Changed hash algorithm to SHA-1 to make it FIPS compliant.

[gregmcguffey]

Changed the hashing algorithm to SHA-1 to make LibZ FIPS compliant (it does not allow MD5). This works in my situation, a simple merging of referenced assemblies into the primary console app executable. It is being used in FIPS environments and is working. Other scenarios have not been tested. I haven't tested performance either, so I'm not sure how much slower SHA-1 is than MD5. In my situation, I haven't noticed any differences.

[Lakritzator]

What about making it configurable?

P.S. You probably might see a difference between the performance when the files get bigger, or maybe on systems with less CPU power.

[gregmcguffey]

Good idea. I'll look into that. It will be easy to provide a command line option to choose a hashing algorithm when . I'm not sure how to deal with this at runtime in the resolver.

[MiloszKrajewski]

Hi,

I'll take a look at this, but for some reason don't see this like some lines has been modified but as whole files has been replaced, so it is quite difficult. Additionally, container version has to be upped as it will not be not compatible with previous version (so old containers won't work with new code and new code will not work with old container). It seems to me like quite serious breaking change.

[Hellman101]

I agree the code appears to be all changed. Quick note - I had submitted a pull request with a similar change when this project was on CodePlex. The one recommendation is to use CryptoAPI so the project isn't hard coded to SHA-1. I can try to resurrect my old code in a bit as a second option.

[derwasp]

@MiloszKrajewski you can try adding ?w=1 to see the real difference. I guess line ending is different.

[riverar]

@MiloszKrajewski Any further thoughts on this? IronPDF uses LibZ and has broken all their software on all major U.S. Department of Defense machines worldwide. (Policy currently dictates all machines run in FIPS compliant mode.)

My knee-jerk proposal is:

• eliminate seemingly unnecessary use of cryptography, it creates technical debt that must be cleaned up regularly (can you instead rely on relative assembly path [e.g. libs\foo.dll] or strong name identity?)
• increase the major and declare back-compat breakage, this is a high severity design flaw that needs fixing

cc: @gregmcguffey @Lakritzator @derwasp

[Hellman101]

I couldn't figure out how to undo all the whitespace changes in @gregmcguffey PR and his changes are much better than my original changes, so I copied the changes and create a new PR with the minimal amount of changes. Credit is all @gregmcguffey but hopefully this is easier to diff and get pushed in. @MiloszKrajewski what do you think?