Add and Validate NestedInstaller FileSha256

[Trenly]

• Have you signed the Contributor License Agreement?
• Are you working against an Issue?
  • Add and Validate NestedInstallerSha256 #2545

Still working on adding unit and E2E tests

Microsoft Reviewers: Open in CodeFlow

[yao-msft]

Just my 2 cents before we get too far into implementation. I'm not sure if this is of high importance since we already validated the zip hash before extracting. If we are concerned that extracted files may be tampered after extraction and before execution, we could improve the code to put a write exclusive handle on to be extracted files and keep the handle after execution completes.

[Trenly]

Just my 2 cents before we get too far into implementation. I'm not sure if this is of high importance since we already validated the zip hash before extracting. If we are concerned that extracted files may be tampered after extraction and before execution, we could improve the code to put a write exclusive handle on to be extracted files and keep the handle after execution completes.

I think that is certainly one concern, but the other concern I have is that it is much easier to cause a hash collision on Zip files than other file types. Presume for a moment that someone had a malicious application, put it inside a zip, and included in the zip a second binary file that had been carefully crafted to make the hash of the overall zip file the same. That would pass hash validation still. Ignoring the fact that malware scans would probably catch it anyways, its just an optional added layer of protection to validate the hash of the file that was actually extracted

[Trenly]

Closed as this is not a high-priority item, I don't feel like resolving merge conflicts, and there are probably better implementations that could be planned for the future