[release/13.5] Use SHA-512 for Aspire Skills bundle integrity checks and hide the remote-fetch preview toggle by aspire-repo-bot[bot] · Pull Request #19448 · microsoft/aspire

aspire-repo-bot · 2026-08-17T20:06:49Z

Backport of #19303 to release/13.5

Customer Impact

Testing

Risk

Regression?

…tch toggle Aligns the Aspire Skills bundle integrity checks on SHA-512, matching the digest the CLI acquisition scripts (get-aspire-cli.*) already use. This is a consistency/modernization change, not prompted by any defect in SHA-256. - Archive checksum (aspire-skills.metadata.json, update/verify scripts, AspireSkillsInstaller) now uses SHA-512. - Per-file bundle hashes in skill-manifest.json (validated by AspireSkillsBundle) now use SHA-512. - Telemetry-hook hashes (Get-AspireSkills*Hex) now use SHA-512. - Rebuilt the embedded aspire-skills-v0.0.1.tgz snapshot so its internal manifest carries SHA-512 hashes; recomputed the archive SHA-512. The CLI verifies fully offline with no dependency on an aspire-skills re-release. - Renamed the localized resource key, updated strings, regenerated xlf. - Hid the aspireSkillsRemoteFetchEnabled toggle from `aspire config` output and the generated VS Code schemas (flag still functions; default off). - Updated unit + E2E tests to SHA-512. The GitHub artifact attestation digest intentionally stays sha256: — GitHub's attestation API is keyed by the artifact's SHA-256 subject digest. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Addresses PR review feedback: - ConfigCommandTests: assert aspireSkillsRemoteFetchEnabled is absent from both 'config list --all' and 'config info --json', and that it is still honored when set directly in configuration (hiding only removes it from discovery). - AspireSkillsInstallerTests: add a self-computing end-to-end test that opens the real embedded provider, verifies the archive SHA-512 against the recorded metadata, extracts the .tgz, recomputes every per-file SHA-512 from the internal skill-manifest.json (asserting 128-hex digests), and runs the production AspireSkillsBundle loader over the extracted snapshot. It reads whatever is embedded, so it survives future bundle swaps. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dff98a25-4c5c-4889-9437-289c2e023c4d

…ile hashes The embedded Aspire skills bundle must be the exact attestation-verified release asset so `gh attestation verify` (which looks it up by the artifact's SHA-256 subject digest) succeeds. Rebuilding the .tgz locally to inject SHA-512 per-file manifests produced bytes with no published attestation, which failed the verify-aspire-skills-bundle CI job with an HTTP 404. Restore the attested v0.0.1 archive verbatim and record its SHA-512 as the full-file archive checksum in metadata. Make per-file validation algorithm-agnostic: prefer SHA-512 (emitted by current microsoft/aspire-skills builds) and accept SHA-256 for bundles published before the switch, so the trusted last-resort embedded snapshot keeps loading until a signed SHA-512 release is re-embedded. The full-file archive checksum, telemetry hooks, and remote-fetch path remain SHA-512. - SkillBundleFile: add optional Sha256 alongside preferred Sha512 - AspireSkillsBundle.ValidateFile: verify against whichever digest the manifest declares (SHA-512 preferred), restore NormalizeSha256 - Embedded metadata: SHA-512 of the attested v0.0.1 asset - Tests: rework the embedded integrity test to be algorithm-agnostic; add coverage for the legacy SHA-256 per-file path and the no-hash error Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dff98a25-4c5c-4889-9437-289c2e023c4d

github-actions · 2026-08-17T20:07:07Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19448

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19448"

Copilot

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

This PR migrates Aspire skills bundle integrity checks from SHA-256 to SHA-512 (while keeping legacy per-file SHA-256 support for already-attested bundles), and hides a preview feature flag from user-facing discovery surfaces.

