pkgwatch/src/hash.rs

//! One function, shared by two real callers (`verifier`, `builder`) —
//! not a general-purpose utils dump. See ARCHITECTURE.md > "organize by
//! pipeline stage, not by layer" for why that distinction matters.

use sha2::{Digest, Sha256};

/// Shared by `verifier` (same-origin-sha256 checks) and `builder` (every
/// generated PKGBUILD needs a `sha256sums` entry for makepkg's own local
/// integrity check, regardless of pkgwatch's own trust tier for that
/// package).
pub fn sha256_hex(data: &[u8]) -> String {
    let mut hasher = Sha256::new();
    hasher.update(data);
    hex::encode(hasher.finalize())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn matches_known_sha256() {
        // printf 'hello world' | sha256sum
        assert_eq!(
            sha256_hex(b"hello world"),
            "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
        );
    }
}