argon2 2.1.1 → 2.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 933cdf134b0ac4110cda1cd9a8108a75c0dc6d80e6d2cb68446d93b1898f298a
-  data.tar.gz: bcb1c0d25d2a074c59ad5002e2078d0aa344480022f9a658eb297dcbd16b1eb6
+  metadata.gz: 117208813bd32c3221d1553b236a99c1bdff7bb67b2043df81f3d6da452c0673
+  data.tar.gz: cd12a36287b85e5406bbdeaa9e92a69051c6f1877560063ac38acedcaf1aaa6d
 SHA512:
-  metadata.gz: d17d3f5c0a9162dca09db8ab7a9926becc50ace4527d2ad705db80d44ffdc528d3110853885ee5c042b5142c5cd619fd8c93d6a7dec75fc70d41fbb40661f259
-  data.tar.gz: 91fb841e70a470bf760871690c216ae4f305442a063b4c5a5c861fe97510c226db5f8db92cc65e8a93ea459fd42ac735bd216e2dfb333fc334f1e3f21cba3bbf
+  metadata.gz: adc5da0bf66689aa8d601521b0aebaf2a25c467d5c9e8d1d81fbb1efa6882f75d7330f25221b21b789dd6a34359a1af08aa4a49d188718aada38c4acec3b1690
+  data.tar.gz: 57484f607bca24b01fb63e4892037333fc089a0fd253e1771d2cf0b0f06aa18339108fd8d796bbca8201bca2e48e5729551803f92d74601449fd1082a002a7a5

data/.github/workflows/codeql.yml

@@ -0,0 +1,74 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "master" ]
+  schedule:
+    - cron: '34 3 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'ruby' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines.
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    # - run: |
+    #   echo "Run, Build Application using script"
+    #   ./location_of_script_within_repo/buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "/language:${{matrix.language}}"

data/.github/workflows/ruby.yml

@@ -13,10 +13,9 @@ jobs:
           - ubuntu
           - macos
         ruby:
-          - 2.6
           - 2.7
-          - 3.0
-          - head
+          - 3.1
+          - 3.2
 
     runs-on: ${{ matrix.os }}-latest
 

data/.rubocop.yml

@@ -210,8 +210,6 @@ Style/RedundantArgument: # (new in 1.4)
   Enabled: true
 Style/SwapValues: # (new in 1.1)
   Enabled: true
-Gemspec/DateAssignment: # (new in 1.10)
-  Enabled: true
 Lint/DeprecatedConstants: # (new in 1.8)
   Enabled: true
 Lint/LambdaWithoutLiteralBlock: # (new in 1.8)
@@ -234,3 +232,83 @@ Style/IfWithBooleanLiteralBranches: # (new in 1.9)
   Enabled: true
 Style/StringChars: # (new in 1.12)
   Enabled: true
+Gemspec/DeprecatedAttributeAssignment: # new in 1.30
+  Enabled: true
+Gemspec/RequireMFA: # new in 1.23
+  Enabled: true
+Layout/LineContinuationLeadingSpace: # new in 1.31
+  Enabled: true
+Layout/LineContinuationSpacing: # new in 1.31
+  Enabled: true
+Layout/LineEndStringConcatenationIndentation: # new in 1.18
+  Enabled: true
+Lint/AmbiguousOperatorPrecedence: # new in 1.21
+  Enabled: true
+Lint/AmbiguousRange: # new in 1.19
+  Enabled: true
+Lint/ConstantOverwrittenInRescue: # new in 1.31
+  Enabled: true
+Lint/DuplicateMagicComment: # new in 1.37
+  Enabled: true
+Lint/EmptyInPattern: # new in 1.16
+  Enabled: true
+Lint/IncompatibleIoSelectWithFiberScheduler: # new in 1.21
+  Enabled: true
+Lint/NonAtomicFileOperation: # new in 1.31
+  Enabled: true
+Lint/RefinementImportMethods: # new in 1.27
+  Enabled: true
+Lint/RequireRangeParentheses: # new in 1.32
+  Enabled: true
+Lint/RequireRelativeSelfPath: # new in 1.22
+  Enabled: true
+Lint/UselessRuby2Keywords: # new in 1.23
+  Enabled: true
+Naming/BlockForwarding: # new in 1.24
+  Enabled: true
+Security/CompoundHash: # new in 1.28
+  Enabled: true
+Security/IoMethods: # new in 1.22
+  Enabled: true
+Style/EmptyHeredoc: # new in 1.32
+  Enabled: true
+Style/EnvHome: # new in 1.29
+  Enabled: true
+Style/FetchEnvVar: # new in 1.28
+  Enabled: true
+Style/FileRead: # new in 1.24
+  Enabled: true
+Style/FileWrite: # new in 1.24
+  Enabled: true
+Style/InPatternThen: # new in 1.16
+  Enabled: true
+Style/MagicCommentFormat: # new in 1.35
+  Enabled: true
+Style/MapCompactWithConditionalBlock: # new in 1.30
+  Enabled: true
+Style/MapToHash: # new in 1.24
+  Enabled: true
+Style/MultilineInPatternThen: # new in 1.16
+  Enabled: true
+Style/NestedFileDirname: # new in 1.26
+  Enabled: true
+Style/NumberedParameters: # new in 1.22
+  Enabled: true
+Style/NumberedParametersLimit: # new in 1.22
+  Enabled: true
+Style/ObjectThen: # new in 1.28
+  Enabled: true
+Style/OpenStructUse: # new in 1.23
+  Enabled: true
+Style/OperatorMethodCall: # new in 1.37
+  Enabled: true
+Style/QuotedSymbols: # new in 1.16
+  Enabled: true
+Style/RedundantInitialize: # new in 1.27
+  Enabled: true
+Style/RedundantSelfAssignmentBranch: # new in 1.19
+  Enabled: true
+Style/RedundantStringEscape: # new in 1.37
+  Enabled: true
+Style/SelectByRegexp: # new in 1.22
+  Enabled: true