Changes:

Switched embedded archive and hook/hash verification from SHA-256 to SHA-512 across CLI code, engineering scripts, and tests.
Updated skills bundle manifest support to prefer per-file SHA-512 while still accepting legacy per-file SHA-256.
Introduced a Hidden feature flag attribute and filtered hidden features from config list --all, config info --json, and VS Code schemas; added tests for hidden-flag behavior.

Reviewed changes

Copilot reviewed 33 out of 34 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/Infrastructure.Tests/PowerShellScripts/AspireSkillsBundleHashTests.cs	Updates PowerShell driver test oracle to SHA-512.
tests/Aspire.Cli.Tests/TestServices/FakePlaywrightServices.cs	Updates test bundle file hashing to SHA-512.
tests/Aspire.Cli.Tests/Commands/ConfigCommandTests.cs	Adds regression tests ensuring hidden features aren’t advertised but remain honored when set.
tests/Aspire.Cli.Tests/Commands/AgentInitCommandTests.cs	Updates agent init tests to use SHA-512 per-file hashes.
tests/Aspire.Cli.Tests/Agents/AspireSkillsInstallerTests.cs	Updates installer tests to SHA-512 and adds end-to-end validation of embedded archive + per-file manifest hashes.
tests/Aspire.Cli.Tests/Agents/AspireSkillsBundleTests.cs	Adds coverage for legacy SHA-256 per-file validation and missing-hash failures; updates SHA-512 expectations.
tests/Aspire.Cli.EndToEnd.Tests/AgentCommandTests.cs	Updates seeded cache manifest generation to SHA-512 hashes.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.zh-Hant.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.zh-Hans.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.tr.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.ru.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.pt-BR.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.pl.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.ko.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.ja.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.it.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.fr.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.es.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.de.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/xlf/AgentCommandStrings.cs.xlf	Updates localized resource keys/messages for SHA-512 metadata + verification failures.
src/Aspire.Cli/Resources/AgentCommandStrings.resx	Renames/updates resource strings for SHA-512.
src/Aspire.Cli/KnownFeatures.cs	Adds `Hidden` to feature metadata and hides `aspireSkillsRemoteFetchEnabled` from discovery.
src/Aspire.Cli/Commands/ConfigCommand.cs	Filters hidden features out of config list/info available-features output.
src/Aspire.Cli/Agents/AspireSkills/SkillBundleManifest.cs	Adds per-file `Sha512` and switches embedded metadata to `Sha512`.
src/Aspire.Cli/Agents/AspireSkills/Embedded/aspire-skills.metadata.json	Updates embedded bundle metadata to SHA-512.
src/Aspire.Cli/Agents/AspireSkills/AspireSkillsInstaller.cs	Validates embedded archive via SHA-512 and updates metadata validation key.
src/Aspire.Cli/Agents/AspireSkills/AspireSkillsBundle.cs	Prefers SHA-512 per-file validation while accepting legacy SHA-256; adds SHA-512 normalization helper.
extension/schemas/aspire-settings.schema.json	Removes hidden feature from schema discovery; adds/updates other feature definitions.
extension/schemas/aspire-global-settings.schema.json	Removes hidden feature from schema discovery; adds/updates other feature definitions.
extension/schemas/aspire-config.schema.json	Removes hidden feature from schema discovery; adds/updates other feature definitions.
eng/scripts/verify-aspire-skills-bundle.ps1	Updates verification script to SHA-512 for archive and hook hashes.
eng/scripts/update-aspire-skills-bundle.ps1	Updates update script to compute/store SHA-512 and hook hashes.
eng/scripts/aspire-skills-bundle.common.ps1	Renames helper function and switches hashing implementation to SHA-512.

Files not reviewed (1)

src/Aspire.Cli/Resources/AgentCommandStrings.Designer.cs: Generated file

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

+    // bundle archive (an optional `sha512-` SRI-style prefix is tolerated). Emitted per-file by current
+    // microsoft/aspire-skills' build-aspire-bundles.mjs and verified by AspireSkillsBundle.ValidateFile.
+    public string? Sha512 { get; init; }
+
+    // Lowercase hex SHA-256 of the file contents, accepted only for bundles published before the SHA-512
+    // switch — notably the attestation-verified v0.0.1 snapshot currently embedded in the CLI, whose bytes
+    // cannot be re-hashed without breaking their published attestation. When both are present SHA-512 wins;
+    // an optional `sha256-` SRI-style prefix is tolerated. New/remote bundles emit `Sha512` and this is null.


