package.sgl — sigil-crypto

1;;; sigil-crypto - Cryptographic Functions

2;;;

3;;; Provides cryptographic primitives using mbedTLS:

4;;; - SHA-1 and SHA-256 hashing

5;;; - HMAC-SHA1 / HMAC-SHA256 / HMAC-SHA512

6;;; - PBKDF2-SHA1 / PBKDF2-SHA256 / PBKDF2-SHA512 key derivation

7;;; - HKDF-SHA256 (RFC 5869) key derivation

8;;; - ECDSA P-256 sign + verify + keygen (JOSE/ES256 format)

9;;; - ECDH P-256 shared-secret derivation

10;;; - AES-128-GCM authenticated encryption

11;;; - Base64 + base64url (RFC 4648 § 5) encoding/decoding

12;;; - Cryptographically secure random bytes

13;;;

14;;; This package vendors mbedTLS and can be used independently of TLS.

16(package

17 name: "sigil-crypto"

18 version: "0.16.4"

19 sigil: "^0.17"

20 description: "Cryptographic functions for Sigil (SHA, HMAC, ECDSA, ECDH, AES-GCM, HKDF, base64, random)"

21 url: "https://codeberg.org/sigil/sigil-crypto"

22 license: "BSD-3-Clause"

23 authors: (list "David Wilson <[email protected]>")

25 dependencies: (list

26 ;; Explicit sigil-lib pin: overrides the extraction-era implicit

27 ;; sigil-stdlib/sigil-lib (^0.15 from the retired sigil-lang repo)

28 ;; that the reintegrated monorepo test-runner chain would otherwise

29 ;; derive. sigil-crypto's native codegen needs the 0.17 runtime

30 ;; headers to build libsigil-crypto.a.

31 (from-git url: "codeberg:sigil/sigil"

32 package: "sigil-lib" version: "^0.17"))

34 ;; sigil-test + sigil-test-runner are required as dev-deps so

35 ;; `sigil test` can build a test-harness binary that statically

36 ;; links sigil-crypto's native init function. The harness imports

37 ;; (sigil test cli) from sigil-test-runner. Without these the host

38 ;; sigil binary's bundled (and potentially stale) `(sigil crypto).sgb`

39 ;; would be used instead of the local source, causing newer bindings

40 ;; to surface as `unbound variable`.

41 dev-dependencies: (list

42 (from-git url: "codeberg:sigil/sigil" package: "sigil-test" version: "^0.17")

43 (from-git url: "codeberg:sigil/sigil" package: "sigil-test-runner" version: "^0.17"))

45 ;; Native library definition

46 libraries: (list

47 (library

48 name: 'sigil-crypto

49 c-sources: '("native/crypto.c"

50 "vendor/mbedtls/library/*.c")

51 c-include-dirs: '("vendor/mbedtls/include"

52 "vendor/mbedtls")

53 c-flags: '("-DMBEDTLS_CONFIG_FILE=\"sigil_mbedtls_config.h\"")

54 native-init: "sigil__init_sigil_crypto_module"))

56 tasks: (list

57 (task

58 name: 'build

59 description: "Build the sigil-crypto native library"

60 steps: (list

61 ;; Compile mbedTLS library with our minimal config

62 ;; The config disables TLS 1.3 (requires complex PSA crypto setup)

63 ;; and enables only what we need for TLS 1.2 client connections

64 (compile-c-sources

65 sources: "vendor/mbedtls/library/*.c"

66 include-dirs: '("vendor/mbedtls/include"

67 "vendor/mbedtls")

68 flags: '("-std=c99"

69 "-Wall" "-Wno-unused-function"

70 "-DMBEDTLS_CONFIG_FILE=\"sigil_mbedtls_config.h\""))

72 ;; Compile crypto.c

73 ;; Flags go through with-sigil-c-flags so the build system injects

74 ;; -I<sigil-lib>/include + -I<sigil-lib>/src. crypto.c's

75 ;; #include <sigil/sigil.h> resolves via that auto-injection.

76 (compile-c-sources

77 sources: '("native/crypto.c")

78 include-dirs: '("vendor/mbedtls/include"

79 "vendor/mbedtls")

80 flags: (with-sigil-c-flags '("-std=c99"

81 "-Wall" "-Wextra"

82 "-Wno-unused-parameter"

83 "-D_GNU_SOURCE"

84 "-DMBEDTLS_CONFIG_FILE=\"sigil_mbedtls_config.h\"")))

86 ;; Create static library

87 (create-static-library

88 name: "sigil-crypto")

90 ;; Compile Scheme module

91 (compile-sigil-modules

92 sources: "src/**/*.sgl")))))