fix: replace md5 with sha256 for FIPS-compliant cache key generation#765
Open
octo-patch wants to merge 1 commit into
Open
fix: replace md5 with sha256 for FIPS-compliant cache key generation#765octo-patch wants to merge 1 commit into
octo-patch wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #701
Problem
ShellGPT fails immediately on FIPS-enabled systems because the cache uses MD5 to generate cache keys. MD5 is not approved for use on FIPS 140-2/140-3 compliant systems, causing a
ValueErrorwhenhashlib.md5()is called.Solution
Replace
md5withsha256for cache key generation. SHA-256 is FIPS-compliant and serves the same purpose here — producing a deterministic, fixed-length key from the request parameters. This is a non-cryptographic use case (cache key deduplication), so SHA-256 is a drop-in replacement with no functional difference.Note: Existing cache files (named with MD5 hashes) will not be matched after this change, so the cache will be cold on first run. Old files will be gradually evicted by the existing
_delete_oldest_filescleanup logic.Testing
sgpt/cache.py