[eliottness]

Summary of changes

Stops this repository's CI, build and smoke-test images from trusting emSign ECC Root CA - G3 and AAA Certificate Services. The APPSEC-71273 ledger lists 152 impacted image references here: 20 fixed in this PR, 3 fixed at their in-repo image source in #9528, 129 follow-ups.

Reason for change

Incident IR-62343: the compromised eMudhra intermediates chain to these two roots, and every CI image whose CA stores still trust them keeps the exposure. Jira: APPSEC-71282 (parent APPSEC-71273).

Implementation details

• tracer/build/_build/SmokeTests/smoke-test-images.docker-compose.yml: re-pins 19 mcr.microsoft.com/dotnet/aspnet runtime tags (8.0, 9.0, 10.0, 11.0; bookworm-slim, jammy, noble, resolute, alpine 3.24, chiseled and composite variants) to their current MCR digests.
• tracer/build/_build/Build.VariableGenerations.cs: the dd-dotnet failure-test matrix runtime image moves from EOL aspnet:9.0-alpine3.20 to aspnet:9.0-alpine3.24. That matrix is a small representative set (one image per package format), so the Alpine minor is not what it tests.
• Smoke Dockerfiles (smoke.dockerfile, smoke.chiseled, smoke.dd-dotnet, smoke.dotnet-tool, smoke.dotnet-tool.nuget, smoke.dotnet-tool.self-instrument, smoke.nuget, smoke.nuget.dd-dotnet, smoke.trimming): no published SDK tag is clean, so a new sdk-patched stage (FROM mcr.microsoft.com/dotnet/sdk:$DOTNETSDK_VERSION) removes both roots from the SDK's NuGet trust lists (sdk/*/trustedroots/*.pem), and each builder stage builds FROM sdk-patched.
• The build-toolchain Dockerfiles (alpine.build, alpine.build.arm64, centos7.build, debian) moved to Stop trusting compromised eMudhra roots in the build-toolchain images #9528, because they need image republishing and VM rebuilds (andrewlock's review on Stop trusting compromised eMudhra roots in CI and smoke-test images #9517).

Test coverage

Every new image reference was pulled and every changed Dockerfile was built, then scanned with the eMudhra scanner (it checks every file in the image for the two roots' public keys); all returned empty hits. Images that CI never builds or pulls are left alone.

• NuGet trust: smoke.dockerfile --target builder (including dotnet publish for net10.0, which restores its packages) built with the stripped trust lists, so the packages it restores do not depend on signatures chaining to these roots.
• This PR comes from a branch in the repo, so the Azure DevOps pipelines run on it. It replaces fork PR Stop trusting compromised eMudhra roots in CI and smoke-test images #9517, as andrewlock asked there.

Other details

Follow-ups (not in this PR):

