jruby extension

[kares]

adds a Java implementation (LLM generated based on current C sources)

the rest is plumbing for the JRuby extension -> -java variant of the gem

[headius]

Looks good to me overall. Will be worth running some benchmarks to clean up excess allocation. A few minor review comments should be addressed.

[headius]

Fix indentation to match Java standard, otherwise this will be a constant maintenance headache.

[headius]

These don't appear to be rest-arg methods so remove rest = true.

[kares]

unfortunately, failing when rest = true is removed

[kares]

10.0.5.0 (fails the same on 9.4 as well):

java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
	at org.jruby.dist/org.jruby.internal.runtime.methods.InvocationMethodFactory.loadArguments(InvocationMethodFactory.java:559)
	at org.jruby.dist/org.jruby.internal.runtime.methods.InvocationMethodFactory.createAnnotatedMethodInvocation(InvocationMethodFactory.java:782)
	at org.jruby.dist/org.jruby.internal.runtime.methods.InvocationMethodFactory.addAnnotatedMethodInvoker(InvocationMethodFactory.java:719)
	at org.jruby.dist/org.jruby.internal.runtime.methods.InvocationMethodFactory.getAnnotatedMethodClass(InvocationMethodFactory.java:279)
	at org.jruby.dist/org.jruby.internal.runtime.methods.InvocationMethodFactory.getAnnotatedMethod(InvocationMethodFactory.java:328)
	at org.jruby.dist/org.jruby.RubyModule.defineAnnotatedMethod(RubyModule.java:1400)
	at org.jruby.dist/org.jruby.RubyModule.defineAnnotatedMethod(RubyModule.java:1374)
	at org.jruby.dist/org.jruby.anno.TypePopulator$ReflectiveTypePopulator.populate(TypePopulator.java:119)
	at org.jruby.dist/org.jruby.RubyModule.defineAnnotatedMethodsIndividually(RubyModule.java:1368)
	at org.jruby.dist/org.jruby.RubyModule.defineAnnotatedMethods(RubyModule.java:1272)
	at org.netssh.bcrypt_pbkdf.BCryptPbkdfExt.load(BCryptPbkdfExt.java:18)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
	at org.jruby.dist/org.jruby.ext.jruby.JRubyUtilLibrary.loadExtension(JRubyUtilLibrary.java:258)
	at org.jruby.dist/org.jruby.ext.jruby.JRubyUtilLibrary.load_ext(JRubyUtilLibrary.java:219)

[headius]

Remove rest = true and use two explicit arguments.

[mfazekas]

Explored a pure Ruby fallback as an alternative to this Java extension. Benchmarks show it's ~30x slower than the Java extension on JRuby — about 2.4 seconds per key load at rounds=16 (the openssh default). That's too slow to be acceptable for something that blocks every SSH connection open.

So this Java extension is the right path. One thing worth considering: instead of maintaining our own Java port of the Blowfish/bcrypt_pbkdf logic, we could pull in jBCrypt (Kenny Root's fork, org.connectbot:jbcrypt:1.0.2 on Maven Central, ~17KB) as a Maven dependency via jar-dependencies. It already has a pbkdf method and is the source of the test vectors we added in #32. That would reduce the amount of crypto code we own and maintain.

[kares]

Explored a pure Ruby fallback as an alternative to this Java extension. Benchmarks show it's ~30x slower than the Java extension on JRuby — about 2.4 seconds per key load at rounds=16 (the openssh default). That's too slow to be acceptable for something that blocks every SSH connection open.

That is surprising, even after some decent warmup?
Anyway I think having a pure Ruby version would be acceptable for JRuby as well, given the use-case AFAIU is deployment and it's really just a transitive dependency at this point...

[kares]

we could pull in jBCrypt (Kenny Root's fork, org.connectbot:jbcrypt:1.0.2 on Maven Central, ~17KB) as a Maven dependency via jar-dependencies

the fork itself seem abandoned (just like the parent) for 5 years, not much going on the repo, see: kruton/jbcrypt#1

it's probably easier/safer to maintain parity C-Java sources (esp. with LLM), the jar-dependencies story is not a headache free path and gets a bit invasive since the preferred path is to vendor the .jar.