$ docker run --rm --name validator-libsodium-usage-ruby-rbnacl-argon2-tampered-fails-2732 -t --mount type=bind,src=/tmp/validator-status-libsodium-usage-ruby-rbnacl-argon2-tampered-fails,dst=/validator/status validator-libsodium-shared bash -lc 'set -euo pipefail
/validator/tests/_shared/install_override_debs.sh
exec /validator/tests/_shared/run_library_tests.sh "$@"' validator-testcase libsodium usage-ruby-rbnacl-argon2-tampered-fails -- bash -c 'PS4=$1; shift; set -x; source "$@"' validator-xtrace '__VALIDATOR_XTRACE__ ' /validator/tests/libsodium/tests/cases/usage/usage-ruby-rbnacl-argon2-tampered-fails.sh
no override packages found; continuing with apt originals
ops = RbNaCl::PasswordHash::Argon2::OPSLIMIT_INTERACTIVE
mem = RbNaCl::PasswordHash::Argon2::MEMLIMIT_INTERACTIVE
password = "correct horse battery staple".dup.force_encoding(Encoding::BINARY)
salt_a = ("a" * 16).dup.force_encoding(Encoding::BINARY)
salt_b = ("b" * 16).dup.force_encoding(Encoding::BINARY)
digest_size = 32

h1 = RbNaCl::PasswordHash.argon2(password, salt_a, ops, mem, digest_size)
raise "unexpected digest size #{h1.bytesize}" unless h1.bytesize == digest_size

# Same password+salt+params must be deterministic.
h2 = RbNaCl::PasswordHash.argon2(password, salt_a, ops, mem, digest_size)
raise "argon2 not deterministic for fixed salt" unless h1 == h2

# A different salt must produce a different digest.
h3 = RbNaCl::PasswordHash.argon2(password, salt_b, ops, mem, digest_size)
raise "argon2 ignored salt" if h3 == h1

# A different password under the same salt must also produce a different digest.
h4 = RbNaCl::PasswordHash.argon2("other password".dup.force_encoding(Encoding::BINARY), salt_a, ops, mem, digest_size)
raise "argon2 ignored password" if h4 == h1

puts "ok " + h1.unpack1("H*")[0, 16]
'
ok 25d1a5d244492349