secretbox 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 66063a036d91ef89f2e4a2bcb89d2cb0d9f4592da4b06d602208f731732ba77f
+  data.tar.gz: 427a24a4ba19958be04169fa67d8471e8b754e037edd00c6e4e1cdc2e2b84b22
+SHA512:
+  metadata.gz: d95aeceb5ab531a3f0486a21f370d6cd21be61ded0fb3220f6e6d3fe8ddd22721c7511ba42fc5fa5419e388ff01f2249b0857d218e1d9790cb8119f7acabb678
+  data.tar.gz: 7941981ed45a43b06452698a21e754decec6e59293fa22532d08e33758f7ea1f9f879ee6cf95b2e843187cf70fdee80c0ab850c5093c8ec1ab90c5f77b8da918

data/.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby-version: ['2.3', '2.4', '2.5', '2.6', '2.7', '3.0', '3.1', '3.2', '3.3', '3.4']
+        include:
+          - ruby-version: '4.0'
+            allow-failure: true
+          - ruby-version: ruby-head
+            allow-failure: true
+          - ruby-version: jruby-head
+            allow-failure: true
+
+    continue-on-error: ${{ matrix.allow-failure || false }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Ruby ${{ matrix.ruby-version }}
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby-version }}
+          bundler-cache: true
+
+      - name: Run tests
+        run: bundle exec rake spec
+
+      - name: Upload coverage to Codecov
+        if: matrix.ruby-version == '3.4'
+        uses: codecov/codecov-action@v5
+        with:
+          files: coverage/.resultset.json
+          token: ${{ secrets.CODECOV_TOKEN }}

data/.gitignore

@@ -0,0 +1,10 @@
+/.bundle/
+/.yardoc
+/Gemfile.lock
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+*.gem

