Strong naming signing fails on Azure Linux 4.0

[martincostello]

Describe the bug

After #7288 was fixed, I updated two test jobs with have in the OpenTelemetry .NET SDK that use Azure Linux to use the new Azure Linux 4.0 images: open-telemetry/opentelemetry-dotnet@0ae525b.

These jobs fail with the following error:

#14 5.048 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.RuntimeIdentifierInference.targets(385,5): message NETSDK1057: You are using a preview version of .NET. See: https://aka.ms/dotnet-support-policy [/repo/test/OpenTelemetry.Instrumentation.W3cTraceContext.Tests/OpenTelemetry.Instrumentation.W3cTraceContext.Tests.csproj::TargetFramework=net10.0]
#14 6.194 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.RuntimeIdentifierInference.targets(385,5): message NETSDK1057: You are using a preview version of .NET. See: https://aka.ms/dotnet-support-policy [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error : Unhandled exception. Interop+Crypto+OpenSslCryptographicException: error:03000098:digital envelope routines::invalid digest [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Interop.Crypto.RsaSignHash(SafeEvpPKeyHandle pkey, RSASignaturePaddingMode paddingMode, HashAlgorithmName digestAlgorithm, ReadOnlySpan`1 hash, Span`1 destination) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at System.Security.Cryptography.RSAOpenSsl.SignHash(Byte[] hash, HashAlgorithmName hashAlgorithm, RSASignaturePadding padding) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.SigningUtilities.CalculateRsaSignature(IEnumerable`1 content, RSAParameters privateKey) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.DesktopStrongNameProvider.<>c__DisplayClass12_0.<SignBuilder>b__0(IEnumerable`1 content) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at System.Reflection.PortableExecutable.PEBuilder.Sign(BlobBuilder peImage, Blob strongNameSignatureFixup, Func`2 signatureProvider) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.Cci.PeWriter.WritePeToStream(EmitContext context, CommonMessageProvider messageProvider, Func`1 getPeStream, Func`1 getPortablePdbStreamOpt, PdbWriter nativePdbWriterOpt, String pdbPathOpt, Boolean metadataOnly, Boolean isDeterministic, Boolean emitTestCoverageData, Nullable`1 privateKeyOpt, CancellationToken cancellationToken) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.Compilation.SerializePeToStream(CommonPEModuleBuilder moduleBeingBuilt, DiagnosticBag metadataDiagnostics, CommonMessageProvider messageProvider, Func`1 getPeStream, Func`1 getMetadataPeStreamOpt, Func`1 getPortablePdbStreamOpt, PdbWriter nativePdbWriterOpt, String pdbPathOpt, RebuildData rebuildData, Boolean metadataOnly, Boolean includePrivateMembers, Boolean isDeterministic, Boolean emitTestCoverageData, Nullable`1 privateKeyOpt, CancellationToken cancellationToken) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.Compilation.SerializeToPeStream(CommonPEModuleBuilder moduleBeingBuilt, EmitStreamProvider peStreamProvider, EmitStreamProvider metadataPEStreamProvider, EmitStreamProvider pdbStreamProvider, RebuildData rebuildData, Func`2 testSymWriterFactory, DiagnosticBag diagnostics, EmitOptions emitOptions, Nullable`1 privateKeyOpt, CancellationToken cancellationToken) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.CommonCompiler.CompileAndEmit(TouchedFileLogger touchedFilesLogger, Compilation& compilation, ImmutableArray`1 analyzers, ImmutableArray`1 generators, ImmutableArray`1 additionalTextFiles, AnalyzerConfigSet analyzerConfigSet, ImmutableArray`1 sourceFileAnalyzerConfigOptions, ImmutableArray`1 embeddedTexts, DiagnosticBag diagnostics, ErrorLogger errorLogger, CancellationToken cancellationToken, CancellationTokenSource& analyzerCts, AnalyzerDriver& analyzerDriver, Nullable`1& generatorTimingInfo) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.CommonCompiler.<RunCore>g__compileAndReport|73_0(<>c__DisplayClass73_0&) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.CommonCompiler.RunCore(TextWriter consoleOutput, ErrorLogger errorLogger, CancellationToken cancellationToken) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.CommonCompiler.Run(TextWriter consoleOutput, CancellationToken cancellationToken) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.CSharp.CommandLine.Csc.Run(String[] args, BuildPaths buildPaths, TextWriter textWriter, IAnalyzerAssemblyLoader analyzerLoader) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.CommandLine.BuildClient.RunCompilation(IEnumerable`1 originalArguments, BuildPaths buildPaths, TextWriter textWriter, String pipeName) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.CommandLine.BuildClient.Run(IEnumerable`1 arguments, RequestLanguage language, CompileFunc compileFunc, CompileOnServerFunc compileOnServerFunc, ICompilerServerLogger logger) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.CSharp.CommandLine.Program.MainCore(String[] args) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.CSharp.CommandLine.Program.Main(String[] args) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
#14 ERROR: process "/bin/sh -c dotnet publish \"OpenTelemetry.Instrumentation.W3cTraceContext.Tests.csproj\" -c \"${PUBLISH_CONFIGURATION}\" -f \"${PUBLISH_FRAMEWORK}\" -o /drop -p:IntegrationBuild=true" did not complete successfully: exit code: 1
------
 > [build 4/5] RUN dotnet publish "OpenTelemetry.Instrumentation.W3cTraceContext.Tests.csproj" -c "Release" -f "net10.0" -o /drop -p:IntegrationBuild=true:
19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.Compilation.SerializeToPeStream(CommonPEModuleBuilder moduleBeingBuilt, EmitStreamProvider peStreamProvider, EmitStreamProvider metadataPEStreamProvider, EmitStreamProvider pdbStreamProvider, RebuildData rebuildData, Func`2 testSymWriterFactory, DiagnosticBag diagnostics, EmitOptions emitOptions, Nullable`1 privateKeyOpt, CancellationToken cancellationToken) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.CommonCompiler.CompileAndEmit(TouchedFileLogger touchedFilesLogger, Compilation& compilation, ImmutableArray`1 analyzers, ImmutableArray`1 generators, ImmutableArray`1 additionalTextFiles, AnalyzerConfigSet analyzerConfigSet, ImmutableArray`1 sourceFileAnalyzerConfigOptions, ImmutableArray`1 embeddedTexts, DiagnosticBag diagnostics, ErrorLogger errorLogger, CancellationToken cancellationToken, CancellationTokenSource& analyzerCts, AnalyzerDriver& analyzerDriver, Nullable`1& generatorTimingInfo) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
19.97 /usr/share/dotnet/sdk/11.0.100-preview.6.26359.118/Roslyn/Microsoft.CSharp.Core.targets(97,5): error :    at Microsoft.CodeAnalysis.CommonCompiler.<RunCore>g__compileAndReport|73_0(<>c__DisplayClass73_0&) [/repo/src/OpenTelemetry.Api/OpenTelemetry.Api.csproj::TargetFramework=net10.0]
Dockerfile:21

