Merge pull request #6082 from libgit2/ethomson/oid

hash: separate hashes and git_oid

28 files changed, 143 insertions, 114 deletions

diff --git a/fuzzers/commit_graph_fuzzer.c b/fuzzers/commit_graph_fuzzer.c
index b41816ed9..39b520882 100644
--- a/fuzzers/commit_graph_fuzzer.c
+++ b/fuzzers/commit_graph_fuzzer.c
@@ -34,6 +34,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 	git_commit_graph_file file = {{0}};
 	git_commit_graph_entry e;
 	git_buf commit_graph_buf = GIT_BUF_INIT;
+	unsigned char hash[GIT_HASH_SHA1_SIZE];
 	git_oid oid = {{0}};
 	bool append_hash = false;
 
@@ -50,14 +51,16 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 	size -= 4;
 
 	if (append_hash) {
-		if (git_buf_init(&commit_graph_buf, size + sizeof(oid)) < 0)
+		if (git_buf_init(&commit_graph_buf, size + GIT_HASH_SHA1_SIZE) < 0)
 			goto cleanup;
-		if (git_hash_buf(&oid, data, size) < 0) {
+		if (git_hash_buf(hash, data, size, GIT_HASH_ALGORITHM_SHA1) < 0) {
 			fprintf(stderr, "Failed to compute the SHA1 hash\n");
 			abort();
 		}
 		memcpy(commit_graph_buf.ptr, data, size);
-		memcpy(commit_graph_buf.ptr + size, &oid, sizeof(oid));
+		memcpy(commit_graph_buf.ptr + size, hash, GIT_HASH_SHA1_SIZE);
+
+		memcpy(oid.id, hash, GIT_OID_RAWSZ);
 	} else {
 		git_buf_attach_notowned(&commit_graph_buf, (char *)data, size);
 	}
diff --git a/fuzzers/midx_fuzzer.c b/fuzzers/midx_fuzzer.c
index e67873faa..9739f0a40 100644
--- a/fuzzers/midx_fuzzer.c
+++ b/fuzzers/midx_fuzzer.c
@@ -34,6 +34,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 	git_midx_file idx = {{0}};
 	git_midx_entry e;
 	git_buf midx_buf = GIT_BUF_INIT;
+	unsigned char hash[GIT_HASH_SHA1_SIZE];
 	git_oid oid = {{0}};
 	bool append_hash = false;
 
@@ -50,14 +51,16 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 	size -= 4;
 
 	if (append_hash) {
-		if (git_buf_init(&midx_buf, size + sizeof(oid)) < 0)
+		if (git_buf_init(&midx_buf, size + GIT_HASH_SHA1_SIZE) < 0)
 			goto cleanup;
-		if (git_hash_buf(&oid, data, size) < 0) {
+		if (git_hash_buf(hash, data, size, GIT_HASH_ALGORITHM_SHA1) < 0) {
 			fprintf(stderr, "Failed to compute the SHA1 hash\n");
 			abort();
 		}
 		memcpy(midx_buf.ptr, data, size);
-		memcpy(midx_buf.ptr + size, &oid, sizeof(oid));
+		memcpy(midx_buf.ptr + size, hash, GIT_HASH_SHA1_SIZE);
+
+		memcpy(oid.id, hash, GIT_OID_RAWSZ);
 	} else {
 		git_buf_attach_notowned(&midx_buf, (char *)data, size);
 	}
diff --git a/src/commit_graph.c b/src/commit_graph.c
index f663fc5d3..df760b5f8 100644
--- a/src/commit_graph.c
+++ b/src/commit_graph.c
@@ -230,7 +230,7 @@ int git_commit_graph_file_parse(
 		return commit_graph_error("wrong commit-graph size");
 	git_oid_cpy(&file->checksum, (git_oid *)(data + trailer_offset));
 
-	if (git_hash_buf(&cgraph_checksum, data, (size_t)trailer_offset) < 0)
+	if (git_hash_buf(cgraph_checksum.id, data, (size_t)trailer_offset, GIT_HASH_ALGORITHM_SHA1) < 0)
 		return commit_graph_error("could not calculate signature");
 	if (!git_oid_equal(&cgraph_checksum, &file->checksum))
 		return commit_graph_error("index signature mismatch");
@@ -986,7 +986,7 @@ static int commit_graph_write(
 	hash_cb_data.cb_data = cb_data;
 	hash_cb_data.ctx = &ctx;
 
-	error = git_hash_ctx_init(&ctx);
+	error = git_hash_ctx_init(&ctx, GIT_HASH_ALGORITHM_SHA1);
 	if (error < 0)
 		return error;
 	cb_data = &hash_cb_data;
@@ -1132,7 +1132,7 @@ static int commit_graph_write(
 		goto cleanup;
 
 	/* Finalize the checksum and write the trailer. */
-	error = git_hash_final(&cgraph_checksum, &ctx);
+	error = git_hash_final(cgraph_checksum.id, &ctx);
 	if (error < 0)
 		goto cleanup;
 	error = write_cb((const char *)&cgraph_checksum, sizeof(cgraph_checksum), cb_data);
diff --git a/src/config_file.c b/src/config_file.c
index 3588e6be6..2f83a4070 100644
--- a/src/config_file.c
+++ b/src/config_file.c
@@ -144,7 +144,7 @@ static int config_file_is_modified(int *modified, config_file *file)
 	if ((error = git_futils_readbuffer(&buf, file->path)) < 0)
 		goto out;
 