data/.ruby-gemset

@@ -0,0 +1 @@
+secretbox

data/.ruby-version

@@ -0,0 +1 @@
+3.2.1

data/AGENTS.md

@@ -0,0 +1,214 @@
+# Secretbox Agent Guidelines
+
+Guidelines for agents working on the secretbox gem.
+
+## Ruby Version Support
+
+The gem maintains **backward compatibility** from Ruby **2.3.8** to **3.4+**.
+
+- **2.3.8–3.3**: Fully supported (tested in CI)
+- **3.4+**: Fully supported (base64 added as explicit dependency)
+- **4.0, JRuby-head**: Experimental (allow-failure in CI)
+
+When adding features or fixing bugs:
+1. Test locally with `RUBY_VERSION >= 2.3.8`
+2. Never use syntax newer than Ruby 2.3 (e.g., safe navigation `&.`, pattern matching)
+3. All dependencies must work on Ruby 2.3.8+
+4. Special handling for Ruby 3.4+ (see `secretbox.gemspec` for `base64` conditional dependency)
+
+## Code Style & Conventions
+
+### No Comments
+Do not add comments to explain code. The code must be self-documenting through:
+- Meaningful method and variable names
+- Clear algorithm flow
+- Tests that serve as living documentation
+
+Existing comments are minimal by design. Keep it that way.
+
+### Private Methods
+- Use `private` keyword to mark internal methods
+- Access instance state through explicit `attr_reader` (never directly access `@key` outside the class)
+- See `lib/secretbox.rb` for the pattern
+
+### Constants
+- Define at class level in UPPERCASE
+- Freeze strings: `.freeze`
+- Group related constants together (ALGORITHM, KEY_SIZE, IV_SIZE, TAG_SIZE)
+
+### Error Classes
+- Inherit from `StandardError`
+- Define nested under the main class
+- Use existing: `Secretbox::InvalidKeyError`, `Secretbox::DecryptionError`
+- Add only if new error condition cannot fit existing types
+
+### Method Signatures
+- Use keyword arguments for optional parameters (e.g., `auth_data: ''`)
+- Default empty string `''` for `auth_data`, not `nil`
+- Type validation happens early via `validate_string!`
+
+## Testing
+
+- Test framework: **Minitest** with `minitest-great_expectations` DSL
+- Test file location: `spec/secretbox_spec.rb`
+- Pattern: `describe`, `let`, `it` with `.must_*` assertions
+- Cover: happy path, errors, edge cases, type validation, tampering
+
+Run tests:
+```bash
+bundle exec rake spec
+```
+
+Test filtering:
+```bash
+bundle exec rake spec NAME=encrypts  # runs tests matching "encrypts"
+bundle exec rake spec TEST=spec/secretbox_spec.rb:12  # runs line 12
+```
+
+## Version Management
+
+Versioning follows [Semantic Versioning](https://semver.org):
+
+- **MAJOR.MINOR.PATCH** format
+- Located in `lib/secretbox/version.rb`
+- `Secretbox::VERSION = '1.0.0'`
+
+Increment:
+- **MAJOR**: Breaking changes (e.g., change method signature)
+- **MINOR**: New features, backward compatible
+- **PATCH**: Bug fixes
+
+Update version **before** committing changes.
+
+## Git Conventions
+
+### Commit Messages
+All commits use **Conventional Commits** format:
+
+```
+type(scope): subject
+
+[optional body]
+
+[optional footer]
+```
+
+**Types:**
+- `feat`: New feature
+- `fix`: Bug fix
+- `refactor`: Code restructuring (no behavior change)
+- `test`: Test additions/updates
+- `ci`: CI/CD workflow changes
+- `chore`: Dependency updates, tooling
+- `docs`: Documentation (though secretbox minimizes this)
+
+**Scope:** (optional but recommended)
+- `encrypt`, `decrypt`, `validation`, `compat`, `deps`
+
+**Subject:**
+- Lowercase, imperative mood ("add" not "adds" or "added")
+- No period at the end
+- Max 50 characters
+
+**Examples:**
+```
+feat(encrypt): add support for empty plaintext
+fix(decrypt): handle tampered ciphertext edge case
+refactor: rename internal variable for clarity
+test(validation): add type error cases
+ci: add Ruby 3.4 to test matrix
+chore(deps): update minitest to 5.20
+```
+
+### Branch Naming
+While not enforced, follow this convention:
+- `feat/description` for features
+- `fix/description` for bug fixes
+- `refactor/description` for refactoring
+
+## File Structure
+
+```
+secretbox/
+├── lib/secretbox.rb             # Main class (no nested require)
+├── lib/secretbox/version.rb     # Version constant only
+├── spec/secretbox_spec.rb       # All tests in one file
+├── spec/minitest_helper.rb      # Setup (minimal)
+├── spec/coverage_helper.rb      # SimpleCov config
+├── secretbox.gemspec            # Gem metadata & dependencies
+├── AGENT.md                      # This file
+├── README.md                     # Usage guide
+├── LICENSE.txt                   # MIT
+└── .github/workflows/ci.yml      # CI matrix
+```
+
+Keep nested `lib/` structure minimal — only add new files if truly modular.
+
+## Dependencies
+
+### Runtime
+- `base64`: Ruby 3.4+ only (OpenSSL handles it < 3.4)
+
+### Development
+- `rake`, `minitest`, `minitest-great_expectations`, `minitest-colorin`, `minitest-line`, `simplecov`
+- Ruby 3.4+ only: `mutex_m`, `ostruct`
+
+When adding dependencies:
+1. Add to `secretbox.gemspec`
+2. Document why (comment in gemspec)
+3. Ensure Ruby 2.3.8 compatibility
+4. Test in CI (already covers 2.3–3.4)
+
+## Key Implementation Details
+
+### Ciphertext Format
+Base64-encoded: `iv (12 bytes) + auth_tag (16 bytes) + encrypted_data`
+
+This format is **not changing**. If you need to support multiple formats, add a version byte inside the raw bytes.
+
+### Algorithm
+- **Cipher:** AES-256-GCM
+- **IV size:** 12 bytes (nonce) — always random
+- **Key size:** 32 bytes (256 bits)
+- **Auth tag size:** 16 bytes (128 bits)
+- **Auth data:** Authenticated but not encrypted
+
+### Validation
+- `validate_string!`: Type check (raises `TypeError`)
+- `decode_base64!`: Decoding and error wrapping (raises `InvalidKeyError` or `TypeError`)
+- Never validate inside the cipher calls — do it upfront
+
+## Before Committing
+
+1. ✅ Run tests: `bundle exec rake spec`
+2. ✅ All tests pass on Ruby 2.3.8, 3.2, 3.4
+3. ✅ Update `lib/secretbox/version.rb` if behavior changes
+4. ✅ Commit with **Conventional Commits** format
+5. ✅ No comments added to code
+6. ✅ All new methods have test coverage
+
+## Running Locally
+
+```bash
+cd /path/to/secretbox
+
+# Install dependencies
+bundle install
+
+# Run tests
+bundle exec rake spec
+
+# Run tests with coverage
+COVERAGE=true bundle exec rake spec
+
+# Open IRB console with secretbox loaded
+bundle exec rake console
+```
+
+## Questions?
+
+Refer to:
+- Implementation: `lib/secretbox.rb`
+- Tests: `spec/secretbox_spec.rb`
+- Gem metadata: `secretbox.gemspec`
+- CI config: `.github/workflows/ci.yml`