+    internal static string NormalizeSha512(string sha512)
+    {
+        const string prefix = "sha512-";
+        return sha512.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)
+            ? sha512[prefix.Length..]
+            : sha512;
+    }


+    private static string ComputeSha512(Stream stream)
    {
-        return Convert.ToHexString(SHA256.HashData(stream)).ToLowerInvariant();
+        return Convert.ToHexString(SHA512.HashData(stream)).ToLowerInvariant();
+    }


github-actions · 2026-08-17T20:10:24Z

Tests selector (audit mode)

The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement.

Runs the full test matrix + all jobs (ALL) — run-all fallback: 'eng/scripts/aspire-skills-bundle.common.ps1' is neither Layer-1-owned nor matched by a Layer 2 rule

Selection computed for commit 13b50e8.

Jose Perez Rodriguez (joperezr)

Talked about this one earlier today. Approved.

aspire-repo-bot · 2026-08-17T22:36:51Z

✅ No documentation update needed.

Step 5 branch taken: excluded → backport (base_branch_is_release, head_branch_is_backport, title_release_prefix, body_backport_marker)

Triggered signals (2): cli_command_file_changed, cli_resource_strings_changed

PR title is prefixed [release/13.5] and body states "Backport of Use SHA-512 for Aspire Skills bundle integrity checks and hide the remote-fetch preview toggle #19303 to release/13.5"
Base branch is release/13.5, head branch matches backport pattern
This is a backport of the original (forward) PR Use SHA-512 for Aspire Skills bundle integrity checks and hide the remote-fetch preview toggle #19303; documentation for this change should be authored against that original PR on the default branch, not duplicated here.

No docs PR drafted per exclusion rule for backports.

David Pine and others added 3 commits August 17, 2026 20:06

Copilot AI balanced review requested due to automatic review settings August 17, 2026 20:06

aspire-repo-bot Bot requested review from James Newton-King (JamesNK), Adam Ratzman (adamint), David Fowler (davidfowl), Ella Hathaway (ellahathaway) and Mitch Denny (mitchdenny) as code owners August 17, 2026 20:06

github-actions Bot added the area-cli label Aug 17, 2026

Copilot AI reviewed Aug 17, 2026

View reviewed changes

Jose Perez Rodriguez (joperezr) approved these changes Aug 17, 2026

View reviewed changes

Jose Perez Rodriguez (joperezr) merged commit fba5676 into release/13.5 Aug 17, 2026
344 checks passed

Jose Perez Rodriguez (joperezr) deleted the backport/pr-19303-to-release/13.5 branch August 17, 2026 22:25

microsoft-github-policy-service Bot added this to the 13.5 milestone Aug 17, 2026

Navigation Menu

Uh oh!

[release/13.5] Use SHA-512 for Aspire Skills bundle integrity checks and hide the remote-fetch preview toggle - #19448

[release/13.5] Use SHA-512 for Aspire Skills bundle integrity checks and hide the remote-fetch preview toggle#19448
Jose Perez Rodriguez (joperezr) merged 3 commits into
release/13.5from
backport/pr-19303-to-release/13.5

aspire-repo-bot Bot commented Aug 17, 2026

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

Jose Perez Rodriguez (joperezr) left a comment

Uh oh!

Uh oh!

aspire-repo-bot Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

aspire-repo-bot Bot commented Aug 17, 2026

Customer Impact

Testing

Risk

Regression?

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented Aug 17, 2026

Tests selector (audit mode)

Uh oh!

Jose Perez Rodriguez (joperezr) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aspire-repo-bot Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants