crypto.sha256

def sha256(bytes: Sequence[int]) -> List[int]

from fune.crypto.sha256 import sha256  # crypto.sha256@^1

import builtins
import hashlib
from typing import List, Sequence


def sha256(bytes: Sequence[int]) -> List[int]:
    """The SHA-256 digest of a byte string (FIPS 180-4), from hashlib.

    A Python ``bytes`` value is accepted as is; a list must hold integers
    0-255, checked here so a bad value fails with the same words as in
    TypeScript and Rust rather than hashlib's own.
    """
    if isinstance(bytes, (str, dict)) or not hasattr(bytes, "__len__"):
        raise TypeError("bytes must be a list of integers from 0 to 255")
    for b in bytes:
        if type(b) is not int or b < 0 or b > 255:
            raise ValueError("bytes must be a list of integers from 0 to 255")
    return list(hashlib.sha256(builtins.bytes(bytes)).digest())

Install

fune build

With that line in your source, in a Python project (language python in fune.project), fune build resolves it and nothing else, pins them in fune.lock, downloads only the Python package of each, and builds the code above into your project’s .fune/build, one readable file per capability with a header linking back here. Or pin a range in fune.project and build in one step:

fune add crypto.sha256

The manifest, vectors and README with only the Python implementation. Install it without the registry with fune add ./crypto.sha256-1.0.0-python.fune, or fetch it from a terminal with fune pull crypto.sha256@1.0.0:python.

The whole function, every language, is one file too: crypto.sha256-1.0.0.fune, 17,379 bytes, sha256 beb0733f73c235f9276b554934618e517a26461d4bf4350f5465f14bfd89c645. It installs into a project of any language.

# fune: before crypto.sha256

# fune: after crypto.sha256

# fune: step crypto.sha256 after <n|label>

More from the author

The TypeScript implementation is plain code with no `node:crypto` and no `crypto.subtle`, so it runs unchanged in a browser, in Node and in a worker, synchronously (`crypto.subtle.digest` is asynchronous and only exists in secure contexts). The Python implementation uses the standard library's `hashlib`, and the Rust one is written out with the standard library only. All three are checked against the same vectors.

A hash is not a password hash: a single SHA-256 of a password can be guessed billions of times a second. Store passwords with `auth.password-hash`, which uses PBKDF2 with a salt and many iterations. A hash is not a MAC either: to prove a message came from someone holding a key, use `crypto.hmac-sha256` (prefixing the key and hashing is open to length extension).

The digests in the vectors are the published ones: "abc" and the 448-bit message from the NIST example values for FIPS 180-4 (SHA256.pdf), the empty string, the pangram, and messages of 55, 56, 64 and 119 bytes, which sit on either side of the points where the padding needs a second block.

Source: FIPS 180-4, Secure Hash Standard, section 6.2 (https://csrc.nist.gov/pubs/fips/180-4/upd1/final) and the NIST cryptographic standards example values (https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values).

Files