Uploaded image for project: 'Qt Visual Studio Tools'
  1. Qt Visual Studio Tools
  2. QTVSADDINBUG-618

MSBuild Task "GetItemHash" fails when compiling due to FIPS issue

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • P3: Somewhat important
    • 2.3.2
    • 2.3.1
    • Build-time integration
    • None
    • Visual Studio 2017 on Windows 10 Enterprise
    • Windows
    • 0675fc4d46001fb1c0936bd0354f20c9a3e66063

    Description

      When I attempt to compile a QT C++ application in Visual Studio that uses Qt/MSBuild, I get the following error message:

       

      error MSB4018: The "GetItemHash" task failed unexpectedly.
      error MSB4018: System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
      error MSB4018:    at System.Security.Cryptography.SHA1Managed..ctor()
      error MSB4018:    at InlineCode.GetItemHash.Execute() in %LOCALAPPDATA%\Temp\okytod5q.0.cs:line 73
      error MSB4018:    at Microsoft.Build.BackEnd.TaskExecutionHost.Microsoft.Build.BackEnd.ITaskExecutionHost.Execute()
      error MSB4018:    at Microsoft.Build.BackEnd.TaskBuilder.<ExecuteInstantiatedTask>d__26.MoveNext()
      

       

      The main reason I am getting this is because the FIPS (Federal Information Processing Standards) compliance group policy is enabled on my developer system.

       

      After looking over the MSBuild files in the %LOCALAPPDATA%/QtMsBuild folder on my PC, it appears that the GetItemHash is using the SHA1Managed class to create the hash, which unfortunately is not permitted according to FIPS (specifically, FIPS 140). 

       

      If possible, I request that the GetItemHash task be changed to use the SHA1Cng class instead in order for the MSBuild task to be FIPS compliant.  I made this change locally and it resulted in the application compiling successfully.  (Unfortunately, I have to do this change everytime I open Visual Studio since the files in the local appdata folder get written over when Visual Studio starts)

       

      NOTE 1: I did try to disable FIPS for just MSBuild, but that didn't seem to work.  But even if it did, this is probably a good change to make so that this Visual Studio extension works just as well on secured U.S. government computer systems as well.

       

      NOTE 2: If you want to see how to enable FIPS, this link might be of help: https://www.howtogeek.com/245859/why-you-shouldnt-enable-fips-compliant-encryption-on-windows/

       

       

      Attachments

        For Gerrit Dashboard: QTVSADDINBUG-618
        # Subject Branch Project Status CR V

        Activity

          People

            mecfc Miguel Costa
            rveira Robert Veira
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes