Skip to content

[release/v7.6.10] Add warning for SHA-1 File Catalog #28311

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Dongbo Wang (daxian-dbw) merged 1 commit into from
Nov 4, 2026
+21 −0
Merged

[release/v7.6.10] Add warning for SHA-1 File Catalog #28311

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/System.Management.Automation/resources/CatalogStrings.resx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,9 @@
<data name="UnKnownCatalogVersion" xml:space="preserve">
<value>Catalog version is not valid. We only support catalog version {0} and version {1}.</value>
</data>
<data name="WeakCatalogHashAlgorithm" xml:space="preserve">
<value>'{0}' is a version catalog that uses SHA0 or SHA1. Consider regenerating this catalog with '-CatalogVersion 2'.</value>

@daxian-dbw Dongbo Wang (daxian-dbw) Nov 3, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Anam Navied (@anamnavi) I think this comment makes sense. The GetCatalogHashAlgorithm throws a terminating error when the passed-in catalogVersion is neither 1 nor 2.

@daxian-dbw Dongbo Wang (daxian-dbw) Nov 3, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I submitted #28322 to fix it in GitHub. Will backport it in the next 7.6 release.

</data>
<data name="UnableToOpenCatalogDefinitionFile" xml:space="preserve">
<value>Unable to open catalog definition file.</value>
</data>
Expand Down
18 changes: 18 additions & 0 deletions src/System.Management.Automation/security/CatalogHelper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,20 @@ private static string GetCatalogHashAlgorithm(int catalogVersion)
return hashAlgorithm;
}

/// <summary>
/// Emit an advisory warning when using legacy catalog version 1 (SHA-1).
/// Advisory only: does not fail catalog generation/validation for compatibility.
/// Automation validating catalogs can check CatalogInformation.HashAlgorithm (Test-FileCatalog -Detailed)
/// to detect SHA-1 programmatically.
/// </summary>
private static void WarnIfLegacyCatalogVersion(string catalogFilePath, int catalogVersion)
{
if (catalogVersion < 2)
{
_cmdlet.WriteWarning(StringUtil.Format(CatalogStrings.WeakCatalogHashAlgorithm, catalogFilePath));
}
}

/// <summary>
/// Generate the Catalog Definition File representing files and folders.
/// </summary>
Expand Down Expand Up @@ -331,6 +345,8 @@ internal static FileInfo GenerateCatalog(PSCmdlet cmdlet, Collection<string> Pat
_cmdlet = cmdlet;
string hashAlgorithm = GetCatalogHashAlgorithm(catalogVersion);

WarnIfLegacyCatalogVersion(catalogFilePath, catalogVersion);

if (!string.IsNullOrEmpty(hashAlgorithm))
{
// Generate Path for Catalog Definition File
Expand Down Expand Up @@ -733,6 +749,8 @@ internal static CatalogInformation ValidateCatalog(PSCmdlet cmdlet, Collection<s
Dictionary<string, string> catalogHashes = GetHashesFromCatalog(catalogFilePath, excludedPatterns, out catalogVersion);
string hashAlgorithm = GetCatalogHashAlgorithm(catalogVersion);

WarnIfLegacyCatalogVersion(catalogFilePath, catalogVersion);

if (!string.IsNullOrEmpty(hashAlgorithm))
{
Dictionary<string, string> fileHashes = CalculateHashesFromPath(catalogFolders, catalogFilePath, hashAlgorithm, excludedPatterns);
Expand Down
Loading