SCA230 -- Issue, root cause, workaround, and requested fix

Embedded Security ChipWhisperer Software
1

While going through SCA203, I kept having trouble with the jupyter notebooks.

Eventually, I was able to find a root-cause and workaround. This post is to document for others who might hit this, and to request a fix by maintainer of the cwtvla module.

How to determine if you are affected

Run pip check – does it list any version conflicts, especially about numpy and chipwhisperer?

Background

  1. the chipwhisperer 6.0.0 module requires numpy <=1.26.4.
  2. the cwtvla 0.1.3 module requires numpy, but does not list any version metadata.
  3. The chipwhisperer 6.0.0 module does not list cwtvla as a prerequisite (which seems correct)
  4. The cwtvla 0.1.3 module does not list chipwhisperer as a prerequisite

As a result, cwtvla must be manually installed. A typical installation would simply be: pip install cwtvla.

However, because cwtvla does not list version metadata in its requirements, that will install the latest available versions. In particular, numpy will be updated to version 2.x.x … even though it breaks the chipwhisperer module’s explicit requirement of numpy <= 1.26.4.

As a result, lots of things break.

Workaround

pip uninstall -y scipy numpy cwtvla
pip install numpy==1.26.4
pip install "scipy<1.14"
pip install cwtvla --no-deps
pip check

Proper Fix

Fix the cwtvla module dependencies:

  • add chipwhisperer == 6.0.0
  • modify Requires: scipy → Requires: scipy<1.14
  • similarly, add Requires: zarr <= ... with proper version metadata, since that module is also required for at least cwtvla.cw_convenience
  • etc.

This would ensure that The cwtvla module should list dependencies that don’t conflict with the chipwhisperer module.

In fact, perhaps cwtvla module should depend on the chipwhisperer module directly?

Using CWTVLA from Jupyter