mirror of
https://github.com/microsoft/semantic-kernel.git
synced 2026-10-12 02:19:06 +00:00
8ec7dddd9a
### Motivation and Context `_CopilotStudioAgentTokenFactory._cert_thumbprint` computes the X.509 certificate thumbprint that is passed to MSAL as the `thumbprint` client credential. This value is the JWT `x5t` header, which MSAL and Microsoft Entra ID require to be a SHA-1 digest - any other digest would be rejected by the token endpoint. Because it is a plain digest call, static analysis tooling flags it even though the hash is used purely as a certificate identifier, not as a cryptographic/security primitive (the call already passes `usedforsecurity=False`). ### Description Adds a comment explaining why SHA-1 is required here and annotates the call so static analysis does not flag it. No behavior change. Note: MSAL itself carries the same annotation on its own `x5t` fingerprint computation. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Co-authored-by: Copilot App <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> Copilot-Session: d2b7d3e7-a125-4569-b976-a6534c1837ae