Fix hash mismatch on signed dotnet-install.ps1 (non-ASCII characters)#730
Merged
Merged
Conversation
The signed PowerShell script contained two non-ASCII em dash characters (U+2014) in comments, introduced by #697. When Authenticode-signed without a BOM, non-ASCII content causes the file hash to fail validation across differing code pages, producing the 'hash does not match the digital signature' error under AllSigned policy. This is a recurrence of #541 (fixed in #543 by removing an emoji). Replace the em dashes with ASCII hyphens and add a regression test that asserts both install scripts contain only ASCII bytes, guarding against a third recurrence. Fixes #729 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
mthalman
approved these changes
Jul 7, 2026
github-project-automation
Bot
moved this from Backlog
to Rollout
in .NET Install Scripts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Users running the signed
dotnet-install.ps1(from https://dot.net/v1/dotnet-install.ps1) under theAllSignedexecution policy hit:This is a recurrence of #541 (previously fixed in #543 by removing an emoji).
Root cause
src/dotnet-install.ps1contained two non-ASCII em dash characters (U+2014) in code comments on lines 942 and 959, introduced in #697. The file is saved without a byte-order mark, and when a script containing non-ASCII characters is Authenticode-signed without a BOM, its content hash fails validation on machines whose active code page differs from the signing machine. See the Microsoft troubleshooting guide. The.shscript was unaffected.Approach
ScriptEncodingTests) that reads both install scripts as bytes and fails with the exact line and offset if any byte is greater than 127. Since this bug class has now shipped twice, the test guards against a third recurrence.Validation
I chose to remove the characters rather than add a UTF-8 BOM, matching the precedent from #543.
Fixes: #729