Merge lp:~dave-cheney/juju-core/179-remove-thirdparty-pbkdf2-dependency into lp:~go-bot/juju-core/trunk

[Dave Cheney]

Remove thirdparty/pbkdf2

In preparation for the migration to github remove the private copy of pbkdf2.

It is probable that when this package was added, somewhere around 18 months ago, we did not have godeps or a established way of managing dependencies, so vendoring the package made sense at the time.

The only differences between our privat copy and the upstream is our inclusion of our note that the package is a fork.

Remove thirdparty/pbkdf2

In preparation for the migration to github remove the private copy of pbkdf2.

It is probable that when this package was added, somewhere around 18 months ago, we did not have godeps or a established way of managing dependencies, so vendoring the package made sense at the time.

The only differences between our privat copy and the upstream is our inclusion of our note that the package is a fork.

ubuntu@winton-02:~$ diff -u ~/src/launchpad.net/juju-core/thirdparty/pbkdf2/pbkdf2.go /home/ubuntu/src/code.google.com/p/go.crypto/pbkdf2/pbkdf2.go
--- /home/ubuntu/src/launchpad.net/juju-core/thirdparty/pbkdf2/pbkdf2.go 2014-05-21 00:46:49.130817000 +0000
+++ /home/ubuntu/src/code.google.com/p/go.crypto/pbkdf2/pbkdf2.go 2014-05-21 00:46:54.275885894 +0000
@@ -1,5 +1,3 @@
-// Original package at code.google.com/p/go.crypto/pbkdf2
-
 // Copyright 2012 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
ubuntu@winton-02:~$ diff -u ~/src/launchpad.net/juju-core/thirdparty/pbkdf2/pbkdf2_test.go /home/ubuntu/src/code.google.com/p/go.crypto/pbkdf2/pbkdf2_test.go

https://codereview.appspot.com/98460044/

[Dave Cheney (dave-cheney)]

Reviewers: mp+220341_code.launchpad.net,

Message:
Please take a look.

Description:
Remove thirdparty/pbkdf2

In preparation for the migration to github remove the private copy of
pbkdf2.

It is probable that when this package was added, somewhere around 18
months ago, we did not have godeps or a established way of managing
dependencies, so vendoring the package made sense at the time.

The only differences between our privat copy and the upstream is our
inclusion of our note that the package is a fork.

ubuntu@winton-02:~$ diff -u
~/src/launchpad.net/juju-core/thirdparty/pbkdf2/pbkdf2.go
/home/ubuntu/src/code.google.com/p/go.crypto/pbkdf2/pbkdf2.go
--- /home/ubuntu/src/launchpad.net/juju-core/thirdparty/pbkdf2/pbkdf2.go
        2014-05-21 00:46:49.130817000 +0000
+++ /home/ubuntu/src/code.google.com/p/go.crypto/pbkdf2/pbkdf2.go
2014-05-21 00:46:54.275885894 +0000
@@ -1,5 +1,3 @@
-// Original package at code.google.com/p/go.crypto/pbkdf2
-
  // Copyright 2012 The Go Authors. All rights reserved.
  // Use of this source code is governed by a BSD-style
  // license that can be found in the LICENSE file.
ubuntu@winton-02:~$ diff -u
~/src/launchpad.net/juju-core/thirdparty/pbkdf2/pbkdf2_test.go
/home/ubuntu/src/code.google.com/p/go.crypto/pbkdf2/pbkdf2_test.go

https://code.launchpad.net/~dave-cheney/juju-core/179-remove-thirdparty-pbkdf2-dependency/+merge/220341

Requires:
https://code.launchpad.net/~dave-cheney/juju-core/178-update-errgo-and-loggo-dependencies/+merge/220340

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/98460044/

Affected files (+3, -237 lines):
   A [revision details]
   D thirdparty/pbkdf2/pbkdf2.go
   D thirdparty/pbkdf2/pbkdf2_test.go
   M utils/password.go

[Andrew Wilkins (axwalk)]

On 2014/05/21 01:33:16, dfc wrote:
> Please take a look.

LGTM

https://codereview.appspot.com/98460044/

[Ian Booth (wallyworld)]

review: Approve

[Go Bot (go-bot)]

The attempt to merge lp:~dave-cheney/juju-core/179-remove-thirdparty-pbkdf2-dependency into lp:juju-core failed. Below is the output from the failed tests.

ok launchpad.net/juju-core 0.011s
ok launchpad.net/juju-core/agent 0.902s
ok launchpad.net/juju-core/agent/mongo 0.477s
ok launchpad.net/juju-core/agent/tools 0.166s
ok launchpad.net/juju-core/bzr 5.421s
ok launchpad.net/juju-core/cert 2.031s
ok launchpad.net/juju-core/charm 0.423s
? launchpad.net/juju-core/charm/hooks [no test files]
? launchpad.net/juju-core/charm/testing [no test files]
ok launchpad.net/juju-core/cloudinit 0.134s
ok launchpad.net/juju-core/cloudinit/sshinit 0.709s

----------------------------------------------------------------------
FAIL: package_test.go:20: Dependencies.TestPackageDependencies

package_test.go:26:
    // This test is to ensure we don't bring in dependencies without thinking.
    // Looking at the "environs/config", it is just for JujuHome. This should
    // really be moved into "juju/osenv".
    c.Assert(testbase.FindJujuCoreImports(c, "launchpad.net/juju-core/cmd"),
        gc.DeepEquals,
        []string{"juju/arch", "juju/osenv", "names", "thirdparty/pbkdf2", "utils", "version"})
... obtained []string = []string{"juju/arch", "juju/osenv", "names", "utils", "version"}
... expected []string = []string{"juju/arch", "juju/osenv", "names", "thirdparty/pbkdf2", "utils", "version"}

OOPS: 57 passed, 1 FAILED
--- FAIL: Test (0.02 seconds)
FAIL
FAIL launchpad.net/juju-core/cmd 0.153s
ok launchpad.net/juju-core/cmd/charm-admin 0.236s
? launchpad.net/juju-core/cmd/charmd [no test files]
? launchpad.net/juju-core/cmd/charmload [no test files]
ok launchpad.net/juju-core/cmd/envcmd 0.163s
ok launchpad.net/juju-core/cmd/juju 224.318s
ok launchpad.net/juju-core/cmd/jujud 67.173s
ok launchpad.net/juju-core/cmd/plugins/juju-metadata 10.599s
? launchpad.net/juju-core/cmd/plugins/juju-restore [no test files]
ok launchpad.net/juju-core/cmd/plugins/local 0.160s
? launchpad.net/juju-core/cmd/plugins/local/juju-local [no test files]
ok launchpad.net/juju-core/constraints 0.023s
ok launchpad.net/juju-core/container 0.167s
ok launchpad.net/juju-core/container/factory 0.155s
ok launchpad.net/juju-core/container/kvm 0.180s
ok launchpad.net/juju-core/container/kvm/mock 0.149s
? launchpad.net/juju-core/container/kvm/testing [no test files]
ok launchpad.net/juju-core/container/lxc 4.314s
? launchpad.net/juju-core/container/lxc/mock [no test files]
? launchpad.net/juju-core/container/lxc/testing [no test files]
? launchpad.net/juju-core/container/testing [no test files]
ok launchpad.net/juju-core/downloader 5.223s
ok launchpad.net/juju-core/environs 2.244s
ok launchpad.net/juju-core/environs/bootstrap 12.563s
ok launchpad.net/juju-core/environs/cloudinit 0.443s
ok launchpad.net/juju-core/environs/config 1.640s
ok launchpad.net/juju-core/environs/configstore 0.145s
ok launchpad.net/juju-core/environs/filestorage 0.028s
ok launchpad.net/juju-core/environs/httpstorage 0.629s
ok launchpad.net/juju-core/environs/imagemetadata 0.424s
? launchpad.net/juju-core/environs/imagemetadata/testing ...

[Dave Cheney (dave-cheney)]

Please take a look.

https://codereview.appspot.com/98460044/

=== modified file 'cmd/package_test.go'
--- cmd/package_test.go	2014-05-01 23:32:37 +0000
+++ cmd/package_test.go	2014-05-21 02:36:03 +0000
@@ -23,5 +23,5 @@
 	// really be moved into "juju/osenv".
 	c.Assert(testbase.FindJujuCoreImports(c, "launchpad.net/juju-core/cmd"),
 		gc.DeepEquals,
-		[]string{"juju/arch", "juju/osenv", "names", "thirdparty/pbkdf2", "utils", "version"})
+		[]string{"juju/arch", "juju/osenv", "names", "utils", "version"})
 }

=== removed directory 'thirdparty'
=== removed directory 'thirdparty/pbkdf2'
=== removed file 'thirdparty/pbkdf2/pbkdf2.go'
--- thirdparty/pbkdf2/pbkdf2.go	2012-10-05 14:27:52 +0000
+++ thirdparty/pbkdf2/pbkdf2.go	1970-01-01 00:00:00 +0000
@@ -1,79 +0,0 @@
-// Original package at code.google.com/p/go.crypto/pbkdf2
-
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-/*
-Package pbkdf2 implements the key derivation function PBKDF2 as defined in RFC
-2898 / PKCS #5 v2.0.
-
-A key derivation function is useful when encrypting data based on a password
-or any other not-fully-random data. It uses a pseudorandom function to derive
-a secure encryption key based on the password.
-
-While v2.0 of the standard defines only one pseudorandom function to use,
-HMAC-SHA1, the drafted v2.1 specification allows use of all five FIPS Approved
-Hash Functions SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 for HMAC. To
-choose, you can pass the `New` functions from the different SHA packages to
-pbkdf2.Key.
-*/
-package pbkdf2
-
-import (
-	"crypto/hmac"
-	"hash"
-)
-
-// Key derives a key from the password, salt and iteration count, returning a
-// []byte of length keylen that can be used as cryptographic key. The key is
-// derived based on the method described as PBKDF2 with the HMAC variant using
-// the supplied hash function.
-//
-// For example, to use a HMAC-SHA-1 based PBKDF2 key derivation function, you
-// can get a derived key for e.g. AES-256 (which needs a 32-byte key) by
-// doing:
-//
-// 	dk := pbkdf2.Key([]byte("some password"), salt, 4096, 32, sha1.New)
-//
-// Remember to get a good random salt. At least 8 bytes is recommended by the
-// RFC.
-//
-// Using a higher iteration count will increase the cost of an exhaustive
-// search but will also make derivation proportionally slower.
-func Key(password, salt []byte, iter, keyLen int, h func() hash.Hash) []byte {
-	prf := hmac.New(h, password)
-	hashLen := prf.Size()
-	numBlocks := (keyLen + hashLen - 1) / hashLen
-
-	var buf [4]byte
-	dk := make([]byte, 0, numBlocks*hashLen)
-	U := make([]byte, hashLen)
-	for block := 1; block <= numBlocks; block++ {
-		// N.B.: || means concatenation, ^ means XOR
-		// for each block T_i = U_1 ^ U_2 ^ ... ^ U_iter
-		// U_1 = PRF(password, salt || uint(i))
-		prf.Reset()
-		prf.Write(salt)
-		buf[0] = byte(block >> 24)
-		buf[1] = byte(block >> 16)
-		buf[2] = byte(block >> 8)
-		buf[3] = byte(block)
-		prf.Write(buf[:4])
-		dk = prf.Sum(dk)
-		T := dk[len(dk)-hashLen:]
-		copy(U, T)
-
-		// U_n = PRF(password, U_(n-1))
-		for n := 2; n <= iter; n++ {
-			prf.Reset()
-			prf.Write(U)
-			U = U[:0]
-			U = prf.Sum(U)
-			for x := range U {
-				T[x] ^= U[x]
-			}
-		}
-	}
-	return dk[:keyLen]
-}

