to the centos10 image? you removed it in dotnet/dotnet-buildtools-prereqs-docker#1357

We could probably also switch the codespaces container to e.g. Ubuntu. Do we know if more distros will turn off SHA1 in the future?

I would rather we switch to a different OS. It is valuable for source-build to be testing w/o this. I can't answer on other distros moving in this direction.

[akoeplinger]

Ok, sounds like switching to e.g. Ubuntu would be better then. Though we'd probably lose being able to download the Online SB artifacts and then do an Offline SB using those in the Codespace.

Btw. I dug a little bit into the history and the reason why it works in source-build is because we indeed disable full signing there: dotnet/arcade#12940