-	if ((error = git_hash_buf(&hash, buf.ptr, buf.size)) < 0)
+	if ((error = git_hash_buf(hash.id, buf.ptr, buf.size, GIT_HASH_ALGORITHM_SHA1)) < 0)
 		goto out;
 
 	if (!git_oid_equal(&hash, &file->checksum)) {
@@ -869,7 +869,7 @@ static int config_file_read(
 		goto out;
 
 	git_futils_filestamp_set_from_stat(&file->stamp, &st);
-	if ((error = git_hash_buf(&file->checksum, contents.ptr, contents.size)) < 0)
+	if ((error = git_hash_buf(file->checksum.id, contents.ptr, contents.size, GIT_HASH_ALGORITHM_SHA1)) < 0)
 		goto out;
 
 	if ((error = config_file_read_buffer(entries, repo, file, level, depth,
diff --git a/src/diff.c b/src/diff.c
index 30b9f647a..44b67ee06 100644
--- a/src/diff.c
+++ b/src/diff.c
@@ -269,7 +269,7 @@ static int flush_hunk(git_oid *result, git_hash_ctx *ctx)
 	unsigned short carry = 0;
 	int error, i;
 
-	if ((error = git_hash_final(&hash, ctx)) < 0 ||
+	if ((error = git_hash_final(hash.id, ctx)) < 0 ||
 	    (error = git_hash_init(ctx)) < 0)
 		return error;
 
@@ -352,7 +352,7 @@ int git_diff_patchid(git_oid *out, git_diff *diff, git_diff_patchid_options *opt
 
 	memset(&args, 0, sizeof(args));
 	args.first_file = 1;
-	if ((error = git_hash_ctx_init(&args.ctx)) < 0)
+	if ((error = git_hash_ctx_init(&args.ctx, GIT_HASH_ALGORITHM_SHA1)) < 0)
 		goto out;
 
 	if ((error = git_diff_print(diff,
diff --git a/src/filebuf.c b/src/filebuf.c
index a3f6b1483..4296b2226 100644
--- a/src/filebuf.c
+++ b/src/filebuf.c
@@ -305,7 +305,7 @@ int git_filebuf_open_withsize(git_filebuf *file, const char *path, int flags, mo
 	if (flags & GIT_FILEBUF_HASH_CONTENTS) {
 		file->compute_digest = 1;
 
-		if (git_hash_ctx_init(&file->digest) < 0)
+		if (git_hash_ctx_init(&file->digest, GIT_HASH_ALGORITHM_SHA1) < 0)
 			goto cleanup;
 	}
 
@@ -397,7 +397,7 @@ int git_filebuf_hash(git_oid *oid, git_filebuf *file)
 	if (verify_last_error(file) < 0)
 		return -1;
 
-	git_hash_final(oid, &file->digest);
+	git_hash_final(oid->id, &file->digest);
 	git_hash_ctx_cleanup(&file->digest);
 	file->compute_digest = 0;
 
diff --git a/src/futils.c b/src/futils.c
index a44820875..d28b231ce 100644
--- a/src/futils.c
+++ b/src/futils.c
@@ -177,13 +177,16 @@ int git_futils_readbuffer_fd(git_buf *buf, git_file fd, size_t len)
 }
 
 int git_futils_readbuffer_updated(
-	git_buf *out, const char *path, git_oid *checksum, int *updated)
+	git_buf *out,
+	const char *path,
+	unsigned char checksum[GIT_HASH_SHA1_SIZE],
+	int *updated)
 {
 	int error;
 	git_file fd;
 	struct stat st;
 	git_buf buf = GIT_BUF_INIT;
-	git_oid checksum_new;
+	unsigned char checksum_new[GIT_HASH_SHA1_SIZE];
 
 	GIT_ASSERT_ARG(out);
 	GIT_ASSERT_ARG(path && *path);
@@ -216,7 +219,7 @@ int git_futils_readbuffer_updated(
 	p_close(fd);
 
 	if (checksum) {
-		if ((error = git_hash_buf(&checksum_new, buf.ptr, buf.size)) < 0) {
+		if ((error = git_hash_buf(checksum_new, buf.ptr, buf.size, GIT_HASH_ALGORITHM_SHA1)) < 0) {
 			git_buf_dispose(&buf);
 			return error;
 		}
@@ -224,7 +227,7 @@ int git_futils_readbuffer_updated(
 		/*
 		 * If we were given a checksum, we only want to use it if it's different
 		 */
-		if (!git_oid__cmp(checksum, &checksum_new)) {
+		if (!memcmp(checksum, checksum_new, GIT_HASH_SHA1_SIZE)) {
 			git_buf_dispose(&buf);
 			if (updated)
 				*updated = 0;
@@ -232,7 +235,7 @@ int git_futils_readbuffer_updated(
 			return 0;
 		}
 
-		git_oid_cpy(checksum, &checksum_new);
+		memcpy(checksum, checksum_new, GIT_HASH_SHA1_SIZE);
 	}
 
