First working version.

4 files changed, 639 insertions, 4 deletions

diff --git a/aws/cloudformation/utils.scm b/aws/cloudformation/utils.scm
new file mode 100644
index 0000000..e618cf8
--- /dev/null
+++ b/aws/cloudformation/utils.scm
@@ -0,0 +1,277 @@
+(define-module (aws cloudformation utils)
+  #:use-module (aws cloudformation utils base32)
+  #:use-module (aws cloudformation utils sha-1)
+  #:use-module (ice-9 match)
+  #:use-module (oop goops)
+  #:use-module (rnrs bytevectors)
+  #:use-module (srfi srfi-1)
+  #:export (<cloudformation-property>
+            <cloudformation-object>
+            <cloudformation-attribute>
+            <cloudformation-resource>
+            <cloudformation-stack>
+            attributes
+            aws-string->symbol
+            description
+            documentation-url
+            id
+            name
+            outputs
+            parameters
+            primitive-type
+            properties
+            required?
+            resource-name
+            resources
+            to-json
+            type-check
+            type-checker
+            update-type
+            valid?))
+
+(define (aws-string->symbol str)
+  ;; Drop the "AWS::" that's at the beginning of *almost* everything.
+  (let ((str (if (string-prefix? "AWS::" str)
+                 (string-drop str 5)
+                 str)))
+    (list->symbol
+     (let loop ((i 0)
+                (same-word? #t)
+                (slash-delimiter? #f))
+       (cond
+        ((= i (string-length str)) ; end of string
+         '())
+        ;; "IoT" violates all the rules. grrrr
+        ((and (< (+ i 3) (string-length str))
+              (eqv? (string-ref str i) #\I)
+              (eqv? (string-ref str (+ i 1)) #\o)
+              (eqv? (string-ref str (+ i 2)) #\T))
+         (cons* #\i #\o #\t (loop (+ i 3) #f #f)))
+        ;; Replace "." with "/"
+        ((eqv? (string-ref str i) #\.)
+         (cons #\/ (loop (1+ i) #f #t)))
+        ;; Get rid of "::"
+        ((and (eqv? (string-ref str i) #\:)
+              (eqv? (string-ref str (1+ i)) #\:))
+         (loop (+ i 2) #f #f))
+        ((char-upper-case? (string-ref str i)) ; detect camel casing
+         (cond
+          ;; If we've had a string of uppercase characters and the
+          ;; next character is lowercase, we're actually at the
+          ;; beginning of a new word.  For example, when we reach the
+          ;; "I" in "DBInstance" we need to treat it as the beginning
+          ;; of a new word.
+          ((and same-word?
+                (< (1+ i) (string-length str))
+                (char-lower-case? (string-ref str (1+ i))))
+           (loop i #f #f))
+          ;; Consecutive uppercase characters are part of the same word.
+          (same-word?
+           (cons (char-downcase (string-ref str i)) (loop (1+ i) #t #f)))
+          ;; Encountering an uppercase character after a series of
+          ;; non-uppercase characters means that we are at the
+          ;; beginning of a new word.
+          (else
+           (if (or (zero? i) slash-delimiter?)
+               (cons (char-downcase (string-ref str i)) (loop (1+ i) #t #f))
+               (cons* #\- (char-downcase (string-ref str i))
+                      (loop (1+ i) #t #f))))))
+        (else
+         (cons (string-ref str i) (loop (1+ i) #f #f))))))))
+
+(define-class <cloudformation-property> ()
+  (name #:getter name #:init-keyword #:name)
+  (type-checker #:getter type-checker #:init-keyword #:type-checker)
+  (required? #:getter required? #:init-keyword #:required?)
