Init: copy code from gobang

10 files changed, 1281 insertions, 0 deletions

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..f4905f3
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,6 @@
+/*.bin
+/src/version.go
+/src/*.a
+/src/*.bin
+/tests/*.a
+/tests/*.bin
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..dc64488
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,152 @@
+.POSIX:
+DATE         = 1970-01-01
+VERSION      = 0.1.0
+NAME         = scrypt
+NAME_UC      = $(NAME)
+LANGUAGES    = en
+## Installation prefix.  Defaults to "/usr".
+PREFIX       = /usr
+BINDIR       = $(PREFIX)/bin
+LIBDIR       = $(PREFIX)/lib
+GOLIBDIR     = $(LIBDIR)/go
+INCLUDEDIR   = $(PREFIX)/include
+SRCDIR       = $(PREFIX)/src/$(NAME)
+SHAREDIR     = $(PREFIX)/share
+LOCALEDIR    = $(SHAREDIR)/locale
+MANDIR       = $(SHAREDIR)/man
+EXEC         = ./
+## Where to store the installation.  Empty by default.
+DESTDIR      =
+LDLIBS       =
+GOCFLAGS     = -I $(GOLIBDIR)
+GOLDFLAGS    = -L $(GOLIBDIR)
+
+
+
+.SUFFIXES:
+.SUFFIXES: .go .a .bin .bin-check
+
+
+
+objects = \
+	src/$(NAME).a                  \
+	src/main.a                     \
+	tests/$(NAME).a                \
+	tests/main.a                   \
+	tests/libbuild.a               \
+
+sources = \
+	src/$(NAME).go                 \
+	src/version.go                 \
+	src/main.go                    \
+
+
+derived-assets = \
+	src/version.go                 \
+	$(objects)                     \
+	src/main.bin                   \
+	tests/main.bin                 \
+	tests/libbuild.bin             \
+	$(NAME).bin                    \
+
+side-assets = \
+
+
+
+## Default target.  Builds all artifacts required for testing
+## and installation.
+all: $(derived-assets)
+
+
+$(objects): Makefile
+
+src/$(NAME).a: src/$(NAME).go src/version.go
+	go tool compile $(GOCFLAGS) -o $@ -p $(*F) -I $(@D) $*.go src/version.go
+
+src/main.a: src/main.go src/$(NAME).a
+tests/main.a: tests/main.go tests/$(NAME).a
+src/main.a tests/main.a:
+	go tool compile $(GOCFLAGS) -o $@ -p $(*F) -I $(@D) $*.go
+
+tests/libbuild.a: tests/libbuild.go src/$(NAME).a
+	go tool compile $(GOCFLAGS) -o $@ -p main -I src $*.go
+
+tests/$(NAME).a: tests/$(NAME).go src/$(NAME).go src/version.go
+	go tool compile $(GOCFLAGS) -o $@ -p $(*F) $*.go src/$(*F).go src/version.go
+
+tests/libbuild.bin: tests/libbuild.a
+	go tool link   $(GOLDFLAGS) -o $@ -L src $*.a
+
+src/main.bin: src/main.a
+tests/main.bin: tests/main.a
+src/main.bin tests/main.bin:
+	go tool link   $(GOLDFLAGS) -o $@ -L $(@D) --extldflags '$(LDLIBS)' $*.a
+
+$(NAME).bin: src/main.bin
+	ln -fs $? $@
+
+src/version.go: Makefile
+	echo 'package $(NAME); var version = "$(VERSION)"' > $@
+
+
+
+tests.bin-check = \
+	tests/main.bin-check           \
+	tests/libbuild.bin-check       \
+
+tests/main.bin-check: tests/main.bin
+tests/libbuild.bin-check: tests/libbuild.bin
+$(tests.bin-check):
+	$(EXEC)$*.bin
+
+check-unit: $(tests.bin-check)
+
+
+integration-tests = \
+	tests/cli-opts.sh              \
+	tests/integration.sh           \
+
+.PRECIOUS: $(integration-tests)
+$(integration-tests): $(NAME).bin
+$(integration-tests): ALWAYS
+	sh $@
+
+check-integration: $(integration-tests)
+
+
+## Run all tests.  Each test suite is isolated, so that a parallel
+## build can run tests at the same time.  The required artifacts
+## are created if missing.
+check: check-unit check-integration
+
+
+
+## Remove *all* derived artifacts produced during the build.
+## A dedicated test asserts that this is always true.
+clean:
+	rm -rf $(derived-assets) $(side-assets)
+
+
+## Installs into $(DESTDIR)$(PREFIX).  Its dependency target
+## ensures that all installable artifacts are crafted beforehand.
+install: all
+	mkdir -p \
+		'$(DESTDIR)$(BINDIR)'     \
+		'$(DESTDIR)$(GOLIBDIR)'   \
+		'$(DESTDIR)$(SRCDIR)'     \
+
+	cp $(NAME).bin       '$(DESTDIR)$(BINDIR)'/$(NAME)
+	cp src/$(NAME).a     '$(DESTDIR)$(GOLIBDIR)'
+	cp $(sources)        '$(DESTDIR)$(SRCDIR)'
+
+## Uninstalls from $(DESTDIR)$(PREFIX).  This is a perfect mirror
+## of the "install" target, and removes *all* that was installed.
+## A dedicated test asserts that this is always true.
+uninstall:
+	rm -rf \
+		'$(DESTDIR)$(BINDIR)'/$(NAME)         \
+		'$(DESTDIR)$(GOLIBDIR)'/$(NAME).a     \
+		'$(DESTDIR)$(SRCDIR)'                 \
+
+
+ALWAYS:
diff --git a/src/main.go b/src/main.go
new file mode 100644
index 0000000..af85993
--- /dev/null
+++ b/src/main.go
@@ -0,0 +1,7 @@
+package main
+
+import "scrypt"
+
+func main() {
+	scrypt.Main()
+}
diff --git a/src/scrypt.go b/src/scrypt.go
new file mode 100644
index 0000000..103ae66
--- /dev/null
+++ b/src/scrypt.go
@@ -0,0 +1,420 @@
+package scrypt
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"hash"
+	"io"
+	"math/bits"
+	"os"
+	"slices"
+)
+
+
+
+const (
+	maxInt                = int((^uint(0)) >> 1)
+	MinimumPasswordLength = 16
+)
+
+const (
+	scrypt_N = 1 << 15
+	scrypt_r = 8
+	scrypt_p = 1
+	scryptSaltMinLength = 32
+	scryptDesiredLength = 32
+)
+
+
+var (
+	BadNError           = errors.New("scrypt: N must be > 1 and a power of 2")
+	ParamsTooLargeError = errors.New("scrypt: parameters are too large")
+	SaltTooSmallError   = errors.New("scrypt: salt is too small")
+)
+
+
+
+// Package pbkdf2 implements the key derivation function PBKDF2 as defined in
+// RFC 2898 / PKCS #5 v2.0.
+//
+// A key derivation function is useful when encrypting data based on a password
+// or any other not-fully-random data. It uses a pseudorandom function to derive
+// a secure encryption key based on the password.
+//
+// While v2.0 of the standard defines only one pseudorandom function to use,
+// HMAC-SHA1, the drafted v2.1 specification allows use of all five FIPS
+// Approved Hash Functions SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 for
+// HMAC. To choose, you can pass the `New` functions from the different SHA
+// packages to pbkdf2.Key.
+//
+//
+// Key derives a key from the password, salt and iteration count, returning a
+// []byte of length keylen that can be used as cryptographic key. The key is
+// derived based on the method described as PBKDF2 with the HMAC variant using
+// the supplied hash function.
+//
+// For example, to use a HMAC-SHA-1 based PBKDF2 key derivation function, you
+// can get a derived key for e.g. AES-256 (which needs a 32-byte key) by
+// doing:
+//
+//	dk := pbkdf2.Key([]byte("some password"), salt, 4096, 32, sha1.New)
+//
+// Remember to get a good random salt. At least 8 bytes is recommended by the
+// RFC.
+//
+// Using a higher iteration count will increase the cost of an exhaustive
+// search but will also make derivation proportionally slower.
+func _PBKDF2Key(
+	password []byte,
+	salt []byte,
+	iter int,
+	keyLen int,
+	h func() hash.Hash,
+) []byte {
+	prf := hmac.New(h, password)
+	hashLen := prf.Size()
+	numBlocks := (keyLen + hashLen - 1) / hashLen
+
+	var buffer [4]byte
+	dk := make([]byte, 0, numBlocks*hashLen)
+	U := make([]byte, hashLen)
+	for block := 1; block <= numBlocks; block++ {
+		// N.B.: || means concatenation, ^ means XOR
+		// for each block T_i = U_1 ^ U_2 ^ ... ^ U_iter
+		// U_1 = PRF(password, salt || uint(i))
+		prf.Reset()
+		prf.Write(salt)
+		buffer[0] = byte(block >> 24)
+		buffer[1] = byte(block >> 16)
+		buffer[2] = byte(block >> 8)
+		buffer[3] = byte(block >> 0)
+		prf.Write(buffer[:4])
+		dk = prf.Sum(dk)
+		T := dk[len(dk) - hashLen:]
+		copy(U, T)
+
+		// U_n = PRF(password, U_(n - 1))
+		for n := 2; n <= iter; n++ {
+			prf.Reset()
+			prf.Write(U)
+			U = U[:0]
+			U = prf.Sum(U)
+			for x := range U {
+				T[x] ^= U[x]
+			}
+		}
+	}
+	return dk[:keyLen]
+}
+
+// blockCopy copies n numbers from src into dst.
+func blockCopy(dst []uint32, src []uint32, n int) {
+	copy(dst, src[:n])
+}
+
+// blockXOR XORs numbers from dst with n numbers from src.
+func blockXOR(dst []uint32, src []uint32, n int) {
+	for i, v := range src[:n] {
+		dst[i] ^= v
+	}
+}
+
+// salsaXOR applies Salsa20/8 to the XOR of 16 numbers from tmp and in,
+// and puts the result into both tmp and out.
