Add SHA-384 support to file checksum computation (FIPS+NCS) - #267
Add SHA-384 support to file checksum computation (FIPS+NCS)#267vkalapov wants to merge 1 commit into
Conversation
LMCROSSITXSADEPLOY-3224
ec08ad6 to
505e9f1
Compare
| hasher = sha1.New() | ||
| case "SHA256": | ||
| hasher = sha256.New() | ||
| case "SHA384", "SHA-384": |
There was a problem hiding this comment.
Shouldn't we add support for sha3 algorithms?
There was a problem hiding this comment.
SHA3 is needed for advanced requirements, SHA-384 satisfies the moderate requirements in our case.
| @@ -23,6 +23,8 @@ func ComputeFileChecksum(filePath, algorithm string) (string, error) { | |||
| hasher = sha1.New() | |||
| case "SHA256": | |||
There was a problem hiding this comment.
Is the current plugin, without these changes compatible with the response from the deploy-service as it returns the algorithm?
There was a problem hiding this comment.
Yes, the current plugin with the backend changes finishes deployments successfully. However, if a SHA-384 file entry already exists from a previous deploy (e.g. an orphan from an interrupted deploy), the old plugin prints a FAILED message because it doesn't know SHA-384, and continues the deployment after re-uploading the file. The deploy completes normally, but the orphaned file entry remains until a periodic cleanup job removes it.
3 participants
What
Add
SHA384/SHA-384cases toComputeFileChecksuminutil/digest.go, and also handle the hyphenatedSHA-256variant while here.Why
The deploy service now stores file digests with SHA-384 (
DIGEST_ALGORITHM = "SHA-384") to satisfy FIPS 140-3 and NCS MODERATE requirements. The CLI callsGET /filesand uses thedigestAlgorithmfield returned per entry to compute a local digest for skip-upload optimisation. Without this change, old CLI hits thedefaultbranch and prints"Unsupported digest algorithm \"SHA-384\"", causing a re-upload on every retry instead of skipping.Deploys still succeed without this fix (the server never verifies a client-sent digest), but the skip optimisation is degraded.
LMCROSSITXSADEPLOY-3224