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in secretbox.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2025 Gabriel Naiman
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,78 @@
+# Secretbox
+
+[![Gem Version](https://badge.fury.io/rb/secretbox.svg)](https://rubygems.org/gems/secretbox)
+[![CI](https://github.com/gabynaiman/secretbox/actions/workflows/ci.yml/badge.svg)](https://github.com/gabynaiman/secretbox/actions/workflows/ci.yml)
+
+AES-256-GCM authenticated encryption for sensitive data.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'secretbox'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install secretbox
+
+## Usage
+
+### Generate a key
+
+```ruby
+key = Secretbox.generate_key # => base64 String (32 random bytes)
+```
+
+Store the key in an environment variable (e.g. `SECRETBOX_KEY`).
+
+### Encrypt and decrypt
+
+```ruby
+secretbox = Secretbox.new(ENV.fetch('SECRETBOX_KEY'))
+
+ciphertext = secretbox.encrypt('secret message')
+secretbox.decrypt(ciphertext) # => 'secret message'
+```
+
+### With authenticated associated data (AAD)
+
+```ruby
+ciphertext = secretbox.encrypt('secret', auth_data: 'user:42')
+secretbox.decrypt(ciphertext, auth_data: 'user:42') # => 'secret'
+
+secretbox.decrypt(ciphertext, auth_data: 'user:99') # raises Secretbox::DecryptionError
+```
+
+The `auth_data` is not encrypted but is authenticated — any tampering with it
+causes decryption to fail. Use it to bind ciphertext to context (e.g. a record ID).
+
+### Encrypting structured data
+
+```ruby
+settings = { api_key: 'abc123', token: 'xyz' }
+ciphertext = secretbox.encrypt(JSON.generate(settings))
+
+JSON.parse(secretbox.decrypt(ciphertext), symbolize_names: true) # => { api_key: 'abc123', token: 'xyz' }
+```
+
+## Errors
+
+| Error | When |
+|---|---|
+| `Secretbox::InvalidKeyError` | Key is not valid base64 or not 32 bytes |
+| `Secretbox::DecryptionError` | Ciphertext is tampered, key is wrong, or auth_data mismatches |
+| `TypeError` | plaintext/ciphertext/auth_data is not a String |
+
+## Ciphertext format
+
+Base64-encoded: `iv (12 bytes) + auth_tag (16 bytes) + encrypted_data`
+
+## License
+
+MIT

data/Rakefile

@@ -0,0 +1,25 @@
+require 'bundler/gem_tasks'
+require 'rake/testtask'
+
+Rake::TestTask.new(:spec) do |t|
+  t.libs << 'spec'
+  t.libs << 'lib'
+  t.pattern = 'spec/**/*_spec.rb'
+  t.verbose = false
+  t.warning = false
+  t.loader = nil if ENV['TEST']
+  ENV['TEST'], ENV['LINE'] = ENV['TEST'].split(':') if ENV['TEST'] && !ENV['LINE']
+  t.options = ''
+  t.options << "--name=/#{ENV['NAME']}/ " if ENV['NAME']
+  t.options << "-l #{ENV['LINE']} " if ENV['LINE'] && ENV['TEST']
+end
+
+task default: :spec
+
+desc 'IRB console'
+task :console do
+  require 'irb'
+  require 'secretbox'
+  ARGV.clear
+  IRB.start
+end

