Conversation
The only MbedTLS use was `digest(MD_SHA256, data, key)`, i.e. HMAC-SHA256, in the SharedKey request signer and the SAS token generator. The SHA stdlib's `hmac_sha256(key, data)` produces identical bytes, so MbedTLS is dropped in favour of it. This removes MbedTLS from downstream manifests once AWS.jl stops pulling it in transitively. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
MbedTLS was used in exactly two places, both computing HMAC-SHA256 over a request string with the base64-decoded account key:
src/rest_api_protocol.jl: SharedKeyAuthorizationheader signingsrc/StorageServices/sas.jl: SAS token signatureBoth
digest(MD_SHA256, data, key)calls are replaced withhmac_sha256(key, data)from theSHAstdlib (note the argument order swap).using MbedTLSinRESTandStorageServicesbecomesusing SHA: hmac_sha256.Project.tomlswaps the MbedTLS dep for SHA. Patch version bump0.5.0 → 0.5.1.Why
An upcoming AWS.jl release drops GitHub.jl, which is the last package pulling MbedTLS into JuliaHub manifests transitively when running on HTTP.jl 2.x. After that, every remaining MbedTLS in our trees comes from a direct dependency like this one. This is part of a sweep to remove those, see JuliaComputing/JuliaHubData.jl#90 for the first one.
Testing
Checked locally that
MbedTLS.digest(MD_SHA256, data, key)andSHA.hmac_sha256(key, data)return identical bytes for a random key and multi-line string. Changed files parse. Full test suite not run locally; CI will tell.🤖 Generated with Claude Code