Module sha256 

SHA-256 (FIPS 180-4), for .fttsq section digests.

Why this is here rather than a dependency

sha2 is already resolved in Cargo.lock as a transitive dependency, and it is the better long-run answer. Adding a direct edge to it changes the dependency graph, which changes Cargo.lock — and cargo check --locked is a hard gate that every concurrent agent in this workspace runs. Landing a Cargo.toml edit without an in-lockstep lockfile regeneration breaks the gate for everyone, and regenerating the lock requires winning a contended build lock.

So this is a deliberate, bounded trade, not a preference for hand-rolled crypto.

DELETION CONDITION: replace this module with sha2::Sha256 the next time the workspace lockfile is being updated for another reason. Tracked by frankentts-p2-fttsq-format-wsa.

Scope

Digests here are integrity checks — they detect truncation, bit-flips, and mismatched sections. They are not a signature scheme and prove nothing about who produced an artifact. Verified against the FIPS 180-4 vectors in the tests below.

Structs

Sha256

Streaming SHA-256 state.

Functions

hex_digest

Digests a byte slice, returning lowercase hex.

hex_digest_file

Digests a file by streaming fixed-size reads, returning lowercase hex.

to_hex

Renders raw digest bytes as lowercase hex.