 	/*
diff --git a/src/futils.h b/src/futils.h
index 58936125a..373cc3042 100644
--- a/src/futils.h
+++ b/src/futils.h
@@ -14,7 +14,7 @@
 #include "path.h"
 #include "pool.h"
 #include "strmap.h"
-#include "oid.h"
+#include "hash.h"
 
 /**
  * Filebuffer methods
@@ -23,7 +23,10 @@
  */
 extern int git_futils_readbuffer(git_buf *obj, const char *path);
 extern int git_futils_readbuffer_updated(
-	git_buf *obj, const char *path, git_oid *checksum, int *updated);
+	git_buf *obj,
+	const char *path,
+	unsigned char checksum[GIT_HASH_SHA1_SIZE],
+	int *updated);
 extern int git_futils_readbuffer_fd(git_buf *obj, git_file fd, size_t len);
 
 /* Additional constants for `git_futils_writebuffer`'s `open_flags`.  We
diff --git a/src/hash.c b/src/hash.c
index 5a7278e42..222eadf40 100644
--- a/src/hash.c
+++ b/src/hash.c
@@ -12,71 +12,83 @@ int git_hash_global_init(void)
 	return git_hash_sha1_global_init();
 }
 
-int git_hash_ctx_init(git_hash_ctx *ctx)
+int git_hash_ctx_init(git_hash_ctx *ctx, git_hash_algorithm_t algorithm)
 {
 	int error;
 
-	if ((error = git_hash_sha1_ctx_init(&ctx->ctx.sha1)) < 0)
-		return error;
-
-	ctx->algo = GIT_HASH_ALGO_SHA1;
+	switch (algorithm) {
+	case GIT_HASH_ALGORITHM_SHA1:
+		error = git_hash_sha1_ctx_init(&ctx->ctx.sha1);
+		break;
+	default:
+		git_error_set(GIT_ERROR_INTERNAL, "unknown hash algorithm");
+		error = -1;
+	}
 
-	return 0;
+	ctx->algorithm = algorithm;
+	return error;
 }
 
 void git_hash_ctx_cleanup(git_hash_ctx *ctx)
 {
-	switch (ctx->algo) {
-		case GIT_HASH_ALGO_SHA1:
-			git_hash_sha1_ctx_cleanup(&ctx->ctx.sha1);
-			return;
-		default:
-			/* unreachable */ ;
+	switch (ctx->algorithm) {
+	case GIT_HASH_ALGORITHM_SHA1:
+		git_hash_sha1_ctx_cleanup(&ctx->ctx.sha1);
+		return;
+	default:
+		/* unreachable */ ;
 	}
 }
 
 int git_hash_init(git_hash_ctx *ctx)
 {
-	switch (ctx->algo) {
-		case GIT_HASH_ALGO_SHA1:
-			return git_hash_sha1_init(&ctx->ctx.sha1);
-		default:
-			/* unreachable */ ;
+	switch (ctx->algorithm) {
+	case GIT_HASH_ALGORITHM_SHA1:
+		return git_hash_sha1_init(&ctx->ctx.sha1);
+	default:
+		/* unreachable */ ;
 	}
-	GIT_ASSERT(0);
+
+	git_error_set(GIT_ERROR_INTERNAL, "unknown hash algorithm");
 	return -1;
 }
 
 int git_hash_update(git_hash_ctx *ctx, const void *data, size_t len)
 {
-	switch (ctx->algo) {
-		case GIT_HASH_ALGO_SHA1:
-			return git_hash_sha1_update(&ctx->ctx.sha1, data, len);
-		default:
-			/* unreachable */ ;
+	switch (ctx->algorithm) {
+	case GIT_HASH_ALGORITHM_SHA1:
+		return git_hash_sha1_update(&ctx->ctx.sha1, data, len);
+	default:
+		/* unreachable */ ;
 	}
-	GIT_ASSERT(0);
+
+	git_error_set(GIT_ERROR_INTERNAL, "unknown hash algorithm");
 	return -1;
 }
 
-int git_hash_final(git_oid *out, git_hash_ctx *ctx)
+int git_hash_final(unsigned char *out, git_hash_ctx *ctx)
 {
-	switch (ctx->algo) {
-		case GIT_HASH_ALGO_SHA1:
-			return git_hash_sha1_final(out, &ctx->ctx.sha1);
-		default:
-			/* unreachable */ ;
+	switch (ctx->algorithm) {
+	case GIT_HASH_ALGORITHM_SHA1:
+		return git_hash_sha1_final(out, &ctx->ctx.sha1);
+	default:
+		/* unreachable */ ;
 	}
-	GIT_ASSERT(0);
+
+	git_error_set(GIT_ERROR_INTERNAL, "unknown hash algorithm");
 	return -1;
 }
 
-int git_hash_buf(git_oid *out, const void *data, size_t len)
+int git_hash_buf(
+	unsigned char *out,
+	const void *data,
+	size_t len,
+	git_hash_algorithm_t algorithm)
 {
 	git_hash_ctx ctx;
 	int error = 0;
 
-	if (git_hash_ctx_init(&ctx) < 0)
+	if (git_hash_ctx_init(&ctx, algorithm) < 0)
 		return -1;
 
 	if ((error = git_hash_update(&ctx, data, len)) >= 0)
@@ -87,13 +99,17 @@ int git_hash_buf(git_oid *out, const void *data, size_t len)
 	return error;
 }
 
