arachne::crypto Namespace Reference

Namespaces
namespace	anonymous_namespace{crypto.cpp}

Classes
class	sha256_hasher

Typedefs
using	sha256_digest = std::array<std::byte, 32>

Functions
std::string	sha256 (std::span< const std::byte > bytes)
std::string	sha256 (std::string_view bytes)
std::string	sha256_file (const std::filesystem::path &path)
std::string	sha256_string (std::string_view bytes)
bool	is_safe_relative_artifact_ref (std::string_view artifact_ref) noexcept
std::filesystem::path	safe_artifact_path (const std::filesystem::path &root, std::string_view artifact_ref)

Typedef Documentation

sha256_digest

using arachne::crypto::sha256_digest = std::array<std::byte, 32>

Definition at line 14 of file crypto.hpp.

Function Documentation

is_safe_relative_artifact_ref()

bool arachne::crypto::is_safe_relative_artifact_ref ( std::string_view artifact_ref )

nodiscardnoexcept

Return true only for a portable, non-empty relative artifact reference. Backslashes, absolute paths, empty components, and dot components are rejected so a reference has the same meaning on POSIX and Windows.

Definition at line 249 of file crypto.cpp.

           {
    if (artifact_ref.empty() || artifact_ref.size() > 4096U
        || artifact_ref.front() == '/' || artifact_ref.front() == '\\'
        || artifact_ref.back() == '/' || artifact_ref.back() == '\\'
        || artifact_ref.find('\0') != std::string_view::npos
        || artifact_ref.find('\\') != std::string_view::npos) {
        return false;
    }
 
    std::size_t start = 0;
    while (start < artifact_ref.size()) {
        const std::size_t slash = artifact_ref.find('/', start);
        const std::size_t end
            = slash == std::string_view::npos ? artifact_ref.size() : slash;
        const std::string_view component
            = artifact_ref.substr(start, end - start);
        if (component.empty() || component == "." || component == ".."
            || component.find(':') != std::string_view::npos
            || component.back() == ' ' || component.back() == '.') {
            return false;
        }
        if (std::ranges::any_of(component, [](const char character) {
                const auto value = static_cast<unsigned char>(character);
                return value < 0x20U || value == 0x7fU;
            })) {
            return false;
        }
        std::string device_name(component.substr(0, component.find('.')));
        std::ranges::transform(
            device_name, device_name.begin(), [](const char character) {
                return static_cast<char>(
                    std::toupper(static_cast<unsigned char>(character))
                );
            }
        );
        const bool numbered_device = device_name.size() == 4U
            && (device_name.starts_with("COM")
                || device_name.starts_with("LPT"))
            && device_name.back() >= '1' && device_name.back() <= '9';
        if (device_name == "CON" || device_name == "PRN" || device_name == "AUX"
            || device_name == "NUL" || numbered_device) {
            return false;
        }
        if (slash == std::string_view::npos) {
            break;
        }
        start = slash + 1U;
    }
    return true;
}

safe_artifact_path()

std::filesystem::path arachne::crypto::safe_artifact_path ( const std::filesystem::path & root, std::string_view artifact_ref )

nodiscard

Join a validated artifact reference to a root. This is a lexical safety primitive; callers that write files must additionally reject symlinked directory components.

Definition at line 302 of file crypto.cpp.

  {
    if (!is_safe_relative_artifact_ref(artifact_ref)) {
        throw std::invalid_argument("unsafe relative artifact reference");
    }
    return root / std::filesystem::path { artifact_ref };
}

sha256() [1/2]

std::string arachne::crypto::sha256 ( std::span< const std::byte > bytes )

nodiscard

Return the lowercase hexadecimal SHA-256 digest of arbitrary bytes.

Definition at line 209 of file crypto.cpp.

                                                     {
    sha256_hasher hasher;
    hasher.update(bytes);
    return hasher.finish_hex();
}

References arachne::crypto::sha256_hasher::finish_hex().

Referenced by arachne::pheidippides::anonymous_namespace{transport.cpp}::artifact_id_for(), arachne::ariadne::candidate_planner::build(), arachne::ariadne::viewer_builder::build_site(), arachne::ariadne::anonymous_namespace{viewer.cpp}::edge_id(), arachne::ariadne::candidate_planner::enrichment_fetch_plan(), arachne::coordination::operational_ledger::intake(), arachne::penelope::anonymous_namespace{store.cpp}::make_staging_directory(), anonymous_namespace{main.cpp}::policy_configuration_hash(), arachne::ariadne::viewer_builder::project(), arachne::ariadne::anonymous_namespace{candidates.cpp}::publish_immutable_file(), arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::request_cache_key(), arachne::pheidippides::anonymous_namespace{transport.cpp}::retry_delay(), sha256_string(), anonymous_namespace{main.cpp}::wikidata_point_fetch_request(), arachne::penelope::anonymous_namespace{store.cpp}::write_active_id(), arachne::ariadne::anonymous_namespace{viewer.cpp}::write_immutable_file(), arachne::ariadne::candidate_planner::write_plan(), and arachne::ariadne::viewer_builder::write_projection().

Here is the call graph for this function:

Here is the caller graph for this function:

sha256() [2/2]

std::string arachne::crypto::sha256 ( std::string_view bytes )

nodiscard

Return the lowercase hexadecimal SHA-256 digest of a byte string.

Definition at line 215 of file crypto.cpp.

                                             {
    sha256_hasher hasher;
    hasher.update(bytes);
    return hasher.finish_hex();
}

References arachne::crypto::sha256_hasher::finish_hex().

Here is the call graph for this function:

sha256_file()

std::string arachne::crypto::sha256_file ( const std::filesystem::path & path )

nodiscard

Stream a file in binary mode and return its lowercase SHA-256 digest.

Definition at line 221 of file crypto.cpp.

                                                     {
    std::ifstream input(path, std::ios::binary);
    if (!input.is_open()) {
        throw std::system_error(
            errno == 0 ? EIO : errno, std::generic_category(),
            "cannot open file for SHA-256"
        );
    }
 
    sha256_hasher hasher;
    std::array<char, 64U * 1024U> buffer {};
    while (input) {
        input.read(buffer.data(), static_cast<std::streamsize>(buffer.size()));
        const std::streamsize count = input.gcount();
        if (count > 0) {
            hasher.update(
                std::as_bytes(
                    std::span { buffer.data(), static_cast<std::size_t>(count) }
                )
            );
        }
    }
    if (!input.eof()) {
        throw std::runtime_error("I/O error while calculating file SHA-256");
    }
    return hasher.finish_hex();
}

References arachne::crypto::sha256_hasher::finish_hex().

Referenced by anonymous_namespace{main.cpp}::command_candidate_rebuild(), arachne::penelope::store::export_jsonl(), arachne::coordination::anonymous_namespace{coordinator.cpp}::fingerprint_regular_file(), arachne::ariadne::anonymous_namespace{candidates.cpp}::publish_immutable_file(), arachne::penelope::store::replace_candidate_snapshot(), anonymous_namespace{main.cpp}::resolve_snapshot_export(), arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::safe_cached_file(), arachne::penelope::anonymous_namespace{store.cpp}::snapshot_from_directory(), anonymous_namespace{main.cpp}::verify_external_source_snapshot(), anonymous_namespace{main.cpp}::write_graph_run_manifest(), and arachne::ariadne::anonymous_namespace{viewer.cpp}::write_immutable_file().

Here is the call graph for this function:

Here is the caller graph for this function:

sha256_string()

std::string arachne::crypto::sha256_string ( std::string_view bytes )

inlinenodiscard

Compatibility spelling used by early Penelope code.

Definition at line 50 of file crypto.hpp.

                                                                   {
    return sha256(bytes);
}

References sha256().

Here is the call graph for this function: