argon2id 0.9.0-java → 0.10.0-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d800bf5ae7adbe6147fd6f203c786b0eeb5f9dbe95dd4f014468ace9e25b49e
-  data.tar.gz: 1d01ea1bbe6f8230fbad76bac860c8dd800bf197bdec4c2828042e421194bec5
+  metadata.gz: c752158cef0854ab64c00cd3346cc664f71f165cd020d66a7c89e7d1fc94cf95
+  data.tar.gz: ba733bbd6d58a4f0d38ce903fcb6394e4b3779d45351d6c4ba9a3b0833ad837d
 SHA512:
-  metadata.gz: 53034e61b8278965fcc19ab077bc1891f79d28cafcc0f919a959232c9f8413cb86196db325afede3608b90ce13fb428455fc21b797ae56b5deaaedd3987f5f3f
-  data.tar.gz: cf38332ace3dffda693e6aaf4703ed690b60856800ff79dfda0294b9905b7987babf46a7f889f90e2547631ee845b6ab5278204b75297f22fa592113d064695c
+  metadata.gz: 01a4ca3f615bbf4a524892e1ec5ed168d01ba77624901488bf324ca23a2d2fc605d449cc7c5686b0a220d2999ef72b772e3c059802ea2a8dab8f5052a45f89c0
+  data.tar.gz: d5f4be4cb26348d7163a92dd1ee1fe9ff5a7064e5d3cc30c3ad0e689550f9325f482aa9afbe4bcbec7c44c6c4216274ea87a9148ff2cf5130e92e7132fd8c136

data/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.0] - 2026-04-06
+
+### Changed
+
+- Hashing and verifying passwords no longer holds the Ruby Global VM Lock
+  during the intentionally expensive computation of the Argon2id hash, allowing
+  other threads to do work at the same time.
+- Argon2id::Password objects, their encoded password hash, salt, and hash
+  output strings are now all frozen to prevent mutation. Inputs are also now
+  frozen ASAP during hashing and verification to prevent mutation before
+  passing to the internal C/Java implementation of Argon2.
+- The extension is now flagged as safe to use with Ractors.
+
 ## [0.9.0] - 2025-12-30
 
 ### Added
@@ -151,6 +164,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   reference C implementation of Argon2, the password-hashing function that won
   the Password Hashing Competition.
 
+[0.10.0]: https://github.com/mudge/argon2id/releases/tag/v0.10.0
 [0.9.0]: https://github.com/mudge/argon2id/releases/tag/v0.9.0
 [0.8.0]: https://github.com/mudge/argon2id/releases/tag/v0.8.0
 [0.8.0.rc1]: https://github.com/mudge/argon2id/releases/tag/v0.8.0.rc1

data/README.md

@@ -5,7 +5,7 @@ Ruby bindings to [Argon2][], the password-hashing function that won the 2015
 
 [![Build Status](https://github.com/mudge/argon2id/actions/workflows/tests.yml/badge.svg?branch=main)](https://github.com/mudge/argon2id/actions)
 
-**Current version:** 0.9.0  
+**Current version:** 0.10.0  
 **Bundled Argon2 version:** libargon2.1 (20190702)
 
 ```ruby

data/lib/argon2id/password.rb

@@ -115,13 +115,14 @@ module Argon2id
     def initialize(encoded)
       raise ArgumentError, "invalid hash" unless PATTERN =~ String(encoded)
 
-      @encoded = $&
+      @encoded = $&.freeze
       @version = Integer($1 || 0x10)
       @m_cost = Integer($2)
       @t_cost = Integer($3)
       @parallelism = Integer($4)
-      @salt = $5.unpack1("m")
-      @output = $6.unpack1("m")
+      @salt = $5.unpack1("m").freeze
+      @output = $6.unpack1("m").freeze
+      freeze
     end
 
     # Return the encoded password hash.

data/lib/argon2id/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Argon2id
-  VERSION = "0.9.0"
+  VERSION = "0.10.0"
 end

data/test/argon2id/test_password.rb

@@ -188,6 +188,42 @@ class TestPassword < Minitest::Test
     assert password == "password"
   end
 
+  def test_new_password_is_frozen
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert password.frozen?
+  end
+
+  def test_encoded_is_frozen
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert password.encoded.frozen?
+  end
+
+  def test_salt_is_frozen
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert password.salt.frozen?
+  end
+
+  def test_output_is_frozen
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert password.output.frozen?
+  end
+
   def test_encoded_returns_the_full_encoded_hash
     password = Argon2id::Password.new(
       "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
@@ -526,6 +562,12 @@ class TestPassword < Minitest::Test
     Argon2id.output_len = Argon2id::DEFAULT_OUTPUT_LEN
   end
 
+  def test_create_password_is_frozen
+    password = Argon2id::Password.create("password")
+
+    assert password.frozen?
+  end
+
   def test_create_password_equals_correct_password
     password = Argon2id::Password.create("password")
 
@@ -538,6 +580,31 @@ class TestPassword < Minitest::Test
     refute password == "differentpassword"
   end
 
+  def test_create_is_thread_safe
+    threads = 10.times.map do |i|
+      Thread.new(i) do |n|
+        password = Argon2id::Password.create("password-#{n}", t_cost: 2, m_cost: 256, parallelism: 1)
+        assert password == "password-#{n}"
+      end
+    end
+
+    threads.each(&:value)
+  end
+
+  def test_verify_is_thread_safe
+    hash = Argon2id::Password.create("password", t_cost: 2, m_cost: 256, parallelism: 1).to_s
+
+    threads = 10.times.map do |i|
+      Thread.new do
+        password = Argon2id::Password.new(hash)
+        assert password == "password"
+        refute password == "wrong"
+      end
+    end
+
+    threads.each(&:value)
+  end
+
   def test_hashing_password_verifies_correct_password
     hash = Argon2id::Password.create("password").to_s
     password = Argon2id::Password.new(hash)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: argon2id
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.10.0
 platform: java
 authors:
 - Paul Mucur
@@ -95,7 +95,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Ruby bindings to Argon2
 test_files: []