$ docker run --rm --name validator-libsodium-usage-ruby-rbnacl-auth-onetime-48096 -t --mount type=bind,src=/tmp/validator-status-libsodium-usage-ruby-rbnacl-auth-onetime,dst=/validator/status --mount type=bind,src=/home/runner/work/validator/validator/.work/pages-artifacts/debs/port/libsodium,dst=/override-debs,readonly validator-libsodium-shared bash -lc 'set -euo pipefail
/validator/tests/_shared/install_override_debs.sh
exec /validator/tests/_shared/run_library_tests.sh "$@"' validator-testcase libsodium usage-ruby-rbnacl-auth-onetime -- bash -c 'PS4=$1; shift; set -x; source "$@"' validator-xtrace '__VALIDATOR_XTRACE__ ' /validator/tests/libsodium/tests/cases/usage/usage-ruby-rbnacl-auth-onetime.sh
installing override packages from /override-debs
(Reading database ... (Reading database ... 5%(Reading database ... 10%(Reading database ... 15%(Reading database ... 20%(Reading database ... 25%(Reading database ... 30%(Reading database ... 35%(Reading database ... 40%(Reading database ... 45%(Reading database ... 50%(Reading database ... 55%(Reading database ... 60%(Reading database ... 65%(Reading database ... 70%(Reading database ... 75%(Reading database ... 80%(Reading database ... 85%(Reading database ... 90%(Reading database ... 95%(Reading database ... 100%(Reading database ... 22270 files and directories currently installed.)
Preparing to unpack .../libsodium-dev_1.0.18-1ubuntu0.24.04.1+safelibs1778011697_amd64.deb ...
Unpacking libsodium-dev:amd64 (1.0.18-1ubuntu0.24.04.1+safelibs1778011697) over (1.0.18-1ubuntu0.24.04.1) ...
Preparing to unpack .../libsodium23_1.0.18-1ubuntu0.24.04.1+safelibs1778011697_amd64.deb ...
Unpacking libsodium23:amd64 (1.0.18-1ubuntu0.24.04.1+safelibs1778011697) over (1.0.18-1ubuntu0.24.04.1) ...
Setting up libsodium23:amd64 (1.0.18-1ubuntu0.24.04.1+safelibs1778011697) ...
Setting up libsodium-dev:amd64 (1.0.18-1ubuntu0.24.04.1+safelibs1778011697) ...
Processing triggers for libc-bin (2.39-0ubuntu8.7) ...
key = ("\x42".b * RbNaCl::OneTimeAuths::Poly1305.key_bytes)
message = "validator one-time auth payload"
auth = RbNaCl::OneTimeAuths::Poly1305.new(key)
tag = auth.auth(message)
raise "unexpected tag length: #{tag.bytesize}" unless tag.bytesize == 16

# Matching tag must verify (no exception).
auth.verify(tag, message)

# A tampered tag must be rejected.
tampered = tag.dup
tampered.setbyte(0, tampered.getbyte(0) ^ 0x01)
rejected_tampered = false
begin
  auth.verify(tampered, message)
rescue RbNaCl::BadAuthenticatorError
  rejected_tampered = true
end
raise "tampered tag accepted" unless rejected_tampered

# A wrong key must also reject the original tag.
wrong = RbNaCl::OneTimeAuths::Poly1305.new(("\x43".b * 32))
rejected_wrong = false
begin
  wrong.verify(tag, message)
rescue RbNaCl::BadAuthenticatorError
  rejected_wrong = true
end
raise "wrong key accepted tag" unless rejected_wrong

puts tag.unpack1("H*")
'
b2d5ddeb3dfdffaa2789f6b5e3adb9d3