argon2id 0.8.0.rc1-x86_64-linux-gnu

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 335b330352233d19cece5b11b42aaaea51c751fb3628181220d90782957cc985
+  data.tar.gz: a5118e97e80534efc2c1480791b626e8bb5f1f14b2439840a416eba0e6ac4ce4
+SHA512:
+  metadata.gz: 79e949adb262b5db7993d7a0f323f9572103651ecde4dddfe4f942cfb3b662206f1896d2e1b24df251888da65c4a30d85ba097ece4b5158b319b6b46f7fbeb72
+  data.tar.gz: 50c7f3c0826b8932075cf78cee6ee0390f99aa3471ad3bcc23bb57109686ee95a10c97fa00dd3f73c45acfe759fd69986e6bc293c9e74aa2b6e2ee99fc8beb12

data/CHANGELOG.md

@@ -0,0 +1,142 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.8.0.rc1] - 2024-12-16
+
+### Added
+
+- Add Ruby 3.4.0-rc1 support to the precompiled, native gems
+
+### Changed
+
+- Provide separate precompiled, native gems for GNU and Musl
+- Require glibc 2.29+ for x86-linux-gnu and x86_64-linux-gnu (and recommend
+  RubyGems 3.3.22+ and Bundler 2.3.21+)
+
+### Removed
+
+- Drop support for Ruby versions older than 3.1 as they do not ship with a
+  version of RubyGems new enough to handle the new Musl gems
+
+## [0.7.0] - 2024-11-08
+
+### Fixed
+
+- Fixed verifying Argon2id encoded hashes without a version number on JRuby
+
+### Added
+
+- Added a new `Argon2id::Password.valid_hash?` API for testing if a given
+  encoded hash is a valid Argon2id hash or not (e.g. if you want to check
+  which hashing function was used to store a user's password)
+
+## [0.6.0] - 2024-11-05
+
+### Changed
+
+- Move the internal API to `Argon2id::Password` and make it explicitly private
+
+## [0.5.0] - 2024-11-02
+
+### Removed
+
+- No longer expose the `type` of an encoded hash as it must always be an
+  Argon2id hash
+
+## [0.4.1] - 2024-11-02
+
+### Changed
+
+- Refactor verification on JRuby to avoid parsing encoded hashes unnecessarily
+- No longer describe the gem in terms of bindings to the reference C
+  implementation given the Bouncy Castle-based JRuby implementation
+- Only wrap `IllegalStateException` with `Argon2id::Error` on JRuby
+
+## [0.4.0] - 2024-11-02
+
+### Added
+
+- Added support for JRuby 9.4 by adding an implementation of Argon2id hashing
+  and verification using JRuby-OpenSSL's Bouncy Castle internals
+- Added `output` to `Argon2id::Password` instances so the actual "output" part
+  of a password hash can be retrieved (and compared)
+
+### Changed
+
+- Verifying a password will now consistently raise an `ArgumentError` when
+  given an invalid encoded hash rather than an `Argon2id::Error`
+
+## [0.3.0] - 2024-11-01
+
+### Added
+
+- Expose all parameters of a hash through new readers on `Argon2id::Password`:
+  namely, `type`, `version`, `m_cost`, `t_cost`, and `parallelism`
+
+### Changed
+
+- Remove the dependency on the `base64` gem by inlining the definition of
+  `Base64.decode64` (thanks to @etiennebarrie for the tip)
+
+## [0.2.1] - 2024-11-01
+
+### Added
+
+- Anything that can be coerced to a String can now be passed to
+  `Argon2id::Password.new`
+
+## [0.2.0] - 2024-11-01
+
+### Added
+
+- The original salt for an `Argon2id::Password` can now be retrieved with
+  `Argon2id::Password#salt`
+
+### Changed
+
+- Encoded hashes are now validated when initialising an `Argon2id::Password`,
+  raising an `ArgumentError` if they are invalid
+
+## [0.1.2] - 2024-11-01
+
+### Fixed
+
+- Validate that the encoded hash passed to `Argon2id::Password.new` is a
+  null-terminated C string, raising an `ArgumentError` if it contains extra null
+  bytes
+
+## [0.1.1] - 2024-11-01
+
+### Added
+
+- RDoc documentation for the API
+
+### Fixed
+
+- Saved a superfluous extra byte when allocating the buffer for the encoded
+  hash
+
+## [0.1.0] - 2024-10-31
+
+### Added
+
+- The initial version of the Argon2id gem, providing Ruby bindings to the
+  reference C implementation of Argon2, the password-hashing function that won
+  the Password Hashing Competition.
+
+[0.8.0.rc1]: https://github.com/mudge/argon2id/releases/tag/v0.8.0.rc1
+[0.7.0]: https://github.com/mudge/argon2id/releases/tag/v0.7.0
+[0.6.0]: https://github.com/mudge/argon2id/releases/tag/v0.6.0
+[0.5.0]: https://github.com/mudge/argon2id/releases/tag/v0.5.0
+[0.4.1]: https://github.com/mudge/argon2id/releases/tag/v0.4.1
+[0.4.0]: https://github.com/mudge/argon2id/releases/tag/v0.4.0
+[0.3.0]: https://github.com/mudge/argon2id/releases/tag/v0.3.0
+[0.2.1]: https://github.com/mudge/argon2id/releases/tag/v0.2.1
+[0.2.0]: https://github.com/mudge/argon2id/releases/tag/v0.2.0
+[0.1.2]: https://github.com/mudge/argon2id/releases/tag/v0.1.2
+[0.1.1]: https://github.com/mudge/argon2id/releases/tag/v0.1.1
+[0.1.0]: https://github.com/mudge/argon2id/releases/tag/v0.1.0

