[Gudge (MGudgin)]

This PR converges the Rust workspace on sha2 0.11 and preserves SHA-256 output while avoiding per-byte String allocations.

Resolves #844

Details

• Use the workspace SHA-2 version in WSLc's build and update rust-embed-utils to 8.12, eliminating sha2 0.10 and its old hash stack from Cargo.lock.
• Add wxc_common::hashing::{sha256, sha256_hex} and encoding::lowercase_hex for policy identity, telemetry, learning-mode values, LXC chain names, and Hyperlight OCI digests.
• Encode the WSLc SDK package checksum in one preallocated buffer, and remove unused direct sha2 dependencies.

Tests

• cargo fmt --all -- --check — passed.
• cargo check --workspace --all-targets --all-features --locked --offline — passed.
• cargo clippy --workspace --all-targets --all-features --offline -- -D warnings — passed.
• cargo test --workspace --exclude wxc_host_prep --offline -- --skip base_container_helpers::tests::runtime_proxy_preserves_allowed_host_to_container_loopback — passed.
• cargo tree --workspace --target all --all-features -d --offline — passed; no duplicate sha2 versions.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot review overview

🟡 Changes recommended

The new learning-mode digest encoding adds 32 temporary allocations per overlong ETL property.

Review effort: Balanced
Findings: 1

Open (1)

• Avoid temporary String allocations for SHA-256 formatting · New

What changed in this PR

Unifies the Rust workspace on SHA-2 0.11 while preserving lowercase digest output.

Changes:

• Upgrades workspace and WSLc build dependencies.
• Updates digest formatting for SHA-2 0.11.
• Refreshes transitive dependencies and removes SHA-2 0.10.

File	Description
src/​Cargo.toml	Upgrades workspace SHA-2.
src/​Cargo.lock	Unifies resolved SHA-2 dependencies.
src/​backends/​wslc/​common/​Cargo.toml	Uses the workspace SHA-2 version.
src/​core/​mxc_engine/​src/​verbose_telemetry.rs	Preserves lowercase telemetry hashes.
src/​core/​learning_mode_platforms/​windows/​src/​extractors.rs	Preserves lowercase bounded-property hashes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Hyperlight retains incompatible LowerHex formatting, and the new encoders lack independent compatibility tests.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Replace incompatible sha2 digest hex formatting · New
• Avoid temporary String allocations for SHA-256 formatting

Previously missed (2)

In code that hasn't changed since last review

Add exact-output coverage for manual encoder markers

src/​core/​learning_mode_platforms/​windows/​src/​extractors.rs:514

The new manual encoder has no exact-output coverage: the existing bounding tests only check length and distinctness. Add a known-vector assertion for an overlong value's marker so lowercase output, two-digit zero padding, and the existing marker format are independently preserved.

Add independent known-vector digest assertion

src/​core/​mxc_engine/​src/​verbose_telemetry.rs:338

This assertion now obtains its expected digest through the same new helper used by production, so it cannot detect a case or zero-padding regression in the compatibility behavior this PR is meant to preserve. Add an independent known-vector assertion such as the standard SHA-256 of b"abc".

[Copilot]

Copilot review overview

🔵 Needs a closer look

The learning-mode hash conversion introduces avoidable per-byte allocations in an event-processing path.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Replace incompatible sha2 digest hex formatting
• Avoid temporary String allocations for SHA-256 formatting

[Jeff Whiteside (jsidewhite)]

[Copilot]

Copilot review overview

🟢 Approval recommended

The dependency graph is consolidated and existing digest representations remain covered and unchanged.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Replace incompatible sha2 digest hex formatting
• Avoid temporary String allocations for SHA-256 formatting