cfgroovy集成querbus运行PHP调用Kraken API报nonce无效问题求解

• 基于已停止维护的cfgroovy组件运行PHP代码调用Kraken API，返回「invalid: nonce」错误
• 相同逻辑的PHP代码在XAMPP 3.3.2（内置PHP 7.0.25）环境下运行无异常
• 集成环境已安装适配的最新版querbus JAR包，支撑ColdFusion下的PHP脚本运行

• 核心异常指向签名计算环节的hash_hmac函数逻辑
• 根因：当前使用的querbus JAR仅支持PHP 5.4.0版本语法，与XAMPP运行的PHP 7.0.25存在版本差异
• 实现逻辑参考公开的Kraken API PHP端客户端方案

<cftry>
   <g:script lang="php">
      <?php 
        $key = 'APIKEY';
        $secret = 'APISECRET';
        $request = array();
        if(!isset($request['nonce'])) {
            $nonce = explode(' ', microtime());
            $request['nonce'] = $nonce[1] . str_pad(substr($nonce[0], 2, 6), 6, '0');
        }

        $pspostdata = http_build_query($request, '', '&');

        $variables["postdata"] = $request['nonce'] . $pspostdata;

        $version = '0';
        $method = 'TradeBalance';

        $path = '/' . $version . '/private/' . $method;
        $sign = hash_hmac('sha512', $path . hash('sha256', $variables["postdata"] . $pspostdata, true), base64_decode($secret), true);
        $variables["myArray"] = base64_encode($sign); 

        $headers = array(
            'API-Key: ' . $key,
            'API-Sign: ' . base64_encode($sign)
        );

        $cl = curl_init();

        curl_setopt_array($cl, array(
            CURLOPT_SSL_VERIFYPEER => true,
            CURLOPT_SSL_VERIFYHOST => 2,
            CURLOPT_USERAGENT => 'Kraken PHP API Agent',
            CURLOPT_POST => true,
            CURLOPT_RETURNTRANSFER => true)
        );

        // make request
        curl_setopt($cl, CURLOPT_URL, 'https://api.kraken.com' . $path);
        curl_setopt($cl, CURLOPT_POSTFIELDS, $pspostdata);
        curl_setopt($cl, CURLOPT_HTTPHEADER, $headers);
        $variables["results"] = curl_exec($cl);
      ?>
   </g:script>
   <cfhttp url="https://api.kraken.com/0/private/TradeBalance" method="POST" result="result">
      <cfhttpparam name="API-Key" type="HEADER"  value="#key#">
      <cfhttpparam name="API-Sign" type="HEADER"  value='#variables["myArray"]#'>
    </cfhttp>
    <cfdump var="#variables#">
    <cfdump var="#result#">

hash_hmac('sha512', $path . hash('sha256', $request['nonce'] . $postdata, true), base64_decode($this->secret), true);

• 适配PHP 5.4.0版本的hash_hmac函数实现逻辑，兼容querbus运行环境
• 或直接通过ColdFusion实现Kraken API要求的签名计算逻辑，移除cfgroovy环境下的PHP代码依赖

内容的提问来源于stack exchange，提问作者Irish