refactor(crypto): implement argon2id in-tree, drop conan-odr-index

.github/workflows/android.yml

@@ -41,8 +41,6 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: checkout conan-odr-index
-        run: git submodule update --init --depth 1 conan-odr-index
 
       - name: install ccache
         run: |
@@ -61,7 +59,7 @@ jobs:
 
       - name: conan cache key
         shell: bash
-        run: echo "CONAN_CACHE_KEY=$(git rev-parse HEAD:conan-odr-index)-${{ hashFiles('conanfile.py', '.github/config/conan/**') }}" >> "$GITHUB_ENV"
+        run: echo "CONAN_CACHE_KEY=${{ hashFiles('conanfile.py', '.github/config/conan/**') }}" >> "$GITHUB_ENV"
 
       - name: cache conan
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -71,8 +69,6 @@ jobs:
           restore-keys: |
             conan-${{ env.CACHE_FLAVOR }}-android-${{ matrix.architecture }}-${{ env.CONAN_KEY_SUFFIX }}-
 
-      - name: export conan-odr-index
-        run: python conan-odr-index/scripts/conan_export_all_packages.py --selection-config conan-odr-index/defaults.yaml
       - name: conan config
         run: conan config install .github/config/conan
 

.github/workflows/apple.yml

@@ -74,8 +74,6 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: checkout conan-odr-index
-        run: git submodule update --init --depth 1 conan-odr-index
 
       # `create-xcframework` behaviour and the default deployment targets move
       # between Xcode versions, so the runner default is not good enough.
@@ -98,7 +96,7 @@ jobs:
 
       - name: conan cache key
         shell: bash
-        run: echo "CONAN_CACHE_KEY=$(git rev-parse HEAD:conan-odr-index)-${{ hashFiles('conanfile.py', '.github/config/conan/**') }}" >> "$GITHUB_ENV"
+        run: echo "CONAN_CACHE_KEY=${{ hashFiles('conanfile.py', '.github/config/conan/**') }}" >> "$GITHUB_ENV"
 
       - name: cache conan
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -108,8 +106,6 @@ jobs:
           restore-keys: |
             conan-${{ env.CACHE_FLAVOR }}-${{ matrix.profile }}-${{ env.CONAN_KEY_SUFFIX }}-
 
-      - name: export conan-odr-index
-        run: python conan-odr-index/scripts/conan_export_all_packages.py --selection-config conan-odr-index/defaults.yaml
       - name: conan config
         run: conan config install .github/config/conan
 

.github/workflows/build_test.yml

@@ -54,8 +54,6 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: checkout conan-odr-index
-        run: git submodule update --init --depth 1 conan-odr-index
 
       - name: ubuntu install ccache
         if: runner.os == 'Linux'
@@ -84,7 +82,7 @@ jobs:
 
       - name: conan cache key
         shell: bash
-        run: echo "CONAN_CACHE_KEY=$(git rev-parse HEAD:conan-odr-index)-${{ hashFiles('conanfile.py', '.github/config/conan/**') }}" >> "$GITHUB_ENV"
+        run: echo "CONAN_CACHE_KEY=${{ hashFiles('conanfile.py', '.github/config/conan/**') }}" >> "$GITHUB_ENV"
 
       - name: cache conan
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -94,8 +92,6 @@ jobs:
           restore-keys: |
             conan-${{ env.CACHE_FLAVOR }}-${{ matrix.host_profile }}-${{ env.CONAN_KEY_SUFFIX }}-
 
-      - name: export conan-odr-index
-        run: python conan-odr-index/scripts/conan_export_all_packages.py --selection-config conan-odr-index/defaults.yaml
       - name: conan config
         run: conan config install .github/config/conan
 
@@ -328,7 +324,7 @@ jobs:
 
   build-test-downstream:
     runs-on: ${{ matrix.os }}
-    # Exports the full odr-index (no `--selection-config`) and resolves through
+    # Exports odrcore and builds a consumer against it, resolving through
     # `conan.lock`, so its dependency set differs from the `build` job's.
     env:
       CACHE_FLAVOR: downstream
@@ -340,8 +336,6 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: checkout conan-odr-index
-        run: git submodule update --init --depth 1 conan-odr-index
 