-int git_hash_vec(git_oid *out, git_buf_vec *vec, size_t n)
+int git_hash_vec(
+	unsigned char *out,
+	git_buf_vec *vec,
+	size_t n,
+	git_hash_algorithm_t algorithm)
 {
 	git_hash_ctx ctx;
 	size_t i;
 	int error = 0;
 
-	if (git_hash_ctx_init(&ctx) < 0)
+	if (git_hash_ctx_init(&ctx, algorithm) < 0)
 		return -1;
 
 	for (i = 0; i < n; i++) {
diff --git a/src/hash.h b/src/hash.h
index 87305cc79..ec91fa43a 100644
--- a/src/hash.h
+++ b/src/hash.h
@@ -11,6 +11,7 @@
 #include "common.h"
 
 #include "git2/oid.h"
+#include "hash/sha1.h"
 
 typedef struct {
 	void *data;
@@ -18,29 +19,27 @@ typedef struct {
 } git_buf_vec;
 
 typedef enum {
-	GIT_HASH_ALGO_UNKNOWN = 0,
-	GIT_HASH_ALGO_SHA1,
-} git_hash_algo_t;
-
-#include "hash/sha1.h"
+	GIT_HASH_ALGORITHM_NONE = 0,
+	GIT_HASH_ALGORITHM_SHA1
+} git_hash_algorithm_t;
 
 typedef struct git_hash_ctx {
 	union {
 		git_hash_sha1_ctx sha1;
 	} ctx;
-	git_hash_algo_t algo;
+	git_hash_algorithm_t algorithm;
 } git_hash_ctx;
 
 int git_hash_global_init(void);
 
-int git_hash_ctx_init(git_hash_ctx *ctx);
+int git_hash_ctx_init(git_hash_ctx *ctx, git_hash_algorithm_t algorithm);
 void git_hash_ctx_cleanup(git_hash_ctx *ctx);
 
 int git_hash_init(git_hash_ctx *c);
 int git_hash_update(git_hash_ctx *c, const void *data, size_t len);
-int git_hash_final(git_oid *out, git_hash_ctx *c);
+int git_hash_final(unsigned char *out, git_hash_ctx *c);
 
-int git_hash_buf(git_oid *out, const void *data, size_t len);
-int git_hash_vec(git_oid *out, git_buf_vec *vec, size_t n);
+int git_hash_buf(unsigned char *out, const void *data, size_t len, git_hash_algorithm_t algorithm);
+int git_hash_vec(unsigned char *out, git_buf_vec *vec, size_t n, git_hash_algorithm_t algorithm);
 
 #endif
diff --git a/src/hash/sha1.h b/src/hash/sha1.h
index fb8d62f80..4b4dae3f8 100644
--- a/src/hash/sha1.h
+++ b/src/hash/sha1.h
@@ -26,6 +26,8 @@ typedef struct git_hash_sha1_ctx git_hash_sha1_ctx;
 # include "sha1/generic.h"
 #endif
 
+#define GIT_HASH_SHA1_SIZE 20
+
 int git_hash_sha1_global_init(void);
 
 int git_hash_sha1_ctx_init(git_hash_sha1_ctx *ctx);
@@ -33,6 +35,6 @@ void git_hash_sha1_ctx_cleanup(git_hash_sha1_ctx *ctx);
 
 int git_hash_sha1_init(git_hash_sha1_ctx *c);
 int git_hash_sha1_update(git_hash_sha1_ctx *c, const void *data, size_t len);
-int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *c);
+int git_hash_sha1_final(unsigned char *out, git_hash_sha1_ctx *c);
 
 #endif
diff --git a/src/hash/sha1/collisiondetect.c b/src/hash/sha1/collisiondetect.c
index 722ebf36f..ec7059c4c 100644
--- a/src/hash/sha1/collisiondetect.c
+++ b/src/hash/sha1/collisiondetect.c
@@ -36,10 +36,10 @@ int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *data, size_t len)
 	return 0;
 }
 
-int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
+int git_hash_sha1_final(unsigned char *out, git_hash_sha1_ctx *ctx)
 {
 	GIT_ASSERT_ARG(ctx);
-	if (SHA1DCFinal(out->id, &ctx->c)) {
+	if (SHA1DCFinal(out, &ctx->c)) {
 		git_error_set(GIT_ERROR_SHA1, "SHA1 collision attack detected");
 		return -1;
 	}
diff --git a/src/hash/sha1/common_crypto.c b/src/hash/sha1/common_crypto.c
index 4250e0b61..9d608f449 100644
--- a/src/hash/sha1/common_crypto.c
+++ b/src/hash/sha1/common_crypto.c
@@ -49,9 +49,9 @@ int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *_data, size_t len)
 	return 0;
 }
 
-int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
+int git_hash_sha1_final(unsigned char *out, git_hash_sha1_ctx *ctx)
 {
 	GIT_ASSERT_ARG(ctx);
-	CC_SHA1_Final(out->id, &ctx->c);
+	CC_SHA1_Final(out, &ctx->c);
 	return 0;
 }
diff --git a/src/hash/sha1/generic.c b/src/hash/sha1/generic.c
index 607fe3a43..85b34c578 100644
--- a/src/hash/sha1/generic.c
+++ b/src/hash/sha1/generic.c
@@ -278,7 +278,7 @@ int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *data, size_t len)
 	return 0;
 }
 
-int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
+int git_hash_sha1_final(unsigned char *out, git_hash_sha1_ctx *ctx)
 {
 	static const unsigned char pad[64] = { 0x80 };
 	unsigned int padlen[2];
@@ -294,7 +294,7 @@ int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
 
 	/* Output hash */
 	for (i = 0; i < 5; i++)
-		put_be32(out->id + i*4, ctx->H[i]);
+		put_be32(out + i*4, ctx->H[i]);
 
 	return 0;
 }
diff --git a/src/hash/sha1/mbedtls.c b/src/hash/sha1/mbedtls.c
index 04e7da5fa..56016bec8 100644
--- a/src/hash/sha1/mbedtls.c
+++ b/src/hash/sha1/mbedtls.c
@@ -38,9 +38,9 @@ int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *data, size_t len)
 	return 0;
 }
 
-int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
+int git_hash_sha1_final(unsigned char *out, git_hash_sha1_ctx *ctx)
 {
 	GIT_ASSERT_ARG(ctx);
-	mbedtls_sha1_finish(&ctx->c, out->id);
+	mbedtls_sha1_finish(&ctx->c, out);
 	return 0;
 }
diff --git a/src/hash/sha1/openssl.c b/src/hash/sha1/openssl.c
index 68d9611d4..64bf99b3c 100644
--- a/src/hash/sha1/openssl.c
+++ b/src/hash/sha1/openssl.c
@@ -46,11 +46,11 @@ int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *data, size_t len)
 	return 0;
 }
 
-int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
+int git_hash_sha1_final(unsigned char *out, git_hash_sha1_ctx *ctx)
 {
 	GIT_ASSERT_ARG(ctx);
 
-	if (SHA1_Final(out->id, &ctx->c) != 1) {
+	if (SHA1_Final(out, &ctx->c) != 1) {
 		git_error_set(GIT_ERROR_SHA1, "hash_openssl: failed to finalize hash");
 		return -1;
 	}
diff --git a/src/hash/sha1/win32.c b/src/hash/sha1/win32.c
index a6e7061c6..b89dfbad8 100644
--- a/src/hash/sha1/win32.c
+++ b/src/hash/sha1/win32.c
@@ -181,14 +181,14 @@ GIT_INLINE(int) hash_cryptoapi_update(git_hash_sha1_ctx *ctx, const void *_data,
 	return 0;
 }
 
-GIT_INLINE(int) hash_cryptoapi_final(git_oid *out, git_hash_sha1_ctx *ctx)
+GIT_INLINE(int) hash_cryptoapi_final(unsigned char *out, git_hash_sha1_ctx *ctx)
 {
-	DWORD len = 20;
+	DWORD len = GIT_HASH_SHA1_SIZE;
 	int error = 0;
 
 	GIT_ASSERT(ctx->ctx.cryptoapi.valid);
 
-	if (!CryptGetHashParam(ctx->ctx.cryptoapi.hash_handle, HP_HASHVAL, out->id, &len, 0)) {
+	if (!CryptGetHashParam(ctx->ctx.cryptoapi.hash_handle, HP_HASHVAL, out, &len, 0)) {
 		git_error_set(GIT_ERROR_OS, "legacy hash data could not be finished");
 		error = -1;
 	}
@@ -262,9 +262,9 @@ GIT_INLINE(int) hash_cng_update(git_hash_sha1_ctx *ctx, const void *_data, size_
 	return 0;
 }
 
-GIT_INLINE(int) hash_cng_final(git_oid *out, git_hash_sha1_ctx *ctx)
+GIT_INLINE(int) hash_cng_final(unsigned char *out, git_hash_sha1_ctx *ctx)
 {
-	if (ctx->prov->prov.cng.finish_hash(ctx->ctx.cng.hash_handle, out->id, GIT_OID_RAWSZ, 0) < 0) {
+	if (ctx->prov->prov.cng.finish_hash(ctx->ctx.cng.hash_handle, out, GIT_HASH_SHA1_SIZE, 0) < 0) {
 		git_error_set(GIT_ERROR_OS, "hash could not be finished");
 		return -1;
 	}
@@ -315,7 +315,7 @@ int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *data, size_t len)
 	return (ctx->type == CNG) ? hash_cng_update(ctx, data, len) : hash_cryptoapi_update(ctx, data, len);
 }
 
-int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
+int git_hash_sha1_final(unsigned char *out, git_hash_sha1_ctx *ctx)
 {
 	GIT_ASSERT_ARG(ctx);
 	GIT_ASSERT_ARG(ctx->type);
diff --git a/src/index.c b/src/index.c
index 5c3305170..2e24fff69 100644
--- a/src/index.c
+++ b/src/index.c
@@ -2648,7 +2648,7 @@ static int parse_index(git_index *index, const char *buffer, size_t buffer_size)
 
