Latest libsodium-1.0.18-stable.tar.gz.

git-svn-id: https://www.unprompted.com/svn/projects/tildefriends/trunk@4193 ed5197a5-7fde-0310-b194-c3ffbd925b24

deps/libsodium/.github/workflows/ci.yml

@@ -12,13 +12,14 @@ jobs:
   tcc:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Update packages list
         run: sudo apt-get update
 
       - name: Install dependencies
-        run: sudo apt-get install -y build-essential libtool autoconf automake tcc
+        run: |
+          sudo apt-get install -y build-essential libtool autoconf automake tcc
 
       - name: Autogen
         run: ./autogen.sh -s
@@ -31,10 +32,40 @@ jobs:
           make uninstall
           make distclean
 
+  zig:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Update packages list
+        run: sudo apt-get update
+
+      - name: Install dependencies
+        run: |
+          curl -sL -o - https://ziglang.org/download/0.10.1/zig-linux-x86_64-0.10.1.tar.xz | tar xJ -f - -C /opt/
+          sudo mv /opt/zig-* /opt/zig
+
+      - name: Autogen
+        run: ./autogen.sh -s
+
+      - name: Compilation with zig
+        run: |
+          export PATH=/opt/zig:$PATH
+          zig build
+          zig build -Dtarget=x86_64-linux
+          zig build -Dtarget=aarch64-linux
+          zig build -Dtarget=x86_64-windows
+          zig build -Dtarget=aarch64-windows
+          zig build -Dtarget=x86_64-macos
+          zig build -Dtarget=aarch64-macos
+          zig build -Dtarget=wasm32-wasi
+          zig build -Drelease-fast
+          rm -fr zig-cache zig-out
+
   regular:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Update packages list
         run: sudo apt-get update
@@ -63,7 +94,7 @@ jobs:
   check-globals:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Update packages list
         run: sudo apt-get update
@@ -81,7 +112,7 @@ jobs:
   other-comp:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Update packages list
         run: sudo apt-get update
@@ -107,7 +138,7 @@ jobs:
   other-arch:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Update packages list
         run: sudo apt-get update
@@ -123,3 +154,28 @@ jobs:
           env CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking --host=powerpc-linux-gnu
           make -j $(nproc)
           make clean > /dev/null
+
+  android:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Update packages list
+        run: sudo apt-get update
+
+      - name: Install base dependencies
+        run: sudo apt-get install -y libtool autoconf automake unzip
+
+      - name: Autogen
+        run: ./autogen.sh -s
+
+      - name: Install Android NDK
+        run: |
+          mkdir /tmp/android && cd /tmp/android
+          curl -o ndk.zip -L https://dl.google.com/android/repository/android-ndk-r25b-linux.zip
+          unzip ndk.zip && rm -f *.zip && mv android-ndk* ndk
+
+      - name: Android compilation
+        run: |
+          env ANDROID_NDK_HOME=/tmp/android/ndk ./dist-build/android-x86.sh
+          env ANDROID_NDK_HOME=/tmp/android/ndk ./dist-build/android-armv8-a.sh

deps/libsodium/.github/workflows/codeql-analysis.yml

@@ -12,12 +12,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v2
         with:
           languages: cpp
 
@@ -27,4 +27,4 @@ jobs:
           make -j $(nproc) check
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v2

deps/libsodium/.github/workflows/dotnet-core.yml

@@ -10,187 +10,182 @@ jobs:
   build-windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v3
       - name: buildbase.bat
         run: buildbase.bat ..\vs2022\libsodium.sln 17
         working-directory: builds/msvc/build/
         shell: cmd
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
           name: build-win-x64
           path: bin/x64/Release/v143/dynamic/libsodium.dll
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
           name: build-win-x86
           path: bin/Win32/Release/v143/dynamic/libsodium.dll
 
