Compute sha256, sha1 and SRI digests through utils::digest (#706)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Part of #706 (slice 1; the issue stays open for slice 2)

Summary

utils::digest held only the pin validators, while the computations were written out inline or as private copies, and some of those copies shared a name with a validator (sha256_hex). This PR adds the computations to utils::digest: sha256_hex_of, sha1_hex_of, sha512_base64_of and sha512_sri_of. It moves every production digest site in the 14 files no open PR changes onto them, and deletes the copies.

Why

• Issue #706, register row C17 in discussion #560; living document Part 7, "Digest helpers".
• Leverage: B 0, U 1 (Agent-mode apply and rollback reject a manifest hash in uppercase hex that blob download accepts as valid #707's single hash-comparison rule builds on these helpers), D ≈ 6 (4 named copies plus about 20 inline sites collapse to one module), R L. This was the top-ranked candidate that no open PR overlaps.

What changed

• utils/digest.rs: the four *_of helpers. The _of suffix keeps a helper that computes a digest from sharing a name with a validator. The file also gains a known-vector test and a ratchet test.
• These copies are deleted: vendor/ledger_snapshots::sha256_hex, patch/redirect/vlt_preflight::sha512_sri, vendor/nuget_feed::content_hash, api/client::is_valid_sha256_hex (now digest::is_hex(s, 64)), the SRI format! blocks in npm_pack and bun_lock, and the inline hex::encode(ShaN::digest(..)) sites in policy, update/download, bun_workspace, bun_binary, state, verify, service_fetch, reuse, registry_fetch, nuget_feed and redirect/upstream/client.
• Test modules that got sha2 through use super::* now import it themselves. Test fixtures keep their own independent digest oracles.

Deleted (git diff --stat)

• 19 files: +190 / −116 in total.
• Production code: about +45 / −105. That is the four helpers, plus 24 sites, 4 functions and 18 imports deleted.
• Tests: about +145 / −11 (the known-vector test, the ratchet test and test-module imports).

Behavior

None. Every helper produces the same lowercase hex or padded standard base64 the inline copies produced, and is_hex(s, 64) is byte-for-byte the deleted is_valid_sha256_hex.

Tests

• computations_match_known_vectors pins "" and "abc" for sha256, sha1 and sha512-base64/SRI (checked against openssl dgst). It also checks that each output passes the module's own validators (is_hex64_lower, sha1_hex, is_sri_pin).
• production_digests_go_through_the_helpers is a ratchet. It scans socket-patch-core/src (CRLF-normalized) and fails on a new inline digest in production code, and also on a stale entry in PENDING_INLINE_DIGESTS. The pending list holds the 6 slice-2 files: utils/group_commit.rs, vendor/jvm/mod.rs, vendor/maven_repo.rs, vendor/pypi.rs, vendor/redownload.rs, vendor/yarn_berry_lock.rs.
• The existing callers' tests pass through the shared helpers: vlt_preflight, npm_manifest, ledger_snapshots, nuget_feed and the client blob-hash guard tests.
• Commands:
  • cargo clippy --workspace --all-features -- -D warnings: clean.
  • cargo test -p socket-patch-core --lib: 5047 passed, 4 failed. These are the 4 known root-only failures, which fail on main too: relax_loop_must_not_traverse_symlinked_root, an_unremovable_hidden_lock_keeps_every_store_entry, wire_write_failure_maps_error_and_leaves_lock_untouched, wire_failure_rolls_back_already_written_files.
  • cargo test -p socket-patch-cli --all-features --lib: 840 passed.
  • cargo test -p socket-patch-cli --all-features --test in_process_redirect: 111 passed, 3 failed. All 3 fail only because the sandbox runs as root (each chmods a directory to 0o555): partial_lockfile_write_failure_exits_1_and_writes_no_ledger, redirect_json_mode_write_failures_emit_error_envelope, vlt::scan_redirect_vlt_heal_invalidation_failure_warns.

Risk

Low. The change is mechanical, the compiler checks every call site, and the outputs are pinned by vectors. The one public item removed is vlt_preflight::sha512_sri, and nothing in the workspace outside core used it.

Remaining (slice 2)

• The 6 pending files. They are waiting on open PRs sbt, Mill and scala-cli support in agent, hosted and vendored modes #690, Full Gradle support in agent, hosted and vendored modes #646, Fix vendored mode replacing symlinked lockfiles (#627) #802, Fix Hatch environments being invisible to stale-install checks and VEX (#335) #700, Fix vendored Pipenv re-vendor to a newer patch (#769) #825 and Fix yarn berry project gates drifting between modes (#628, #629) #657.
• A sha512_hex_of helper for the berry/maven hex sha512 sites.
• The validator rename (sha256_hex → parse_sha256_hex), which touches vex/discover/maven.rs (Full Gradle support in agent, hosted and vendored modes #646).
• apply::is_valid_blob_hash.

🤖 Generated with Claude Code

https://claude.ai/code/session_018qs9ueQm9g96AmuZfDt3Cw

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 58a6d1c. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review.

• Head: 58a6d1cd8ddfaec7bade8e97e2f868c78436f30d
• CI: 488/488 check runs green (success/skipped) on this head; mergeable clean
• Bugbot: reviewed 58a6d1c, no new issues; no open threads
• Reviewer focus: refactor slice 1 of Compute sha256, sha1 and sha512-SRI digests through utils::digest instead of inline copies #706: sha256/sha1/SRI digest computations moved into utils::digest; Compute sha256, sha1 and sha512-SRI digests through utils::digest instead of inline copies #706 stays open for slice 2

---

Generated by Claude Code