GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — tools: upgrade Windows digital signature to SHA256 by tniessen · Pull Request #47206 · nodejs/node

Conversation

@tniessen

@tniessen tniessen commented Mar 21, 2023

Copy link
Copy Markdown
Member

signtool still defaults to SHA1, which is vulnerable to certain collisions. This switches to SHA256, which is stronger and which also matches the hash function used by the signing certificate.

Technically, /fd certHash would be a better choice, but I don't know if it is widely supported.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@tniessen
tools: upgrade Windows digital signature to SHA256
8570c1e 
signtool still defaults to SHA1, which is vulnerable to certain
collisions. This switches to SHA256, which is stronger and which also
matches the hash function used by the signing certificate.

Technically, `/fd certHash` would be a better choice, but I don't know
if it is widely supported.
@tniessen tniessen added windows Issues and PRs related to the Windows platform. build Issues and PRs related to Node.js builds or CI infrastructure. tools Issues and PRs related to the tools directory. security Issues and PRs related to security. labels Mar 21, 2023
@nodejs-github-bot nodejs-github-bot added the needs-ci PRs that need a full CI run. label Mar 21, 2023
@tniessen

tniessen commented Mar 21, 2023

Copy link
Copy Markdown
Member Author

cc @nodejs/build @nodejs/platform-windows
ovflowd reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tniessen tniessen mentioned this pull request Mar 21, 2023
Windows MSI Installer for Node/npm (LTS) uses vulnerable/obsolete security certificate hash, SHA1 nodejs/nodejs.org#4522
Closed
ovflowd
ovflowd approved these changes Mar 21, 2023
View reviewed changes

@ovflowd ovflowd left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not build, but looks good to me :)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
targos
targos approved these changes Mar 22, 2023
View reviewed changes
@targos

targos commented Mar 22, 2023

Copy link
Copy Markdown
Member

/fd certHash was added to the documentation in 2020 so I guess it's not supported by VS2019.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tniessen tniessen added author ready PRs with CI started, the required approvals, and no outstanding review comments. request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Mar 22, 2023
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Mar 22, 2023
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
lpinca
lpinca approved these changes Mar 22, 2023
View reviewed changes
@github-actions github-actions Bot mentioned this pull request Mar 23, 2023
CI Reliability 2023-03-23 nodejs/reliability#533
Open
33 tasks
@nodejs-github-bot

nodejs-github-bot commented Mar 23, 2023

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/50568/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tniessen tniessen added the commit-queue PRs queued for automated landing through the Commit Queue. label Mar 25, 2023
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Mar 25, 2023
@nodejs-github-bot
nodejs-github-bot merged commit 6311de3 into nodejs:main Mar 25, 2023
@nodejs-github-bot

nodejs-github-bot commented Mar 25, 2023

Copy link
Copy Markdown
Collaborator

Landed in 6311de3
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@RafaelGSS RafaelGSS mentioned this pull request Apr 3, 2023
2023-04-18, Version 20.0.0 (Current) #47381
Merged
RafaelGSS pushed a commit that referenced this pull request Apr 5, 2023
@tniessen @RafaelGSS
tools: upgrade Windows digital signature to SHA256
6206d3e 
signtool still defaults to SHA1, which is vulnerable to certain
collisions. This switches to SHA256, which is stronger and which also
matches the hash function used by the signing certificate.

Technically, `/fd certHash` would be a better choice, but I don't know
if it is widely supported.

PR-URL: #47206
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
@RafaelGSS RafaelGSS mentioned this pull request Apr 6, 2023
v19.9.0 proposal #47441
Merged
RafaelGSS pushed a commit that referenced this pull request Apr 6, 2023
@tniessen @RafaelGSS
tools: upgrade Windows digital signature to SHA256
3ce6a64 
signtool still defaults to SHA1, which is vulnerable to certain
collisions. This switches to SHA256, which is stronger and which also
matches the hash function used by the signing certificate.

Technically, `/fd certHash` would be a better choice, but I don't know
if it is widely supported.

PR-URL: #47206
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
RafaelGSS pushed a commit that referenced this pull request Apr 7, 2023
@tniessen @RafaelGSS
tools: upgrade Windows digital signature to SHA256
def7e3d 
signtool still defaults to SHA1, which is vulnerable to certain
collisions. This switches to SHA256, which is stronger and which also
matches the hash function used by the signing certificate.

Technically, `/fd certHash` would be a better choice, but I don't know
if it is widely supported.

PR-URL: #47206
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
danielleadams pushed a commit that referenced this pull request Jul 6, 2023
@tniessen @danielleadams
tools: upgrade Windows digital signature to SHA256
9781185 
signtool still defaults to SHA1, which is vulnerable to certain
collisions. This switches to SHA256, which is stronger and which also
matches the hash function used by the signing certificate.

Technically, `/fd certHash` would be a better choice, but I don't know
if it is widely supported.

PR-URL: #47206
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
@danielleadams danielleadams mentioned this pull request Jul 10, 2023
v18.17.0 release proposal #48694
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lpinca lpinca lpinca approved these changes
@ovflowd ovflowd ovflowd approved these changes
+1 more reviewer
@targos targos targos approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. build Issues and PRs related to Node.js builds or CI infrastructure. needs-ci PRs that need a full CI run. security Issues and PRs related to security. tools Issues and PRs related to the tools directory. windows Issues and PRs related to the Windows platform.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

@tniessen @targos @nodejs-github-bot @lpinca @ovflowd
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.