   build-linux-glibc:
     runs-on: ubuntu-latest
-    container:
-      image: ubuntu:16.04
     steps:
-      - name: Set up build environment
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
+        with:
+          version: 0.10.1
+      - uses: actions/checkout@v3
+      - name: build
         run: |
-          apt-get update && apt-get install -y build-essential
+          zig build -Drelease-fast -Dtarget=x86_64-linux-gnu.2.17
-      - uses: actions/checkout@v1
+      - name: tests
-      - name: configure
+        run: cd zig-out/bin && ./run.sh
-        run: ./configure --disable-dependency-tracking --prefix=$PWD/.libsodium-build
+      - uses: actions/upload-artifact@v3
-      - name: make
-        run: make
-      - name: make check
-        run: make check
-      - name: make install
-        run: make install
-      - name: strip
-        run: strip --strip-all .libsodium-build/lib/libsodium.so
-      - uses: actions/upload-artifact@v2
         with:
           name: build-linux-x64
-          path: .libsodium-build/lib/libsodium.so
+          path: zig-out/lib/libsodium.so
+
+  build-linux-glibc-arm:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
+        with:
+          version: 0.10.1
+      - name: Fix ARM support
+        run: |
+          curl -L https://raw.githubusercontent.com/ziglang/zig/master/lib/libc/glibc/sysdeps/arm/arm-features.h | sudo tee /opt/hostedtoolcache/zig/zig-linux-x86_64-*/x64/lib/libc/glibc/sysdeps/arm/sysdep.h >/dev/null
+      - name: Set up emulation environment
+        run: |
+          export DEBIAN_FRONTEND=noninteractive
+          sudo apt-get update
+          sudo apt-get install -y build-essential qemu binfmt-support qemu-user-static qemu-system-arm gcc-arm-linux-gnueabihf libc6-armhf-cross
+          sudo dpkg --add-architecture armhf
+          sudo update-binfmts --enable qemu-arm
+          sudo update-binfmts --display
+          sudo ln -s /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.* /lib
+      - uses: actions/checkout@v3
+      - name: build
+        run: |
+          zig build -Drelease-fast -Dtarget=arm-linux-gnueabihf.2.23
+      - name: tests
+        run: |
+          cd zig-out/bin && env LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib ./run.sh
+      - uses: actions/upload-artifact@v3
+        with:
+          name: build-linux-arm
+          path: zig-out/lib/libsodium.so
 