+  (update-type #:getter update-type #:init-keyword #:update-type)
+  (documentation-url #:getter documentation-url
+                     #:init-keyword #:documentation-url))
+
+(define-method (type-check (procedure <procedure>) x)
+  (procedure x))
+
+(define-method (type-check (property <cloudformation-property>) x)
+  ((type-checker property) x))
+
+(define-class <cloudformation-class> (<class>)
+  (properties #:getter properties)
+  (cfn-name #:getter cfn-name)
+  (documentation-url #:getter documentation-url))
+
+(define-method (initialize (cfn-class <cloudformation-class>) args)
+  (define* (slot-cfn-property slot-name #:key cfn-property #:allow-other-keys)
+    (and cfn-property (cons slot-name cfn-property)))
+  (define* (init #:key cfn-name documentation-url slots #:allow-other-keys)
+    (slot-set! cfn-class 'cfn-name cfn-name)
+    (slot-set! cfn-class 'documentation-url documentation-url)
+    (slot-set! cfn-class
+               'properties
+               (filter-map (lambda (slot-args)
+                             (apply slot-cfn-property slot-args))
+                           slots)))
+  (apply init args)
+  (next-method))
+
+(define-class <cloudformation-object> ()
+  #:metaclass <cloudformation-class>)
+
+(define-method (initialize (obj <cloudformation-object>) args)
+  (next-method)
+  ;; Ensure that all required properties have been specified, and that
+  ;; all specified properties pass the type checker.
+  (for-each (match-lambda
+              ((slot-name . prop)
+               (cond
+                ((and (required? prop) (not (slot-bound? obj slot-name)))
+                 (error "required property not specified:" slot-name))
+                ((slot-bound? obj slot-name)
+                 (let ((value (slot-ref obj slot-name)))
+                   (unless (type-check prop value)
+                     (error "wrong type for property:" slot-name value)))))))
+            (slot-ref (class-of obj) 'properties)))
+
+(define-method (cfn-name (obj <cloudformation-object>))
+  (cfn-name (class-of obj)))
+
+(define-method (properties (obj <cloudformation-object>))
+  (slot-ref (class-of obj) 'properties))
+
+(define-method (to-json/refs obj)
+  (to-json obj))
+
+(define-method (to-json (s <string>)) s)
+(define-method (to-json (b <boolean>)) b)
+(define-method (to-json (n <number>)) n)
+(define-method (to-json (p <pair>))
+  (if (pair? (car p))
+      `(@ ,@(map (match-lambda
+                   ((k . v)
+                    (cons k (to-json/refs v))))
+                 p))
+      (cons (to-json/refs (car p)) (to-json (cdr p)))))
+(define-method (to-json (null <null>))
+  '())
+
+(define-method (to-json (obj <cloudformation-object>))
+  (cons '@
+   (filter-map (match-lambda
+                 ((slot-name . property)
+                  (and (slot-bound? obj slot-name)
+                       (cons (name property)
+                             (to-json/refs (slot-ref obj slot-name))))))
+               (properties obj))))
+
+(define-method (valid? (obj <cloudformation-object>))
+  (every (match-lambda
+           ((slot-name . property)
+            (cond
+             ((and (required? property) (not (slot-bound? obj slot-name)))
+              #f)
+             ((not (or (required? property) (slot-bound? obj slot-name)))
+              #t)
+             (else
+              (type-check property (slot-ref obj slot-name))))))
+         (slot-ref (class-of obj) 'properties)))
+
+(define-class <cloudformation-attribute> ()
+  (name #:getter name #:init-keyword #:name)
+  (primitive-type #:getter primitive-type #:init-keyword #:primitive-type))
+
