Details
-
Bug
-
Resolution: Fixed
-
P3: Somewhat important
-
2.3.1
-
None
-
Visual Studio 2017 on Windows 10 Enterprise
-
-
0675fc4d46001fb1c0936bd0354f20c9a3e66063
Description
When I attempt to compile a QT C++ application in Visual Studio that uses Qt/MSBuild, I get the following error message:
error MSB4018: The "GetItemHash" task failed unexpectedly. error MSB4018: System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms. error MSB4018: at System.Security.Cryptography.SHA1Managed..ctor() error MSB4018: at InlineCode.GetItemHash.Execute() in %LOCALAPPDATA%\Temp\okytod5q.0.cs:line 73 error MSB4018: at Microsoft.Build.BackEnd.TaskExecutionHost.Microsoft.Build.BackEnd.ITaskExecutionHost.Execute() error MSB4018: at Microsoft.Build.BackEnd.TaskBuilder.<ExecuteInstantiatedTask>d__26.MoveNext()
The main reason I am getting this is because the FIPS (Federal Information Processing Standards) compliance group policy is enabled on my developer system.
After looking over the MSBuild files in the %LOCALAPPDATA%/QtMsBuild folder on my PC, it appears that the GetItemHash is using the SHA1Managed class to create the hash, which unfortunately is not permitted according to FIPS (specifically, FIPS 140).
If possible, I request that the GetItemHash task be changed to use the SHA1Cng class instead in order for the MSBuild task to be FIPS compliant. I made this change locally and it resulted in the application compiling successfully. (Unfortunately, I have to do this change everytime I open Visual Studio since the files in the local appdata folder get written over when Visual Studio starts)
NOTE 1: I did try to disable FIPS for just MSBuild, but that didn't seem to work. But even if it did, this is probably a good change to make so that this Visual Studio extension works just as well on secured U.S. government computer systems as well.
NOTE 2: If you want to see how to enable FIPS, this link might be of help: https://www.howtogeek.com/245859/why-you-shouldnt-enable-fips-compliant-encryption-on-windows/