Route Gradle digests through utils::digest

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Summary

main has been failing socket-patch-core --lib since c644ab0. The cause is a semantic conflict between Gradle support (#646) and the digest helpers (#865), not either PR alone. #865 added a guard test, utils::digest::tests::production_digests_go_through_the_helpers, which asserts that production code hashes only through utils::digest. #646 landed three files that still hash inline:

• crawlers/gradle_cache.rs: pristine and DerivedIndex::query (sha1)
• patch/jvm_jar.rs: sha256_hex / sha1_hex
• patch/sidecars/maven.rs: Algo::digest (sha1)

This breaks test (ubuntu/macos), test-release and coverage on every open PR (first seen on #827).

Fix

Each inline call goes through utils::digest::sha1_hex_of / sha256_hex_of. Those helpers compute the same lowercase hex, so behaviour is unchanged. I removed the Digest imports that became unused. The test-only inline SRI in jvm_jar.rs's test module is left alone, since the guard skips test modules. No other production code changes.

Evidence

• On origin/main c644ab0: cargo test -p socket-patch-core --all-features --lib -- utils::digest::tests::production_digests fails, with left listing the three files above.
• With this change, cargo test -p socket-patch-core --all-features --lib passes 5243 tests. The only 4 failures are the chmod-based write-failure tests (copy_tree, vlt_heal, pypi_poetry, pypi_requirements), which can't fail as root in the sandbox; they're unrelated, and CI runs as non-root.
• cargo test -p socket-patch-core --all-features --lib -- utils::digest gradle_cache jvm_jar sidecars: 67/67 pass.
• cargo clippy --workspace --all-features -- -D warnings is clean, and rustfmt --check is clean on the three touched files.

Related: #827 needs this fix to go green.

🤖 Generated with Claude Code

---

Generated by Claude Code

---

Note

Low Risk
Refactor-only: same hex digests via shared helpers; no logic or API changes beyond satisfying the digest guard test.

Overview
Gradle cache, JVM jar patching, and Maven sidecar code no longer compute SHA-1/SHA-256 with inline Digest + hex::encode calls. Production hashing now goes through utils::digest::sha1_hex_of and sha256_hex_of in gradle_cache (pristine, DerivedIndex::query), jvm_jar (sha1_hex / sha256_hex), and sidecars/maven (Algo::Sha1::digest).

This aligns Gradle/JVM paths with the production_digests_go_through_the_helpers guard from #865, which was failing after #646 landed inline digests. Unused sha1/sha2 Digest imports were removed; digest output format is unchanged.

^{Reviewed by Cursor Bugbot for commit 659ac2c. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 659ac2c. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[agent] Ported into #873 (cherry-picked as e5dfad6) so that PR can go green while main's coverage is red on production_digests_go_through_the_helpers. It becomes a no-op there once this lands.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review at 659ac2c (659ac2c24e5c5904e743b4bc98ea4645da2ed6a1).

• CI: 406/406 green on the head commit (6 skipped by matrix rule).
• Bugbot: reviewed 659ac2c with no findings; no open review threads.
• Mergeable against main (clean); approved by Tanmay Singla (@Tanmay182003) on this SHA.
• Reviewer note: this fixes main's red production_digests_go_through_the_helpers; several open PRs carry a port of it, so landing it first unblocks them.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] Ported into #911 (commit 34051e4) so that PR's CI can go green while main's digest guard is red. It becomes a no-op once this lands.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] Ported this PR's commit into #961 (as 35ffa60), because main's red production_digests_go_through_the_helpers turned its test and coverage jobs red. The two changes are identical, so whichever lands first makes the other a no-op.

---

Generated by Claude Code