From abd5a6e957cbdda88300328584dc443003592d91 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Tue, 10 Nov 2026 11:21:57 +0100
Subject: [PATCH] sonar: cite the ODF section the SHA-1 algorithms come from

---
 sonar-project.properties | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sonar-project.properties b/sonar-project.properties
index 4bbfda2d8c..bf4496425f 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -1,9 +1,9 @@
 sonar.projectKey=storytold_wordcraft
 sonar.organization=storytold
 
-# S4790 (weak hash): SHA-1 is what ODF 1.2 encryption (§4.16, manifest:start-key-generation and
-# manifest:checksum-type "SHA1/1K") names for files written by older office suites. It is needed
-# to open those files, not chosen for new security; new files use SHA-256.
+# S4790 (weak hash): SHA-1 is a start-key and "SHA1/1K" checksum algorithm that ODF package
+# encryption (ODF 1.3 Part 2 §4.16) names, and older office suites wrote it. It is needed to open
+# those files, not chosen for new security: WordCraft writes a SHA-256 start key and checksum.
 sonar.issue.ignore.multicriteria=odt_sha1
 sonar.issue.ignore.multicriteria.odt_sha1.ruleKey=rust:S4790
 sonar.issue.ignore.multicriteria.odt_sha1.resourceKey=crates/formats/src/odt/crypt.rs