feat(hash): remove OpenSSL-backed algorithms

AGENTS.md

@@ -12,7 +12,7 @@ score/          # C++ AND Rust libraries side by side (concurrency, containers,
                 # Most components have a docs/ subfolder with requirements, architecture, detailed design, and safety analysis.
 src/            # Deprecated Bazel alias stubs. No real sources here.
 examples/       # Integration and usage examples (C++ and Rust)
-third_party/    # External dependency BUILD files (acl, openssl, libcap2, etc.)
+third_party/    # External dependency BUILD files (acl, libcap2, etc.)
 docs/           # Feature-level and module-level Sphinx docs.
 .github/        # CI workflows, CODEOWNERS, tools
 ```

MODULE.bazel

@@ -83,8 +83,6 @@ bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
 bazel_dep(name = "google_benchmark", version = "1.9.5")
 bazel_dep(name = "download_utils", version = "1.2.2")
 bazel_dep(name = "rules_cc", version = "0.2.17")
-bazel_dep(name = "openssl", version = "3.5.5.bcr.4")
-
 ## Configure the Rust toolchain
 
 bazel_dep(name = "rules_rust", version = "0.68.2-score")

docs/baselibs/components/index.rst

@@ -36,8 +36,8 @@ Overview
 - :need:`doc__flatbuffers`: FlatBuffers-Library with serialization, read access, and structural
   verification of FlatBuffers data, plus code generation via ``flatc`` for C++, Rust, and Python.
 - :need:`doc__filesystem`: Filesystem manipulation library similar to ``std::filesystem``.
-- :need:`doc__hash`: Hash calculation library supporting cryptographic (SHA-256, SHA-512) and
-  checksum (CRC-32) algorithms via a pluggable interface.
+- :need:`doc__hash`: Checksum library supporting CRC-32 and a transitional native SHA-256 implementation for
+  existing safety-integrity consumers. Cryptographic hash operations are provided by the Security Crypto feature.
 - :need:`doc__futurecpp`: Extends the C++17 Standard Library with features from newer C++ standards up to C++26,
   as well as selected proposals for the C++ Standard Library.
 - :need:`doc__safecpp`: A collection of utilities that helps developers write safer C++ code, including

score/hash/code/common/algorithms.cpp

@@ -30,18 +30,9 @@ score::cpp::optional<std::uint8_t> HashSizeInBytes(const HashAlgorithm algorithm
         case HashAlgorithm::kCrc32Autosar:
             hashSizeInBytes = kCrc32AutosarSize;
             break;
-        case HashAlgorithm::kSha1:
-            hashSizeInBytes = kSha1Size;
-            break;
         case HashAlgorithm::kSha256:
             hashSizeInBytes = kSha256Size;
             break;
-        case HashAlgorithm::kSha384:
-            hashSizeInBytes = kSha384Size;
-            break;
-        case HashAlgorithm::kSha512:
-            hashSizeInBytes = kSha512Size;
-            break;
         case HashAlgorithm::kNone:
         case HashAlgorithm::kLast:
         default:
@@ -74,18 +65,9 @@ HashAlgorithm IdentifyHash(std::string_view hash_string) noexcept
             // there's no way to distinguish between kCrc32 and kCrc32Autosar based on the bytes alone
             identifiedHash = HashAlgorithm::kCrc32;
             break;
-        case kSha1Size * 2U:
-            identifiedHash = HashAlgorithm::kSha1;
-            break;
         case kSha256Size * 2U:
             identifiedHash = HashAlgorithm::kSha256;
             break;
-        case kSha384Size * 2U:
-            identifiedHash = HashAlgorithm::kSha384;
-            break;
-        case kSha512Size * 2U:
-            identifiedHash = HashAlgorithm::kSha512;
-            break;
         default:
             break;
     }
@@ -103,18 +85,9 @@ HashAlgorithm IdentifyHash(std::size_t hash_size_in_bytes) noexcept
             // there's no way to distinguish between kCrc32 and kCrc32Autosar based on the bytes alone
             identifiedHash = HashAlgorithm::kCrc32;
             break;
-        case kSha1Size:
-            identifiedHash = HashAlgorithm::kSha1;
-            break;
         case kSha256Size:
             identifiedHash = HashAlgorithm::kSha256;
             break;
-        case kSha384Size:
-            identifiedHash = HashAlgorithm::kSha384;
-            break;
-        case kSha512Size:
-            identifiedHash = HashAlgorithm::kSha512;
-            break;
         default:
             break;
     }

score/hash/code/common/algorithms.h

@@ -25,26 +25,22 @@ namespace score
 namespace hash
 {
 
+// Retain the existing capacity to avoid changing the layout of public hash types during the algorithm migration.
