Red Hat's wishlist for 2026

This is a collection of issues and areas that we would like to see improved in .NET in 2026.

This is a follow-up from https://github.com/dotnet/source-build/issues/4697

## Document .NET's behaviour running on FIPS-enabled systems

Status: In Progress

Issue: https://github.com/dotnet/docs/issues/41565 (maybe more issues)

The document at https://learn.microsoft.com/en-us/dotnet/standard/security/fips-compliance describes the general behaviour of .NET in FIPS-enabled systems. We would like to have enhanced documentation that includes more details about that behaviour, including how .NET behaves when running on FIPS-enabled operating systems and known exceptions where .NET bypasses the FIPS policy explicitly.

This is **not** about certifying or modifying .NET for FIPS, only documenting the current behaviour in more detial.

## Minimize differences between different builds of .NET 11

Status: In Progress

Issue: https://github.com/dotnet/source-build/issues/4010

This includes both how the product is built, and what product is built.

Thanks to the amazing work of folks who created the VMR, everyone (Microsoft and source-build) is now building out of the same repository and branch and even commit! This is fantastic, and was unthinkable even just a few years ago. We would still like to minimize the differences in the built SDK between the builds of .NET.

There is are known differences between the contents of the generated SDK, such workloads (https://github.com/dotnet/source-build/issues/3242) as which files are in the SDK (see [the baseline diff](https://github.com/dotnet/dotnet/blob/main/test/Microsoft.DotNet.SourceBuild.Tests/assets/SdkContentTests/MsftToSbSdkFiles.diff)) as well as contents of the files (eg, optimization levels, or the .NET TFMs they are targeting).

## Post Quantum Cryptography for .NET

Status: Complete

Issue: N/A

.NET 10 got initial support for PQC in various API. We would like to understand what is planned for PQC in .NET 11, and what .NET would look like if only PQC algorithms were enabled/available.

2026-06-02 Update: We consider this work complete for now. There's several enhancements that are being tracked elsewhere, but not urgent/required from our side for now.

## Reproducible builds of .NET

Status: In Progress

Issue: https://github.com/dotnet/source-build/issues/4963

We would like .NET's builds to be reproducible to improve .NET's security stance, increasing user trust, making an entire class of supply chain attacks much harder, and making it easier to comply with various auditing and compliance requirements.

## Finished/polished user story for sources, binaries and symbols for debugging.

Status: Complete

Issue: https://github.com/dotnet/source-build/issues/3225

We would like for users using .NET tools (like VSCode) to be able to build/debug their .NET applications using a source-build SDK, and have the same experience.

We want to make sure any customers running .NET workloads in production can use standard tools like dotnet-dump (and others suggested by Microsoft support) against .NET running on RHEL and containers.