Bouncy Castle dependency - replaceable with in-box cryptography?

[christophwille]

The four assemblies for netsparkle come in at 3.46MB, with Bouncy Castle accounting for 3.16 (2.2.2 WPF .Core distribution). That is quite a hefty "penalty" - what is Bouncy Castle used for (ie would it be possible to at least replace it on .NET (Core) with in-box cryptography?)

[christophwille]

Unless I am mistaken, there is only one place in the main package, namely https://github.com/NetSparkleUpdater/NetSparkle/blob/develop/src/NetSparkle/SignatureVerifiers/Ed25519Checker.cs (AppCast generation isn't something I am concerned about as this is a dev dependency).

[Deadpikle]

You're not mistaken. That's the one place where it is used.

If you can point me to a library that is similarly trustworthy and unit tested, or a built-in way to do this in .NET that works from 4.5.2 (or 4.6.2) all the way through .NET 7+, I'd be interested in taking a look.

Alternatively, would trimming the DLL in your own application (and making sure NetSparkle was trimmable) be the solution, here? It seems as though that would allow us to continue to use BouncyCastle (with its benefits and google-ability) while not bogging down published apps.

Edit: Links for future ref: https://github.com/bcgit/bc-csharp/issues/451, https://github.com/bcgit/bc-csharp/issues/422, https://github.com/bcgit/bc-csharp/issues/504

[Deadpikle]

Some additional applicable old discussion here: https://github.com/NetSparkleUpdater/NetSparkle/pull/98

[christophwille]

Isn't NSec doing just that?

[Deadpikle]

BouncyCastle now supports trimming, and when your application is trimmed, the file size of BouncyCastle is reduced quite a bit (in my tests, to less than 50 KB). So, if your application supports trimming, this shouldn't be a problem.

If your application does not support trimming out of the box:

• Try https://github.com/yangzhongke/Zack.DotNetTrimmer if that is reasonable for your app
• Use the NetSparkle.Tests.Trimming app to pop open a CLI in that folder, run dotnet publish, and then use the trimmed DLL in your app. Make sure to test, first, but since DLLs can be replaced, this shouldn't pose an issue, I would imagine, and I was able to do this successfully using one of the NetSparkle test applications. Very much willing to be corrected if I'm wrong, here.

The other option I'd be willing to consider is using Chaos.NaCl (my fork here with .NET Standard compat), but that'd take some work to move in since we'd need to add in file streaming compatibility at the very least.

In any case, with the changes on BouncyCastle's side and trimming available on the NetSparkle side along with the option of just shipping a self-trimmed DLL to your users, I think this can be resolved for end users.

[Deadpikle]

I have again made an adjustment after seeing that the above wasn't going to result in the best experience for end users by switching fully to Chaos.NaCl, of which we have a fork here. This should fully alleviate the concerns that you shared as it is a small DLL, even without trimming, at less than 250 KB. BouncyCastle is no longer used. As a bonus, the core lib is now trimmable and AoT-compatible, so some good things came out of it.

Thanks!