+(define-class <cloudformation-resource-class> (<cloudformation-class>)
+  (resource-name-prefix #:getter resource-name-prefix)
+  (attributes #:getter attributes))
+
+(define-method (initialize (resource-class <cloudformation-resource-class>) args)
+  (define* (init #:key attributes cfn-name #:allow-other-keys)
+    (when cfn-name
+      (slot-set! resource-class 'resource-name-prefix
+                 (string-join (drop (delete "" (string-split cfn-name #\:)) 1)
+                              "")))
+    (slot-set! resource-class 'attributes attributes))
+  (apply init args)
+  (next-method))
+
+(define-class <cloudformation-resource> (<cloudformation-object>)
+  (id #:getter id #:init-keyword #:id)
+  (cfn-id #:getter cfn-id)
+  #:metaclass <cloudformation-resource-class>)
+
+(define char-set:alphanumeric
+  (char-set-intersection char-set:ascii char-set:letter+digit))
+
+(define (alphanumize s)
+  (string-filter char-set:alphanumeric s))
+
+(define (id->cfn-id sym)
+  (string-append (let ((camelized
+                        (string-concatenate
+                         (map (lambda (s)
+                                (string-capitalize (alphanumize s)))
+                              (string-split (symbol->string sym) #\-)))))
+                   (if (> (string-length camelized) 223)
+                       (substring camelized 223)
+                       camelized))
+                 (base32-encode
+                  (sha-1->bytevector
+                   (sha-1
+                    (string->utf8
+                     (symbol->string sym)))))))
+
+(define-method (initialize (resource <cloudformation-resource>) args)
+  (next-method)
+  (unless (slot-bound? resource 'id)
+    (error "no id specified for resource:" resource))
+  (slot-set! resource 'cfn-id (id->cfn-id (id resource))))
+
+(define-method (type-check (proc <procedure>)
+                           (resource <cloudformation-resource>))
+  (type-check proc "arn:dummy"))
+
+(define-method (to-json/refs (resource <cloudformation-resource>))
+  `(@ ("Ref" . ,(cfn-id resource))))
+
+(define-method (to-json (resource <cloudformation-resource>))
+  `(@ ("Type" . ,(cfn-name resource))
+      ("Properties" . ,(next-method))))
+
+(define-class <cloudformation-stack> ()
+  (description #:getter description #:init-keyword #:description #:init-form "")
+  (parameters #:getter parameters #:init-keyword #:parameters)
+  (resources #:getter resources #:init-keyword #:resources)
+  (outputs #:getter outputs #:init-keyword #:outputs))
+
+(define-method (transitive-resources (stack <cloudformation-stack>))
+  (define (scan-object obj)
+    (cond
+     ((is-a? obj <pair>)
+      (match obj
+        ((first rest ...)
+         (concatenate (cons (scan-object first)
+                            (scan-object rest))))
+        ((key . value)
+         (scan-object value))))
+     ((is-a? obj <cloudformation-resource>)
+      (list obj))
+     ((is-a? obj <cloudformation-object>)
+      (scan-properties obj))
+     (else
+      '())))
+  (define (scan-properties obj)
+    (append-map (match-lambda
+                  ((slot-name . prop)
+                   (let ((value (and (slot-bound? obj slot-name)
+                                     (slot-ref obj slot-name))))
+                     (scan-object value))))
+                (properties obj)))
+  (append-map (lambda (resource)
+                (cons resource (scan-properties resource)))
+              (resources stack)))
+
+(define-method (to-json (stack <cloudformation-stack>))
+  `(@ ("AWSTemplateFormatVersion" . "2010-09-09")
+      ("Description" . ,(description stack))
+      ("Resources" .
