Add SHA-512 support

tough/src/cache.rs

@@ -1,5 +1,5 @@
 use crate::error::{self, Result};
-use crate::fetch::{fetch_max_size, fetch_sha256};
+use crate::fetch::{fetch_max_size, fetch_sha256, fetch_sha512};
 use crate::schema::{RoleType, Target};
 use crate::transport::IntoVec;
 use crate::{encode_filename, Prefix, Repository, TargetName};
@@ -257,15 +257,27 @@ impl Repository {
         &self,
         target: &Target,
         name: &TargetName,
-    ) -> (Vec<u8>, String) {
-        let sha256 = &target.hashes.sha256.clone().into_vec();
+    ) -> Result<(Vec<u8>, String)> {
+        let sha256 = target.hashes.sha256.as_ref().map(|d| d.clone().into_vec());
+        let sha512 = target.hashes.sha512.as_ref().map(|d| d.clone().into_vec());
+
+        let digest = if let Some(sha256) = sha256 {
+            sha256
+        } else if let Some(sha512) = sha512 {
+            sha512
+        } else {
+            return Err(error::NoValidHashSnafu {
+                name: format!("{name:?}"),
+            }
+            .build());
+        };
         if self.consistent_snapshot {
-            (
-                sha256.clone(),
-                format!("{}.{}", hex::encode(sha256), name.resolved()),
-            )
+            Ok((
+                digest.clone(),
+                format!("{}.{}", hex::encode(digest), name.resolved()),
+            ))
         } else {
-            (sha256.clone(), name.resolved().to_owned())
+            Ok((digest, name.resolved().to_owned()))
         }
     }
 
@@ -284,15 +296,28 @@ impl Repository {
                 path: filename,
                 url: self.targets_base_url.clone(),
             })?;
-        Ok(fetch_sha256(
-            self.transport.as_ref(),
-            url.clone(),
-            target.length,
-            "targets.json",
-            digest,
-        )
-        .await?
-        .context(error::TransportSnafu { url })
-        .boxed())
+        if target.hashes.sha256.is_some() {
+            Ok(fetch_sha256(
+                self.transport.as_ref(),
+                url.clone(),
+                target.length,
+                "targets.json",
+                digest,
+            )
+            .await?
+            .context(error::TransportSnafu { url })
+            .boxed())
+        } else {
+            Ok(fetch_sha512(
+                self.transport.as_ref(),
+                url.clone(),
+                target.length,
+                "targets.json",
+                digest,
+            )
+            .await?
+            .context(error::TransportSnafu { url })
+            .boxed())
+        }
     }
 }

tough/src/editor/mod.rs

@@ -23,7 +23,7 @@ use crate::schema::{
 use crate::transport::{IntoVec, Transport};
 use crate::{encode_filename, Limits};
 use crate::{Repository, TargetName};
-use aws_lc_rs::digest::{SHA256, SHA256_OUTPUT_LEN};
+use aws_lc_rs::digest::{SHA256, SHA256_OUTPUT_LEN, SHA512, SHA512_OUTPUT_LEN};
 use aws_lc_rs::rand::SystemRandom;
 use chrono::{DateTime, Utc};
 use serde_json::Value;
@@ -112,13 +112,17 @@ impl RepositoryEditor {
             }
         }
 
-        let mut digest = [0; SHA256_OUTPUT_LEN];
-        digest.copy_from_slice(aws_lc_rs::digest::digest(&SHA256, &root_buf).as_ref());
+        let mut sha256_digest = [0; SHA256_OUTPUT_LEN];
+        sha256_digest.copy_from_slice(aws_lc_rs::digest::digest(&SHA256, &root_buf).as_ref());
+
+        let mut sha512_digest = [0; SHA512_OUTPUT_LEN];
+        sha512_digest.copy_from_slice(aws_lc_rs::digest::digest(&SHA512, &root_buf).as_ref());
 
         let signed_root = SignedRole {
             signed: root,
             buffer: root_buf,
-            sha256: digest,
+            sha256: sha256_digest,
+            sha512: sha512_digest,
             length: root_buf_len,
         };
 
@@ -708,7 +712,8 @@ impl RepositoryEditor {
     {
         Metafile {
             hashes: Some(Hashes {
-                sha256: role.sha256.to_vec().into(),
+                sha256: Some(role.sha256.to_vec().into()),
+                sha512: Some(role.sha512.to_vec().into()),
                 _extra: HashMap::new(),
             }),
             length: Some(role.length),
@@ -746,7 +751,8 @@ impl RepositoryEditor {
     {
         Metafile {
             hashes: Some(Hashes {
-                sha256: role.sha256.to_vec().into(),
+                sha256: Some(role.sha256.to_vec().into()),
+                sha512: Some(role.sha512.to_vec().into()),
                 _extra: HashMap::new(),
             }),
             length: Some(role.length),