Skip to content

🚧 [DRAFT] Red Hat's wishlist for 2026 #5401

@omajid

Description

@omajid

This is a collection of issues and areas that we would like to see improved in .NET in 2026.

This is a follow-up from #4697

Document .NET's behaviour running on FIPS-enabled systems

Issue: dotnet/docs#41565 (maybe more issues)

The document at https://learn.microsoft.com/en-us/dotnet/standard/security/fips-compliance describes the general behaviour of .NET in FIPS-enabled systems. We would like to have enhanced documentation that includes more details about that behaviour, including how .NET behaves when running on FIPS-enabled operating systems and known exceptions where .NET bypasses the FIPS policy explicitly.

Minimize differences between different builds of .NET 11

Issue: #4010

This includes both how the product is built, and what product is built.

Thanks to the amazing work of folks who created the VMR, everyone (Microsoft and source-build) is now building out of the same repository and branch and even commit! This is fantastic, and was unthinkable even just a few years ago. We would still like to minimize the differences in the built SDK between the builds of .NET.

There is are known differences between the contents of the generated SDK, such workloads (#3242) as which files are in the SDK (see the baseline diff) as well as contents of the files (eg, optimization levels, or the .NET TFMs they are targeting).

Finished/polished user story for sources, binaries and symbols for debugging.

Issue: #3225

We would like for users using .NET tools (like VSCode) to be able to build/debug their .NET applications using a source-build SDK, and have the same experience.

We want to make sure any customers running .NET workloads in production can use standard tools like dotnet-dump (and others suggested by Microsoft support) against .NET running on RHEL and containers.

Reproducible builds of .NET

Issue: #4963

We would like .NET's builds to be reproducible to improve .NET's security stance, increasing user trust, making an entire class of supply chain attacks much harder, and making it easier to comply with various auditing and compliance requirements.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    Status

    Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions