]> Cypherpunks repositories - gostls13.git/commit
cmd/internal/hash: stop using md5, sha1
authorRuss Cox <rsc@golang.org>
Tue, 7 Jan 2025 16:20:07 +0000 (11:20 -0500)
committerGopher Robot <gobot@golang.org>
Tue, 7 Jan 2025 18:59:33 +0000 (10:59 -0800)
commitb2aa18b96cefb48641ec69a79bc67d030b93f093
tree266af439e679d76461c1d209fbc0a031607333a5
parentd93b549f0502ad9f44b7eacc282c304b22d2603b
cmd/internal/hash: stop using md5, sha1

These break if the tools are run with GODEBUG=fips140=only,
which happens if someone sets that during 'go test' (and a test
binary must be built).

The easiest fix is to make the tools compatible with this GODEBUG
by just using sha256 as the underlying hash always. Just in case,
I made the wrappers select different sections of the hash, but
none of the call sites really care.

This CL is for the Go 1.24 release, but a follow-up during the Go 1.25
dev cycle could change all the usage sites to only use Sum32/New32.

For #70514
Fixes #70878

Change-Id: Id5fea779c83df51d1680dbe561e0949c56e8d1e5
Reviewed-on: https://go-review.googlesource.com/c/go/+/641096
Reviewed-by: Keith Randall <khr@golang.org>
Auto-Submit: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Keith Randall <khr@google.com>
src/cmd/internal/hash/hash.go
src/go/build/deps_test.go
src/internal/pkgbits/encoder.go