fsverity-hash

Python对fs-verity哈希方案的实现。

安装

python -mpip install fsverity-hash

用法

FSVerityHash提供了一个类似于hashlib的接口

>>> import fsverity_hash
>>> m = fsverity_hash.FSVerityHash()
>>> m.update(b"Nobody inspects the spammish repetition")
>>> m.digest()
b'>\xd6s\xd52<\x9e\x1c`\x82\x0f td\xb0\xb8X\xa9\x0b\xa4\xff\x94\x0b\x12=\xd1kBV\x99\xce\xbe'
>>> m.hexdigest()
'3ed673d5323c9e1c60820f207464b0b858a90ba4ff940b123dd16b425699cebe'

的fsverity digest命令产生相同的摘要

$ echo -n "Nobody inspects the spammish repetition" > file.txt
$ fsverity digest file.txt
sha256:3ed673d5323c9e1c60820f207464b0b858a90ba4ff940b123dd16b425699cebe file.txt

该模块公开了与fsverity digest相同的命令行接口

$ echo -n "Nobody inspects the spammish repetition" > spam.txt
$ fsverity digest spam.txt
sha256:3ed673d5323c9e1c60820f207464b0b858a90ba4ff940b123dd16b425699cebe spam.txt
$ python3 -m fsverity_hash spam.txt
sha256:3ed673d5323c9e1c60820f207464b0b858a90ba4ff940b123dd16b425699cebe spam.txt
$ python3 -m fsverity_hash --help
usage: fsverity_hash.py [-h] [--hash-alg {sha256,sha512}] [--block-size BYTES]
                        [--compact]
                        [FILE ...]

Compute fs-verity hashes

positional arguments:
  FILE                  Input file(s) to process (default: stdin)

optional arguments:
  -h, --help            show this help message and exit
  --hash-alg {sha256,sha512}
                        Merkle tree block hashing algorithm (default: sha256)
  --block-size BYTES    Merkle tree block size in bytes (default: 4096)
  --compact             Omit the hash algorithm name when printing digests

限制

• 最多可以哈希8 GiB。这是一个实现限制，而不是fs-verity哈希的一般限制。
• 未实现加盐哈希。
• 没有自动测试。
• 未测试自定义块大小。
• FSVerityHash对象不能被复制。

其他实现

• https://git.kernel.org/pub/scm/fs/fsverity/fsverity-utils.git引用libfsverity实现和fsverity命令
• https://github.com/rvolgers/fs-verity-rs Rust包

进一步阅读

• https://manpages.debian.org/testing/fsverity/fsverity.1.en.html
• https://linuxkernel.org.cn/doc/html/v6.1/filesystems/fsverity.html