It looks like some sort of image/OpenSSL configuration that forbids SHA-1?

Which .NET image(s) are you using?

mcr.microsoft.com/dotnet/sdk:11.0.100-preview.6-azurelinux4.0@sha256:4fae6b560baea20005499293fcb98ce6cdfd682cf3121e6f618d4a52666454d0

Steps to reproduce

1. Clone and checkout open-telemetry/opentelemetry-dotnet@0ae525b
2. Run docker compose --file=test/OpenTelemetry.Instrumentation.W3cTraceContext.Tests/docker-compose.yml "--file=build/docker-compose.net11.0.yml" --project-directory=. up --exit-code-from=tests --build

Other information

No response

Output of docker version

Output of docker info

[martincostello]

Was able to work around the issue with <PublicSign>true</PublicSign>.

[martincostello]

If this is "by design" that's fine, but I guess it will need documenting somewhere as a breaking change?

[lbussell]

@richlander @jperrin - potential issue with crypto on Azure Linux 4? Should I transfer this to the Runtime repo?

[lbussell]

@martincostello - please try running your build command with OPENSSL_ENABLE_SHA1_SIGNATURES=1.

[martincostello]

@lbussell That also fixes it.

[lbussell]

The reason this happens is because RHEL/Fedora based distros disable RSA/SHA-1 (Azure Linux 4 is based on Fedora). SHA-1 is the only algorithm that strong name signing supports. There's a lengthy related discussion here: dotnet/runtime#65874

I imagine more apps will hit this as we transition to Azure Linux 4. We'll leave this issue open until we have better guidance or until changes are made somewhere in the stack.