Drop support for OpenSSL primitives on macOS #116481
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vcsjones
added
area-System.Security
breaking-change
dotnet-policy-service
bot
added
the
needs-breaking-change-doc-created
|
Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones |
There was a problem hiding this comment.
Pull Request Overview
This PR removes vestigial OpenSSL-based implementations on macOS, replacing them with stubs that throw PlatformNotSupportedException, and updates project files to stop building or running those tests on macOS.
- Deleted the SafeEvpPKeyHandle OpenSSL macOS implementation.
- Added NotSupported source files and adjusted
<Compile>includes in the main crypto csproj. - Updated test projects to ignore OpenSSL tests on macOS.
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/libraries/tests.proj | Removed ARM64/macOS exclusion for OpenSSL tests (no longer needed) |
| src/libraries/System.Security.Cryptography/src/.../SafeEvpPKeyHandle.OpenSsl.macOS.cs | Deleted macOS-specific OpenSSL key handle implementation |
| src/libraries/System.Security.Cryptography/src/System.Security.Cryptography.csproj | Reworked OpenSSL ItemGroups: removed AEAD group, added NotSupported stubs and moved compile items |
| src/libraries/System.Security.Cryptography.OpenSsl/tests/System.Security.Cryptography.OpenSsl.Tests.csproj | Extended IgnoreForCI to also skip OpenSSL tests on macOS |
Comments suppressed due to low confidence (2)
src/libraries/System.Security.Cryptography.OpenSsl/tests/System.Security.Cryptography.OpenSsl.Tests.csproj:5
- There are no new tests verifying that AesCcm and other OpenSSL-based APIs on macOS throw PlatformNotSupportedException. Consider adding tests (with
ActiveIssuefor macOS) to cover the new NotSupported stubs.
<IgnoreForCI Condition="'$(TargetOS)' == 'android' or '$(TargetOS)' == 'ios' or '$(TargetOS)' == 'tvos' or '$(TargetOS)' == 'osx'">true</IgnoreForCI>
src/libraries/System.Security.Cryptography.OpenSsl/tests/System.Security.Cryptography.OpenSsl.Tests.csproj:4
- [nitpick] The comment could explicitly list
macOSalongsideiOSandtvOSfor clarity, e.g. “The library is not supported on Android or Apple platforms (iOS, tvOS, macOS)”.
<!-- The library is not supported on Android / Apple (PNSE) -->
src/libraries/System.Security.Cryptography/src/System.Security.Cryptography.csproj
Show resolved
Hide resolved
src/libraries/System.Security.Cryptography/src/System.Security.Cryptography.csproj
Show resolved
Hide resolved
This was referenced Jun 11, 2025
bartonjs
approved these changes
Jun 11, 2025
|
/ba-g iOS queue is dead-lettered, and this change doesn't affect iOS. |
vcsjones
removed
the
needs-breaking-change-doc-created
|
Breaking change doc. dotnet/docs#46789 |
This was referenced Jul 9, 2025
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
macOS has historically supported
AesCcmandOpenSslsuffixed types likeRSAOpenSslas a "light up" option.This support is largely vestigial from when .NET used OpenSSL on macOS as its main cryptographic implementation. It hasn't had test coverage in some time due to the hardened runtime preventing loading the openssl libraries.
This pull request changes the OpenSSL primitives on macOS to unconditionally throw PlatformNotSupportedException.
It does not fully remove building of System.Security.Cryptography.Native or shipping the native library. That will be done as a follow up pending some open questions.