optional libsodium

CHANGELOG.md

@@ -6,6 +6,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Make `libsodium` dependency optional for consumers who want to verify signatures _only_
+
 ## [0.2.1] - 2024-02-19
 
 ### Added

README.md

@@ -19,6 +19,9 @@ A ruby implemenation of [Minisign](http://jedisct1.github.io/minisign/).
 gem install minisign
 ```
 
+**Note**: This gem has a conditional dependency on [`libsodium`](https://doc.libsodium.org/) for the functionality related to key derivation and signature creation.
+Signature verification _does not_ need `libsodium`.
+
 ### Read a public key
 
 ```rb

bin/minisign

@@ -31,6 +31,11 @@ rescue OptionParser::InvalidOption
   exit 1
 end
 
+if (options[:G] || options[:R] || options[:C] || options[:S]) && !RbNaCl.const_defined?(:PasswordHash)
+  warn 'Error: libsodium is not installed!'
+  exit 1
+end
+
 Minisign::CLI.generate(options) if options[:G]
 Minisign::CLI.recreate(options) if options[:R]
 Minisign::CLI.change_password(options) if options[:C]

lib/minisign.rb

@@ -2,12 +2,18 @@
 
 require 'ed25519'
 require 'base64'
-require 'rbnacl'
+require 'openssl'
+begin
+  require 'rbnacl'
+rescue LoadError
+  # errors handled when invoked (see Minisign::NaCl)
+end
 
 require 'minisign/cli'
 require 'minisign/utils'
 require 'minisign/public_key'
 require 'minisign/signature'
 require 'minisign/private_key'
 require 'minisign/key_pair'
+require 'minisign/nacl'
 require 'minisign/error'

lib/minisign/error.rb

@@ -9,4 +9,7 @@ class PasswordMissingError < StandardError
 
   class PasswordIncorrectError < StandardError
   end
+
+  class LibSodiumDependencyError < StandardError
+  end
 end

lib/minisign/nacl.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Minisign
+  # A module that invokes RbNaCl with user-focused actionable error messages.
+  module NaCl
+    def self.assert_libsodium_dependency_met!
+      return if RbNaCl.const_defined?(:PasswordHash)
+
+      raise Minisign::LibSodiumDependencyError, 'libsodium is not installed!'
+    end
+
+    module Hash
+      # see RbNaCl::Hash::Blake2b
+      module Blake2b
+        def self.digest(*args)
+          NaCl.assert_libsodium_dependency_met!
+          RbNaCl::Hash::Blake2b.digest(*args)
+        end
+      end
+    end
+
+    # see RbNaCl::PasswordHash
+    module PasswordHash
+      def self.scrypt(*args)
+        NaCl.assert_libsodium_dependency_met!
+        RbNaCl::PasswordHash.scrypt(*args)
+      end
+    end
+  end
+end

lib/minisign/utils.rb

@@ -4,11 +4,11 @@ module Minisign
   # Helpers used in multiple classes
   module Utils
     def blake2b256(message)
-      RbNaCl::Hash::Blake2b.digest(message, { digest_size: 32 })
+      Minisign::NaCl::Hash::Blake2b.digest(message, { digest_size: 32 })
     end
 
     def blake2b512(message)
-      RbNaCl::Hash::Blake2b.digest(message, { digest_size: 64 })
+      OpenSSL::Digest.new('blake2b512').digest(message)
     end
 
     # @return [Array<32 bit unsigned ints>]
@@ -25,7 +25,7 @@ def hex(bytes)
 
     # @return [String] the <kdf_output> used to xor the ed25519 keys
     def derive_key(password, kdf_salt, kdf_opslimit, kdf_memlimit)
-      RbNaCl::PasswordHash.scrypt(
+      Minisign::NaCl::PasswordHash.scrypt(
         password,
         kdf_salt,
         kdf_opslimit,

spec/minisign/nacl_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+describe Minisign::NaCl do
+  it 'raises LibSodiumDependencyError if libsodium not installed' do
+    hash = RbNaCl.send(:remove_const, :Hash)
+    password_hash = RbNaCl.send(:remove_const, :PasswordHash)
+    expect do
+      Minisign::NaCl::Hash::Blake2b.digest('message', { digest_size: 32 })
+    end.to raise_error(Minisign::LibSodiumDependencyError)
+    RbNaCl.const_set(:Hash, hash)
+    RbNaCl.const_set(:PasswordHash, password_hash)
+  end
+end