Repository: neovim/neovim
File: runtime/lua/vim/secure.lua (Lua)

Code before:
        local hash, file = string.match(line, '^(%S+) (.+)$')
        if hash and file then
          trust[file] = hash
        end
      end
    end
    f:close()
  end
  return trust
end

--- Reads the given file/directory at {fullpath} and returns the
--- contents and a hash of the contents. If {fullpath} is not a directory
--- and {bufnr} is given, then contents are read from the {bufnr} buffer rather
--- than the filesytesm.
---
---@param fullpath (string) Path to a file or directory to read.
---@param bufnr (number?) The number of the buffer.
---@return string|boolean? contents the contents of the file, or true if it's a directory
---@return string? hash the hash of the contents, or "directory" if it's a directory
local function read_and_hash(fullpath, bufnr)
  local contents ---@type string|boolean?
  local hash ---@type string
  if vim.fn.isdirectory(fullpath) == 1 then
    contents = true
    hash = "directory"
  else
    if bufnr then
      local newline = vim.bo[bufnr].fileformat == 'unix' and '\n' or '\r\n'
      contents =
        table.concat(vim.api.nvim_buf_get_lines(bufnr --[[@as integer]], 0, -1, false), newline)
      if vim.bo[bufnr].endofline then
        contents = contents .. newline
      end
    else
      do
        local f = io.open(fullpath, 'r')
        if not f then
          return nil, nil
        end
        contents = f:read('*a')
        f:close()
      end

      if not contents then
        return nil, nil
      end
    end

    hash = vim.fn.sha256(contents)
  end

Review comment (security):
Seems reasonable because it's non-recursive. We could maybe key it by "modified" date and/or permissions, idk. Not a blocker.

Code after:
        local hash, file = string.match(line, '^(%S+) (.+)$')
        if hash and file then
          trust[file] = hash
        end
      end
    end
    f:close()
  end
  return trust
end

--- If {fullpath} is a file, read the contents of {fullpath} (or the contents of {bufnr}
--- if given) and returns the contents and a hash of the contents.
---
--- If {fullpath} is a directory, then nothing is read from the filesystem, and
--- `contents = true` and `hash = "directory"` is returned instead.
---
---@param fullpath (string) Path to a file or directory to read.
---@param bufnr (number?) The number of the buffer.
---@return string|boolean? contents the contents of the file, or true if it's a directory
---@return string? hash the hash of the contents, or "directory" if it's a directory
local function compute_hash(fullpath, bufnr)
  local contents ---@type string|boolean?
  local hash ---@type string
  if vim.fn.isdirectory(fullpath) == 1 then
    return true, 'directory'
  end

  if bufnr then
    local newline = vim.bo[bufnr].fileformat == 'unix' and '\n' or '\r\n'
    contents =
      table.concat(vim.api.nvim_buf_get_lines(bufnr --[[@as integer]], 0, -1, false), newline)
    if vim.bo[bufnr].endofline then
      contents = contents .. newline
    end
  else
    do
      local f = io.open(fullpath, 'r')
      if not f then
        return nil, nil
      end
      contents = f:read('*a')
      f:close()
    end

    if not contents then
      return nil, nil
    end
  end

  hash = vim.fn.sha256(contents)