raise warning if insecure sha-1 certificate fingerprint is passed to nuget.exe sign command #5924
+151
−12
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bug
Fixes: https://github.com/NuGet/Client.Engineering/issues/2931
Description
Deprecate the usage of SHA-1 fingerprints in NuGet.exe sign command especially for
CertificateFingerprint
option. Instead, allownuget.exe sign
command to accept SHA-2 (SHA-256, SHA-384 and SHA-512) family fingerprints for searching a local certificate store for the certificate.Here is how the nuget.exe sign command works after this PR has been merged:
store.Certificates.Find(X509FindType.FindByThumbprint, options.Fingerprint, validOnly);
I made similar changes to the dotnet sign command in #5895.
PR Checklist