data/README.md

@@ -13,7 +13,7 @@ This project has several key tenets to its design:
 * The reference Argon2 implementation is to be used "unaltered". To ensure compliance with this goal, and encourage regular updates from upstream, the upstream library is implemented as a git submodule, and is intended to stay that way.
 * The FFI interface is kept as slim as possible, with wrapper classes preferred to implementing context structs in FFI
 * Security and maintainability take top priority. This can have an impact on platform support. A PR that contains platform specific code paths is unlikely to be accepted.
-* Tested platforms are MRI Ruby 2.2, 2.3 and JRuby 9000. No assertions are made on other platforms.
+* Tested platforms are MRI Ruby 2.7 and 3.0. No assertions are made on other platforms.
 * Errors from the C interface are raised as Exceptions. There are a lot of exception classes, but they tend to relate to things like very broken input, and code bugs. Calls to this library should generally not require a rescue.
 * Test suites should aim for 100% code coverage.
 * Default work values should not be considered constants. I will increase them from time to time.

data/argon2.gemspec

@@ -17,14 +17,17 @@ Gem::Specification.new do |spec|
   spec.description   = 'Argon2 FFI binding'
   spec.homepage      = 'https://github.com/technion/ruby-argon2'
   spec.license       = 'MIT'
+  spec.metadata      = {
+    'rubygems_mfa_required' => 'true'
+  }
 
-  spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
   spec.files << `find ext`.split
 
   spec.bindir        = "exe"
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
-  spec.add_dependency 'ffi', '~> 1.14'
+  spec.add_dependency 'ffi', '~> 1.15'
   spec.add_dependency 'ffi-compiler', '~> 1.0'
 
   spec.add_development_dependency "bundler", '~> 2.0'
@@ -33,6 +36,6 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rubocop", '~> 1.7'
   spec.add_development_dependency "simplecov", '~> 0.20'
   spec.add_development_dependency "simplecov-lcov", '~> 0.8'
-  spec.add_development_dependency "steep", "~> 0.43.1"
+  spec.add_development_dependency "steep", "~> 1.2.1"
   spec.extensions << 'ext/argon2_wrap/extconf.rb'
 end

