Move DSA tests into System.Security.Cryptography

[PranavSenthilnathan]

Currently System.Security.Cryptography.OpenSsl.Tests, System.Security.Cryptography.Csp.Tests, System.Security.Cryptography.Cng.Tests and System.Security.Cryptography.Tests each produce separate assemblies with different static DSA factories to test a specific creation methods (DSAOpenSsl, DSACng, DSACsp, or just DSA). This PR consolidates all these tests into System.Security.Cryptography.Tests by:

• Making the current test classes abstract and adding a virtual property on them for the factory to use
• Having derived classes per factory for each test
• Add appropriate include conditions in the csproj for the different platforms targeted by each leaf class

This is currently scoped to DSA since the changes were starting to get large, so EC and RSA will be follow-ups instead.

Contributes to #66338

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR refactors the DSA test suite so the shared DSA test logic lives under System.Security.Cryptography.Tests, with provider-specific “driver” types (Default / CNG / CSP / OpenSSL) selecting the appropriate DSA factory per platform. It also removes the duplicated DSA test sources from the OpenSsl/Csp/Cng test projects accordingly.

Changes:

• Replaces the old static DSAFactory/IDSAProvider pattern with an instance-based DSAProvider abstraction, and converts common DSA test classes from static/sealed to abstract with provider overrides.
• Adds provider-specific derived test classes and provider implementations into System.Security.Cryptography.Tests, with platform-conditional compilation in the csproj.
• Updates dependent tests and project files to reference the new structure and removes DSA test sources from the legacy per-implementation test projects.

Reviewed changes

Copilot reviewed 27 out of 28 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/libraries/System.Security.Cryptography/tests/X509Certificates/CertificateCreation/PrivateKeyAssociationTests.cs	Updates DSA key-selection logic to use the new default DSA provider capability check.
src/libraries/System.Security.Cryptography/tests/System.Security.Cryptography.Tests.csproj	Adds new DSA provider + driver test files and wires them into platform-specific ItemGroups.
src/libraries/System.Security.Cryptography/tests/OpenSslDsaCommonTests.Unix.cs	Adds OpenSSL-specific derived classes to run the shared DSA common tests with DSAOpenSsl.
src/libraries/System.Security.Cryptography/tests/DsaOpenSslTests.Unix.cs	Moves OpenSSL-specific DSA API tests into the consolidated test assembly (Unix build).
src/libraries/System.Security.Cryptography/tests/DSAOpenSslProvider.Unix.cs	Converts OpenSSL provider to the new DSAProvider base pattern and adds a singleton instance.
src/libraries/System.Security.Cryptography/tests/DSACryptoServiceProviderProvider.Windows.cs	Converts CSP provider to the new DSAProvider base pattern and adds a singleton instance.
src/libraries/System.Security.Cryptography/tests/DSACryptoServiceProviderCommonTests.Windows.cs	Adds CSP-specific derived classes to run shared DSA common tests against DSACryptoServiceProvider.
src/libraries/System.Security.Cryptography/tests/DSACreateTests.cs	Replaces prior conditional-attribute gating with runtime gating using the new provider capability check.
src/libraries/System.Security.Cryptography/tests/DSACngProvider.Windows.cs	Converts CNG provider to the new DSAProvider base pattern and adds a singleton instance.
src/libraries/System.Security.Cryptography/tests/DSACngCommonTests.Windows.cs	Adds CNG-specific derived classes to run shared DSA common tests against DSACng.
src/libraries/System.Security.Cryptography/tests/DefaultDSAProvider.cs	Reworks the default provider to use DSAProvider + singleton instance.
src/libraries/System.Security.Cryptography/tests/DefaultDsaCommonTests.cs	Adds Default-DSA derived classes to run shared DSA common tests against DSA.Create().
src/libraries/System.Security.Cryptography.OpenSsl/tests/System.Security.Cryptography.OpenSsl.Tests.csproj	Removes DSA test sources now relocated into System.Security.Cryptography.Tests.
src/libraries/System.Security.Cryptography.Csp/tests/System.Security.Cryptography.Csp.Tests.csproj	Removes shared DSA test sources now relocated into System.Security.Cryptography.Tests.
src/libraries/System.Security.Cryptography.Cng/tests/System.Security.Cryptography.Cng.Tests.csproj	Removes shared DSA test sources now relocated into System.Security.Cryptography.Tests.
src/libraries/System.Security.Cryptography.Cng/tests/DSACngTests.cs	Adjusts DSACng-specific tests after the shared DSA factory removal.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSAXml.cs	Refactors common DSA XML tests into an abstract base using DSAProvider.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignVerify.NistValidation.cs	Refactors NIST validation tests to use instance-based provider selection and runtime gating.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignVerify.cs	Refactors sign/verify tests into abstract bases with DSAProvider injection.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignatureFormatTests.cs	Refactors signature-format tests into abstract bases; shifts key generation to provider-based instance paths.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignatureFormatter.cs	Refactors signature formatter tests into an abstract base using DSAProvider.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSAProvider.cs	Introduces the new DSAProvider abstraction used by the refactored DSA tests.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSAKeyPemTests.cs	Refactors PEM import tests into an abstract base with provider injection.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSAKeyGeneration.cs	Refactors key-generation tests into an abstract base with provider injection.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSAKeyFileTests.cs	Refactors key file tests into an abstract base with provider injection.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSAImportExport.cs	Refactors import/export tests into an abstract base with provider injection and runtime gating.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSAFactoryTests.cs	Refactors factory tests into an abstract base using provider injection.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSAFactory.cs	Deletes the old static DSAFactory / IDSAProvider implementation.