+func salsaXOR(tmp *[16]uint32, in []uint32, out []uint32) {
+	w0  := tmp[0]  ^ in[0]
+	w1  := tmp[1]  ^ in[1]
+	w2  := tmp[2]  ^ in[2]
+	w3  := tmp[3]  ^ in[3]
+	w4  := tmp[4]  ^ in[4]
+	w5  := tmp[5]  ^ in[5]
+	w6  := tmp[6]  ^ in[6]
+	w7  := tmp[7]  ^ in[7]
+	w8  := tmp[8]  ^ in[8]
+	w9  := tmp[9]  ^ in[9]
+	w10 := tmp[10] ^ in[10]
+	w11 := tmp[11] ^ in[11]
+	w12 := tmp[12] ^ in[12]
+	w13 := tmp[13] ^ in[13]
+	w14 := tmp[14] ^ in[14]
+	w15 := tmp[15] ^ in[15]
+
+	x0  := w0
+	x1  := w1
+	x2  := w2
+	x3  := w3
+	x4  := w4
+	x5  := w5
+	x6  := w6
+	x7  := w7
+	x8  := w8
+	x9  := w9
+	x10 := w10
+	x11 := w11
+	x12 := w12
+	x13 := w13
+	x14 := w14
+	x15 := w15
+
+	for i := 0; i < 8; i += 2 {
+		x4  ^= bits.RotateLeft32(x0  + x12, 7)
+		x8  ^= bits.RotateLeft32(x4  + x0,  9)
+		x12 ^= bits.RotateLeft32(x8  + x4,  13)
+		x0  ^= bits.RotateLeft32(x12 + x8,  18)
+
+		x9  ^= bits.RotateLeft32(x5  + x1,  7)
+		x13 ^= bits.RotateLeft32(x9  + x5,  9)
+		x1  ^= bits.RotateLeft32(x13 + x9,  13)
+		x5  ^= bits.RotateLeft32(x1  + x13, 18)
+
+		x14 ^= bits.RotateLeft32(x10 + x6,  7)
+		x2  ^= bits.RotateLeft32(x14 + x10, 9)
+		x6  ^= bits.RotateLeft32(x2  + x14, 13)
+		x10 ^= bits.RotateLeft32(x6  + x2,  18)
+
+		x3  ^= bits.RotateLeft32(x15 + x11, 7)
+		x7  ^= bits.RotateLeft32(x3  + x15, 9)
+		x11 ^= bits.RotateLeft32(x7  + x3,  13)
+		x15 ^= bits.RotateLeft32(x11 + x7,  18)
+
+		x1  ^= bits.RotateLeft32(x0  + x3,  7)
+		x2  ^= bits.RotateLeft32(x1  + x0,  9)
+		x3  ^= bits.RotateLeft32(x2  + x1,  13)
+		x0  ^= bits.RotateLeft32(x3  + x2,  18)
+
+		x6  ^= bits.RotateLeft32(x5  + x4,  7)
+		x7  ^= bits.RotateLeft32(x6  + x5,  9)
+		x4  ^= bits.RotateLeft32(x7  + x6,  13)
+		x5  ^= bits.RotateLeft32(x4  + x7,  18)
+
+		x11 ^= bits.RotateLeft32(x10 + x9,  7)
+		x8  ^= bits.RotateLeft32(x11 + x10, 9)
+		x9  ^= bits.RotateLeft32(x8  + x11, 13)
+		x10 ^= bits.RotateLeft32(x9  + x8,  18)
+
+		x12 ^= bits.RotateLeft32(x15 + x14, 7)
+		x13 ^= bits.RotateLeft32(x12 + x15, 9)
+		x14 ^= bits.RotateLeft32(x13 + x12, 13)
+		x15 ^= bits.RotateLeft32(x14 + x13, 18)
+	}
+
+	x0  += w0
+	x1  += w1
+	x2  += w2
+	x3  += w3
+	x4  += w4
+	x5  += w5
+	x6  += w6
+	x7  += w7
+	x8  += w8
+	x9  += w9
+	x10 += w10
+	x11 += w11
+	x12 += w12
+	x13 += w13
+	x14 += w14
+	x15 += w15
+
+	out[0],  tmp[0]  = x0,  x0
+	out[1],  tmp[1]  = x1,  x1
+	out[2],  tmp[2]  = x2,  x2
+	out[3],  tmp[3]  = x3,  x3
+	out[4],  tmp[4]  = x4,  x4
+	out[5],  tmp[5]  = x5,  x5
+	out[6],  tmp[6]  = x6,  x6
+	out[7],  tmp[7]  = x7,  x7
+	out[8],  tmp[8]  = x8,  x8
+	out[9],  tmp[9]  = x9,  x9
+	out[10], tmp[10] = x10, x10
+	out[11], tmp[11] = x11, x11
+	out[12], tmp[12] = x12, x12
+	out[13], tmp[13] = x13, x13
+	out[14], tmp[14] = x14, x14
+	out[15], tmp[15] = x15, x15
+}
+
+func blockMix(tmp *[16]uint32, in []uint32, out []uint32, r int) {
+	blockCopy(tmp[:], in[(2 * r - 1) * 16:], 16)
+	for i := 0; i < 2 * r; i += 2 {
+		salsaXOR(tmp, in[i * 16:],      out[i * 8:])
+		salsaXOR(tmp, in[i * 16 + 16:], out[i * 8 + r * 16:])
+	}
+}
+
+func integer(b []uint32, r int) uint64 {
+	j := (2 * r - 1) * 16
+	return uint64(b[j]) | (uint64(b[j + 1]) << 32)
+}
+
+func smix(b []byte, r int, N int, v []uint32, xy []uint32) {
+	var tmp [16]uint32
+	R := 32 * r
+	x := xy
+	y := xy[R:]
+
+	j := 0
+	for i := 0; i < R; i++ {
+		x[i] = binary.LittleEndian.Uint32(b[j:])
+		j += 4
+	}
+	for i := 0; i < N; i += 2 {
+		blockCopy(v[i * R:], x, R)
+		blockMix(&tmp, x, y, r)
+
+		blockCopy(v[(i + 1) * R:], y, R)
+		blockMix(&tmp, y, x, r)
+	}
+	for i := 0; i < N; i += 2 {
+		j := int(integer(x, r) & uint64(N - 1))
+		blockXOR(x, v[j * R:], R)
+		blockMix(&tmp, x, y, r)
+
+		j = int(integer(y, r) & uint64(N - 1))
+		blockXOR(y, v[j * R:], R)
+		blockMix(&tmp, y, x, r)
+	}
+	j = 0
+	for _, v := range x[:R] {
+		binary.LittleEndian.PutUint32(b[j:], v)
+		j += 4
+	}
+}
+
+func validateParams(N int, r int, p int) error {
+	if N <= 1 || N & (N - 1) != 0 {
+		return BadNError
+	}
+
+	if ((uint64(r) * uint64(p)) >= (1 << 30)) ||
+			r > maxInt / 128 / p ||
+			r > maxInt / 256 ||
+			N > maxInt / 128 / r {
+		return ParamsTooLargeError
+	}
+
+	return nil
+}
+
+// Package scrypt implements the scrypt key derivation function as defined in
+// Colin Percival's paper "Stronger Key Derivation via Sequential Memory-Hard
+// Functions" (https://www.tarsnap.com/scrypt/scrypt.pdf).
+//
+//
+// Key derives a key from the password, salt, and cost parameters, returning
+// a byte slice of length keyLen that can be used as cryptographic key.
+//
+// N is a CPU/memory cost parameter, which must be a power of 2 greater than 1.