+       (@ ,@(map (lambda (resource)
+                   (cons (cfn-id resource)
+                         (to-json resource)))
+                 (transitive-resources stack))))))
diff --git a/aws/cloudformation/utils/base32.scm b/aws/cloudformation/utils/base32.scm
new file mode 100644
index 0000000..4a01825
--- /dev/null
+++ b/aws/cloudformation/utils/base32.scm
@@ -0,0 +1,53 @@
+(define-module (aws cloudformation utils base32)
+  #:use-module (rnrs bytevectors)
+  #:use-module (srfi srfi-60)
+  #:export (base32-encode))
+
+;; Credit to Ludovic Courtes
+(define bytevector-quintet-ref
+  (let* ((ref  bytevector-u8-ref)
+         (ref+ (lambda (bv offset)
+                 (let ((o (+ 1 offset)))
+                   (if (>= o (bytevector-length bv))
+                       0
+                       (bytevector-u8-ref bv o)))))
+         (ref0 (lambda (bv offset)
+                 (bit-field (ref bv offset) 3 8)))
+         (ref1 (lambda (bv offset)
+                 (logior (ash (bit-field (ref bv offset) 0 3) 2)
+                         (bit-field (ref+ bv offset) 6 8))))
+         (ref2 (lambda (bv offset)
+                 (bit-field (ref bv offset) 1 6)))
+         (ref3 (lambda (bv offset)
+                 (logior (ash (bit-field (ref bv offset) 0 1) 4)
+                         (bit-field (ref+ bv offset) 4 8))))
+         (ref4 (lambda (bv offset)
+                 (logior (ash (bit-field (ref bv offset) 0 4) 1)
+                         (bit-field (ref+ bv offset) 7 8))))
+         (ref5 (lambda (bv offset)
+                 (bit-field (ref bv offset) 2 7)))
+         (ref6 (lambda (bv offset)
+                 (logior (ash (bit-field (ref bv offset) 0 2) 3)
+                         (bit-field (ref+ bv offset) 5 8))))
+         (ref7 (lambda (bv offset)
+                 (bit-field (ref bv offset) 0 5)))
+         (refs (vector ref0 ref1 ref2 ref3 ref4 ref5 ref6 ref7)))
+    (lambda (bv index)
+      "Return the INDEXth quintet of BV."
+      (let ((p (vector-ref refs (modulo index 8))))
+        (p bv (quotient (* index 5) 8))))))
+
+(define (base32-encode bv)
+  ;; We are assuming that the bytevector length is divisible by 5,
+  ;; because that is the case for SHA-1 hashes. A general-purpose
+  ;; base32 encoder would need to pad the bytevector when this is not
+  ;; the case.
+  (let* ((alphabet "0123456789ABCDEFGHJKMNPQRSTVWXYZ")
+         (n (/ (* (bytevector-length bv) 8) 5))
+         (s (make-string n)))
+    (let loop ((i 0))
+      (when (< i n)
+        (let ((x (bytevector-quintet-ref bv i)))
+          (string-set! s i (string-ref alphabet x))
+          (loop (+ i 1)))))
+    s))
diff --git a/aws/json.scm b/aws/cloudformation/utils/json.scm
index cb77ff5..11ca6bf 100644
--- a/aws/json.scm
+++ b/aws/cloudformation/utils/json.scm
@@ -17,9 +17,14 @@
 ;;;; Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 ;;;; 02110-1301 USA
 
-(define-module (aws json)
+(define-module (aws cloudformation utils json)
   #:use-module (ice-9 match)
-  #:export (read-json write-json))
+  #:export (read-json json-assoc-ref write-json))
+
+(define (json-assoc-ref json key)
+  (match (assoc-ref json key)
+    (('@ . alist) alist)
+    (x x)))
 
 (define (json-error port)
   (throw 'json-error port))
@@ -347,9 +352,9 @@ encountered.."
   (display "{" port)
   (match object
     (() #f)
-    ((front ... (end-key end-val))
+    ((front ... (end-key . end-val))
      (for-each (match-lambda
-                 ((key value)
+                 ((key . value)
                   (write-kv-pair key value)
                   (display "," port)))
                front)
diff --git a/aws/cloudformation/utils/sha-1.scm b/aws/cloudformation/utils/sha-1.scm
new file mode 100644
index 0000000..a34f09e
--- /dev/null
+++ b/aws/cloudformation/utils/sha-1.scm
@@ -0,0 +1,300 @@
+;; -*- mode: scheme; coding: utf-8 -*-
+;; Copyright © 2009, 2010, 2012 Göran Weinholt <goran@weinholt.se>
+
+;; Permission is hereby granted, free of charge, to any person obtaining a
+;; copy of this software and associated documentation files (the "Software"),
+;; to deal in the Software without restriction, including without limitation
+;; the rights to use, copy, modify, merge, publish, distribute, sublicense,
+;; and/or sell copies of the Software, and to permit persons to whom the
+;; Software is furnished to do so, subject to the following conditions:
+
+;; The above copyright notice and this permission notice shall be included in
+;; all copies or substantial portions of the Software.
