Explicitly set default encoding in createHash()

[addaleax]

Up until now, the default encoding for this is binary, but this is scheduled to change in Node 8. Since this module is currently always passing string input to the Hash object, it needs to account for that.

A better fix would likely involve dropping all strings handling and treating binary data using Buffer objects, but I kept this change minimal to avoid any breakage.

Refs: nodejs/node#8611

@malept Could you backport this change to the 1.x.x versions of sumchecker? This came up because a major dependent of sumchecker, electron-prebuilt, would be affected by the change in Node, and it still supports 0.10.x/0.12.x Node versions.

[addaleax]

Also, fyi: This code is not optimal anyway. One of the reasons for switching the default encoding to UTF-8 is that it actually affects security – with binary, multiple characters would get mapped to the same hash, because binary effectively just takes the last 8 bits of the codepoint and throws the rest away.

[malept]

I'll try to look at this PR this weekend.

Also, fyi: This code is not optimal anyway. One of the reasons for switching the default encoding to UTF-8 is that it actually affects security – with binary, multiple characters would get mapped to the same hash, because binary effectively just takes the last 8 bits of the codepoint and throws the rest away.

It's like that because the checksums for Electron are generated with the -b flag of sha256sum. I am open to changing the default (and appropriately major version bumping this module), but I'll need to keep electron-download checking the Electron files using the binary encoding.

[addaleax]

I'll try to look at this PR this weekend.

Thanks!

but I'll need to keep electron-download checking the Electron files using the binary encoding.

What I meant was that, while you can process binary data using that encoding, it would be a bit more customary to not apply any string encoding/decoding at all and just use Buffer objects. That should have behaviour equivalent to reading the file as binary and then passing it to the Hash object as binary again (i.e. what currently happens).

[addaleax]

Bump @malept – This PR really only explicitly sets the defaultEncoding to what it currently is by default, it should be very low-risk.

[malept]

I didn't have time this weekend to look at it mostly because of the backporting part. However, I did just push a v1 branch that you can submit a PR against.

[addaleax]

@malept thanks, done!