Allow using server authentication cert config in runtime WithContainerFiles callbacks, fix MacOS keychain access spam with dev cert by danegsta · Pull Request #13151 · microsoft/aspire

danegsta · 2025-11-24T01:15:25Z

Description

Adds a new ServerAuthenticationCertificateContext property to the WithContainerFiles callback API context that can be used to include server authentication specific properties (path to the key file, pfx file, etc.) in configuration files if required.
Caches ASP.NET development certificate on MacOS to avoid constant keychain access prompting
Avoids having to write a temporary version of the pfx file for copying into a container (this depends on a DCP update to allow specifying a binary file as a base64 encoded string)
Adds new DistributedApplicationOptions and environment variable flags to disable using the dev cert for server authentication by default, independent of the certificate trust feature

Fixes #13137
Implements #13040

…back context

…ertConfig

…g, avoid excessive keychain access prompts on Mac

…ting

github-actions · 2025-11-24T01:15:35Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 13151

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 13151"

danegsta · 2025-11-24T01:17:22Z

I've applied the no merge label as one change in this PR depends on a DCP change that'll need to be merged first, otherwise pfx based certs won't work in containers.

Copilot

Pull request overview

This PR adds support for using server authentication certificate configuration in runtime WithContainerFiles callbacks and fixes MacOS keychain access spam by caching the development certificate. The changes introduce a new API context property, improve certificate caching, and add configuration options to disable dev cert usage independently of certificate trust.

Key Changes:

Adds ServerAuthenticationCertificateContext property to ContainerFileSystemCallbackContext for accessing certificate paths in container file generation callbacks
Implements MacOS-specific caching of ASP.NET development certificate key material to avoid repeated keychain prompts
Introduces new configuration flags (UseDeveloperCertificateForServerAuthentication) to control dev cert usage for server authentication independently of trust settings

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 17 comments.

Show a summary per file

File	Description
`src/Shared/KnownConfigNames.cs`	Adds new environment variable constant for server authentication configuration
`src/Aspire.Hosting/IDeveloperCertificateService.cs`	Renames property to `UseForServerAuthentication` for clarity
`src/Aspire.Hosting/DistributedApplicationOptions.cs`	Adds new option for controlling dev cert usage for server authentication
`src/Aspire.Hosting/DeveloperCertificateService.cs`	Implements new property with configuration priority logic
`src/Aspire.Hosting/Dcp/Model/Container.cs`	Adds `RawContents` field for base64-encoded binary file content
`src/Aspire.Hosting/Dcp/DcpExecutor.cs`	Major refactor: implements certificate caching, removes temp PFX files, adds MacOS keychain cache
`src/Aspire.Hosting/ApplicationModel/X509CertificateResource.cs`	New experimental resource type for X.509 certificates
`src/Aspire.Hosting/ApplicationModel/ResourceExtensions.cs`	Refactors to use new `ServerAuthenticationCertificateConfigurationDetails` class
`src/Aspire.Hosting/ApplicationModel/ReferenceExpression.cs`	Adds `WasResolved` tracking to detect reference usage
`src/Aspire.Hosting/ApplicationModel/ExpressionResolver.cs`	Sets `WasResolved` flag during expression evaluation
`src/Aspire.Hosting/ApplicationModel/ContainerFileSystemCallbackAnnotation.cs`	Adds new context class for server authentication certificate paths
`src/Aspire.Hosting.Yarp/YarpResourceExtensions.cs`	Updates to use renamed service property
`src/Aspire.Hosting.Redis/RedisBuilderExtensions.cs`	Updates to use renamed service property
`src/Aspire.Hosting.Python/PythonAppResourceBuilderExtensions.cs`	Updates to use renamed service property
`src/Aspire.Hosting.Keycloak/KeycloakResourceBuilderExtensions.cs`	Updates to use renamed service property

src/Aspire.Hosting/ApplicationModel/ContainerFileSystemCallbackAnnotation.cs

src/Aspire.Hosting/Dcp/Model/Container.cs

src/Aspire.Hosting/DeveloperCertificateService.cs

src/Aspire.Hosting/DistributedApplicationOptions.cs

src/Aspire.Hosting/ApplicationModel/X509CertificateResource.cs

src/Aspire.Hosting/Dcp/Model/Container.cs

src/Aspire.Hosting/ApplicationModel/ContainerFileSystemCallbackAnnotation.cs

src/Aspire.Hosting/ApplicationModel/X509CertificateResource.cs

src/Aspire.Hosting/Dcp/DcpExecutor.cs

danegsta · 2025-11-25T01:33:29Z

#13186 was merged with the path fixes and support for copying pfx files to containers via base64 encoded strings in the resource config instead of requiring temporary files.

