MLDsaOpenSsl + tests

[krwq]

Contributes to: #113502

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[ghost]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[Copilot]

Copilot reviewed 15 out of 18 changed files in this pull request and generated no comments.

Files not reviewed (3)

• src/libraries/System.Security.Cryptography/src/Resources/Strings.resx: Language not supported
• src/libraries/System.Security.Cryptography/src/System.Security.Cryptography.csproj: Language not supported
• src/libraries/System.Security.Cryptography/tests/System.Security.Cryptography.Tests.csproj: Language not supported

Comments suppressed due to low confidence (1)

src/native/libs/System.Security.Cryptography.Native/pal_evp_pkey_ml_dsa.h:8

• Consider aligning the native enum name with the managed interop naming (e.g. 'PalMLDsaAlgorithmId' instead of 'PalMLDsaId') to improve clarity and reduce potential confusion between layers.

typedef enum

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[bartonjs]

#114471 is adding a few TODOs regarding MLDsaOpenSsl's future existence. Assuming it's merged before you iterate on this, consider trying to address them in this PR. But if that feels like too much scope creep, it can be a followup.

[vcsjones]

Merge branch 'main'

Sorry. That was a fat-finger :-/

[krwq]

I rebased again: first to remove @vcsjones's commit, second to make sure I don't conflict with #114471 but there were no merge related changes and only last two commits can be reviewed (first to address feedback here, second to address #114471 TODOs.

[bartonjs]

@vcsjones I don't see a way for me to trigger a 3.5 run. Would you mind?

[PranavSenthilnathan]

@vcsjones-bot test 727a0bc with openssl-3.5

[vcsjones]

@vcsjones-bot test 727a0bc with openssl-3.5

[vcsjones]

The bot ignores everyone except for me, for now. Will work on that later.

[vcsjones]

The results will be here https://github.com/vcsjones/runtime-ci/actions/runs/14414503783

[bartonjs]

Looks like the new tests are all happy in https://github.com/vcsjones/runtime-ci/actions/runs/14414503783.

[krwq]

failures look unrelated, merging

[MichalStrehovsky]

@krwq I believe this is breaking native AOT outerloop runs on all linux flavors with:

ld.lld(0,0): error : (NETCORE_ENGINEERING_TELEMETRY=Build) undefined symbol: CryptoNative_MLDsaImportSecretKey
ld.lld(0,0): error : (NETCORE_ENGINEERING_TELEMETRY=Build) undefined symbol: CryptoNative_MLDsaImportPublicKey

Sample: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1019203&view=logs&jobId=7e7cde7f-4669-5f41-976b-370a74291e60

Searching through the repo, I see we have a LibraryImport for these APIs, but I can't seem to find an implementation. It's not clear to me why it's not failing on CoreCLR - the only plausible explanation would be that there's no test coverage of these APIs and the codepath is not exercised at runtime. CoreCLR fails just in time for things like this, native AOT fails ahead of time.

Could you please have a look today or revert if the investigation takes longer?

[krwq]

@MichalStrehovsky I'll take a look

[PranavSenthilnathan]

@krwq Those methods are not used so they can be safely removed. I have the changes in https://github.com/dotnet/runtime/pull/114060/files#diff-083ed7205b5ecd53c32df803bd31400a901aba8981fd1b71830817a81ca61378 already but feel free to push them yourself if you don't want to wait for that.

[krwq]

@PranavSenthilnathan if you're planning on merging today then I'll wait, otherwise will send targeted PR tomorrow if this is not addressed yet