bug#49530: pycryptodome bundles libtomcrypt, fonts, JavaScript and CSS

bug#49530: pycryptodome bundles libtomcrypt, fonts, JavaScript and CSS

[Maxime Devos]

[-- Attachment #1: Type: text/plain, Size: 1121 bytes --]

X-Debbugs-CC: slg <0x2d@disroot.org>

Hi guix,

In the context of <https://issues.guix.gnu.org/49123>;, I looked
at the source code of pycryptodome, version 3.10.1.  It bundles
some fonts, javascript, CSS, and libtomcrypt.  That's not the
version packaged in guix, but presumably version 3.9.9 has
the same issues as well.

More specifically, the following things are bundled:

Doc/sphinx_rtd_theme/static/js/theme.js: Minified
javascript code. It starts with
/* sphinx_rtd_theme version 0.4.0 | MIT license */

Doc/sphinx_rtd_theme/static/js/modernizr.min.js:
Likewise, and starts with /* Modernizr 2.6.2 (Custom Build) | MIT & BSD */

Doc/sphinx_rtd_theme/static/fonts: Various fonts
(‘font awesome’, ‘roboto slab’, ‘lato’, ‘inconsolata’).

Doc/sphinx_rtd_theme/static/css: Minified CSS. One file starts with
/* sphinx_rtd_theme version 0.4.0 | MIT license */, the other is of unknon
origin. There are also 'css.map' files. I don't know what these are.

src/libtom: Bundled headers from 'libtomcrypt'.  Curiously, I don't see
corresponding '.c' files.

Greetings,
Maxime.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 260 bytes --]

bug#49530: pycryptodome bundles libtomcrypt, fonts, JavaScript and CSS

[Leo Famulari]

On Sun, Jul 11, 2021 at 11:17:03PM +0200, Maxime Devos wrote:
> src/libtom: Bundled headers from 'libtomcrypt'.  Curiously, I don't see
> corresponding '.c' files.

Libtomcrypt is commonly embedded into other programs. For example, our
Dropbear package contained a modified copy of it for a long time, until
commit f72ff06ef8a83a78ad625fe50ee5bb618ea4f37c.

It may be that it can be used as a "headers only" library.

bug#49530: pycryptodome bundles libtomcrypt, fonts, JavaScript and CSS

[Maxime Devos]

[-- Attachment #1: Type: text/plain, Size: 670 bytes --]

Leo Famulari schreef op zo 11-07-2021 om 19:07 [-0400]:
> On Sun, Jul 11, 2021 at 11:17:03PM +0200, Maxime Devos wrote:
> > src/libtom: Bundled headers from 'libtomcrypt'.  Curiously, I don't see
> > corresponding '.c' files.
> 
> Libtomcrypt is commonly embedded into other programs. For example, our
> Dropbear package contained a modified copy of it for a long time, until
> commit f72ff06ef8a83a78ad625fe50ee5bb618ea4f37c.
> 
> It may be that it can be used as a "headers only" library.

It turns out there is a C file after all: tomcrypt_des.c.
I sent a patch (https://issues.guix.gnu.org/49543) to unbundle
it and the headers.

Greetings,
Maxime.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 260 bytes --]