From 3b20d8115af4747ac55cae0016ef46bd6114dda6 Mon Sep 17 00:00:00 2001 From: Daniel Hast Date: Sat, 17 Oct 2026 10:30:54 -0400 Subject: [PATCH] chore: use 256 bits instead of 512 for BLAKE2b hash 256 bits is plenty and fits on a single line. --- CHANGELOG.md | 5 +++++ meson.build | 2 +- run0edit_main.py.in => run0edit_main.py | 7 +++---- test/test_run0edit_main.py | 4 ++-- 4 files changed, 11 insertions(+), 7 deletions(-) rename run0edit_main.py.in => run0edit_main.py (98%) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3681d5a..f9e32a2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ SPDX-License-Identifier: Apache-2.0 OR MIT # Changelog +## [Unreleased] + +- Use 256-bit BLAKE2b hash instead of default 512 bits. + ## [v0.6.1] - 2026-08-23 - Grant the privileged inner script the additional capabilities `CAP_SYS_NICE` @@ -231,6 +235,7 @@ Rewrote script in Python. ([#1](https://github.com/HastD/run0edit/pull/1)) - Initial release. +[Unreleased]: https://github.com/HastD/run0edit/compare/v0.6.1...HEAD [v0.6.1]: https://github.com/HastD/run0edit/compare/v0.6.0...v0.6.1 [v0.6.0]: https://github.com/HastD/run0edit/compare/v0.5.10...v0.6.0 [v0.5.10]: https://github.com/HastD/run0edit/compare/v0.5.9...v0.5.10 diff --git a/meson.build b/meson.build index 3dfed6b..5c1abb6 100644 --- a/meson.build +++ b/meson.build @@ -25,7 +25,7 @@ conf_data.set('LIBEXECDIR', libexecdir) conf_data.set('SYSCONFDIR', sysconfdir) main_script = configure_file( - input: 'run0edit_main.py.in', + input: 'run0edit_main.py', output: 'run0edit_main.py', configuration: conf_data, ) diff --git a/run0edit_main.py.in b/run0edit_main.py similarity index 98% rename from run0edit_main.py.in rename to run0edit_main.py index 33bd831..b3da178 100644 --- a/run0edit_main.py.in +++ b/run0edit_main.py @@ -26,8 +26,7 @@ __version__: Final[str] = "@VERSION@" INNER_SCRIPT_PATH: Final[str] = "@LIBEXECDIR@/run0edit/run0edit_inner.py" -INNER_SCRIPT_B2: Final[str] = "\ -7d215d913fbc27ace618e1354a6dadcc8277a3eb77dfa38a243d6a5e76e0e350afd5143a0b6bb34059b089cef19a957340cb2c1af4040c0ea489af31875bfb05" +INNER_SCRIPT_B2: Final[str] = "21f7a46ca9a765179bca501703f8de12569a6e19fbe248e25e8ba3f612c636af" DEFAULT_CONF_PATH: Final[str] = "@SYSCONFDIR@/run0edit/editor.conf" CAPABILITY_BOUNDING_SET: Final[list[str]] = [ @@ -83,10 +82,10 @@ def validate_inner_script() -> bool: - """Ensure inner script has expected BLAKE2 hash.""" + """Ensure inner script has expected BLAKE2b hash.""" try: with open(INNER_SCRIPT_PATH, "rb") as f: - file_hash = hashlib.blake2b(f.read()) + file_hash = hashlib.blake2b(f.read(), digest_size=32) except OSError: return False return file_hash.hexdigest() == INNER_SCRIPT_B2 diff --git a/test/test_run0edit_main.py b/test/test_run0edit_main.py index 48346b2..1b5afcf 100644 --- a/test/test_run0edit_main.py +++ b/test/test_run0edit_main.py @@ -34,9 +34,9 @@ def test_inner_script_path(self): self.assertEqual(run0edit.INNER_SCRIPT_PATH, "/usr/libexec/run0edit/run0edit_inner.py") def test_inner_script_b2(self): - """INNER_SCRIPT_B2 should equal BLAKE2 hash of inner script""" + """INNER_SCRIPT_B2 should equal BLAKE2b hash of inner script""" with open("run0edit_inner.py", "rb") as f: - file_hash = hashlib.blake2b(f.read()) + file_hash = hashlib.blake2b(f.read(), digest_size=32) self.assertEqual(file_hash.hexdigest(), run0edit.INNER_SCRIPT_B2) def test_default_conf_path(self):