[release/5.0-rc2] hold ref to temp keychain on OSX to avoid premature cleanup #41882
+56
−14
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
cc: @jeffhandley fixes #39603 |
jeffhandley
changed the title
jeffhandley
approved these changes
Sep 4, 2020
ghost
locked as resolved and limited conversation to collaborators
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport of #41787 to release/5.0-rc2
/cc @wfurt
Customer Impact
This is regression from 3.1. When people import certificate and key from a pfx file, that may not be able to use them.
The issue had repro case for adding the key to a certificate store but it can impact other scenarios as well.
This is macOS specific. Originally reported on Bug Sur 11.0 - but reproduced also on Catalina 10.15.
Testing
This bug caused relevant tests not to run and fail silently (as they check if write to a certificate store is possible before the run) I verified manually that the existing tests do run and pass as well as I verify that the repro code works on 10.15 and 11.0.
Risk
medium. The fix is not large but it creates new relation between X509Certificate and temporary storage when needed.