data/Gemfile

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+gemspec
+
+group :memcheck, optional: true do
+  gem "ruby_memcheck"
+end

data/LICENSE

@@ -0,0 +1,11 @@
+Copyright (c) 2024 Paul Mucur.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

data/README.md

@@ -0,0 +1,371 @@
+# Argon2id - Ruby bindings to the OWASP recommended password-hashing function
+
+Ruby bindings to [Argon2][], the password-hashing function that won the 2015
+[Password Hashing Competition][].
+
+[![Build Status](https://github.com/mudge/argon2id/actions/workflows/tests.yml/badge.svg?branch=main)](https://github.com/mudge/argon2id/actions)
+
+**Current version:** 0.8.0.rc1  
+**Bundled Argon2 version:** libargon2.1 (20190702)
+
+```ruby
+Argon2id::Password.create("password").to_s
+#=> "$argon2id$v=19$m=19456,t=2,p=1$agNV6OfDL1OwE44WdrFCJw$ITrBwvCsW4b5GjgZuL67RCcvVMEWBWXtASc9TVyI3rY"
+
+password = Argon2id::Password.new("$argon2id$v=19$m=19456,t=2,p=1$ZS2nBFWBpnt28HjtzNOW4w$SQ+p+dIcWbpzWpZQ/ZZFj8IQkyhYZf127U4QdkRmKFU")
+password == "password"     #=> true
+password == "not password" #=> false
+
+password.m_cost #=> 19456
+password.salt   #=> "e-\xA7\x04U\x81\xA6{v\xF0x\xED\xCC\xD3\x96\xE3"
+```
+
+## Table of contents
+
+* [Why Argon2id?](#why-argon2id)
+* [Usage](#usage)
+    * [Hashing passwords](#hashing-passwords)
+    * [Verifying passwords](#verifying-passwords)
+    * [Validating encoded hashes](#validating-encoded-hashes)
+    * [Errors](#errors)
+    * [Usage with Active Record](#usage-with-active-record)
+* [Requirements](#requirements)
+    * [Native gems](#native-gems)
+    * [Verifying the gems](#verifying-the-gems)
+    * [Installing the `ruby` platform gem](#installing-the-ruby-platform-gem)
+* [Thanks](#thanks)
+* [Contact](#contact)
+* [License](#license)
+    * [Dependencies](#dependencies)
+
+## Why Argon2id?
+
+> Argon2 is a password-hashing function that summarizes the state of the art in
+> the design of memory-hard functions and can be used to hash passwords for
+> credential storage, key derivation, or other applications.
+>
+> It has a simple design aimed at the highest memory filling rate and effective
+> use of multiple computing units, while still providing defense against
+> tradeoff attacks (by exploiting the cache and memory organization of the
+> recent processors).
+
+— [Argon2][]
+
+> Argon2 was the winner of the 2015 Password Hashing Competition. Out of the
+> three Argon2 versions, use the Argon2id variant since it provides a balanced
+> approach to resisting both side-channel and GPU-based attacks.
+
+— [OWASP Password Storage Cheat Sheet][]
+
+See also [argon2-cffi's "Why 'just use bcrypt' Is Not the Best Answer (Anymore)"](https://argon2-cffi.readthedocs.io/en/23.1.0/argon2.html#why-just-use-bcrypt-is-not-the-best-answer-anymore).
+
+## Usage
+
+Install argon2id as a dependency:
+
+```ruby
+# In your Gemfile
+gem "argon2id"
+
+# Or without Bundler
+gem install argon2id
+```
+
+Include in your code:
+
+```ruby
+require "argon2id"
+```
+
+### Hashing passwords
+
+Hash a plain text password (e.g. from user input) with
+`Argon2id::Password.create`:
+
+```ruby
+password = Argon2id::Password.create("opensesame")
+```
+
+The encoded value of the resulting hash is available via
+`Argon2id::Password#to_s` (ideal for persisting somewhere):
+
+```ruby
+password.to_s
