From 73e3720083caef9f1e59827845311ef3ebcd7f6f Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Tue, 10 Nov 2026 11:22:16 +0100
Subject: [PATCH] sonar: SHA-1 image names in .fig export are the format's, not
 a choice

---
 sonar-project.properties | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sonar-project.properties b/sonar-project.properties
index 92562d54c..5f58f42ae 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -1,2 +1,8 @@
 sonar.projectKey=storytold_figcraft
 sonar.organization=storytold
+
+# S4790 (weak hash): a .fig file names each image by the SHA-1 of its bytes (20 bytes, the only
+# length readers accept). It is an identifier the format fixes, not a security choice.
+sonar.issue.ignore.multicriteria=fig_image_sha1
+sonar.issue.ignore.multicriteria.fig_image_sha1.ruleKey=rust:S4790
+sonar.issue.ignore.multicriteria.fig_image_sha1.resourceKey=crates/format/src/fig/export.rs