Route the JVM jar digests through utils::digest

#646 landed inline sha1/sha256 computations in patch/jvm_jar.rs,
patch/sidecars/maven.rs and crawlers/gradle_cache.rs after the
utils::digest ratchet, so production_digests_go_through_the_helpers
fails on main. jvm_jar's private sha1_hex/sha256_hex copies and the
Maven sidecar's inline sha1 now call the shared helpers; gradle_cache.rs,
which an open PR also edits, joins the pending list for now. Hashes are
byte-identical.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-core/src/patch/jvm_jar.rs

@@ -25,8 +25,6 @@
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 
-use sha1::Digest as _;
-
 use crate::crawlers::gradle_cache;
 use crate::hash::git_sha256::compute_git_sha256_from_bytes;
 use crate::manifest::schema::PatchFileInfo;
@@ -36,6 +34,7 @@ use crate::patch::apply::{
 };
 use crate::patch::rollback::{RollbackResult, VerifyRollbackResult, VerifyRollbackStatus};
 use crate::patch::sidecars::{self, maven as maven_sidecars};
+use crate::utils::digest::{sha1_hex_of, sha256_hex_of};
 use crate::utils::purl::{parse_maven_purl, purl_qualifier};
 use crate::vendor::VendorServiceConfig;
 
@@ -270,7 +269,7 @@ pub fn derived_copies_in(
     // reader fails fast on a FIFO or device instead of wedging in open(2).
     let current = crate::utils::fs::read_regular_to_bytes_sync(&jar)
         .ok()
-        .map(|b| sha1_hex(&b));
+        .map(|b| sha1_hex_of(&b));
     let written = std::fs::metadata(&jar).and_then(|m| m.modified()).ok();
     let unverified = found
         .unknown
@@ -279,7 +278,7 @@ pub fn derived_copies_in(
             let Ok(copy) = crate::utils::fs::read_regular_to_bytes_sync(p) else {
                 return true;
             };
-            if Some(sha1_hex(&copy)) == current {
+            if Some(sha1_hex_of(&copy)) == current {
                 return false;
             }
             let made = std::fs::metadata(p).and_then(|m| m.modified()).ok();
@@ -352,20 +351,11 @@ fn unpatched_members(
     Ok(members)
 }
 
-fn sha256_hex(bytes: &[u8]) -> String {
-    use sha2::Digest as _;
-    hex::encode(sha2::Sha256::digest(bytes))
-}
-
-fn sha1_hex(bytes: &[u8]) -> String {
-    hex::encode(sha1::Sha1::digest(bytes))
-}
-
 /// `<socket_dir>/jvm-originals/<sha256>.jar`.
 pub fn backup_path(socket_dir: &Path, original: &[u8]) -> PathBuf {
     socket_dir
         .join(ORIGINALS_DIR)
-        .join(format!("{}.jar", sha256_hex(original)))
+        .join(format!("{}.jar", sha256_hex_of(original)))
 }
 
 /// Keep `original` under [`ORIGINALS_DIR`] (content-addressed: an existing
@@ -625,7 +615,7 @@ async fn find_backup(restore: &JarRestore<'_>, dir: &Path, current: &[u8]) -> Op
             continue;
         };
         if let Some(hash) = &gradle_hash {
-            if !gradle_cache::hash_eq(hash, &sha1_hex(&bytes)) {
+            if !gradle_cache::hash_eq(hash, &sha1_hex_of(&bytes)) {
                 continue;
             }
         }
@@ -663,7 +653,7 @@ async fn upstream_for_gradle_copy(purl: &str, jar_leaf: &str, dir: &Path) -> Opt
     )
     .await
     .ok()?;
-    gradle_cache::hash_eq(hash, &sha1_hex(&bytes)).then_some(bytes)
+    gradle_cache::hash_eq(hash, &sha1_hex_of(&bytes)).then_some(bytes)
 }
 
 fn rollback_result(purl: &str, dir: &Path) -> RollbackResult {
@@ -1066,7 +1056,7 @@ mod tests {
         std::fs::create_dir_all(&copy).unwrap();
         let original = pristine_jar();
         std::fs::write(copy.join("lib-1.0.jar"), &original).unwrap();
-        let sha1_text = format!("{}\n", sha1_hex(&original));
+        let sha1_text = format!("{}\n", sha1_hex_of(&original));
         std::fs::write(copy.join("lib-1.0.jar.sha1"), &sha1_text).unwrap();
 
         let files = record();
@@ -1082,7 +1072,7 @@ mod tests {
         );
         assert_eq!(
             std::fs::read_to_string(copy.join("lib-1.0.jar.sha1")).unwrap(),
-            format!("{}\n", sha1_hex(&service))
+            format!("{}\n", sha1_hex_of(&service))
         );
 
         let restore = JarRestore {
@@ -1123,7 +1113,7 @@ mod tests {
         let version = d
             .path()
             .join(".gradle/caches/modules-2/files-2.1/com.example/lib/1.0");
-        let hash_dir = version.join(sha1_hex(&original));
+        let hash_dir = version.join(sha1_hex_of(&original));
         std::fs::create_dir_all(&hash_dir).unwrap();
         std::fs::write(hash_dir.join("lib-1.0.jar"), patched_jar()).unwrap();
 

crates/socket-patch-core/src/patch/sidecars/maven.rs

@@ -17,8 +17,6 @@
 
 use std::path::{Path, PathBuf};
 
-use sha1::Digest as _;
-
 use super::{
     SidecarAdvisory, SidecarAdvisoryCode, SidecarError, SidecarFile, SidecarFileAction,
     SidecarPayload, SidecarSeverity,
@@ -44,7 +42,7 @@ impl Algo {
 
     fn digest(self, bytes: &[u8]) -> String {
         match self {
-            Algo::Sha1 => hex::encode(sha1::Sha1::digest(bytes)),
+            Algo::Sha1 => crate::utils::digest::sha1_hex_of(bytes),
             Algo::Md5 => hex::encode(md5(bytes)),
         }
     }

crates/socket-patch-core/src/utils/digest.rs

@@ -135,6 +135,7 @@ mod tests {
     /// when you move it onto the helpers above; the test fails on a stale
     /// entry as well as on a new inline copy.
     const PENDING_INLINE_DIGESTS: &[&str] = &[
+        "crawlers/gradle_cache.rs",
         "utils/group_commit.rs",
         "vendor/jvm/mod.rs",
         "vendor/maven_repo.rs",