D-003 How is a SHA-256 hash written, and does the value name its algorithm?

What the schemas do

64 lowercase hexadecimal characters. The field name, sha256, names the algorithm.

Options

• bare-hex Chosen

  64 lowercase hexadecimal characters. The field name, sha256, names the algorithm.

• prefixed

  sha256: followed by 64 lowercase hexadecimal characters, as the initial conventions § 9 wrote it.

• base64

  The 32 hash bytes in base64, as Subresource Integrity writes them.

Why

The specification names the field sha256, so a prefix in the value would repeat the algorithm, and a value with another prefix would contradict the field name. Lowercase hex is what sha256sum, git, and most tools print, and allowing one case gives each hash one spelling, so equal hashes compare equal as strings. The initial conventions' sha256: prefix predates the field name. If another algorithm is ever needed, a new field names it.

What we ask the specification to state

State the encoding of sha256 values: 64 lowercase hexadecimal characters of the SHA-256 of the exact bytes the URL returns.

The specification lines it rests on

Each line is quoted as the record pins it. Expand an item to read the quote.

With the open PRs

• § 5.8, the terms_ref row L333 in #75

  terms_ref | Object | seller-set | OPTIONAL; REQUIRED when terms_acceptance_required is true. { url, sha256, version }: the legal terms or IO template the buyer accepts at assent. Hash-pinned, so assent (§ 4.1) binds to an exact document

Examples that disagree with the text

What it shapes

With the open PRs: Digest, LineItem.terms_ref