Skip to content

Use SHA-256 when checking dependency integrity in src/configuration #622

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jviotti merged 1 commit into from
Feb 9, 2026
Merged

Use SHA-256 when checking dependency integrity in src/configuration #622

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion config.cmake.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ if(NOT BLAZE_COMPONENTS)
endif()

include(CMakeFindDependencyMacro)
find_dependency(Core COMPONENTS regex uri json jsonpointer jsonschema io yaml md5)
find_dependency(Core COMPONENTS regex uri json jsonpointer jsonschema io yaml crypto)

foreach(component ${BLAZE_COMPONENTS})
if(component STREQUAL "compiler")
Expand Down
2 changes: 1 addition & 1 deletion src/configuration/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,5 +9,5 @@ target_link_libraries(sourcemeta_blaze_configuration PUBLIC sourcemeta::core::js
target_link_libraries(sourcemeta_blaze_configuration PUBLIC sourcemeta::core::jsonpointer)
target_link_libraries(sourcemeta_blaze_configuration PRIVATE sourcemeta::core::uri)
target_link_libraries(sourcemeta_blaze_configuration PRIVATE sourcemeta::core::io)
target_link_libraries(sourcemeta_blaze_configuration PRIVATE sourcemeta::core::md5)
target_link_libraries(sourcemeta_blaze_configuration PRIVATE sourcemeta::core::crypto)
target_link_libraries(sourcemeta_blaze_configuration PRIVATE sourcemeta::core::jsonschema)
9 changes: 5 additions & 4 deletions src/configuration/fetch.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
#include <sourcemeta/blaze/configuration.h>

#include <sourcemeta/core/crypto.h>
#include <sourcemeta/core/json.h>
#include <sourcemeta/core/jsonschema.h>
#include <sourcemeta/core/md5.h>

#include <cassert> // assert
#include <cstdint> // std::uint8_t
Expand All @@ -11,9 +11,10 @@

namespace {

auto compute_md5(const std::string &content) -> sourcemeta::core::JSON::String {
auto compute_sha256(const std::string &content)
-> sourcemeta::core::JSON::String {
std::ostringstream result;
sourcemeta::core::md5(content, result);
sourcemeta::core::sha256(content, result);
return result.str();
}

Expand Down Expand Up @@ -66,7 +67,7 @@ auto verify_written_schema(
return FetchResult::Error;
}

out_hash = compute_md5(written_content);
out_hash = compute_sha256(written_content);

if (!emit_event(callback, FetchEvent::Type::VerifyEnd, dependency_uri,
dependency_path, index, total, {}, nullptr, true)) {
Expand Down
5 changes: 2 additions & 3 deletions src/configuration/include/sourcemeta/blaze/configuration.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,8 +71,7 @@ struct SOURCEMETA_BLAZE_CONFIGURATION_EXPORT Configuration {
std::filesystem::path path;
// TODO: Separately store the server ETag for exploiting HTTP caching?
sourcemeta::core::JSON::String hash;
// TODO: Support SHA-256 only instead
enum class HashAlgorithm : std::uint8_t { MD5 };
enum class HashAlgorithm : std::uint8_t { SHA256 };
HashAlgorithm hash_algorithm;
enum class Status : std::uint8_t {
Untracked,
Expand All @@ -90,7 +89,7 @@ struct SOURCEMETA_BLAZE_CONFIGURATION_EXPORT Configuration {
emplace(const sourcemeta::core::JSON::String &uri,
const std::filesystem::path &path,
const sourcemeta::core::JSON::String &hash,
Entry::HashAlgorithm hash_algorithm = Entry::HashAlgorithm::MD5)
Entry::HashAlgorithm hash_algorithm = Entry::HashAlgorithm::SHA256)
-> void;

[[nodiscard]] auto size() const noexcept -> std::size_t;
Expand Down
14 changes: 7 additions & 7 deletions src/configuration/lock.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
#include <sourcemeta/blaze/configuration.h>

#include <sourcemeta/core/crypto.h>
#include <sourcemeta/core/json.h>
#include <sourcemeta/core/jsonpointer.h>
#include <sourcemeta/core/md5.h>

#include <cassert> // assert
#include <sstream> // std::ostringstream
Expand All @@ -19,9 +19,9 @@ auto compute_hash(
using HashAlgorithm =
sourcemeta::blaze::Configuration::Lock::Entry::HashAlgorithm;
switch (algorithm) {
case HashAlgorithm::MD5: {
case HashAlgorithm::SHA256: {
std::ostringstream result;
sourcemeta::core::md5(content, result);
sourcemeta::core::sha256(content, result);
return result.str();
}
default:
Expand All @@ -38,8 +38,8 @@ auto hash_algorithm_to_string(
using HashAlgorithm =
sourcemeta::blaze::Configuration::Lock::Entry::HashAlgorithm;
switch (algorithm) {
case HashAlgorithm::MD5:
return "md5";
case HashAlgorithm::SHA256:
return "sha256";
default:
throw sourcemeta::blaze::ConfigurationParseError("Unknown hash algorithm",
location);
Expand All @@ -51,8 +51,8 @@ auto string_to_hash_algorithm(const sourcemeta::core::JSON::String &value,
-> sourcemeta::blaze::Configuration::Lock::Entry::HashAlgorithm {
using HashAlgorithm =
sourcemeta::blaze::Configuration::Lock::Entry::HashAlgorithm;
if (value == "md5") {
return HashAlgorithm::MD5;
if (value == "sha256") {
return HashAlgorithm::SHA256;
}

throw sourcemeta::blaze::ConfigurationParseError("Unknown hash algorithm",
Expand Down
Loading