From de0f5e6c68b0c0f2569f38edb73173e0e3347059 Mon Sep 17 00:00:00 2001
From: Simone <simone.chifari@gmail.com>
Date: Tue, 9 Jun 2026 21:02:23 +0200
Subject: [PATCH] fix(toolchain): refresh dotnet-install.ps1 pinned hash
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Microsoft rotated the unversioned https://dot.net/v1/dotnet-install.ps1, so
the pinned SHA256 was stale and the toolchain aborted ("Possible MITM or
wrong installer version"). Independently re-downloaded the official script
(builds.dotnet.microsoft.com) — its hash matches the guest's observed
value, confirming it is the legitimate current script, not tampering.

Update the pin in both WinBuild2025 and WinBuild2022 toolchains to
6585899AED55FF6AE13DBE1E8C3B878F2D00433520E7EFBE250B75DB948B7DA9 and note
that this pin must be refreshed whenever MS updates the script in place.
---
 template/Install-CIToolchain-WinBuild2022.ps1 | 5 +++--
 template/Install-CIToolchain-WinBuild2025.ps1 | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/template/Install-CIToolchain-WinBuild2022.ps1 b/template/Install-CIToolchain-WinBuild2022.ps1
index 7b4ad36..5d72d0e 100644
--- a/template/Install-CIToolchain-WinBuild2022.ps1
+++ b/template/Install-CIToolchain-WinBuild2022.ps1
@@ -297,8 +297,9 @@ $script:Hashes = @{
     'Python'                  = '698F2DF46E1A3DD92F393458EEA77BD94EF5FF21F0D5BF5CF676F3D28A9B4B6C'
 
     # dotnet-install.ps1 from https://dot.net/v1/dotnet-install.ps1
-    # Changes with each .NET SDK release cycle — verify after any dotnet version bump.
-    'DotNetInstallScript'     = 'CE5330422F1D3E9B3D46462A24EF7105F660EC6C67EF3F5D4AE05B7259FB4234'
+    # Unversioned — Microsoft updates it in place, so refresh this pin whenever
+    # the hash check fails. Verified 2026-06-09 against the official URL.
+    'DotNetInstallScript'     = '6585899AED55FF6AE13DBE1E8C3B878F2D00433520E7EFBE250B75DB948B7DA9'
 
     # vs_buildtools.exe bootstrapper from aka.ms/vs/stable/vs_buildtools.exe
     # Stable within a VS release cycle — update when VS major version changes.
diff --git a/template/Install-CIToolchain-WinBuild2025.ps1 b/template/Install-CIToolchain-WinBuild2025.ps1
index ab1edf7..203ba1d 100644
--- a/template/Install-CIToolchain-WinBuild2025.ps1
+++ b/template/Install-CIToolchain-WinBuild2025.ps1
@@ -307,8 +307,9 @@ $script:Hashes = @{
     'Python'                  = '698F2DF46E1A3DD92F393458EEA77BD94EF5FF21F0D5BF5CF676F3D28A9B4B6C'
 
     # dotnet-install.ps1 from https://dot.net/v1/dotnet-install.ps1
-    # Changes with each .NET SDK release cycle — verify after any dotnet version bump.
-    'DotNetInstallScript'     = 'CE5330422F1D3E9B3D46462A24EF7105F660EC6C67EF3F5D4AE05B7259FB4234'
+    # Unversioned — Microsoft updates it in place, so refresh this pin whenever
+    # the hash check fails. Verified 2026-06-09 against the official URL.
+    'DotNetInstallScript'     = '6585899AED55FF6AE13DBE1E8C3B878F2D00433520E7EFBE250B75DB948B7DA9'
 
     # vs_buildtools.exe bootstrapper from aka.ms/vs/stable/vs_buildtools.exe
     # Stable within a VS release cycle — update when VS major version changes.