Repository navigation
[release/v7.6.10] Add warning for SHA-1 File Catalog - #28311
Dongbo Wang (daxian-dbw) wants to merge 1 commit into
Conversation
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
There was a problem hiding this comment.
🟡 Changes recommended
The catalog warning incorrectly lists SHA0 as a possible algorithm and omits the catalog version instead of accurately identifying version 1 catalogs as using weak SHA-1.
1 open issue
What changed in this PR
Backports #27805 to release/v7.6.10, adding warnings when generating or validating legacy SHA-1 file catalogs while retaining compatibility.
Changes:
- Adds a shared warning helper to catalog generation and validation.
- Adds warning text recommending regeneration with
-CatalogVersion 2. - Leaves hashing and validation logic unchanged.
| File | Description |
|---|---|
src/System.Management.Automation/security/CatalogHelper.cs |
Emits warnings when generating or validating legacy catalogs. |
src/System.Management.Automation/resources/CatalogStrings.resx |
Adds the warning message and migration guidance. |
Review effort: Balanced
| <value>Catalog version is not valid. We only support catalog version {0} and version {1}.</value> | ||
| </data> | ||
| <data name="WeakCatalogHashAlgorithm" xml:space="preserve"> | ||
| <value>'{0}' is a version catalog that uses SHA0 or SHA1. Consider regenerating this catalog with '-CatalogVersion 2'.</value> |
There was a problem hiding this comment.
Anam Navied (@anamnavi) I think this comment makes sense. The GetCatalogHashAlgorithm throws a terminating error when the passed-in catalogVersion is neither 1 nor 2.
There was a problem hiding this comment.
I submitted #28322 to fix it in GitHub. Will backport it in the next 7.6 release.
Justin Chung (jshigetomi)
left a comment
There was a problem hiding this comment.
Reviewed as a faithful backport; no blocking issues found.
Backport of #27805 to release/v7.6.10
Triggered by Dongbo Wang (@daxian-dbw) on behalf of Anam Navied (@anamnavi)
Original CL Label: CL-General
/cc @PowerShell/powershell-maintainers
Impact
REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.
Tooling Impact
Customer Impact
Warns when generating or validating legacy SHA-1 file catalogs and recommends regenerating with -CatalogVersion 2. Catalog generation and validation remain supported for compatibility; hashing and validation behavior are unchanged.
Regression
REQUIRED: Check exactly one box.
This is not a regression.
Testing
No tests were added in the original diff. The backport cherry-picked without conflicts and the working tree is clean. Local tests were not run; backport CI must pass before merge.
Risk
REQUIRED: Check exactly one box.
Security-related catalog handling. The change is limited to advisory warnings when legacy catalog versions are used; hashing and validation logic are unchanged.