Java程序归档文件哈希计算：文件范围、大SWF处理及哈希组织咨询

Hey there! Let's tackle your three key questions about calculating hashes for files in archives using Java's MessageDigest—I've dealt with similar use cases before, so here's what I've learned:

1. Do I only need to calculate hashes for specific file types? #

This entirely depends on your business requirements, not technical limitations:

• If your goal is to verify the integrity of the entire archive (e.g., ensuring no files were tampered with), you should calculate hashes for every single file in the archive. MessageDigest works with raw byte streams, so it doesn't care about file extensions or formats—any file (binary or text) can be processed.
• If you only care about specific file categories (e.g., validating official documents like Word/Excel files, or excluding temporary/cache files), then you can filter files by their extension or MIME type before computing hashes. For example, you might skip .tmp or .log files but process .docx, .jpeg, and .xml.

The bottom line: The technical capability is there for any file type—let your use case drive which files you target.

2. Are large .swf (Flash) files suitable for hash calculation? #

Absolutely! Hash calculation isn't limited by file size, as long as you process the file in chunks instead of loading the entire thing into memory (which would cause OutOfMemoryErrors for huge files).

Here's how to handle large SWF files efficiently:

• Use a buffered input stream (like BufferedInputStream) to read the file in small chunks (e.g., 8KB or 64KB buffers).
• Feed each chunk into the MessageDigest instance incrementally using update(byte[]) instead of digest(byte[]).

Quick code snippet for chunked hash calculation:

public static String calculateFileHash(File file, String algorithm) throws IOException, NoSuchAlgorithmException {
    MessageDigest digest = MessageDigest.getInstance(algorithm);
    try (BufferedInputStream bis = new BufferedInputStream(new FileInputStream(file))) {
        byte[] buffer = new byte[8192]; // 8KB buffer
        int bytesRead;
        while ((bytesRead = bis.read(buffer)) != -1) {
            digest.update(buffer, 0, bytesRead);
        }
    }
    byte[] hashBytes = digest.digest();
    // Convert bytes to hex string
    StringBuilder sb = new StringBuilder();
    for (byte b : hashBytes) {
        sb.append(String.format("%02x", b));
    }
    return sb.toString();
}

This approach works seamlessly for multi-GB SWF files—just make sure your IO subsystem can handle the read speed, and you'll be fine.

3. Recommended ways to organize hashes for a ZIP file containing multiple files? #

There are a few practical patterns depending on what you need to do with the hashes:

Option 1: Embed a hash manifest in the ZIP #

Add a dedicated metadata file (e.g., hash-manifest.json or file-hashes.txt) directly into the ZIP archive. This file can store key-value pairs mapping each file's path inside the ZIP to its hash value. For example, a JSON manifest might look like:

{
  "documents/report.docx": "a1b2c3d4...",
  "media/animation.swf": "e5f6g7h8...",
  "config/settings.xml": "i9j0k1l2..."
}

When you process the ZIP later, you can read this manifest first to validate other files' hashes.

Option 2: In-memory or persistent storage during processing #

If you're processing the ZIP programmatically (not needing to store hashes with the archive), use a Map<String, String> where:

• The key is the relative path of the file inside the ZIP (to avoid conflicts if files have the same name in different directories)
• The value is the hex-encoded hash string (using SHA-256 or SHA-512 for better security than MD5)

Example snippet for processing a ZIP file:

public static Map<String, String> calculateZipFileHashes(File zipFile, String algorithm) throws IOException, NoSuchAlgorithmException {
    Map<String, String> fileHashes = new HashMap<>();
    try (ZipInputStream zis = new ZipInputStream(new FileInputStream(zipFile))) {
        ZipEntry entry;
        while ((entry = zis.getNextEntry()) != null) {
            if (!entry.isDirectory()) { // Skip directories
                MessageDigest digest = MessageDigest.getInstance(algorithm);
                byte[] buffer = new byte[8192];
                int bytesRead;
                while ((bytesRead = zis.read(buffer)) != -1) {
                    digest.update(buffer, 0, bytesRead);
                }
                // Convert hash to hex string
                StringBuilder sb = new StringBuilder();
                for (byte b : digest.digest()) {
                    sb.append(String.format("%02x", b));
                }
                fileHashes.put(entry.getName(), sb.toString());
            }
            zis.closeEntry();
        }
    }
    return fileHashes;
}

You can then persist this map to a database, write it to an external file, or use it for real-time validation.

Bonus: Algorithm choice #

Always prefer SHA-256 or SHA-512 over MD5 or SHA-1—they're cryptographically secure and less prone to collisions, which is critical if you're using hashes for integrity verification.

内容的提问来源于stack exchange，提问作者YS_NE