Comments suppressed due to low confidence (2)

src/libraries/System.Security.Cryptography/tests/DSACngProvider.Windows.cs:21

• SupportsFips186_3 is hard-coded to true, but DSACng itself varies default key size / 2048-bit support based on Windows version. Making this reflect the actual OS capability keeps the shared tests from trying 2048/SHA-2 paths on downlevel Windows.
  src/libraries/System.Security.Cryptography.Cng/tests/DSACngTests.cs:29
• TestImportV2Key (2048-bit import) used to be conditionally executed; making it an unconditional [Fact] can fail on downlevel Windows where 2048-bit DSA/CNG isn’t supported. Consider restoring a condition (based on Windows version) so the test skips when the platform can’t import 2048-bit keys.

    public static class DsaCngTests
    {
        [Fact]
        public static void TestImportV1Key()
        {
            using (CngKey key = CngKey.Import(TestData.Key_DSA1024Key, CngKeyBlobFormat.GenericPrivateBlob))
            {
                VerifyImportedKey(key);
                Assert.Equal(1024, key.KeySize);
            }
        }

        [Fact]
        public static void TestImportV2Key()
        {
            using (CngKey key = CngKey.Import(TestData.Key_DSA2048Key, CngKeyBlobFormat.GenericPrivateBlob))
            {
                VerifyImportedKey(key);
                Assert.Equal(2048, key.KeySize);
            }
        }

[Copilot]

Pull request overview

Copilot reviewed 32 out of 33 changed files in this pull request and generated 3 comments.

[PranavSenthilnathan]

There is a Unix implementation and it forwards to the default implementation (which would be OpenSSL):

runtime/src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/DSACryptoServiceProvider.Unix.cs

Lines 45 to 54 in 0b259fa

	[UnsupportedOSPlatform("ios")]
	[UnsupportedOSPlatform("tvos")]
	public DSACryptoServiceProvider(int dwKeySize) : base()
	{
	ArgumentOutOfRangeException.ThrowIfNegative(dwKeySize);
	// This class wraps DSA
	_impl = DSA.Create();
	KeySize = dwKeySize;
	}

[bartonjs]

Alpha ordering was lost

[bartonjs]

Alpha ordering was lost

[bartonjs]

I'd've called it something based on "Require" or "Assert" instead of "ThrowSkipTest...", e.g. DefaultDSAProvider.Instance.AssertFips186_3(). Particularly because the name you have here puts the "FIPS 186-3" part buried in the middle.