From 36754d761377b7a5592e2d1bb15a5b68afcbaf07 Mon Sep 17 00:00:00 2001
From: jackctj117 <jackctj117@gmail.com>
Date: Thu, 15 Oct 2026 14:20:59 -0600
Subject: [PATCH] fips-check: use fips-hash.sh for the in core hash update

Replace the inline hash scrape with a call to fips-hash.sh so the
digest detection and length check apply here too. A rejected hash now
stops the run instead of running make check against a bad verifyCore,
and make clean only runs when verifyCore actually changed.
---
 fips-check.sh | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/fips-check.sh b/fips-check.sh
index 2cffedea60..fd9f79be4d 100755
--- a/fips-check.sh
+++ b/fips-check.sh
@@ -672,14 +672,15 @@ if [ "$DOCONFIGURE" = "yes" ]; then
     fi
 
     if [ -s wolfcrypt/src/fips_test.c ]; then
-        # Take the hash exactly as long as reported: the in core digest is
-        # SHA-256 (64 hex) up to FIPS v6.0.0 and SHA-512 (128 hex) from v7.0.0.
-        NEWHASH=$(./wolfcrypt/test/testwolfcrypt | \
-                  sed -n 's/^hash = \([0-9A-Fa-f][0-9A-Fa-f]*\).*$/\1/p' | head -1)
-        if [ -n "$NEWHASH" ]; then
-            cp wolfcrypt/src/fips_test.c wolfcrypt/src/fips_test.c.bak
-            sed "s/^\".*\";/\"${NEWHASH}\";/" wolfcrypt/src/fips_test.c.bak > \
-                                                    wolfcrypt/src/fips_test.c
+        # fips-hash.sh matches the reported hash to the in core digest that
+        # fips_test.c expects (SHA-256 up to FIPS v6.0.0, SHA-512 from v7.0.0)
+        # and refuses to write one of the wrong length.
+        OLDHASH=$(grep '^".*";' wolfcrypt/src/fips_test.c)
+        if ! ./fips-hash.sh; then
+            echo 'fips-check: Hash update failed. Debris left for analysis.'
+            exit 3
+        fi
+        if [ "$OLDHASH" != "$(grep '^".*";' wolfcrypt/src/fips_test.c)" ]; then
             make clean
         fi
     fi