 	/* Precalculate the SHA1 of the files's contents -- we'll match it to
 	 * the provided SHA1 in the footer */
-	git_hash_buf(&checksum_calculated, buffer, buffer_size - INDEX_FOOTER_SIZE);
+	git_hash_buf(checksum_calculated.id, buffer, buffer_size - INDEX_FOOTER_SIZE, GIT_HASH_ALGORITHM_SHA1);
 
 	/* Parse header */
 	if ((error = read_header(&header, buffer)) < 0)
diff --git a/src/indexer.c b/src/indexer.c
index ce7737500..16ed7bfae 100644
--- a/src/indexer.c
+++ b/src/indexer.c
@@ -152,8 +152,8 @@ int git_indexer_new(
 	idx->mode = mode ? mode : GIT_PACK_FILE_MODE;
 	git_buf_init(&idx->entry_data, 0);
 
-	if ((error = git_hash_ctx_init(&idx->hash_ctx)) < 0 ||
-	    (error = git_hash_ctx_init(&idx->trailer)) < 0 ||
+	if ((error = git_hash_ctx_init(&idx->hash_ctx, GIT_HASH_ALGORITHM_SHA1)) < 0 ||
+	    (error = git_hash_ctx_init(&idx->trailer, GIT_HASH_ALGORITHM_SHA1)) < 0 ||
 	    (error = git_oidmap_new(&idx->expected_oids)) < 0)
 		goto cleanup;
 
@@ -426,7 +426,7 @@ static int store_object(git_indexer *idx)
 	pentry = git__calloc(1, sizeof(struct git_pack_entry));
 	GIT_ERROR_CHECK_ALLOC(pentry);
 
-	if (git_hash_final(&oid, &idx->hash_ctx)) {
+	if (git_hash_final(oid.id, &idx->hash_ctx)) {
 		git__free(pentry);
 		goto on_error;
 	}
@@ -1183,7 +1183,7 @@ int git_indexer_commit(git_indexer *idx, git_indexer_progress *stats)
 	git_oid_fromraw(&file_hash, packfile_trailer);
 	git_mwindow_close(&w);
 
-	git_hash_final(&trailer_hash, &idx->trailer);
+	git_hash_final(trailer_hash.id, &idx->trailer);
 	if (git_oid_cmp(&file_hash, &trailer_hash)) {
 		git_error_set(GIT_ERROR_INDEXER, "packfile trailer mismatch");
 		return -1;
@@ -1204,7 +1204,7 @@ int git_indexer_commit(git_indexer *idx, git_indexer_progress *stats)
 		if (update_header_and_rehash(idx, stats) < 0)
 			return -1;
 
-		git_hash_final(&trailer_hash, &idx->trailer);
+		git_hash_final(trailer_hash.id, &idx->trailer);
 		write_at(idx, &trailer_hash, idx->pack->mwf.size - GIT_OID_RAWSZ, GIT_OID_RAWSZ);
 	}
 
diff --git a/src/midx.c b/src/midx.c
index 6a885eddc..cd3c98cef 100644
--- a/src/midx.c
+++ b/src/midx.c
@@ -212,7 +212,7 @@ int git_midx_parse(
 		return midx_error("wrong index size");
 	git_oid_cpy(&idx->checksum, (git_oid *)(data + trailer_offset));
 
-	if (git_hash_buf(&idx_checksum, data, (size_t)trailer_offset) < 0)
+	if (git_hash_buf(idx_checksum.id, data, (size_t)trailer_offset, GIT_HASH_ALGORITHM_SHA1) < 0)
 		return midx_error("could not calculate signature");
 	if (!git_oid_equal(&idx_checksum, &idx->checksum))
 		return midx_error("index signature mismatch");
@@ -668,7 +668,7 @@ static int midx_write(
 	hash_cb_data.cb_data = cb_data;
 	hash_cb_data.ctx = &ctx;
 
-	error = git_hash_ctx_init(&ctx);
+	error = git_hash_ctx_init(&ctx, GIT_HASH_ALGORITHM_SHA1);
 	if (error < 0)
 		return error;
 	cb_data = &hash_cb_data;
@@ -819,7 +819,7 @@ static int midx_write(
 		goto cleanup;
 
 	/* Finalize the checksum and write the trailer. */
-	error = git_hash_final(&idx_checksum, &ctx);
+	error = git_hash_final(idx_checksum.id, &ctx);
 	if (error < 0)
 		goto cleanup;
 	error = write_cb((const char *)&idx_checksum, sizeof(idx_checksum), cb_data);
diff --git a/src/odb.c b/src/odb.c
index 7834e5f15..baa287348 100644
--- a/src/odb.c
+++ b/src/odb.c
@@ -136,7 +136,7 @@ int git_odb__hashobj(git_oid *id, git_rawobj *obj)
 	vec[1].data = obj->data;
 	vec[1].len = obj->len;
 
-	return git_hash_vec(id, vec, 2);
+	return git_hash_vec(id->id, vec, 2, GIT_HASH_ALGORITHM_SHA1);
 }
 
 
@@ -210,7 +210,7 @@ int git_odb__hashfd(git_oid *out, git_file fd, size_t size, git_object_t type)
 		return -1;
 	}
 
