Hash and crypto functions

Text hashes operate on the supplied UTF-8 bytes. File hashes read confined regular files as raw bytes; they follow the filesystem confinement rules.

Function	Result and rules
`md5(text)`	Lowercase hex MD5 digest.
`sha1(text)`	Lowercase hex SHA-1 digest.
`sha256(text)`	Lowercase hex SHA-256 digest.
`sha512(text)`	Lowercase hex SHA-512 digest.
`base64sha256(text)`	Base64 of raw SHA-256 digest bytes, not of the hex spelling.
`base64sha512(text)`	Base64 of raw SHA-512 digest bytes.
`filemd5(path)`	Lowercase hex MD5 of file bytes.
`filesha1(path)`	Lowercase hex SHA-1 of file bytes.
`filesha256(path)`	Lowercase hex SHA-256 of file bytes.
`filesha512(path)`	Lowercase hex SHA-512 of file bytes.
`filebase64sha256(path)`	Base64 of raw SHA-256 digest bytes of a file.
`filebase64sha512(path)`	Base64 of raw SHA-512 digest bytes of a file.
`rsadecrypt(ciphertext, private_key)`	Base64 PKCS#1 v1.5 ciphertext plus unencrypted PKCS#1/PKCS#8 PEM RSA key; UTF-8 plaintext is intrinsically sensitive.
`uuidv5(namespace, name)`	Deterministic namespace UUID; namespace is a UUID or dns/url/oid/x500.

rsadecrypt accepts keys up to 8192 bits/16 KiB. Keep key material out of public configurations; use sensitive inputs when required. Sensitivity does not encrypt a completed bundle. Random uuid and bcrypt functions are unavailable. Bundle integrity and cloud file checksums use SHA-256; legacy hash functions do not change those policies.

Example

locals {
  hashes = {
    md5 = md5("rivet")
    sha1 = sha1("rivet")
    sha256 = sha256("rivet")
    sha512 = sha512("rivet")
    base64sha256 = base64sha256("rivet")
    base64sha512 = base64sha512("rivet")
    filemd5 = filemd5("assets/config.json")
    filesha1 = filesha1("assets/config.json")
    filesha256 = filesha256("assets/config.json")
    filesha512 = filesha512("assets/config.json")
    filebase64sha256 = filebase64sha256("assets/config.json")
    filebase64sha512 = filebase64sha512("assets/config.json")
    id = uuidv5("dns", "example.invalid")
  }
}
output "hashes" {
  type  = string
  value = jsonencode(local.hashes)
}

All calls obey the function limits and annotation rules.