bcrypt 3.1.12 → 3.1.18

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,17 +1,7 @@
1
1
  ---
2
- !binary "U0hBMjU2":
3
- metadata.gz: !binary |-
4
- YjQwMDJlZTYyN2EzOTJhMzg3Y2YyMDgwYjZjYjdiOWRkNmNiZWRkYmMxNGVh
5
- MzkyZDczMmIzOTNjYWMwNDI3ZQ==
6
- data.tar.gz: !binary |-
7
- MDdkNzlhOGZmYjNlNWMxODE3OTBhMmFiYWU3ZDFiNDA2N2M4YThhOWUxZTcy
8
- YmEwZDE5ODg4ZWJhMjg5NWEzNg==
2
+ SHA256:
3
+ metadata.gz: ba8b7b14c18d5ad7f8dcd58b2e719925695a8af445b232d50fc21695b3cd4200
4
+ data.tar.gz: a3a566bb869dcc9001dbeae8041595152444596253d152c9a374ce9c1503d817
9
5
  SHA512:
10
- metadata.gz: !binary |-
11
- YWFlMDYxYzFjM2NlNjY5YzhkZmVmYWIxNGI5NzFkNDgzZTdkYmViNmU4Mjhm
12
- NmEzYjhiMjRlODA1ZDc2ZTRjNDQ3ODg4NzM1ZWI0YzIwNjU1YTZkZjE4MmQ3
13
- Nzc1Y2IzZGM3YmZhOWQxYjI4OTBkY2RmMTE3MWZhZDhkYTQ4ZDA=
14
- data.tar.gz: !binary |-
15
- Njc0ODJhZWE3YTMwNTNhYmRlYjllYWZkYzM1YTg5OTU5NTAwNWYyMzU4ZWM2
16
- ZmRlZmYyZGJlYWQ3NzcxNjNkOTNkODI5YTY4MTM1ZDllZGVmOTJmODNiNmRl
17
- ZWRjZjRjOGRmM2FiNTM5M2I3MDBiYWYwN2NkNGZkNjZkYzI4ZjE=
6
+ metadata.gz: 9e21ae566338f46280af6576c42b54d6dfe9e75619c35a72b87f6401bef689be8526b3385a556f332c28d9a939ca7cd4f2104ef1483f4cc24d144ba837b69af4
7
+ data.tar.gz: 1c2e714911083b8aa457d9d16c5dd084acd6610e67a4f2c489ec137b1c503f2753d4a2c98e06446bc7771caec176b7b24a207f7395541e32c31268c8d8773551
@@ -0,0 +1,59 @@
1
+ name: Test Suite
2
+
3
+ # Run against all commits and pull requests.
4
+ on: [ push, pull_request ]
5
+
6
+ jobs:
7
+ test_matrix:
8
+
9
+ strategy:
10
+ fail-fast: false
11
+ matrix:
12
+ os:
13
+ - ubuntu
14
+ - macos
15
+ - windows
16
+ ruby:
17
+ - 2.1
18
+ - 2.2
19
+ - 2.3
20
+ - 2.4
21
+ - 2.5
22
+ - 2.6
23
+ - 2.7
24
+ - '3.0'
25
+ - 3.1
26
+ - head
27
+ - jruby
28
+ - jruby-head
29
+ - truffleruby
30
+ - truffleruby-head
31
+ - mingw
32
+ exclude:
33
+ - { os: ubuntu, ruby: mingw }
34
+ - { os: macos, ruby: mingw }
35
+ - { os: windows, ruby: truffleruby }
36
+ - { os: windows, ruby: truffleruby-head }
37
+
38
+ runs-on: ${{ matrix.os }}-latest
39
+
40
+ steps:
41
+ - uses: actions/checkout@v2
42
+ - name: Set up Ruby
43
+ uses: ruby/setup-ruby@v1
44
+ with:
45
+ ruby-version: ${{ matrix.ruby }}
46
+ bundler-cache: true
47
+ env:
48
+ JAVA_OPTS: -Djdk.io.File.enableADS=true
49
+ - name: Run tests
50
+ run: bundle exec rake default
51
+ env:
52
+ JAVA_OPTS: -Djdk.io.File.enableADS=true
53
+
54
+ finish:
55
+ runs-on: ubuntu-latest
56
+ needs: [ test_matrix ]
57
+ steps:
58
+ - name: Wait for status checks
59
+ run: echo "All Green!"
data/.gitignore CHANGED
@@ -7,3 +7,4 @@ tmp
7
7
  *.jar
8
8
  .DS_Store
9
9
  .rbenv-gemsets
10
+ Gemfile.lock
data/CHANGELOG CHANGED
@@ -1,88 +1,113 @@
1
- 1.0.0 Feb 27 2007
2
- - Initial release.
1
+ 3.1.18 May 16 2022
2
+ - Unlock GVL when calculating hashes and salts [GH #260]
3
+ - Fix compilation warnings in `ext/mri/bcrypt_ext.c` [GH #261]
3
4
 
4
- 2.0.0 Mar 07 2007
5
- - Removed BCrypt::Password#exactly_equals -- use BCrypt::Password#eql? instead.
6
- - Added BCrypt::Password#is_password?.
7
- - Refactored out BCrypt::Internals into more useful BCrypt::Engine.
8
- - Added validation of secrets -- nil is not healthy.
5
+ 3.1.17 Mar 14 2022
6
+ - Fix regex in validators to use \A and \z instead of ^ and $ [GH #121]
7
+ - Truncate secrets greater than 72 bytes in hash_secret [GH #255]
8
+ - Assorted test and doc improvements
9
9
 
10
- 2.0.1 Mar 09 2007
11
- - Fixed load path issues
12
- - Fixed crashes when hashing weird values (e.g., false, etc.)
10
+ 3.1.16 Sep 3 2020
11
+ - Fix compilation on FreeBSD. [GH #234]
13
12
 
14
- 2.0.2 Jun 06 2007
15
- - Fixed example code in the README [Winson]
16
- - Fixed Solaris compatibility [Jeremy LaTrasse, Twitter crew]
13
+ 3.1.15 July 21 2020
14
+ - Remove GVL optimization. Apparently it breaks things [GH #230]
17
15
 
18
- 2.0.3 May 07 2008
19
- - Made exception classes descend from StandardError, not Exception [Dan42]
20
- - Changed BCrypt::Engine.hash to BCrypt::Engine.hash_secret to avoid Merb
21
- sorting issues. [Lee Pope]
16
+ 3.1.14 July 21 2020
17
+ - Start calibration from the minimum cost supported by the algorithm [GH #206 by @sergey-alekseev]
22
18
 
23
- 2.0.4 Mar 09 2009
24
- - Added Ruby 1.9 compatibility. [Genki Takiuchi]
25
- - Fixed segfaults on some different types of empty strings. [Mike Pomraning]
19
+ 3.1.13 May 31 2019
20
+ - No longer include compiled binaries for Windows. See GH #173.
21
+ - Update C and Java implementations to latest versions [GH #182 by @fonica]
22
+ - Bump default cost to 12 [GH #181 by @bdewater]
23
+ - Remove explicit support for Rubies 1.8 and 1.9
24
+ - Define SKIP_GNU token when building extension (Fixes FreeBSD >= 12) [GH #189 by @adam12]
26
25
 
27
- 2.0.5 Mar 11 2009
28
- - Fixed Ruby 1.8.5 compatibility. [Mike Pomraning]
26
+ 3.1.12 May 16 2018
27
+ - Add support for Ruby 2.3, 2.4, and 2.5 in compiled Windows binaries
28
+ - Fix compatibility with libxcrypt - Fixes hash errors in Fedora 28 and Ubuntu 20 [GH #164 by @besser82]
29
29
 
30
- 2.1.0 Aug 12 2009
31
- - Improved code coverage, unit tests, and build chain. [Hongli Lai]
32
- - Ruby 1.9 compatibility fixes. [Hongli Lai]
33
- - JRuby support, using Damien Miller's jBCrypt. [Hongli Lai]
34
- - Ruby 1.9 GIL releasing for high-cost hashes. [Hongli Lai]
30
+ 3.1.11 Mar 06 2016
31
+ - Add support for Ruby 2.2 in compiled Windows binaries
35
32
 