+#=> "$argon2id$v=19$m=19456,t=2,p=1$ZS2nBFWBpnt28HjtzNOW4w$SQ+p+dIcWbpzWpZQ/ZZFj8IQkyhYZf127U4QdkRmKFU"
+```
+
+By default, `Argon2id::Password.create` will use the second set of parameters
+recommended by [OWASP][OWASP Password Storage Cheat Sheet] but these can be
+overridden by passing keyword arguments to `Argon2id::Password.create`:
+
+* `t_cost`: the "time cost" given as a number of iterations (defaults to 2)
+* `m_cost`: the "memory cost" given in kibibytes (defaults to 19 mebibytes)
+* `parallelism`: the number of threads and compute lanes to use (defaults to 1)
+* `salt_len`: the salt size in bytes (defaults to 16)
+* `output_len`: the desired length of the hash in bytes (defaults to 32)
+
+```ruby
+password = Argon2id::Password.create("opensesame", t_cost: 3, m_cost: 12288)
+password.to_s
+#=> "$argon2id$v=19$m=12288,t=3,p=1$uukIsLS6y6etvsgoN20kVg$exMvDX/P9exvEPmnZL2gZClRyMdrnqjqyysLMP/VUWA"
+```
+
+If you want to override the parameters for all calls to
+`Argon2id::Password.create`, you can set them on `Argon2id` directly:
+
+```ruby
+Argon2id.t_cost = 3
+Argon2id.m_cost = 12288
+Argon2id.parallelism = 1
+Argon2id.salt_len = 16
+Argon2id.output_len = 32
+```
+
+### Verifying passwords
+
+To verify a password against a hash, use `Argon2id::Password#==`:
+
+```ruby
+password = Argon2id::Password.create("opensesame")
+password == "opensesame"    #=> true
+password == "notopensesame" #=> false
+```
+
+Or, if you only have the encoded hash (e.g. retrieved from storage):
+
+```ruby
+password = Argon2id::Password.new("$argon2id$v=19$m=19456,t=2,p=1$ZS2nBFWBpnt28HjtzNOW4w$SQ+p+dIcWbpzWpZQ/ZZFj8IQkyhYZf127U4QdkRmKFU")
+password == "opensesame"    #=> true
+password == "notopensesame" #=> false
+```
+
+> [!WARNING]
+> `Argon2id::Password.new` does not support hashes generated from other Argon2
+> variants such as Argon2i and Argon2d.
+
+For compatibility with [bcrypt-ruby][], `Argon2id::Password#==` is aliased to `Argon2id::Password.is_password?`:
+
+```ruby
+password = Argon2id::Password.new("$argon2id$v=19$m=19456,t=2,p=1$ZS2nBFWBpnt28HjtzNOW4w$SQ+p+dIcWbpzWpZQ/ZZFj8IQkyhYZf127U4QdkRmKFU")
+password.is_password?("opensesame")    #=> true
+password.is_password?("notopensesame") #=> false
+```
+
+> [!CAUTION]
+> `Argon2id::Password#==` only works if the plain text password is on the right, e.g. the following behaviour may be surprising:
+>
+> ```ruby
+> password = Argon2id::Password.create("password")
+> password == "password" #=> true
+> "password" == password #=> false
+> password == password   #=> false
+> ```
+>
+> If you want to avoid this ambiguity, prefer the `Argon2id::Password#is_password?` alias instead.
+
+The various parts of the encoded hash can be retrieved:
+
+```ruby
+password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
+password.version     #=> 19
+password.m_cost      #=> 256
+password.t_cost      #=> 2
+password.parallelism #=> 1
+password.salt        #=> "somesalt"
+password.output
+#=> "\x9D\xFE\xB9\x10\xE8\v\xAD\x03\x11\xFE\xE2\x0F\x9C\x0E+\x12\xC1y\x87\xB4\xCA\xC9\f.\xF5M[0!\xC6\x8B\xFE"
+```
+
+### Validating encoded hashes
+
+If you need to check ahead of time whether an encoded password hash is a valid Argon2id hash (e.g. if you're migrating between hashing functions and need to test what kind of password has been stored for a user), you can use `Argon2id::Password.valid_hash?` like so:
+
