Skip to content

Use Guile-Gcrypt instead of 'openssl' to compute HMACs. #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
civodul wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Use Guile-Gcrypt instead of 'openssl' to compute HMACs. #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,19 @@ $ cd `guile -c "(display (%global-site-dir))"`
$ wget https://raw.githubusercontent.com/jerry40/guile-simple-zmq/master/src/simple-zmq.scm
```

Last, [Guile-Gcrypt](https://notabug.org/cwebber/guile-gcrypt) is needed
to compute hash-based message authentication codes (HMACs) while
communicating with Jupyter:
```
$ wget https://notabug.org/cwebber/guile-gcrypt/archive/v0.1.0.tar.gz
$ tar xvf v0.1.0.tar.gz
$ cd guile-gcrypt-0.1.0
Copy link
Copy Markdown
Owner

@jerry40 jerry40 Sep 11, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I get guile-gcrypt folder after unpacking
I installed (Ubuntu 18.04) guile-2.2-dev and texinfo and executed
./configure --prefix=/usr/ --with-libgcrypt-libdir=/usr/lib/x86_64-linux-gnu/ and it worked, but make returns an error:

cd "$am__cwd"; \
if /bin/bash /home/jerry/Downloads/guile-gcrypt/build-aux/missing makeinfo   -I . \
 -o guile-gcrypt.info guile-gcrypt.texi; \
then \
  rc=0; \
  CDPATH="${ZSH_VERSION+.}:" && cd .; \
else \
  rc=$?; \
  CDPATH="${ZSH_VERSION+.}:" && cd . && \
  $restore $backupdir/* `echo "./guile-gcrypt.info" | sed 's|[^/]*$||'`; \
fi; \
rm -rf $backupdir; exit $rc
./pre-inst-env  compile -Wunbound-variable -Warity-mismatch -Wformat -o "gcrypt/base16.go" "gcrypt/base16.scm"
./pre-inst-env: 33: exec: compile: not found
Makefile:1410: recipe for target 'gcrypt/base16.go' failed

Copy link
Copy Markdown
Author

@civodul civodul Sep 11, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like the guild program wasn't found. Did autoreconf emit warnings? What does grep GUILD config.log return?

Copy link
Copy Markdown
Owner

@jerry40 jerry40 Sep 11, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

autoreconf:

jerry@MS-7721:~/Downloads/guile-gcrypt$ autoreconf -vfi
autoreconf: Entering directory `.'
autoreconf: configure.ac: not using Gettext
autoreconf: running: aclocal --force 
autoreconf: configure.ac: tracing
autoreconf: configure.ac: not using Libtool
autoreconf: running: /usr/bin/autoconf --force
autoreconf: configure.ac: not using Autoheader
autoreconf: running: automake --add-missing --copy --force-missing
autoreconf: Leaving directory `.'

guild:

jerry@MS-7721:~/Downloads/guile-gcrypt$ guild --version
;;; note: auto-compilation is enabled, set GUILE_AUTO_COMPILE=0
;;;       or pass the --no-auto-compile argument to disable.
;;; compiling /usr/bin/guild
;;; compiled /home/jerry/.cache/guile/ccache/2.2-LE-8-3.A/usr/bin/guild.go
guild (GNU Guile) 2.2.3
Copyright (C) 2017 Free Software Foundation, Inc.

hm...

jerry@MS-7721:~/Downloads/guile-gcrypt$ grep GUILD config.log
GUILD=''

Copy link
Copy Markdown
Author

@civodul civodul Sep 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fishy, indeed! What does configure show when looking for guild?

I see this:

$ grep -i guild ~/src/guile-gcrypt/config.log
configure:2633: checking for guild
configure:2663: result: /home/ludo/.guix-profile/bin/guild
ac_cv_path_GUILD=/home/ludo/.guix-profile/bin/guild
GUILD='/home/ludo/.guix-profile/bin/guild'
GUILE_TOOLS='/home/ludo/.guix-profile/bin/guild'

As a workaround you can always run:

./configure ac_cv_path_GUILD=/usr/bin/guild

... but that shouldn't be necessary.

HTH!

Copy link
Copy Markdown
Owner

@jerry40 jerry40 Sep 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like it is looking for guld-2.2 command

jerry@MS-7721:~/Downloads/guile-gcrypt$ grep -i guild config.log
configure:2645: checking for guild-2.2
GUILD=''

Interesting

Copy link
Copy Markdown
Owner

@jerry40 jerry40 Sep 13, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I understand why it searches for guild-2.2.
guile.m4:

# This macro looks for programs @code{guile} and @code{guild}, setting
# variables @var{GUILE} and @var{GUILD} to their paths, respectively.
# The macro will attempt to find @code{guile} with the suffix of
# @code{-X.Y}, followed by looking for it with the suffix @code{X.Y}, and
# then fall back to looking for @code{guile} with no suffix. If
# @code{guile} is still not found, signal an error. The suffix, if any,
# that was required to find @code{guile} will be used for @code{guild}
# as well.

