Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support TLS v1.2 #458

Closed
ferventcoder opened this issue Oct 10, 2015 · 1 comment
Closed

Support TLS v1.2 #458

ferventcoder opened this issue Oct 10, 2015 · 1 comment
Assignees
@ferventcoder
Labels
5 - Released Bug Priority_HIGH Security
Milestone
0.10.1

Comments

@ferventcoder
Copy link
Member

https://groups.google.com/d/msgid/chocolatey/a84e2f24-8568-4ec0-927a-d55152b5dbc9%40googlegroups.com?utm_medium=email&utm_source=footer

The tl;dr is http://stackoverflow.com/questions/4137106/are-there-net-implementation-of-tls-1-2

Related to #8 for full implementation

Sorry Windows 2003 fans. We'll also be looking at how we can ensure that it works .
@ferventcoder ferventcoder added this to the 0.9.10 milestone Oct 10, 2015
ferventcoder added a commit to ferventcoder/choco that referenced this issue Oct 10, 2015
@ferventcoder
(chocolateyGH-458) Upgrade to .NET 4.5.2
ee9e8ea 
Prior to being able to use TLS 1.2, it is required that choco be
upgraded to at least .NET 4.5. Upgrade each of the projects
ferventcoder added a commit to ferventcoder/choco that referenced this issue Oct 10, 2015
@ferventcoder
(chocolateyGH-458) use .NET 4.5 for builds
40798f4
@ferventcoder ferventcoder mentioned this issue Oct 10, 2015
Closed
@ferventcoder ferventcoder self-assigned this Oct 10, 2015
ferventcoder added a commit to ferventcoder/choco that referenced this issue Oct 10, 2015
@ferventcoder
(chocolateyGH-458) Retarget to .NET 4.5 nuget assemblies
ae22e98 
NuGet detected that some assemblies required that they be
reinstalled/retargeted to take advantage of the newer assembly
framework.
@ferventcoder ferventcoder changed the title NuGet doesn't support TLS v1.2 only NuGet doesn't support TLS v1.2 Oct 10, 2015
@ferventcoder ferventcoder changed the title NuGet doesn't support TLS v1.2 Choco / NuGet doesn't support TLS v1.2 Oct 10, 2015
@ferventcoder ferventcoder modified the milestones: 0.9.11, 0.9.10 Oct 11, 2015
ferventcoder added a commit to ferventcoder/choco that referenced this issue Oct 11, 2015
@ferventcoder
(chocolateyGH-458) Retarget to .NET 4.5 nuget assemblies
0c171b3 
NuGet detected that some assemblies required that they be
reinstalled/retargeted to take advantage of the newer assembly
framework.
ferventcoder added a commit to ferventcoder/choco that referenced this issue Oct 11, 2015
@ferventcoder
(chocolateyGH-458) Conditional compilation symbols for .NET version
fd09a01 
.NET doesn't have compiler conditionals for the different
versions of the .NET Frameworks, so it's not possible out of the
box to target different functionality based on the .NET versions.
Add a property group in a targets file based on
http://stackoverflow.com/a/29001688/18475 and ensure that both
chocolatey and chocolatey.console VS projects use those targets
files.
ferventcoder added a commit to ferventcoder/choco that referenced this issue Oct 11, 2015
@ferventcoder
(chocolateyGH-458) Support TLS v1.2
91e492c 
The .NET Framework supports TLS v1.2 as of version 4.5 -
http://msdn.microsoft.com/en-us/library/system.security.authentication.sslprotocols(v=vs.110).aspx
but the security protocol is not set to use it out of the box.

Set the SecurityProtocol to start with the highest encryption available
and move down from there. If someone compiles choco with .NET 4.0, post
a warning about the encryption not being good enough.
ferventcoder added a commit to ferventcoder/choco that referenced this issue Oct 12, 2015
@ferventcoder
(chocolateyGH-458) ILMerge to 4.5
c98abbb 
Retarget ILMerge to .NET 4.5 reference assemblies.
@ferventcoder ferventcoder modified the milestones: 0.10.1, 0.11.0 Sep 2, 2016
@ferventcoder
Copy link
Member Author

Was able to retarget this without requiring an upgrade to .NET 4.5.

@ferventcoder ferventcoder changed the title Choco / NuGet doesn't support TLS v1.2 Support TLS v1.2 Sep 2, 2016
ferventcoder added a commit that referenced this issue Sep 2, 2016
@ferventcoder
(GH-458) Support TLS v1.2
2d39d97 
The .NET Framework supports TLS v1.2 as of version 4.5 -
http://msdn.microsoft.com/en-us/library/system.security.authentication.sslprotocols(v=vs.110).aspx
but the security protocol is not set to use it out of the box.

Set the SecurityProtocol to start with the highest encryption available
and move down from there.

Choco is compiled on .NET 4.0, but .NET 4.5 is an in place upgrade,
which gives us access to set the proper security protocols by
converting the enumeration values directly into `SecurityProtocolType`.
This will fail when running on .NET 4.0, so fall back to using TLS,
then SSLv3 with a warning recommending folks upgrade to .NET 4.5 at
their earliest convenience.
ferventcoder added a commit that referenced this issue Sep 2, 2016
@ferventcoder
Merge branch 'stable'
b077c3a 
* stable:
  (maint) Log Option Parse Error w/Converted Message
  (doc) Log Silent Args that Were Overridden
  (GH-937) Installer Location as Working Directory
  (GH-937) Externalize Working Directory
  (GH-941) Install-ChocolateyInstallPackage - Alias $fileFullPath
  (GH-458) Support TLS v1.2
ferventcoder added a commit that referenced this issue Sep 19, 2016
@ferventcoder
(GH-458) Warn To Verbose Log For Now
558c845 
We want to provide the TLS warning in a way that doesn't have people
just blindly ignoring future warnings, so we need a way to toggle the
warning off once someone has accepted they have read and understood the
warning. For now we will log to verbose so that it is at least present
in logs, and when folks run at verbose.
ferventcoder added a commit that referenced this issue Sep 19, 2016
@ferventcoder
Merge branch 'stable'
f48be9e 
* stable:
  (version) 0.10.1
  (GH-943) Remove Transaction Lock Even on Failure
  (doc) update CHANGELOG/nuspec
  (doc) add CHANGELOG title/summary
  (doc) update licensed changelog
  (GH-458) Warn To Verbose Log For Now
  (doc) add licensed changelog
  (maint) formatting
  (doc) Note Runtime Options For Checksums In Error
@ferventcoder ferventcoder mentioned this issue Nov 2, 2016
Closed
@gep13 gep13 mentioned this issue May 8, 2017
Closed
@gep13 gep13 mentioned this issue Jul 7, 2023
Closed
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ferventcoder ferventcoder

Labels
5 - Released Bug Priority_HIGH Security
Projects
None yet
Milestone
0.10.1
Development

No branches or pull requests
2 participants
@ferventcoder @gep13