+```ruby
+Argon2id::Password.valid_hash?("$argon2id$v=19$m=65536,t=2,p=1$c29tZXNhbHQ$CTFhFdXPJO1aFaMaO6Mm5c8y7cJHAph8ArZWb2GRPPc")
+#=> true
+
+Argon2id::Password.valid_hash?("$2a$12$stsRn7Mi9r02.keRyF4OK.Aq4UWOU185lWggfUQfcupAi.b7AI/nS")
+#=> false
+```
+
+### Errors
+
+Any errors returned from Argon2 will be raised as `Argon2id::Error`, e.g.
+
+```ruby
+Argon2id::Password.create("password", salt_len: 0)
+# Salt is too short (Argon2id::Error)
+```
+
+### Usage with Active Record
+
+If you're planning to use this with Active Record instead of [Rails' own
+bcrypt-based
+`has_secure_password`](https://api.rubyonrails.org/v8.0/classes/ActiveModel/SecurePassword/ClassMethods.html),
+you can use the following as a starting point:
+
+#### The `User` model
+
+```ruby
+require "argon2id"
+
+# Schema: User(name: string, password_digest:string)
+class User < ApplicationRecord
+  attr_reader :password
+
+  validates :password_digest, presence: true
+  validates :password, confirmation: true, allow_blank: true
+
+  def password=(unencrypted_password)
+    if unencrypted_password.nil?
+      @password = nil
+      self.password_digest = nil
+    elsif !unencrypted_password.empty?
+      @password = unencrypted_password
+      self.password_digest = Argon2id::Password.create(unencrypted_password)
+    end
+  end
+
+  def authenticate(unencrypted_password)
+    password_digest? && Argon2id::Password.new(password_digest).is_password?(unencrypted_password) && self
+  end
+
+  def password_salt
+    Argon2id::Password.new(password_digest).salt if password_digest?
+  end
+end
+```
+
+This can then be used like so:
+
+```ruby
+user = User.new(name: "alice", password: "", password_confirmation: "diffpassword")
+user.save                               #=> false, password required
+user.password = "password"
+user.save                               #=> false, confirmation doesn't match
+user.password_confirmation = "password"
+user.save                               #=> true
+
+user.authenticate("notright") #=> false
+user.authenticate("password") #=> user
+
+User.find_by(name: "alice")&.authenticate("notright") #=> false
+User.find_by(name: "alice")&.authenticate("password") #=> user
+```
+
+## Requirements
+
+This gem requires any of the following to run:
+
+* [Ruby](https://www.ruby-lang.org/en/) 3.1 to 3.4.0-rc1
+* [JRuby](https://www.jruby.org) 9.4
+* [TruffleRuby](https://www.graalvm.org/ruby/) 24.1
+
+> [!NOTE]
+> The JRuby version of the gem uses
+> [JRuby-OpenSSL](https://github.com/jruby/jruby-openssl)'s implementation of
+> Argon2 while the others use the reference C implementation.
+
+### Native gems
+
+Where possible, a pre-compiled native gem will be provided for the following platforms:
+
+* Linux
+    * `aarch64-linux`, `arm-linux`, `x86-linux`, `x86_64-linux` (requires [glibc](https://www.gnu.org/software/libc/) 2.29+, RubyGems 3.3.22+ and Bundler 2.3.21+)
+    * [musl](https://musl.libc.org/)-based systems such as [Alpine](https://alpinelinux.org) are supported with Bundler 2.5.6+
+* macOS `x86_64-darwin` and `arm64-darwin`
+* Windows `x64-mingw-ucrt`
+* Java: any platform running JRuby 9.4 or higher
+
+### Verifying the gems
+
+SHA256 checksums are included in the [release
+notes](https://github.com/mudge/argon2id/releases) for each version and can be
+checked with `sha256sum`, e.g.
+
+```console