data/lib/secretbox/version.rb

@@ -0,0 +1,3 @@
+class Secretbox
+  VERSION = '1.0.0'
+end

data/lib/secretbox.rb

@@ -0,0 +1,75 @@
+require 'base64'
+require 'openssl'
+require 'securerandom'
+
+require_relative 'secretbox/version'
+
+class Secretbox
+
+  ALGORITHM = 'aes-256-gcm'.freeze
+  KEY_SIZE  = 32
+  IV_SIZE   = 12
+  TAG_SIZE  = 16
+
+  class InvalidKeyError < StandardError; end
+  class DecryptionError < StandardError; end
+
+  def self.generate_key
+    Base64.strict_encode64(SecureRandom.random_bytes(KEY_SIZE))
+  end
+
+  def initialize(key)
+    validate_string! key, :key
+    @key = decode_base64! key, :key, error: InvalidKeyError
+    raise InvalidKeyError, "key must be #{KEY_SIZE} bytes" unless @key.bytesize == KEY_SIZE
+  end
+
+  def encrypt(plaintext, auth_data: '')
+    validate_string! plaintext, :plaintext
+    validate_string! auth_data, :auth_data
+
+    cipher = OpenSSL::Cipher.new(ALGORITHM).tap(&:encrypt)
+    iv     = cipher.random_iv
+    cipher.key       = key
+    cipher.auth_data = auth_data
+
+    encrypted = cipher.update(plaintext) + cipher.final
+
+    Base64.strict_encode64(iv + cipher.auth_tag + encrypted)
+  end
+
+  def decrypt(ciphertext, auth_data: '')
+    validate_string! ciphertext, :ciphertext
+    validate_string! auth_data,  :auth_data
+
+    raw       = decode_base64! ciphertext, :ciphertext
+    iv        = raw[0, IV_SIZE]
+    auth_tag  = raw[IV_SIZE, TAG_SIZE]
+    encrypted = raw[(IV_SIZE + TAG_SIZE)..-1]
+
+    cipher = OpenSSL::Cipher.new(ALGORITHM).tap(&:decrypt)
+    cipher.key       = key
+    cipher.iv        = iv
+    cipher.auth_tag  = auth_tag
+    cipher.auth_data = auth_data
+
+    cipher.update(encrypted) + cipher.final
+  rescue OpenSSL::Cipher::CipherError => e
+    raise DecryptionError, e.message
+  end
+
+  private
+
+  attr_reader :key
+
+  def validate_string!(value, name)
+    raise TypeError, "#{name} must be a String, got #{value.class}" unless value.is_a?(String)
+  end
+
+  def decode_base64!(value, name, error: TypeError)
+    Base64.strict_decode64(value)
+  rescue ArgumentError
+    raise error, "#{name} is not valid base64"
+  end
+
+end

data/secretbox.gemspec

@@ -0,0 +1,36 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'secretbox/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = 'secretbox'
+  spec.version       = Secretbox::VERSION
+  spec.authors       = ['Gabriel Naiman']
+  spec.email         = ['gabynaiman@gmail.com']
+  spec.summary       = 'AES-256-GCM authenticated encryption for sensitive data'
+  spec.description   = 'AES-256-GCM authenticated encryption for sensitive data'
+  spec.homepage      = 'https://github.com/gabynaiman/secretbox'
+  spec.license       = 'MIT'
+
+  spec.required_ruby_version = '>= 2.3.8'
+
+  spec.files         = `git ls-files -z`.split("\x0")
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.require_paths = ['lib']
+
+  spec.add_dependency 'base64' if RUBY_VERSION >= '3.4'
+
+  spec.add_development_dependency 'rake', '~> 12.0'
+  spec.add_development_dependency 'minitest', '~> 5.0', '< 5.11'
+  spec.add_development_dependency 'minitest-great_expectations'
+  spec.add_development_dependency 'minitest-colorin', '~> 0.1'
+  spec.add_development_dependency 'minitest-line', '~> 0.6'
+  spec.add_development_dependency 'simplecov', '~> 0.12'
+
+  if RUBY_VERSION >= '3.4'
+    spec.add_development_dependency 'mutex_m'
+    spec.add_development_dependency 'ostruct'
+  end
+end

data/spec/coverage_helper.rb

@@ -0,0 +1,3 @@
+require 'simplecov'
+
+SimpleCov.start

data/spec/minitest_helper.rb

@@ -0,0 +1,5 @@
+require 'coverage_helper'
+require 'secretbox'
+require 'minitest/autorun'
+require 'minitest/colorin'
+require 'minitest/great_expectations'

data/spec/secretbox_spec.rb

@@ -0,0 +1,92 @@
+require 'minitest_helper'
+
+describe Secretbox do
+
+  let(:key)        { Secretbox.generate_key }
+  let(:secretbox)  { Secretbox.new(key) }
+
+  it 'encrypts and decrypts a string' do
+    plaintext = 'secret message'
+    secretbox.decrypt(secretbox.encrypt(plaintext)).must_equal plaintext
+  end
+
+  it 'encrypts and decrypts a JSON string' do
+    plaintext = JSON.generate({ token: 'abc123', expires_at: 9999999999, expires: true })
+    secretbox.decrypt(secretbox.encrypt(plaintext)).must_equal plaintext
+  end
+
+  it 'produces different ciphertexts for the same input' do
+    plaintext   = 'same message'
+    ciphertext1 = secretbox.encrypt(plaintext)
+    ciphertext2 = secretbox.encrypt(plaintext)
+
+    ciphertext1.wont_equal ciphertext2
+  end
+
+  it 'ciphertext does not contain the plaintext' do
+    plaintext  = 'sensitive data'
+    ciphertext = secretbox.encrypt(plaintext)
+
+    ciphertext.wont_include plaintext
+  end
+
+  it 'encrypts and decrypts with auth_data' do
+    plaintext  = 'secret message'
+    ciphertext = secretbox.encrypt(plaintext, auth_data: 'context')
+
+    secretbox.decrypt(ciphertext, auth_data: 'context').must_equal plaintext
+  end
+
+  it 'raises TypeError when plaintext is not a String' do
+    proc { secretbox.encrypt(1) }.must_raise TypeError
+    proc { secretbox.encrypt(true) }.must_raise TypeError
+    proc { secretbox.encrypt(nil) }.must_raise TypeError
+  end
+
+  it 'raises TypeError when encrypt auth_data is not a String' do
+    proc { secretbox.encrypt('text', auth_data: 1) }.must_raise TypeError
+  end
+
+  it 'raises TypeError when ciphertext is not a String' do
+    proc { secretbox.decrypt(1) }.must_raise TypeError
+  end
+
+  it 'raises TypeError when decrypt auth_data is not a String' do
+    ciphertext = secretbox.encrypt('secret')
+    proc { secretbox.decrypt(ciphertext, auth_data: 1) }.must_raise TypeError
+  end
+
+  it 'raises InvalidKeyError when the key is not valid base64' do
+    proc { Secretbox.new('not-valid!!!') }.must_raise Secretbox::InvalidKeyError
+  end
+
+  it 'raises InvalidKeyError when the key is not 32 bytes' do
+    proc { Secretbox.new(Base64.strict_encode64('tooshort')) }.must_raise Secretbox::InvalidKeyError
+  end
+
+  it 'raises TypeError when the ciphertext is not valid base64' do
+    proc { secretbox.decrypt('not-valid-base64!!!') }.must_raise TypeError
+  end
+
+  it 'raises DecryptionError when decrypting with a different key' do
+    other_secretbox = Secretbox.new(Secretbox.generate_key)
+    ciphertext      = secretbox.encrypt('secret')
+
+    proc { other_secretbox.decrypt(ciphertext) }.must_raise Secretbox::DecryptionError
+  end
+
+  it 'raises DecryptionError when decrypting with a different auth_data' do
+    ciphertext = secretbox.encrypt('secret', auth_data: 'context')
+
+    proc { secretbox.decrypt(ciphertext, auth_data: 'other') }.must_raise Secretbox::DecryptionError
+  end
+
+  it 'raises DecryptionError when the ciphertext is tampered' do
+    raw      = Base64.strict_decode64(secretbox.encrypt('secret'))
+    raw[-1]  = (raw[-1].ord ^ 0xFF).chr
+    tampered = Base64.strict_encode64(raw)
+
+    proc { secretbox.decrypt(tampered) }.must_raise Secretbox::DecryptionError
+  end
+
+end

metadata

@@ -0,0 +1,151 @@
+--- !ruby/object:Gem::Specification
+name: secretbox
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Gabriel Naiman
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-07-25 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.0'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5.11'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5.11'
+- !ruby/object:Gem::Dependency
+  name: minitest-great_expectations
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: minitest-colorin
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+- !ruby/object:Gem::Dependency
+  name: minitest-line
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.12'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.12'
+description: AES-256-GCM authenticated encryption for sensitive data
+email:
+- gabynaiman@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".github/workflows/ci.yml"
+- ".gitignore"
+- ".ruby-gemset"
+- ".ruby-version"
+- AGENTS.md
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- lib/secretbox.rb
+- lib/secretbox/version.rb
+- secretbox.gemspec
+- spec/coverage_helper.rb
+- spec/minitest_helper.rb
+- spec/secretbox_spec.rb
+homepage: https://github.com/gabynaiman/secretbox
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.3.8
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.4.6
+signing_key:
+specification_version: 4
+summary: AES-256-GCM authenticated encryption for sensitive data
+test_files:
+- spec/coverage_helper.rb
+- spec/minitest_helper.rb
+- spec/secretbox_spec.rb