36
- 2.1.1 Aug 14 2009
37
- - JVM 1.4/1.5 compatibility [Hongli Lai]
33
+ 3.1.10 Jan 28 2015
34
+ - Fix issue with dumping a BCrypt::Password instance to YAML in Ruby 2.2 [GH #107 by @mattwildig]
38
35
 
39
- 2.1.2 Sep 16 2009
40
- - Fixed support for Solaris, OpenSolaris.
36
+ 3.1.9 Oct 23 2014
37
+ - Rebuild corrupt binaries
41
38
 
42
- 3.0.0 Aug 24 2011
43
- - Bcrypt C implementation replaced with a public domain implementation.
44
- - License changed to MIT
39
+ 3.1.8 Oct 23 2014
40
+ - Add support for Ruby 2.1 in compiled Windows binaries [GH #102]
45
41
 
46
- 3.0.1 Sep 12 2011
47
- - create raises an exception if the cost is higher than 31. GH #27
42
+ 3.1.7 Feb 24 2014
43
+ - Rebuild corrupt Java binary version of gem [GH #90]
44
+ - The 2.1 support for Windows binaries alleged in 3.1.3 was a lie -- documentation removed
45
+
46
+ 3.1.6 Feb 21 2014
47
+ - Dummy version of "bcrypt-ruby" needed a couple version bumps to fix some
48
+ bugs. It felt wrong to have that at a higher version than the real gem, so
49
+ the real gem is getting bumped to 3.1.6.
50
+
51
+ 3.1.3 Feb 21 2014
52
+ - Add support for Ruby 2.1 in compiled Windows binaries
53
+ - Rename gem from "bcrypt-ruby" to just "bcrypt". [GH #86 by @sferik]
54
+
55
+ 3.1.2 Aug 26 2013
56
+ - Add support for Ruby 1.8 and 2.0 (in addition to 1.9) in compiled Windows binaries
57
+ - Add support for 64-bit Windows
58
+
59
+ 3.1.1 Jul 10 2013
60
+ - Remove support for Ruby 1.8 in compiled win32 binaries
48
61
 
49
62
  3.1.0 May 07 2013
50
63
  - Add BCrypt::Password.valid_hash?(str) to check if a string is a valid bcrypt password hash
51
64
  - BCrypt::Password cost should be set to DEFAULT_COST if nil
52
65
  - Add BCrypt::Engine.cost attribute for getting/setting a default cost externally
53
66
 
54
- 3.1.1 Jul 10 2013
55
- - Remove support for Ruby 1.8 in compiled win32 binaries
67
+ 3.0.1 Sep 12 2011
68
+ - create raises an exception if the cost is higher than 31. GH #27
56
69
 
57
- 3.1.2 Aug 26 2013
58
- - Add support for Ruby 1.8 and 2.0 (in addition to 1.9) in compiled Windows binaries
59
- - Add support for 64-bit Windows
70
+ 3.0.0 Aug 24 2011
71
+ - Bcrypt C implementation replaced with a public domain implementation.
72
+ - License changed to MIT
60
73
 
61
- 3.1.3 Feb 21 2014
62
- - Add support for Ruby 2.1 in compiled Windows binaries
63
- - Rename gem from "bcrypt-ruby" to just "bcrypt". [GH #86 by @sferik]
74
+ 2.1.2 Sep 16 2009
75
+ - Fixed support for Solaris, OpenSolaris.
64
76
 
65
- 3.1.6 Feb 21 2014
66
- - Dummy version of "bcrypt-ruby" needed a couple version bumps to fix some
67
- bugs. It felt wrong to have that at a higher version than the real gem, so
68
- the real gem is getting bumped to 3.1.6.
77
+ 2.1.1 Aug 14 2009
78
+ - JVM 1.4/1.5 compatibility [Hongli Lai]
69
79
 
