argon2 2.0.2 → 2.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f448652ac1fb4a0d6d72144ea0aafb92081581f13c13b0c0b65912b1dfc79e1c
-  data.tar.gz: a773a85b25a5048d39ee31b7abef28a84f1f74045609b28cc78c137d8a722cce
+  metadata.gz: ff5c2dcd38a21e51982265caf83a721327a8cff1a09acc5c51312ce92d2f5619
+  data.tar.gz: ab787b9e4ee2a039e286f5b96ebb65da86845749c7003de1b43061a2da2c3699
 SHA512:
-  metadata.gz: fdc0083265c308602bc2a7f9d4948bc210e90fa20e617963736bc3d61163105acfaddb17438e52b9d81db5c0623f7b5a44d8fe059d13ccd08724e1a22a9471de
-  data.tar.gz: 20bb002c7ba1828fed88e01cd3744873bb3a8b5c1a014bb2a99254653d8bafb44f3b4903509a859acff5a7668512f6cc350b0dda261d2b793628b27d27deb825
+  metadata.gz: 1b47bef62063b2871cd0c6235fe38e76b892b9c4b888d0b9798ccf39a6cc7daa2f4539b6a4fa1829635e5970401a59b822bcd1d1f72bfb71b9d3c79781ecf1ae
+  data.tar.gz: 476a21e271c981101b51cd0fe32ce6182635994273895de8f57c26224f9f4e4fd883a1a40139fa95c9672a2cb8dea920bce9e362e01fc0893cacfd3b28ce9625

data/.github/workflows/rubocop.yml

@@ -0,0 +1,16 @@
+name: Rubocop
+
+# Run this workflow every time a new commit pushed to your repository
+on: push
+
+jobs:
+
+  rubocop:
+    name: Rubocopchecks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Rubocop
+        uses: gimenete/rubocop-action@1.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+

data/.github/workflows/ruby.yml

@@ -0,0 +1,32 @@
+name: Test Suite
+
+on: push
+
+jobs:
+  test:
+
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby-version: ['3.0', 2.7, 2.5]
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Ruby ${{ matrix.ruby-version }}
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby-version }} 
+    - name: Install dependencies
+      run: bundle install
+    - name: Init submodules
+      run: git submodule update --init --recursive
+    - name: Build C library
+      run: bin/setup
+    - name: Test C library
+      run: cd ext/argon2_wrap/ && make test && cd ../..
+    - name: Run tests
+      run: bundle exec rake
+    - name: Coveralls
+      uses: coverallsapp/github-action@master
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}

data/.rubocop.yml

@@ -1,20 +1,26 @@
-
 Metrics/AbcSize:
   Max: 20
+
 Metrics/CyclomaticComplexity:
   Enabled: false
+
 Metrics/PerceivedComplexity:
   Enabled: false
-Metrics/LineLength:
+
+Layout/LineLength:
   Max: 160
+  Exclude:
+    - 'test/low_level_test.rb'
 
 Metrics/MethodLength:
   Max: 24
+  Exclude:
+    - 'test/low_level_test.rb'
 
-Layout/AlignParameters:
+Layout/ParameterAlignment:
   Enabled: false
 
-Layout/AlignArray:
+Layout/ArrayAlignment:
   Enabled: false
 
 # Configuration parameters: Exclude.
@@ -37,7 +43,7 @@ Style/HashSyntax:
 
 # Offense count: 1
 # Cop supports --auto-correct.
-Layout/IndentArray:
+Layout/FirstArrayElementIndentation:
   Exclude:
     - 'lib/argon2/errors.rb'
 
@@ -61,3 +67,142 @@ Layout/MultilineMethodCallBraceLayout:
     - 'lib/argon2.rb'
     - 'test/low_level_test.rb'
 
