GNU bug report logs - #49530
pycryptodome bundles libtomcrypt, fonts, JavaScript and CSS

Previous Next

To reply to this bug, email your comments to 49530 AT debbugs.gnu.org.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Maxime Devos <maximedevos <at> telenet.be>
To: bug-guix <at> gnu.org
Subject: pycryptodome bundles libtomcrypt, fonts, JavaScript and CSS
Date: Sun, 11 Jul 2021 23:17:03 +0200

[Message part 1 (text/plain, inline)]

X-Debbugs-CC: slg <0x2d <at> disroot.org>

Hi guix,

In the context of <https://issues.guix.gnu.org/49123>;, I looked
at the source code of pycryptodome, version 3.10.1.  It bundles
some fonts, javascript, CSS, and libtomcrypt.  That's not the
version packaged in guix, but presumably version 3.9.9 has
the same issues as well.

More specifically, the following things are bundled:

Doc/sphinx_rtd_theme/static/js/theme.js: Minified
javascript code. It starts with
/* sphinx_rtd_theme version 0.4.0 | MIT license */

Doc/sphinx_rtd_theme/static/js/modernizr.min.js:
Likewise, and starts with /* Modernizr 2.6.2 (Custom Build) | MIT & BSD */

Doc/sphinx_rtd_theme/static/fonts: Various fonts
(‘font awesome’, ‘roboto slab’, ‘lato’, ‘inconsolata’).

Doc/sphinx_rtd_theme/static/css: Minified CSS. One file starts with
/* sphinx_rtd_theme version 0.4.0 | MIT license */, the other is of unknon
origin. There are also 'css.map' files. I don't know what these are.

src/libtom: Bundled headers from 'libtomcrypt'.  Curiously, I don't see
corresponding '.c' files.

Greetings,
Maxime.

[signature.asc (application/pgp-signature, inline)]

Message #8 received at 49530 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Maxime Devos <maximedevos <at> telenet.be>
Cc: 49530 <at> debbugs.gnu.org, slg <0x2d <at> disroot.org>
Subject: Re: bug#49530: pycryptodome bundles libtomcrypt, fonts, JavaScript
 and CSS
Date: Sun, 11 Jul 2021 19:07:52 -0400

On Sun, Jul 11, 2021 at 11:17:03PM +0200, Maxime Devos wrote:
> src/libtom: Bundled headers from 'libtomcrypt'.  Curiously, I don't see
> corresponding '.c' files.

Libtomcrypt is commonly embedded into other programs. For example, our
Dropbear package contained a modified copy of it for a long time, until
commit f72ff06ef8a83a78ad625fe50ee5bb618ea4f37c.

It may be that it can be used as a "headers only" library.

Message #11 received at 49530 <at> debbugs.gnu.org (full text, mbox):

From: Maxime Devos <maximedevos <at> telenet.be>
To: Leo Famulari <leo <at> famulari.name>
Cc: 49530 <at> debbugs.gnu.org, slg <0x2d <at> disroot.org>
Subject: Re: bug#49530: pycryptodome bundles libtomcrypt, fonts, JavaScript
 and CSS
Date: Wed, 14 Jul 2021 12:01:01 +0200

[Message part 1 (text/plain, inline)]

Leo Famulari schreef op zo 11-07-2021 om 19:07 [-0400]:
> On Sun, Jul 11, 2021 at 11:17:03PM +0200, Maxime Devos wrote:
> > src/libtom: Bundled headers from 'libtomcrypt'.  Curiously, I don't see
> > corresponding '.c' files.
> 
> Libtomcrypt is commonly embedded into other programs. For example, our
> Dropbear package contained a modified copy of it for a long time, until
> commit f72ff06ef8a83a78ad625fe50ee5bb618ea4f37c.
> 
> It may be that it can be used as a "headers only" library.

It turns out there is a C file after all: tomcrypt_des.c.
I sent a patch (https://issues.guix.gnu.org/49543) to unbundle
it and the headers.

Greetings,
Maxime.

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.