Permalink
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
- 20 commits
- 49 files changed
- 6 contributors
Commits on Jan 28, 2025
Commits on Jan 31, 2025
-
Build identity service in CI pipeline (#7412)
Currently, we do not build the identity service as part of the Build CI pipeline. When we need identity service packages, e.g., in most of our test pipelines, we get them from the GitHub Actions pipeline that runs in the Azure/iot-identity-service repo. We have a script to grab the packages, and it relies on a GitHub person access token (PAT) for authentication. In an effort to meet stricter security requirements that will soon be enforced, we want to eliminate PAT usage wherever possible. This change reduces GitHub PAT usage in our test pipelines by building identity service packages directly in the Build CI pipeline and saving them as artifacts for consumption by downstream pipelines. Also, the scripts under the platform-validation/ folder belong to a feature that was not completed and is not supported. Rather than upgrade the pipelines associated with these scripts (which also are not being used), we are removing them. To test, I ran the Build CI pipeline against these changes and confirmed it generated all the expected artifacts. Then I ran the following pipelines using those artifacts, and confirmed that all jobs passed: - End-to-end tests - Nested end-to-end tests - Connectivity tests - ISA-95 smoke tests ## Azure IoT Edge PR checklist:
Commits on Feb 12, 2025
Commits on Feb 13, 2025
-
Use a different agent to build .NET (#7421)
We recently removed .NET 6.0 from all but one of our build agent images, because it is no longer supported. We kept it on agent-aziotedge-ubuntu-20.04-msmoby because we still have a dependency on .NET 6 for our Azure Functions module. This change updates the agent we use when building .NET (6 and 8) to agent-aziotedge-ubuntu-20.04-msmoby, so that the build pipeline will continue to work following the agent updates described earlier. I also changed other instances of agent-aziotedge-ubuntu-20.04-docker in the same file because Ubuntu 20.04 will soon reach end-of-life so this gives us a head start on migrating away from that version. But the bulk of the work to migrate away from Ubuntu 20.04 will go into a separate change. To test, I ran the Build CI pipeline against these changes and confirmed that the .NET build passes. ## Azure IoT Edge PR checklist:
Commits on Feb 15, 2025
Commits on Feb 20, 2025
-
Add support for Azure Linux 3.0 (#7418)
This change adds support for building and testing IoT Edge for Azure Linux 3.0. To test, I confirmed that the CI build passes, and that the right artifacts are produced. I also ran the end-to-end tests pipeline and confirmed that the Mariner and Azure Linux jobs (x64 and arm64) ran and passed. ## Azure IoT Edge PR checklist:
Commits on Feb 24, 2025
-
Fix SimulatedTemperatureSensor Module Status Issues on Stop command (#…
…7420) Issue description: **Expected Behavior** When changing the module status from Running to Stopped via the Azure portal, the module on the device should stop successfully. **Actual Behavior** After setting the module to Stopped, running sudo iotedge list shows the SimulatedTemperatureSensor module in a Failed (139) state instead of Stopped. **Fix: ** This pull request addresses the issues causing the SimulatedTemperatureSensor module to fail with exit code 139 when it receives a stop command from the Azure portal. Initially, the SimulatedTemperatureSensor module encountered exit code 139 due to improper handling of task cancellations, leading to a segmentation fault. To address this, handling for TaskCanceledException was added in the SendEvents method to log a message when the task is canceled. Changes made: - Added handling for TaskCanceledException in the SendEvents method to log a message when the task is canceled. - Setting the Environment.ExitCode to 0 indicating the successful exit. - Replacing the Console statements with logger. These changes address the issues causing the SimulatedTemperatureSensor module to fail with exit codes 139 and 143, ensuring the module transitions to the stopped state correctly.  ## Azure IoT Edge PR checklist:
Commits on Mar 1, 2025
-
Fix: Issue7388 - TLS auth failed due to unsupported Ephemeral keys (#…
…7424) Co-authored-by: Tanmay Yerunkar <tyerunkar@microsoft.com>
Commits on Mar 6, 2025
-
Fix iotedged checkin pipeline (#7426)
Within the last few days the itoedged checkin pipeline has started failing in the code coverage job. I'm not sure what changed with rust or cargo or the cargo-tarpaulin tool, but the tool is no longer happy with the environment. I was able to fix it by sourcing the cargo environment instead of manually setting `CARGO="${CARGO_HOME:-"$HOME/.cargo"}/bin/cargo"`. ## Azure IoT Edge PR checklist: -
Fix: Enhance JSON Deserialization Security - Mitigate TypeNameHandlin…