• Needs a rebuild at its source (Datadog-built or mirrored image) (5): public.ecr.aws/datadog/agent, registry.ddbuild.io/images/ci/images:1.2.6, registry.ddbuild.io/ci/serverless-tools:1, registry.ddbuild.io/images/benchmarking-platform-tools-ubuntu:newest, ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent:latest.
• Integration-test servers in docker-compose.yml, kept at their tested versions (3): postgres:10.5-alpine, rabbitmq:3-management, redis:4-alpine. Every newer image in their major lines still trusts the roots, and moving them to postgres 18 / rabbitmq 4 / redis 8 changes the server versions the integration matrix tests against (oldest clients: Npgsql 4.0.0, RabbitMQ.Client 3.6.9, StackExchange.Redis 1.0.187, ServiceStack.Redis 4.0.48). The owning team should pick supported server versions and run the integration tests.
• No clean upstream version yet (66): localstack/localstack:4.14.0, andrewlock/ok-api:latest, elasticsearch:7.10.1, mongo:5.0.31, mysql/mysql-server:8.0, mcr.microsoft.com/azure-sql-edge:latest, mcr.microsoft.com/cosmosdb/linux/azure-cosmos-emulator:vnext-preview, bentonam/couchbase-docker:community-5.0.1, docker.elastic.co/elasticsearch/elasticsearch:7.14.1, mcr.microsoft.com/mssql/server:latest, mcr.microsoft.com/azure-messaging/servicebus-emulator:1.1.2, mcr.microsoft.com/azure-storage/azurite:3.37.0, mcr.microsoft.com/azure-messaging/eventhubs-emulator:latest, workleap/eventgridemulator:0.6.37, confluentinc/cp-zookeeper:6.1.1, confluentinc/cp-server:6.1.1, mcr.microsoft.com/dotnet/aspnet:10.0-alpine3.22, mcr.microsoft.com/dotnet/aspnet:10.0-alpine3.22-composite, mcr.microsoft.com/dotnet/sdk:8.0-jammy, mcr.microsoft.com/dotnet/sdk:9.0-bookworm-slim, mcr.microsoft.com/dotnet/sdk:9.0-noble, mcr.microsoft.com/dotnet/sdk:10.0-alpine3.22, mcr.microsoft.com/dotnet/sdk:10.0-noble, mcr.microsoft.com/dotnet/sdk:10.0-resolute, mcr.microsoft.com/dotnet/sdk:11.0-alpine3.24, mcr.microsoft.com/dotnet/sdk:11.0-resolute, andrewlock/dotnet-centos-stream:8-3.1, andrewlock/dotnet-centos-stream:8-5.0, andrewlock/dotnet-centos-stream:8-6.0, andrewlock/dotnet-centos-stream:9-6.0, andrewlock/dotnet-centos-stream:9-9.0, andrewlock/dotnet-debian:trixie-10.0, andrewlock/dotnet-debian:trixie-8.0, andrewlock/dotnet-debian:trixie-9.0, andrewlock/dotnet-fedora:29-2.1, andrewlock/dotnet-fedora:29-3.1, andrewlock/dotnet-fedora:33-3.1, andrewlock/dotnet-fedora:33-5.0, andrewlock/dotnet-fedora:34-3.1, andrewlock/dotnet-fedora:34-5.0, andrewlock/dotnet-fedora:34-6.0, andrewlock/dotnet-fedora:35-3.1, andrewlock/dotnet-fedora:35-5.0, andrewlock/dotnet-fedora:35-7.0, andrewlock/dotnet-fedora:40-9.0, andrewlock/dotnet-fedora-arm64:34-6.0, andrewlock/dotnet-fedora-arm64:35-5.0, andrewlock/dotnet-fedora-arm64:35-7.0, andrewlock/dotnet-fedora-arm64:40-9.0, andrewlock/dotnet-opensuse:15-2.1, andrewlock/dotnet-opensuse:15-3.1, andrewlock/dotnet-opensuse:15-5.0, andrewlock/dotnet-opensuse:15-6.0, andrewlock/dotnet-opensuse:15-7.0, andrewlock/dotnet-opensuse:15-9.0, andrewlock/dotnet-opensuse:15-10.0, andrewlock/dotnet-rhel:8-3.1, andrewlock/dotnet-rhel:8-5.0, andrewlock/dotnet-rhel:8-6.0, andrewlock/dotnet-rhel:8-7.0, andrewlock/dotnet-rhel:8-9.0, andrewlock/dotnet-rhel:9-9.0, public.ecr.aws/lambda/dotnet:8, public.ecr.aws/lambda/dotnet:9, public.ecr.aws/lambda/dotnet:10, mcr.microsoft.com/dotnet/sdk.
• EOL test target kept on purpose (moving the tag would change the tested version) (40): docker.elastic.co/elasticsearch/elasticsearch:6.4.2, docker.elastic.co/elasticsearch/elasticsearch:5.6.16, mysql/mysql-server:5.7, mcr.microsoft.com/dotnet/aspnet:2.1-alpine3.12, mcr.microsoft.com/dotnet/aspnet:2.1-stretch-slim, mcr.microsoft.com/dotnet/aspnet:3.1-alpine3.14, mcr.microsoft.com/dotnet/aspnet:3.1-bionic, mcr.microsoft.com/dotnet/aspnet:3.1-bullseye-slim, mcr.microsoft.com/dotnet/aspnet:5.0-alpine3.13, mcr.microsoft.com/dotnet/aspnet:5.0-alpine3.14, mcr.microsoft.com/dotnet/aspnet:5.0-buster-slim, mcr.microsoft.com/dotnet/aspnet:5.0-focal, mcr.microsoft.com/dotnet/aspnet:6.0-alpine3.14, mcr.microsoft.com/dotnet/aspnet:6.0-alpine3.18, mcr.microsoft.com/dotnet/aspnet:6.0-bullseye-slim, mcr.microsoft.com/dotnet/aspnet:7.0-alpine3.16, mcr.microsoft.com/dotnet/aspnet:7.0-alpine3.18, mcr.microsoft.com/dotnet/aspnet:7.0-bullseye-slim, mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.18, mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.18-composite, mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.19, mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.19-composite, mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.20, mcr.microsoft.com/dotnet/aspnet:9.0-alpine3.20, mcr.microsoft.com/dotnet/aspnet:9.0-alpine3.20-composite, mcr.microsoft.com/dotnet/sdk:3.1-alpine3.15, mcr.microsoft.com/dotnet/sdk:3.1-bullseye, mcr.microsoft.com/dotnet/sdk:6.0-alpine3.16, mcr.microsoft.com/dotnet/sdk:6.0-bullseye-slim, mcr.microsoft.com/dotnet/sdk:7.0-alpine3.16, mcr.microsoft.com/dotnet/sdk:7.0-bullseye-slim, mcr.microsoft.com/dotnet/sdk:8.0-alpine3.18, mcr.microsoft.com/dotnet/sdk:9.0-alpine3.20, andrewlock/dotnet-centos:7-2.1, andrewlock/dotnet-centos:7-3.1, andrewlock/dotnet-centos:7-5.0, andrewlock/dotnet-centos:7-6.0, andrewlock/dotnet-centos:7-7.0, public.ecr.aws/lambda/dotnet:6, public.ecr.aws/lambda/dotnet:7.
• Unscannable from outside the registry (pull access denied) (1): 486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/benchmarking-platform:dotnet-throughput-9.
• Not used by any CI job, left untouched: 13 reference(s).