+Gemspec/RequiredRubyVersion:
+  Enabled: false
+
+Layout/BeginEndAlignment: # (new in 0.91)
+  Enabled: true
+Layout/EmptyLinesAroundAttributeAccessor: # (new in 0.83)
+  Enabled: true
+Layout/SpaceAroundMethodCallOperator: # (new in 0.82)
+  Enabled: true
+Lint/BinaryOperatorWithIdenticalOperands: # (new in 0.89)
+  Enabled: true
+Lint/ConstantDefinitionInBlock: # (new in 0.91)
+  Enabled: true
+Lint/DeprecatedOpenSSLConstant: # (new in 0.84)
+  Enabled: true
+Lint/DuplicateElsifCondition: # (new in 0.88)
+  Enabled: true
+Lint/DuplicateRequire: # (new in 0.90)
+  Enabled: true
+Lint/DuplicateRescueException: # (new in 0.89)
+  Enabled: true
+Lint/EmptyConditionalBody: # (new in 0.89)
+  Enabled: true
+Lint/EmptyFile: # (new in 0.90)
+  Enabled: true
+Lint/FloatComparison: # (new in 0.89)
+  Enabled: true
+Lint/IdentityComparison: # (new in 0.91)
+  Enabled: true
+Lint/MissingSuper: # (new in 0.89)
+  Enabled: true
+Lint/MixedRegexpCaptureTypes: # (new in 0.85)
+  Enabled: true
+Lint/OutOfRangeRegexpRef: # (new in 0.89)
+  Enabled: true
+Lint/RaiseException: # (new in 0.81)
+  Enabled: true
+Lint/SelfAssignment: # (new in 0.89)
+  Enabled: true
+Lint/StructNewOverride: # (new in 0.81)
+  Enabled: true
+Lint/TopLevelReturnWithArgument: # (new in 0.89)
+  Enabled: true
+Lint/TrailingCommaInAttributeDeclaration: # (new in 0.90)
+  Enabled: true
+Lint/UnreachableLoop: # (new in 0.89)
+  Enabled: true
+Lint/UselessMethodDefinition: # (new in 0.90)
+  Enabled: true
+Lint/UselessTimes: # (new in 0.91)
+  Enabled: true
+Style/AccessorGrouping: # (new in 0.87)
+  Enabled: true
+Style/ArrayCoercion: # (new in 0.88)
+  Enabled: true
+Style/BisectedAttrAccessor: # (new in 0.87)
+  Enabled: true
+Style/CaseLikeIf: # (new in 0.88)
+  Enabled: true
+Style/CombinableLoops: # (new in 0.90)
+  Enabled: true
+Style/ExplicitBlockArgument: # (new in 0.89)
+  Enabled: true
+Style/ExponentialNotation: # (new in 0.82)
+  Enabled: true
+Style/GlobalStdStream: # (new in 0.89)
+  Enabled: true
+Style/HashAsLastArrayItem: # (new in 0.88)
+  Enabled: true
+Style/HashEachMethods: # (new in 0.80)
+  Enabled: true
+Style/HashLikeCase: # (new in 0.88)
+  Enabled: true
+Style/HashTransformKeys: # (new in 0.80)
+  Enabled: true
+Style/HashTransformValues: # (new in 0.80)
+  Enabled: true
+Style/KeywordParametersOrder: # (new in 0.90)
+  Enabled: true
+Style/OptionalBooleanParameter: # (new in 0.89)
+  Enabled: true
+Style/RedundantAssignment: # (new in 0.87)
+  Enabled: true
+Style/RedundantFetchBlock: # (new in 0.86)
+  Enabled: true
+Style/RedundantFileExtensionInRequire: # (new in 0.88)
+  Enabled: true
+Style/RedundantRegexpCharacterClass: # (new in 0.85)
+  Enabled: true
+Style/RedundantRegexpEscape: # (new in 0.85)
+  Enabled: true
+Style/RedundantSelfAssignment: # (new in 0.90)
+  Enabled: true
+Style/SingleArgumentDig: # (new in 0.89)
+  Enabled: true
+Style/SlicingWithRange: # (new in 0.83)
+  Enabled: true
+Style/SoleNestedConditional: # (new in 0.89)
+  Enabled: true
+Style/StringConcatenation: # (new in 0.89)
+  Enabled: true
+
+Layout/SpaceBeforeBrackets: # (new in 1.7)
+  Enabled: true
+Lint/AmbiguousAssignment: # (new in 1.7)
+  Enabled: true
+Lint/DuplicateBranch: # (new in 1.3)
+  Enabled: true
+Lint/DuplicateRegexpCharacterClassElement: # (new in 1.1)
+  Enabled: true
+Lint/EmptyBlock: # (new in 1.1)
+  Enabled: true
+Lint/EmptyClass: # (new in 1.3)
+  Enabled: true
+Lint/NoReturnInBeginEndBlocks: # (new in 1.2)
+  Enabled: true
+Lint/ToEnumArguments: # (new in 1.1)
+  Enabled: true
+Lint/UnexpectedBlockArity: # (new in 1.5)
+  Enabled: true
+Lint/UnmodifiedReduceAccumulator: # (new in 1.1)
+  Enabled: true
+Style/ArgumentsForwarding: # (new in 1.1)
+  Enabled: true
+Style/CollectionCompact: # (new in 1.2)
+  Enabled: true
+Style/DocumentDynamicEvalDefinition: # (new in 1.1)
+  Enabled: true
+Style/HashExcept: # (new in 1.7)
+  Enabled: true
+Style/NegatedIfElseCondition: # (new in 1.2)
+  Enabled: true
+Style/NilLambda: # (new in 1.3)
+  Enabled: true
+Style/RedundantArgument: # (new in 1.4)
+  Enabled: true
+Style/SwapValues: # (new in 1.1)
+  Enabled: true
+

data/Changelog.md

@@ -1,3 +1,6 @@
+## v2.0.3: 2021-01-02
+- Address potential memory leak. Unlikely to be exploitable.
+
 ## v2.0.0: 2019-01-06
 - Defaults to Argon2id for new hashes
 

data/Gemfile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 source 'https://rubygems.org'
 
 # Specify your gem's dependencies in argon2.gemspec

data/README.md

@@ -2,21 +2,20 @@
 
 This Ruby Gem provides FFI bindings, and a simplified interface, to the Argon2 algorithm. [Argon2](https://github.com/P-H-C/phc-winner-argon2) is the official winner of the Password Hashing Competition, a several year project to identify a successor to bcrypt/PBKDF/scrypt methods of securely storing passwords. This is an independant project and not official from the PHC team.
 
-
-[![Build Status](https://travis-ci.org/technion/ruby-argon2.svg?branch=master)](https://travis-ci.org/technion/ruby-argon2)
+![Build Status](https://github.com/technion/ruby-argon2/workflows/Test%20Suite/badge.svg)
 [![Code Climate](https://codeclimate.com/github/technion/ruby-argon2/badges/gpa.svg)](https://codeclimate.com/github/technion/ruby-argon2)
 [![Coverage Status](https://coveralls.io/repos/github/technion/ruby-argon2/badge.svg)](https://coveralls.io/github/technion/ruby-argon2)
 
 ## Design
 
-This project has several key tenants to its design:
+This project has several key tenets to its design:
 
 * The reference Argon2 implementation is to be used "unaltered". To ensure compliance with this goal, and encourage regular updates from upstream, the upstream library is implemented as a git submodule, and is intended to stay that way.
 * The FFI interface is kept as slim as possible, with wrapper classes preferred to implementing context structs in FFI
 * Security and maintainability take top priority. This can have an impact on platform support. A PR that contains platform specific code paths is unlikely to be accepted.
 * Tested platforms are MRI Ruby 2.2, 2.3 and JRuby 9000. No assertions are made on other platforms.
 * Errors from the C interface are raised as Exceptions. There are a lot of exception classes, but they tend to relate to things like very broken input, and code bugs. Calls to this library should generally not require a rescue.
-* Test suits should aim for 100% code coverage.
+* Test suites should aim for 100% code coverage.
 * Default work values should not be considered constants. I will increase them from time to time.
 * Not exposing the threads parameter is a design choice. I believe there is significant risk, and minimal gain in using a value other than '1'. Four threads on a four core box completely ties up the entire server to process one user logon. If you want more security, increase m_cost.
 * Many Rubocop errors have been disabled, but any commit should avoid new alerts or demonstrate their necessity.
@@ -45,7 +44,7 @@ hasher.create("password")
 ```
 
 If you follow this pattern, it is important to create a new `Argon2::Password` every time you generate a hash, in order to ensure a unique salt. See [issue 23](https://github.com/technion/ruby-argon2/issues/23) for more information.
-Alternatively, use this shotcut:
+Alternatively, use this shortcut:
 
