diff --git a/src/System.Management.Automation/resources/CatalogStrings.resx b/src/System.Management.Automation/resources/CatalogStrings.resx
index 662b765652b..9235ab84ff6 100644
--- a/src/System.Management.Automation/resources/CatalogStrings.resx
+++ b/src/System.Management.Automation/resources/CatalogStrings.resx
@@ -150,6 +150,9 @@
Catalog version is not valid. We only support catalog version {0} and version {1}.
+
+ '{0}' is a version 1 catalog that uses SHA1. Consider regenerating this catalog with -CatalogVersion 2.
+
Unable to open catalog definition file.
diff --git a/src/System.Management.Automation/security/CatalogHelper.cs b/src/System.Management.Automation/security/CatalogHelper.cs
index 4892f7434e4..ac64e4afbe5 100644
--- a/src/System.Management.Automation/security/CatalogHelper.cs
+++ b/src/System.Management.Automation/security/CatalogHelper.cs
@@ -146,6 +146,20 @@ private static string GetCatalogHashAlgorithm(int catalogVersion)
return hashAlgorithm;
}
+ ///
+ /// Emit an advisory warning when using legacy catalog version 1 (SHA-1).
+ /// Advisory only: does not fail catalog generation/validation for compatibility.
+ /// Automation validating catalogs can check CatalogInformation.HashAlgorithm (Test-FileCatalog -Detailed)
+ /// to detect SHA-1 programmatically.
+ ///
+ private static void WarnIfLegacyCatalogVersion(string catalogFilePath, int catalogVersion)
+ {
+ if (catalogVersion == 1)
+ {
+ _cmdlet.WriteWarning(StringUtil.Format(CatalogStrings.WeakCatalogHashAlgorithm, catalogFilePath));
+ }
+ }
+
///
/// Generate the Catalog Definition File representing files and folders.
///
@@ -331,6 +345,8 @@ internal static FileInfo GenerateCatalog(PSCmdlet cmdlet, Collection Pat
_cmdlet = cmdlet;
string hashAlgorithm = GetCatalogHashAlgorithm(catalogVersion);
+ WarnIfLegacyCatalogVersion(catalogFilePath, catalogVersion);
+
if (!string.IsNullOrEmpty(hashAlgorithm))
{
// Generate Path for Catalog Definition File
@@ -733,6 +749,8 @@ internal static CatalogInformation ValidateCatalog(PSCmdlet cmdlet, Collection catalogHashes = GetHashesFromCatalog(catalogFilePath, excludedPatterns, out catalogVersion);
string hashAlgorithm = GetCatalogHashAlgorithm(catalogVersion);
+ WarnIfLegacyCatalogVersion(catalogFilePath, catalogVersion);
+
if (!string.IsNullOrEmpty(hashAlgorithm))
{
Dictionary fileHashes = CalculateHashesFromPath(catalogFolders, catalogFilePath, hashAlgorithm, excludedPatterns);