dotnet / dotnet/macios

[CI] Ventura x64 Security tests fail with NoSuchKeyChain / InvalidHandle

Open
#26,416 4 comments 0 reactions 0 assignees View on GitHub
ci-failure ci-postmortem tests
Dominant language
C#
Stars
2.9k
Forks
576
Avg merge
2d 13h
Merged PRs (30d)
96

Description

## Failure signature

On the **M1 - Mac Ventura (13) macOS tests** job, the `macOS/osx-x64 monotouch-test` Security/Keychain tests fail together with `SecStatusCode.InvalidHandle`, PKCS#12 import failures, and key-generation failures. The matching system log contains repeated Security errors `NoSuchKeyChain` (`-25294`) and `InvalidHandle` (`-25304`).

**Classification:** CI infrastructure failure.

## Confirmed occurrences

| PR / head | Azure run / job | Evidence | Outcome |
|---|---|---|---|
| #26232 / `e094a26829c95306641819f4d16876738bf0507b` | [build 14730280, Ventura macOS tests](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=14730280&view=logs&jobId=e59aa738-7d46-5a5e-8f43-c6b31f5d2976) | 17 Security/Keychain failures; 290 `-25294` and 7 `-25304` log entries | Failed-job retry succeeded |
| #26414 / `349cd4737d1e7e0b4726779bb4e6ca561619cdae` | [build 14889519, attempt 1, Ventura macOS tests](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=14889519&view=logs&jobId=e59aa738-7d46-5a5e-8f43-c6b31f5d2976) | 15 failures including `GenerateKeyPairTest`, `AccessCertificates`, identity import, keychain add, and crypto tests; 989 `-25294` and 8 `-25304` log entries | Build still active; no retry submitted |

This is **2 confirmed occurrences across 2 monitored PRs**.

## Reproduction pattern and impact

The Ventura job runs both macOS architectures. The x64 `monotouch-test` process fails a cluster of otherwise unrelated Security APIs because the Keychain is unavailable or returns invalid handles. This causes the complete Ventura stage and PR simulator check to fail even though the PR changes are unrelated.

The #26414 job also has an independent arm64 600-second HTTP-suite timeout; that separate signature is tracked in #25687 and is not part of this issue.

## Investigation performed

- Inspected Azure build metadata and the first failed `Run tests` task.
- Read the TestSummary and HtmlReport output for both architectures.
- Correlated exact test names, `InvalidHandle` results, and Security error codes with the retained #26232 occurrence.
- Searched all open and closed issues separately for the stable signature, exact test names, `InvalidHandle`, `NoSuchKeyChain`, `-25294`, and Security/Keychain terms. No matching issue was found; #25299 appeared only through an unrelated PR-number text match.

## Observation window

- First observed: `2026-07-22T10:41:16Z`
- Latest observed: `2026-08-06T07:01:41Z`

## Workaround

A failed-job rerun cleared the #26232 occurrence. For #26414, no retry is permitted until build 14889519 is terminal and the normal merge, head, budget, and equivalent-run gates are refreshed.

Azure diagnostic artifacts are retention-limited; links and only the minimal stable diagnostic lines are recorded here.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the Azure build metadata and the first failed Run tests task for the Ventura macOS tests job. Compare TestSummary and HtmlReport output for the x64 monotouch-test Security/Keychain failures with the retained #26232 occurrence, and review the system-log codes -25294 and -25304. Done means the Ventura stage no longer fails from this signature across retries or monitored PRs.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, macos
Domain
ci-cd, devops, security, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.