…ertConfig

davidfowl · 2025-11-25T06:43:28Z

Works like a charm!

davidfowl · 2025-11-25T06:44:12Z

src/Aspire.Hosting/ApplicationModel/ReferenceExpression.cs

+    /// <summary>
+    /// Indicates whether this expression was ever referenced to get its value.
+    /// </summary>
+    internal bool WasResolved { get; set; }


Why do we need this?

I’m only generating key material that’s actually reference; if no resource actually references the pfx or pem key, I’m not exporting them. I’m using this to check the usage.

I dont like it, can we put it outside of the reference expression.

Other option (without making the API weird) would be a custom IValueProvider

davidfowl · 2025-11-25T06:47:22Z

src/Aspire.Hosting/Dcp/DcpExecutor.cs

    private static readonly TimeSpan s_disposeTimeout = TimeSpan.FromSeconds(10);

+    // Well-known location on disk where dev-cert key material is cached.
+    private static readonly string s_macOSUserDevCertificateLocation = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".aspire", "dev-certs", "https");


This is why I am doing that folders PR, to avoid code like this spreading 😄

Yeah, it’ll be nice to have a central service for this.

davidfowl · 2025-11-25T06:48:37Z

Are we going to need docs to tell people to set ASPIRE_DEVELOPER_CERTIFICATE_DEFAULT_SERVER_AUTHENTICATION on mac if you are doing CI?

danegsta · 2025-11-25T16:36:42Z

Are we going to need docs to tell people to set ASPIRE_DEVELOPER_CERTIFICATE_DEFAULT_SERVER_AUTHENTICATION on mac if you are doing CI?

Yes, amongst all the rest of the new API that was added. I’ll open a docs issue to expand on the current certificates docs from 13.0.

danegsta added 4 commits November 21, 2025 15:09

Expose runtime certificate properties in WithContainerFileSystem call…

d06fc0f

…back context

Merge remote-tracking branch 'upstream/main' into danegsta/fileBasedC…

ef6b320

…ertConfig

Support using WithContainerFiles for server authentication cert confi…

64a4219

…g, avoid excessive keychain access prompts on Mac

Cache dev cert private keys on Mac to prevent constant keychain promp…

e453337

…ting

danegsta requested review from DamianEdwards, Copilot and davidfowl November 24, 2025 01:15

Copilot started reviewing on behalf of danegsta November 24, 2025 01:15 View session

danegsta added the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label Nov 24, 2025

Copilot finished reviewing on behalf of danegsta November 24, 2025 01:18

Copilot AI reviewed Nov 24, 2025

View reviewed changes

danegsta added 5 commits November 23, 2025 17:37

Simplify cache to only cover MacOS

64bffd2

Remove X509CertificateResource

540e423

Improve doc comments

51053cd

Ensure the booleans are evaluated correctly

e97c4f5

Fix test issues

9ecbc62

danegsta requested review from eerhardt, mitchdenny and radical as code owners November 24, 2025 02:56

Update compatibility suppression file

820d7b8

danegsta mentioned this pull request Nov 25, 2025

Use DevCert for SQL Server #13131

Open

9 tasks

danegsta removed the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label Nov 25, 2025

danegsta added 2 commits November 24, 2025 17:38

Merge remote-tracking branch 'upstream/main' into danegsta/fileBasedC…

42f6377

…ertConfig

Attempt to skip test requiring keychain access on MacOS

1f256d3

davidfowl approved these changes Nov 25, 2025

View reviewed changes

davidfowl merged commit b521f51 into microsoft:main Nov 25, 2025
295 checks passed

dotnet-policy-service bot added this to the 13.1 milestone Nov 25, 2025

davidfowl reviewed Nov 25, 2025

View reviewed changes

github-actions bot locked and limited conversation to collaborators Dec 26, 2025

Conversation

danegsta commented Nov 24, 2025

Description

Uh oh!

github-actions bot commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

danegsta commented Nov 24, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

danegsta commented Nov 25, 2025

Uh oh!

davidfowl commented Nov 25, 2025

Uh oh!

Uh oh!

davidfowl Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

danegsta Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

davidfowl Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

danegsta Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

davidfowl Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

danegsta Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

davidfowl commented Nov 25, 2025

Uh oh!

danegsta commented Nov 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Nov 24, 2025 •

edited

Loading