[improve][misc] Replace MD5 NAR/archive checksums with SHA-256

[david-streamlio]

Motivation

FileUtils.calculateMd5sum backs two non-security change-detection mechanisms: the NAR extraction directory checksum (NarUnpacker) and the connector/function archive identity used for hot-reload (ConnectorUtils/FunctionUtils). MD5 is fine for change detection, but strict security providers reject it outright — under BC-FIPS in approved-only mode, MessageDigest.getInstance("md5") throws, which breaks NAR extraction (and therefore broker/worker startup with connectors) on FIPS-configured JVMs.

This is one of a set of small preparatory cleanups for FIPS-restricted deployments; a broader PIP covering TLS provider wiring, packaging, and message-crypto algorithm migration is being drafted separately.

Modifications

• FileUtils: replaced calculateMd5sum with calculateSha256sum (SHA-256, larger read buffer); javadoc documents that the checksum is change detection, not a security control.
• NarUnpacker: uses the SHA-256 checksum for the extraction directory and lock-file names; local variable renamed accordingly.
• ConnectorUtils/FunctionUtils: computeArchiveMd5Hex → computeArchiveChecksumHex (SHA-256).
• Connector/FunctionArchive: field/accessor renames (getArchiveChecksumHex), javadoc updated.

The archive checksum is only compared in-memory against values computed by the same JVM, so the algorithm change is not observable there. The NAR extraction directory name changes, causing a one-time re-extraction after upgrade; stale checksum-named directories from older versions are left behind in the extraction dir, matching existing behavior when NAR content changes.

Verifying this change

• Make sure that the change passes the CI checks.

This change is already covered by existing tests: NarUnpackerTest (extraction/locking against the new checksum naming), ConnectorUtilsReloadTest and FunctionUtilsReloadTest (archive-identity change detection).

Does this pull request potentially affect one of the following parts:

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

[Copilot]

Pull request overview

This PR updates Pulsar’s non-security checksum-based change-detection mechanisms to use SHA-256 instead of MD5, avoiding failures on FIPS-configured JVMs where weak digests can be rejected (e.g., MessageDigest.getInstance("md5") throwing under strict providers). The change affects NAR unpacking directory/lock naming and connector/function archive identity checks used for hot reload.

Changes:

• Replaced FileUtils.calculateMd5sum with FileUtils.calculateSha256sum (SHA-256; larger read buffer; clarified javadoc that it’s for change detection).
• Updated NarUnpacker to derive extraction directory and lockfile names from the SHA-256 checksum.
• Renamed connector/function archive identity helpers and fields from “Md5” to generic “Checksum” and switched to SHA-256 hex.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pulsar-functions/utils/src/main/java/org/apache/pulsar/functions/utils/io/ConnectorUtils.java	Uses SHA-256 hex for connector archive identity during reload; renames helper to checksum-based name.
pulsar-functions/utils/src/main/java/org/apache/pulsar/functions/utils/io/Connector.java	Renames stored archive digest field/accessor to checksum and computes SHA-256 via updated utility.
pulsar-functions/utils/src/main/java/org/apache/pulsar/functions/utils/functions/FunctionUtils.java	Uses SHA-256 hex for function archive identity during reload; renames helper to checksum-based name.
pulsar-functions/utils/src/main/java/org/apache/pulsar/functions/utils/functions/FunctionArchive.java	Renames stored archive digest field/accessor to checksum and computes SHA-256 via updated utility.
pulsar-common/src/main/java/org/apache/pulsar/common/nar/NarUnpacker.java	Switches unpack directory + lock naming from MD5 to SHA-256 checksum.
pulsar-common/src/main/java/org/apache/pulsar/common/nar/FileUtils.java	Implements SHA-256 checksum calculation and updates documentation accordingly.