Modify remote_file cache_control_data to use sha256 for its name #3991
Conversation
We want to support a fips mode, and doing MD5 with fips mode enabled is wrong/hard. In this case, the type of checksum does not matter, so let's just use sha256 since fips mode will be happy with that. For cases where the cache control data exists, we update it to provide a seamless upgrade.
jaym
force-pushed
the
jdm/remote-file-sha2
branch
from
3bc0a0a
to
f18185d
Compare
jaym
force-pushed
the
jdm/remote-file-sha2
branch
from
f18185d
to
7b9726f
Compare
| @@ -145,18 +145,51 @@ def load_data | |||
| end | |||
|
|
|||
| def load_json_data | |||
| Chef::FileCache.load("remote_file/#{sanitized_cache_file_basename}") | |||
| path = sanitized_cache_file_path(sanitized_cache_file_basename) | |||
There was a problem hiding this comment.
Maybe instead of doing this as a one off, we should put some kind of version number in the metadata this time so we can do this more cleanly next time?
There was a problem hiding this comment.
In general, that sounds like a good idea. I don't think it would have helped this case as the only the file name is incorrect, the data inside is exactly the same. Will look into adding this, may make the solution cleaner
| @@ -38,7 +38,11 @@ def checksum_for_file(file) | |||
| end | |||
|
|
|||
| def generate_checksum(file) | |||
| checksum_file(file, OpenSSL::Digest::SHA256.new) | |||
| if file.is_a?(StringIO) | |||
There was a problem hiding this comment.
Would it make sense to check for respond_to?(:read) ? I don't know why you'd need it, but it would allow you to File.open(thing, opts) { |f| generate_checksum(f) } (maybe that would be helpful if dealing with a gzipped file?).
|
👍 there are some improvements that can be made, but I won't block merge on those if this work is time sensitive. |
|
@jaym is this waiting on anything? |
|
👍 if you want to address Dan's |
Modify remote_file cache_control_data to use sha256 for its name
We want to support a fips mode, and doing MD5 with fips mode enabled
is wrong/hard. In this case, the type of checksum does not
matter, so let's just use sha256 since fips mode will be happy
with that.
For cases where the cache control data exists, we update it
to provide a seamless upgrade.