Include SHA-256 functions in Mojo::Util

[duffee]

Summary

Import SHA-256 functions from Digest::SHA into Mojo::Util

Motivation

As of v9.19, signed cookies now use HMAC-SHA-256 instead of HMAC-SHA1.
Import the equivalent SHA-256 functions into Mojo::Util in line with the current available SHA-1 functions.

I tripped over this last week while migrating a module from Mojo 8 to 9. Our test module was mocking the
signed cookie and when I reached for the updated hmac_sha256_hex function, it wasn't in Mojo::Util
and I was sad. Was just going to raise an issue and thought that a PR was just as quick and explains the change
better than I could.

References

Switch away from HMAC SHA1 for signed cookies #1790

[willsheppard]

👍

[kraih]

We don't usually add functions to Mojo::Util that are not used inside the framework for something.

[duffee]

I see that Mojolicious::Controller uses Digest::SHA::hmac_sha256_hex directly in the every_signed_cookie and signed_cookie subs and that you're planning to deprecate the old SHA1 functions. Is that a design decision to remove digest code out of Mojo core or would you find it useful to migrate the current SHA1 functions to SHA-256?

[kraih]

I think we'd rather remove those than add more. Their only use anymore is basically as methods of Mojo::ByteStream, in some limited situations. Happy to listen to counter arguments though.

[Grinnz]

I think it would be a good idea to add these from the point of view of promoting good practices by easy availability, and SHA-256 is a rather commonly used hash at this point. And if so, they should be added to Mojo::ByteStream as well.

[duffee]

I'd hate to argue against my own PR, but thinking some more, I'd actually prefer performance over convenience. The business has recently moved into the cloud where memory and runtime now have a price tag on them.

I'm not a profiling guru. If someone can determine whether monkey patching the sha-256 functions into Mojo::Util improves or hurts performance for code that uses them (as well as for code that doesn't), I would go with that. If it's better, I'll volunteer to add them to Mojo::ByteStream as well.

If it degrades performance, perhaps it's better just to expand the docs with a mention on how it's implemented and write a blog post on rolling your own signed cookies (for those who blog).

[mergify]

This pull request is now in conflicts. Could you fix it @duffee? 🙏

[mergify]

This pull request is now in conflicts. Could you fix it @duffee? 🙏

[mergify]

This pull request is now in conflicts. Could you fix it @duffee? 🙏

[kraih]

I'm afraid it looks like this PR failed to reach the required number of votes. Thank you.