…g Vulnerability (#7423) [Bug 30973440](https://msazure.visualstudio.com/One/_workitems/edit/30973440) and [Bug 30973442](https://msazure.visualstudio.com/One/_workitems/edit/30973442) CodeQL issue: https://liquid.microsoft.com/codeql/issues/621b3860-9992-462a-8a9d-0a24593f51a5?copilot_promptid=E91B0CE9-0C1B-4AC2-8A46-33F49B67E058 This commit addresses a potential security vulnerability **within our test code and infrastructure** related to JSON deserialization by enhancing the type handling mechanism. **Issue:** The previous deserialization configuration was using `TypeNameHandling.Auto` in Newtonsoft.Json. `TypeNameHandling.Auto` allows for automatic deserialization of types based on `$type` metadata embedded in the JSON. If an attacker can control the JSON input, they can potentially inject malicious `$type` properties to instantiate arbitrary types, leading to Remote Code Execution (RCE) vulnerabilities. This is related to our test infrastructure, so the potential security impact does not include production code running on customers' devices **Fix Implemented:** To mitigate this risk, the following changes have been made: 1. **Disabled Automatic Type Name Handling (`TypeNameHandling.None`):** - The `TypeNameHandling` setting in `JsonSerializerSettings` has been explicitly set to `TypeNameHandling.None`. - This is because the serialized JSON in our use case does not include `$type` metadata. Setting `TypeNameHandling.None` ensures that automatic `$type` processing is completely disabled, further enhancing security. 2. **Implemented Secure Deserialization with KnownTypes Whitelist:** - Updated TypeNameSerializationBinder binder to utilize a `KnownTypes` whitelist, explicitly defining the set of allowed types that can be deserialized. - The deserializer is now configured to use this `SerializationBinder`, ensuring that only types present in the `KnownTypes` whitelist are permitted for deserialization. This significantly restricts the attack surface and prevents the instantiation of unauthorized or potentially malicious types. - This approach aligns with secure deserialization best practices and follows the guidance outlined in: [https://liquid.microsoft.com/Web/Object/Read/MS.Security/Requirements/Microsoft.Security.SystemsADM.10010#Zguide](https://liquid.microsoft.com/Web/Object/Read/MS.Security/Requirements/Microsoft.Security.SystemsADM.10010#Zguide) and recommendation: Solution using custom ISerializationBinder: [https://liquid.microsoft.com/Web/Object/Read/ScanningToolWarnings/Requirements/CodeQL.SM02211#Zguide](https://liquid.microsoft.com/Web/Object/Read/ScanningToolWarnings/Requirements/CodeQL.SM02211#Zguide) **Tested the changes in the local:**  **References:** https://liquid.microsoft.com/Web/Object/Read/ScanningToolWarnings/Requirements/CodeQL.SM02211#Zguide https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca2326 https://liquid.microsoft.com/Web/Object/Read/MS.Security/Requirements/Microsoft.Security.SystemsADM.10010#Zguide ## Azure IoT Edge PR checklist:
-
Remove use of rust-musl-builder image from API Proxy build.sh (#7390)
Resolves #7368 Replaces use of ekidd/rust-musl-builder with cross-platform-rust-build.sh. This fixes errors that occur when build.sh runs (i.e. the OS Error 13 that occurs when attempting to create a tmp file to /opt/rust/rustup). This change was tested on an ubuntu 20.04 dev machine by setting the ARCH env var to amd64 and running build.sh. This resulted in the azureiotedge-api-proxy image building successfully locally without any errors. ## Azure IoT Edge PR checklist:
Commits on Mar 11, 2025
-
Upgrade Ubuntu 20.04 agents (#7425)
Ubuntu 20.04 will be out of support soon (May 2025). This PR upgrades most of our build/test agents to 24.04 (22.04 in the case of building Mariner) to ensure the agents are supported and secure. To test, I ran all the affected pipelines and ensured they behaved properly with the newer agents. ## Azure IoT Edge PR checklist:
Commits on Mar 12, 2025
Commits on Mar 25, 2025
-
Clean up images when nested pipelines complete (#7431)
This change impacts the the Nested End-to-end Tests and ISA-95 Smoke Test pipelines. It deletes Docker containers and images when the pipelines complete so they don't hang around on the custom pipeline agent and potentially trigger warnings during vulnerability scans. Note that, for the ISA-95 Smoke Test pipeline, I had to move the network unlock logic to a new location. The new logic to clean images needs to reacquire the custom L3/L4/L5 agents, however I found that the Azure Pipelines service lost it's connection to the agents so it couldn't assign them jobs unless I unlocked the network first. This actually makes more sense anyway; the Run_ISA95_test job starts by locking the network and ends by unlocking it. It's more symmetric now. I also found that two expected variables in the Clean_up_identities job of the ISA-95 Smoke Test pipeline were never being set, so the level 3 identity was never cleaned up (the test IoT hub had a whole bunch of stale identities hanging around). I made updates to set the variables. To test, I ran the Nested End-to-end Tests and ISA-95 Smoke Test pipelines and confirmed that (1) they passed, and (2) the images were removed from the agents. ## Azure IoT Edge PR checklist:
There are no files selected for viewing
This file was deleted.