Introduce signing guile-ssh functions.

[nicolas-graves]

This is corresponding to the current https://gitlab.com/libssh/libssh-mirror/-/merge_requests/536 (not merged yet, but I expect that to be soon enough).

Here's a usage example :

(use-modules (ssh key)
             (srfi srfi-26)
             (ice-9 textual-ports))

(define (public-keys-equal? pub1 pub2)
  (string=? (public-key->string pub1)
            (public-key->string pub2)))

(define rsakey (private-key-from-file "tests/keys/rsakey"))
(define test-string "Test input\0string")

(call-with-output-file "/tmp/message.sig"
  (cut format <> (sign test-string rsakey)))

(and=>
 (verify
  "Test input\0string"
  ;; "not a signature"
  (call-with-input-file "/tmp/message.sig" get-string-all))
 (cut public-keys-equal? rsakey <>))

[nicolas-graves]

@artyom-poptsov The first commit can already be reviewed/merged, see https://codeberg.org/guix/guix/issues/113 for the reason why it's required.

[nicolas-graves]

@artyom-poptsov It's been merged upstream! Next steps here?

[artyom-poptsov]

Thanks for your contribution! Sorry, I was busy with other tasks so forgot about you pull request.

I checked your changes locally and saw some compilation errors. I'm building this with libssh 0.10, so I suppose the new functionality shouldn't work anyway. However, we need to make sure that Guile-SSH builds with older libssh verisons as well. So, in case of your changes, we need to issue a warning from configure script about lack of signing functionality when older libssh version is used, but other parts of Guile-SSH must work nevertheless.

