diff --git a/src/System.Management.Automation/resources/CatalogStrings.resx b/src/System.Management.Automation/resources/CatalogStrings.resx index 662b765652b..9235ab84ff6 100644 --- a/src/System.Management.Automation/resources/CatalogStrings.resx +++ b/src/System.Management.Automation/resources/CatalogStrings.resx @@ -150,6 +150,9 @@ Catalog version is not valid. We only support catalog version {0} and version {1}. + + '{0}' is a version 1 catalog that uses SHA1. Consider regenerating this catalog with -CatalogVersion 2. + Unable to open catalog definition file. diff --git a/src/System.Management.Automation/security/CatalogHelper.cs b/src/System.Management.Automation/security/CatalogHelper.cs index 4892f7434e4..ac64e4afbe5 100644 --- a/src/System.Management.Automation/security/CatalogHelper.cs +++ b/src/System.Management.Automation/security/CatalogHelper.cs @@ -146,6 +146,20 @@ private static string GetCatalogHashAlgorithm(int catalogVersion) return hashAlgorithm; } + /// + /// Emit an advisory warning when using legacy catalog version 1 (SHA-1). + /// Advisory only: does not fail catalog generation/validation for compatibility. + /// Automation validating catalogs can check CatalogInformation.HashAlgorithm (Test-FileCatalog -Detailed) + /// to detect SHA-1 programmatically. + /// + private static void WarnIfLegacyCatalogVersion(string catalogFilePath, int catalogVersion) + { + if (catalogVersion == 1) + { + _cmdlet.WriteWarning(StringUtil.Format(CatalogStrings.WeakCatalogHashAlgorithm, catalogFilePath)); + } + } + /// /// Generate the Catalog Definition File representing files and folders. /// @@ -331,6 +345,8 @@ internal static FileInfo GenerateCatalog(PSCmdlet cmdlet, Collection Pat _cmdlet = cmdlet; string hashAlgorithm = GetCatalogHashAlgorithm(catalogVersion); + WarnIfLegacyCatalogVersion(catalogFilePath, catalogVersion); + if (!string.IsNullOrEmpty(hashAlgorithm)) { // Generate Path for Catalog Definition File @@ -733,6 +749,8 @@ internal static CatalogInformation ValidateCatalog(PSCmdlet cmdlet, Collection catalogHashes = GetHashesFromCatalog(catalogFilePath, excludedPatterns, out catalogVersion); string hashAlgorithm = GetCatalogHashAlgorithm(catalogVersion); + WarnIfLegacyCatalogVersion(catalogFilePath, catalogVersion); + if (!string.IsNullOrEmpty(hashAlgorithm)) { Dictionary fileHashes = CalculateHashesFromPath(catalogFolders, catalogFilePath, hashAlgorithm, excludedPatterns);