mirror of
https://github.com/borgbackup/borg.git
synced 2026-09-01 14:13:19 +02:00
8d81cfabb7- src/borg/crypto/low_level.pyx: implement `argon2_hash` using OpenSSL's `EVP_KDF` API for ARGON2 (requires OpenSSL >= 3.2.0). - src/borg/crypto/key.py: switch to the native `argon2_hash` implementation, removing `argon2-cffi` dependency. - setup.py: require OpenSSL >= 3.2.0 for the crypto extension to ensure ARGON2 KDF support is available. - pyproject.toml: drop `argon2-cffi` dependency. - docs: update installation requirements and security documentation to reflect the transition to OpenSSL for Argon2. The lanes are computed in parallel via OpenSSL's thread pool: OpenSSL's Argon2 only uses threads if OSSL_set_max_threads() enabled the thread pool and a "threads" parameter > 1 is given. Passing threads=1 would compute the 4 lanes of our default parallelism=4 sequentially, and unlocking would get slower than it was with argon2-cffi, which used real threads for the lanes. The thread count only affects speed, never the derived key (only the lanes parameter does), so this is fully compatible with existing keys. Apple M-series (OpenSSL 3.6.3), borg defaults (t=3, m=64 MiB, p=4): threads=1: 83 ms, threads=4: 29 ms (2.8x faster). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
27 lines
798 B
Bash
Executable file
27 lines
798 B
Bash
Executable file
#!/bin/sh
|
|
# Generate a single-file binary of borgbackup using Nuitka.
|
|
|
|
set -eu
|
|
|
|
OUTPUT_DIR="dist/binary"
|
|
OUTPUT_FILENAME="borg-nuitka.exe" # .exe does NOT mean windows here
|
|
SRC_DIR="src/borg"
|
|
|
|
echo "Building single-file binary of borgbackup..."
|
|
|
|
# Run Nuitka compilation
|
|
# We use --assume-yes-for-downloads to avoid interactive prompts in automated runs.
|
|
# We set PYTHONPATH=src to ensure the local version of borg is used.
|
|
mkdir -p $OUTPUT_DIR
|
|
PYTHONPATH=src python -m nuitka \
|
|
--mode=onefile \
|
|
--assume-yes-for-downloads \
|
|
--include-package=borg \
|
|
--include-package=borghash \
|
|
--include-package=borgstore \
|
|
--output-dir="$OUTPUT_DIR" \
|
|
--output-filename="$OUTPUT_FILENAME" \
|
|
"$SRC_DIR"
|
|
|
|
echo "Single-file binary generated at:"
|
|
echo "$OUTPUT_DIR/$OUTPUT_FILENAME"
|