$ make -j25
Making all in build-aux
make[1]: Entering directory '/home/avp/src/projects/guile-ssh/build-aux'
Making all in am
make[2]: Entering directory '/home/avp/src/projects/guile-ssh/build-aux/am'
make[2]: Nothing to be done for 'all'.
make[2]: Leaving directory '/home/avp/src/projects/guile-ssh/build-aux/am'
Making all in m4
make[2]: Entering directory '/home/avp/src/projects/guile-ssh/build-aux/m4'
make[2]: Nothing to be done for 'all'.
make[2]: Leaving directory '/home/avp/src/projects/guile-ssh/build-aux/m4'
make[2]: Entering directory '/home/avp/src/projects/guile-ssh/build-aux'
make[2]: Nothing to be done for 'all-am'.
make[2]: Leaving directory '/home/avp/src/projects/guile-ssh/build-aux'
make[1]: Leaving directory '/home/avp/src/projects/guile-ssh/build-aux'
Making all in libguile-ssh
make[1]: Entering directory '/home/avp/src/projects/guile-ssh/libguile-ssh'
  GEN      auth.x
  GEN      channel-func.x
  GEN      channel-type.x
  GEN      error.x
  GEN      key-func.x
  GEN      key-type.x
  GEN      log.x
  GEN      message-func.x
  GEN      message-type.x
  GEN      server-func.x
  GEN      server-type.x
  GEN      session-func.x
  GEN      session-type.x
  GEN      sftp-file-type.x
  GEN      sftp-dir-type.x
  GEN      sftp-dir-func.x
  GEN      sftp-session-func.x
  GEN      sftp-session-type.x
  GEN      version.x
make  all-am
make[2]: Entering directory '/home/avp/src/projects/guile-ssh/libguile-ssh'
  CC       libguile_ssh_la-callbacks.lo
  CC       libguile_ssh_la-auth.lo
  CC       libguile_ssh_la-channel-func.lo
  CC       libguile_ssh_la-channel-type.lo
  CC       libguile_ssh_la-channel-main.lo
  CC       libguile_ssh_la-error.lo
  CC       libguile_ssh_la-key-func.lo
  CC       libguile_ssh_la-key-main.lo
  CC       libguile_ssh_la-key-type.lo
  CC       libguile_ssh_la-session-func.lo
  CC       libguile_ssh_la-session-type.lo
  CC       libguile_ssh_la-server-main.lo
  CC       libguile_ssh_la-session-main.lo
  CC       libguile_ssh_la-server-func.lo
  CC       libguile_ssh_la-server-type.lo
  CC       libguile_ssh_la-message-type.lo
  CC       libguile_ssh_la-message-func.lo
  CC       libguile_ssh_la-message-main.lo
  CC       libguile_ssh_la-version.lo
  CC       libguile_ssh_la-threads.lo
  CC       libguile_ssh_la-common.lo
  CC       libguile_ssh_la-log.lo
  CC       libguile_ssh_la-sftp-session-type.lo
  CC       libguile_ssh_la-sftp-session-main.lo
  CC       libguile_ssh_la-sftp-session-func.lo
  CC       libguile_ssh_la-sftp-file-type.lo
  CC       libguile_ssh_la-sftp-file-main.lo
channel-func.c: In function 'guile_ssh_channel_listen_forward':
channel-func.c:420:3: warning: 'ssh_forward_listen' is deprecated [-Wdeprecated-declarations]
  420 |   res = ssh_forward_listen (sd->ssh_session,
      |   ^~~
In file included from channel-func.c:24:
/home/avp/.guix-profile/include/libssh/libssh.h:553:31: note: declared here
  553 | SSH_DEPRECATED LIBSSH_API int ssh_forward_listen(ssh_session session, const char *address, int port, int *bound_port);
      |                               ^~~~~~~~~~~~~~~~~~
channel-func.c: In function 'guile_ssh_channel_accept_forward':
channel-func.c:450:3: warning: 'ssh_channel_accept_forward' is deprecated [-Wdeprecated-declarations]
  450 |   c_channel = ssh_channel_accept_forward (sd->ssh_session,
      |   ^~~~~~~~~
/home/avp/.guix-profile/include/libssh/libssh.h:517:39: note: declared here
  517 | SSH_DEPRECATED LIBSSH_API ssh_channel ssh_channel_accept_forward(ssh_session session,
      |                                       ^~~~~~~~~~~~~~~~~~~~~~~~~~
message-func.c: In function 'get_auth_req':
message-func.c:298:3: warning: 'ssh_message_auth_password' is deprecated [-Wdeprecated-declarations]
  298 |   const char *password = ssh_message_auth_password (msg);
      |   ^~~~~
In file included from message-func.c:25:
/home/avp/.guix-profile/include/libssh/server.h:302:39: note: declared here
  302 | SSH_DEPRECATED LIBSSH_API const char *ssh_message_auth_password(ssh_message msg);
      |                                       ^~~~~~~~~~~~~~~~~~~~~~~~~
message-func.c:299:3: warning: 'ssh_message_auth_pubkey' is deprecated [-Wdeprecated-declarations]
  299 |   ssh_key public_key   = ssh_message_auth_pubkey (msg);
      |   ^~~~~~~
/home/avp/.guix-profile/include/libssh/server.h:320:35: note: declared here
  320 | SSH_DEPRECATED LIBSSH_API ssh_key ssh_message_auth_pubkey(ssh_message msg);
      |                                   ^~~~~~~~~~~~~~~~~~~~~~~
channel-func.c: In function 'guile_ssh_channel_cancel_forward':
channel-func.c:481:3: warning: 'ssh_forward_cancel' is deprecated [-Wdeprecated-declarations]
  481 |   res = ssh_forward_cancel (sd->ssh_session,
      |   ^~~
/home/avp/.guix-profile/include/libssh/libssh.h:552:31: note: declared here
  552 | SSH_DEPRECATED LIBSSH_API int ssh_forward_cancel(ssh_session session, const char *address, int port);
      |                               ^~~~~~~~~~~~~~~~~~
message-func.c:315:35: warning: 'ssh_message_auth_publickey_state' is deprecated [-Wdeprecated-declarations]
  315 |                                   (int) ssh_message_auth_publickey_state (msg));
      |                                   ^
/home/avp/.guix-profile/include/libssh/server.h:325:54: note: declared here
  325 | SSH_DEPRECATED LIBSSH_API enum ssh_publickey_state_e ssh_message_auth_publickey_state(ssh_message msg);
      |                                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
message-func.c: In function 'get_pty_req':
message-func.c:327:3: warning: 'ssh_message_channel_request_pty_term' is deprecated [-Wdeprecated-declarations]
  327 |   const char *term = ssh_message_channel_request_pty_term (msg);
      |   ^~~~~
/home/avp/.guix-profile/include/libssh/server.h:356:39: note: declared here
  356 | SSH_DEPRECATED LIBSSH_API const char *ssh_message_channel_request_pty_term(ssh_message msg);
      |                                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
message-func.c:328:3: warning: 'ssh_message_channel_request_pty_width' is deprecated [-Wdeprecated-declarations]
  328 |   int w   = ssh_message_channel_request_pty_width (msg);
      |   ^~~
/home/avp/.guix-profile/include/libssh/server.h:357:31: note: declared here
  357 | SSH_DEPRECATED LIBSSH_API int ssh_message_channel_request_pty_width(ssh_message msg);
      |                               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
message-func.c:329:3: warning: 'ssh_message_channel_request_pty_height' is deprecated [-Wdeprecated-declarations]
  329 |   int h   = ssh_message_channel_request_pty_height (msg);
      |   ^~~
/home/avp/.guix-profile/include/libssh/server.h:358:31: note: declared here
  358 | SSH_DEPRECATED LIBSSH_API int ssh_message_channel_request_pty_height(ssh_message msg);
      |                               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
message-func.c:330:3: warning: 'ssh_message_channel_request_pty_pxwidth' is deprecated [-Wdeprecated-declarations]
  330 |   int pxw = ssh_message_channel_request_pty_pxwidth (msg);
      |   ^~~
/home/avp/.guix-profile/include/libssh/server.h:359:31: note: declared here
  359 | SSH_DEPRECATED LIBSSH_API int ssh_message_channel_request_pty_pxwidth(ssh_message msg);
      |                               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
message-func.c:331:3: warning: 'ssh_message_channel_request_pty_pxheight' is deprecated [-Wdeprecated-declarations]
  331 |   int pxh = ssh_message_channel_request_pty_pxheight (msg);
      |   ^~~
/home/avp/.guix-profile/include/libssh/server.h:360:31: note: declared here
  360 | SSH_DEPRECATED LIBSSH_API int ssh_message_channel_request_pty_pxheight(ssh_message msg);
      |                               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
key-func.c:490:15: error: 'SSHSIG_DIGEST_SHA2_256' undeclared here (not in a function)
  490 |   { "sha256", SSHSIG_DIGEST_SHA2_256 },
      |               ^~~~~~~~~~~~~~~~~~~~~~
  CC       libguile_ssh_la-sftp-dir-type.lo
key-func.c:491:15: error: 'SSHSIG_DIGEST_SHA2_512' undeclared here (not in a function)
  491 |   { "sha512", SSHSIG_DIGEST_SHA2_512 },
      |               ^~~~~~~~~~~~~~~~~~~~~~
  CC       libguile_ssh_la-sftp-dir-func.lo
  CC       libguile_ssh_la-sftp-dir-main.lo
key-func.c: In function 'guile_ssh_sign':
key-func.c:530:9: error: implicit declaration of function 'sshsig_sign' [-Wimplicit-function-declaration]
  530 |   res = sshsig_sign (data, data_len, kd->ssh_key, c_sig_namespace,
      |         ^~~~~~~~~~~
key-func.c: In function 'guile_ssh_verify':
key-func.c:578:9: error: implicit declaration of function 'sshsig_verify' [-Wimplicit-function-declaration]
  578 |   res = sshsig_verify (data, data_len, c_signature, c_sig_namespace, &sign_key);
      |         ^~~~~~~~~~~~~
make[2]: *** [Makefile:701: libguile_ssh_la-key-func.lo] Error 1
make[2]: *** Waiting for unfinished jobs....
make[2]: Leaving directory '/home/avp/src/projects/guile-ssh/libguile-ssh'
make[1]: *** [Makefile:509: all] Error 2
make[1]: Leaving directory '/home/avp/src/projects/guile-ssh/libguile-ssh'
make: *** [Makefile:437: all-recursive] Error 1

