Use SHA512 instead of SHA1.

#3992

9 files changed, 17 insertions, 15 deletions

diff --git a/src/Cpp.Build.props b/src/Cpp.Build.props
index ef9de6f0..a734aab0 100644
--- a/src/Cpp.Build.props
+++ b/src/Cpp.Build.props
@@ -25,7 +25,7 @@
       <DisableSpecificWarnings>$(DisableSpecificCompilerWarnings)</DisableSpecificWarnings>
       <WarningLevel>Level4</WarningLevel>
       <AdditionalIncludeDirectories>$(ProjectDir)inc;$(MSBuildProjectDirectory);$(IntDir);$(SqlCESdkIncludePath);$(ProjectAdditionalIncludeDirectories);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <PreprocessorDefinitions>WIN32;_WINDOWS;_WIN32_MSI=500;_WIN32_WINNT=0x0501;$(ArmPreprocessorDefinitions);$(UnicodePreprocessorDefinitions);_CRT_STDIO_LEGACY_WIDE_SPECIFIERS;_WINSOCK_DEPRECATED_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_WINDOWS;_WIN32_MSI=500;_WIN32_WINNT=0x0600;$(ArmPreprocessorDefinitions);$(UnicodePreprocessorDefinitions);_CRT_STDIO_LEGACY_WIDE_SPECIFIERS;_WINSOCK_DEPRECATED_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <PrecompiledHeader>Use</PrecompiledHeader>
       <PrecompiledHeaderFile>precomp.h</PrecompiledHeaderFile>
       <CallingConvention Condition="'$(Platform)'=='Win32'">StdCall</CallingConvention>
diff --git a/src/WixToolset.BootstrapperCore.Native/inc/BootstrapperEngine.h b/src/WixToolset.BootstrapperCore.Native/inc/BootstrapperEngine.h
index 9642748b..c0e4ded1 100644
--- a/src/WixToolset.BootstrapperCore.Native/inc/BootstrapperEngine.h
+++ b/src/WixToolset.BootstrapperCore.Native/inc/BootstrapperEngine.h
@@ -82,7 +82,7 @@ enum BOOTSTRAPPER_LOG_LEVEL
 enum BOOTSTRAPPER_UPDATE_HASH_TYPE
 {
     BOOTSTRAPPER_UPDATE_HASH_TYPE_NONE,
-    BOOTSTRAPPER_UPDATE_HASH_TYPE_SHA1,
+    BOOTSTRAPPER_UPDATE_HASH_TYPE_SHA512,
 };
 
 enum BOOTSTRAPPER_ENGINE_MESSAGE
diff --git a/src/engine/cache.cpp b/src/engine/cache.cpp
index 92a79eb9..2349a357 100644
--- a/src/engine/cache.cpp
+++ b/src/engine/cache.cpp
@@ -273,7 +273,7 @@ extern "C" HRESULT CacheCalculatePayloadWorkingPath(
     ExitOnFailure(hr, "Failed to get working folder for payload.");
 
     hr = StrAllocConcat(psczWorkingPath, pPayload->sczKey, 0);
-    ExitOnFailure(hr, "Failed to append SHA1 hash as payload unverified path.");
+    ExitOnFailure(hr, "Failed to append Id as payload unverified path.");
 
 LExit:
     return hr;
@@ -291,7 +291,7 @@ extern "C" HRESULT CacheCalculateContainerWorkingPath(
     ExitOnFailure(hr, "Failed to get working folder for container.");
 
     hr = StrAllocConcat(psczWorkingPath, pContainer->sczHash, 0);
-    ExitOnFailure(hr, "Failed to append SHA1 hash as container unverified path.");
+    ExitOnFailure(hr, "Failed to append hash as container unverified path.");
 
 LExit:
     return hr;
@@ -1750,23 +1750,23 @@ static HRESULT VerifyHash(
     UNREFERENCED_PARAMETER(wzUnverifiedPayloadPath);
 
     HRESULT hr = S_OK;
-    BYTE rgbActualHash[SHA1_HASH_LEN] = { };
+    BYTE rgbActualHash[SHA512_HASH_LEN] = { };
     DWORD64 qwHashedBytes;
     LPWSTR pszExpected = NULL;
     LPWSTR pszActual = NULL;
 
     // TODO: create a cryp hash file that sends progress.
-    hr = CrypHashFileHandle(hFile, PROV_RSA_FULL, CALG_SHA1, rgbActualHash, sizeof(rgbActualHash), &qwHashedBytes);
+    hr = CrypHashFileHandle(hFile, PROV_RSA_AES, CALG_SHA_512, rgbActualHash, sizeof(rgbActualHash), &qwHashedBytes);
     ExitOnFailure(hr, "Failed to calculate hash for path: %ls", wzUnverifiedPayloadPath);
 
     // Compare hashes.
-    if (cbHash != sizeof(rgbActualHash) || 0 != memcmp(pbHash, rgbActualHash, SHA1_HASH_LEN))
+    if (cbHash != sizeof(rgbActualHash) || 0 != memcmp(pbHash, rgbActualHash, SHA512_HASH_LEN))
     {
         hr = CRYPT_E_HASH_VALUE;
 
