Switch to SHA-256 hashing

odp/api/lib/archive/__init__.py

@@ -28,7 +28,7 @@ async def get_zip(self, *paths: str | PathLike) -> FileResponse:
         files at `paths` to the client."""
         raise NotImplementedError
 
-    async def put(self, path: str | PathLike, file: UploadFile, md5: str) -> None:
+    async def put(self, path: str | PathLike, file: UploadFile, sha256: str) -> None:
         """Store the contents of the incoming `file` at `path` and
         verify the stored file against the given checksum."""
         raise NotImplementedError

odp/api/lib/archive/filesystem.py

@@ -22,7 +22,7 @@ async def get(self, path: str | PathLike) -> FileResponse:
         """Send the contents of the file at `path` to the client."""
         return FileResponse(self.dir / path)
 
-    async def put(self, path: str | PathLike, file: UploadFile, md5: str) -> None:
+    async def put(self, path: str | PathLike, file: UploadFile, sha256: str) -> None:
         """Store the contents of the incoming `file` at `path` and
         verify the stored file against the given checksum."""
         try:
@@ -42,7 +42,7 @@ async def put(self, path: str | PathLike, file: UploadFile, md5: str) -> None:
             )
 
         with open(self.dir / path, 'rb') as f:
-            if md5 != hashlib.md5(f.read()).hexdigest():
+            if sha256 != hashlib.sha256(f.read()).hexdigest():
                 raise HTTPException(
                     HTTP_422_UNPROCESSABLE_ENTITY, f'Error creating file at {path}: checksum verification failed'
                 )

odp/api/lib/archive/nextcloud.py

@@ -17,7 +17,7 @@ async def get_zip(self, *paths: str | PathLike) -> FileResponse:
         """Send a zip file of the directories and files at `paths`
         to the client."""
 
-    async def put(self, path: str | PathLike, file: UploadFile, md5: str) -> None:
+    async def put(self, path: str | PathLike, file: UploadFile, sha256: str) -> None:
         """Store the contents of the incoming `file` at `path` and
         verify the stored file against the given checksum."""
 

odp/api/routers/archive.py

@@ -12,6 +12,7 @@
 from odp.api.models import ArchiveModel, ArchiveResourceModel, Page, ResourceModel
 from odp.api.routers.resource import output_resource_model
 from odp.const import ODPScope
+from odp.const.db import HashAlgorithm
 from odp.db import Session
 from odp.db.models import Archive, ArchiveResource, Package, PackageResource, Provider, Resource
 
@@ -125,12 +126,12 @@ async def upload_resource(
         provider_id: str,
         package_id: str,
         path: str = Path(..., title='Resource path relative to the package root'),
-        title: str = Query(..., title='Resource title'),
-        description: str = Query(None, title='Resource description'),
         file: UploadFile = File(..., title='File upload'),
         filename: str = Query(..., title='File name'),
         mimetype: str = Query(..., title='Content type'),
-        md5: str = Query(..., title='MD5 checksum'),
+        sha256: str = Query(..., title='SHA-256 checksum'),
+        title: str = Query(None, title='Resource title'),
+        description: str = Query(None, title='Resource description'),
         archive_adapter: ArchiveAdapter = Depends(get_archive_adapter),
         provider_auth: Authorized = Depends(Authorize(ODPScope.PROVIDER_READ)),
         package_auth: Authorized = Depends(Authorize(ODPScope.PACKAGE_WRITE)),
@@ -176,7 +177,8 @@ async def upload_resource(
         filename=filename,
         mimetype=mimetype,
         size=file.size,
-        md5=md5,
+        hash=sha256,
+        hash_algorithm=HashAlgorithm.sha256,
         timestamp=(timestamp := datetime.now(timezone.utc)),
         provider_id=provider_id,
     )
@@ -210,7 +212,7 @@ async def upload_resource(
 
     try:
         await archive_adapter.put(
-            archive_path, file, md5
+            archive_path, file, sha256
         )
     except NotImplementedError:
         raise HTTPException(

odp/db/models/resource.py

@@ -45,4 +45,4 @@ class Resource(Base):
     archive_resources = relationship('ArchiveResource', viewonly=True)
     archives = association_proxy('archive_resources', 'archive')
 
-    _repr_ = 'id', 'title', 'filename', 'mimetype', 'size', 'md5', 'provider_id'
+    _repr_ = 'id', 'title', 'filename', 'mimetype', 'size', 'hash', 'provider_id'