package.sgl — sigil-crypto

1;;; sigil-crypto - Cryptographic Functions

2;;;

3;;; Provides cryptographic primitives using mbedTLS:

4;;; - SHA-1 and SHA-256 hashing

5;;; - HMAC-SHA1 / HMAC-SHA256 / HMAC-SHA512

6;;; - PBKDF2-SHA1 / PBKDF2-SHA256 / PBKDF2-SHA512 key derivation

7;;; - HKDF-SHA256 (RFC 5869) key derivation

8;;; - ECDSA P-256 sign + verify + keygen (JOSE/ES256 format)

9;;; - ECDH P-256 shared-secret derivation

10;;; - AES-128-GCM authenticated encryption

11;;; - Base64 + base64url (RFC 4648 § 5) encoding/decoding

12;;; - Cryptographically secure random bytes

13;;;

14;;; and, using the vendored Monocypher (vendor/MONOCYPHER.md):

15;;; - Ed25519 (RFC 8032) verify, sign and public-key derivation

16;;; - BLAKE2b-512

17;;; - minisign public keys and signatures, (sigil crypto minisign)

18;;;

19;;; This package vendors mbedTLS and can be used independently of TLS.

20;;;

21;;; On wasm targets only the Monocypher half is built: Mbed TLS needs an

22;;; entropy source, sockets and a clock that the wasm build does not provide

23;;; yet (t-8c222f), and the Mbed TLS-backed procedures raise "not available

24;;; on wasm" there.

26;; skip-on-wasm wraps a build step so it is a no-op on wasm/wasi targets.

27;; run-steps threads each step's return value as the ctx for the next step,

28;; so a skipped step must return ctx unchanged. Same shape as sigil-audio.

29(let ((skip-on-wasm

30 (lambda (step)

31 (lambda (ctx)

32 (if (memq (target-os ctx) '(wasm wasi))

33 ctx

34 (step ctx))))))

35 (package

36 name: "sigil-crypto"

37 version: "0.16.7"

38 sigil: "0.20"

  description: "Cryptographic functions for Sigil (SHA, HMAC, ECDSA, ECDH, AES-GCM, HKDF, Ed25519, BLAKE2b, minisign, base64, random)"

40 url: "https://codeberg.org/sigil/sigil-crypto"

41 license: "BSD-3-Clause"

42 authors: (list "David Wilson <[email protected]>")

44 dependencies: (list

45 ;; Explicit sigil-lib pin: overrides the extraction-era implicit

46 ;; sigil-stdlib/sigil-lib (^0.15 from the retired sigil-lang repo) that

47 ;; the reintegrated monorepo test-runner chain would otherwise derive.

48 ;;

49 ;; Was ^0.17, justified as "sigil-crypto's native codegen needs the 0.17

50 ;; runtime headers to build libsigil-crypto.a". Measured 2026-08-24 on

51 ;; host sigil 0.19.2, two isolated trees differing only in these pins:

52 ;; libsigil-crypto.a builds BOTH ways (5891408 B at ^0.17, 5891528 B at

53 ;; ^0.19). The reason had expired. See

54 ;; topics/sigil-crypto-017-pin-does-not-protect-native-codegen.

55 (from-git url: "codeberg:sigil/sigil"

56 package: "sigil-lib" version: ">=0.21"))

58 ;; sigil-test + sigil-test-runner are required as dev-deps so

59 ;; `sigil test` can build a test-harness binary that statically

60 ;; links sigil-crypto's native init function. The harness imports

61 ;; (sigil test cli) from sigil-test-runner. Without these the host

62 ;; sigil binary's bundled (and potentially stale) `(sigil crypto).sgb`

63 ;; would be used instead of the local source, causing newer bindings

64 ;; to surface as `unbound variable`.

65 ;;

66 ;; They must track the host runtime. At ^0.17 they resolved to

67 ;; sigil-test-runner 0.17.17, whose core.sgb is bytecode v10, and a 0.19

68 ;; host emits v11: `sigil test` died with "unsupported bytecode version 11

69 ;; (expected 10)" before running anything. At ^0.19: 100/100 pass.

70 dev-dependencies: (list

71 (from-git url: "codeberg:sigil/sigil" package: "sigil-test" version: ">=0.21")

72 (from-git url: "codeberg:sigil/sigil" package: "sigil-test-runner" version: ">=0.21"))

74 ;; Native library definition. sigil-build reads c-sources as a "has native

75 ;; code" test and for the include dirs; the build task below compiles the

76 ;; real, target-dependent list.

77 libraries: (list

78 (library

79 name: 'sigil-crypto

80 c-sources: '("native/crypto.c"

81 "native/ed25519.c"

82 "native/ed25519-verify.c"

83 "vendor/monocypher/src/monocypher.c"

84 "vendor/monocypher/src/optional/monocypher-ed25519.c"

85 "vendor/mbedtls/library/*.c")

86 c-include-dirs: '("vendor/mbedtls/include"

87 "vendor/mbedtls"

88 "vendor/monocypher/src"

89 "vendor/monocypher/src/optional")

90 c-flags: '("-DMBEDTLS_CONFIG_FILE=\"sigil_mbedtls_config.h\"")

91 native-init: "sigil__init_sigil_crypto_module"))

93 tasks: (list

94 (task

95 name: 'build

96 description: "Build the sigil-crypto native library"

97 steps: (list

98 ;; Compile mbedTLS library with our minimal config

99 ;; Shared TLS 1.2/1.3 client configuration, including PSA prerequisites.

100 ;; Not on wasm: three of its units #error there (t-8c222f).

101 (skip-on-wasm (compile-c-sources

102 sources: "vendor/mbedtls/library/*.c"

103 include-dirs: '("vendor/mbedtls/include"

104 "vendor/mbedtls")

105 flags: '("-std=c99"

106 "-Wall" "-Wno-unused-function"

107 "-DMBEDTLS_CONFIG_FILE=\"sigil_mbedtls_config.h\"")))

108

109 ;; Compile vendored Monocypher (unmodified upstream 4.0.3) on every

110 ;; target. Plain C99 with no platform calls.

111 (compile-c-sources

112 sources: '("vendor/monocypher/src/monocypher.c"

113 "vendor/monocypher/src/optional/monocypher-ed25519.c")

114 include-dirs: '("vendor/monocypher/src"

115 "vendor/monocypher/src/optional")

116 flags: '("-std=c99" "-Wall" "-Wextra"))

117

118 ;; Compile crypto.c and ed25519.c

119 ;; Flags go through with-sigil-c-flags so the build system injects

120 ;; -I<sigil-lib>/include + -I<sigil-lib>/src. crypto.c's

121 ;; #include <sigil/sigil.h> resolves via that auto-injection.

122 (compile-c-sources

123 sources: '("native/crypto.c"

124 "native/ed25519.c"

125 "native/ed25519-verify.c")

126 include-dirs: '("vendor/mbedtls/include"

127 "vendor/mbedtls"

128 "vendor/monocypher/src"

129 "vendor/monocypher/src/optional")

130 flags: (with-sigil-c-flags '("-std=c99"

131 "-Wall" "-Wextra"

132 "-Wno-unused-parameter"

133 "-D_GNU_SOURCE"

134 "-DMBEDTLS_CONFIG_FILE=\"sigil_mbedtls_config.h\"")))

135

136 ;; Create static library

137 (create-static-library

138 name: "sigil-crypto")

139

140 ;; Compile Scheme module

141 (compile-sigil-modules

142 sources: "src/**/*.sgl"))))))