CI Run Link: https://github.com/coder/coder/actions/runs/27788155477
Failed Jobs:
Commit Info:
Error Evidence:
=== FAIL: coderd/azureidentity TestValidate/regular (0.01s)
azureidentity_test.go:58:
Error: Received unexpected error:
verify pkcs7:
github.com/coder/coder/v2/coderd/azureidentity.Validate
/home/runner/work/coder/coder/coderd/azureidentity/azureidentity.go:265
- pkcs7: failed to verify certificate chain: x509: certificate signed by unknown authority
Root Cause:
TestValidate/regular runs in offline mode and relies on rootCertPool() for trust. On Linux, rootCertPool() returns x509.SystemCertPool() (see coderd/azureidentity/roots_other.go). The Azure PKCS7 payload in the test failed to chain to a trusted root in the runner’s system trust store, producing x509: certificate signed by unknown authority. This suggests a system root store mismatch/rotation or missing Azure root (possibly related to the recent change that embeds roots only on darwin).
Precise Assignment Analysis:
- git blame is not available via the API; used file history instead.
git log --oneline -10 --follow coderd/azureidentity/azureidentity_test.go → 132fa87 (Spike Curtis) "fix: only embed Azure roots on darwin"git log --oneline -10 --follow coderd/azureidentity/azureidentity.go → 132fa87 (Spike Curtis) "fix: only embed Azure roots on darwin"
Assigning to spikecurtis as the most recent meaningful modifier of root-trust behavior for this test/component.
Related Issues:
Classification:
A. Flaky Test / certificate trust chain mismatch on Linux runners.
Reproduction:
go test ./coderd/azureidentity -run TestValidate/regular -count=1
CI Run Link: https://github.com/coder/coder/actions/runs/27788155477
Failed Jobs:
Commit Info:
Error Evidence:
Root Cause:
TestValidate/regularruns in offline mode and relies onrootCertPool()for trust. On Linux,rootCertPool()returnsx509.SystemCertPool()(seecoderd/azureidentity/roots_other.go). The Azure PKCS7 payload in the test failed to chain to a trusted root in the runner’s system trust store, producingx509: certificate signed by unknown authority. This suggests a system root store mismatch/rotation or missing Azure root (possibly related to the recent change that embeds roots only on darwin).Precise Assignment Analysis:
git log --oneline -10 --follow coderd/azureidentity/azureidentity_test.go→ 132fa87 (Spike Curtis) "fix: only embed Azure roots on darwin"git log --oneline -10 --follow coderd/azureidentity/azureidentity.go→ 132fa87 (Spike Curtis) "fix: only embed Azure roots on darwin"Assigning to
spikecurtisas the most recent meaningful modifier of root-trust behavior for this test/component.Related Issues:
coderd/azureidentity TestValidate/regularfails on MacOS #101 (macOS standards-compliance error; different failure mode)Classification:
A. Flaky Test / certificate trust chain mismatch on Linux runners.
Reproduction:
go test ./coderd/azureidentity -run TestValidate/regular -count=1