+
+;; THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+;; IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+;; FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+;; THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+;; LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+;; FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+;; DEALINGS IN THE SOFTWARE.
+#!r6rs
+
+;; Byte-oriented SHA-1 from FIPS 180-3 and RFC 3174.
+
+;; The data being hashed will never be modified here.
+
+;; TODO: give an error if more than 2^64 bits are processed?
+;; TODO: Optimize. Should be simple enough with the help of a profiler.
+
+(library (aws cloudformation utils sha-1)
+  (export make-sha-1 sha-1-update! sha-1-finish! sha-1-clear!
+          sha-1 sha-1-copy sha-1-finish
+          sha-1-transform!              ;for interested parties only
+          sha-1-length
+          sha-1-copy-hash! sha-1-96-copy-hash!
+          sha-1->bytevector sha-1->string
+          sha-1-hash=? sha-1-96-hash=?
+          hmac-sha-1)
+  (import (except (rnrs) bitwise-rotate-bit-field))
+
+  (define (sha-1-length) 20)
+
+  (define (vector-copy x) (vector-map (lambda (i) i) x))
+
+  (define (rol32 n count)
+    (let ((field1 (bitwise-and #xffffffff (bitwise-arithmetic-shift-left n count)))
+          (field2 (bitwise-arithmetic-shift-right n (- 32 count))))
+      (bitwise-ior field1 field2)))
+
+  (define-record-type sha1state
+    (fields (immutable H)               ;Hash
+            (immutable W)               ;temporary data
+            (immutable m)               ;unprocessed data
+            (mutable pending)           ;length of unprocessed data
+            (mutable processed)))       ;length of processed data
+
+  (define (make-sha-1)
+    (let ((H (list->vector initial-hash))
+          (W (make-bytevector (* 4 80)))
+          (m (make-bytevector (* 4 16))))
+      (make-sha1state H W m 0 0)))
+
+  (define (sha-1-copy state)
+    (let ((H (vector-copy (sha1state-H state)))
+          (W (make-bytevector (* 4 80)))
+          (m (bytevector-copy (sha1state-m state))))
+      (make-sha1state H W m
+                      (sha1state-pending state)
+                      (sha1state-processed state))))
+
+  (define (sha-1-clear! state)
+    (for-each (lambda (i v)
+                (vector-set! (sha1state-H state) i v))
+              '(0 1 2 3 4)
+              initial-hash)
+    (bytevector-fill! (sha1state-W state) 0)
+    (bytevector-fill! (sha1state-m state) 0)
+    (sha1state-pending-set! state 0)
+    (sha1state-processed-set! state 0))
+
+  (define initial-hash '(#x67452301 #xefcdab89 #x98badcfe #x10325476 #xc3d2e1f0))
+
+  (define (Ch x y z)
+    (bitwise-xor (bitwise-and x y)
+                 (bitwise-and (bitwise-not x) z)))
+
+  (define Parity bitwise-xor)
+
+  (define (Maj x y z)
+    (bitwise-xor (bitwise-and x y)
+                 (bitwise-and x z)
+                 (bitwise-and y z)))
+
+  (define k1 #x5a827999)
+  (define k2 #x6ed9eba1)
+  (define k3 #x8f1bbcdc)
+  (define k4 #xca62c1d6)
+
+  (define (f t B C D)
+    ((cond ((<= 0 t 19) Ch)
+           ((<= 20 t 39) Parity)
+           ((<= 40 t 59) Maj)
+           (else Parity))
+     B C D))
+
+  (define (K t)
+    (cond ((<= 0 t 19) k1)
+          ((<= 20 t 39) k2)
+          ((<= 40 t 59) k3)
+          (else k4)))
+
+  ;; This function transforms a whole 512 bit block.
+  (define (sha-1-transform! H W m offset)
+    ;; Copy the message block
+    (do ((t 0 (+ t 4)))
+        ((= t (* 4 16)))
+      (bytevector-u32-native-set! W t (bytevector-u32-ref m (+ t offset) (endianness big))))
+    ;; Initialize W[16..79]
+    (do ((t (* 4 16) (+ t 4)))
+        ((= t (* 4 80)))
+      (bytevector-u32-native-set! W t (rol32
+                                       (bitwise-xor (bytevector-u32-native-ref W (- t (* 4 3)))
+                                                    (bytevector-u32-native-ref W (- t (* 4 8)))
+                                                    (bytevector-u32-native-ref W (- t (* 4 14)))
+                                                    (bytevector-u32-native-ref W (- t (* 4 16))))
+                                       1)))
+    ;; Do the hokey pokey
+    (let lp ((A (vector-ref H 0))
+             (B (vector-ref H 1))
+             (C (vector-ref H 2))
+             (D (vector-ref H 3))
+             (E (vector-ref H 4))
+             (t 0))
+      (cond ((= t 80)
+             (vector-set! H 0 (bitwise-and #xffffffff (+ A (vector-ref H 0))))
+             (vector-set! H 1 (bitwise-and #xffffffff (+ B (vector-ref H 1))))
+             (vector-set! H 2 (bitwise-and #xffffffff (+ C (vector-ref H 2))))
+             (vector-set! H 3 (bitwise-and #xffffffff (+ D (vector-ref H 3))))
+             (vector-set! H 4 (bitwise-and #xffffffff (+ E (vector-ref H 4)))))
+            (else
+             (lp (bitwise-and #xffffffff
+                              (+ (rol32 A 5)
+                                 (f t B C D)
+                                 E
+                                 (bytevector-u32-native-ref W (* 4 t))
+                                 (K t)))
+                 A
+                 (rol32 B 30)
+                 C
+                 D
+                 (+ t 1))))))
+
+  ;; Add a bytevector to the state. Align your data to whole blocks if
+  ;; you want this to go a little faster.
+  (define sha-1-update!
+    (case-lambda
+      ((state data start end)
+       (let ((m (sha1state-m state))    ;unprocessed data
+             (H (sha1state-H state))
+             (W (sha1state-W state)))
+         (let lp ((offset start))
+           (cond ((= (sha1state-pending state) 64)
+                  ;; A whole block is pending
+                  (sha-1-transform! H W m 0)
+                  (sha1state-pending-set! state 0)
+                  (sha1state-processed-set! state (+ 64 (sha1state-processed state)))
+                  (lp offset))
+                 ((= offset end)
+                  (values))
+                 ((or (> (sha1state-pending state) 0)
+                      (> (+ offset 64) end))
+                  ;; Pending data exists or less than a block remains.
+                  ;; Add more pending data.
+                  (let ((added (min (- 64 (sha1state-pending state))
+                                    (- end offset))))
+                    (bytevector-copy! data offset
+                                      m (sha1state-pending state)
+                                      added)
+                    (sha1state-pending-set! state (+ added (sha1state-pending state)))
+                    (lp (+ offset added))))
+                 (else
+                  ;; Consume a whole block
+                  (sha-1-transform! H W data offset)
+                  (sha1state-processed-set! state (+ 64 (sha1state-processed state)))
+                  (lp (+ offset 64)))))))
+      ((state data)
+       (sha-1-update! state data 0 (bytevector-length data)))))
+
+  (define zero-block (make-bytevector 64 0))
+
+  ;; Finish the state by adding a 1, zeros and the counter.
+  (define (sha-1-finish! state)
+    (let ((m (sha1state-m state))
+          (pending (+ (sha1state-pending state) 1)))
+      (bytevector-u8-set! m (sha1state-pending state) #x80)
+      (cond ((> pending 56)
+             (bytevector-copy! zero-block 0
+                               m pending
+                               (- 64 pending))
+             (sha-1-transform! (sha1state-H state)
+                               (sha1state-W state)
+                               m
+                               0)
+             (bytevector-fill! m 0))
+            (else
+             (bytevector-copy! zero-block 0
+                               m pending
+                               (- 64 pending))))
+      ;; Number of bits in the data
+      (bytevector-u64-set! m 56
+                           (* (+ (sha1state-processed state)
+                                 (- pending 1))
+                              8)
+                           (endianness big))
+      (sha-1-transform! (sha1state-H state)
+                        (sha1state-W state)
+                        m
+                        0)))
+
+  (define (sha-1-finish state)
+    (let ((copy (sha-1-copy state)))
+      (sha-1-finish! copy)
+      copy))
+
+  ;; Find the SHA-1 of the concatenation of the given bytevectors.
+  (define (sha-1 . data)
+    (let ((state (make-sha-1)))
+      (for-each (lambda (d) (sha-1-update! state d))
+                data)
+      (sha-1-finish! state)
+      state))
+
+  (define (copy-hash! state bv off len)
+    (do ((i 0 (+ i 1)))
+        ((= i len))
+      (bytevector-u32-set! bv (+ off (* 4 i))
+                           (vector-ref (sha1state-H state) i)
+                           (endianness big))))
+
+  (define (sha-1-copy-hash! state bv off)
+    (copy-hash! state bv off 5))
+
+  (define (sha-1-96-copy-hash! state bv off)
+    (copy-hash! state bv off 3))
+
+  (define (sha-1->bytevector state)
+    (let ((ret (make-bytevector (* 4 5))))
+      (sha-1-copy-hash! state ret 0)
+      ret))
+
+  (define (sha-1->string state)
+    (apply string-append
+           (map (lambda (x)
+                  (if (< x #x10)
+                      (string-append "0" (number->string x 16))
+                      (number->string x 16)))
+                (bytevector->u8-list (sha-1->bytevector state)))))
+
+  ;; Compare an SHA-1 state with a bytevector. It is supposed to not
+  ;; terminate early in order to not leak timing information. Assumes
+  ;; that the bytevector's length is ok.
+  (define (cmp state bv len)
+    (do ((i 0 (fx+ i 1))
+         (diff 0 (+ diff
+                    (bitwise-xor
+                     (bytevector-u32-ref bv (* 4 i) (endianness big))
+                     (vector-ref (sha1state-H state) i)))))
+        ((fx=? i len)
+         (zero? diff))))
+
+  (define (sha-1-hash=? state bv) (cmp state bv 5))
+
+  (define (sha-1-96-hash=? state bv) (cmp state bv 3))
+
+;;; HMAC-SHA-1. RFC 2104.
+
+  ;; TODO: an API with make, update!, finish!, finish, clear!, copy, etc
+
+  (define (hmac-sha-1 secret . data)
+    ;; RFC 2104.
+    (if (> (bytevector-length secret) 64)
+        (apply hmac-sha-1 (sha-1->bytevector (sha-1 secret)) data)
+        (let ((k-ipad (make-bytevector 64 0))
+              (k-opad (make-bytevector 64 0)))
+          (bytevector-copy! secret 0 k-ipad 0 (bytevector-length secret))
+          (bytevector-copy! secret 0 k-opad 0 (bytevector-length secret))
+          (do ((i 0 (fx+ i 1)))
+              ((fx=? i 64))
+            (bytevector-u8-set! k-ipad i (fxxor #x36 (bytevector-u8-ref k-ipad i)))
+            (bytevector-u8-set! k-opad i (fxxor #x5c (bytevector-u8-ref k-opad i))))
+          (let ((state (make-sha-1)))
+            (sha-1-update! state k-ipad)
+            (for-each (lambda (d) (sha-1-update! state d)) data)
+            (sha-1-finish! state)
+            (let ((digest (sha-1->bytevector state)))
+              (sha-1-clear! state)
+              (sha-1-update! state k-opad)
+              (sha-1-update! state digest)
+              (sha-1-finish! state)
+              state))))))