   build-linux-glibc-arm64:
     runs-on: ubuntu-latest
-    container:
-      image: ubuntu:16.04
     steps:
-      - name: Set up build environment
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
+        with:
+          version: 0.10.1
+      - name: Set up emulation environment
         run: |
           export DEBIAN_FRONTEND=noninteractive
-
+          sudo apt-get update
-          cat <<-EOF | tee /etc/apt/sources.list.d/arm64.list >/dev/null
+          sudo apt-get install -y qemu binfmt-support qemu-user-static qemu-system-arm gcc-aarch64-linux-gnu libc6-arm64-cross
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial main restricted
+          sudo dpkg --add-architecture arm64
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial-updates main restricted
+          sudo update-binfmts --enable qemu-aarch64
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial universe
+          sudo update-binfmts --display
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial-updates universe
+          sudo ln -s /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.* /lib
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial multiverse
+      - uses: actions/checkout@v3
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial-updates multiverse
+      - name: build
-          deb [arch=arm64] http://ports.ubuntu.com/ xenial-backports main restricted universe multiverse
-          EOF
-
-          sed -i 's/deb h/deb [arch=amd64] h/g' /etc/apt/sources.list
-
-          dpkg --add-architecture arm64
-
-          apt-get update && apt-get install -y build-essential qemu-user qemu-user-static gcc-aarch64-linux-gnu g++-aarch64-linux-gnu libstdc++6:arm64
-
-      - uses: actions/checkout@v1
-      - name: configure
-        run: ./configure --disable-dependency-tracking --prefix=$PWD/.libsodium-build --host=aarch64-linux-gnu
-      - name: make
-        run: make -j $(nproc)
-
-      - name: make check
-        # Disable make check on this platform
-        if: ${{ false }}
         run: |
-          make check
+          zig build -Drelease-fast -Dtarget=aarch64-linux-gnu.2.23
-
+      - name: tests
-      - name: make install
+        run: |
-        run: make install
+          cd zig-out/bin && env LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib ./run.sh
-
+      - uses: actions/upload-artifact@v3
-      - name: strip
-        run: aarch64-linux-gnu-strip --strip-all .libsodium-build/lib/libsodium.so
-      - uses: actions/upload-artifact@v2
         with:
           name: build-linux-arm64
-          path: .libsodium-build/lib/libsodium.so
+          path: zig-out/lib/libsodium.so
-
-  build-linux-glibc-arm:
-    runs-on: ubuntu-20.04
-    steps:
-      - name: Set up build environment
-        run: |
-          export DEBIAN_FRONTEND=noninteractive
-
-          cat <<-EOF | sudo tee /etc/apt/sources.list.d/armhf.list >/dev/null
-          deb [arch=armhf] http://ports.ubuntu.com/ focal main restricted
-          deb [arch=armhf] http://ports.ubuntu.com/ focal-updates main restricted
-          deb [arch=armhf] http://ports.ubuntu.com/ focal universe
-          deb [arch=armhf] http://ports.ubuntu.com/ focal-updates universe
-          deb [arch=armhf] http://ports.ubuntu.com/ focal multiverse
-          deb [arch=armhf] http://ports.ubuntu.com/ focal-updates multiverse
-          deb [arch=armhf] http://ports.ubuntu.com/ focal-backports main restricted universe multiverse
-          EOF
-
-          sudo sed -i 's/deb h/deb [arch=amd64] h/g' /etc/apt/sources.list
-
-          sudo dpkg --add-architecture armhf
-
-          sudo apt-get update && sudo apt-get install -y build-essential qemu-user qemu-user-static gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf libstdc++6:armhf
-
-      - uses: actions/checkout@v1
-      - name: configure
-        run: ./configure --disable-dependency-tracking --prefix=$PWD/.libsodium-build --host=arm-linux-gnueabihf
-      - name: make
-        run: make -j $(nproc)
-
-      - name: make check
-        run: |
-          make check
-
-      - name: make install
-        run: make install
-
-      - name: strip
-        run: arm-linux-gnueabihf-strip --strip-all .libsodium-build/lib/libsodium.so
-      - uses: actions/upload-artifact@v2
-        with:
-          name: build-linux-arm
-          path: .libsodium-build/lib/libsodium.so
 
   build-linux-musl:
     runs-on: ubuntu-latest
     container:
-      image: alpine:3.15
+      image: alpine:3.13
     steps:
       - name: Set up build environment
         run: |
           apk update
-          apk add alpine-sdk ca-certificates
+          apk add alpine-sdk ca-certificates xz
-      - uses: actions/checkout@v1
+      - name: Install Zig
-      - name: configure
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
-        run: ./configure --disable-dependency-tracking --prefix=$PWD/.libsodium-build
+        with:
-      - name: make
+          version: 0.10.1
-        run: make
+      - uses: actions/checkout@v3
-      - name: make check
+      - name: build
-        run: make check
+        run: |
-      - name: make install
+          zig build -Drelease-fast -Dtarget=x86_64-linux-musl
-        run: make install
+      - name: tests
-      - name: strip
+        run: |
-        run: strip --strip-all .libsodium-build/lib/libsodium.so
+          cd zig-out/bin && ./run.sh
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
           name: build-linux-musl-x64
-          path: .libsodium-build/lib/libsodium.so
+          path: zig-out/lib/libsodium.so
+
+  build-linux-musl-arm:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
+        with:
+          version: 0.10.1
+      - uses: actions/checkout@v3
+      - name: build
+        run: |
+          zig build -Drelease-fast -Dtarget=arm-linux-musleabihf
+      - uses: actions/upload-artifact@v3
+        with:
+          name: build-linux-musl-arm
+          path: zig-out/lib/libsodium.so
+
+  build-linux-musl-arm64:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Zig
+        uses: goto-bus-stop/setup-zig@869a4299cf8ac7db4ebffaec36ad82a682f88acb
+        with:
+          version: 0.10.1
+      - uses: actions/checkout@v3
+      - name: build
+        run: |
+          zig build -Drelease-fast -Dtarget=aarch64-linux-musl
+      - uses: actions/upload-artifact@v3
+        with:
+          name: build-linux-musl-arm64
+          path: zig-out/lib/libsodium.so
 