+// r and p must satisfy r * p < 2³⁰. If the parameters do not satisfy the
+// limits, the function returns a nil byte slice and an error.
+//
+// For example, you can get a derived key for e.g. AES-256 (which needs a
+// 32-byte key) by doing:
+//
+//	dk, err := scrypt.Key([]byte("some password"), salt, 32768, 8, 1, 32)
+//
+// The recommended parameters for interactive logins as of 2017 are N=32768, r=8
+// and p=1. The parameters N, r, and p should be increased as memory latency and
+// CPU parallelism increases; consider setting N to the highest power of 2 you
+// can derive within 100 milliseconds. Remember to get a good random salt.
+func scrypt(
+	password []byte,
+	salt []byte,
+	N int,
+	r int,
+	p int,
+	keyLen int,
+) ([]byte, error) {
+	err := validateParams(N, r, p)
+	if err != nil {
+		return nil, err
+	}
+
+	xy := make([]uint32, 64 * r)
+	v  := make([]uint32, 32 * r * N)
+	b  := _PBKDF2Key(password, salt, 1, p * 128 * r, sha256.New)
+
+	for i := 0; i < p; i++ {
+		smix(b[i * 128 * r:], r, N, v, xy)
+	}
+
+	return _PBKDF2Key(password, b, 1, keyLen, sha256.New), nil
+}
+
+func SaltFrom(r io.Reader) ([]byte, error) {
+	buffer := make([]byte, scryptSaltMinLength)
+	_, err := io.ReadFull(rand.Reader, buffer)
+	if err != nil {
+		return nil, err
+	}
+	return buffer, nil
+}
+
+func HashFrom(password []byte, salt []byte) ([]byte, error) {
+	if len(salt) < scryptSaltMinLength {
+		return nil, SaltTooSmallError
+	}
+
+	hash, err := scrypt(
+		password,
+		salt,
+		scrypt_N,
+		scrypt_r,
+		scrypt_p,
+		scryptDesiredLength,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return hash, nil
+}
+
+func CheckFrom(password []byte, salt []byte, hash []byte) (bool, error) {
+	candidate, err := HashFrom(password, salt)
+	if err != nil {
+		return false, err
+	}
+
+	return slices.Equal(candidate, hash), nil
+}
+
+func Salt() []byte {
+	salt, err := SaltFrom(rand.Reader)
+	if err != nil {
+		panic(err)
+	}
+	return salt
+}
+
+func Hash(password []byte, salt []byte) []byte {
+	hash, err := HashFrom(password, salt)
+	if err != nil {
+		panic(err)
+	}
+	return hash
+}
+
+func Check(password []byte, salt []byte, hash []byte) bool {
+	check, err := CheckFrom(password, salt, hash)
+	if err != nil {
+		panic(err)
+	}
+	return check
+}
+
+
+func Main() {
+	if len(os.Args) != 3 {
+		fmt.Fprintf(os.Stderr, "Usage: scrypt PASSWORD SALT\n")
+		os.Exit(2)
+	}
+
+	fmt.Println(hex.EncodeToString(
+		Hash([]byte(os.Args[1]), []byte(os.Args[2]))),
+	)
+}
diff --git a/tests/cli-opts.sh b/tests/cli-opts.sh
new file mode 100755
index 0000000..4f59185
--- /dev/null
+++ b/tests/cli-opts.sh
@@ -0,0 +1,47 @@
+#!/bin/sh
+set -eu
+
+. tests/lib.sh
+
+
+test_needs_2_arguments() {
+	testing 'needs 2 arguments'
+
+	N="$LINENO"
+	OUT="$(mkstemp)"
+	ERR="$(mkstemp)"
+	trap 'rm -f "$OUT" "$ERR"' EXIT
+	STATUS=0
+	./scrypt.bin 1>"$OUT" 2>"$ERR" || STATUS=$?
+	assert_status 2
+	assert_empty_stdout
+	assert_usage "$ERR"
+	rm -f "$OUT" "$ERR"
+
+	N="$LINENO"
+	OUT="$(mkstemp)"
+	ERR="$(mkstemp)"
+	trap 'rm -f "$OUT" "$ERR"' EXIT
+	STATUS=0
+	./scrypt.bin password 1>"$OUT" 2>"$ERR" || STATUS=$?
+	assert_status 2
+	assert_empty_stdout
+	assert_usage "$ERR"
+	rm -f "$OUT" "$ERR"
+
+	N="$LINENO"
+	OUT="$(mkstemp)"
+	ERR="$(mkstemp)"
+	trap 'rm -f "$OUT" "$ERR"' EXIT
+	STATUS=0
+	./scrypt.bin salt 1>"$OUT" 2>"$ERR" || STATUS=$?
+	assert_status 2
+	assert_empty_stdout
+	assert_usage "$ERR"
+	rm -f "$OUT" "$ERR"
+
+	test_ok
+}
+
+
+test_needs_2_arguments
diff --git a/tests/integration.sh b/tests/integration.sh
new file mode 100755
index 0000000..e31ae4d
--- /dev/null
+++ b/tests/integration.sh
@@ -0,0 +1,47 @@
+#!/bin/sh
+set -eu
+
+. tests/lib.sh
+
+
+test_needs_minimum_salt_length() {
+	testing 'needs minimum salt length'
+
+	N="$LINENO"
+	OUT="$(mkstemp)"
+	ERR="$(mkstemp)"
+	trap 'rm -f "$OUT" "$ERR"' EXIT
+	STATUS=0
+	./scrypt.bin password salt 1>"$OUT" 2>"$ERR" || STATUS=$?
