Clarify AGENTS guidance for non-security hashing#15802
Merged
sebastienros merged 2 commits intomainfrom Apr 3, 2026
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 15802Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 15802" |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates contributor/agent guidance to steer non-security hashing toward faster non-cryptographic algorithms, aligning with repository practices.
Changes:
- Add AGENTS.md guidance discouraging SHA-256 for non-security hashing.
- Recommend xxHash3 for stable non-cryptographic hashing scenarios.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Contributor
|
🎬 CLI E2E Test Recordings — 55 recordings uploaded (commit View recordings
📹 Recordings uploaded automatically from CI run #23906997468 |
joperezr
approved these changes
Apr 3, 2026
Member
joperezr
left a comment
joperezr
left a comment
There was a problem hiding this comment.
LGTM — the single line addition is accurate and well-formed. System.IO.Hashing.XxHash3 is already used in the codebase and the guidance is appropriate for steering contributors away from unnecessary cryptographic hashing overhead in non-security scenarios.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
SHA-256 is designed for adversarial resistance, not just for generating a fingerprint. When a hash is not security-related, using a cryptographic hash is often more expensive than necessary.
This updates
AGENTS.mdto tell contributors not to use cryptographic hashes such as SHA-256 for non-security scenarios and to prefer xxHash3 for stable non-cryptographic hashing instead. This helps steer implementations toward a faster, smaller, and more appropriate hash choice for cases like sharding keys, hash tables, cache keys, trusted-system deduplication, and non-security change detection.Fixes # (issue)
Checklist
<remarks />and<code />elements on your triple slash comments?aspire.devissue: