Merge pull request #1170 from JuliaLang/mbedtls

Replace MbedTLS with SHA.jl and bump version

Author: JamesWrigley

Project.toml

@@ -1,6 +1,6 @@
 name = "IJulia"
 uuid = "7073ff75-c697-5162-941a-fcdaad2a7d2a"
-version = "1.29.0"
+version = "1.29.1"
 
 [deps]
 Base64 = "2a0f44e3-6c83-55bd-87e4-b1978d98bd5f"
@@ -10,11 +10,11 @@ InteractiveUtils = "b77e0a4c-d291-57a0-90e8-8db25a27a240"
 JSON = "682c06a0-de6a-54ab-a142-c8b1cf79cde6"
 Logging = "56ddb016-857b-54e1-b83d-db4d58db5568"
 Markdown = "d6f4376e-aef5-505a-96c1-9c027394607a"
-MbedTLS = "739be429-bea8-5141-9913-cc70e7f3736d"
 Pkg = "44cfe95a-1eb2-52ea-b672-e2afdf69b78f"
 Printf = "de0858da-6303-5e67-8744-51eddeeeb8d7"
 REPL = "3fa0cd96-eef1-5676-8a61-b3b8758bbffb"
 Random = "9a3f8284-a2c9-5f02-9a11-845980a1fd5c"
+SHA = "ea8e919c-243c-51af-8825-aaa63cd721ce"
 SoftGlobalScope = "b85f4697-e234-5449-a836-ec8e2f98b302"
 UUIDs = "cf7118a7-6976-5b1a-9a39-7adc72f591a4"
 ZMQ = "c2297ded-f4af-51ae-bb23-16f91089e4e1"
@@ -27,11 +27,11 @@ InteractiveUtils = "1"
 JSON = "0.18,0.19,0.20,0.21,1"
 Logging = "1"
 Markdown = "1"
-MbedTLS = "0.5,0.6,0.7,1"
 Pkg = "1"
 Printf = "1"
 REPL = "1"
 Random = "1"
+SHA = "0.7, 1"
 SoftGlobalScope = "1"
 UUIDs = "1"
 ZMQ = "1.3"

docs/src/_changelog.md

@@ -7,11 +7,14 @@ CurrentModule = IJulia
 This documents notable changes in IJulia.jl. The format is based on [Keep a
 Changelog](https://keepachangelog.com).
 
-## Unreleased
+## [v1.29.1] - 2025-07-26
 
 ### Changed
 - Improved the token-finding functionality to return more accurate tooltips when
   Shift + Tab is pressed ([#847]).
+- IJulia switched from using MbedTLS.jl to the SHA.jl stdlib. This should not
+  change anything for users except that now only SHA message digests are
+  supported instead of e.g. MD5, and Jupyter uses SHA256 by default ([#1170]).
 
 ## [v1.29.0] - 2025-06-13
 

src/IJulia.jl

@@ -33,6 +33,7 @@ The `IJulia` module is used in three ways
 module IJulia
 export notebook, jupyterlab, installkernel
 
+import SHA
 using ZMQ, JSON, SoftGlobalScope
 import Base.invokelatest
 import Dates

src/hmac.jl

@@ -1,24 +1,16 @@
-using MbedTLS
-const hmacstate = Ref{MbedTLS.MD{true}}()
+const sha_ctx = Ref{SHA.SHA_CTX}()
+const hmac_key = Ref{Vector{UInt8}}()
 
-function hmac(s1,s2,s3,s4)
-    if !isdefined(hmacstate, :x)
+function hmac(s1, s2, s3, s4)
+    if !isassigned(sha_ctx)
         return ""
     else
-        MbedTLS.reset!(hmacstate[])
+        hmac = SHA.HMAC_CTX(copy(sha_ctx[]), hmac_key[])
         for s in (s1, s2, s3, s4)
-            write(hmacstate[], s)
+            SHA.update!(hmac, codeunits(s))
         end
-        # Take the digest (returned as a byte array) and convert it to hex string representation
-        digest = MbedTLS.finish!(hmacstate[])
-        hexdigest = Vector{UInt8}(undef, length(digest)*2)
-        for i = 1:length(digest)
-            b = digest[i]
-            d = b >> 4
-            hexdigest[2i-1] = UInt8('0')+d+39*(d>9)
-            d = b & 0xf
-            hexdigest[2i] = UInt8('0')+d+39*(d>9)
-        end
-        return String(hexdigest)
+
+        digest = SHA.digest!(hmac)
+        return bytes2hex(digest)
     end
 end

src/init.jl

@@ -85,10 +85,13 @@ function init(args)
         isempty(signature_scheme) && (signature_scheme = "hmac-sha256")
         sigschm = split(signature_scheme, "-")
         if sigschm[1] != "hmac" || length(sigschm) != 2
-            error("unrecognized signature_scheme $signature_scheme")
+            error("Unrecognized signature_scheme: $(signature_scheme)")
+        elseif !startswith(sigschm[2], "sha")
+            error("Signature schemes other than SHA are not supported on IJulia anymore, requested signature_scheme is: $(signature_scheme)")
         end
-        hmacstate[] = MbedTLS.MD(getfield(MbedTLS, Symbol("MD_", uppercase(sigschm[2]))),
-                                 profile["key"])
+
+        global sha_ctx[] = getproperty(SHA, Symbol(uppercase(sigschm[2]), "_CTX"))()
+        global hmac_key[] = collect(UInt8, profile["key"])
     end
 
     publish[] = Socket(PUB)