+	assert_status 2
+	assert_empty_stdout
+	assert_fgrep_stderr 'salt is too small'
+	rm -f "$OUT" "$ERR"
+
+	test_ok
+}
+
+test_same_input_same_output() {
+	testing 'same input, same output'
+
+	N="$LINENO"
+	OUT="$(mkstemp)"
+	ERR="$(mkstemp)"
+	trap 'rm -f "$OUT" "$ERR"' EXIT
+	STATUS=0
+	#            8       16      24      32
+	#            v       v       v       v
+	SALT='saltsaltsaltsaltsaltsaltsaltsalti'
+	HASH='969a539633fd531309197c26a671d593da0eadbd31c1194c23bd1b143a0ecb5e'
+	./scrypt.bin password "$SALT" 1>"$OUT" 2>"$ERR" || STATUS=$?
+	assert_status 0
+	assert_stdout "$HASH"
+	assert_empty_stderr
+	rm -f "$OUT" "$ERR"
+
+	test_ok
+}
+
+
+test_needs_minimum_salt_length
+test_same_input_same_output
diff --git a/tests/lib.sh b/tests/lib.sh
new file mode 100644
index 0000000..07ecbef
--- /dev/null
+++ b/tests/lib.sh
@@ -0,0 +1,119 @@
+#!/bin/sh
+
+end="\033[0m"
+red="\033[0;31m"
+green="\033[0;32m"
+yellow="\033[0;33m"
+
+N=
+OUT=
+ERR=
+STATUS=
+
+ERROR() {
+	# shellcheck disable=2059
+	printf "${red}ERROR${end}"
+}
+
+print_debug_info() {
+	# shellcheck disable=2016
+	printf 'LINENO:   %s\n$OUT:      %s\n$ERR:      %s\n' \
+		"$N" "$OUT" "$ERR" >&2
+}
+
+assert_status() {
+	if [ "$STATUS" != "$1" ]; then
+		printf '\n%s: Bad status.\n\nexpected: %s\ngot:      %s\n' \
+			"$(ERROR)" "$1" "$STATUS" >&2
+		print_debug_info
+		exit 1
+	fi
+}
+
+assert_usage() {
+	if ! grep -Fq 'Usage' "$1"; then
+		echo 'Expected to find "Usage" text, it was missing:' >&2
+		cat "$1" >&2
+		print_debug_info
+		exit 1
+	fi
+}
+
+assert_empty_stream() {
+	if [ -s "$2" ]; then
+		FMT='\n%s: Expected %s (%s) to be empty, but has content:\n%s\n'
+		# shellcheck disable=2059
+		printf "$FMT" \
+			"$(ERROR)" "$1" "$2" "$(cat "$2")" >&2
+		print_debug_info
+		exit 1
+	fi
+}
+
+assert_empty_stdout() {
+	assert_empty_stream STDOUT "$OUT"
+}
+
+assert_empty_stderr() {
+	assert_empty_stream STDERR "$ERR"
+}
+
+assert_stream() {
+	if [ "$(cat "$2")" != "$3" ]; then
+		printf '\n%s: Bad %s (%s)\n\nexpected: %s\ngot:      %s\n' \
+			"$(ERROR)" "$1" "$2" "$3" "$(cat "$2")" >&2
+		print_debug_info
+		exit 1
+	fi
+}
+
+assert_stdout() {
+	assert_stream STDOUT "$OUT" "$1"
+}
+
+assert_stderr() {
+	assert_stream STDERR "$ERR" "$1"
+}
+
+assert_grep_stream() {
+	if ! grep -qE "$3" "$2"; then
+		printf '\n%s: Bad %s (%s)\n\ngrepping: %s\nin:\n%s\n' \
+			"$(ERROR)" "$1" "$2" "$3"  "$(cat "$2")" >&2
+		print_debug_info
+		exit 1
+	fi
+}
+
+assert_grep_stdout() {
+	assert_grep_stream STDOUT "$OUT" "$1"
+}
+
+assert_grep_stderr() {
+	assert_grep_stream STDERR "$ERR" "$1"
+}
+
+assert_fgrep_stream() {
+	if ! grep -Fq -- "$3" "$2"; then
+		printf '\n%s: Bad %s (%s)\n\ngrepping: %s\nin:\n%s\n' \
+			"$(ERROR)" "$1" "$2" "$3"  "$(cat "$2")" >&2
+		print_debug_info
+		exit 1
+	fi
+}
+
+assert_fgrep_stdout() {
+	assert_fgrep_stream STDOUT "$OUT" "$1"
+}
+
+assert_fgrep_stderr() {
+	assert_fgrep_stream STDERR "$ERR" "$1"
+}
+
+testing() {
+	printf "${yellow}testing${end}: %s..." "$1" >&2
+}
+
+test_ok() {
+	# shellcheck disable=2059
+	printf " ${green}OK${end}.\n" >&2
+}
diff --git a/tests/libbuild.go b/tests/libbuild.go
new file mode 100644
index 0000000..724d17a
--- /dev/null
+++ b/tests/libbuild.go
@@ -0,0 +1,14 @@
+package main
+
+import (
+	"encoding/hex"
+	"fmt"
+
+	"scrypt"
+)
+
+func main() {
+	fmt.Println(
+		hex.EncodeToString(scrypt.Hash(scrypt.Salt(), scrypt.Salt())),
+	)
+}
diff --git a/tests/main.go b/tests/main.go
new file mode 100644
index 0000000..5985191
--- /dev/null
+++ b/tests/main.go
@@ -0,0 +1,7 @@
+package main
+
+import "scrypt"
+
+func main() {
+	scrypt.MainTest()
+}
diff --git a/tests/scrypt.go b/tests/scrypt.go
