Add libsodium dependency installation to readme

[newhoggy]

There are libsodium installation instructions on this page.

Have you looked at those?

[regel]

I've seen the instructions too. The libsodium dependency being used is the fork of a fork of the original, and it's behind in releases. If this crypto lib is truly required to run the cardano nodes, consider sponsoring the author(s) on Github and using the official lib version since it's apparently actively maintained. It leaves me in the dust, and I'm a big fan of ADA. Please clarify how the library is used in cardano and what can be done to switch to the original.

[regel]

Usage in cardano-node:

# strings bin/cardano-node | grep ^sodium_ | sort -u
sodium_compare
sodium_fe25519_frombytes
sodium_fe25519_invert
sodium_fe25519_tobytes
sodium_free
sodium_ge25519_add
sodium_ge25519_double_scalarmult_vartime
sodium_ge25519_from_hash
sodium_ge25519_from_uniform
sodium_ge25519_frombytes
sodium_ge25519_frombytes_negate_vartime
sodium_ge25519_has_small_order
sodium_ge25519_is_canonical
sodium_ge25519_is_on_curve
sodium_ge25519_is_on_main_subgroup
sodium_ge25519_p1p1_to_p2
sodium_ge25519_p1p1_to_p3
sodium_ge25519_p3_to_cached
sodium_ge25519_p3_tobytes
sodium_ge25519_scalarmult
sodium_ge25519_scalarmult_base
sodium_ge25519_sub
sodium_ge25519_tobytes
sodium_init
sodium_is_zero
sodium_malloc
sodium_memzero
sodium_ristretto255_from_hash
sodium_ristretto255_frombytes
sodium_ristretto255_p3_tobytes
sodium_sc25519_invert
sodium_sc25519_is_canonical
sodium_sc25519_mul
sodium_sc25519_muladd
sodium_sc25519_reduce

[regel]

Forum discussions on the same topic: "Why is not the origin libsodium library used when running a cardano-node?"

This algorand's fork of libsodium apparently provides VRF implementation but they are not used anywhere in cardano-node, are they? lddoutput does not find any use of these VRF functions. Finally, the CI workflows use a vanilla libsodium version:

$ grep sodium .github/workflows/haskell.yml 
    - name: Install libsodium (Windows)
          https://download.libsodium.org/libsodium/releases/libsodium-1.0.18-mingw.tar.gz -o libsodium-1.0.18-mingw.tar.gz
        tar zxvf libsodium-1.0.18-mingw.tar.gz
        sed -i "s|/d/a/1/s/|D:/a/cardano-node/cardano-node/|g" libsodium-win64/lib/pkgconfig/libsodium.pc
        export PKG_CONFIG_PATH="$(readlink -f libsodium-win64/lib/pkgconfig)"
        export LIBSODIUM_PATH="$(readlink -f libsodium-win64/bin | sed 's|^/d|D:|g' | tr / '\\')"
    - name: Install libsodium (MacOS)
      run: brew install libsodium
    - name: Configure to use libsodium
          flags: -external-libsodium-vrf
        sudo apt-get -y install libsodium23 libsodium-dev

Can we conclude that users can simply install the original libsodium library and then we can update the documentation to include installation instructions below? If we do, I'm happy to submit a pull-request.

Install libsodium (Windows)

curl -Ls https://download.libsodium.org/libsodium/releases/libsodium-1.0.18-mingw.tar.gz -o libsodium-1.0.18-mingw.tar.gz
tar zxvf libsodium-1.0.18-mingw.tar.gz

Install libsodium (MacOS)

brew install libsodium

Install libsodium (Linux)

sudo apt-get -y install libsodium23 libsodium-dev

[rdlrt]

then we can update the documentation to include installation instructions below

Whether you use the VRF additions or not is your choice (IOG's strict recommendation is to not depend on system library), and controlled via addition of flag you see in CI, i.e. flags: -external-libsodium-vrf

Personally , I'd always trust testing from official Package Manager's libsodium instead of a fork, but the trace from documentation to use system libsodium for advanced users (only for development/testing) was removed. I doubt they'd like to put it back in 🙂

Can we conclude that users can simply install the original libsodium library

No , you cant use ldd / strings / grep for library name and conclude a submodule will not be used , but in this case, adding the above mentioned flag will cause node to not depend on fork

[Jimbo4350]

Closing this. If this is still relevant please reopen.