         // Best effort to log the expected and actual hash value strings.
         if (SUCCEEDED(StrAllocHexEncode(pbHash, cbHash, &pszExpected)) &&
-            SUCCEEDED(StrAllocHexEncode(rgbActualHash, SHA1_HASH_LEN, &pszActual)))
+            SUCCEEDED(StrAllocHexEncode(rgbActualHash, (SIZE_T)qwHashedBytes, &pszActual)))
         {
             ExitOnFailure(hr, "Hash mismatch for path: %ls, expected: %ls, actual: %ls", wzUnverifiedPayloadPath, pszExpected, pszActual);
         }
diff --git a/src/engine/cache.h b/src/engine/cache.h
index f8ad2a90..a00c50b7 100644
--- a/src/engine/cache.h
+++ b/src/engine/cache.h
@@ -16,7 +16,7 @@ HRESULT CacheInitialize(
     __in_z_opt LPCWSTR wzSourceProcessPath
     );
 HRESULT CacheEnsureWorkingFolder(
-    __in_z LPCWSTR wzBundleId,
+    __in_z_opt LPCWSTR wzBundleId,
     __deref_out_z_opt LPWSTR* psczWorkingFolder
     );
 HRESULT CacheCalculateBundleWorkingPath(
diff --git a/src/engine/externalengine.cpp b/src/engine/externalengine.cpp
index f9a06437..26ab9fba 100644
--- a/src/engine/externalengine.cpp
+++ b/src/engine/externalengine.cpp
@@ -288,7 +288,7 @@ HRESULT ExternalEngineSetUpdate(
     {
         hr = E_INVALIDARG;
     }
-    else if (BOOTSTRAPPER_UPDATE_HASH_TYPE_SHA1 == hashType && (SHA1_HASH_LEN != cbHash || !rgbHash))
+    else if (BOOTSTRAPPER_UPDATE_HASH_TYPE_SHA512 == hashType && (SHA512_HASH_LEN != cbHash || !rgbHash))
     {
         hr = E_INVALIDARG;
     }
diff --git a/src/engine/userexperience.cpp b/src/engine/userexperience.cpp
index 84e88718..40a30c5d 100644
--- a/src/engine/userexperience.cpp
+++ b/src/engine/userexperience.cpp
@@ -111,7 +111,7 @@ extern "C" HRESULT UserExperienceLoad(
     args.pCommand = pCommand;
     args.pfnBootstrapperEngineProc = EngineForApplicationProc;
     args.pvBootstrapperEngineProcContext = pEngineContext;
-    args.qwEngineAPIVersion = MAKEQWORDVERSION(2021, 2, 24, 0);
+    args.qwEngineAPIVersion = MAKEQWORDVERSION(2021, 3, 2, 0);
 
     results.cbSize = sizeof(BOOTSTRAPPER_CREATE_RESULTS);
 
diff --git a/src/test/BurnUnitTest/BurnUnitTest.vcxproj b/src/test/BurnUnitTest/BurnUnitTest.vcxproj
index 869ba7a2..2ca7219e 100644
--- a/src/test/BurnUnitTest/BurnUnitTest.vcxproj
+++ b/src/test/BurnUnitTest/BurnUnitTest.vcxproj
@@ -69,6 +69,7 @@
     <ResourceCompile Include="BurnUnitTest.rc" />
   </ItemGroup>
   <ItemGroup>
+    <None Include="TestData\CacheTest\CacheSignatureTest.File" CopyToOutputDirectory="PreserveNewest" />
     <None Include="TestData\PlanTest\BasicFunctionality_BundleA_manifest.xml" CopyToOutputDirectory="PreserveNewest" />
     <None Include="TestData\PlanTest\MsiTransaction_BundleAv1_manifest.xml" CopyToOutputDirectory="PreserveNewest" />
     <None Include="TestData\PlanTest\Slipstream_BundleA_manifest.xml" CopyToOutputDirectory="PreserveNewest" />
diff --git a/src/test/BurnUnitTest/CacheTest.cpp b/src/test/BurnUnitTest/CacheTest.cpp
index 6d261842..fc0b4531 100644
--- a/src/test/BurnUnitTest/CacheTest.cpp
+++ b/src/test/BurnUnitTest/CacheTest.cpp
@@ -24,7 +24,7 @@ namespace Bootstrapper
         {
         }
 
-        [Fact(Skip = "Currently fails")]
+        [Fact]
         void CacheSignatureTest()
         {
             HRESULT hr = S_OK;
@@ -36,12 +36,12 @@ namespace Bootstrapper
 
             try
             {
-                pin_ptr<const wchar_t> dataDirectory = PtrToStringChars(this->TestContext->DataDirectory);
-                hr = PathConcat(dataDirectory, L"BurnTestPayloads\\Products\\TestExe\\TestExe.exe", &sczPayloadPath);
+                pin_ptr<const wchar_t> dataDirectory = PtrToStringChars(this->TestContext->TestDirectory);
+                hr = PathConcat(dataDirectory, L"TestData\\CacheTest\\CacheSignatureTest.File", &sczPayloadPath);
                 Assert::True(S_OK == hr, "Failed to get path to test file.");
                 Assert::True(FileExistsEx(sczPayloadPath, NULL), "Test file does not exist.");
 
-                hr = StrAllocHexDecode(L"232BD16B78C1926F95D637731E1EE5379A3C4222", &pb, &cb);
+                hr = StrAllocHexDecode(L"25e61cd83485062b70713aebddd3fe4992826cb121466fddc8de3eacb1e42f39d4bdd8455d95eec8c9529ced4c0296ab861931fe2c86df2f2b4e8d259a6d9223", &pb, &cb);
                 Assert::Equal(S_OK, hr);
 
                 package.fPerMachine = FALSE;
diff --git a/src/test/BurnUnitTest/TestData/CacheTest/CacheSignatureTest.File b/src/test/BurnUnitTest/TestData/CacheTest/CacheSignatureTest.File
new file mode 100644
index 00000000..896ac017
--- /dev/null
+++ b/src/test/BurnUnitTest/TestData/CacheTest/CacheSignatureTest.File
@@ -0,0 +1 @@
+This file has a known hash.
\ No newline at end of file