new file mode 100644
index 0000000..d6d59c3
--- /dev/null
+++ b/tests/scrypt.go
@@ -0,0 +1,462 @@
+package scrypt
+
+import (
+	"crypto/sha1"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"hash"
+	"os"
+	"reflect"
+)
+
+
+
+func showColour() bool {
+	return os.Getenv("NO_COLOUR") == ""
+}
+
+func testStart(name string) {
+	fmt.Fprintf(os.Stderr, "%s:\n", name)
+}
+
+func testing(message string, body func()) {
+	if showColour() {
+		fmt.Fprintf(
+			os.Stderr,
+			"\033[0;33mtesting\033[0m: %s... ",
+			message,
+		)
+		body()
+		fmt.Fprintf(os.Stderr, "\033[0;32mOK\033[0m.\n")
+	} else {
+		fmt.Fprintf(os.Stderr, "testing: %s... ", message)
+		body()
+		fmt.Fprintf(os.Stderr, "OK.\n")
+	}
+}
+
+func assertEq(given any, expected any) {
+	if !reflect.DeepEqual(given, expected) {
+		if showColour() {
+			fmt.Fprintf(os.Stderr, "\033[0;31mERR\033[0m.\n")
+		} else {
+			fmt.Fprintf(os.Stderr, "ERR.\n")
+		}
+		fmt.Fprintf(os.Stderr, "given != expected\n")
+		fmt.Fprintf(os.Stderr, "given:    %#v\n", given)
+		fmt.Fprintf(os.Stderr, "expected: %#v\n", expected)
+		os.Exit(1)
+	}
+}
+
+
+type pbkdfTestVector struct {
+	password string
+	salt     string
+	iter     int
+	output   []byte
+}
+
+// Test vectors from RFC 6070, http://tools.ietf.org/html/rfc6070
+var sha1TestVectors = []pbkdfTestVector {
+	{
+		"password",
+		"salt",
+		1,
+		[]byte {
+			0x0c, 0x60, 0xc8, 0x0f, 0x96, 0x1f, 0x0e, 0x71,
+			0xf3, 0xa9, 0xb5, 0x24, 0xaf, 0x60, 0x12, 0x06,
+			0x2f, 0xe0, 0x37, 0xa6,
+		},
+	},
+	{
+		"password",
+		"salt",
+		2,
+		[]byte{
+			0xea, 0x6c, 0x01, 0x4d, 0xc7, 0x2d, 0x6f, 0x8c,
+			0xcd, 0x1e, 0xd9, 0x2a, 0xce, 0x1d, 0x41, 0xf0,
+			0xd8, 0xde, 0x89, 0x57,
+		},
+	},
+	{
+		"password",
+		"salt",
+		4096,
+		[]byte{
+			0x4b, 0x00, 0x79, 0x01, 0xb7, 0x65, 0x48, 0x9a,
+			0xbe, 0xad, 0x49, 0xd9, 0x26, 0xf7, 0x21, 0xd0,
+			0x65, 0xa4, 0x29, 0xc1,
+		},
+	},
+	// // This one takes too long
+	// {
+	// 	"password",
+	// 	"salt",
+	// 	16777216,
+	// 	[]byte {
+	// 		0xee, 0xfe, 0x3d, 0x61, 0xcd, 0x4d, 0xa4, 0xe4,
+	// 		0xe9, 0x94, 0x5b, 0x3d, 0x6b, 0xa2, 0x15, 0x8c,
+	// 		0x26, 0x34, 0xe9, 0x84,
+	// 	},
+	// },
+	{
+		"passwordPASSWORDpassword",
+		"saltSALTsaltSALTsaltSALTsaltSALTsalt",
+		4096,
+		[]byte{
+			0x3d, 0x2e, 0xec, 0x4f, 0xe4, 0x1c, 0x84, 0x9b,
+			0x80, 0xc8, 0xd8, 0x36, 0x62, 0xc0, 0xe4, 0x4a,
+			0x8b, 0x29, 0x1a, 0x96, 0x4c, 0xf2, 0xf0, 0x70,
+			0x38,
+		},
+	},
+	{
+		"pass\000word",
+		"sa\000lt",
+		4096,
+		[]byte{
+			0x56, 0xfa, 0x6a, 0xa7, 0x55, 0x48, 0x09, 0x9d,
+			0xcc, 0x37, 0xd7, 0xf0, 0x34, 0x25, 0xe0, 0xc3,
+		},
+	},
+}
+
+// Test vectors from
+// http://stackoverflow.com/questions/5130513/pbkdf2-hmac-sha2-test-vectors
+var sha256TestVectors = []pbkdfTestVector {
+	{
+		"password",
+		"salt",
+		1,
+		[]byte {
+			0x12, 0x0f, 0xb6, 0xcf, 0xfc, 0xf8, 0xb3, 0x2c,
+			0x43, 0xe7, 0x22, 0x52, 0x56, 0xc4, 0xf8, 0x37,
+			0xa8, 0x65, 0x48, 0xc9,
+		},
+	},
+	{
+		"password",
+		"salt",
+		2,
+		[]byte {
+			0xae, 0x4d, 0x0c, 0x95, 0xaf, 0x6b, 0x46, 0xd3,
+			0x2d, 0x0a, 0xdf, 0xf9, 0x28, 0xf0, 0x6d, 0xd0,
+			0x2a, 0x30, 0x3f, 0x8e,
+		},
+	},
+	{
+		"password",
+		"salt",
+		4096,
+		[]byte {
+			0xc5, 0xe4, 0x78, 0xd5, 0x92, 0x88, 0xc8, 0x41,
+			0xaa, 0x53, 0x0d, 0xb6, 0x84, 0x5c, 0x4c, 0x8d,
+			0x96, 0x28, 0x93, 0xa0,
+		},
+	},
+	{
+		"passwordPASSWORDpassword",
+		"saltSALTsaltSALTsaltSALTsaltSALTsalt",
+		4096,
+		[]byte {
+			0x34, 0x8c, 0x89, 0xdb, 0xcb, 0xd3, 0x2b, 0x2f,
+			0x32, 0xd8, 0x14, 0xb8, 0x11, 0x6e, 0x84, 0xcf,
+			0x2b, 0x17, 0x34, 0x7e, 0xbc, 0x18, 0x00, 0x18,
+			0x1c,
+		},
+	},
+	{
+		"pass\000word",
+		"sa\000lt",
+		4096,
+		[]byte {
