Openssl result is not matching in cmd and power shell of windows

Question

Now I am going to get the signature of android debug key.

In windows command(cmd.exe)

keytool -exportcert -alias androiddebugkey -keystore debug.keystore | openssl.exe sha1 -binary | openssl.exe base64
Enter keystore password:  android

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore debug.keystore -destkeystore debug.keystore -deststoretype pkcs12".
uQzK/Tk81BxWs8sBwQyvTLOWCKQ=

In windows Power Shell

keytool -exportcert -alias androiddebugkey -keystore debug.keystore | .\openssl.exe
sha1 -binary | .\openssl.exe base64
Enter keystore password:  android

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore debug.keystore -destkeystore debug.keystore -deststoretype pkcs12".
Pz8/Pwo/MDNuPyE/Pys/Pz8/Sm8K

Two result was not matching.

cmd.exe: uQzK/Tk81BxWs8sBwQyvTLOWCKQ=

Power Shell: Pz8/Pwo/MDNuPyE/Pys/Pz8/Sm8K

Why? What happened?

Answer 1

This is a consequence of the object pipeline in PowerShell and you should never pipe raw binary data in PowerShell because it will be corrupted.

It is never safe to pipe raw binary data in PowerShell. Pipes in PowerShell are for objects and text that can safely be automagically converted to a string array. Please read this for full explanation with details.

The result calculated with powershell is wrong, because you used pipes. One way to fix this is to use cmd.exe from within powershell:

cmd /C "keytool -exportcert -alias androiddebugkey -keystore debug.keystore | openssl.exe sha1 -binary | openssl.exe base64"

Instead using pipes you can read/write input/output from/to files. Unfortunately openssl.exe sha1 does not have a -in parameter to specify input file. Therefore we need to use powershell-commandlet Start-Process, which allows reading and writing files with parameters -RedirectStandardInput and -RedirectStandardOutput:

keytool -exportcert -alias mykey -storepass wortwort -file f1.bin
Start-Process -FilePath openssl.exe -ArgumentList "sha1 -binary" -RedirectStandardInput f1.bin -RedirectStandardOutput f2.bin
Start-Process -FilePath openssl.exe -ArgumentList base64 -RedirectStandardInput f2.bin -RedirectStandardOutput o_with_ps.txt

keytool writes to file f1.bin. Then openssl.exe sha1 reads from f1.bin and writes to f2.bin. Finally, openssl.exe base64 reads from f2.bin and writes to o_with-ps.txt