       - name: ubuntu install ccache
         if: runner.os == 'Linux'
@@ -363,7 +357,7 @@ jobs:
 
       - name: conan cache key
         shell: bash
-        run: echo "CONAN_CACHE_KEY=$(git rev-parse HEAD:conan-odr-index)-${{ hashFiles('conanfile.py', 'conan.lock', '.github/config/conan/**') }}" >> "$GITHUB_ENV"
+        run: echo "CONAN_CACHE_KEY=${{ hashFiles('conanfile.py', 'conan.lock', '.github/config/conan/**') }}" >> "$GITHUB_ENV"
 
       - name: cache conan
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -373,8 +367,6 @@ jobs:
           restore-keys: |
             conan-${{ env.CACHE_FLAVOR }}-${{ matrix.host_profile }}-${{ env.CONAN_KEY_SUFFIX }}-
 
-      - name: export conan-odr-index
-        run: python conan-odr-index/scripts/conan_export_all_packages.py
       - name: conan config
         run: conan config install .github/config/conan
 

.github/workflows/conan.yml

@@ -22,8 +22,6 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: checkout conan-odr-index
-        run: git submodule update --init --depth 1 conan-odr-index
 
       - name: ubuntu install ccache
         if: runner.os == 'Linux'
@@ -54,8 +52,6 @@ jobs:
           restore-keys: |
             conan-${{ matrix.host_profile }}-
 
-      - name: export conan-odr-index
-        run: python conan-odr-index/scripts/conan_export_all_packages.py --selection-config conan-odr-index/defaults.yaml
       - name: conan config
         run: conan config install .github/config/conan
 

.github/workflows/python.yml

@@ -61,8 +61,6 @@ jobs:
         with:
           # setuptools-scm derives the package version from git tags.
           fetch-depth: 0
-      - name: checkout conan-odr-index
-        run: git submodule update --init --depth 1 conan-odr-index
 
       # The conan profiles use ccache as compiler launcher, so it must exist
       # even for `--build missing` source builds.
@@ -86,7 +84,7 @@ jobs:
 
       - name: conan cache key
         shell: bash
-        run: echo "CONAN_CACHE_KEY=$(git rev-parse HEAD:conan-odr-index)-${{ hashFiles('conanfile.py', 'pyproject.toml', '.github/config/conan/**') }}" >> "$GITHUB_ENV"
+        run: echo "CONAN_CACHE_KEY=${{ hashFiles('conanfile.py', 'pyproject.toml', '.github/config/conan/**') }}" >> "$GITHUB_ENV"
 
       - name: cache conan
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -96,8 +94,6 @@ jobs:
           restore-keys: |
             conan-${{ env.CACHE_FLAVOR }}-${{ matrix.host_profile }}-${{ env.CONAN_KEY_SUFFIX }}-
 
-      - name: export conan-odr-index
-        run: python conan-odr-index/scripts/conan_export_all_packages.py --selection-config conan-odr-index/defaults.yaml
       - name: conan config
         run: conan config install .github/config/conan
 
@@ -195,8 +191,8 @@ jobs:
   # Uses PyPI trusted publishing (OIDC, no token): the `pyodr` project on PyPI
   # must list this repo + workflow + the `pypi` environment as a publisher.
   # Note pip cannot build the published sdist on its own (the build needs a
-  # conan-generated toolchain plus the conan-odr-index recipes, see
-  # python/README.md); it is published for completeness.
+  # conan-generated toolchain, see python/README.md); it is published for
+  # completeness.
   pypi:
     needs: [wheels, sdist]
     runs-on: ubuntu-24.04

.github/workflows/tidy.yml

@@ -29,8 +29,6 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: checkout conan-odr-index
-        run: git submodule update --init --depth 1 conan-odr-index
 
       - name: ubuntu install ccache
         if: runner.os == 'Linux'
@@ -60,8 +58,6 @@ jobs:
           restore-keys: |
             conan-${{ matrix.host_profile }}-
 
-      - name: export conan-odr-index
-        run: python conan-odr-index/scripts/conan_export_all_packages.py --selection-config conan-odr-index/defaults.yaml
       - name: conan config
         run: conan config install .github/config/conan
 

