From ae818dc28c7fff8896f972a7c7d8f36e8fd1b8c8 Mon Sep 17 00:00:00 2001 From: anamnavi Date: Mon, 10 Aug 2026 15:45:16 -0400 Subject: [PATCH 1/4] Add warning against using weak SHA-1 File Catalog --- .../resources/CatalogStrings.resx | 3 +++ .../security/CatalogHelper.cs | 18 ++++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/src/System.Management.Automation/resources/CatalogStrings.resx b/src/System.Management.Automation/resources/CatalogStrings.resx index 662b765652b..da1b1421571 100644 --- a/src/System.Management.Automation/resources/CatalogStrings.resx +++ b/src/System.Management.Automation/resources/CatalogStrings.resx @@ -150,6 +150,9 @@ Catalog version is not valid. We only support catalog version {0} and version {1}. + + Catalog '{0}' uses version {1}. Catalog version 2 is recommended. Consider regenerating this catalog with -CatalogVersion 2. + Unable to open catalog definition file. diff --git a/src/System.Management.Automation/security/CatalogHelper.cs b/src/System.Management.Automation/security/CatalogHelper.cs index 4892f7434e4..cd86f7415af 100644 --- a/src/System.Management.Automation/security/CatalogHelper.cs +++ b/src/System.Management.Automation/security/CatalogHelper.cs @@ -146,6 +146,20 @@ private static string GetCatalogHashAlgorithm(int catalogVersion) return hashAlgorithm; } + /// + /// Emit an advisory warning when a catalog uses a weak (pre-v2 / SHA-1) version. + /// Advisory only: by design this does NOT fail validation - Status stays Valid for + /// compatibility. Automation should check CatalogInformation.HashAlgorithm to detect + /// SHA-1 programmatically. + /// + private static void WarnIfLegacyCatalogVersion(string catalogFilePath, int catalogVersion) + { + if (catalogVersion < 2) + { + _cmdlet.WriteWarning(StringUtil.Format(CatalogStrings.WeakCatalogHashAlgorithm, catalogFilePath, catalogVersion)); + } + } + /// /// Generate the Catalog Definition File representing files and folders. /// @@ -331,6 +345,8 @@ internal static FileInfo GenerateCatalog(PSCmdlet cmdlet, Collection Pat _cmdlet = cmdlet; string hashAlgorithm = GetCatalogHashAlgorithm(catalogVersion); + WarnIfLegacyCatalogVersion(catalogFilePath, catalogVersion); + if (!string.IsNullOrEmpty(hashAlgorithm)) { // Generate Path for Catalog Definition File @@ -733,6 +749,8 @@ internal static CatalogInformation ValidateCatalog(PSCmdlet cmdlet, Collection catalogHashes = GetHashesFromCatalog(catalogFilePath, excludedPatterns, out catalogVersion); string hashAlgorithm = GetCatalogHashAlgorithm(catalogVersion); + WarnIfLegacyCatalogVersion(catalogFilePath, catalogVersion); + if (!string.IsNullOrEmpty(hashAlgorithm)) { Dictionary fileHashes = CalculateHashesFromPath(catalogFolders, catalogFilePath, hashAlgorithm, excludedPatterns); From 697f979ddb7bde869a4128917633a3faf95a066c Mon Sep 17 00:00:00 2001 From: anamnavi Date: Mon, 10 Aug 2026 16:26:40 -0400 Subject: [PATCH 2/4] Update catalog version check condition --- .../security/CatalogHelper.cs | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/System.Management.Automation/security/CatalogHelper.cs b/src/System.Management.Automation/security/CatalogHelper.cs index cd86f7415af..a03987f7028 100644 --- a/src/System.Management.Automation/security/CatalogHelper.cs +++ b/src/System.Management.Automation/security/CatalogHelper.cs @@ -147,14 +147,14 @@ private static string GetCatalogHashAlgorithm(int catalogVersion) } /// - /// Emit an advisory warning when a catalog uses a weak (pre-v2 / SHA-1) version. - /// Advisory only: by design this does NOT fail validation - Status stays Valid for - /// compatibility. Automation should check CatalogInformation.HashAlgorithm to detect - /// SHA-1 programmatically. + /// Emit an advisory warning when using legacy catalog version 1 (SHA-1). + /// Advisory only: does not fail catalog generation/validation for compatibility. + /// Automation validating catalogs can check CatalogInformation.HashAlgorithm (Test-FileCatalog -Detailed) + /// to detect SHA-1 programmatically. /// private static void WarnIfLegacyCatalogVersion(string catalogFilePath, int catalogVersion) { - if (catalogVersion < 2) + if (catalogVersion == 1) { _cmdlet.WriteWarning(StringUtil.Format(CatalogStrings.WeakCatalogHashAlgorithm, catalogFilePath, catalogVersion)); } From 72c2be0973ce53c12725a5adfbae6114d3a2fa68 Mon Sep 17 00:00:00 2001 From: anamnavi Date: Mon, 10 Aug 2026 17:23:27 -0400 Subject: [PATCH 3/4] Update warning message --- src/System.Management.Automation/resources/CatalogStrings.resx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/System.Management.Automation/resources/CatalogStrings.resx b/src/System.Management.Automation/resources/CatalogStrings.resx index da1b1421571..9235ab84ff6 100644 --- a/src/System.Management.Automation/resources/CatalogStrings.resx +++ b/src/System.Management.Automation/resources/CatalogStrings.resx @@ -151,7 +151,7 @@ Catalog version is not valid. We only support catalog version {0} and version {1}. - Catalog '{0}' uses version {1}. Catalog version 2 is recommended. Consider regenerating this catalog with -CatalogVersion 2. + '{0}' is a version 1 catalog that uses SHA1. Consider regenerating this catalog with -CatalogVersion 2. Unable to open catalog definition file. From cf00fa0bdaca1c4f2ee9f61bdd480e132aa834cf Mon Sep 17 00:00:00 2001 From: anamnavi Date: Mon, 10 Aug 2026 17:39:03 -0400 Subject: [PATCH 4/4] remove unecessary param for warning string --- src/System.Management.Automation/security/CatalogHelper.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/System.Management.Automation/security/CatalogHelper.cs b/src/System.Management.Automation/security/CatalogHelper.cs index a03987f7028..ac64e4afbe5 100644 --- a/src/System.Management.Automation/security/CatalogHelper.cs +++ b/src/System.Management.Automation/security/CatalogHelper.cs @@ -156,7 +156,7 @@ private static void WarnIfLegacyCatalogVersion(string catalogFilePath, int catal { if (catalogVersion == 1) { - _cmdlet.WriteWarning(StringUtil.Format(CatalogStrings.WeakCatalogHashAlgorithm, catalogFilePath, catalogVersion)); + _cmdlet.WriteWarning(StringUtil.Format(CatalogStrings.WeakCatalogHashAlgorithm, catalogFilePath)); } }