   build-macos-x64:
-    runs-on: macos-11
+    runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v3
       - name: configure
-        run: env CFLAGS="-O2 -arch x86_64 -mmacosx-version-min=10.10" LDFLAGS="-arch x86_64 -mmacosx-version-min=10.10" ./configure --host=arm-apple-darwin20 --prefix=$PWD/.libsodium-build
+        run: env CFLAGS="-Ofast -arch x86_64 -mmacosx-version-min=10.15" LDFLAGS="-arch x86_64 -mmacosx-version-min=10.15" ./configure --host=arm-apple-darwin20 --prefix=$PWD/.libsodium-build
       - name: make
         run: make
       - name: make check
         run: make check
       - name: make install
         run: make install
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
           name: build-osx-x64
           path: .libsodium-build/lib/libsodium.dylib
 
   build-macos-arm64:
-    runs-on: macos-11
+    runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v3
       - name: configure
-        run: env CFLAGS="-O2 -arch arm64 -mmacosx-version-min=10.10" LDFLAGS="-arch arm64 -mmacosx-version-min=10.10" ./configure --host=arm-apple-darwin20 --prefix=$PWD/.libsodium-build
+        run: env CFLAGS="-Ofast -arch arm64 -mmacosx-version-min=10.15" LDFLAGS="-arch arm64 -mmacosx-version-min=10.15" ./configure --host=arm-apple-darwin20 --prefix=$PWD/.libsodium-build
       - name: make
         run: make
       - name: make install
         run: make install
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
           name: build-osx-arm64
           path: .libsodium-build/lib/libsodium.dylib
@@ -203,6 +198,8 @@ jobs:
       - build-linux-glibc-arm
       - build-linux-glibc-arm64
       - build-linux-musl
+      - build-linux-musl-arm
+      - build-linux-musl-arm64
       - build-macos-x64
       - build-macos-arm64
     container:
@@ -212,36 +209,44 @@ jobs:
       DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
       DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v3
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
         with:
           name: build-win-x64
           path: .libsodium-pack/runtimes/win-x64/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
         with:
           name: build-win-x86
           path: .libsodium-pack/runtimes/win-x86/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
         with:
           name: build-linux-x64
           path: .libsodium-pack/runtimes/linux-x64/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
         with:
           name: build-linux-arm64
           path: .libsodium-pack/runtimes/linux-arm64/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
         with:
           name: build-linux-arm
           path: .libsodium-pack/runtimes/linux-arm/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
         with:
           name: build-linux-musl-x64
           path: .libsodium-pack/runtimes/linux-musl-x64/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
+        with:
+          name: build-linux-musl-arm
+          path: .libsodium-pack/runtimes/linux-musl-arm/native/
+      - uses: actions/download-artifact@v3
+        with:
+          name: build-linux-musl-arm64
+          path: .libsodium-pack/runtimes/linux-musl-arm64/native/
+      - uses: actions/download-artifact@v3
         with:
           name: build-osx-x64
           path: .libsodium-pack/runtimes/osx-x64/native/
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
         with:
           name: build-osx-arm64
           path: .libsodium-pack/runtimes/osx-arm64/native/
@@ -249,7 +254,7 @@ jobs:
         run: cp AUTHORS ChangeLog LICENSE packaging/dotnet-core/libsodium.pkgproj .libsodium-pack/
       - name: Create NuGet package
         run: dotnet pack -c Release .libsodium-pack/libsodium.pkgproj
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
           name: nuget-package
           path: .libsodium-pack/bin/Release/*.nupkg
@@ -265,8 +270,8 @@ jobs:
       DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
       DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v3
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v3
         with:
           name: nuget-package
           path: .libsodium-pack/
@@ -291,7 +296,7 @@ jobs:
           mv .libsodium-test/bin/Release/net6.0/linux-arm/publish .libsodium-builds/linux-arm
           mv .libsodium-test/bin/Release/net6.0/linux-arm64/publish .libsodium-builds/linux-arm64
           mv .libsodium-test/bin/Release/net6.0/linux-x64/publish .libsodium-builds/linux-x64
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
           name: test-builds
           path: .libsodium-builds/*
@@ -302,14 +307,14 @@ jobs:
     - build-test-binaries
     strategy:
       matrix:
-        # CentOS 7 and Debian 9 use an older GCC version; make sure we can run on those platforms.
+        # CentOS 7 and Debian 10 use an older GCC version; make sure we can run on those platforms.
-        arch: [ 'centos:7', 'debian:9' ]
+        arch: [ 'centos:7', 'debian:10' ]
     container:
       image: ${{ matrix.arch }}
     env:
       DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
     steps:
-    - uses: actions/download-artifact@v2
+    - uses: actions/download-artifact@v3
       with:
         name: test-builds
         path: .libsodium-builds/
@@ -319,37 +324,42 @@ jobs:
         .libsodium-builds/linux-x64/Tests
 
