@ohos-ports/react-native-quick-crypto 0.0.0-stage → 1.1.8-beta.0

package/QuickCrypto.podspec

@@ -0,0 +1,259 @@
+require "json"
+require "digest"
+require "shellwords"
+
+package = JSON.parse(File.read(File.join(__dir__, "package.json")))
+
+Pod::UI.puts "[QuickCrypto]  💨 crypto just got quicker"
+
+Pod::Spec.new do |s|
+  s.name         = "QuickCrypto"
+  s.version      = package["version"]
+  s.summary      = package["description"]
+  s.homepage     = package["homepage"]
+  s.license      = package["license"]
+  s.authors      = package["authors"]
+
+  s.ios.deployment_target = min_ios_version_supported
+  s.visionos.deployment_target = 1.0
+  s.macos.deployment_target = 10.13
+  s.tvos.deployment_target = 13.4
+
+  s.source = { :git => "https://github.com/margelo/react-native-quick-crypto.git", :tag => "#{s.version}" }
+
+  # Prebuilt static OpenSSL whose every global symbol is renamed to rnqc_*, with
+  # the original names demoted to non-external. QuickCrypto is source-built, so
+  # its OpenSSL references are resolved when the *app* links; without the rename,
+  # any other library that statically embeds OpenSSL wins the first-come symbol
+  # resolution and QuickCrypto silently runs on a foreign OpenSSL. See
+  # scripts/build-openssl-apple.sh and issue #1059.
+  #
+  # Downloaded during podspec evaluation rather than in prepare_command, because
+  # prepare_command is skipped for :path pods.
+  openssl_version = "3.6.2"
+  openssl_sha256 = "a50e3c8473b0526b159ad8d105e97a90d1153a4a230388cc731ee23a7d0ad3a4"
+  openssl_dir = File.join(__dir__, "ios", "openssl")
+  openssl_prefix_header = File.join(openssl_dir, "quickcrypto_openssl_prefix.h")
+
+  unless File.exist?(openssl_prefix_header)
+    if openssl_sha256 == "REPLACE_WITH_RELEASE_SHA256"
+      raise "[QuickCrypto] openssl_sha256 is unset — publish the openssl-apple-#{openssl_version} release and paste its checksum into QuickCrypto.podspec"
+    end
+
+    archive = File.join(__dir__, "ios", "QuickCryptoOpenSSL.zip")
+    url = "https://github.com/margelo/react-native-quick-crypto/releases/download/openssl-apple-#{openssl_version}/QuickCryptoOpenSSL-#{openssl_version}.zip"
+
+    Pod::UI.puts "[QuickCrypto] ⬇️  Downloading static OpenSSL #{openssl_version}..."
+    FileUtils.mkdir_p(File.join(__dir__, "ios"))
+    FileUtils.rm_rf(openssl_dir)
+    system("curl -sSfL --retry 3 --retry-all-errors --connect-timeout 30 --max-time 600 -o #{archive.shellescape} #{url.shellescape}") || raise("[QuickCrypto] Failed to download static OpenSSL")
+
+    actual = Digest::SHA256.file(archive).hexdigest
+    unless actual == openssl_sha256
+      File.delete(archive)
+      raise "[QuickCrypto] Static OpenSSL checksum mismatch: expected #{openssl_sha256}, got #{actual}"
+    end
+
+    system("unzip -q #{archive.shellescape} -d #{openssl_dir.shellescape}") || raise("[QuickCrypto] Failed to extract static OpenSSL")
+    File.delete(archive)
+    Pod::UI.puts "[QuickCrypto] ✅ Static OpenSSL ready"
+  end
+
+  sodium_enabled = ENV['SODIUM_ENABLED'] == '1'
+  Pod::UI.puts("[QuickCrypto]  🧂 has libsodium #{sodium_enabled ? "enabled" : "disabled"}!")
+
+  # Ensure libsodium source is present during podspec evaluation when enabled.
+  # This is necessary because prepare_command is skipped for :path pods.
+  if sodium_enabled
+    sodium_version = "1.0.22"
+    # The GitHub release asset, not download.libsodium.org's -stable tarball: the
+    # latter is regenerated from the stable branch, so no hash can be pinned to it.
+    sodium_sha256 = "adbdd8f16149e81ac6078a03aca6fc03b592b89ef7b5ed83841c086191be3349"
+    sodium_url = "https://github.com/jedisct1/libsodium/releases/download/#{sodium_version}-RELEASE/libsodium-#{sodium_version}.tar.gz"
+    sodium_dir = File.join(__dir__, "ios", "libsodium-stable")
+    sodium_header = File.join(sodium_dir, "src", "libsodium", "include", "sodium.h")
+    unless File.exist?(sodium_header)
+      ios_dir = File.join(__dir__, "ios")
+      archive = File.join(ios_dir, "libsodium.tar.gz")
+      extracted = File.join(ios_dir, "libsodium-#{sodium_version}")
+
+      FileUtils.mkdir_p(ios_dir)
+      FileUtils.rm_rf([sodium_dir, extracted])
+
+      Pod::UI.puts "[QuickCrypto] ⬇️  Downloading libsodium #{sodium_version} source..."
+      system("curl -sSfL --retry 3 --retry-all-errors --connect-timeout 30 --max-time 300 -o #{archive.shellescape} #{sodium_url.shellescape}") || raise("[QuickCrypto] Failed to download libsodium")
+
+      actual = Digest::SHA256.file(archive).hexdigest
+      unless actual == sodium_sha256
+        File.delete(archive)
+        raise "[QuickCrypto] libsodium checksum mismatch: expected #{sodium_sha256}, got #{actual}"
+      end
+
+      system("tar -xzf #{archive.shellescape} -C #{ios_dir.shellescape}") || raise("[QuickCrypto] Failed to extract libsodium")
+      File.rename(extracted, sodium_dir)
+      File.delete(archive)
+      Pod::UI.puts "[QuickCrypto] ✅ libsodium source ready"
+    end
+  end
+
+  if sodium_enabled
+    # Build libsodium from source for XSalsa20 cipher support
+    # CocoaPods packages are outdated (1.0.12) and SPM causes module conflicts
+    s.prepare_command = <<-CMD
+      set -e
+      # Clean up vendored OpenSSL.xcframework from pre-1.0.20 installs
+      rm -rf OpenSSL.xcframework
+      rm -f OpenSSL.xcframework.zip
+      # Build the libsodium source the podspec already downloaded and verified.
+      cd ios/libsodium-stable
+      ./configure --disable-shared --enable-static
+      make -j$(sysctl -n hw.ncpu)
+    CMD
+  else
+    s.prepare_command = <<-CMD
+      set -e
+      # Clean up libsodium if previously built
+      rm -rf ios/libsodium-stable
+      rm -f ios/libsodium.tar.gz
+      # Clean up vendored OpenSSL.xcframework from pre-1.0.20 installs
+      rm -rf OpenSSL.xcframework
+      rm -f OpenSSL.xcframework.zip
+    CMD
+  end
+
+  base_source_files = [
+    # implementation (Swift)
+    "ios/**/*.{swift}",
+    # ios (Objective-C++)
+    "ios/**/*.{h,m,mm}",
+    # implementation (C++)
+    "cpp/**/*.{hpp,cpp}",
+    # dependencies (C++) - ncrypto
+    "deps/ncrypto/include/**/*.{h}",
+    "deps/ncrypto/src/*.{cpp}",
+    # dependencies (C++) - simdutf
+    "deps/simdutf/include/**/*.{h}",
+    "deps/simdutf/src/simdutf.cpp",
+    # dependencies (C) - exclude BLAKE3 x86 SIMD files (only use portable + NEON for ARM)
+    "deps/blake3/c/*.{h,c}",
+    "deps/fastpbkdf2/*.{h,c}",
+  ]
+
+  # Exclude BLAKE3 x86-specific SIMD implementations (SSE2, SSE4.1, AVX2, AVX-512)
+  # These use Intel intrinsics that don't compile on ARM
+  # Also exclude example files, TBB files, test files, and non-C directories
+  s.exclude_files = [
+    # Prebuilt OpenSSL headers — reached through HEADER_SEARCH_PATHS, never
+    # compiled as sources. Must not glob the .xcframework alongside them:
+    # CocoaPods applies exclude_files to vendored_frameworks too, so a broader
+    # pattern here silently unlinks the library.
+    "ios/openssl/include/**/*",
+    "ios/openssl/quickcrypto_openssl_prefix.h",
+    "deps/blake3/c/blake3_sse2.c",
+    "deps/blake3/c/blake3_sse41.c",
+    "deps/blake3/c/blake3_avx2.c",
+    "deps/blake3/c/blake3_avx512.c",
+    "deps/blake3/c/blake3_sse2_x86-64_unix.S",
+    "deps/blake3/c/blake3_sse41_x86-64_unix.S",
+    "deps/blake3/c/blake3_avx2_x86-64_unix.S",
+    "deps/blake3/c/blake3_avx512_x86-64_unix.S",
+    "deps/blake3/c/blake3_sse2_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_sse41_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_avx2_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_avx512_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_sse2_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_sse41_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_avx2_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_avx512_x86-64_windows_msvc.asm",
+    "deps/blake3/c/main.c",
+    "deps/blake3/c/example.c",
+    "deps/blake3/c/example_tbb.c",
+    "deps/blake3/c/blake3_tbb.cpp",
+    # Exclude ncrypto version.h to avoid header name collision with libsodium's version.h
+    # (ncrypto.h includes it via relative path "ncrypto/version.h" which still resolves)
+    "deps/ncrypto/include/ncrypto/version.h",
+    # Exclude non-C parts of BLAKE3 repo (Rust, benchmarks, tools, etc.)
+    "deps/blake3/src/**/*",
+    "deps/blake3/b3sum/**/*",
+    "deps/blake3/benches/**/*",
+    "deps/blake3/reference_impl/**/*",
+    "deps/blake3/tools/**/*",
+    "deps/blake3/test_vectors/**/*",
+  ]
+
+  if sodium_enabled
+    base_source_files += ["ios/libsodium-stable/src/libsodium/**/*.{h,c}"]
+  end
+
+  s.source_files = base_source_files
+
+  xcconfig = {
+    # C++ compiler flags, mainly for folly.
+    "GCC_PREPROCESSOR_DEFINITIONS" => "$(inherited) FOLLY_NO_CONFIG FOLLY_CFG_NO_COROUTINES",
+    # Set C++ standard to C++20
+    "CLANG_CXX_LANGUAGE_STANDARD" => "c++20",
+    "CLANG_ALLOW_NON_MODULAR_INCLUDES_IN_FRAMEWORK_MODULES" => "YES",
+    # Exclude ARM NEON source when building x86_64 simulator (no NEON support).
+    "EXCLUDED_SOURCE_FILE_NAMES[sdk=iphonesimulator*][arch=x86_64]" => "deps/blake3/c/blake3_neon.c",
+    # Disable x86 SIMD intrinsics on iOS simulator — the .c implementation files are already
+    # excluded above, but blake3_dispatch.c still references the symbols unless these macros
+    # are defined. Mirrors the Android CMakeLists.txt approach (line 18-22).
+    "GCC_PREPROCESSOR_DEFINITIONS[sdk=iphonesimulator*][arch=x86_64]" => "$(inherited) BLAKE3_NO_AVX512 BLAKE3_NO_AVX2 BLAKE3_NO_SSE41 BLAKE3_NO_SSE2"
+  }
+
+  # Every translation unit calls the renamed OpenSSL symbols. Missing a rename
+  # is a link error, never a silent bind to a foreign OpenSSL.
+  openssl_include = File.join(openssl_dir, "include")
+  force_include = "-include \"#{openssl_prefix_header}\""
+  xcconfig["OTHER_CFLAGS"] = "$(inherited) #{force_include}"
+  xcconfig["OTHER_CPLUSPLUSFLAGS"] = "$(inherited) #{force_include}"
+
+  # Add cpp subdirectories to header search paths
+  cpp_headers = [
+    # Absolute path as well as the pod-relative one: in monorepos the podspec is
+    # reached through a symlink but sources resolve to their real paths.