+			0x89, 0xb6, 0x9d, 0x05, 0x16, 0xf8, 0x29, 0x89,
+			0x3c, 0x69, 0x62, 0x26, 0x65, 0x0a, 0x86, 0x87,
+		},
+	},
+}
+
+func testHash(h func() hash.Hash, hashName string, vectors []pbkdfTestVector) {
+	for _, v := range vectors {
+		out := _PBKDF2Key(
+			[]byte(v.password),
+			[]byte(v.salt),
+			v.iter,
+			len(v.output),
+			h,
+		)
+		assertEq(out, v.output)
+	}
+}
+
+func test__PBKDF() {
+	testStart("_PBKDF()")
+
+	testing("HMAC with SHA1", func() {
+		testHash(sha1.New, "SHA1", sha1TestVectors)
+	})
+
+	testing("HMAC with SHA256", func() {
+		testHash(sha256.New, "SHA256", sha256TestVectors)
+	})
+}
+
+type scryptTestVector struct {
+	password string
+	salt     string
+	N, r, p  int
+	output   []byte
+	err      error
+}
+
+var good = []scryptTestVector {
+	{
+		"password",
+		"salt",
+		2, 10, 10,
+		[]byte {
+			0x48, 0x2c, 0x85, 0x8e, 0x22, 0x90, 0x55, 0xe6, 0x2f,
+			0x41, 0xe0, 0xec, 0x81, 0x9a, 0x5e, 0xe1, 0x8b, 0xdb,
+			0x87, 0x25, 0x1a, 0x53, 0x4f, 0x75, 0xac, 0xd9, 0x5a,
+			0xc5, 0xe5, 0xa, 0xa1, 0x5f,
+		},
+		nil,
+	},
+	{
+		"password",
+		"salt",
+		16, 100, 100,
+		[]byte {
+			0x88, 0xbd, 0x5e, 0xdb, 0x52, 0xd1, 0xdd, 0x0, 0x18,
+			0x87, 0x72, 0xad, 0x36, 0x17, 0x12, 0x90, 0x22, 0x4e,
+			0x74, 0x82, 0x95, 0x25, 0xb1, 0x8d, 0x73, 0x23, 0xa5,
+			0x7f, 0x91, 0x96, 0x3c, 0x37,
+		},
+		nil,
+	},
+	{
+		"this is a long \000 password",
+		"and this is a long \000 salt",
+		16384, 8, 1,
+		[]byte {
+			0xc3, 0xf1, 0x82, 0xee, 0x2d, 0xec, 0x84, 0x6e, 0x70,
+			0xa6, 0x94, 0x2f, 0xb5, 0x29, 0x98, 0x5a, 0x3a, 0x09,
+			0x76, 0x5e, 0xf0, 0x4c, 0x61, 0x29, 0x23, 0xb1, 0x7f,
+			0x18, 0x55, 0x5a, 0x37, 0x07, 0x6d, 0xeb, 0x2b, 0x98,
+			0x30, 0xd6, 0x9d, 0xe5, 0x49, 0x26, 0x51, 0xe4, 0x50,
+			0x6a, 0xe5, 0x77, 0x6d, 0x96, 0xd4, 0x0f, 0x67, 0xaa,
+			0xee, 0x37, 0xe1, 0x77, 0x7b, 0x8a, 0xd5, 0xc3, 0x11,
+			0x14, 0x32, 0xbb, 0x3b, 0x6f, 0x7e, 0x12, 0x64, 0x40,
+			0x18, 0x79, 0xe6, 0x41, 0xae,
+		},
+		nil,
+	},
+	{
+		"p",
+		"s",
+		2, 1, 1,
+		[]byte {
+			0x48, 0xb0, 0xd2, 0xa8, 0xa3, 0x27, 0x26, 0x11, 0x98,
+			0x4c, 0x50, 0xeb, 0xd6, 0x30, 0xaf, 0x52,
+		},
+		nil,
+	},
+
+	{
+		"",
+		"",
+		16, 1, 1,
+		[]byte {
+			0x77, 0xd6, 0x57, 0x62, 0x38, 0x65, 0x7b, 0x20, 0x3b,
+			0x19, 0xca, 0x42, 0xc1, 0x8a, 0x04, 0x97, 0xf1, 0x6b,
+			0x48, 0x44, 0xe3, 0x07, 0x4a, 0xe8, 0xdf, 0xdf, 0xfa,
+			0x3f, 0xed, 0xe2, 0x14, 0x42, 0xfc, 0xd0, 0x06, 0x9d,
+			0xed, 0x09, 0x48, 0xf8, 0x32, 0x6a, 0x75, 0x3a, 0x0f,
+			0xc8, 0x1f, 0x17, 0xe8, 0xd3, 0xe0, 0xfb, 0x2e, 0x0d,
+			0x36, 0x28, 0xcf, 0x35, 0xe2, 0x0c, 0x38, 0xd1, 0x89,
+			0x06,
+		},
+		nil,
+	},
+	{
+		"password",
+		"NaCl",
+		1024, 8, 16,
+		[]byte {
+			0xfd, 0xba, 0xbe, 0x1c, 0x9d, 0x34, 0x72, 0x00, 0x78,
+			0x56, 0xe7, 0x19, 0x0d, 0x01, 0xe9, 0xfe, 0x7c, 0x6a,
+			0xd7, 0xcb, 0xc8, 0x23, 0x78, 0x30, 0xe7, 0x73, 0x76,
+			0x63, 0x4b, 0x37, 0x31, 0x62, 0x2e, 0xaf, 0x30, 0xd9,
+			0x2e, 0x22, 0xa3, 0x88, 0x6f, 0xf1, 0x09, 0x27, 0x9d,
+			0x98, 0x30, 0xda, 0xc7, 0x27, 0xaf, 0xb9, 0x4a, 0x83,
+			0xee, 0x6d, 0x83, 0x60, 0xcb, 0xdf, 0xa2, 0xcc, 0x06,
+			0x40,
+		},
+		nil,
+	},
+	{
+		"pleaseletmein", "SodiumChloride",
+		16384, 8, 1,
+		[]byte {
+			0x70, 0x23, 0xbd, 0xcb, 0x3a, 0xfd, 0x73, 0x48, 0x46,
+			0x1c, 0x06, 0xcd, 0x81, 0xfd, 0x38, 0xeb, 0xfd, 0xa8,
+			0xfb, 0xba, 0x90, 0x4f, 0x8e, 0x3e, 0xa9, 0xb5, 0x43,
+			0xf6, 0x54, 0x5d, 0xa1, 0xf2, 0xd5, 0x43, 0x29, 0x55,
+			0x61, 0x3f, 0x0f, 0xcf, 0x62, 0xd4, 0x97, 0x05, 0x24,
+			0x2a, 0x9a, 0xf9, 0xe6, 0x1e, 0x85, 0xdc, 0x0d, 0x65,
+			0x1e, 0x40, 0xdf, 0xcf, 0x01, 0x7b, 0x45, 0x57, 0x58,
+			0x87,
+		},
+		nil,
+	},
+	// // Disabled: needs 1 GiB RAM and takes too long for a simple test.