   run-test-binaries-cross-plat:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     needs:
       - build-test-binaries
     env:
       DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
     strategy:
       matrix:
+        include:
+          - arch: x64
+            libs: /usr/lib
+          - arch: arm
+            libs: /usr/arm-linux-gnueabihf/lib
+          - arch: arm64
+            libs: /usr/aarch64-linux-gnu/lib
         arch: [x64, arm, arm64]
     steps:
       - name: Set up build environment
         run: |
           export DEBIAN_FRONTEND=noninteractive
 
-          cat <<-EOF | sudo tee /etc/apt/sources.list.d/multiarch.list >/dev/null
+          # On virtualization systems such as the one used by WSL2, the ARM crypto extensions
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal main restricted
+          # don't work as expected. As a result, installing on Ubuntu fails during integrity
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal-updates main restricted
+          # checks. As a workaround, the following command disables hardware acceleration for
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal universe
+          # gcrypt, which the apt-get command relies on.
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal-updates universe
+          sudo mkdir -p /etc/gcrypt && echo all | sudo tee /etc/gcrypt/hwf.deny
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal multiverse
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal-updates multiverse
-          deb [arch=armhf,arm64] http://ports.ubuntu.com/ focal-backports main restricted universe multiverse
-          EOF
-
-          sudo sed -i 's/deb h/deb [arch=amd64] h/g' /etc/apt/sources.list
 
+          sudo apt-get update && sudo apt-get install -y qemu binfmt-support qemu-user-static qemu-system-arm gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu libc6-armhf-cross libc6-arm64-cross
           sudo dpkg --add-architecture armhf
           sudo dpkg --add-architecture arm64
+          sudo update-binfmts --enable qemu-aarch64
+          sudo update-binfmts --enable qemu-arm
+          sudo update-binfmts --display
+          sudo ln -s /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.* /lib
+          sudo ln -s /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.* /lib
 
