Merge package:crypto

pkgs/crypto/.github/dependabot.yml

@@ -0,0 +1,15 @@
+# Dependabot configuration file.
+# See https://docs.github.com/en/code-security/dependabot/dependabot-version-updates
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    labels:
+      - autosubmit
+    groups:
+      github-actions:
+        patterns:
+          - "*"

pkgs/crypto/.github/workflows/no-response.yml

@@ -0,0 +1,37 @@
+# A workflow to close issues where the author hasn't responded to a request for
+# more information; see https://github.com/actions/stale.
+
+name: No Response
+
+# Run as a daily cron.
+on:
+  schedule:
+    # Every day at 8am
+    - cron: '0 8 * * *'
+
+# All permissions not specified are set to 'none'.
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  no-response:
+    runs-on: ubuntu-latest
+    if: ${{ github.repository_owner == 'dart-lang' }}
+    steps:
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e
+        with:
+          # Don't automatically mark inactive issues+PRs as stale.
+          days-before-stale: -1
+          # Close needs-info issues and PRs after 14 days of inactivity.
+          days-before-close: 14
+          stale-issue-label: "needs-info"
+          close-issue-message: >
+            Without additional information we're not able to resolve this issue.
+            Feel free to add more info or respond to any questions above and we
+            can reopen the case. Thanks for your contribution!
+          stale-pr-label: "needs-info"
+          close-pr-message: >
+            Without additional information we're not able to resolve this PR.
+            Feel free to add more info or respond to any questions above.
+            Thanks for your contribution!

pkgs/crypto/.github/workflows/publish.yaml

@@ -0,0 +1,17 @@
+# A CI configuration to auto-publish pub packages.
+
+name: Publish
+
+on:
+  pull_request:
+    branches: [ master ]
+  push:
+    tags: [ 'v[0-9]+.[0-9]+.[0-9]+' ]
+
+jobs:
+  publish:
+    if: ${{ github.repository_owner == 'dart-lang' }}
+    uses: dart-lang/ecosystem/.github/workflows/publish.yaml@main
+    permissions:
+      id-token: write # Required for authentication using OIDC
+      pull-requests: write # Required for writing the pull request note

pkgs/crypto/.github/workflows/test-package.yml

@@ -0,0 +1,68 @@
+name: Dart CI
+
+on:
+  # Run on PRs and pushes to the default branch.
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  schedule:
+    - cron: "0 0 * * 0"
+
+env:
+  PUB_ENVIRONMENT: bot.github
+
+jobs:
+  # Check code formatting and static analysis on a single OS (linux)
+  # against Dart dev.
+  analyze:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        sdk: [dev]
+    steps:
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+      - uses: dart-lang/setup-dart@0a8a0fc875eb934c15d08629302413c671d3f672
+        with:
+          sdk: ${{ matrix.sdk }}
+      - id: install
+        name: Install dependencies
+        run: dart pub get
+      - name: Check formatting
+        run: dart format --output=none --set-exit-if-changed .
+        if: always() && steps.install.outcome == 'success'
+      - name: Analyze code
+        run: dart analyze --fatal-infos
+        if: always() && steps.install.outcome == 'success'
+
+  # Run tests on a matrix consisting of two dimensions:
+  # 1. OS: ubuntu-latest, (macos-latest, windows-latest)
+  # 2. release channel: dev
+  test:
+    needs: analyze
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        # Add macos-latest and/or windows-latest if relevant for this package.
+        os: [ubuntu-latest]
+        sdk: [3.4, dev]
+    steps:
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+      - uses: dart-lang/setup-dart@0a8a0fc875eb934c15d08629302413c671d3f672
+        with:
+          sdk: ${{ matrix.sdk }}
+      - id: install
+        name: Install dependencies
+        run: dart pub get
+      - name: Run VM tests
+        run: dart test --platform vm
+        if: always() && steps.install.outcome == 'success'
+      - name: Run Chrome tests
+        run: dart test --platform chrome
+        if: always() && steps.install.outcome == 'success'
+      - name: Run Chrome tests - wasm
+        # TODO: investigate why we get hangs when concurrency is > 1
+        run: dart test --platform chrome --compiler dart2wasm -j 1
+        if: always() && steps.install.outcome == 'success'

pkgs/crypto/.gitignore

@@ -0,0 +1,3 @@
+.dart_tool
+.packages
+pubspec.lock

pkgs/crypto/.test_config

@@ -0,0 +1,5 @@
+{
+  "test_package": {
+    "platforms": ["vm"]
+  }
+}

pkgs/crypto/AUTHORS

@@ -0,0 +1,6 @@
+# Below is a list of people and organizations that have contributed
+# to the project. Names should be added to the list like so:
+#
+#   Name/Organization <email address>
+
+Google Inc.

pkgs/crypto/CHANGELOG.md

@@ -0,0 +1,165 @@
+## 3.0.5
+
+* Revert switch to enable fast "sinks" on Wasm because it breaks `dart2js` with
+  server mode.
+
+## 3.0.4
+
+* Fix WebAssembly support.
+* Require Dart 3.4
+
+## 3.0.3
+
+* Require Dart 2.19.0.
+* Add topics to `pubspec.yaml`.
+
+## 3.0.2
+
+* Require Dart 2.14.0.
+* Fix bug calculating hashes for content larger than 512MB when compiled to JS.
+
+## 3.0.1
+
+* Fix doc links in README.
+
+## 3.0.0
+
+* Stable release for null safety.
+* Adds SHA-2 512/224 and SHA-2 512/256 from FIPS 180-4
+* Removes `newInstance` instance members on some classes
+  and updates documentation.
+
+## 2.1.5
+
+* Improve example and package description to address package site maintenance
+  suggestions.
+
+## 2.1.4
+  * BugFix: padding was incorrect for some SHA-512/328.
+
+## 2.1.3
+  * **Security vulnerability**: Fixed constant-time comparison in `Digest`.
+
+## 2.1.2
+  * Fix bug in SHA-2 384/512 blocksize.
+  * Added HMAC-SHA-2 test vectors
+
+## 2.1.1+1
+  * Bump version number for publish mishap (spare file uploaded with `pub
+    publish`).
+
+## 2.1.1
+  * Added a workaround for a bug in DDC (used in build_web_compilers 1.x).
+  This bug is not present in DDK (used in build_web_compilers 2.x).
+
+## 2.1.0
+  * Added SHA384, and SHA512
+  * Add Sha224 + Refactor
+  * Support 32bit and 64bit operations for SHA384/51
+  * Add conditional imports
+  * De-listify 32bit allocations
+  * Add sha monte tests for 224,256,384, and 512
+
+## 2.0.5
+
+* Changed the max message size instead to 0x3ffffffffffff, which is the largest
+  portable value for both JS and the Dart VM.
+
+## 2.0.4
+
+* Made max message size a BigNum instead of an int so that dart2js can compile
+  with crypto.
+
+## 2.0.3
+
+* Updated SDK version to 2.0.0-dev.17.0
+
+## 2.0.2+1
+
+* Fix SDK constraint.
+
+## 2.0.2
+
+* Prepare `HashSink` implementation for limiting integers to 64 bits in Dart
+  language.
+
+## 2.0.1
+
+* Support `convert` 2.0.0.
+
+## 2.0.0
+
+**Note**: There are no APIs in 2.0.0 that weren't also in 0.9.2. Packages that
+would use 2.0.0 as a lower bound should use 0.9.2 instead—for example, `crypto:
+">=0.9.2 <3.0.0"`.
+
+* `Hash` and `Hmac` no longer extend `ChunkedConverter`.
+
+## 1.1.1
+
+* Properly close sinks passed to `Hash.startChunkedConversion()` when
+  `ByteConversionSink.close()` is called.
+
+## 1.1.0
+
+* `Hmac` and `Hash` now extend the new `ChunkedConverter` class from
+  `dart:convert`.
+
+* Fix all strong mode warnings.
+
+## 1.0.0
+
+* All APIs that were deprecated in 0.9.2 have been removed. No new APIs have
+  been added. Packages that would use 1.0.0 as a lower bound should use 0.9.2
+  instead—for example, `crypto: ">=0.9.2 <2.0.0"`.
+
+## 0.9.2+1
+
+* Avoid core library methods that don't work on dart2js.
+
+## 0.9.2
+
+* `Hash`, `MD5`, `SHA1`, and `SHA256` now implement `Converter`. They convert
+  between `List<int>`s and the new `Digest` class, which represents a hash
+  digest. The `Converter` APIs—`Hash.convert()` and
+  `Hash.startChunkedConversion`—should be used in preference to the old APIs,
+  which are now deprecated.
+
+* `SHA1`, `SHA256`, and `HMAC` have been renamed to `Sha1`, `Sha256`, and
+  `Hmac`, respectively. The old names still work, but are deprecated.
+
+* Top-level `sha1`, `sha256`, and `md5` fields have been added to make it easier
+  to use those hash algorithms without having to instantiate new instances.
+
+* Hashing now works correctly for input sizes up to 2^64 bytes.
+
+### Deprecations
+
+* `Hash.add`, `Hash.close`, and `Hash.newInstance` are deprecated.
+  `Hash.convert` should be used for hashing single values, and
+  `Hash.startChunkedConversion` should be used for hashing streamed values.
+
+* `SHA1` and `SHA256` are deprecated. Use the top-level `sha1` and `sha256`
+  fields instead.
+
+* While the `MD5` class is not deprecated, the `new MD5()` constructor is. Use
+  the top-level `md5` field instead.
+
+* `HMAC` is deprecated. Use `Hmac` instead.
+
+* `Base64Codec`, `Base64Encoder`, `Base64Decoder`, `Base64EncoderSink`,
+  `Base64DecoderSink`, and `BASE64` are deprecated. Use the Base64 APIs in
+  `dart:convert` instead.
+
+* `CryptoUtils` is deprecated. Use the Base64 APIs in `dart:convert` and the hex
+  APIs in the `convert` package instead.
+
+## 0.9.1
+
+* Base64 convert returns an Uint8List
+* Base64 codec and encoder can now take an encodePaddingCharacter
+* Implement a Base64 codec similar to codecs in 'dart:convert'
+
+## 0.9.0
+
+* ChangeLog starts here.