70
- 3.1.7 Feb 24 2014
71
- - Rebuild corrupt Java binary version of gem [GH #90]
72
- - The 2.1 support for Windows binaries alleged in 3.1.3 was a lie -- documentation removed
80
+ 2.1.0 Aug 12 2009
81
+ - Improved code coverage, unit tests, and build chain. [Hongli Lai]
82
+ - Ruby 1.9 compatibility fixes. [Hongli Lai]
83
+ - JRuby support, using Damien Miller's jBCrypt. [Hongli Lai]
84
+ - Ruby 1.9 GIL releasing for high-cost hashes. [Hongli Lai]
73
85
 
74
- 3.1.8 Oct 23 2014
75
- - Add support for Ruby 2.1 in compiled Windows binaries [GH #102]
86
+ 2.0.5 Mar 11 2009
87
+ - Fixed Ruby 1.8.5 compatibility. [Mike Pomraning]
76
88
 
77
- 3.1.9 Oct 23 2014
78
- - Rebuild corrupt binaries
89
+ 2.0.4 Mar 09 2009
90
+ - Added Ruby 1.9 compatibility. [Genki Takiuchi]
91
+ - Fixed segfaults on some different types of empty strings. [Mike Pomraning]
79
92
 
80
- 3.1.10 Jan 28 2015
81
- - Fix issue with dumping a BCrypt::Password instance to YAML in Ruby 2.2 [GH #107 by @mattwildig]
93
+ 2.0.3 May 07 2008
94
+ - Made exception classes descend from StandardError, not Exception [Dan42]
95
+ - Changed BCrypt::Engine.hash to BCrypt::Engine.hash_secret to avoid Merb
96
+ sorting issues. [Lee Pope]
82
97
 
83
- 3.1.11 Mar 06 2016
84
- - Add support for Ruby 2.2 in compiled Windows binaries
98
+ 2.0.2 Jun 06 2007
99
+ - Fixed example code in the README [Winson]
100
+ - Fixed Solaris compatibility [Jeremy LaTrasse, Twitter crew]
85
101
 
86
- 3.1.12 May 16 2018
87
- - Add support for Ruby 2.3, 2.4, and 2.5 in compiled Windows binaries
88
- - Fix compatibility with libxcrypt [GH #164 by @besser82]
102
+ 2.0.1 Mar 09 2007
103
+ - Fixed load path issues
104
+ - Fixed crashes when hashing weird values (e.g., false, etc.)
105
+
106
+ 2.0.0 Mar 07 2007
107
+ - Removed BCrypt::Password#exactly_equals -- use BCrypt::Password#eql? instead.
108
+ - Added BCrypt::Password#is_password?.
109
+ - Refactored out BCrypt::Internals into more useful BCrypt::Engine.
110
+ - Added validation of secrets -- nil is not healthy.
111
+
112
+ 1.0.0 Feb 27 2007
113
+ - Initial release.
data/README.md CHANGED
@@ -2,9 +2,9 @@
2
2
 
3
3
  An easy way to keep your users' passwords secure.
4
4
 
5
- * http://github.com/codahale/bcrypt-ruby/tree/master
5
+ * https://github.com/bcrypt-ruby/bcrypt-ruby/tree/master
6
6
 
7
- [![Build Status](https://travis-ci.org/codahale/bcrypt-ruby.png?branch=master)](https://travis-ci.org/codahale/bcrypt-ruby)
7
+ [![Github Actions Build Status](https://github.com/bcrypt-ruby/bcrypt-ruby/actions/workflows/ruby.yml/badge.svg?branch=master)](https://github.com/bcrypt-ruby/bcrypt-ruby/actions/workflows/ruby.yml)
8
8
 
9
9
  ## Why you should use `bcrypt()`
10
10
 
@@ -18,7 +18,7 @@ security experts is not a professional response to risk.
18
18
  `bcrypt()` allows you to easily harden your application against these kinds of attacks.
19
19
 
20
20
  *Note*: JRuby versions of the bcrypt gem `<= 2.1.3` had a [security
21
- vulnerability](http://www.mindrot.org/files/jBCrypt/internat.adv) that
21
+ vulnerability](https://www.mindrot.org/files/jBCrypt/internat.adv) that
22
22
  was fixed in `>= 2.1.4`. If you used a vulnerable version to hash
23
23
  passwords with international characters in them, you will need to
24
24
  re-hash those passwords. This vulnerability only affected the JRuby gem.
@@ -27,16 +27,16 @@ re-hash those passwords. This vulnerability only affected the JRuby gem.
27
27
 