 ```ruby
 Argon2::Password.create("password")
@@ -81,7 +80,7 @@ Version 1.0.0 included a major version bump over 0.1.4 due to several breaking c
 
 The second of these is that the reference Argon2 implementation introduced an algorithm change, which produces a hash which is not backwards compatible. This is documented on [this PR on the C library](https://github.com/P-H-C/phc-winner-argon2/pull/115). This was a regrettable requirement to address a security concern in the algorithm itself. The two versions of the Argon2 algorithm are numbered 1.0 and 1.3 respectively.
 
-Shortly after this, version 1.0.0 of this gem was released with this breaking change, supporting only Argon2 v1.3. Further time later, the official encoding format was updated, with a spec that included the version number, and the library introduced backward compatibility. This should remove the likelyhood of such breaking changes in future. Version 1.1.0 will silently introduce the current version number in hashes, in order to avoid a further compatibility break.
+Shortly after this, version 1.0.0 of this gem was released with this breaking change, supporting only Argon2 v1.3. Further time later, the official encoding format was updated, with a spec that included the version number, and the library introduced backward compatibility. This should remove the likelihood of such breaking changes in future. Version 1.1.0 will silently introduce the current version number in hashes, in order to avoid a further compatibility break.
 
 
 ## Platform Issues
@@ -92,6 +91,8 @@ Windows is not. Nobody anywhere has the resources to support Ruby FFI code on Wi
 
 grsec introduces certain challenges. Please see [documentation here](https://github.com/technion/ruby-argon2/issues/15).
 
+See the .travis.yml file to see currently tested and supported Ruby versions.
+
 ## RubyDocs documentation
 
 [The usual URL](http://www.rubydoc.info/gems/argon2) will provide detailed documentation.
@@ -109,7 +110,7 @@ Although the low level C contains support for "secure memory wipe", any code hit
 
 ### Work maximums may be tighter than reference
 
-The reference implementation is aimed to provide secure hashing for many years. This implementation doesn't want you to DoS yourself in the meantime. Accordingly, some limits artificial limits exist on work powers. This gem can be much more agile in raising these as technology progresses.
+The reference implementation is aimed to provide secure hashing for many years. This implementation doesn't want you to DoS yourself in the meantime. Accordingly, some artificial limits exist on work powers. This gem can be much more agile in raising these as technology progresses.
 
 ### Salts in general
 

data/Rakefile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "bundler/gem_tasks"
 require "rake/testtask"
 require 'rubocop/rake_task'

data/argon2.gemspec

@@ -1,4 +1,6 @@
-lib = File.expand_path('../lib', __FILE__)
+# frozen_string_literal: true
+
+lib = File.expand_path('lib', __dir__)
 
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require 'argon2/version'
@@ -20,13 +22,14 @@ Gem::Specification.new do |spec|
   spec.bindir        = "exe"
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
-  spec.add_dependency 'ffi', '~> 1.9'
-  spec.add_dependency 'ffi-compiler', '>= 0.1'
+  spec.add_dependency 'ffi', '~> 1.14'
+  spec.add_dependency 'ffi-compiler', '~> 1.0'
 
   spec.add_development_dependency "bundler", '~> 2.0'
-  spec.add_development_dependency "coveralls", '~> 0.8'
   spec.add_development_dependency "minitest", '~> 5.8'
-  spec.add_development_dependency "rake", '~> 10.4', '>= 10.4.2'
-  spec.add_development_dependency "rubocop", '~> 0.49'
+  spec.add_development_dependency "rake", '~> 13.0.1'
+  spec.add_development_dependency "rubocop", '~> 1.7'
+  spec.add_development_dependency "simplecov", '~> 0.20'
+  spec.add_development_dependency "simplecov-lcov", '~> 0.8'
   spec.extensions << 'ext/argon2_wrap/extconf.rb'
 end

data/bin/console

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require "bundler/setup"
 require "argon2"

data/ext/argon2_wrap/argon_wrap.c

@@ -130,6 +130,8 @@ int wrap_argon2_verify(const char *encoded, const char *pwd,
         type = Argon2_d;
     } else {
         // Other types not yet supported
+        free(ctx.salt);
+        free(ctx.out);
         return ARGON2_DECODING_FAIL;
     }
 

data/ext/argon2_wrap/extconf.rb

@@ -1 +1,2 @@
+# frozen_string_literal: true
 #I must admit I have no understanding of why this empty file works.

