[CI] Ventura x64 Security tests fail with NoSuchKeyChain / InvalidHandle
- Dominant language
- C#
- Stars
- 2.9k
- Forks
- 576
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
## Failure signature
On the **M1 - Mac Ventura (13) macOS tests** job, the `macOS/osx-x64 monotouch-test` Security/Keychain tests fail together with `SecStatusCode.InvalidHandle`, PKCS#12 import failures, and key-generation failures. The matching system log contains repeated Security errors `NoSuchKeyChain` (`-25294`) and `InvalidHandle` (`-25304`).
**Classification:** CI infrastructure failure.
## Confirmed occurrences
| PR / head | Azure run / job | Evidence | Outcome |
|---|---|---|---|
| #26232 / `e094a26829c95306641819f4d16876738bf0507b` | [build 14730280, Ventura macOS tests](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=14730280&view=logs&jobId=e59aa738-7d46-5a5e-8f43-c6b31f5d2976) | 17 Security/Keychain failures; 290 `-25294` and 7 `-25304` log entries | Failed-job retry succeeded |
| #26414 / `349cd4737d1e7e0b4726779bb4e6ca561619cdae` | [build 14889519, attempt 1, Ventura macOS tests](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=14889519&view=logs&jobId=e59aa738-7d46-5a5e-8f43-c6b31f5d2976) | 15 failures including `GenerateKeyPairTest`, `AccessCertificates`, identity import, keychain add, and crypto tests; 989 `-25294` and 8 `-25304` log entries | Build still active; no retry submitted |
This is **2 confirmed occurrences across 2 monitored PRs**.
## Reproduction pattern and impact
The Ventura job runs both macOS architectures. The x64 `monotouch-test` process fails a cluster of otherwise unrelated Security APIs because the Keychain is unavailable or returns invalid handles. This causes the complete Ventura stage and PR simulator check to fail even though the PR changes are unrelated.
The #26414 job also has an independent arm64 600-second HTTP-suite timeout; that separate signature is tracked in #25687 and is not part of this issue.
## Investigation performed
- Inspected Azure build metadata and the first failed `Run tests` task.
- Read the TestSummary and HtmlReport output for both architectures.
- Correlated exact test names, `InvalidHandle` results, and Security error codes with the retained #26232 occurrence.
- Searched all open and closed issues separately for the stable signature, exact test names, `InvalidHandle`, `NoSuchKeyChain`, `-25294`, and Security/Keychain terms. No matching issue was found; #25299 appeared only through an unrelated PR-number text match.
## Observation window
- First observed: `2026-07-22T10:41:16Z`
- Latest observed: `2026-08-06T07:01:41Z`
## Workaround
A failed-job rerun cleared the #26232 occurrence. For #26414, no retry is permitted until build 14889519 is terminal and the normal merge, head, budget, and equivalent-run gates are refreshed.
Azure diagnostic artifacts are retention-limited; links and only the minimal stable diagnostic lines are recorded here.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the Azure build metadata and the first failed Run tests task for the Ventura macOS tests job. Compare TestSummary and HtmlReport output for the x64 monotouch-test Security/Keychain failures with the retained #26232 occurrence, and review the system-log codes -25294 and -25304. Done means the Ventura stage no longer fails from this signature across retries or monitored PRs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp, macos
- Domain
- ci-cd, devops, security, testing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100