Adopt *-clib crypto packages?

[hsyl20]

Hi! To make the installation of cardano-base simpler (see current build instructions) I've made 3 Cabal clib packages that build C dependencies:

• sodium-clib: https://github.com/hsyl20/libsodium/tree/haskell-bindings
• secp256k1-clib: https://github.com/hsyl20/secp256k1/tree/haskell-bindings
• blst-clib: https://github.com/hsyl20/blst/tree/haskell-bindings

They have been useful already to build cardano-base under a Windows VM where using WSL was difficult/impossible.

These are just forks of upstream repositories with some changes:

• .cabal file added
• only for libsodium: configure.ac file modified, autoreconf rerun, and additional buildinfo.in file added
• basic test added (test script should be replaced by a github action)

Note: we use IOG's custom libsodium fork with VRF support, but this could be made optional in the cabal file (it's just some additional C files to link).

Would you be interested in adopting them? sodium-clib in particular could be used (optionally with a cabal flag) by libsodium-bindings.

I expect maintenance to be lightweight: we only have to reapply our changes in a new branch when an upstream release is made.

⚠ Warning ⚠: These packages have not been audited. We should probably compare/test on CI the libraries built via cabal with the libraries built via the upstream build system to check that they are not meaningfully different before suggesting using them in production.

[Kleidukos]

@hsyl20 Hi! We had tried to make some efforts to bundle libsodium originally but it had proven more complex than expected. I'd welcome a PR to enable source bundling (through sodium-clib) behind a cabal flag.

However considering recent developments in libsodium I'd like to start with (currently unreleased) 1.0.21 if that's ok with you?

[hasufell]

Possibly I misunderstood it, but please don't do source bundling behind a cabal flag.

Always create separate foo-clib packages and then have foo conditionally depend on it.

If that's what you meant, then 👍

[Kleidukos]

@hasufell Thanks, we agree, I was just unclear and I indeed meant source bundling via sodium-clib.

[Kleidukos]

@hsyl20 btw, if you want to share the administrative burden (coordination with HSEC for instance), the Cryptography Group would be happy to host the bundled libs and bindings.

[hsyl20]

However considering recent developments in libsodium I'd like to start with (currently unreleased) 1.0.21 if that's ok with you?

No problem for me, currently my branch is on top of master so we can just rebase [Actually I've just tried and new also need to rebase the IOG VRF fork part first. It shouldn't be to difficult either.]

@hsyl20 btw, if you want to share the administrative burden (coordination with HSEC for instance), the Cryptography Group would be happy to host the bundled libs and bindings.

Yeah that was my question :-)

[Kleidukos]

@hsyl20 haha apologies, I misunderstood "adopting". Then yes, let me send you an invite for the GH org.