+	// {
+	// 	"pleaseletmein", "SodiumChloride",
+	// 	1048576, 8, 1,
+	// 	[]byte{
+	// 		0x21, 0x01, 0xcb, 0x9b, 0x6a, 0x51, 0x1a, 0xae, 0xad,
+	// 		0xdb, 0xbe, 0x09, 0xcf, 0x70, 0xf8, 0x81, 0xec, 0x56,
+	// 		0x8d, 0x57, 0x4a, 0x2f, 0xfd, 0x4d, 0xab, 0xe5, 0xee,
+	// 		0x98, 0x20, 0xad, 0xaa, 0x47, 0x8e, 0x56, 0xfd, 0x8f,
+	// 		0x4b, 0xa5, 0xd0, 0x9f, 0xfa, 0x1c, 0x6d, 0x92, 0x7c,
+	// 		0x40, 0xf4, 0xc3, 0x37, 0x30, 0x40, 0x49, 0xe8, 0xa9,
+	// 		0x52, 0xfb, 0xcb, 0xf4, 0x5c, 0x6f, 0xa7, 0x7a, 0x41,
+	// 		0xa4,
+	// 	},
+	// 	nil,
+	// },
+}
+
+const halfMax = maxInt / 2
+var bad = []scryptTestVector {
+	{"p", "s", 0,  1,       1,       nil, BadNError},            // N == 0
+	{"p", "s", 1,  1,       1,       nil, BadNError},            // N == 1
+	{"p", "s", 7,  8,       1,       nil, BadNError},            // N is not power of 2
+	{"p", "s", 16, halfMax, halfMax, nil, ParamsTooLargeError},  // p * r too large
+}
+
+func test_validParams() {
+	testStart("validParams()")
+
+	return // FIXME
+	testing("bad hashes", func() {
+		for _, v := range bad {
+			_, err := scrypt(
+				[]byte(v.password),
+				[]byte(v.salt),
+				v.N,
+				v.r,
+				v.p,
+				32,
+			)
+			// fmt.Println("N: %#v\n", v.N)
+			assertEq(err, v.err)
+		}
+	})
+}
+
+func test_scrypt() {
+	testStart("scrypt()")
+
+	testing("good hashes", func() {
+		for _, v := range good {
+			k, err := scrypt(
+				[]byte(v.password),
+				[]byte(v.salt),
+				v.N,
+				v.r,
+				v.p,
+				len(v.output),
+			)
+			assertEq(err, nil)
+			assertEq(k, v.output)
+		}
+	})
+
+	testing("bad hashes", func() {
+		for _, v := range bad {
+			_, err := scrypt(
+				[]byte(v.password),
+				[]byte(v.salt),
+				v.N,
+				v.r,
+				v.p,
+				32,
+			)
+			// fmt.Println("N: %#v\n", v.N)
+			assertEq(err, v.err)
+		}
+	})
+
+	testing("example value", func() {
+		const expected = "lGnMz8io0AUkfzn6Pls1qX20Vs7PGN6sbYQ2TQgY12M="
+		// DO NOT use this salt value; generate your own random salt.
+		// 8 bytes is a good length.
+		salt := []byte{0xc8, 0x28, 0xf2, 0x58, 0xa7, 0x6a, 0xad, 0x7b}
+
+		dk, err := scrypt(
+			[]byte("some password"),
+			salt,
+			1<<15,
+			8,
+			1,
+			32,
+		)
+		assertEq(err, nil)
+
+		given := base64.StdEncoding.EncodeToString(dk)
+		assertEq(given, expected)
+	})
+}
+
+func test_Random() {
+	testStart("Random()")
+
+/*
+FIXME
+	testing("we get the desired output size", func() {
+		for i := 0; i < 100; i++ {
+			buffer := Random(i)
+			assertEq(len(buffer), i)
+		}
+	})
+	*/
+}
+
+func test_Salt() {
+	testStart("Salt()")
+
+	testing("we generate a random salt of a fixed size", func() {
+		salt := Salt()
+		assertEq(len(salt), scryptSaltMinLength)
+
+		var buffer [scryptSaltMinLength * 2]byte
+		hex.Encode(buffer[:], salt)
+		fmt.Fprintf(os.Stderr, "%s ", string(buffer[:]))
+	})
+}
+
+func test_Hash() {
+	testStart("Hash()")
+
+	testing("same input, same output", func() {
+		password := Salt()
+		salt := Salt()
+		hash1 := Hash(password, salt)
+		hash2 := Hash(password, salt)
+		assertEq(hash1, hash2)
+	})
+}
+
+
+func MainTest() {
+	test__PBKDF()
+	test_validParams()
+	test_scrypt()
+	test_Hash()
+	test_Random()
+	test_Salt()
+}