data/ext/phc-winner-argon2/.gitignore

@@ -2,6 +2,7 @@ argon2
 libargon2.a
 libargon2.so*
 libargon2.dylib
+libargon2.pc
 .DS_Store
 src/*.o
 src/blake2/*.o

data/ext/phc-winner-argon2/Argon2.sln

@@ -1,8 +1,6 @@
 
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 14
-VisualStudioVersion = 14.0.25420.1
-MinimumVisualStudioVersion = 10.0.40219.1
+Microsoft Visual Studio Solution File, Format Version 11.00
+# Visual Studio 2010
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Argon2OptTestCI", "vs2015\Argon2OptTestCI\Argon2OptTestCI.vcxproj", "{12956597-5E42-433A-93F3-D4EFF50AA207}"
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Argon2RefTestCI", "vs2015\Argon2RefTestCI\Argon2RefTestCI.vcxproj", "{8A1F7F84-34AF-4DB2-9D58-D4823DFE79E9}"

data/ext/phc-winner-argon2/LICENSE

@@ -7,8 +7,8 @@ You may use this work under the terms of a Creative Commons CC0 1.0
 License/Waiver or the Apache Public License 2.0, at your option. The terms of
 these licenses can be found at:
 
-- CC0 1.0 Universal : http://creativecommons.org/publicdomain/zero/1.0
-- Apache 2.0        : http://www.apache.org/licenses/LICENSE-2.0
+- CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0
+- Apache 2.0        : https://www.apache.org/licenses/LICENSE-2.0
 
 The terms of the licenses are reproduced below.
 

data/ext/phc-winner-argon2/Makefile

@@ -8,8 +8,8 @@
 # License/Waiver or the Apache Public License 2.0, at your option. The terms of
 # these licenses can be found at:
 #
-# - CC0 1.0 Universal : http://creativecommons.org/publicdomain/zero/1.0
-# - Apache 2.0        : http://www.apache.org/licenses/LICENSE-2.0
+# - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0
+# - Apache 2.0        : https://www.apache.org/licenses/LICENSE-2.0
 #
 # You should have received a copy of both of these licenses along with this
 # software. If not, they may be obtained at the above URLs.
@@ -18,6 +18,13 @@
 RUN = argon2
 BENCH = bench
 GENKAT = genkat
+ARGON2_VERSION ?= ZERO
+
+# installation parameters for staging area and final installation path
+# Note; if Linux and not Debian/Ubuntu version also add lib override to make command-line
+#       for RedHat/Fedora, add: LIBRARY_REL=lib64
+DESTDIR ?=
+PREFIX ?= /usr
 
 # Increment on an ABI breaking change
 ABI_VERSION = 1
@@ -56,40 +63,51 @@ endif
 
 BUILD_PATH := $(shell pwd)
 KERNEL_NAME := $(shell uname -s)
+MACHINE_NAME := $(shell uname -m)
+
+LIB_NAME = argon2
+PC_NAME = lib$(LIB_NAME).pc
+PC_SRC = $(PC_NAME).in
 
-LIB_NAME=argon2
 ifeq ($(KERNEL_NAME), Linux)
 	LIB_EXT := so.$(ABI_VERSION)
 	LIB_CFLAGS := -shared -fPIC -fvisibility=hidden -DA2_VISCTL=1
 	SO_LDFLAGS := -Wl,-soname,lib$(LIB_NAME).$(LIB_EXT)
 	LINKED_LIB_EXT := so
+	PC_EXTRA_LIBS ?= -lrt -ldl
 endif
-ifeq ($(KERNEL_NAME), $(filter $(KERNEL_NAME),FreeBSD NetBSD OpenBSD))
+ifeq ($(KERNEL_NAME), $(filter $(KERNEL_NAME),DragonFly FreeBSD NetBSD OpenBSD))
 	LIB_EXT := so
 	LIB_CFLAGS := -shared -fPIC
+	PC_EXTRA_LIBS ?=
 endif
 ifeq ($(KERNEL_NAME), Darwin)
 	LIB_EXT := $(ABI_VERSION).dylib
 	LIB_CFLAGS := -dynamiclib -install_name @rpath/lib$(LIB_NAME).$(LIB_EXT)
 	LINKED_LIB_EXT := dylib
+	PC_EXTRA_LIBS ?=
 endif
 ifeq ($(findstring CYGWIN, $(KERNEL_NAME)), CYGWIN)
 	LIB_EXT := dll
 	LIB_CFLAGS := -shared -Wl,--out-implib,lib$(LIB_NAME).$(LIB_EXT).a
+	PC_EXTRA_LIBS ?=
 endif
 ifeq ($(findstring MINGW, $(KERNEL_NAME)), MINGW)
 	LIB_EXT := dll
 	LIB_CFLAGS := -shared -Wl,--out-implib,lib$(LIB_NAME).$(LIB_EXT).a
+	PC_EXTRA_LIBS ?=
 endif
 ifeq ($(findstring MSYS, $(KERNEL_NAME)), MSYS)
 	LIB_EXT := dll
 	LIB_CFLAGS := -shared -Wl,--out-implib,lib$(LIB_NAME).$(LIB_EXT).a
+	PC_EXTRA_LIBS ?=
 endif
 ifeq ($(KERNEL_NAME), SunOS)
 	CC := gcc
 	CFLAGS += -D_REENTRANT
 	LIB_EXT := so
 	LIB_CFLAGS := -shared -fPIC
+	PC_EXTRA_LIBS ?=
 endif
 
 ifeq ($(KERNEL_NAME), Linux)
@@ -105,26 +123,53 @@ ifdef LINKED_LIB_EXT
 LINKED_LIB_SH := lib$(LIB_NAME).$(LINKED_LIB_EXT)
 endif
 
+# Some systems don't provide an unprefixed ar when cross-compiling.
+AR=ar
 
 LIBRARIES = $(LIB_SH) $(LIB_ST)
 HEADERS = include/argon2.h
 
 INSTALL = install
 
-DESTDIR =
-PREFIX = /usr
-INCLUDE_REL = include
-LIBRARY_REL = lib
-BINARY_REL = bin
+# relative paths for different OS
+ifeq ($(KERNEL_NAME), $(filter $(KERNEL_NAME),DragonFly FreeBSD))
+
+# default for FreeBSD
+BINARY_REL ?= bin
+INCLUDE_REL ?= include
+LIBRARY_REL ?= lib
+PKGCONFIG_REL ?= libdata
+
+else ifeq ($(KERNEL_NAME)-$(MACHINE_NAME), Linux-x86_64)
+
+# default for Debian/Ubuntu x86_64
+BINARY_REL ?= bin
+INCLUDE_REL ?= include
+LIBRARY_REL ?= lib/x86_64-linux-gnu
+PKGCONFIG_REL ?= $(LIBRARY_REL)
+
+else
+
+# NetBSD, ... and Linux64/Linux32 variants that use plain lib directory
+BINARY_REL ?= bin
+INCLUDE_REL ?= include
+LIBRARY_REL ?= lib
+PKGCONFIG_REL ?= $(LIBRARY_REL)
+
+endif
 
+# absolute paths to staging area
 INST_INCLUDE = $(DESTDIR)$(PREFIX)/$(INCLUDE_REL)
 INST_LIBRARY = $(DESTDIR)$(PREFIX)/$(LIBRARY_REL)
 INST_BINARY = $(DESTDIR)$(PREFIX)/$(BINARY_REL)
+INST_PKGCONFIG = $(DESTDIR)$(PREFIX)/$(PKGCONFIG_REL)/pkgconfig
 
-.PHONY: clean dist format $(GENKAT) all install
-
+# main target
+.PHONY: all
 all: $(RUN) libs
-libs: $(LIBRARIES)
+
+.PHONY: libs
+libs: $(LIBRARIES) $(PC_NAME)
 
