mathnet/mathnet-symbolics

Code signing algorithm update

cgravill opened this issue · 3 comments

cgravill commented

Thanks for building the library, it’s been really useful.

I recently updated to v0.18 in some of our tools. They’ve been security flagged by automated tools for review due to the SHA-1 signing on mathnet symbolics.

I checked, and it looks like the signtool.exe being used can do more secure hashing algorithms e.g. one of the SHA-2 with the /fd flag:
https://msdn.microsoft.com/en-us/library/windows/desktop/jj835835(v=vs.85).aspx

Is it possible to upgrade? It looks to work but I don’t have the corresponding certificate to confirm.

cdrnet commented

Thanks for the hint - I'll verify (and do a patch release if it works)!

cdrnet commented

I've just released v0.18.1, which is exactly like v0.18.0 but uses SHA2-256 instead of SHA1 for the code signing. Thanks for the hint, SHA1 has indeed been deprecated for code signing purposes for quite a while.

Could you please verify whether it now passes your security tool?

If it passes, I'll update the other Math.NET projects the same way.

  • 👍1
cgravill commented

Thanks, that's excellent. I can confirm the automated security tools pass when I updated Symbolics to v0.18.1

Much appreciated.

  • 👍2