-          sudo apt-get update && sudo apt-get install -y qemu-user qemu-user-static libstdc++6:armhf libstdc++6:arm64
+      - uses: actions/download-artifact@v3
-
-      - uses: actions/download-artifact@v2
         with:
           name: test-builds
           path: .libsodium-builds/
@@ -357,4 +367,4 @@ jobs:
       - name: Run ${{ matrix.arch }}
         run: |
           chmod +x .libsodium-builds/linux-${{ matrix.arch }}/Tests
-          .libsodium-builds/linux-${{ matrix.arch }}/Tests
+          env LD_LIBRARY_PATH=${{ matrix.libs }} .libsodium-builds/linux-${{ matrix.arch }}/Tests

deps/libsodium/AUTHORS

@@ -45,8 +45,7 @@ siphash                                Jean-Philippe Aumasson
 Implementors
 ============
 
-crypto_aead/aes256gcm/aesni            Romain Dolbeau
+crypto_aead/aes256gcm/aesni            Frank Denis
-                                       Frank Denis
 
 crypto_aead/chacha20poly1305           Frank Denis
 

deps/libsodium/LICENSE

@@ -1,7 +1,7 @@
 /*
  * ISC License
  *
- * Copyright (c) 2013-2022
+ * Copyright (c) 2013-2023
  * Frank Denis <j at pureftpd dot org>
  *
  * Permission to use, copy, modify, and/or distribute this software for any

deps/libsodium/azure-pipelines.yml

@@ -16,12 +16,13 @@ jobs:
           curl https://get.wasmer.io -sSfL | sh
         displayName: Install wasmer
       - script: |
-          curl -sL -o - https://ziglang.org/download/0.8.1/zig-linux-x86_64-0.8.1.tar.xz | tar xJ -f - -C /opt/
+          curl -sL -o - https://ziglang.org/download/0.10.1/zig-linux-x86_64-0.10.1.tar.xz | tar xJ -f - -C /opt/
           sudo mv /opt/zig-* /opt/zig
-          env PATH=/opt/zig/bin:/opt/zig:$PATH
+          export PATH=/opt/zig/bin:/opt/zig:$PATH
         displayName: Install the Zig SDK
       - script: |
-          env WASMER_DIR=${HOME}/.wasmer PATH=${HOME}/.wasmer/bin:${HOME}/.cargo/bin:$PATH dist-build/wasm32-wasi.sh
+          . ~/.wasmer/wasmer.sh
+          dist-build/wasm32-wasi.sh
         displayName: Compile libsodium
       - task: PublishBuildArtifacts@1
         condition: not(canceled())
@@ -67,26 +68,12 @@ jobs:
           pathToPublish: bin
           artifactName: libsodium
 
-  - job: "windows_old"
-    pool:
-      vmImage: "vs2017-win2016"
-    steps:
-      - powershell: |
-          cd builds\msvc\build
-          & .\buildbase.bat ..\vs2017\libsodium.sln 15
-        displayName: Compile it all
-      - task: PublishBuildArtifacts@1
-        condition: not(canceled())
-        inputs:
-          pathToPublish: bin
-          artifactName: libsodium
-
   - job: mingw64
     pool:
       vmImage: "windows-2019"
     steps:
       - powershell: |
-          (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2021-07-25/msys2-base-x86_64-20210725.sfx.exe", "sfx.exe")
+          (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2022-12-16/msys2-base-x86_64-20221216.sfx.exe", "sfx.exe")
           .\sfx.exe -y -o\
           del sfx.exe
         displayName: Install MSYS2

deps/libsodium/build-aux/config.sub

@@ -1,10 +1,10 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2022 Free Software Foundation, Inc.
+#   Copyright 1992-2023 Free Software Foundation, Inc.
 
