Switch to SHA256 hashing.

.build/PrepareArtifacts.ps1

@@ -9,7 +9,7 @@ $ArtifactsDir = Join-Path -Path $env:ArtifactsShare -ChildPath ($Environment.ToL
 $WorkDir = $env:SYSTEM_DEFAULTWORKINGDIRECTORY
 
 function Create-ReleaseFile($FilePath) {
-    $Hash = (Get-FileHash -Path $FilePath -Algorithm MD5).Hash
+    $Hash = (Get-FileHash -Path $FilePath -Algorithm SHA256).Hash
     New-Item -Path "$ArtifactsDir\Releases" -Name $Hash -ItemType File -Force | Out-Null
 }
 

ControlR.Agent/Services/AgentUpdater.cs

@@ -75,8 +75,8 @@ public async Task CheckForUpdate(CancellationToken cancellationToken = default)
 
             _logger.LogInformation(
                 "Comparing local file hash {LocalFileHash} to latest file hash {ServerFileHash}",
-                Convert.ToBase64String(exeHash),
-                Convert.ToBase64String(remoteHash));
+                Convert.ToHexString(exeHash),
+                Convert.ToHexString(remoteHash));
 
             if (remoteHash.SequenceEqual(exeHash))
             {

ControlR.Agent/Services/Windows/StreamerUpdaterWindows.cs

@@ -150,8 +150,8 @@ private async Task<Result<bool>> IsRemoteHashDifferent(string zipPath)
 
         _logger.LogInformation(
             "Comparing local streamer archive hash ({LocalArchiveHash}) to remote ({RemoteArchiveHash}).",
-            Convert.ToBase64String(localHash),
-            Convert.ToBase64String(streamerHashResult.Value));
+            Convert.ToHexString(localHash),
+            Convert.ToHexString(streamerHashResult.Value));
 
         if (streamerHashResult.Value.SequenceEqual(localHash))
         {

ControlR.Server/Middleware/Md5HeaderMiddleware.cs → ControlR.Server/Middleware/ContentHashHeaderMiddleware.cs

@@ -4,11 +4,11 @@
 
 namespace ControlR.Server.Middleware;
 
-public class Md5HeaderMiddleware(
+public class ContentHashHeaderMiddleware(
     RequestDelegate _next,
     IFileProvider fileProvider,
     IHostApplicationLifetime _appLifetime,
-    ILogger<Md5HeaderMiddleware> _logger)
+    ILogger<ContentHashHeaderMiddleware> _logger)
 {
     private static readonly MemoryCache _memoryCache = new(new MemoryCacheOptions());
 
@@ -35,18 +35,22 @@ public async Task InvokeAsync(HttpContext context)
         if (_memoryCache.TryGetValue(filePath, out var cachedObject) &&
             cachedObject is string cachedHash)
         {
-            context.Response.Headers.ContentMD5 = cachedHash;
+            context.Response.Headers["Content-Hash"] = cachedHash;
             await _next(context);
             return;
         }
 
         using var fs = new FileStream(fileInfo.PhysicalPath, FileMode.Open, FileAccess.Read, FileShare.Read);
-        var hash = await MD5.HashDataAsync(fs, _appLifetime.ApplicationStopping);
-        var base64Hash = Convert.ToBase64String(hash);
-        _memoryCache.Set(filePath, base64Hash, TimeSpan.FromMinutes(10));
+        var sha256Hash = await SHA256.HashDataAsync(fs, _appLifetime.ApplicationStopping);
+        var hexHash = Convert.ToHexString(sha256Hash);
+        context.Response.Headers["Content-Hash"] = hexHash;
+        // TODO: Re-enable when MD5 is removed.
+        //_memoryCache.Set(filePath, hexHash, TimeSpan.FromMinutes(10));
+
+        // TODO: Remove next release.
+        var md5Hash = await MD5.HashDataAsync(fs, _appLifetime.ApplicationStopping);
+        var base64Hash = Convert.ToBase64String(md5Hash);
         context.Response.Headers.ContentMD5 = base64Hash;
-        // TODO: Remove after next release.
-        context.Response.Headers["MD5"] = base64Hash;
 
         await _next(context);
     }

ControlR.Server/Program.cs

@@ -203,7 +203,7 @@
     app.UseHttpsRedirection();
 }
 
-app.UseMiddleware<Md5HeaderMiddleware>();
+app.UseMiddleware<ContentHashHeaderMiddleware>();
 
 ConfigureStaticFiles(app);
 

Libraries/ControlR.Libraries.Shared/Services/Http/VersionApi.cs

@@ -31,9 +31,11 @@ public async Task<Result<byte[]>> GetCurrentAgentHash(RuntimeId runtime)
             using var request = new HttpRequestMessage(HttpMethod.Head, fileRelativePath);
             using var response = await _client.SendAsync(request);
             response.EnsureSuccessStatusCode();
-            if (response.Content.Headers.ContentMD5 is byte[] contentMd5)
+            if (response.Headers.TryGetValues("Content-Hash", out var values) &&
+                values.FirstOrDefault() is string hashString)
             {
-                return Result.Ok(contentMd5);
+                var fileHash = Convert.FromHexString(hashString);
+                return Result.Ok(fileHash);
             }
 
             return Result.Fail<byte[]>("Failed to get agent file hash.");
@@ -73,9 +75,11 @@ public async Task<Result<byte[]>> GetCurrentStreamerHash(RuntimeId runtime)
             using var response = await _client.SendAsync(request);
             response.EnsureSuccessStatusCode();
 
-            if (response.Content.Headers.ContentMD5 is byte[] contentMd5)
+            if (response.Headers.TryGetValues("Content-Hash", out var values) &&
+                  values.FirstOrDefault() is string hashString)
             {
-                return Result.Ok(contentMd5);
+                var fileHash = Convert.FromHexString(hashString);
+                return Result.Ok(fileHash);
             }
 
             return Result.Fail<byte[]>("Failed to get streamer file hash.");