pkgs/crypto/CONTRIBUTING.md

@@ -0,0 +1,33 @@
+Want to contribute? Great! First, read this page (including the small print at
+the end).
+
+### Before you contribute
+Before we can use your code, you must sign the
+[Google Individual Contributor License Agreement](https://cla.developers.google.com/about/google-individual)
+(CLA), which you can do online. The CLA is necessary mainly because you own the
+copyright to your changes, even after your contribution becomes part of our
+codebase, so we need your permission to use and distribute your code. We also
+need to be sure of various other things—for instance that you'll tell us if you
+know that your code infringes on other people's patents. You don't have to sign
+the CLA until after you've submitted your code for review and a member has
+approved it, but you must do it before we can put your code into our codebase.
+
+Before you start working on a larger contribution, you should get in touch with
+us first through the issue tracker with your idea so that we can help out and
+possibly guide you. Coordinating up front makes it much easier to avoid
+frustration later on.
+
+### Code reviews
+All submissions, including submissions by project members, require review.
+
+### File headers
+All files in the project must start with the following header.
+
+    // Copyright (c) 2015, the Dart project authors.  Please see the AUTHORS file
+    // for details. All rights reserved. Use of this source code is governed by a
+    // BSD-style license that can be found in the LICENSE file.
+
+### The small print
+Contributions made by corporations are covered by a different agreement than the
+one above, the
+[Software Grant and Corporate Contributor License Agreement](https://developers.google.com/open-source/cla/corporate).

pkgs/crypto/LICENSE

@@ -0,0 +1,27 @@
+Copyright 2015, the Dart project authors.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above
+      copyright notice, this list of conditions and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+    * Neither the name of Google LLC nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.