Skip to content

fix: mitigate hash collision risk by using full SHA256 hash#49

Open
echobt wants to merge 1 commit intomainfrom
fix/issue-152
Open

fix: mitigate hash collision risk by using full SHA256 hash#49
echobt wants to merge 1 commit intomainfrom
fix/issue-152

Conversation

@echobt
Copy link
Copy Markdown
Contributor

@echobt echobt commented Jan 20, 2026

Problem

The previous implementation used only the first 8 bytes (64 bits) of the SHA256 hash for generating project database filenames. This limited the hash space significantly, increasing the risk of collisions via the birthday paradox as the number of projects grows. A collision would result in two different projects sharing the same database file, leading to data corruption.

Solution

This PR changes the hash_path function in src/config.rs to use the full SHA256 hash (32 bytes / 64 hex characters) instead of truncating it. This effectively eliminates the risk of accidental collision for all practical purposes.

Testing

  • Verified that hash_path now returns a 64-character hex string.
  • Ran existing tests with cargo test to ensure no regressions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant