From 8ec7dddd9a84cebaea3ae80c7cd85c61e2cffdff Mon Sep 17 00:00:00 2001 From: SergeyMenshykh <68852919+SergeyMenshykh@users.noreply.github.com> Date: Wed, 5 Aug 2026 16:54:12 +0100 Subject: [PATCH] Python: Document x5t certificate thumbprint hashing in Copilot Studio agent (#14270) ### Motivation and Context `_CopilotStudioAgentTokenFactory._cert_thumbprint` computes the X.509 certificate thumbprint that is passed to MSAL as the `thumbprint` client credential. This value is the JWT `x5t` header, which MSAL and Microsoft Entra ID require to be a SHA-1 digest - any other digest would be rejected by the token endpoint. Because it is a plain digest call, static analysis tooling flags it even though the hash is used purely as a certificate identifier, not as a cryptographic/security primitive (the call already passes `usedforsecurity=False`). ### Description Adds a comment explaining why SHA-1 is required here and annotates the call so static analysis does not flag it. No behavior change. Note: MSAL itself carries the same annotation on its own `x5t` fingerprint computation. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone :smile: --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: d2b7d3e7-a125-4569-b976-a6534c1837ae --- .../agents/copilot_studio/copilot_studio_agent.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py b/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py index fe4f98c9dc..4c8da0fb21 100644 --- a/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py +++ b/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py @@ -181,7 +181,10 @@ class _CopilotStudioAgentTokenFactory: pem_bytes = Path(cert_path).read_bytes() der_bytes = ssl.PEM_cert_to_DER_cert(pem_bytes.decode()) - return hashlib.sha1(der_bytes, usedforsecurity=False).hexdigest().upper() + # SHA-1 is not used here as a security primitive; it is required to compute the X.509 certificate thumbprint + # (the `x5t` JWT header value), which MSAL and Microsoft Entra ID mandate to be a SHA-1 digest for the + # `thumbprint` client credential. Hence the `usedforsecurity=False` flag. + return hashlib.sha1(der_bytes, usedforsecurity=False).hexdigest().upper() # CodeQL [SM02167] x5t thumbprint # endregion