-	if ((error = git_hash_ctx_init(&ctx)) < 0)
+	if ((error = git_hash_ctx_init(&ctx, GIT_HASH_ALGORITHM_SHA1)) < 0)
 		return error;
 
 	if ((error = git_odb__format_object_header(&hdr_len, hdr,
@@ -237,7 +237,7 @@ int git_odb__hashfd(git_oid *out, git_file fd, size_t size, git_object_t type)
 		goto done;
 	}
 
-	error = git_hash_final(out, &ctx);
+	error = git_hash_final(out->id, &ctx);
 
 done:
 	git_hash_ctx_cleanup(&ctx);
@@ -1561,7 +1561,7 @@ int git_odb_open_wstream(
 	ctx = git__malloc(sizeof(git_hash_ctx));
 	GIT_ERROR_CHECK_ALLOC(ctx);
 
-	if ((error = git_hash_ctx_init(ctx)) < 0 ||
+	if ((error = git_hash_ctx_init(ctx, GIT_HASH_ALGORITHM_SHA1)) < 0 ||
 		(error = hash_header(ctx, size, type)) < 0)
 		goto done;
 
@@ -1607,7 +1607,7 @@ int git_odb_stream_finalize_write(git_oid *out, git_odb_stream *stream)
 		return git_odb_stream__invalid_length(stream,
 			"stream_finalize_write()");
 
-	git_hash_final(out, stream->hash_ctx);
+	git_hash_final(out->id, stream->hash_ctx);
 
 	if (git_odb__freshen(stream->backend->odb, out))
 		return 0;
diff --git a/src/odb_loose.c b/src/odb_loose.c
index b0abbbf4c..1f8a0bb21 100644
--- a/src/odb_loose.c
+++ b/src/odb_loose.c
@@ -1023,7 +1023,7 @@ static int loose_backend__readstream(
 	hash_ctx = git__malloc(sizeof(git_hash_ctx));
 	GIT_ERROR_CHECK_ALLOC(hash_ctx);
 
-	if ((error = git_hash_ctx_init(hash_ctx)) < 0 ||
+	if ((error = git_hash_ctx_init(hash_ctx, GIT_HASH_ALGORITHM_SHA1)) < 0 ||
 		(error = git_futils_mmap_ro_file(&stream->map, object_path.ptr)) < 0 ||
 		(error = git_zstream_init(&stream->zstream, GIT_ZSTREAM_INFLATE)) < 0)
 		goto done;
diff --git a/src/pack-objects.c b/src/pack-objects.c
index faff310b4..d89a4e780 100644
--- a/src/pack-objects.c
+++ b/src/pack-objects.c
@@ -141,7 +141,7 @@ int git_packbuilder_new(git_packbuilder **out, git_repository *repo)
 	pb->repo = repo;
 	pb->nr_threads = 1; /* do not spawn any thread by default */
 
-	if (git_hash_ctx_init(&pb->ctx) < 0 ||
+	if (git_hash_ctx_init(&pb->ctx, GIT_HASH_ALGORITHM_SHA1) < 0 ||
 		git_zstream_init(&pb->zstream, GIT_ZSTREAM_DEFLATE) < 0 ||
 		git_repository_odb(&pb->odb, repo) < 0 ||
 		packbuilder_config(pb) < 0)
@@ -664,7 +664,7 @@ static int write_pack(git_packbuilder *pb,
 		pb->nr_remaining -= pb->nr_written;
 	} while (pb->nr_remaining && i < pb->nr_objects);
 
-	if ((error = git_hash_final(&entry_oid, &pb->ctx)) < 0)
+	if ((error = git_hash_final(entry_oid.id, &pb->ctx)) < 0)
 		goto done;
 
 	error = write_cb(entry_oid.id, GIT_OID_RAWSZ, cb_data);
diff --git a/tests/core/sha1.c b/tests/core/sha1.c
index 196b00352..92582d69a 100644
--- a/tests/core/sha1.c
+++ b/tests/core/sha1.c
@@ -13,7 +13,7 @@ void test_core_sha1__cleanup(void)
 	cl_fixture_cleanup(FIXTURE_DIR);
 }
 
-static int sha1_file(git_oid *oid, const char *filename)
+static int sha1_file(git_oid *out, const char *filename)
 {
 	git_hash_ctx ctx;
 	char buf[2048];
@@ -23,7 +23,7 @@ static int sha1_file(git_oid *oid, const char *filename)
 	fd = p_open(filename, O_RDONLY);
 	cl_assert(fd >= 0);
 
-	cl_git_pass(git_hash_ctx_init(&ctx));
+	cl_git_pass(git_hash_ctx_init(&ctx, GIT_HASH_ALGORITHM_SHA1));
 
 	while ((read_len = p_read(fd, buf, 2048)) > 0)
 		cl_git_pass(git_hash_update(&ctx, buf, (size_t)read_len));
@@ -31,7 +31,7 @@ static int sha1_file(git_oid *oid, const char *filename)
 	cl_assert_equal_i(0, read_len);
 	p_close(fd);
 
-	ret = git_hash_final(oid, &ctx);
+	ret = git_hash_final(out->id, &ctx);
 	git_hash_ctx_cleanup(&ctx);
 
 	return ret;
diff --git a/tests/object/raw/hash.c b/tests/object/raw/hash.c
index 830f1caa1..3be1f83b3 100644
--- a/tests/object/raw/hash.c
+++ b/tests/object/raw/hash.c
@@ -26,18 +26,18 @@ void test_object_raw_hash__hash_by_blocks(void)
 	git_hash_ctx ctx;
 	git_oid id1, id2;
 