+    "\"$(PODS_TARGET_SRCROOT)/ios/openssl/include\"",
+    "\"#{openssl_include}\"",
+    "\"$(PODS_TARGET_SRCROOT)/cpp/utils\"",
+    "\"$(PODS_TARGET_SRCROOT)/cpp/hkdf\"",
+    "\"$(PODS_TARGET_SRCROOT)/cpp/dh\"",
+    "\"$(PODS_TARGET_SRCROOT)/cpp/ecdh\"",
+    "\"$(PODS_TARGET_SRCROOT)/cpp/turboshake\"",
+    "\"$(PODS_TARGET_SRCROOT)/nitrogen/generated/shared/c++\"",
+    "\"$(PODS_TARGET_SRCROOT)/deps/ncrypto/include\"",
+    "\"$(PODS_TARGET_SRCROOT)/deps/simdutf/include\"",
+    "\"$(PODS_TARGET_SRCROOT)/deps/simdutf/src\"",
+    "\"$(PODS_TARGET_SRCROOT)/deps/blake3/c\"",
+    "\"$(PODS_TARGET_SRCROOT)/deps/fastpbkdf2\""
+  ]
+
+  if sodium_enabled
+    # Use absolute path from __dir__ which resolves symlinks correctly.
+    # This is necessary in monorepo setups where the podspec is accessed via symlink
+    # but the source files are resolved to their real paths during compilation.
+    real_sodium_include = File.join(__dir__, "ios", "libsodium-stable", "src", "libsodium", "include")
+    sodium_headers = [
+      "\"$(PODS_TARGET_SRCROOT)/ios/libsodium-stable/src/libsodium/include\"",
+      "\"$(PODS_TARGET_SRCROOT)/ios/libsodium-stable/src/libsodium/include/sodium\"",
+      "\"#{real_sodium_include}\"",
+      "\"#{real_sodium_include}/sodium\""
+    ]
+    xcconfig["HEADER_SEARCH_PATHS"] = (cpp_headers + sodium_headers).join(' ')
+    xcconfig["GCC_PREPROCESSOR_DEFINITIONS"] = "$(inherited) FOLLY_NO_CONFIG FOLLY_CFG_NO_COROUTINES BLSALLOC_SODIUM=1"
+  else
+    xcconfig["HEADER_SEARCH_PATHS"] = cpp_headers.join(' ')
+  end
+
+  s.pod_target_xcconfig = xcconfig
+
+  # Add all files generated by Nitrogen
+  load "nitrogen/generated/ios/QuickCrypto+autolinking.rb"
+  add_nitrogen_files(s)
+
+  s.vendored_frameworks = "ios/openssl/QuickCryptoOpenSSL.xcframework"
+
+  s.dependency "React-jsi"
+  s.dependency "React-callinvoker"
+
+  install_modules_dependencies(s)
+end

package/README.md

@@ -1,3 +1,171 @@
-# Temporary Holding Version
+<a href="https://margelo.com">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="./.docs/img/banner-dark.png" />
+    <source media="(prefers-color-scheme: light)" srcset="./.docs/img/banner-light.png" />
+    <img alt="react-native-quick-crypto" src="./.docs/img/banner-light.png" />
+  </picture>
+</a>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# ⚡️ react-native-quick-crypto
+
+A fast implementation of Node's `crypto` module.
+
+## Features
+
+Unlike any other current JS-based polyfills, react-native-quick-crypto is written in C/C++ JSI and provides much greater performance - especially on mobile devices.
+QuickCrypto can be used as a drop-in replacement for your Web3/Crypto apps or CRDT-based local first databases to speed up common cryptography functions.
+
+- 🏎️ Hundreds of times faster than all JS-based solutions
+- ⚡️ Lightning fast implementation with Nitro Modules (pure C++ and JSI) instead of JS
+- 🧪 Well tested in JS and C++ (OpenSSL)
+- 💰 Made for crypto apps and wallets
+- 🔢 Secure native compiled cryptography
+- 🔁 Easy drop-in replacement for [crypto-browserify](https://github.com/browserify/crypto-browserify) or [react-native-crypto](https://github.com/tradle/react-native-crypto)
+
+## Versions
+
+| Version | RN Architecture | Modules |
+| ------- | ------ | ------- |
+| `1.x`     | new [->](https://github.com/reactwg/react-native-new-architecture/blob/main/docs/enable-apps.md)  | Nitro Modules [->](https://github.com/mrousavy/nitro) |
+| `0.x`     | old, new 🤞  | Bridge & JSI |
+
+> Note: Minimum supported version of React Native is `0.75`.  If you need to use earlier versions, please use `0.x` versions of this library.
+
+## Migration
+
+Our goal in refactoring to v1.0 was to maintain API compatibility.  If you are upgrading to v1.0 from v0.x, and find any discrepancies, please open an issue in this repo.
+
+## Benchmarks
+
+There is a benchmark suite in the Example app in this repo that has benchmarks of algorithms against their pure JS counterparts.  This is not meant to disparage the other libraries.  On the contrary, they perform amazingly well when used in a server-side Node environment.  This library exists because React Native does not have that environment nor the Node Crypto API implementation at hand.  So the benchmark suite is there to show you the speedup vs. the alternative of using a pure JS library on React Native.
+
+---
+
+## Installation
+
+<h3>
+  React Native  <a href="#"><img src="./.docs/img/react-native.png" height="15" /></a>
+</h3>
+
+```sh
+bun add react-native-quick-crypto react-native-nitro-modules react-native-quick-base64
+cd ios && pod install
+```
+
+<h3>
+  Expo  <a href="#">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="./.docs/img/expo/dark.png" />
+      <source media="(prefers-color-scheme: light)" srcset="./.docs/img/expo/light.png" />
+      <img alt="Expo" src="./.docs/img/expo/light.png" height="12" />
+      </picture>
+  </a>
+</h3>
+
+```sh
+expo install react-native-quick-crypto
+expo prebuild
+```
+
+Optional: override `global.Buffer` and `global.crypto` in your application as early as possible for example in index.js.
+
+```ts
+import { install } from 'react-native-quick-crypto';
+
+install();
+```
+
+## Replace `crypto-browserify`
+
+If you are using a library that depends on `crypto`, instead of polyfilling it with `crypto-browserify` (or `react-native-crypto`) you can use `react-native-quick-crypto` for a fully native implementation. This way you can get much faster crypto operations with just a single-line change!
+
+### Using metro config
+
+Use the [`resolveRequest`](https://facebook.github.io/metro/docs/resolution#resolverequest-customresolver) configuration option in your `metro.config.js`
+
+```js
+config.resolver.resolveRequest = (context, moduleName, platform) => {
+  if (moduleName === 'crypto') {
+    // when importing crypto, resolve to react-native-quick-crypto
+    return context.resolveRequest(
+      context,
+      'react-native-quick-crypto',
+      platform,
+    )
+  }
+  // otherwise chain to the standard Metro resolver.
+  return context.resolveRequest(context, moduleName, platform)
+}
+```
+
+### Using babel-plugin-module-resolver
+
+You need to install `babel-plugin-module-resolver`, it's a babel plugin that will alias any imports in the code with the values you pass to it. It tricks any module that will try to import certain dependencies with the native versions we require for React Native.
+
+```sh
+yarn add --dev babel-plugin-module-resolver
+```
+
+Then, in your `babel.config.js`, add the plugin to swap the `crypto`, `stream` and `buffer` dependencies:
+
+```diff
+module.exports = {
+  presets: ['module:metro-react-native-babel-preset'],
+  plugins: [
++   [
++     'module-resolver',
++     {
++       alias: {
++         'crypto': 'react-native-quick-crypto',
++         'stream': 'readable-stream',
++         'buffer': 'react-native-quick-crypto',
++       },
++     },
++   ],
+    ...
+  ],
+};
+```
+
+> **Note:** `react-native-quick-crypto` re-exports `Buffer` from `@craftzdog/react-native-buffer`, so you can use either as the buffer alias. Using `react-native-quick-crypto` ensures a single Buffer instance across your app.
+
+Then restart your bundler using `yarn start --reset-cache`.
+
+## Usage
+
+For example, to hash a string with SHA256 you can do the following:
+
+```ts
+import QuickCrypto from 'react-native-quick-crypto';
+
+const hashed = QuickCrypto.createHash('sha256')
+  .update('Damn, Margelo writes hella good software!')
+  .digest('hex');
+```
+
+More details can be found on the [documentation](https://margelo.github.io/react-native-quick-crypto/).
+
+## Limitations
+
+Not all cryptographic algorithms are supported yet. See the [implementation coverage](./.docs/implementation-coverage.md) document for more details. If you need a specific algorithm, please open a `feature request` issue and we'll see what we can do.
+
+## Community Discord
+
+[Join the Margelo Community Discord](https://discord.gg/6CSHz2qAvA) to chat about react-native-quick-crypto or other Margelo libraries.
