Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Hash avatar addresses with SHA-256
Gravatar's documentation now describes SHA-256 hashes on gravatar.com
alone, and Libravatar has long accepted them beside MD5.
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/extensions/test-email-avatar.lua | 8 | |
| -rwxr-xr-x | tests/t0504-email-avatar.sh | 8 |
2 files changed, 9 insertions, 7 deletions
diff --git a/tests/extensions/test-email-avatar.lua b/tests/extensions/test-email-avatar.lua index 41cba8c..c6b92cb 100644 --- a/tests/extensions/test-email-avatar.lua +++ b/tests/extensions/test-email-avatar.lua @@ -4,7 +4,8 @@ -- is picked from the script's name. The second argument chooses how the -- openssl.digest dependency is met, stub swaps in the deterministic fake -- from the harness, real uses an installed luaossl and adds the one check --- only a genuine MD5 can pass, and missing makes the module fail to load. +-- only a genuine SHA-256 can pass, and missing makes the module fail to +-- load. local test_directory = arg[0]:match("^(.*)/") or "." local h = dofile(test_directory .. "/harness.lua") @@ -12,7 +13,7 @@ local h = dofile(test_directory .. "/harness.lua") local script = arg[1] local mode = arg[2] or "stub" -local base_url = "https://www.gravatar.com/avatar/" +local base_url = "https://gravatar.com/avatar/" if script:find("libravatar", 1, true) then base_url = "https://seccdn.libravatar.org/avatar/" end @@ -90,7 +91,8 @@ h.check("the outermost brackets are the ones taken off", if mode == "real" then out = render("test@example.com", "x") - h.equals("a known address hashes to its published md5", hash_of(out), "55502f40dc8b7c769880b10874abc9d0") + h.equals("a known address hashes to its sha256", hash_of(out), + "973dfe463ec85785f5f95af5ba3906eedb2d931c24e69824a89ea65dba4e813b") end h.finish() diff --git a/tests/t0504-email-avatar.sh b/tests/t0504-email-avatar.sh index 0150c54..c1869b4 100755 --- a/tests/t0504-email-avatar.sh +++ b/tests/t0504-email-avatar.sh @@ -5,9 +5,9 @@ # unit checks run each under every suitable standalone Lua with a # deterministic digest standing in for luaossl, with the module made to # fail to load, and once more against the real module wherever it is -# installed, which adds the check that a known address hashes to its -# published md5. Through cgit itself the answer depends on whether the -# binary's own Lua has luaossl, so it is probed for rather than assumed. +# installed, which adds the check that a known address hashes to its SHA-256. +# Through cgit itself the answer depends on whether the binary's own Lua has +# luaossl, so it is probed for rather than assumed. test_description='Check the shipped email avatar extensions' CGIT_TEST_NO_CREATE_REPOS=YesPlease @@ -75,7 +75,7 @@ test_expect_success CGIT_LUA 'point cgit at it through the email filter' ' # library commits under. test_expect_success CGIT_LUA_OSSL 'the commit page draws the author icon' ' cgit_url "avatar/commit/" >tmp && - grep "www.gravatar.com/avatar/5c1e6d6e64e12aca17657581a48005d1" tmp && + grep "gravatar.com/avatar/b0eda69977c26118feff17875d53376006568bcbcde5ca0c916d01f05c281436" tmp && grep "loading=.lazy." tmp ' |