[hyperpolymath]

Closes the "evidence_hash hashes usize::to_le_bytes" follow-up from #247.

Problem

EvidenceAccumulator::finalize fed files_read to SHA-256 as usize::to_le_bytes. A 32-bit build hashed 4 bytes where a 64-bit build hashed 8, so the same scan produced different evidence hashes on different platforms, and a verifier on another platform couldn't recompute them.

Fix

• files_read is widened to u64 before hashing, like bytes_read and wall_clock_ms already are.
• On 64-bit platforms the hashed bytes are identical, so every existing evidence hash is unchanged. 32-bit builds now agree with them.
• The computation moves to a public attestation::evidence::evidence_hash function, so a verifier can recompute it, and the doc comment now states the encoding.

Validation

• New test evidence_hash_known_answer. The expected value comes from coreutils, not the crate:

  printf 'nonce\002\0\0\0\0\0\0\0\350\003\0\0\0\0\0\0rolling\007\0\0\0\0\0\0\0' | sha256sum
  

• cargo fmt --check, plus cargo clippy --locked --all-targets -D warnings with and without --all-features: clean.
• cargo test --locked --all-features: all suites green (lib: 524 passed).

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3c0b7399-202c-46b5-a8b2-48185c1864ab

Commits

Reviewing files that changed from the base of the PR and between 5175a68 and 7cadaa5.

Files selected for processing: 2

• CHANGELOG.adoc
• src/attestation/evidence.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T00:07:01.719302Z	7cadaa5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud