Zennoxa Shield
Rules / Go
SHIELD-GO-004

Weak cryptographic hash (SHA1)

highGoCWE-327CVSS 7.4

What it detects

SHA1 is cryptographically weak and unsuitable for security-sensitive operations.

How to fix

Use crypto/sha256 or crypto/sha512 instead of crypto/sha1.

Vulnerable — Shield flags thischecksum.go
package artifact

import (
	"crypto/sha1"
	"encoding/hex"
)

func SignManifest(manifest []byte) string {
	digest := sha1.Sum(manifest) // SHA-1 collisions are practical (SHAttered)
	return hex.EncodeToString(digest[:])
}
Fixed — scans cleanchecksum.go
package artifact

import (
	"crypto/sha256"
	"encoding/hex"
)

func SignManifest(manifest []byte) string {
	digest := sha256.Sum256(manifest)
	return hex.EncodeToString(digest[:])
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-GO-004, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-GO-004: Weak cryptographic hash (SHA1) — Zennoxa Shield