jerry@MS-7721:~$ ls -al /usr/bin/guile*
lrwxrwxrwx 1 root root   23 июл  6 19:47 /usr/bin/guile -> /etc/alternatives/guile
lrwxrwxrwx 1 root root   43 июл 17 16:42 /usr/bin/guile-2.2 -> ../lib/x86_64-linux-gnu/guile-2.2/bin/guile
-rwxr-xr-x 1 root root 6822 июл 17 16:42 /usr/bin/guile-config
-rwxr-xr-x 1 root root 3246 июл 17 16:42 /usr/bin/guile-snarf
lrwxrwxrwx 1 root root    5 июл 17 16:42 /usr/bin/guile-tools -> guild

So it finds guile-2.2 and therefore thinks that suffix for guild should be the same.
PS It seems that your workaround worked:

./configure --prefix=/usr/ --with-libgcrypt-libdir=/usr/lib/x86_64-linux-gnu/ ac_cv_path_GUILD=/usr/bin/guild

Copy link
Copy Markdown
Owner

@jerry40 jerry40 Sep 13, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now I get this message (guile can't find hmac module in the current dir?)

;;; compiling /home/jerry/.local/share/jupyter/kernels/guile/guile-jupyter-kernel.scm
;;; WARNING: compilation of /home/jerry/.local/share/jupyter/kernels/guile/guile-jupyter-kernel.scm failed:
;;; no code for module (hmac)
Backtrace:
          11 (primitive-load "/home/jerry/.local/share/jupyter/kerne…")
In ice-9/eval.scm:
   721:20 10 (primitive-eval (use-modules (simple-zmq) (json) (#) # …))
In ice-9/psyntax.scm:
  1235:36  9 (expand-top-sequence ((use-modules (simple-zmq) (#) …)) …)
  1182:24  8 (parse _ (("placeholder" placeholder)) ((top) #(# # …)) …)
   285:10  7 (parse _ (("placeholder" placeholder)) (()) _ c&e (eval) …)
In ice-9/boot-9.scm:
  3365:20  6 (process-use-modules _)
   222:29  5 (map1 (((simple-zmq)) ((json)) ((hmac)) ((srfi #)) (#)))
   222:29  4 (map1 (((json)) ((hmac)) ((srfi srfi-1)) ((srfi #))))
   222:17  3 (map1 (((hmac)) ((srfi srfi-1)) ((srfi srfi-13))))
  3366:31  2 (_ ((hmac)))
   2791:6  1 (resolve-interface _ #:select _ #:hide _ #:prefix _ # _ …)
In unknown file:
           0 (scm-error misc-error #f "~A ~S" ("no code for modu…" …) …)

ERROR: In procedure scm-error:
no code for module (hmac)

Copy link
Copy Markdown
Author

@civodul civodul Sep 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This suggests that hmac.scm is not in Guile's module search path.

To fix that, you need to either set GUILE_LOAD_PATH to contain the current directory (it's not there by default, for security reasons), or to pass the -L flag to guile. See the manual for details.

HTH!

Copy link
Copy Markdown
Owner

@jerry40 jerry40 Oct 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi!
Yes I think I can avoid this, but I'd like to provide an installation process to users as easy as it can be. I'm afraid that people can be disappointed if the process is too difficult. Can we do anything in order to make it smoother?

Copy link
Copy Markdown
Author

@civodul civodul Oct 15, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello!

I understand your concern. I feel like ./configure && make && make install is as "simple as it can be" in terms of build systems and "least surprise", but I agree that even that can be daunting to some users.

To me, given my own biases ;-), the best answer to such questions is packaging: guile-gcrypt is already in openSuSE, in AUR (unofficial Arch packages), and in Guix. If more distros ship it, then it'll be easier for users building guile-kernel from source.

In the meantime, I don't have a better answer!

Ludo'.

$ autoreconf -vfi
$ ./configure --prefix=<guile-prefix>
$ make
$ sudo make install
```

## Kernel setup
According to the [article](http://jupyter-client.readthedocs.io/en/stable/kernels.html), the kernel can be placed into different loactions:

Expand Down
2 changes: 1 addition & 1 deletion src/guile-jupyter-kernel.scm
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
(use-modules (simple-zmq)
(json)
(hmac)
(srfi srfi-1)
(srfi srfi-13))

(include "tools.scm")
(include "hmac.scm")

(define DELIM "<IDS|MSG>")

Expand Down
27 changes: 10 additions & 17 deletions src/hmac.scm
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,12 @@
(use-modules (ice-9 rdelim)
(ice-9 popen))
(define-module (hmac)
#:use-module (gcrypt hmac)
#:use-module (gcrypt base16)
#:use-module (rnrs bytevectors)
#:export (get-signature))

(define (get-signature key str)
(let* ((p2c (pipe))
(read-pipe (car p2c))
(write-pipe (cdr p2c))
(port (with-input-from-port read-pipe
(lambda ()
(open-input-pipe (string-append "openssl dgst -sha256 -hmac " key))))))
(display str write-pipe)
(close-port write-pipe)
(let ((result (read-line port)))
(close-port read-pipe)
(close-pipe port)
(substring result 9))))



"Return a hexadecimal string containing the SHA256 HMAC of STR, a string,
with KEY, another string."
(bytevector->base16-string
(sign-data key (string->utf8 str)
#:algorithm 'sha256)))