data/ext/phc-winner-argon2/Makefile

@@ -83,7 +83,7 @@ ifeq ($(KERNEL_NAME), $(filter $(KERNEL_NAME),DragonFly FreeBSD NetBSD OpenBSD))
 endif
 ifeq ($(KERNEL_NAME), Darwin)
 	LIB_EXT := $(ABI_VERSION).dylib
-	LIB_CFLAGS := -dynamiclib -install_name @rpath/lib$(LIB_NAME).$(LIB_EXT)
+	LIB_CFLAGS = -dynamiclib -install_name $(PREFIX)/$(LIBRARY_REL)/lib$(LIB_NAME).$(LIB_EXT)
 	LINKED_LIB_EXT := dylib
 	PC_EXTRA_LIBS ?=
 endif

data/ext/phc-winner-argon2/Package.swift

@@ -0,0 +1,46 @@
+// swift-tools-version:5.3
+
+import PackageDescription
+
+let package = Package(
+    name: "argon2",
+    products: [
+        .library(
+            name: "argon2",
+            targets: ["argon2"]),
+    ],
+    targets: [
+        .target(
+            name: "argon2",
+            path: ".",
+            exclude: [
+                "kats",
+                "vs2015",
+                "latex",
+                "libargon2.pc.in",
+                "export.sh",
+                "appveyor.yml",
+                "Argon2.sln",
+                "argon2-specs.pdf",
+                "CHANGELOG.md",
+                "LICENSE",
+                "Makefile",
+                "man",
+                "README.md",
+                "src/bench.c",
+                "src/genkat.c",
+                "src/opt.c",
+                "src/run.c",
+                "src/test.c",
+            ],
+            sources: [
+                "src/blake2/blake2b.c",
+                "src/argon2.c",
+                "src/core.c",
+                "src/encoding.c",
+                "src/ref.c",
+                "src/thread.c"
+            ]
+        )
+    ]
+)

data/ext/phc-winner-argon2/README.md

@@ -44,9 +44,11 @@ Please report bugs as issues on this repository.
 ## Usage
 
 `make` builds the executable `argon2`, the static library `libargon2.a`,
-and the shared library `libargon2.so` (or `libargon2.dylib` on OSX).
-Make sure to run `make test` to verify that your build produces valid
-results. `make install PREFIX=/usr` installs it to your system.
+and the shared library `libargon2.so` (or on macOS, the dynamic library
+`libargon2.dylib` -- make sure to specify the installation prefix when
+you compile: `make PREFIX=/usr`). Make sure to run `make test` to verify
+that your build produces valid results. `sudo make install PREFIX=/usr`
+installs it to your system.
 
 ### Command-line utility
 
@@ -148,7 +150,7 @@ int main(void)
     uint8_t *pwd = (uint8_t *)strdup(PWD);
     uint32_t pwdlen = strlen((char *)pwd);
 
-    uint32_t t_cost = 2;            // 1-pass computation
+    uint32_t t_cost = 2;            // 2-pass computation
     uint32_t m_cost = (1<<16);      // 64 mebibytes memory usage
     uint32_t parallelism = 1;       // number of threads and lanes
 
@@ -244,6 +246,7 @@ Bindings are available for the following languages (make sure to read
 their documentation):
 
 * [Android (Java/Kotlin)](https://github.com/lambdapioneer/argon2kt) by [@lambdapioneer](https://github.com/lambdapioneer)
+* [Dart](https://github.com/tmthecoder/dargon2) by [@tmthecoder](https://github.com/tmthecoder)
 * [Elixir](https://github.com/riverrun/argon2_elixir) by [@riverrun](https://github.com/riverrun)
 * [Erlang](https://github.com/ergenius/eargon2) by [@ergenius](https://github.com/ergenius)
 * [Go](https://github.com/tvdburgt/go-argon2) by [@tvdburgt](https://github.com/tvdburgt)
@@ -269,6 +272,7 @@ their documentation):
 * [Perl](https://github.com/Leont/crypt-argon2) by [@leont](https://github.com/Leont)
 * [mruby](https://github.com/Asmod4n/mruby-argon2) by [@Asmod4n](https://github.com/Asmod4n)
 * [Swift](https://github.com/ImKcat/CatCrypto) by [@ImKcat](https://github.com/ImKcat)
+* [Swift](https://github.com/tmthecoder/Argon2Swift) by [@tmthecoder](https://github.com/tmthecoder)
 
