NuGet / NuGetGallery

NuGet Gallery is a package repository that powers https://www.nuget.org. Use this repo for reporting NuGet.org issues.
https://www.nuget.org/
Apache License 2.0
1.54k stars 644 forks source link

Replace SHA-1 fingerprints with SHA-256 fingerprints #10073

Open dtivel opened 1 month ago

dtivel commented 1 month ago

SHA-1 fingerprints should not be used. Use SHA-256 fingerprints instead. This is for SDL compliance.

From https://github.com/search?q=repo%3ANuGet%2FNuGetGallery%20SHA-1&type=code

joelverhagen commented 1 month ago

Related: https://github.com/NuGet/NuGetGallery/issues/9523.

mariaghiondea commented 1 month ago

Related internal item: Task 2046665: Use approved crypto libraries for the supported platform