chore: update cargo toml for release v2.4.0 #1385
Conversation
WalkthroughThe Changes
Estimated code review effort1 (~2 minutes) Possibly related PRs
Poem
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
Cargo.toml(2 hunks)
🔇 Additional comments (1)
Cargo.toml (1)
3-3: Ensure the 2.4.0 bump is reflected everywhere it is consumed
Bumping the crate version here is necessary, but double-check secondary touch-points (CHANGELOG, Docker image tags,build.rsconstants, CI publishing steps, etc.) to avoid mismatched versions at release time.
| [package.metadata.parseable_ui] | ||
| assets-url = "https://parseable-prism-build.s3.us-east-2.amazonaws.com/v2.3.5/build.zip" | ||
| assets-sha1 = "3e703ef8bedf8ae55fd31713f6267ad14ad3d29d" | ||
| assets-url = "https://parseable-prism-build.s3.us-east-2.amazonaws.com/v2.4.0/build.zip" | ||
| assets-sha1 = "04632472a2174328cfea7a91a175f6f3795d7152" |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Stop using SHA-1 for release-artifact integrity; switch to SHA-256
SHA-1 has been considered broken for over a decade. Prefer a SHA-256 (or stronger) checksum to avoid collision attacks and to align with modern supply-chain security guidance. Example:
-assets-sha1 = "04632472a2174328cfea7a91a175f6f3795d7152"
+# SHA-256 of the v2.4.0 build.zip
+assets-sha256 = "<paste sha256 here>"If the build script currently hard-codes assets-sha1, add parallel support for assets-sha256 or migrate entirely.
🏁 Script executed:
#!/bin/bash
# Search for hard-coded SHA-1 usage in the repository
rg -n "assets-sha1"
# Check for any existing SHA-256 support
rg -n "assets-sha256"
# Locate code that reads the parseable_ui metadata
rg -n "parseable_ui"
# Inspect references to the Cargo metadata section
rg -n "metadata.parseable_ui"Length of output: 1105
Switch to SHA-256 for parseable_ui assets integrity
The build script and Cargo metadata currently only support SHA-1, which is considered insecure. You’ll need to:
- Update Cargo.toml to replace
assets-sha1withassets-sha256(or add parallel support):
• File: Cargo.toml (lines 151–153) - Modify build.rs to:
• Readmetadata["assets-sha256"]instead ofassets-sha1(currently at lines 104 and 127)
• Compute the checksum with SHA-256 (e.g., using thesha2crate) rather than Sha1::hexdigest()
• Write out a.sha256file instead of.sha1(update thechecksum_pathlogic around line 72)
Suggested diff in Cargo.toml:
[package.metadata.parseable_ui]
-assets-url = "https://…/v2.4.0/build.zip"
-assets-sha1 = "04632472a2174328cfea7a91a175f6f3795d7152"
+# URL for v2.4.0 build.zip
+assets-url = "https://…/v2.4.0/build.zip"
+# SHA-256 of v2.4.0 build.zip
+assets-sha256 = "<paste sha256 here>"And in build.rs (pseudocode):
- let checksum_path = out_dir.join("parseable_ui.sha1");
+ let checksum_path = out_dir.join("parseable_ui.sha256");
…
- let checksum = Sha1::from(&parseable_ui_bytes).hexdigest();
+ let checksum = Sha256::digest(&parseable_ui_bytes)
+ .iter()
+ .map(|b| format!("{:02x}", b))
+ .collect::<String>();
…
- if checksum == metadata["assets-sha1"].as_str().unwrap() {
+ if checksum == metadata["assets-sha256"].as_str().unwrap() {These changes will bring artifact validation in line with modern supply-chain security practices.
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In Cargo.toml around lines 151 to 153, replace the key `assets-sha1` with
`assets-sha256` to reflect the use of SHA-256 for asset integrity. Then, in
build.rs at lines 72, 104, and 127, update the code to read the `assets-sha256`
metadata instead of `assets-sha1`, compute the checksum using the SHA-256
algorithm (for example, via the `sha2` crate), and change the output checksum
file extension from `.sha1` to `.sha256`. This involves modifying the checksum
calculation logic and the path where the checksum file is written to ensure
compatibility with SHA-256 validation.
Summary by CodeRabbit