In BootZipCopyAction
and AbstractJarWriter
SHA1 hash is calculated for stored entries requiring unpack and set as entry comment:
archiveEntry.setComment("UNPACK:" + FileUtils.sha1Hash(details.getFile()));
However the hash isn't used anywhere, just the marker prefix UNPACK:
is checked.
Dug through history and first introduction of UNPACK:
+ hash seems to have been in https://github.com/spring-projects/spring-boot/commit/f30b962ff9327d3264d519853992aff972cdbe5a
At that point the hash was extracted and used for the filename:
AsciiBytes hash = data.getComment().substring(UNPACK_MARKER.length());
...
File file = new File(getTempUnpackFolder(), hash.toString() + "-" + name);
But then later in https://github.com/spring-projects/spring-boot/commit/7e718cda265b85ad6337a0aa711906c7e1097e34 this got removed from output filename:
- AsciiBytes hash = data.getComment().substring(UNPACK_MARKER.length());
- File file = new File(getTempUnpackFolder(), hash.toString() + "-" + name);
+ File file = new File(getTempUnpackFolder(), name);
So now the hash is still being calculated and set for the entry but I don't see it being used anywhere.
Could it just be left as UNPACK:
without any hash?
The hashing reads the file completely in memory due to usage of DigestInputStream.readAllBytes()
so in the extreme case the file is fully read 3 times: once by CrcAndSize
calculation, once for the sha1 hash and once for actual copying to the ZipArchiveOutputStream