CMakeLists.txt

@@ -59,7 +59,6 @@ find_package(nlohmann_json REQUIRED)
 find_package(vincentlaucsb-csv-parser REQUIRED)
 find_package(uchardet REQUIRED)
 find_package(utf8cpp REQUIRED)
-find_package(argon2 REQUIRED)
 
 set(PRE_CONFIGURE_FILE "src/odr/internal/git_info.cpp.in")
 set(POST_CONFIGURE_FILE "${CMAKE_CURRENT_BINARY_DIR}/src/odr/internal/git_info.cpp")
@@ -124,6 +123,7 @@ set(ODR_SOURCE_FILES
         "src/odr/internal/common/table_range.cpp"
         "src/odr/internal/common/temporary_file.cpp"
 
+        "src/odr/internal/crypto/crypto_argon2.cpp"
         "src/odr/internal/crypto/crypto_util.cpp"
 
         "src/odr/internal/csv/csv_file.cpp"
@@ -267,7 +267,6 @@ target_link_libraries(odr
         vincentlaucsb-csv-parser::vincentlaucsb-csv-parser
         uchardet::uchardet
         utf8::cpp
-        argon2::argon2
 )
 
 if (ODR_WITH_HTTP_SERVER)

conan.lock

@@ -14,8 +14,7 @@
         "gtest/1.14.0#f8f0757a574a8dd747d16af62d6eb1b7%1743410807.169",
         "cryptopp/8.9.0#7a51e0038756b21bc3a6b82d681d5906%1758206597.119",
         "cpp-httplib/0.47.0#add6673ff352c26898ed2650453e706e%1784539639.401",
-        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1762886692.465",
-        "argon2/20190702-odr#965901884bc82ec8a7c0a1305d42c127%1784987057.981858"
+        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1762886692.465"
     ],
     "build_requires": [
         "zstd/1.5.7#b68ca8e3de04ba5957761751d1d661f4%1760955092.069",

conanfile.py

@@ -55,7 +55,6 @@ def requirements(self):
         self.requires("utfcpp/4.0.9")
         if self.options.get_safe("with_http_server", False):
             self.requires("cpp-httplib/0.47.0")
-        self.requires("argon2/20190702-odr")
         if self.options.get_safe("with_python", False):
             self.requires("pybind11/2.13.6")
 

src/odr/internal/crypto/README.md

@@ -0,0 +1,32 @@
+# Crypto implementation
+
+Thin wrappers over [Crypto++](https://www.cryptopp.com/) in `crypto_util.*`,
+plus one algorithm Crypto++ does not ship: Argon2id.
+
+## Argon2id
+
+`crypto_argon2.*` implements Argon2id per [RFC 9106], version `0x13`, without
+secret or associated data, using Crypto++ for BLAKE2b. Lanes are computed
+sequentially — correct for any `p`, just not in parallel.
+
+It is used by [ODF](../odf/README.md) for LibreOffice's "wholesome" package
+encryption (LibreOffice 24.8+, ODF 1.5), which writes `t=3`, `m=65536` KiB,
+`p=4` lanes.
+
+### Why hand-rolled
+
+- Crypto++ has no Argon2, and has had no release since 8.9.0 (2023).
+- The reference implementation, [P-H-C/phc-winner-argon2], is unmaintained
+  since 2021 and its Makefile cannot cross-compile for Android. ConanCenter
+  [declined to carry the fix][cci-pr] because upstream would never merge it, so
+  depending on it meant maintaining our own Conan recipe for one function.
+  Upstream PR: [#392].
+- libsodium hardcodes `p=1`, so it cannot read the files above.
+- Botan and OpenSSL both work, but mean a second full crypto library.
+
+Tests cross-check against the reference implementation's published vectors.
+
+[RFC 9106]: https://www.rfc-editor.org/rfc/rfc9106
+[P-H-C/phc-winner-argon2]: https://github.com/P-H-C/phc-winner-argon2
+[cci-pr]: https://github.com/conan-io/conan-center-index/pull/27800
+[#392]: https://github.com/P-H-C/phc-winner-argon2/pull/392