FROSADO / onecloudriver / 31961261219

78%

Build Type

push

github

Committed by web-flow

Commit Message

feat(graph): implement QuickXorHash and content-integrity verification (#32) (#90)

* feat(graph): implement QuickXorHash and content-integrity verification (#32)

Adds the QuickXorHash algorithm (rclone/namazso port, BSD-0 + MIT
licenses preserved) and wires it into the content pipeline:

- Download verification: GetItemContentStream hashes the stream and
  rejects a body that does not match the server quickXorHash.
- Cache verification on Open: read-only opens hash the cached content
  and re-download on mismatch (no server hash = skipped, defensive).
- Delta content-change detection: applyDelta keeps the cache when the
  local bytes already match the remote quickXorHash.

No new external dependencies (stdlib hash only).

Closes #32

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

* fix(graph): silence gosec G115 on deliberate byte truncation in QuickXorHash

The checkSum byte conversions are intentional low-byte truncations defined
by the QuickXorHash spec, not overflow bugs. Annotate them with #nosec and
collapse the repetitive length-XOR into a loop so the Security Audit
(gosec -severity=high) passes.

Closes #32

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

* docs: require local security audit (gosec) before pushing (#32)

`make lint-all` does not run standalone gosec, so a gosec finding (e.g. G115
on a type conversion) can pass locally and block the Security Audit CI job.
Document `make security-audit` (or `gosec -quiet -severity=high ./...`) as a
mandatory local check alongside build/test-unit/lint-all.

Closes #32

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

---------

Co-authored-by: Codebuff <noreply@codebuff.com>

Coverage Stats

127 of 147 new or added lines in 6 files covered. (86.39%)

2 existing lines in 1 file now uncovered.

4022 of 5174 relevant lines covered (77.73%)

2862.1 hits per line