Skip to content

fix: replace weak hash functions with SHA-256 #3168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

guan404ming
Copy link

Checklist
  • npm install && npm run lint && npm test passes
  • tests are included
  • documentation is changed or added
  • commit message follows commit guidelines
Description of change

This PR replaces weak cryptographic hash functions (MD5 and SHA1) with SHA-256 across the node-gyp codebase to improve security. The changes affect hash generation for:

  • Object ID calculation in Xcode project files
  • Intermediate file naming in Makefile generation
  • GUID generation for Visual Studio projects
  • Build rule hashing in Ninja generator

Security Impact: Addresses potential security vulnerabilities by replacing deprecated hash functions that are susceptible to collision attacks.

Performance & Functionality: No impact on build speed or functionality. All existing features work exactly the same with stronger security guarantees.

Compatibility: Maintains full backward compatibility while using modern cryptographic standards.

Copy link
Member

@legendecas legendecas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you mind submitting changes in gyp/ to https://github.com/nodejs/gyp-next first? Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants