Hash avatar addresses with SHA-256

Gravatar's documentation now describes SHA-256 hashes on gravatar.com
alone, and Libravatar has long accepted them beside MD5.

4 files changed, 16 insertions, 13 deletions

diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.luaindex d5c30fc..95f7aae 100644--- a/custom/extensions/email-gravatar.lua+++ b/custom/extensions/email-gravatar.lua@@ -29,8 +29,8 @@ -- -- Every page view sends the visitor's IP address and a hash of each -- committer's email to a third-party service, so leave this filter off if--- that is not acceptable for your instance. Addresses are hashed with MD5,--- which Gravatar still accepts.+-- that is not acceptable for your instance. Addresses are hashed with+-- SHA-256, the form Gravatar documents.  local has_digest, digest = pcall(require, "openssl.digest") @@ -41,7 +41,7 @@ local has_digest, digest = pcall(require, "openssl.digest") -- the icon is not blocked as mixed content on an https page. local avatar_size = 13 local default_image = "retro"-local base_url = "https://www.gravatar.com/avatar/"+local base_url = "https://gravatar.com/avatar/"   -- One name reaches this filter as an open, writes and a close, so what the@@ -50,7 +50,7 @@ local buffer = "" local avatar_hash = nil  local function hash_hex(input)-	local raw = digest.new("md5"):final(input)+	local raw = digest.new("sha256"):final(input) 	local hex = "" 	for i = 1, #raw do 		hex = hex .. string.format("%.2x", string.byte(raw, i))
diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.lua
index d5c30fc..95f7aae 100644
--- a/custom/extensions/email-gravatar.lua
+++ b/custom/extensions/email-gravatar.lua
@@ -29,8 +29,8 @@
 --
 -- Every page view sends the visitor's IP address and a hash of each
 -- committer's email to a third-party service, so leave this filter off if
--- that is not acceptable for your instance. Addresses are hashed with MD5,
--- which Gravatar still accepts.
+-- that is not acceptable for your instance. Addresses are hashed with
+-- SHA-256, the form Gravatar documents.
 
 local has_digest, digest = pcall(require, "openssl.digest")
 
@@ -41,7 +41,7 @@ local has_digest, digest = pcall(require, "openssl.digest")
 -- the icon is not blocked as mixed content on an https page.
 local avatar_size = 13
 local default_image = "retro"
-local base_url = "https://www.gravatar.com/avatar/"
+local base_url = "https://gravatar.com/avatar/"
 
 
 -- One name reaches this filter as an open, writes and a close, so what the
@@ -50,7 +50,7 @@ local buffer = ""
 local avatar_hash = nil
 
 local function hash_hex(input)
-	local raw = digest.new("md5"):final(input)
+	local raw = digest.new("sha256"):final(input)
 	local hex = ""
 	for i = 1, #raw do
 		hex = hex .. string.format("%.2x", string.byte(raw, i))
diff --git a/custom/extensions/email-libravatar.lua b/custom/extensions/email-libravatar.luaindex 719be2e..e04c2c2 100644--- a/custom/extensions/email-libravatar.lua+++ b/custom/extensions/email-libravatar.lua@@ -28,7 +28,8 @@ -- -- Every page view sends the visitor's IP address and a hash of each -- committer's email to a third-party service, so leave this filter off if--- that is not acceptable for your instance. Addresses are hashed with MD5.+-- that is not acceptable for your instance. Addresses are hashed with+-- SHA-256, which Libravatar accepts alongside MD5.  local has_digest, digest = pcall(require, "openssl.digest") @@ -48,7 +49,7 @@ local buffer = "" local avatar_hash = nil  local function hash_hex(input)-	local raw = digest.new("md5"):final(input)+	local raw = digest.new("sha256"):final(input) 	local hex = "" 	for i = 1, #raw do 		hex = hex .. string.format("%.2x", string.byte(raw, i))
diff --git a/custom/extensions/email-libravatar.lua b/custom/extensions/email-libravatar.lua
index 719be2e..e04c2c2 100644
--- a/custom/extensions/email-libravatar.lua
+++ b/custom/extensions/email-libravatar.lua
@@ -28,7 +28,8 @@
 --
 -- Every page view sends the visitor's IP address and a hash of each
 -- committer's email to a third-party service, so leave this filter off if
--- that is not acceptable for your instance. Addresses are hashed with MD5.
+-- that is not acceptable for your instance. Addresses are hashed with
+-- SHA-256, which Libravatar accepts alongside MD5.
 
 local has_digest, digest = pcall(require, "openssl.digest")
 
@@ -48,7 +49,7 @@ local buffer = ""
 local avatar_hash = nil
 
 local function hash_hex(input)
-	local raw = digest.new("md5"):final(input)
+	local raw = digest.new("sha256"):final(input)
 	local hex = ""
 	for i = 1, #raw do
 		hex = hex .. string.format("%.2x", string.byte(raw, i))
diff --git a/tests/extensions/test-email-avatar.lua b/tests/extensions/test-email-avatar.luaindex 41cba8c..c6b92cb 100644--- a/tests/extensions/test-email-avatar.lua+++ b/tests/extensions/test-email-avatar.lua@@ -4,7 +4,8 @@ -- is picked from the script's name. The second argument chooses how the -- openssl.digest dependency is met, stub swaps in the deterministic fake -- from the harness, real uses an installed luaossl and adds the one check--- only a genuine MD5 can pass, and missing makes the module fail to load.+-- only a genuine SHA-256 can pass, and missing makes the module fail to+-- load.  local test_directory = arg[0]:match("^(.*)/") or "." local h = dofile(test_directory .. "/harness.lua")@@ -12,7 +13,7 @@ local h = dofile(test_directory .. "/harness.lua") local script = arg[1] local mode = arg[2] or "stub" -local base_url = "https://www.gravatar.com/avatar/"+local base_url = "https://gravatar.com/avatar/" if script:find("libravatar", 1, true) then 	base_url = "https://seccdn.libravatar.org/avatar/" end@@ -90,7 +91,8 @@ h.check("the outermost brackets are the ones taken off",  if mode == "real" then 	out = render("test@example.com", "x")-	h.equals("a known address hashes to its published md5", hash_of(out), "55502f40dc8b7c769880b10874abc9d0")+	h.equals("a known address hashes to its sha256", hash_of(out),+		"973dfe463ec85785f5f95af5ba3906eedb2d931c24e69824a89ea65dba4e813b") end  h.finish()
diff --git a/tests/extensions/test-email-avatar.lua b/tests/extensions/test-email-avatar.lua
index 41cba8c..c6b92cb 100644
--- a/tests/extensions/test-email-avatar.lua
+++ b/tests/extensions/test-email-avatar.lua
@@ -4,7 +4,8 @@
 -- is picked from the script's name. The second argument chooses how the
 -- openssl.digest dependency is met, stub swaps in the deterministic fake
 -- from the harness, real uses an installed luaossl and adds the one check
--- only a genuine MD5 can pass, and missing makes the module fail to load.
+-- only a genuine SHA-256 can pass, and missing makes the module fail to
+-- load.
 
 local test_directory = arg[0]:match("^(.*)/") or "."
 local h = dofile(test_directory .. "/harness.lua")
@@ -12,7 +13,7 @@ local h = dofile(test_directory .. "/harness.lua")
 local script = arg[1]
 local mode = arg[2] or "stub"
 
-local base_url = "https://www.gravatar.com/avatar/"
+local base_url = "https://gravatar.com/avatar/"
 if script:find("libravatar", 1, true) then
 	base_url = "https://seccdn.libravatar.org/avatar/"
 end
@@ -90,7 +91,8 @@ h.check("the outermost brackets are the ones taken off",
 
 if mode == "real" then
 	out = render("test@example.com", "x")
-	h.equals("a known address hashes to its published md5", hash_of(out), "55502f40dc8b7c769880b10874abc9d0")
+	h.equals("a known address hashes to its sha256", hash_of(out),
+		"973dfe463ec85785f5f95af5ba3906eedb2d931c24e69824a89ea65dba4e813b")
 end
 
 h.finish()
diff --git a/tests/t0504-email-avatar.sh b/tests/t0504-email-avatar.shindex 0150c54..c1869b4 100755--- a/tests/t0504-email-avatar.sh+++ b/tests/t0504-email-avatar.sh@@ -5,9 +5,9 @@ # unit checks run each under every suitable standalone Lua with a # deterministic digest standing in for luaossl, with the module made to # fail to load, and once more against the real module wherever it is-# installed, which adds the check that a known address hashes to its-# published md5. Through cgit itself the answer depends on whether the-# binary's own Lua has luaossl, so it is probed for rather than assumed.+# installed, which adds the check that a known address hashes to its SHA-256.+# Through cgit itself the answer depends on whether the binary's own Lua has+# luaossl, so it is probed for rather than assumed.  test_description='Check the shipped email avatar extensions' CGIT_TEST_NO_CREATE_REPOS=YesPlease@@ -75,7 +75,7 @@ test_expect_success CGIT_LUA 'point cgit at it through the email filter' ' # library commits under. test_expect_success CGIT_LUA_OSSL 'the commit page draws the author icon' ' 	cgit_url "avatar/commit/" >tmp &&-	grep "www.gravatar.com/avatar/5c1e6d6e64e12aca17657581a48005d1" tmp &&+	grep "gravatar.com/avatar/b0eda69977c26118feff17875d53376006568bcbcde5ca0c916d01f05c281436" tmp && 	grep "loading=.lazy." tmp ' 
diff --git a/tests/t0504-email-avatar.sh b/tests/t0504-email-avatar.sh
index 0150c54..c1869b4 100755
--- a/tests/t0504-email-avatar.sh
+++ b/tests/t0504-email-avatar.sh
@@ -5,9 +5,9 @@
 # unit checks run each under every suitable standalone Lua with a
 # deterministic digest standing in for luaossl, with the module made to
 # fail to load, and once more against the real module wherever it is
-# installed, which adds the check that a known address hashes to its
-# published md5. Through cgit itself the answer depends on whether the
-# binary's own Lua has luaossl, so it is probed for rather than assumed.
+# installed, which adds the check that a known address hashes to its SHA-256.
+# Through cgit itself the answer depends on whether the binary's own Lua has
+# luaossl, so it is probed for rather than assumed.
 
 test_description='Check the shipped email avatar extensions'
 CGIT_TEST_NO_CREATE_REPOS=YesPlease
@@ -75,7 +75,7 @@ test_expect_success CGIT_LUA 'point cgit at it through the email filter' '
 # library commits under.
 test_expect_success CGIT_LUA_OSSL 'the commit page draws the author icon' '
 	cgit_url "avatar/commit/" >tmp &&
-	grep "www.gravatar.com/avatar/5c1e6d6e64e12aca17657581a48005d1" tmp &&
+	grep "gravatar.com/avatar/b0eda69977c26118feff17875d53376006568bcbcde5ca0c916d01f05c281436" tmp &&
 	grep "loading=.lazy." tmp
 '