[nicolas-graves]

@artyom-poptsov I've updated the PR so that it works with libssh@0.11 and 0.10. It doesn't work with 0.9, but I'm not sure this is related to the changes I've introduced.

It's too late to accept the github invitation you sent me, sorry I didn't see that when you sent it.

[nicolas-graves]

I added two more unittests and documentation in this latest revision. I haven't tried building documentation.

[artyom-poptsov]

It's too late to accept the github invitation you sent me, sorry I didn't see that when you sent it.

Hello. I've sent you another invitation.

[nicolas-graves]

... and the documentation seems to fail building... I'll look into it.

[nicolas-graves]

(Note to myself)

In a way, the failures experimented in the CI checks have not that much to do with our changes, because I checked that for 0-9 and 0-11, the issue in the libssh rather than the guile-ssh package. This means that the guix.scm file should be corrected, but this is out of the scope of this MR.

That said, failures in 0-8-0 and 0-8-1 should be handled here.

[artyom-poptsov]

I think we should disable procedures that require newer version of libssh using conditional compilation to ensure that Guile-SSH is backward compatible with older versions of libssh.

[nicolas-graves]

@artyom-poptsov Yep, I've done that properly, they are.

Anyway, I think I have a working branch to fix compilation on 0.8.1, but I also see

    You are using an old version of libssh;
    some Guile-SSH API may not work properly.
    Please upgrade as soon as possible.
    Support for libssh versions older than 0.8.3
    will be dropped in the future Guile-SSH
    releases.

which I understand as it's not worth pushing it if we're going to drop it just after that, in the same release?

[nicolas-graves]

The compatibility with libssh 0.8.0 is fatally flawed, as in config.log, I have checking for libssh >= 0.8.0... no so the macro flag is not functional.