fix: resolve merge conflict markers committed in 1.3.3 merge - #27
Merged
Conversation
PR #26 squash-merged release-1.3 commit f4fbf10, which had been committed with unresolved conflict markers in CHANGELOG.md and GCPCASClient.cs, leaving main uncompilable (CS8300 x27). The intended resolution of every conflict block is the release-1.3 side, whose content is byte-identical to the 1.3.3 tag. Restore both files from the 1.3.3 tag.
This was referenced Jul 23, 2026
spbsoluble
added a commit
that referenced
this pull request
Jul 23, 2026
The 1.3.3 guard ran new X509Name(true, netCert.Subject), which does not throw on a CN containing an odd-length run of literal backslash bytes. Such subjects were admitted, persisted with backslashes escape-doubled, and then aborted Command's Full Scan with 'badly formatted directory string' when the gateway un-escaped one level and re-parsed the dangling escape on its /v2/certificate/search response. Replace the fragile mirror-the-gateway-parse approach with a structural, version-independent check: reject any subject whose literal backslash run has odd length (HasOddBackslashRun), keeping a defensive local X509Name parse as a second net. Even-length runs round-trip cleanly, matching the lab reproduction's abort/no-abort split (shape1 vs shape2/shape3). Add pure unit regression tests (no GCP required) via InternalsVisibleTo. This branch is based on release-1.3 and also drops the committed merge-conflict markers that release-1.3 carried in CHANGELOG.md and GCPCAS/Client/GCPCASClient.cs (same resolution as #27).
spbsoluble
added a commit
that referenced
this pull request
Jul 23, 2026
The 1.3.3 guard ran new X509Name(true, netCert.Subject), which does not throw on a CN containing an odd-length run of literal backslash bytes. Such subjects were admitted, persisted with backslashes escape-doubled, and then aborted Command's Full Scan with 'badly formatted directory string' when the gateway un-escaped one level and re-parsed the dangling escape on its /v2/certificate/search response. Replace the fragile mirror-the-gateway-parse approach with a structural, version-independent check: reject any subject whose literal backslash run has odd length (HasOddBackslashRun), keeping a defensive local X509Name parse as a second net. Even-length runs round-trip cleanly, matching the lab reproduction's abort/no-abort split (shape1 vs shape2/shape3). Add pure unit regression tests (no GCP required) via InternalsVisibleTo. This branch is based on release-1.3 and also drops the committed merge-conflict markers that release-1.3 carried in CHANGELOG.md and GCPCAS/Client/GCPCASClient.cs (same resolution as #27).
spbsoluble
added a commit
that referenced
this pull request
Jul 23, 2026
The 1.3.3 guard ran new X509Name(true, netCert.Subject), which does not throw on a CN containing an odd-length run of literal backslash bytes. Such subjects were admitted, persisted with backslashes escape-doubled, and then aborted Command's Full Scan with 'badly formatted directory string' when the gateway un-escaped one level and re-parsed the dangling escape on its /v2/certificate/search response. Replace the fragile mirror-the-gateway-parse approach with a structural, version-independent check: reject any subject whose literal backslash run has odd length (HasOddBackslashRun), keeping a defensive local X509Name parse as a second net. Even-length runs round-trip cleanly, matching the lab reproduction's abort/no-abort split (shape1 vs shape2/shape3). Add pure unit regression tests (no GCP required) via InternalsVisibleTo. This branch is based on release-1.3 and also drops the committed merge-conflict markers that release-1.3 carried in CHANGELOG.md and GCPCAS/Client/GCPCASClient.cs (same resolution as #27).
