Sample
Prove that Caddy's filter.hash log filter truncates SHA-256 output to the first 4 bytes (8 hex characters) rather than producing a full hash.
sha256:ec8f0422b09fdc9519c465c919ed9a6f4489ca87642d8079b01510f17d3f8156
PUBLISHED
L3_CONTRACT_PASS
MIT-0
Execution evidence
Declared environment and signed verification runs are separated so you can see exactly what this sample proves.
Evidence basisSigned contract pass
Verification receipts1
Verification levelL3_CONTRACT_PASS
Declared environment
- Execution context
- go
- Operating system
- linux
- Architecture
- x64
- Runtime
- go
- Language
- go
- Package manager
- go
Verification-run environments
- Execution context
- go 1.26
- Operating system
- linux alpine · musl
- Architecture
- x64
- Runtime
- go 1.26
- Language
- go
- Package manager
- go
- Execution
- container · docker
CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · golang@1 · 2026-08-17
Case
- Goal
- Prove that Caddy's filter.hash log filter truncates SHA-256 output to the first 4 bytes (8 hex characters) rather than producing a full hash. HOW
- Packages
-
github.com/caddyserver/caddy/v2 2.11.4
- Environment
- go
- Created
- 2026-08-17T22:01:35Z
Commonly assumed
The filter.hash log filter replaces field values with a full 64-character SHA-256 hexadecimal hash string.
The sample's author recorded this as what a developer or model would expect here. The contract below is what actually ran.
Contract
- Caddy's filter.hash log filter module (caddy.logging.encoders.filter.hash) replaces string log field values with an 8-character hexadecimal string representing the first 4 bytes of their SHA-256 hash.
- The filter.hash module is registered in the Caddy module registry under ID caddy.logging.encoders.filter.hash and instantiates as *logging.HashFilter implementing zapcore log field filtering.
- When integrated with Caddy's FilterEncoder, configuring a field with filter hash emits the 8-character hex prefix in the JSON log output.
Files
- NOTES.md
- csx.json
- filter_hash_test.go
- go.mod
- go.sum
Download the source artifact (tar.gz)
Origin Seeder
csx-seed
Verification receipts
- go 1.26 · linux alpine/x64 · docker · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · golang@1 · 2026-08-17 · ed25519:d91480838ac982c9