verify: use crypto.hash_file, fix io_ scope and naming #10

New issue

Open

opened 2026-05-26 05:10:49 +02:00 by michael · 0 comments

michael commented

2026-05-26 05:10:49 +02:00

Owner

Findings

1. sha256_file reimplements daw.common.crypto.hash_file

sha256_file() in verify.lua duplicates the OS-detection logic
from daw.common.crypto including the sha256sum vs sha256 check.
daw.common.crypto.hash_file() already handles this correctly.

Fix: remove sha256_file(), add require("daw.common.crypto"),
replace calls with crypto.hash_file(path).

Note: crypto.hash_file returns "sha256:<hex>" -- the comparison
against entry.sha256 in the manifest loop must be adjusted
accordingly (strip prefix or store with prefix in manifest).

2. io_ at module level

local io_ = dawio.new() is created at module level.
Handle injection via sys.new(opts) not possible.
Should be created per function call or passed as parameter.
Rename to out for consistency with all other files.

3. _NAME declared after requires

Minor consistency issue -- should be declared before the require block.

Acceptance Criteria

sha256_file removed, replaced with daw.common.crypto.hash_file
Manifest hash comparison adjusted for "sha256:<hex>" prefix
io_ replaced with per-call out, renamed consistently
_NAME moved before requires
Tests pass after changes

## Findings ### 1. sha256_file reimplements daw.common.crypto.hash_file `sha256_file()` in verify.lua duplicates the OS-detection logic from `daw.common.crypto` including the sha256sum vs sha256 check. `daw.common.crypto.hash_file()` already handles this correctly. Fix: remove `sha256_file()`, add `require("daw.common.crypto")`, replace calls with `crypto.hash_file(path)`. Note: `crypto.hash_file` returns `"sha256:<hex>"` -- the comparison against `entry.sha256` in the manifest loop must be adjusted accordingly (strip prefix or store with prefix in manifest). ### 2. io_ at module level `local io_ = dawio.new()` is created at module level. Handle injection via `sys.new(opts)` not possible. Should be created per function call or passed as parameter. Rename to `out` for consistency with all other files. ### 3. _NAME declared after requires Minor consistency issue -- should be declared before the require block. ## Acceptance Criteria - [ ] `sha256_file` removed, replaced with `daw.common.crypto.hash_file` - [ ] Manifest hash comparison adjusted for `"sha256:<hex>"` prefix - [ ] `io_` replaced with per-call `out`, renamed consistently - [ ] `_NAME` moved before requires - [ ] Tests pass after changes

michael added the

labels

2026-05-26 05:10:49 +02:00