+
+## Adopting at scale
+
+`react-native-quick-crypto` was built at Margelo, an elite app development agency. For enterprise support or other business inquiries, contact us at <a href="mailto:hello@margelo.com?subject=Adopting react-native-quick-crypto at scale">hello@margelo.com</a>!
+
+## Contributing
+
+See the [contributing guide](CONTRIBUTING.md) to learn how to contribute to the repository and the development workflow.
+
+For more detailed guides, check out our documentation website:
+- [Contributing Guide]([prod-docs]/docs/guides/contributing)
+- [Writing Documentation]([prod-docs]/docs/guides/writing-documentation)
+
+## License
+
+- react-native-quick-crypto is licensed under MIT.
+- react-native-quick-crypto is heavily inspired by NodeJS Crypto, which is licensed under [nodejs/LICENSE](https://github.com/nodejs/node/blob/main/LICENSE).

package/android/CMakeLists.txt

@@ -0,0 +1,155 @@
+cmake_minimum_required(VERSION 3.10.0)
+project(QuickCrypto)
+
+set(PACKAGE_NAME QuickCrypto)
+set(CMAKE_VERBOSE_MAKEFILE ON)
+set(CMAKE_CXX_STANDARD 20)
+
+# BLAKE3 sources - architecture-specific SIMD support
+set(BLAKE3_SOURCES
+  ../deps/blake3/c/blake3.c
+  ../deps/blake3/c/blake3_dispatch.c
+  ../deps/blake3/c/blake3_portable.c
+)
+
+if(CMAKE_ANDROID_ARCH_ABI STREQUAL "arm64-v8a")
+  # ARM64 uses NEON intrinsics (auto-detected via IS_AARCH64 in blake3_impl.h)
+  list(APPEND BLAKE3_SOURCES ../deps/blake3/c/blake3_neon.c)
+elseif(CMAKE_ANDROID_ARCH_ABI STREQUAL "x86" OR CMAKE_ANDROID_ARCH_ABI STREQUAL "x86_64")
+  # Disable x86 SIMD - would require assembly files we don't compile
+  # Falls back to portable C implementation
+  add_definitions(-DBLAKE3_NO_SSE2 -DBLAKE3_NO_SSE41 -DBLAKE3_NO_AVX2 -DBLAKE3_NO_AVX512)
+endif()
+
+# Define C++ library and add all sources
+add_library(
+  ${PACKAGE_NAME} SHARED
+  src/main/cpp/cpp-adapter.cpp
+  ../cpp/argon2/HybridArgon2.cpp
+  ../cpp/blake3/HybridBlake3.cpp
+  ../cpp/certificate/HybridCertificate.cpp
+  ../cpp/cipher/CCMCipher.cpp
+  ../cpp/cipher/GCMCipher.cpp
+  ../cpp/cipher/HybridCipher.cpp
+  ../cpp/cipher/HybridRsaCipher.cpp
+  ../cpp/cipher/OCBCipher.cpp
+  ../cpp/cipher/XSalsa20Cipher.cpp
+  ../cpp/cipher/XSalsa20Poly1305Cipher.cpp
+  ../cpp/cipher/XChaCha20Poly1305Cipher.cpp
+  ../cpp/cipher/ChaCha20Cipher.cpp
+  ../cpp/cipher/ChaCha20Poly1305Cipher.cpp
+  ../cpp/dh/HybridDiffieHellman.cpp
+  ../cpp/dh/HybridDhKeyPair.cpp
+  ../cpp/dsa/HybridDsaKeyPair.cpp
+  ../cpp/ec/HybridEcKeyPair.cpp
+  ../cpp/ecdh/HybridECDH.cpp
+  ../cpp/ed25519/HybridEdKeyPair.cpp
+  ../cpp/hash/HybridHash.cpp
+  ../cpp/hmac/HybridHmac.cpp
+  ../cpp/hkdf/HybridHkdf.cpp
+  ../cpp/kmac/HybridKmac.cpp
+  ../cpp/keys/HybridKeyObjectHandle.cpp
+  ../cpp/keys/KeyObjectData.cpp
+  ../cpp/mldsa/HybridMlDsaKeyPair.cpp
+  ../cpp/mlkem/HybridMlKemKeyPair.cpp
