From 735e930478cecd9c9bb546bc7081a5af184385aa Mon Sep 17 00:00:00 2001 From: Nick Anderson Date: Tue, 21 Jul 2026 18:25:40 -0500 Subject: [PATCH] CFE-3725: hash=>"best" resolves to SHA-512 (community) Community "best" now resolves to a single SHA-512 instead of cross-correlating MD5 and SHA1. Update the `hash` attribute description and add a History note. Enterprise already used SHA-512, so this only affects the community edition. Co-Authored-By: Claude Opus 4.8 (1M context) --- content/reference/promise-types/files/_index.markdown | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/content/reference/promise-types/files/_index.markdown b/content/reference/promise-types/files/_index.markdown index 45db130c9..facbff2e2 100644 --- a/content/reference/promise-types/files/_index.markdown +++ b/content/reference/promise-types/files/_index.markdown @@ -640,7 +640,7 @@ body acl template **Description:** The `hash` menu option defines the type of hash used for change detection. -The `best` option cross correlates the best two available algorithms known in the OpenSSL library. +The `best` option uses the strongest hash algorithm available (SHA-512). **Type:** (menu option) @@ -665,6 +665,13 @@ body changes example } ``` +**History:** Before 3.29.0, in the community edition the `best` option +cross correlated two algorithms (MD5 and SHA1); it now uses SHA-512, matching +the enterprise edition. Files tracked with `hash => "best"` are silently +re-baselined under the new hash on the first agent run after upgrade. This +change only affects the community edition; the enterprise edition already used +SHA-512. + #### report_changes **Description:** Specify criteria for change warnings using the `report_changes` menu option.