spbsoluble
added a commit
that referenced
this pull request
Jul 23, 2026
The 1.3.3 guard ran new X509Name(true, netCert.Subject), which does not throw on a CN containing an odd-length run of literal backslash bytes. Such subjects were admitted, persisted with backslashes escape-doubled, and then aborted Command's Full Scan with 'badly formatted directory string' when the gateway un-escaped one level and re-parsed the dangling escape on its /v2/certificate/search response. Replace the fragile mirror-the-gateway-parse approach with a structural, version-independent check: reject any subject whose literal backslash run has odd length (HasOddBackslashRun), keeping a defensive local X509Name parse as a second net. Even-length runs round-trip cleanly, matching the lab reproduction's abort/no-abort split (shape1 vs shape2/shape3). Add pure unit regression tests (no GCP required) via InternalsVisibleTo. This branch is based on release-1.3 and also drops the committed merge-conflict markers that release-1.3 carried in CHANGELOG.md and GCPCAS/Client/GCPCASClient.cs (same resolution as #27).
indrora
approved these changes
Jul 23, 2026
spbsoluble
added a commit
that referenced
this pull request
Jul 23, 2026
The 1.3.3 guard ran new X509Name(true, netCert.Subject), which does not throw on a CN containing an odd-length run of literal backslash bytes. Such subjects were admitted, persisted with backslashes escape-doubled, and then aborted Command's Full Scan with 'badly formatted directory string' when the gateway un-escaped one level and re-parsed the dangling escape on its /v2/certificate/search response. Replace the fragile mirror-the-gateway-parse approach with a structural, version-independent check: reject any subject whose literal backslash run has odd length (HasOddBackslashRun), keeping a defensive local X509Name parse as a second net. Even-length runs round-trip cleanly, matching the lab reproduction's abort/no-abort split (shape1 vs shape2/shape3). Add pure unit regression tests (no GCP required) via InternalsVisibleTo. This branch is based on release-1.3 and also drops the committed merge-conflict markers that release-1.3 carried in CHANGELOG.md and GCPCAS/Client/GCPCASClient.cs (same resolution as #27).
spbsoluble
added a commit
that referenced
this pull request
Jul 23, 2026
GCP CAS will issue certificates whose subject is not valid RFC 4514 (e.g. a CN ending in a dangling backslash). The AnyCA Gateway parses the subject with BouncyCastle's X509Name on its /v2/certificate/search response; on such a subject that call throws 'badly formatted directory string', the search page 500s, and Command's Full Scan aborts. The 1.3.3 guard tried to pre-empt this by running the same X509Name parse locally, but the plugin bundled BouncyCastle 2.0.0, whose parser is lenient and never throws on these shapes - so they were admitted and still broke the downstream sync. Fix: pin BouncyCastle.Cryptography to 2.6.2, the same strict build the gateway uses (verified: it throws on exactly the shapes the gateway rejects, with the identical message spelling, and accepts valid escapes such as \HH hex and \, that the gateway accepts). The guard now faithfully reproduces the gateway's accept/reject decision - no structural heuristic and no assumptions about .NET escaping - so it skips only certs the gateway genuinely cannot parse and stops dropping valid ones. Skips are logged at error level and sync continues. The upgrade also clears the known BouncyCastle 2.0.0 security advisories. This branch is based on release-1.3 and also drops the committed merge-conflict markers that release-1.3 carried in CHANGELOG.md and GCPCAS/Client/GCPCASClient.cs (same resolution as #27).
spbsoluble
added a commit
that referenced
this pull request
Jul 23, 2026
GCP CAS will issue certificates whose subject is not valid RFC 4514 (e.g. a CN ending in a dangling backslash). The AnyCA Gateway parses the subject with BouncyCastle's X509Name on its /v2/certificate/search response; on such a subject that call throws 'badly formatted directory string', the search page 500s, and Command's Full Scan aborts. The 1.3.3 guard tried to pre-empt this by running the same X509Name parse locally, but the plugin bundled BouncyCastle 2.0.0, whose parser is lenient and never throws on these shapes - so they were admitted and still broke the downstream sync. Fix: pin BouncyCastle.Cryptography to 2.6.2, the same strict build the gateway uses (verified: it throws on exactly the shapes the gateway rejects, with the identical message spelling, and accepts valid escapes such as \HH hex and \, that the gateway accepts). The guard now faithfully reproduces the gateway's accept/reject decision - no structural heuristic and no assumptions about .NET escaping - so it skips only certs the gateway genuinely cannot parse and stops dropping valid ones. Skips are logged at error level and sync continues. The upgrade also clears the known BouncyCastle 2.0.0 security advisories. Tests: pure unit regression tests for the guard predicate, plus a sync-loop test (SyncSkipContinuationTests) that streams good/bad/good pages through DownloadAllIssuedCertificates via a fake CertificateAuthorityServiceClient and asserts the bad cert is skipped while the rest are buffered and the sync completes. Adds an internal test-only GCPCASClient constructor to inject the fake client, and a GCPCAS.Tests/README.md describing every test. This branch is based on release-1.3 and also drops the committed merge-conflict markers that release-1.3 carried in CHANGELOG.md and GCPCAS/Client/GCPCASClient.cs (same resolution as #27).
spbsoluble
added a commit
that referenced
this pull request
Jul 23, 2026
GCP CAS will issue certificates whose subject is not valid RFC 4514 (e.g. a CN ending in a dangling backslash). The AnyCA Gateway parses the subject with BouncyCastle's X509Name on its /v2/certificate/search response; on such a subject that call throws 'badly formatted directory string', the search page 500s, and Command's Full Scan aborts. The 1.3.3 guard tried to pre-empt this by running the same X509Name parse locally, but the plugin bundled BouncyCastle 2.0.0, whose parser is lenient and never throws on these shapes - so they were admitted and still broke the downstream sync. Fix: pin BouncyCastle.Cryptography to 2.6.2, the same strict build the gateway uses (verified: it throws on exactly the shapes the gateway rejects, with the identical message spelling, and accepts valid escapes such as \HH hex and \, that the gateway accepts). The guard now faithfully reproduces the gateway's accept/reject decision - no structural heuristic and no assumptions about .NET escaping - so it skips only certs the gateway genuinely cannot parse and stops dropping valid ones. Skips are logged at error level and sync continues. The upgrade also clears the known BouncyCastle 2.0.0 security advisories. Tests: pure unit regression tests for the guard predicate, plus a sync-loop test (SyncSkipContinuationTests) that streams good/bad/good pages through DownloadAllIssuedCertificates via a fake CertificateAuthorityServiceClient and asserts the bad cert is skipped while the rest are buffered and the sync completes. Adds an internal test-only GCPCASClient constructor to inject the fake client, and a GCPCAS.Tests/README.md describing every test. This branch is based on release-1.3 and also drops the committed merge-conflict markers that release-1.3 carried in CHANGELOG.md and GCPCAS/Client/GCPCASClient.cs (same resolution as #27).