28
28
  gem install bcrypt
29
29
 
30
- The bcrypt gem is available on the following ruby platforms:
30
+ The bcrypt gem is available on the following Ruby platforms:
31
31
 
32
32
  * JRuby
33
- * RubyInstaller 1.8, 1.9, 2.0, 2.1, 2.2, 2.3, 2.4, and 2.5 builds on Windows
34
- * Any 1.8, 1.9, 2.0, 2.1, 2.2, 2.3, 2.4, or 2.5 Ruby on a BSD/OS X/Linux system with a compiler
33
+ * RubyInstaller 2.0 3.0 builds on Windows with the DevKit
34
+ * Any 2.0 3.0 Ruby on a BSD/OS X/Linux system with a compiler
35
35
 
36
36
  ## How to use `bcrypt()` in your Rails application
37
37
 
38
38
  *Note*: Rails versions >= 3 ship with `ActiveModel::SecurePassword` which uses bcrypt-ruby.
39
- `has_secure_password` [docs](http://api.rubyonrails.org/classes/ActiveModel/SecurePassword/ClassMethods.html#method-i-has_secure_password)
39
+ `has_secure_password` [docs](https://api.rubyonrails.org/classes/ActiveModel/SecurePassword/ClassMethods.html#method-i-has_secure_password)
40
40
  implements a similar authentication strategy to the code below.
41
41
 
42
42
  ### The _User_ model
@@ -81,14 +81,14 @@ end
81
81
  require 'bcrypt'
82
82
 
83
83
  my_password = BCrypt::Password.create("my password")
84
- #=> "$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa"
84
+ #=> "$2a$12$K0ByB.6YI2/OYrB4fQOYLe6Tv0datUVf6VZ/2Jzwm879BW5K1cHey"
85
85
 
86
86
  my_password.version #=> "2a"
87
- my_password.cost #=> 10
87
+ my_password.cost #=> 12
88
88
  my_password == "my password" #=> true
89
89
  my_password == "not my password" #=> false
90
90
 
91
- my_password = BCrypt::Password.new("$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa")
91
+ my_password = BCrypt::Password.new("$2a$12$K0ByB.6YI2/OYrB4fQOYLe6Tv0datUVf6VZ/2Jzwm879BW5K1cHey")
92
92
  my_password == "my password" #=> true
93
93
  my_password == "not my password" #=> false
94
94
  ```
@@ -155,14 +155,14 @@ If an attacker was using Ruby to check each password, they could check ~140,000
155
155
  In addition, `bcrypt()` allows you to increase the amount of work required to hash a password as computers get faster. Old
156
156
  passwords will still work fine, but new passwords can keep up with the times.
157
157
 
158
- The default cost factor used by bcrypt-ruby is 10, which is fine for session-based authentication. If you are using a
158
+ The default cost factor used by bcrypt-ruby is 12, which is fine for session-based authentication. If you are using a
159
159
  stateless authentication architecture (e.g., HTTP Basic Auth), you will want to lower the cost factor to reduce your
160
160
  server load and keep your request times down. This will lower the security provided you, but there are few alternatives.
161
161
 
162
162
  To change the default cost factor used by bcrypt-ruby, use `BCrypt::Engine.cost = new_value`:
163
163
  ```ruby
164
164
  BCrypt::Password.create('secret').cost
165
- #=> 10, the default provided by bcrypt-ruby
165
+ #=> 12, the default provided by bcrypt-ruby
166
166
 
167
167
  # set a new default cost
168
168
  BCrypt::Engine.cost = 8
@@ -180,13 +180,13 @@ system available.
180
180
 
181
181
  For a more technical explanation of the algorithm and its design criteria, please read Niels Provos and David Mazières'
182
182
  Usenix99 paper:
183
- http://www.usenix.org/events/usenix99/provos.html
183
+ https://www.usenix.org/events/usenix99/provos.html
184
184
 