=== removed file 'thirdparty/pbkdf2/pbkdf2_test.go'
--- thirdparty/pbkdf2/pbkdf2_test.go	2012-10-05 14:27:52 +0000
+++ thirdparty/pbkdf2/pbkdf2_test.go	1970-01-01 00:00:00 +0000
@@ -1,157 +0,0 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pbkdf2
-
-import (
-	"bytes"
-	"crypto/sha1"
-	"crypto/sha256"
-	"hash"
-	"testing"
-)
-
-type testVector struct {
-	password string
-	salt     string
-	iter     int
-	output   []byte
-}
-
-// Test vectors from RFC 6070, http://tools.ietf.org/html/rfc6070
-var sha1TestVectors = []testVector{
-	{
-		"password",
-		"salt",
-		1,
-		[]byte{
-			0x0c, 0x60, 0xc8, 0x0f, 0x96, 0x1f, 0x0e, 0x71,
-			0xf3, 0xa9, 0xb5, 0x24, 0xaf, 0x60, 0x12, 0x06,
-			0x2f, 0xe0, 0x37, 0xa6,
-		},
-	},
-	{
-		"password",
-		"salt",
-		2,
-		[]byte{
-			0xea, 0x6c, 0x01, 0x4d, 0xc7, 0x2d, 0x6f, 0x8c,
-			0xcd, 0x1e, 0xd9, 0x2a, 0xce, 0x1d, 0x41, 0xf0,
-			0xd8, 0xde, 0x89, 0x57,
-		},
-	},
-	{
-		"password",
-		"salt",
-		4096,
-		[]byte{
-			0x4b, 0x00, 0x79, 0x01, 0xb7, 0x65, 0x48, 0x9a,
-			0xbe, 0xad, 0x49, 0xd9, 0x26, 0xf7, 0x21, 0xd0,
-			0x65, 0xa4, 0x29, 0xc1,
-		},
-	},
-	// // This one takes too long
-	// {
-	// 	"password",
-	// 	"salt",
-	// 	16777216,
-	// 	[]byte{
-	// 		0xee, 0xfe, 0x3d, 0x61, 0xcd, 0x4d, 0xa4, 0xe4,
-	// 		0xe9, 0x94, 0x5b, 0x3d, 0x6b, 0xa2, 0x15, 0x8c,
-	// 		0x26, 0x34, 0xe9, 0x84,
-	// 	},
-	// },
-	{
-		"passwordPASSWORDpassword",
-		"saltSALTsaltSALTsaltSALTsaltSALTsalt",
-		4096,
-		[]byte{
-			0x3d, 0x2e, 0xec, 0x4f, 0xe4, 0x1c, 0x84, 0x9b,
-			0x80, 0xc8, 0xd8, 0x36, 0x62, 0xc0, 0xe4, 0x4a,
-			0x8b, 0x29, 0x1a, 0x96, 0x4c, 0xf2, 0xf0, 0x70,
-			0x38,
-		},
-	},
-	{
-		"pass\000word",
-		"sa\000lt",
-		4096,
-		[]byte{
-			0x56, 0xfa, 0x6a, 0xa7, 0x55, 0x48, 0x09, 0x9d,
-			0xcc, 0x37, 0xd7, 0xf0, 0x34, 0x25, 0xe0, 0xc3,
-		},
-	},
-}
-
-// Test vectors from
-// http://stackoverflow.com/questions/5130513/pbkdf2-hmac-sha2-test-vectors
-var sha256TestVectors = []testVector{
-	{
-		"password",
-		"salt",
-		1,
-		[]byte{
-			0x12, 0x0f, 0xb6, 0xcf, 0xfc, 0xf8, 0xb3, 0x2c,
-			0x43, 0xe7, 0x22, 0x52, 0x56, 0xc4, 0xf8, 0x37,
-			0xa8, 0x65, 0x48, 0xc9,
-		},
-	},
-	{
-		"password",
-		"salt",