indrora
added a commit
that referenced
this pull request
Jul 30, 2026
…#31) * Merge 1.3.3 to main (#26) * chore: Update integration-manifest.json (#16) * Update integration-manifest.json * Update generated docs --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * release: 1.3.0 --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * fixed sans issue passed to extension data (#23) * fixed sans issue passed to extension data * fixed change log --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> * 200dayfixes (#25) * chore: Update integration-manifest.json * Update integration-manifest.json * Update generated docs --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * Merge 1.3.1 to main Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * Merge 1.3.2 to main (#24) * chore: Update integration-manifest.json (#16) * Update integration-manifest.json * Update generated docs --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * release: 1.3.0 --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * fixed sans issue passed to extension data (#23) * fixed sans issue passed to extension data * fixed change log --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * Add FlowLogger and sync diagnostics for certificate metadata troubleshooting Port the FlowLogger workflow-tracing utility from the cscglobal-caplugin 200dayfixes branch and wire it into the plugin's Synchronize, Enroll, and GetSingleRecord operations to render step-by-step, timed flow diagrams to Trace logs. Add [SYNC-DIAG] instrumentation in GCPCASClient that, for every certificate handed to the AnyCA Gateway during sync, parses the PEM content and logs the fingerprint (thumbprint), NotBefore (as epoch ms), NotAfter, serial number, and subject - i.e. the exact metadata the Gateway must surface to Command on /v2/certificate/search and that the incremental sync gates on. Records whose content is null/empty or unparseable are flagged, pinpointing whether empty fingerprint / notBefore=0 values originate in the plugin. * Add net10.0 to target frameworks * Skip certs with gateway-unparseable subjects during sync During Synchronize, mirror the subject parsing the AnyCA Gateway performs when building its /v2/certificate/search response (new X509Name(true, netCert.Subject)). That call throws on subjects BouncyCastle cannot re-parse from .NET's string representation, which returns a 500 for the entire search page and aborts Command's CA sync. GatewayCanParseSubject runs the same parse on each certificate before it is added to the sync buffer. Certificates that would throw are skipped with a [SYNC-SKIP] warning and counted, so a single unparseable subject never lands in the gateway database and can never break the downstream Command sync. The gateway-side fix (try/catch or reading the subject from DER) will be handled separately. * update changelog --------- Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com> Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com> * fix: resolve merge conflict markers committed in 1.3.3 merge (#27) PR #26 squash-merged release-1.3 commit f4fbf10, which had been committed with unresolved conflict markers in CHANGELOG.md and GCPCASClient.cs, leaving main uncompilable (CS8300 x27). The intended resolution of every conflict block is the release-1.3 side, whose content is byte-identical to the 1.3.3 tag. Restore both files from the 1.3.3 tag. * fix: skip subjects the AnyCA Gateway cannot parse in sync guard (#30) GCP CAS will issue certificates whose subject is not valid RFC 4514 (e.g. a CN ending in a dangling backslash). The AnyCA Gateway parses the subject with BouncyCastle's X509Name on its /v2/certificate/search response; on such a subject that call throws 'badly formatted directory string', the search page 500s, and Command's Full Scan aborts. The 1.3.3 guard tried to pre-empt this by running the same X509Name parse locally, but the plugin bundled BouncyCastle 2.0.0, whose parser is lenient and never throws on these shapes - so they were admitted and still broke the downstream sync. Fix: pin BouncyCastle.Cryptography to 2.6.2, the same strict build the gateway uses (verified: it throws on exactly the shapes the gateway rejects, with the identical message spelling, and accepts valid escapes such as \HH hex and \, that the gateway accepts). The guard now faithfully reproduces the gateway's accept/reject decision - no structural heuristic and no assumptions about .NET escaping - so it skips only certs the gateway genuinely cannot parse and stops dropping valid ones. Skips are logged at error level and sync continues. The upgrade also clears the known BouncyCastle 2.0.0 security advisories. Tests: pure unit regression tests for the guard predicate, plus a sync-loop test (SyncSkipContinuationTests) that streams good/bad/good pages through DownloadAllIssuedCertificates via a fake CertificateAuthorityServiceClient and asserts the bad cert is skipped while the rest are buffered and the sync completes. Adds an internal test-only GCPCASClient constructor to inject the fake client, and a GCPCAS.Tests/README.md describing every test. This branch is based on release-1.3 and also drops the committed merge-conflict markers that release-1.3 carried in CHANGELOG.md and GCPCAS/Client/GCPCASClient.cs (same resolution as #27). --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