+  ../cpp/slhdsa/HybridSlhDsaKeyPair.cpp
+  ../cpp/pbkdf2/HybridPbkdf2.cpp
+  ../cpp/prime/HybridPrime.cpp
+  ../cpp/random/HybridRandom.cpp
+  ../cpp/rsa/HybridRsaKeyPair.cpp
+  ../cpp/scrypt/HybridScrypt.cpp
+  ../cpp/sign/HybridSignHandle.cpp
+  ../cpp/sign/HybridVerifyHandle.cpp
+  ../cpp/turboshake/HybridTurboShake.cpp
+  ../cpp/x509/HybridX509Certificate.cpp
+  ../cpp/utils/HybridUtils.cpp
+  ../cpp/utils/QuickCryptoUtils.cpp
+  ${BLAKE3_SOURCES}
+  ../deps/fastpbkdf2/fastpbkdf2.c
+  ../deps/ncrypto/src/aead.cpp
+  ../deps/ncrypto/src/engine.cpp
+  ../deps/ncrypto/src/ncrypto.cpp
+  ../deps/simdutf/src/simdutf.cpp
+)
+
+# add Nitrogen specs
+include(${CMAKE_SOURCE_DIR}/../nitrogen/generated/android/QuickCrypto+autolinking.cmake)
+
+# local includes
+include_directories(
+  "src/main/cpp"
+  "../cpp/argon2"
+  "../cpp/blake3"
+  "../cpp/certificate"
+  "../cpp/cipher"
+  "../cpp/dh"
+  "../cpp/dsa"
+  "../cpp/ec"
+  "../cpp/ecdh"
+  "../cpp/ed25519"
+  "../cpp/hash"
+  "../cpp/hkdf"
+  "../cpp/hmac"
+  "../cpp/kmac"
+  "../cpp/keys"
+  "../cpp/mldsa"
+  "../cpp/mlkem"
+  "../cpp/slhdsa"
+  "../cpp/pbkdf2"
+  "../cpp/prime"
+  "../cpp/random"
+  "../cpp/rsa"
+  "../cpp/sign"
+  "../cpp/scrypt"
+  "../cpp/turboshake"
+  "../cpp/utils"
+  "../cpp/x509"
+  "../deps/blake3/c"
+  "../deps/fastpbkdf2"
+  "../deps/ncrypto/include"
+  "../deps/simdutf/include"
+  "../deps/simdutf/src"
+)
+
+# Third party libraries (Prefabs)
+find_library(LOG_LIB log)
+
+find_package(opensslstatic REQUIRED CONFIG)
+
+# Link all libraries together
+target_link_libraries(
+  ${PACKAGE_NAME}
+  ${LOG_LIB}                               # <-- Logcat logger
+  android                                  # <-- Android core
+  opensslstatic::ssl                       # <-- OpenSSL   (SSL)
+  opensslstatic::crypto                    # <-- OpenSSL   (Crypto)
+)
+
+# Keep every symbol we pull in from a static archive — i.e. all of OpenSSL — out
+# of this .so's dynamic symbol table, so our OpenSSL and another library's
+# OpenSSL cannot interpose on each other at runtime. Symbols from our own
+# sources are unaffected, so the Nitro/JNI entry points stay exported.
+# See issue #1059.
+target_link_options(${PACKAGE_NAME} PRIVATE "-Wl,--exclude-libs,ALL")
+
+if(SODIUM_ENABLED)
+  add_definitions(-DBLSALLOC_SODIUM)
+  find_package(sodium REQUIRED CONFIG)
+  target_link_libraries(
+    ${PACKAGE_NAME}
+    sodium::sodium
+  )
+endif()
+
+if(ReactAndroid_VERSION_MINOR GREATER_EQUAL 76)
+  target_link_libraries(
+    ${PACKAGE_NAME}
+    ReactAndroid::reactnative              # <-- RN: Native Modules umbrella prefab
+  )
+else()
+  target_link_libraries(
+    ${PACKAGE_NAME}
+    ReactAndroid::react_nativemodule_core  # <-- RN: TurboModules Core
+    ReactAndroid::turbomodulejsijni        # <-- RN: TurboModules utils (e.g. CallInvokerHolder)
+  )
+endif()