From 0b179c0e314fb420dc541362459d56a828b0dc33 Mon Sep 17 00:00:00 2001 From: maagno Date: Tue, 11 Aug 2026 12:11:43 -0400 Subject: [PATCH] [CA5350] Scope-suppress weak-crypto warning for SHA1 file-integrity checks in DownloadUtils Addresses CA5350 ("Do Not Use Weak Cryptographic Algorithms") flagged by DevDiv work item 3012464 on CreateHashAlgorithm in DownloadUtils.cs. SHA1 here is not a security or authentication boundary: it verifies externally-published Android SDK file-integrity checksums (SdkManager.Manifest.cs) and computes Android SDK license hashes matching Google's on-disk licenses/ format (SdkManager.Licenses.cs ComputeLicenseHash). Removing SHA1 would break checksum/license verification, so behavior is preserved and the warning is scope-suppressed to just the SHA1.Create() switch arm. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- src/Xamarin.Android.Tools.AndroidSdk/DownloadUtils.cs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/Xamarin.Android.Tools.AndroidSdk/DownloadUtils.cs b/src/Xamarin.Android.Tools.AndroidSdk/DownloadUtils.cs index 2fc56cb4a41..8412705013d 100644 --- a/src/Xamarin.Android.Tools.AndroidSdk/DownloadUtils.cs +++ b/src/Xamarin.Android.Tools.AndroidSdk/DownloadUtils.cs @@ -98,7 +98,12 @@ internal static string ComputeHashString (ChecksumType checksumType, byte[] data static HashAlgorithm CreateHashAlgorithm (ChecksumType checksumType) => checksumType switch { ChecksumType.Sha256 => (HashAlgorithm) SHA256.Create (), + // SHA1 is used only to verify externally-published file-integrity checksums (Android SDK + // repository manifests publish SHA1 checksums) and to match Google's on-disk license hashes, + // not as a security or authentication boundary. See ChecksumType / SdkManager.Manifest.cs. +#pragma warning disable CA5350 // Do Not Use Weak Cryptographic Algorithms ChecksumType.Sha1 => SHA1.Create (), +#pragma warning restore CA5350 _ => throw new NotSupportedException ($"Unsupported checksum type: '{checksumType}'."), };