Replace usage of md5 with sha256 for generation of mojo app ids.

shell/dynamic_application_loader.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "shell/dynamic_application_loader.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/format_macros.h"
 #include "base/logging.h"
-#include "base/md5.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/message_loop/message_loop.h"
 #include "base/process/process.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
+#include "crypto/secure_hash.h"
+#include "crypto/sha2.h"
 #include "mojo/common/common_type_converters.h"
 #include "mojo/common/data_pipe_utils.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "mojo/services/network/public/interfaces/url_loader.mojom.h"
 #include "shell/context.h"
 #include "shell/data_pipe_peek.h"
 #include "shell/filename_util.h"
 #include "shell/switches.h"
 #include "url/url_util.h"
 
@@ skipping 273 matching lines @@
     std::string map_entry =
         base::StringPrintf("%s %s\n", path.value().c_str(), url.spec().c_str());
     // TODO(eseidel): AppendToFile is missing O_CREAT, crbug.com/450696
     if (!PathExists(map_path))
       base::WriteFile(map_path, map_entry.data(), map_entry.length());
     else
       base::AppendToFile(map_path, map_entry.data(), map_entry.length());
   }
 
   // AppIds should be be both predictable and unique, but any hash would work.
-  // TODO(eseidel): Use sha256 once it has an incremental API, crbug.com/451588
-  // Derived from tools/android/md5sum/md5sum.cc with fstream usage removed.
+  // Currently we use sha256 from crypto/secure_hash.h

[qsr, 2015/01/30 15:15:58]

Eric: there is a few things to consider for this:
1) Only hash a few k of the library, that should be enough to get a hash, and
will be quicker to compute and need less I/O.
2) Try to compute the has while we get the byte from the network in case of a
network load, so that we do not have to re-read the same bytes
3) Fix the current race -> if the same application is in 2 different location on
the network, and we load those at the same time, there is a race.

   static bool ComputeAppId(const base::FilePath& path,
                            std::string* digest_string) {
-
+    scoped_ptr<crypto::SecureHash> ctx(
+        crypto::SecureHash::Create(crypto::SecureHash::SHA256));
     base::File file(path, base::File::FLAG_OPEN | base::File::FLAG_READ);
     if (!file.IsValid()) {
       LOG(ERROR) << "Failed to open " << path.value() << " for computing AppId";
       return false;
     }
-    base::MD5Context ctx;
-    base::MD5Init(&ctx);
     char buf[1024];
     while (file.IsValid()) {
       int bytes_read = file.ReadAtCurrentPos(buf, sizeof(buf));
       if (bytes_read == 0)
         break;
-      base::MD5Update(&ctx, base::StringPiece(buf, bytes_read));
+      ctx->Update(buf, bytes_read);
     }
     if (!file.IsValid()) {
       LOG(ERROR) << "Error reading " << path.value();
       return false;
     }
-    base::MD5Digest digest;
-    base::MD5Final(&digest, &ctx);
-    *digest_string = base::MD5DigestToBase16(digest);
+    // The output is really a vector of unit8, we're cheating by using a string.
+    std::string output(crypto::kSHA256Length, 0);
+    ctx->Finish(string_as_array(&output), output.size());
+    output = base::HexEncode(output.c_str(), output.size());
+    // Using lowercase for compatiblity with sha256sum output.
+    *digest_string = base::StringToLowerASCII(output);
     return true;
   }
 
   static bool RenameToAppId(const base::FilePath& old_path,
                             base::FilePath* new_path) {
     std::string app_id;
     if (!ComputeAppId(old_path, &app_id))
       return false;
 
     base::FilePath temp_dir;
@@ skipping 143 matching lines @@
   // TODO(darin): What should we do about service errors? This implies that
   // the app closed its handle to the service manager. Maybe we don't care?
 }
 
 void DynamicApplicationLoader::LoaderComplete(Loader* loader) {
   loaders_.erase(std::find(loaders_.begin(), loaders_.end(), loader));
 }
 
 }  // namespace shell
 }  // namespace mojo