185
185
  If you'd like more down-to-earth advice regarding cryptography, I suggest reading <i>Practical Cryptography</i> by Niels
186
186
  Ferguson and Bruce Schneier:
187
- http://www.schneier.com/book-practical.html
187
+ https://www.schneier.com/book-practical.html
188
188
 
189
189
  # Etc
190
190
 
191
191
  * Author :: Coda Hale <coda.hale@gmail.com>
192
- * Website :: http://blog.codahale.com
192
+ * Website :: https://codahale.com
data/Rakefile CHANGED
@@ -8,14 +8,6 @@ require 'benchmark'
8
8
 
9
9
  CLEAN.include(
10
10
  "tmp",
11
- "lib/1.8",
12
- "lib/1.9",
13
- "lib/2.0",
14
- "lib/2.1",
15
- "lib/2.2",
16
- "lib/2.3",
17
- "lib/2.4",
18
- "lib/2.5",
19
11
  "lib/bcrypt_ext.jar",
20
12
  "lib/bcrypt_ext.so"
21
13
  )
@@ -58,29 +50,12 @@ end
58
50
  if RUBY_PLATFORM =~ /java/
59
51
  Rake::JavaExtensionTask.new('bcrypt_ext', GEMSPEC) do |ext|
60
52
  ext.ext_dir = 'ext/jruby'
53
+ ext.source_version = "1.7"
54
+ ext.target_version = "1.7"
61
55
  end
62
56
  else
63
57
  Rake::ExtensionTask.new("bcrypt_ext", GEMSPEC) do |ext|
64
58
  ext.ext_dir = 'ext/mri'
65
- ext.cross_compile = true
66
- ext.cross_platform = ['x86-mingw32', 'x64-mingw32']
67
- end
68
-
69
- ENV['RUBY_CC_VERSION'].to_s.split(':').each do |ruby_version|
70
- platforms = {
71
- "x86-mingw32" => "i686-w64-mingw32",
72
- "x64-mingw32" => "x86_64-w64-mingw32"
73
- }
74
- platforms.each do |platform, prefix|
75
- task "copy:bcrypt_ext:#{platform}:#{ruby_version}" do |t|
76
- %w[lib tmp/#{platform}/stage/lib].each do |dir|
77
- so_file = "#{dir}/#{ruby_version[/^\d+\.\d+/]}/bcrypt_ext.so"
78
- if File.exists?(so_file)
79
- sh "#{prefix}-strip -S #{so_file}"
80
- end
81
- end
82
- end
83
- end
84
59
  end
85
60
  end
86
61
 
data/bcrypt.gemspec CHANGED
@@ -1,6 +1,6 @@
1
1
  Gem::Specification.new do |s|
2
2
  s.name = 'bcrypt'
3
- s.version = '3.1.12'
3
+ s.version = '3.1.18'
4
4
 
5
5
  s.summary = "OpenBSD's bcrypt() password hashing algorithm."
6
6
  s.description = <<-EOF
@@ -12,11 +12,9 @@ Gem::Specification.new do |s|
12
12
  s.files = `git ls-files`.split("\n")
13
13
  s.require_path = 'lib'
14
14
 
15
- s.add_development_dependency 'rake-compiler', '~> 0.9.2'
15
+ s.add_development_dependency 'rake-compiler', '~> 1.2.0'
16
16
  s.add_development_dependency 'rspec', '>= 3'
17
- s.add_development_dependency 'rdoc', '~> 3.12'
18
17
 
19
- s.has_rdoc = true
20
18
  s.rdoc_options += ['--title', 'bcrypt-ruby', '--line-numbers', '--inline-source', '--main', 'README.md']
21
19
  s.extra_rdoc_files += ['README.md', 'COPYING', 'CHANGELOG', *Dir['lib/**/*.rb']]
22
20
 
@@ -24,6 +22,6 @@ Gem::Specification.new do |s|
24
22
 
25
23
  s.authors = ["Coda Hale"]
26
24
  s.email = "coda.hale@gmail.com"
27
- s.homepage = "https://github.com/codahale/bcrypt-ruby"
25
+ s.homepage = "https://github.com/bcrypt-ruby/bcrypt-ruby"
28
26
  s.license = "MIT"
29
27
  end