 constexpr std::size_t kMaxDigestSize{64U};
 
-constexpr std::uint8_t kSha1Size{20U};
 constexpr std::uint8_t kSha256Size{32U};
-constexpr std::uint8_t kSha384Size{48U};
-constexpr std::uint8_t kSha512Size{64U};
 constexpr std::uint8_t kCrc32Size{4U};
 constexpr std::uint8_t kCrc32AutosarSize{4U};
 
-/// Cryptographic hash algorithm
+/// Hash and checksum algorithms retained for safety-integrity use cases.
 enum class HashAlgorithm : std::uint8_t
 {
     kNone = 0,
-    kSha1,
-    kSha256,
-    kSha384,
-    kSha512,
-    kCrc32,
-    kCrc32Autosar,
-    kLast
+    // Values 1, 3, and 4 are reserved for the removed SHA-1, SHA-384, and SHA-512 identifiers.
+    kSha256 = 2,
+    kCrc32 = 5,
+    kCrc32Autosar = 6,
+    kLast = 7
 };
 
 // Suppress "UNUSED C++14 A13-2-2" rule finding: "A binary arithmetic operator and a bitwise operator shall return
@@ -64,18 +60,9 @@ inline score::mw::log::LogStream& operator<<(score::mw::log::LogStream& stream,
         case HashAlgorithm::kCrc32Autosar:
             modifiedStream << "Crc32Autosar";
             break;
-        case HashAlgorithm::kSha1:
-            modifiedStream << "Sha1";
-            break;
         case HashAlgorithm::kSha256:
             modifiedStream << "Sha256";
             break;
-        case HashAlgorithm::kSha384:
-            modifiedStream << "Sha384";
-            break;
-        case HashAlgorithm::kSha512:
-            modifiedStream << "Sha512";
-            break;
         case HashAlgorithm::kNone:
             modifiedStream << "None";
             break;
@@ -93,18 +80,17 @@ inline score::mw::log::LogStream& operator<<(score::mw::log::LogStream& stream,
 score::cpp::optional<std::uint8_t> HashSizeInBytes(const HashAlgorithm algorithm) noexcept;
 score::cpp::optional<std::uint8_t> HashSizeInCharacters(const HashAlgorithm algorithm) noexcept;
 
-/// @brief identify the hash algorithm from the \p hash_string
-/// @example if input is sha1sum as string "526eac4f80dd6e6e73c7a501dff1abc83f0b7ccc" the return will be
-/// HashAlgorithm::kSha1
+/// @brief Identifies the hash algorithm from the length of \p hash_string.
+/// @example A 64-character hexadecimal digest is identified as HashAlgorithm::kSha256.
 ///
 /// @param[in] hash_string  - the hash as a string
 /// @return HashAlgorithm   - the \p hash_string algorithm type
 HashAlgorithm IdentifyHash(std::string_view hash_string) noexcept;
 
-/// @brief identify hash algorithm from \p hash_size_in_bytes, for example vector.size()
+/// @brief Identifies the hash algorithm from \p hash_size_in_bytes, for example vector.size().
 ///
-/// @param[in] hash_vector  - hash size in bytes
-/// @return HashAlgorithm   -the \p hash_size_in_bytes algorithm type
+/// @param[in] hash_size_in_bytes  - hash size in bytes
+/// @return HashAlgorithm          - the \p hash_size_in_bytes algorithm type
 HashAlgorithm IdentifyHash(std::size_t hash_size_in_bytes) noexcept;
 
 }  // namespace hash