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-10-26 15:59:59

Comparing candidate commit f690218 in PR branch eliottness/emudhra-ca-roots with baseline commit 4d26bae in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 72 metrics, 0 unstable metrics, 7 known flaky benchmarks, 119 flaky benchmarks without significant changes.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

• 🟩 = significantly better candidate vs. baseline
• 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Known flaky benchmarks

These benchmarks are marked as flaky and will not trigger a failure. Modify FLAKY_BENCHMARKS_REGEX to control which benchmarks are marked as flaky.

scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces net6.0

• unstable execution_time [+24.922ms; +85.928ms] or [+5.520%; +19.032%]

scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest net6.0

• unstable execution_time [+39.415ms; +101.433ms] or [+8.773%; +22.576%]

scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest netcoreapp3.1

• unstable execution_time [-95.547ms; -5.385ms] or [-23.494%; -1.324%]

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces net472

• unstable execution_time [-39.122ms; +34.044ms] or [-7.295%; +6.348%]
• unstable throughput [+87.117op/s; +153.474op/s] or [+17.564%; +30.942%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark net6.0

• unstable execution_time [-34.687µs; +17.367µs] or [-6.708%; +3.358%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark net6.0

• 🟥 execution_time [+2.989µs; +7.063µs] or [+5.822%; +13.760%]
• 🟥 throughput [-2144.458op/s; -1015.916op/s] or [-10.979%; -5.201%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark netcoreapp3.1

• unstable execution_time [-1.101µs; +4.385µs] or [-2.069%; +8.240%]

Known flaky benchmarks without significant changes:

• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_AddEvent_Sampled net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_AddEvent_Sampled net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_AddEvent_Sampled netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_GetContext_Sampled net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_GetContext_Sampled net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_GetContext_Sampled netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetAttributes_Sampled net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetAttributes_Sampled net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetAttributes_Sampled netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetStatus_Sampled net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetStatus_Sampled net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetStatus_Sampled netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_UpdateName_Sampled net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_UpdateName_Sampled net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_UpdateName_Sampled netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_AddEvent_Sampled net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_AddEvent_Sampled net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_AddEvent_Sampled netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_GetContext_Sampled net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_GetContext_Sampled net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_GetContext_Sampled netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_RecordException_Sampled net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_RecordException_Sampled net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_RecordException_Sampled netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetAttributes_Sampled net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetAttributes_Sampled net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetAttributes_Sampled netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetStatus_Sampled net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetStatus_Sampled net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetStatus_Sampled netcoreapp3.1
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_UpdateName_Sampled net472
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_UpdateName_Sampled net6.0
• scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_UpdateName_Sampled netcoreapp3.1
• scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild net472
• scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild net6.0
• scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild netcoreapp3.1
• scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces net472
• scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces netcoreapp3.1
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody net472
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody net6.0
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody netcoreapp3.1
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleSimpleBody net472
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleSimpleBody net6.0
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleSimpleBody netcoreapp3.1
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody net472
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody net6.0
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody netcoreapp3.1
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody net472
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody net6.0
• scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody netcoreapp3.1
• scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeArgs net472
• scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeArgs net6.0
• scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeArgs netcoreapp3.1
• scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs net472
• scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs net6.0
• scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs netcoreapp3.1
• scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmark net472
• scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmark net6.0
• scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmark netcoreapp3.1
• scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmarkWithAttack net472
• scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmarkWithAttack net6.0
• scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmarkWithAttack netcoreapp3.1
• scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest net472
• scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces net6.0
• scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces netcoreapp3.1
• scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice net472
• scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice net6.0
• scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice netcoreapp3.1
• scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSliceWithPool net472
• scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSliceWithPool net6.0
• scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSliceWithPool netcoreapp3.1
• scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice net472
• scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice net6.0
• scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice netcoreapp3.1
• scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch net472
• scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch net6.0
• scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch netcoreapp3.1
• scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearchAsync net472
• scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearchAsync net6.0
• scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearchAsync netcoreapp3.1
• scenario:Benchmarks.Trace.GraphQLBenchmark.ExecuteAsync net472
• scenario:Benchmarks.Trace.GraphQLBenchmark.ExecuteAsync net6.0
• scenario:Benchmarks.Trace.GraphQLBenchmark.ExecuteAsync netcoreapp3.1
• scenario:Benchmarks.Trace.ILoggerBenchmark.EnrichedLog net472
• scenario:Benchmarks.Trace.ILoggerBenchmark.EnrichedLog net6.0
• scenario:Benchmarks.Trace.ILoggerBenchmark.EnrichedLog netcoreapp3.1
• scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark net472
• scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark netcoreapp3.1
• scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark net472
• scenario:Benchmarks.Trace.Log4netBenchmark.EnrichedLog net472
• scenario:Benchmarks.Trace.Log4netBenchmark.EnrichedLog net6.0
• scenario:Benchmarks.Trace.Log4netBenchmark.EnrichedLog netcoreapp3.1
• scenario:Benchmarks.Trace.RedisBenchmark.SendReceive net472
• scenario:Benchmarks.Trace.RedisBenchmark.SendReceive net6.0
• scenario:Benchmarks.Trace.RedisBenchmark.SendReceive netcoreapp3.1
• scenario:Benchmarks.Trace.SerilogBenchmark.EnrichedLog net472
• scenario:Benchmarks.Trace.SerilogBenchmark.EnrichedLog net6.0
• scenario:Benchmarks.Trace.SerilogBenchmark.EnrichedLog netcoreapp3.1
• scenario:Benchmarks.Trace.SingleSpanAspNetCoreBenchmark.SingleSpanAspNetCore net472
• scenario:Benchmarks.Trace.SingleSpanAspNetCoreBenchmark.SingleSpanAspNetCore net6.0
• scenario:Benchmarks.Trace.SingleSpanAspNetCoreBenchmark.SingleSpanAspNetCore netcoreapp3.1
• scenario:Benchmarks.Trace.SpanBenchmark.StartFinishScope net472
• scenario:Benchmarks.Trace.SpanBenchmark.StartFinishScope net6.0
• scenario:Benchmarks.Trace.SpanBenchmark.StartFinishScope netcoreapp3.1
• scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan net472
• scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan net6.0
• scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan netcoreapp3.1
• scenario:Benchmarks.Trace.SpanBenchmark.StartFinishTwoScopes net472
• scenario:Benchmarks.Trace.SpanBenchmark.StartFinishTwoScopes net6.0
• scenario:Benchmarks.Trace.SpanBenchmark.StartFinishTwoScopes netcoreapp3.1
• scenario:Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin net472
• scenario:Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin net6.0
• scenario:Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin netcoreapp3.1

[dd-trace-dotnet-ci-bot]

Execution-Time Benchmarks Report ⏱️

Execution-time results for samples comparing This PR (9527) and master.

✅ No regressions detected

📄 View the full report (charts + all metrics) →

[eliottness]

/azp run

[eliottness]

Closing and reopening to re-trigger Azure CI: build 212455 failed only in unit_tests_macos, where the build-macos-working-directory artifact download timed out at 100% (infra), and /azp run did not start a new build.

[eliottness]

CI status for this PR after two full runs, each failing on a different infra issue:

• Build 212455: unit_tests_macos timed out downloading the 3.48 GB build-macos-working-directory artifact.
• Build 212478: integration_tests_linux / DockerTest debian_net9.0_group2 hit the agent timeout while starting its dependencies. Checkout alone took 14.5 min, and the Azure emulators took 3-7 min each to start; no test had run. That job doesn't use anything this PR changes, and it passed in 212455.

For comparison, master's consolidated-pipeline failed in 10 of its last 15 completed builds.

Smoke coverage:

• Ran and passed in both builds: the smoke stages that use what this PR changes (installer tests: smoke.dockerfile and smoke.chiseled.dockerfile; trimming: smoke.trimming.dockerfile; the dd-dotnet failure tests on the alpine 3.24 matrix).
• Not run yet: the nuget, dotnet-tool and self-instrument smoke stages (smoke.nuget*.dockerfile, smoke.dotnet-tool*.dockerfile). On PRs they only run when SmokeTestInputsChanged is set, which only looks at snapshots and scenario code, or when the build is queued with run_all_installer_tests=true.

Next step: queue a build with run_all_installer_tests=true (it also re-runs the stages that flaked). I'm keeping this PR in draft until that run is green.