XAML code always generates SHA1 checksums in binaries even when csproj file says SHA256

• .NET Core Version: (e.g. 3.0 Preview1, or daily build number, use dotnet --info)
• Windows version: (winver)

The following link has all the information about what’s installed on the machine. https://github.com/actions/runner-images/blob/main/images/win/Windows2022-Readme.md

• Does the bug reproduce also in WPF for .NET Framework 4.8?: Yes/No

Unknown

• Is this bug related specifically to tooling in Visual Studio (e.g. XAML Designer, Code editing, etc…)? If yes, please file the issue via the instructions here.

No.

Problem description:

I’m compiling C# code with msbuild. The .csproj file has: ChecksumAlgorithm SHA256 /ChecksumAlgorithm

Running ildasm on the binary, the manifest shows that the hash is still SHA1 via this line: .hash algorithm 0x00008004

The csc.exe compiler team (Tomas Matousek) has also confirmed that SHA1 is being used for the XAML c# code.

This bug does not repro on projects without XAML.

I’m also a Microsoft FTE so you can contact me directly if you need anything MS-internal.

Actual behavior:

Binary checksum is SHA1.

Expected behavior:

Binary checksum should be SHA256 as requested by .csproj file.

Minimal repro:

The attached repro includes the entire project folder post-build. It thus includes the full -bl “.binlog” file, the source code including auto-generated XAML source, and the final DLL and symbols. The only thing it excludes are the dependency dlls that were not compiled by my project but were instead auto-added by the build, e.g. api-ms-win-core…, PresentationFramework…, etc. (Removing these was required to bring the zip file down to below 25 MB.)

hwdrmdisabler_all_shrunk.zip

[ThomasGoulet73]

I have local changes to change the “#pragma checksum” in the generated code according to the current ChecksumAlgorithm of the project.

But I’m not able to reproduce how the manifest should look like (Line .hash algorithm 0x00008004 should change) in a non-WPF project. If I create a new C# Console project, add <ChecksumAlgorithm>SHA256</ChecksumAlgorithm> to the .csproj, build the project and ildasm the output assembly, the line .hash algorithm 0x00008004 never changes. @tmat Do you have some pointers on what I should do to be able to see the line .hash algorithm 0x00008004 change ?

[tmat]

You can ignore the value of .hash algorithm. It specifies a different hash, which is always SHA1. See ECMA-335 specification, paragraph II.6.2.1.1.

The source document hash algorithm that #pragma checksum specifies is written to the PDB. You can use a tool like pdb2xml to display the content of the PDB file.