From a37e9189369bb65e2ac378613fac354e8a3a421c Mon Sep 17 00:00:00 2001
From: Zhengchao An <anzhengchao@gmail.com>
Date: Sun, 28 Jun 2026 19:42:18 +0800
Subject: [PATCH] docs: document SHA-1 HMAC migration proposal (#747) (#4009)

---
 crates/signer/src/request_signature_v2.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/crates/signer/src/request_signature_v2.rs b/crates/signer/src/request_signature_v2.rs
index 558dfe45b..49244ae03 100644
--- a/crates/signer/src/request_signature_v2.rs
+++ b/crates/signer/src/request_signature_v2.rs
@@ -26,6 +26,14 @@ use super::utils::{HostAddrError, try_get_host_addr};
 use rustfs_utils::crypto::{hex, hmac_sha1};
 use s3s::Body;
 
+// NOTE: SHA-1 HMAC is used here for AWS S3 Signature V2 compatibility.
+// SHA-1 is considered weak, but it's only used for HMAC (not signature collision).
+// Migration plan (not yet implemented):
+// Phase 1: Support both SHA-1 and SHA-256 (configurable)
+// Phase 2: Deprecation warnings in response headers
+// Phase 3: Default to SHA-256, SHA-1 becomes optional
+// See https://github.com/rustfs/backlog/issues/747 for discussion.
+
 const _SIGN_V4_ALGORITHM: &str = "AWS4-HMAC-SHA256";
 const SIGN_V2_ALGORITHM: &str = "AWS";