Skip to content

Add warning against using weak SHA-1 File Catalog #27805

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Anam Navied (anamnavi) wants to merge 4 commits into
base: master
Choose a base branch
from
+21 −0
Open

Add warning against using weak SHA-1 File Catalog #27805

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ae818dc
Add warning against using weak SHA-1 File Catalog
anamnavi Aug 10, 2026
697f979
Update catalog version check condition
anamnavi Aug 10, 2026
72c2be0
Update warning message
anamnavi Aug 10, 2026
cf00fa0
remove unecessary param for warning string
anamnavi Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/System.Management.Automation/resources/CatalogStrings.resx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,9 @@
<data name="UnKnownCatalogVersion" xml:space="preserve">
<value>Catalog version is not valid. We only support catalog version {0} and version {1}.</value>
</data>
<data name="WeakCatalogHashAlgorithm" xml:space="preserve">
<value>'{0}' is a version 1 catalog that uses SHA1. Consider regenerating this catalog with -CatalogVersion 2.</value>

@daxian-dbw Dongbo Wang (daxian-dbw) Aug 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<value>'{0}' is a version 1 catalog that uses SHA1. Consider regenerating this catalog with -CatalogVersion 2.</value>
<value>'{0}' is a version 1 catalog that uses SHA1. Consider regenerating this catalog with '-CatalogVersion 2'.</value>

</data>
<data name="UnableToOpenCatalogDefinitionFile" xml:space="preserve">
<value>Unable to open catalog definition file.</value>
</data>
Expand Down
18 changes: 18 additions & 0 deletions src/System.Management.Automation/security/CatalogHelper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,20 @@ private static string GetCatalogHashAlgorithm(int catalogVersion)
return hashAlgorithm;
}

/// <summary>
/// Emit an advisory warning when using legacy catalog version 1 (SHA-1).
/// Advisory only: does not fail catalog generation/validation for compatibility.
/// Automation validating catalogs can check CatalogInformation.HashAlgorithm (Test-FileCatalog -Detailed)
/// to detect SHA-1 programmatically.
/// </summary>
private static void WarnIfLegacyCatalogVersion(string catalogFilePath, int catalogVersion)
{
if (catalogVersion == 1)
{
_cmdlet.WriteWarning(StringUtil.Format(CatalogStrings.WeakCatalogHashAlgorithm, catalogFilePath));
}
}

/// <summary>
/// Generate the Catalog Definition File representing files and folders.
/// </summary>
Expand Down Expand Up @@ -331,6 +345,8 @@ internal static FileInfo GenerateCatalog(PSCmdlet cmdlet, Collection<string> Pat
_cmdlet = cmdlet;
string hashAlgorithm = GetCatalogHashAlgorithm(catalogVersion);

WarnIfLegacyCatalogVersion(catalogFilePath, catalogVersion);

Comment thread
anamnavi marked this conversation as resolved.
if (!string.IsNullOrEmpty(hashAlgorithm))
{
// Generate Path for Catalog Definition File
Expand Down Expand Up @@ -733,6 +749,8 @@ internal static CatalogInformation ValidateCatalog(PSCmdlet cmdlet, Collection<s
Dictionary<string, string> catalogHashes = GetHashesFromCatalog(catalogFilePath, excludedPatterns, out catalogVersion);
string hashAlgorithm = GetCatalogHashAlgorithm(catalogVersion);

WarnIfLegacyCatalogVersion(catalogFilePath, catalogVersion);

if (!string.IsNullOrEmpty(hashAlgorithm))
{
Dictionary<string, string> fileHashes = CalculateHashesFromPath(catalogFolders, catalogFilePath, hashAlgorithm, excludedPatterns);
Expand Down
Loading