[CA5350] Address weak-crypto warning in DownloadUtils.cs - #1
Draft
mauroa wants to merge 1 commit into
Draft
Conversation
…in DownloadUtils
Addresses CA5350 ("Do Not Use Weak Cryptographic Algorithms") flagged by
DevDiv work item 3012464 on CreateHashAlgorithm in DownloadUtils.cs.
SHA1 here is not a security or authentication boundary: it is used only to
verify externally-published file-integrity checksums (the Android SDK
repository manifest publishes SHA1 checksums, see SdkManager.Manifest.cs)
and to compute Android SDK license hashes that must match Google's on-disk
licenses/ format (SdkManager.Licenses.cs). Removing SHA1 would break
checksum/license verification, so the behavior is preserved and the warning
is scope-suppressed to just the SHA1.Create() switch arm with a clear
justification, matching the repo's existing #pragma suppression style.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
Upstream
dotnet/android-toolsis archived / read-only. It was consolidated intodotnet/android("Merge android-tools into dotnet/android repository" dotnet#397), so a PR could not be opened againstdotnet/android-tools. This draft PR therefore targets the forkmauroa/android-toolsto capture the reviewable change and rationale. The equivalent fix should ultimately be applied indotnet/android(which now owns this source), or via a submodule/pointer update — see the work-item notes.Addresses CA5350 ("Do Not Use Weak Cryptographic Algorithms") flagged by DevDiv work item 3012464 in
src/Xamarin.Android.Tools.AndroidSdk/DownloadUtils.cs.Finding
CreateHashAlgorithmmapsChecksumType.Sha1 => SHA1.Create(), which triggers CA5350 (weak crypto: SHA1/TripleDES/RIPEMD160).Why suppress instead of remove
SHA1 here is not a security or authentication boundary — it is used purely for file-integrity verification against externally-published checksums:
SdkManager.Manifest.csreads thechecksum-typeattribute and falls back toChecksumType.Sha1when it is notsha-256, thenSdkManager.Bootstrap.csverifies the downloaded archive viaDownloadUtils.VerifyChecksum(...).SdkManager.Licenses.cs(ComputeLicenseHash) computes SHA1 to match Google's on-disklicenses/format.Removing SHA1 would break checksum and license verification against upstream-published values, so the behavior is preserved. The warning is scope-suppressed to only the
SHA1.Create()switch arm via#pragma warning disable/restore CA5350, with an inline justification — matching the repo's existing#pragmasuppression style (e.g.AndroidSdkBase.cs,ProcessUtils.cs; there is noGlobalSuppressions.cs).Change
5-line, behavior-preserving suppression around the single
SHA1.Create()line.Validation
CA5350atDownloadUtils.cs(101,25)withdotnet build -p:AnalysisMode=All -t:Rebuild.CA5350is gone; defaultdotnet build -c Debugreports 0 warnings / 0 errors.Context
Consumed by DevDiv/ClientTools.Platform indirectly (ClientTools.Platform →
android-platform-supportsubmodule →external/android-tools→ this repo).Draft for review.