 $(RUN):	        $(SRC) $(SRC_RUN)
 		$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@
@@ -139,49 +184,72 @@ $(LIB_SH): 	$(SRC)
 		$(CC) $(CFLAGS) $(LIB_CFLAGS) $(LDFLAGS) $(SO_LDFLAGS) $^ -o $@
 
 $(LIB_ST): 	$(OBJ)
-		ar rcs $@ $^
+		$(AR) rcs $@ $^
 
+.PHONY: clean
 clean:
-		rm -f $(RUN) $(BENCH) $(GENKAT)
-		rm -f $(LIB_SH) $(LIB_ST) kat-argon2*
+		rm -f '$(RUN)' '$(BENCH)' '$(GENKAT)'
+		rm -f '$(LIB_SH)' '$(LIB_ST)' kat-argon2* '$(PC_NAME)'
 		rm -f testcase
 		rm -rf *.dSYM
 		cd src/ && rm -f *.o
 		cd src/blake2/ && rm -f *.o
 		cd kats/ &&  rm -f kat-* diff* run_* make_*
 
+
+# all substitutions to pc template
+SED_COMMANDS  = /^\#\#.*$$/d;
+SED_COMMANDS += s\#@PREFIX@\#$(PREFIX)\#g;
+SED_COMMANDS += s\#@EXTRA_LIBS@\#$(PC_EXTRA_LIBS)\#g;
+SED_COMMANDS += s\#@UPSTREAM_VER@\#$(ARGON2_VERSION)\#g;
+SED_COMMANDS += s\#@HOST_MULTIARCH@\#$(LIBRARY_REL)\#g;
+SED_COMMANDS += s\#@INCLUDE@\#$(INCLUDE_REL)\#g;
+
+# substitute PREFIX and PC_EXTRA_LIBS into pkgconfig pc file
+$(PC_NAME): $(PC_SRC)
+		sed '$(SED_COMMANDS)' < '$(PC_SRC)' > '$@'
+
+
+.PHONY: dist
 dist:
 		cd ..; \
 		tar -c --exclude='.??*' -z -f $(DIST)-`date "+%Y%m%d"`.tgz $(DIST)/*
 
+.PHONY: test
 test:           $(SRC) src/test.c
 		$(CC) $(CFLAGS)  -Wextra -Wno-type-limits $^ -o testcase
 		@sh kats/test.sh
 		./testcase
 
+.PHONY: testci
 testci:         $(SRC) src/test.c
 		$(CC) $(CI_CFLAGS) $^ -o testcase
 		@sh kats/test.sh
 		./testcase
 
-.PHONY: test
 
+.PHONY: format
 format:
 		clang-format -style="{BasedOnStyle: llvm, IndentWidth: 4}" \
 			-i include/*.h src/*.c src/*.h src/blake2/*.c src/blake2/*.h
 
+.PHONY: install
 install: $(RUN) libs
 	$(INSTALL) -d $(INST_INCLUDE)
 	$(INSTALL) -m 0644 $(HEADERS) $(INST_INCLUDE)
 	$(INSTALL) -d $(INST_LIBRARY)
-	$(INSTALL) $(LIBRARIES) $(INST_LIBRARY)
+	$(INSTALL) -m 0644 $(LIBRARIES) $(INST_LIBRARY)
 ifdef LINKED_LIB_SH
-	cd $(INST_LIBRARY) && ln -s $(notdir $(LIB_SH) $(LINKED_LIB_SH))
+	cd $(INST_LIBRARY) && ln -sf $(notdir $(LIB_SH) $(LINKED_LIB_SH))
 endif
 	$(INSTALL) -d $(INST_BINARY)
 	$(INSTALL) $(RUN) $(INST_BINARY)
+	$(INSTALL) -d $(INST_PKGCONFIG)
+	$(INSTALL) -m 0644 $(PC_NAME) $(INST_PKGCONFIG)
 
+.PHONY: uninstall
 uninstall:
 	cd $(INST_INCLUDE) && rm -f $(notdir $(HEADERS))
 	cd $(INST_LIBRARY) && rm -f $(notdir $(LIBRARIES) $(LINKED_LIB_SH))
 	cd $(INST_BINARY) && rm -f $(notdir $(RUN))
+	cd $(INST_PKG_CONFIG) && rm -f $(notdir $(PC_NAME))