indrora
added a commit
that referenced
this pull request
Jul 30, 2026
* chore: Update integration-manifest.json (#16) * Update integration-manifest.json * Update generated docs --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * release: 1.3.0 --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * fixed sans issue passed to extension data (#23) * fixed sans issue passed to extension data * fixed change log --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> * 200dayfixes (#25) * chore: Update integration-manifest.json * Update integration-manifest.json * Update generated docs --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * Merge 1.3.1 to main Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * Merge 1.3.2 to main (#24) * chore: Update integration-manifest.json (#16) * Update integration-manifest.json * Update generated docs --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * release: 1.3.0 --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * fixed sans issue passed to extension data (#23) * fixed sans issue passed to extension data * fixed change log --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * Add FlowLogger and sync diagnostics for certificate metadata troubleshooting Port the FlowLogger workflow-tracing utility from the cscglobal-caplugin 200dayfixes branch and wire it into the plugin's Synchronize, Enroll, and GetSingleRecord operations to render step-by-step, timed flow diagrams to Trace logs. Add [SYNC-DIAG] instrumentation in GCPCASClient that, for every certificate handed to the AnyCA Gateway during sync, parses the PEM content and logs the fingerprint (thumbprint), NotBefore (as epoch ms), NotAfter, serial number, and subject - i.e. the exact metadata the Gateway must surface to Command on /v2/certificate/search and that the incremental sync gates on. Records whose content is null/empty or unparseable are flagged, pinpointing whether empty fingerprint / notBefore=0 values originate in the plugin. * Add net10.0 to target frameworks * Skip certs with gateway-unparseable subjects during sync During Synchronize, mirror the subject parsing the AnyCA Gateway performs when building its /v2/certificate/search response (new X509Name(true, netCert.Subject)). That call throws on subjects BouncyCastle cannot re-parse from .NET's string representation, which returns a 500 for the entire search page and aborts Command's CA sync. GatewayCanParseSubject runs the same parse on each certificate before it is added to the sync buffer. Certificates that would throw are skipped with a [SYNC-SKIP] warning and counted, so a single unparseable subject never lands in the gateway database and can never break the downstream Command sync. The gateway-side fix (try/catch or reading the subject from DER) will be handled separately. * update changelog --------- Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com> Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * fix: skip subjects with odd-length backslash runs in sync guard (#30) (#31) * Merge 1.3.3 to main (#26) * chore: Update integration-manifest.json (#16) * Update integration-manifest.json * Update generated docs --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * release: 1.3.0 --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * fixed sans issue passed to extension data (#23) * fixed sans issue passed to extension data * fixed change log --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> * 200dayfixes (#25) * chore: Update integration-manifest.json * Update integration-manifest.json * Update generated docs --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * Merge 1.3.1 to main Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * Merge 1.3.2 to main (#24) * chore: Update integration-manifest.json (#16) * Update integration-manifest.json * Update generated docs --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * release: 1.3.0 --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * fixed sans issue passed to extension data (#23) * fixed sans issue passed to extension data * fixed change log --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * Add FlowLogger and sync diagnostics for certificate metadata troubleshooting Port the FlowLogger workflow-tracing utility from the cscglobal-caplugin 200dayfixes branch and wire it into the plugin's Synchronize, Enroll, and GetSingleRecord operations to render step-by-step, timed flow diagrams to Trace logs. Add [SYNC-DIAG] instrumentation in GCPCASClient that, for every certificate handed to the AnyCA Gateway during sync, parses the PEM content and logs the fingerprint (thumbprint), NotBefore (as epoch ms), NotAfter, serial number, and subject - i.e. the exact metadata the Gateway must surface to Command on /v2/certificate/search and that the incremental sync gates on. Records whose content is null/empty or unparseable are flagged, pinpointing whether empty fingerprint / notBefore=0 values originate in the plugin. * Add net10.0 to target frameworks * Skip certs with gateway-unparseable subjects during sync During Synchronize, mirror the subject parsing the AnyCA Gateway performs when building its /v2/certificate/search response (new X509Name(true, netCert.Subject)). That call throws on subjects BouncyCastle cannot re-parse from .NET's string representation, which returns a 500 for the entire search page and aborts Command's CA sync. GatewayCanParseSubject runs the same parse on each certificate before it is added to the sync buffer. Certificates that would throw are skipped with a [SYNC-SKIP] warning and counted, so a single unparseable subject never lands in the gateway database and can never break the downstream Command sync. The gateway-side fix (try/catch or reading the subject from DER) will be handled separately. * update changelog --------- Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com> Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com> * fix: resolve merge conflict markers committed in 1.3.3 merge (#27) PR #26 squash-merged release-1.3 commit f4fbf10, which had been committed with unresolved conflict markers in CHANGELOG.md and GCPCASClient.cs, leaving main uncompilable (CS8300 x27). The intended resolution of every conflict block is the release-1.3 side, whose content is byte-identical to the 1.3.3 tag. Restore both files from the 1.3.3 tag. * fix: skip subjects the AnyCA Gateway cannot parse in sync guard (#30) GCP CAS will issue certificates whose subject is not valid RFC 4514 (e.g. a CN ending in a dangling backslash). The AnyCA Gateway parses the subject with BouncyCastle's X509Name on its /v2/certificate/search response; on such a subject that call throws 'badly formatted directory string', the search page 500s, and Command's Full Scan aborts. The 1.3.3 guard tried to pre-empt this by running the same X509Name parse locally, but the plugin bundled BouncyCastle 2.0.0, whose parser is lenient and never throws on these shapes - so they were admitted and still broke the downstream sync. Fix: pin BouncyCastle.Cryptography to 2.6.2, the same strict build the gateway uses (verified: it throws on exactly the shapes the gateway rejects, with the identical message spelling, and accepts valid escapes such as \HH hex and \, that the gateway accepts). The guard now faithfully reproduces the gateway's accept/reject decision - no structural heuristic and no assumptions about .NET escaping - so it skips only certs the gateway genuinely cannot parse and stops dropping valid ones. Skips are logged at error level and sync continues. The upgrade also clears the known BouncyCastle 2.0.0 security advisories. Tests: pure unit regression tests for the guard predicate, plus a sync-loop test (SyncSkipContinuationTests) that streams good/bad/good pages through DownloadAllIssuedCertificates via a fake CertificateAuthorityServiceClient and asserts the bad cert is skipped while the rest are buffered and the sync completes. Adds an internal test-only GCPCASClient constructor to inject the fake client, and a GCPCAS.Tests/README.md describing every test. This branch is based on release-1.3 and also drops the committed merge-conflict markers that release-1.3 carried in CHANGELOG.md and GCPCAS/Client/GCPCASClient.cs (same resolution as #27). --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
maindoes not compile:dotnet build GCPCAS.slnfails with 27 errors, mostlyCS8300: Merge conflict marker encountered.Commit
f4fbf10("Merge branch 'main' into release-1.3") was committed with unresolved conflict markers inCHANGELOG.mdandGCPCAS/Client/GCPCASClient.cs. PR #26 then squash-merged that ontomainasdf8c241, carrying the markers with it.Triage
git diff 1.3.3 mainis exactly the 13 marker lines — nothing else. Every conflict block resolves to therelease-1.3side:CHANGELOG.md:1GCPCASClient.cs:274skippedCertificatescounter already live in the non-conflicted regionGCPCASClient.cs:320[SYNC-DIAG]summary log — dropping it orphansskippedCertificatesGCPCASClient.cs:383caRequestId/pemlocals + diagnostics call — thereturnbelow already references those locals, so themainside cannot compileFix
Restore both files from the
1.3.3tag, whose content is byte-identical to the intended resolution. Diff is 13 deletions (the marker lines only).Verification
git grep '<<<<<<<'— no markers remaindotnet build GCPCAS.sln— 0 errors (was 27)dotnet test— 4 skipped (integration tests, gated on GCP env vars), 0 failedNote
origin/release-1.3still carries the markers at its tip (f4fbf10). It should get the same fix or be reset before anything else merges from it, or the markers will come back.