 
 ## Test suite

data/lib/argon2/version.rb

@@ -3,5 +3,5 @@
 # Standard Gem version constant.
 
 module Argon2
-  VERSION = "2.1.1"
+  VERSION = "2.1.3"
 end

data/sig/argon2.rbs

@@ -7,10 +7,15 @@ module Argon2
     @salt: nil | String
     @secret: nil | String
 
-    def initialize: (?Hash[Symbol, Integer] options) -> (nil | String)
+    def initialize: (?::Hash[untyped, untyped] options) -> void
     def create: (String pass) -> untyped
     def self.create: (String pass) -> untyped
     def self.valid_hash?: (string hash) -> Integer?
     def self.verify_password: (untyped pass, untyped hash, ?nil secret) -> untyped
   end
+  class Engine
+    def self.saltgen: () -> String
+  end
+  class ArgonHashFail < StandardError
+  end
 end

data/sig/ffi.rbs

@@ -0,0 +1,18 @@
+module Argon2
+  # Direct external bindings. Call these methods via the Engine class to ensure points are dealt with
+  module Ext
+    extend FFI::Library
+  end
+
+  # The engine class shields users from the FFI interface.
+  # It is generally not advised to directly use this class.
+  class Engine
+    def self.hash_argon2i: (untyped password, untyped salt, untyped t_cost, untyped m_cost, ?untyped? out_len) -> untyped
+
+    def self.hash_argon2id: (untyped password, untyped salt, untyped t_cost, untyped m_cost, untyped p_cost, ?untyped? out_len) -> untyped
+
+    def self.hash_argon2id_encode: (untyped password, untyped salt, untyped t_cost, untyped m_cost, untyped p_cost, untyped secret) -> untyped
+
+    def self.argon2_verify: (untyped pwd, untyped hash, untyped secret) -> (false | true)
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: argon2
 version: !ruby/object:Gem::Version
-  version: 2.1.1
+  version: 2.1.3
 platform: ruby
 authors:
 - Technion
-autorequire:
+autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-10-05 00:00:00.000000000 Z
+date: 2022-12-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.14'
+        version: '1.15'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.14'
+        version: '1.15'
 - !ruby/object:Gem::Dependency
   name: ffi-compiler
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.43.1
+        version: 1.2.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.43.1
+        version: 1.2.1
 description: Argon2 FFI binding
 email:
 - technion@lolware.net
@@ -144,6 +144,7 @@ extensions:
 - ext/argon2_wrap/extconf.rb
 extra_rdoc_files: []
 files:
+- ".github/workflows/codeql.yml"
 - ".github/workflows/ruby.yml"
 - ".gitignore"
 - ".gitmodules"
@@ -172,6 +173,7 @@ files:
 - ext/phc-winner-argon2/CHANGELOG.md
 - ext/phc-winner-argon2/LICENSE
 - ext/phc-winner-argon2/Makefile
+- ext/phc-winner-argon2/Package.swift
 - ext/phc-winner-argon2/README.md
 - ext/phc-winner-argon2/appveyor.yml
 - ext/phc-winner-argon2/argon2-specs.pdf
@@ -203,7 +205,6 @@ files:
 - ext/phc-winner-argon2/latex/tradeoff.bib
 - ext/phc-winner-argon2/libargon2.pc.in
 - ext/phc-winner-argon2/man/argon2.1
-- ext/phc-winner-argon2/opt.o
 - ext/phc-winner-argon2/src/argon2.c
 - ext/phc-winner-argon2/src/bench.c
 - ext/phc-winner-argon2/src/blake2/blake2-impl.h
@@ -252,12 +253,14 @@ files:
 - lib/argon2/version.rb
 - sig/argon2.rbs
 - sig/constants.rbs
+- sig/ffi.rbs
 - sig/version.rbs
 homepage: https://github.com/technion/ruby-argon2
 licenses:
 - MIT
-metadata: {}
-post_install_message:
+metadata:
+  rubygems_mfa_required: 'true'
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -272,8 +275,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.21
-signing_key:
+rubygems_version: 3.3.5
+signing_key: 
 specification_version: 4
 summary: Argon2 Password hashing binding
 test_files: []