Module: Datadog::SymbolDatabase::FileHash Private

Defined in:
lib/datadog/symbol_database/file_hash.rb

Overview

This module is part of a private API. You should avoid using this module if possible, as it may be removed or be changed in the future.

Computes Git-style SHA-1 hashes of Ruby source files for backend commit inference.

Uses Git's blob hash algorithm: SHA1("blob \0") Hashes enable the backend to correlate runtime code with Git repository history, identifying which commit is actually deployed.

Called by: Extractor (when building MODULE scopes) Stores result in: Scope's language_specifics Returns: 40-character hex string or nil if file unreadable

Class Method Summary collapse

Class Method Details

.compute(file_path, logger:) ⇒ String?

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Compute Git-style SHA-1 hash of a file. Uses Git's blob hash algorithm: SHA1("blob \0") Returns nil on any error (file not found, permission denied, etc.)



29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
 
# File 'lib/datadog/symbol_database/file_hash.rb', line 29

def compute(file_path, logger:)
  return nil unless file_path
  return nil unless File.exist?(file_path)

  content = File.read(file_path, mode: "rb")
  size = content.bytesize
  git_blob = "blob #{size}\0#{content}"

  # SHA-1 is required here to match Git's blob hash format for commit inference.
  # This is not a security vulnerability - we're computing file content hashes
  # to match against Git objects, not using SHA-1 for authentication/integrity.
  Digest::SHA1.hexdigest(git_blob)  # nosemgrep: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1
rescue Exception => e # standard:disable Lint/RescueException
  Datadog::DI.reraise_if_fatal(e)
  logger.debug { "symdb: file hash failed for #{file_path}: #{e.class}: #{e.message}" }
  nil
end