+$ gem fetch argon2id -v 0.7.0
+Fetching argon2id-0.7.0-arm64-darwin.gem
+Downloaded argon2id-0.7.0-arm64-darwin
+$ sha256sum argon2id-0.7.0-arm64-darwin.gem
+26bba5bcefa56827c728222e6df832aef5c8c4f4d3285875859a1d911477ec68  argon2id-0.7.0-arm64-darwin.gem
+```
+
+[GPG](https://www.gnupg.org/) signatures are attached to each release (the
+assets ending in `.sig`) and can be verified if you import [our signing key
+`0x39AC3530070E0F75`](https://mudge.name/39AC3530070E0F75.asc) (or fetch it
+from a public keyserver, e.g. `gpg --keyserver keyserver.ubuntu.com --recv-key
+0x39AC3530070E0F75`):
+
+```console
+$ gpg --verify argon2id-0.7.0-arm64-darwin.gem.sig argon2id-0.7.0-arm64-darwin.gem
+gpg: Signature made Fri  8 Nov 13:45:18 2024 GMT
+gpg:                using RSA key 702609D9C790F45B577D7BEC39AC3530070E0F75
+gpg: Good signature from "Paul Mucur <mudge@mudge.name>" [unknown]
+gpg:                 aka "Paul Mucur <paul@ghostcassette.com>" [unknown]
+gpg: WARNING: This key is not certified with a trusted signature!
+gpg:          There is no indication that the signature belongs to the owner.
+Primary key fingerprint: 7026 09D9 C790 F45B 577D  7BEC 39AC 3530 070E 0F75
+```
+
+The fingerprint should be as shown above or you can independently verify it
+with the ones shown in the footer of https://mudge.name.
+
+### Installing the `ruby` platform gem
+
+> [!WARNING]
+> We strongly recommend using the native gems where possible to avoid the need
+> for compiling the C extension and its dependencies which will take longer and
+> be less reliable.
+
+If you wish to compile the gem, you will need to explicitly install the `ruby` platform gem:
+
+```ruby
+# In your Gemfile with Bundler 2.3.18+
+gem "argon2id", force_ruby_platform: true
+
+# With Bundler 2.1+
+bundle config set force_ruby_platform true
+
+# With older versions of Bundler
+bundle config force_ruby_platform true
+
+# Without Bundler
+gem install argon2id --platform=ruby
+```
+
+You will need a full compiler toolchain for compiling Ruby C extensions (see
+[Nokogiri's "The Compiler
+Toolchain"](https://nokogiri.org/tutorials/installing_nokogiri.html#appendix-a-the-compiler-toolchain))
+plus the toolchain required for compiling the vendored version of Argon2.
+
+## Thanks
+
+* Thanks to [Mike Dalessio](https://github.com/flavorjones) for his advice and
+ [Ruby C Extensions Explained](https://github.com/flavorjones/ruby-c-extensions-explained)
+ project
+
+## Contact
+
+All issues and suggestions should go to [GitHub
+Issues](https://github.com/mudge/argon2id/issues).
+
+## License
+
+This library is licensed under the BSD 3-Clause License, see `LICENSE`.
+
+Copyright © 2024, Paul Mucur.
+
+### Dependencies
+
+The source code of [Argon2][] is distributed in the gem. This code is copyright
+© 2015 Daniel Dinu, Dmitry Khovratovich (main authors), Jean-Philippe Aumasson
+and Samuel Neves, and dual licensed under the [CC0 License][] and the [Apache
+2.0 License][].
+
+  [Argon2]: https://github.com/P-H-C/phc-winner-argon2/
+  [OWASP Password Storage Cheat Sheet]: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id
+  [bcrypt-ruby]: https://github.com/bcrypt-ruby/bcrypt-ruby
+  [CC0 License]: https://creativecommons.org/about/cc0
+  [Apache 2.0 License]: https://www.apache.org/licenses/LICENSE-2.0
+  [Password Hashing Competition]: https://www.password-hashing.net

data/Rakefile

@@ -0,0 +1,70 @@
+require "rake/extensiontask"
+require "rake_compiler_dock"
+require "minitest/test_task"
+
+CLEAN.add("lib/**/*.{o,so,bundle}", "pkg")
+
+cross_platforms = %w[
+  aarch64-linux-gnu
+  aarch64-linux-musl
+  arm-linux-gnu
+  arm-linux-musl
+  arm64-darwin
+  x64-mingw-ucrt
+  x64-mingw32
+  x86-linux-gnu
+  x86-linux-musl
+  x86-mingw32
+  x86_64-darwin
+  x86_64-linux-gnu
+  x86_64-linux-musl
+].freeze
+
+ENV["RUBY_CC_VERSION"] = %w[3.4.0 3.3.5 3.2.0 3.1.0].join(":")
+
+gemspec = Gem::Specification.load("argon2id.gemspec")
+
+Gem::PackageTask.new(gemspec).define
+
+namespace :java do
+  java_gemspec = gemspec.dup
+  java_gemspec.files.reject! { |path| File.fnmatch?("ext/*", path) }
+  java_gemspec.extensions.clear
+  java_gemspec.platform = Gem::Platform.new("java")
+  java_gemspec.required_ruby_version = ">= 3.1.0"
+
+  Gem::PackageTask.new(java_gemspec).define
+end
+
+Rake::ExtensionTask.new("argon2id", gemspec) do |e|
+  e.lib_dir = "lib/argon2id"
+  e.cross_compile = true
+  e.cross_platform = cross_platforms
+end
+
+Minitest::TestTask.create
+
+begin
+  require "ruby_memcheck"
+
+  namespace :test do
+    RubyMemcheck::TestTask.new(valgrind: :compile)
+  end
+rescue LoadError
+  # Only define the test:valgrind task if ruby_memcheck is installed
+end
+
+namespace :gem do
+  cross_platforms.each do |platform|
+    desc "Compile and build native gem for #{platform}"
+    task platform do
+      RakeCompilerDock.sh <<~SCRIPT, platform: platform, verbose: true
+        gem install bundler --no-document &&
+        bundle &&
+        bundle exec rake native:#{platform} pkg/#{gemspec.full_name}-#{Gem::Platform.new(platform)}.gem PATH="/usr/local/bin:$PATH"
+      SCRIPT
+    end
+  end
+end
+
+task default: [:compile, :test]

data/argon2id.gemspec

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require_relative "lib/argon2id/version"
+
+Gem::Specification.new do |s|
+  s.name = "argon2id"
+  s.version = Argon2id::VERSION
+  s.summary = "Ruby bindings to Argon2"
+  s.description = "Ruby bindings to Argon2, the password-hashing function that won the 2015 Password Hashing Competition."
+  s.license = "BSD-3-Clause"
+  s.authors = ["Paul Mucur"]
+  s.homepage = "https://github.com/mudge/argon2id"
+  s.metadata = {
+    "bug_tracker_uri" => "https://github.com/mudge/argon2id/issues",
+    "changelog_uri" => "https://github.com/mudge/argon2id/blob/main/CHANGELOG.md",
+    "funding_uri" => "https://github.com/sponsors/mudge",
+    "homepage_uri" => "https://github.com/mudge/argon2id",
+    "source_code_uri" => "https://github.com/mudge/argon2id",
+    "rubygems_mfa_required" => "true"
+  }
+  s.required_ruby_version = ">= 3.1.0"
+  s.extensions = ["ext/argon2id/extconf.rb"]
+  s.files = [
+    "CHANGELOG.md",
+    "Gemfile",
+    "LICENSE",
+    "README.md",
+    "Rakefile",
+    "argon2id.gemspec",
+    "ext/argon2id/argon2id.c",
+    "ext/argon2id/extconf.rb",
+    "ext/argon2id/libargon2/LICENSE",
+    "ext/argon2id/libargon2/argon2.c",
+    "ext/argon2id/libargon2/argon2.h",
+    "ext/argon2id/libargon2/blake2/blake2-impl.h",
+    "ext/argon2id/libargon2/blake2/blake2.h",
+    "ext/argon2id/libargon2/blake2/blake2b.c",
+    "ext/argon2id/libargon2/blake2/blamka-round-opt.h",
+    "ext/argon2id/libargon2/blake2/blamka-round-ref.h",
+    "ext/argon2id/libargon2/core.c",
+    "ext/argon2id/libargon2/core.h",
+    "ext/argon2id/libargon2/encoding.c",
+    "ext/argon2id/libargon2/encoding.h",
+    "ext/argon2id/libargon2/ref.c",
+    "ext/argon2id/libargon2/thread.c",
+    "ext/argon2id/libargon2/thread.h",
+    "lib/argon2id.rb",
+    "lib/argon2id/extension.rb",
+    "lib/argon2id/password.rb",
+    "lib/argon2id/version.rb",
+    "test/argon2id/test_password.rb",
+    "test/test_argon2id.rb"
+  ]
+  s.rdoc_options = ["--main", "README.md"]
+
+  s.add_development_dependency("rake-compiler", "~> 1.2")
+  s.add_development_dependency("rake-compiler-dock", "~> 1.7.0.rc1")
+  s.add_development_dependency("minitest", "~> 5.25")
+end