From 8dac5c780282f992a71ccabfef7b3676be301f96 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Tue, 10 Nov 2026 11:21:35 +0100
Subject: [PATCH] sonar: SHA-1 in ODT decryption is the format's, not a choice

---
 sonar-project.properties | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sonar-project.properties b/sonar-project.properties
index 6e78dc7f7c..4bbfda2d8c 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -1,2 +1,9 @@
 sonar.projectKey=storytold_wordcraft
 sonar.organization=storytold
+
+# S4790 (weak hash): SHA-1 is what ODF 1.2 encryption (§4.16, manifest:start-key-generation and
+# manifest:checksum-type "SHA1/1K") names for files written by older office suites. It is needed
+# to open those files, not chosen for new security; new files use SHA-256.
+sonar.issue.ignore.multicriteria=odt_sha1
+sonar.issue.ignore.multicriteria.odt_sha1.ruleKey=rust:S4790
+sonar.issue.ignore.multicriteria.odt_sha1.resourceKey=crates/formats/src/odt/crypt.rs