messagesodium 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 3bbe8437f3f0156fccf90bb3defdf1b565057196
-  data.tar.gz: 01b0de5ed925df8cc9c501b83b07899acfa83b9b
+  metadata.gz: ab737303b92992980e7aa7189686b57603c40cea
+  data.tar.gz: 3d3216c1bfbc8174f4ed8d4a1808a44c7b3d515a
 SHA512:
-  metadata.gz: 7d901c443944865798e2485a7d78da76abdd6110d2d432f1255887c5352bd5470691290cfb74b3c297e6b4f98d71d3348f2cb7d6c3c22ee3c71e21bb6b271a15
-  data.tar.gz: 75cb3cafda0ebbd2792c8f7a049f3fa0854dcfe8e10e88ccb0b7a2968c654f5bfb0af74acb80d7ce04e83d1657e494da41bc4b352f8fe231c2b539fe4001ff21
+  metadata.gz: 6f267c8fc47f1741adfb8b239cf7e71f9b5e44d9ff2f1735f72c44f6916d2d0db74db9cd3d0d6bfcab4e37a10e98da80de7fa4a8e17060ae4fc4b6224fe5a7d5
+  data.tar.gz: 4024beeed614f60c3831940d0295f9baf14ef7cae9d627c1832d70ae46be2803e877579f8567459960fd192f005bb61689071adb169caee7b230f8db53f88ecb

data/README.md

@@ -1,12 +1,13 @@
 # Messagesodium
 
-Project status: Turbo Pre-alpha
+Project status: 1.0 Release candidate
 
 Patches Cookiestore to use libsodium for encryption and verification.
+[![Build Status](https://travis-ci.org/technion/messagesodium.svg?branch=master)](https://travis-ci.org/technion/messagesodium)
 
 # Cookistore
 
-Rails [Cookiestore](https://www.justinweiss.com/articles/how-rails-sessions-work/) is a heavily underrated feature. It bought commonsense to session management at a time when [saving every user session in its own tmpfile on a server](http://php.net/manual/en/function.session-start.php) was slow and unreasonable to scale, and XXX.
+Rails [Cookiestore](https://www.justinweiss.com/articles/how-rails-sessions-work/) is a heavily underrated feature. It bought commonsense to session management at a time when [saving every user session in its own tmpfile on a server](http://php.net/manual/en/function.session-start.php) was slow and unreasonable to scale. And finally it avoided by default the horrible security issues we've seen with directly storing session variables in a cookie.
 
 This gem brings an alternative backend to CookieStore.
 
@@ -65,7 +66,7 @@ What you'll find in this gem is a much smaller, more easily audited codebase wit
 
 # Approach
 
-This gem is designed largely as a drop-in replacement for MessageEncryptor, which in turn is used by CookieStore. In a defualt environment, Rails astracts away everything I say below.
+This gem is designed largely as a drop-in replacement for MessageEncryptor, which in turn is used by CookieStore. In a default environment, Rails astracts away everything I say below.
 
 MessageEncryptor takes a "secret", and a "signing secret", using them as two different secrets. Libsodium only needs a 256-bit secret.
 

data/lib/messagesodium/version.rb

@@ -1,3 +1,3 @@
 module Messagesodium
-  VERSION = "0.2.0".freeze
+  VERSION = "0.3.0".freeze
 end

data/lib/messagesodium.rb

@@ -25,13 +25,18 @@ module ActiveSupport
     # Encrypt and authenticate using libsodium XSalsa20/Poly1305
     # Serialise with JSON.dump
     # Returns base64(random nonce + cipher + auth tag)
+    # URLSafe encoding means it doesn't have to be mangled further to 
+    # become a cookie
     def encrypt_and_sign(value)
-      Base64.strict_encode64(@box.encrypt(::JSON.dump(value)))
+      Base64.urlsafe_encode64(@box.encrypt(::JSON.dump(value)))
     end
 
     # Decrypt the message, and check the auth tag in the process.
     def decrypt_and_verify(value)
-      ::JSON.parse(@box.decrypt(Base64.decode64(value)), symbolize_names: true)
+      ::JSON.parse(
+        @box.decrypt(
+          Base64.urlsafe_decode64(value)),
+        symbolize_names: true)
     rescue RbNaCl::CryptoError
       raise InvalidMessage
     end

data/messagesodium.gemspec

@@ -10,7 +10,8 @@ Gem::Specification.new do |spec|
   spec.email         = ["technion@lolware.net"]
 
   spec.summary       = %q{Patches MessageEncryptor/Cookiestore to use Libsodium .}
-  spec.description   = %q{Introduces modern crypto, higher performance, smaller cookies to your sessions.}
+  spec.description   = 'Introduces modern crypto, higher performance,' \
+                       ' smaller cookies to your sessions.'
   spec.homepage      = "https://github.com/technion/messagesodium"
   spec.license       = "MIT"
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: messagesodium
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Technion
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-09-04 00:00:00.000000000 Z
+date: 2017-09-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rbnacl-libsodium