-	cl_git_pass(git_hash_ctx_init(&ctx));
+	cl_git_pass(git_hash_ctx_init(&ctx, GIT_HASH_ALGORITHM_SHA1));
 
 	/* should already be init'd */
 	cl_git_pass(git_hash_update(&ctx, hello_text, strlen(hello_text)));
-	cl_git_pass(git_hash_final(&id2, &ctx));
+	cl_git_pass(git_hash_final(id2.id, &ctx));
 	cl_git_pass(git_oid_fromstr(&id1, hello_id));
 	cl_assert(git_oid_cmp(&id1, &id2) == 0);
 
 	/* reinit should permit reuse */
 	cl_git_pass(git_hash_init(&ctx));
 	cl_git_pass(git_hash_update(&ctx, bye_text, strlen(bye_text)));
-	cl_git_pass(git_hash_final(&id2, &ctx));
+	cl_git_pass(git_hash_final(id2.id, &ctx));
 	cl_git_pass(git_oid_fromstr(&id1, bye_id));
 	cl_assert(git_oid_cmp(&id1, &id2) == 0);
 
@@ -49,7 +49,7 @@ void test_object_raw_hash__hash_buffer_in_single_call(void)
 	git_oid id1, id2;
 
 	cl_git_pass(git_oid_fromstr(&id1, hello_id));
-	git_hash_buf(&id2, hello_text, strlen(hello_text));
+	git_hash_buf(id2.id, hello_text, strlen(hello_text), GIT_HASH_ALGORITHM_SHA1);
 	cl_assert(git_oid_cmp(&id1, &id2) == 0);
 }
 
@@ -65,7 +65,7 @@ void test_object_raw_hash__hash_vector(void)
 	vec[1].data = hello_text+4;
 	vec[1].len  = strlen(hello_text)-4;
 
-	git_hash_vec(&id2, vec, 2);
+	git_hash_vec(id2.id, vec, 2, GIT_HASH_ALGORITHM_SHA1);
 
 	cl_assert(git_oid_cmp(&id1, &id2) == 0);
 }
diff --git a/tests/object/raw/short.c b/tests/object/raw/short.c
index 813cd86b6..e8d2cf5a5 100644
--- a/tests/object/raw/short.c
+++ b/tests/object/raw/short.c
@@ -33,7 +33,7 @@ static int insert_sequential_oids(
 
 	for (i = 0; i < n; ++i) {
 		p_snprintf(numbuf, sizeof(numbuf), "%u", (unsigned int)i);
-		git_hash_buf(&oid, numbuf, strlen(numbuf));
+		git_hash_buf(oid.id, numbuf, strlen(numbuf), GIT_HASH_ALGORITHM_SHA1);
 
 		oids[i] = git__malloc(GIT_OID_HEXSZ + 1);
 		cl_assert(oids[i]);
diff --git a/tests/odb/largefiles.c b/tests/odb/largefiles.c
index 8be2cfd02..ff82291b3 100644
--- a/tests/odb/largefiles.c
+++ b/tests/odb/largefiles.c
@@ -107,7 +107,7 @@ void test_odb_largefiles__streamread(void)
 	cl_assert_equal_sz(LARGEFILE_SIZE, len);
 	cl_assert_equal_i(GIT_OBJECT_BLOB, type);
 
-	cl_git_pass(git_hash_ctx_init(&hash));
+	cl_git_pass(git_hash_ctx_init(&hash, GIT_HASH_ALGORITHM_SHA1));
 	cl_git_pass(git_odb__format_object_header(&hdr_len, hdr, sizeof(hdr), len, type));
 
 	cl_git_pass(git_hash_update(&hash, hdr, hdr_len));
@@ -119,7 +119,7 @@ void test_odb_largefiles__streamread(void)
 
 	cl_assert_equal_sz(LARGEFILE_SIZE, total);
 
-	git_hash_final(&read_oid, &hash);
+	git_hash_final(read_oid.id, &hash);
 
 	cl_assert_equal_oid(&oid, &read_oid);
 
diff --git a/tests/pack/packbuilder.c b/tests/pack/packbuilder.c
index 5f5441a5d..5d93ede06 100644
--- a/tests/pack/packbuilder.c
+++ b/tests/pack/packbuilder.c
@@ -126,9 +126,9 @@ void test_pack_packbuilder__create_pack(void)
 
 	cl_git_pass(git_futils_readbuffer(&buf, git_buf_cstr(&path)));
 
-	cl_git_pass(git_hash_ctx_init(&ctx));
+	cl_git_pass(git_hash_ctx_init(&ctx, GIT_HASH_ALGORITHM_SHA1));
 	cl_git_pass(git_hash_update(&ctx, buf.ptr, buf.size));
-	cl_git_pass(git_hash_final(&hash, &ctx));
+	cl_git_pass(git_hash_final(hash.id, &ctx));
 	git_hash_ctx_cleanup(&ctx);
 
 	git_buf_dispose(&path);