-		2,
-		[]byte{
-			0xae, 0x4d, 0x0c, 0x95, 0xaf, 0x6b, 0x46, 0xd3,
-			0x2d, 0x0a, 0xdf, 0xf9, 0x28, 0xf0, 0x6d, 0xd0,
-			0x2a, 0x30, 0x3f, 0x8e,
-		},
-	},
-	{
-		"password",
-		"salt",
-		4096,
-		[]byte{
-			0xc5, 0xe4, 0x78, 0xd5, 0x92, 0x88, 0xc8, 0x41,
-			0xaa, 0x53, 0x0d, 0xb6, 0x84, 0x5c, 0x4c, 0x8d,
-			0x96, 0x28, 0x93, 0xa0,
-		},
-	},
-	{
-		"passwordPASSWORDpassword",
-		"saltSALTsaltSALTsaltSALTsaltSALTsalt",
-		4096,
-		[]byte{
-			0x34, 0x8c, 0x89, 0xdb, 0xcb, 0xd3, 0x2b, 0x2f,
-			0x32, 0xd8, 0x14, 0xb8, 0x11, 0x6e, 0x84, 0xcf,
-			0x2b, 0x17, 0x34, 0x7e, 0xbc, 0x18, 0x00, 0x18,
-			0x1c,
-		},
-	},
-	{
-		"pass\000word",
-		"sa\000lt",
-		4096,
-		[]byte{
-			0x89, 0xb6, 0x9d, 0x05, 0x16, 0xf8, 0x29, 0x89,
-			0x3c, 0x69, 0x62, 0x26, 0x65, 0x0a, 0x86, 0x87,
-		},
-	},
-}
-
-func testHash(t *testing.T, h func() hash.Hash, hashName string, vectors []testVector) {
-	for i, v := range vectors {
-		o := Key([]byte(v.password), []byte(v.salt), v.iter, len(v.output), h)
-		if !bytes.Equal(o, v.output) {
-			t.Errorf("%s %d: expected %x, got %x", hashName, i, v.output, o)
-		}
-	}
-}
-
-func TestWithHMACSHA1(t *testing.T) {
-	testHash(t, sha1.New, "SHA1", sha1TestVectors)
-}
-
-func TestWithHMACSHA256(t *testing.T) {
-	testHash(t, sha256.New, "SHA256", sha256TestVectors)
-}

=== modified file 'utils/fslock/package_test.go'
--- utils/fslock/package_test.go	2014-01-21 05:25:30 +0000
+++ utils/fslock/package_test.go	2014-05-21 02:36:03 +0000
@@ -20,5 +20,5 @@
 func (*Dependencies) TestPackageDependencies(c *gc.C) {
 	// This test is to ensure we don't bring in dependencies without thinking.
 	c.Assert(testbase.FindJujuCoreImports(c, "launchpad.net/juju-core/utils/fslock"),
-		gc.DeepEquals, []string{"juju/osenv", "thirdparty/pbkdf2", "utils"})
+		gc.DeepEquals, []string{"juju/osenv", "utils"})
 }

=== modified file 'utils/password.go'
--- utils/password.go	2013-11-07 09:32:37 +0000
+++ utils/password.go	2014-05-21 02:36:03 +0000
@@ -10,7 +10,7 @@
 	"fmt"
 	"io"
 
-	"launchpad.net/juju-core/thirdparty/pbkdf2"
+	"code.google.com/p/go.crypto/pbkdf2"
 )
 
 // CompatSalt is because Juju 1.16 and older used a hard-coded salt to compute