Skip to content

Upgrade BLAKE2 to unify hashing digest versions - #20834

Merged
zanieb merged 3 commits into
zb/upgrade-md5-digestfrom
zb/upgrade-blake2-digest
Jul 30, 2026
Merged

zanieb merged 3 commits into
zb/upgrade-md5-digestfrom
zb/upgrade-blake2-digest

Conversation

@astral-automations-bot

@astral-automations-bot astral-automations-bot Bot commented Jul 30, 2026 •

Copy link
Copy Markdown
Contributor

#20831 and #20833 move SHA-2 and MD5 to digest 0.11, but the latest stable blake2 release still depends on digest 0.10. This leaves the distribution hashing path with an unnecessary compatibility import for the older digest trait.

Upgrade blake2 to 0.11.0-rc.6 so MD5, SHA-2, and BLAKE2 share the same digest API. Preserve the existing 256-bit BLAKE2b output for local-wheel hash verification.

This intentionally adopts a prerelease because no stable BLAKE2 release is compatible with digest 0.11 yet.

Comment thread crates/uv/tests/pip/pip_sync.rs
@zanieb
zanieb force-pushed the zb/upgrade-blake2-digest branch from 746f8a1 to aafbaaa Compare July 30, 2026 19:34
@zanieb
zanieb merged commit 38288e2 into main Jul 30, 2026
117 checks passed
@zanieb
zanieb deleted the zb/upgrade-blake2-digest branch July 30, 2026 20:17
zanieb added a commit that referenced this pull request Jul 30, 2026
`sha2` 0.10 only enables ARM SHA-256 acceleration through its optional
`asm` feature, requiring the `sha2-asm` dependency and platform-specific
configuration added in #20805.

Upgrade to `sha2` 0.11, which selects its ARM backend automatically when
CPU feature detection is available. This preserves accelerated
distribution hashing on Apple Silicon and Linux/Android ARM while
removing `sha2-asm` and its target-specific configuration. Windows on
ARM still falls back to software because `cpufeatures` does not yet
support feature detection there (RustCrypto/utils#1124).

The upgrade also moves SHA-2 to `digest` 0.11. Two follow-ups complete
the migration for the other supported hash algorithms:
#20833 upgrades `md-5` to its stable 0.11 release, and
#20834 upgrades `blake2` to `0.11.0-rc.6`, its first release
compatible with `digest` 0.11.

Co-authored-by: Zanie Blue <contact@zanie.dev>
zanieb added a commit that referenced this pull request Jul 30, 2026
#20831 moves SHA-2 to `digest` 0.11, while `md-5` still
depends on `digest` 0.10. That leaves the distribution hashing path
using incompatible digest traits.

Upgrade `md-5` to its stable 0.11 release so MD5 and SHA-2 share the
same digest API without changing supported hashes or `--require-hashes`
behavior. BLAKE2 remains on the older digest trait in this change;
#20834 completes its migration separately.

Co-authored-by: Zanie Blue <contact@zanie.dev>

This branch was previously deployed

1 inactive deployment
automations — aafbaaa2 Deployed Jul 30, 2026 by zanieb via review / security review #43841
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants