From 3df87e9411c97cf1d38d33c64f5bf79298249c79 Mon Sep 17 00:00:00 2001
From: krynju <krystian.gulinski@juliahub.com>
Date: Thu, 17 Sep 2026 14:34:14 +0200
Subject: [PATCH] chore: replace MbedTLS with SHA stdlib for HMAC signing

The only MbedTLS use was `digest(MD_SHA256, data, key)`, i.e. HMAC-SHA256,
in the SharedKey request signer and the SAS token generator. The SHA
stdlib's `hmac_sha256(key, data)` produces identical bytes, so MbedTLS is
dropped in favour of it. This removes MbedTLS from downstream manifests
once AWS.jl stops pulling it in transitively.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 Project.toml                           | 6 +++---
 src/StorageServices/StorageServices.jl | 2 +-
 src/StorageServices/sas.jl             | 2 +-
 src/rest_api_protocol.jl               | 4 ++--
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Project.toml b/Project.toml
index 2036a9d..ac9fa26 100644
--- a/Project.toml
+++ b/Project.toml
@@ -2,14 +2,14 @@ name = "Azure"
 uuid = "34b51195-c7f2-5807-8107-6ca017e2682c"
 keywords = ["azure", "cloud", "api", "julia"]
 desc = "Julia interface to Azure APIs"
-version = "0.5.0"
+version = "0.5.1"
 
 [deps]
 Base64 = "2a0f44e3-6c83-55bd-87e4-b1978d98bd5f"
 Dates = "ade2ca70-3891-5945-98fb-dc099432e06a"
 Downloads = "f43a241f-c20a-4ad4-852c-f6b1247861c6"
 JSON = "682c06a0-de6a-54ab-a142-c8b1cf79cde6"
-MbedTLS = "739be429-bea8-5141-9913-cc70e7f3736d"
+SHA = "ea8e919c-243c-51af-8825-aaa63cd721ce"
 Mmap = "a63ad114-7e13-5084-954f-fe012c677804"
 OpenAPI = "d5e62ea6-ddf3-4d43-8e4c-ad5e6c8bfd7d"
 Random = "9a3f8284-a2c9-5f02-9a11-845980a1fd5c"
@@ -20,7 +20,7 @@ XMLDict = "228000da-037f-5747-90a9-8195ccbf91a5"
 [compat]
 Downloads = "1"
 JSON = "0.21"
-MbedTLS = "0.6.8, 0.7, 1"
+SHA = "0.7, 1"
 OpenAPI = "0.1,0.2"
 TimeZones = "1"
 URIs = "1.3, 1.4"
diff --git a/src/StorageServices/StorageServices.jl b/src/StorageServices/StorageServices.jl
index b997ce4..d72d79d 100644
--- a/src/StorageServices/StorageServices.jl
+++ b/src/StorageServices/StorageServices.jl
@@ -5,7 +5,7 @@ using Azure.StorageManagementClient
 using Azure.REST
 using Azure.REST: AccountKey, service_response, parse_service_response, issuccess
 using URIs
-using MbedTLS
+using SHA: hmac_sha256
 using Dates
 using Base64
 using Mmap
diff --git a/src/StorageServices/sas.jl b/src/StorageServices/sas.jl
index 05a3ac5..b85f917 100644
--- a/src/StorageServices/sas.jl
+++ b/src/StorageServices/sas.jl
@@ -79,7 +79,7 @@ function appendSAS(raw_url::String, key::String; permissions::String=SASPermissi
                         content_language,
                         content_type
                     ], "\n")
-    sig = base64encode(digest(MD_SHA256, str_to_sign, base64decode(key)))
+    sig = base64encode(hmac_sha256(base64decode(key), str_to_sign))
 
     query_params =  [
                         "sv"=>SAS_VERSION,
diff --git a/src/rest_api_protocol.jl b/src/rest_api_protocol.jl
index a571051..7daeec4 100644
--- a/src/rest_api_protocol.jl
+++ b/src/rest_api_protocol.jl
@@ -2,7 +2,7 @@ module REST
 
 using URIs
 using Downloads
-using MbedTLS
+using SHA: hmac_sha256
 using Dates
 using Base64
 using XMLDict
@@ -112,7 +112,7 @@ function sign_sharedkey(req::ServiceRequest, key::String)
     print(iob, canonicalize_resource(req.account, req.resource))
 
     signingstr = String(take!(iob))
-    hmacsign = base64encode(digest(MD_SHA256, signingstr, base64decode(key)))
+    hmacsign = base64encode(hmac_sha256(base64decode(key), signingstr))
     req.headers["Authorization"] = "SharedKey $(req.account):$(hmacsign)"
     nothing
 end