 # shellcheck disable=SC2006,SC2268 # see below for rationale
 
-timestamp='2022-01-03'
+timestamp='2023-01-21'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -76,7 +76,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
 
-Copyright 1992-2022 Free Software Foundation, Inc.
+Copyright 1992-2023 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -145,7 +145,7 @@ case $1 in
 			nto-qnx* | linux-* | uclinux-uclibc* \
 			| uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* \
 			| netbsd*-eabi* | kopensolaris*-gnu* | cloudabi*-eabi* \
-			| storm-chaos* | os2-emx* | rtmk-nova*)
+			| storm-chaos* | os2-emx* | rtmk-nova* | managarm-*)
 				basic_machine=$field1
 				basic_os=$maybe_os
 				;;
@@ -1075,7 +1075,7 @@ case $cpu-$vendor in
 	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
 		cpu=i586
 		;;
-	pentiumpro-* | p6-* | 6x86-* | athlon-* | athalon_*-*)
+	pentiumpro-* | p6-* | 6x86-* | athlon-* | athlon_*-*)
 		cpu=i686
 		;;
 	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
@@ -1207,7 +1207,7 @@ case $cpu-$vendor in
 			| k1om \
 			| le32 | le64 \
 			| lm32 \
-			| loongarch32 | loongarch64 | loongarchx32 \
+			| loongarch32 | loongarch64 \
 			| m32c | m32r | m32rle \
 			| m5200 | m68000 | m680[012346]0 | m68360 | m683?2 | m68k \
 			| m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x \
@@ -1341,6 +1341,10 @@ EOF
 		kernel=linux
 		os=`echo "$basic_os" | sed -e 's|linux|gnu|'`
 		;;
+	managarm*)
+		kernel=managarm
+		os=`echo "$basic_os" | sed -e 's|managarm|mlibc|'`
+		;;
 	*)
 		kernel=
 		os=$basic_os
@@ -1754,7 +1758,7 @@ case $os in
 	     | onefs* | tirtos* | phoenix* | fuchsia* | redox* | bme* \
 	     | midnightbsd* | amdhsa* | unleashed* | emscripten* | wasi* \
 	     | nsk* | powerunix* | genode* | zvmoe* | qnx* | emx* | zephyr* \
-	     | fiwix* )
+	     | fiwix* | mlibc* )
 		;;
 	# This one is extra strict with allowed versions
 	sco3.2v2 | sco3.2v[4-9]* | sco5v6*)
@@ -1762,6 +1766,9 @@ case $os in
 		;;
 	none)
 		;;
+	kernel* )
+		# Restricted further below
+		;;
 	*)
 		echo Invalid configuration \`"$1"\': OS \`"$os"\' not recognized 1>&2
 		exit 1
@@ -1772,16 +1779,26 @@ esac
 # (given a valid OS), if there is a kernel.
 case $kernel-$os in
 	linux-gnu* | linux-dietlibc* | linux-android* | linux-newlib* \
-		   | linux-musl* | linux-relibc* | linux-uclibc* )
+		   | linux-musl* | linux-relibc* | linux-uclibc* | linux-mlibc* )
 		;;
 	uclinux-uclibc* )
 		;;
-	-dietlibc* | -newlib* | -musl* | -relibc* | -uclibc* )
+	managarm-mlibc* | managarm-kernel* )
+		;;
+	-dietlibc* | -newlib* | -musl* | -relibc* | -uclibc* | -mlibc* )
 		# These are just libc implementations, not actual OSes, and thus
 		# require a kernel.
 		echo "Invalid configuration \`$1': libc \`$os' needs explicit kernel." 1>&2
 		exit 1
 		;;
+	-kernel* )
+		echo "Invalid configuration \`$1': \`$os' needs explicit kernel." 1>&2
+		exit 1
+		;;
+	*-kernel* )
+		echo "Invalid configuration \`$1': \`$kernel' does not support \`$os'." 1>&2
+		exit 1
+		;;
 	kfreebsd*-gnu* | kopensolaris*-gnu*)
 		;;
 	vxworks-simlinux | vxworks-simwindows | vxworks-spe)

deps/libsodium/build.zig

@@ -1,30 +1,38 @@
 const std = @import("std");
-const builtin = @import("builtin");
 const fmt = std.fmt;
 const fs = std.fs;
 const heap = std.heap;
 const mem = std.mem;
 const LibExeObjStep = std.build.LibExeObjStep;
+const Target = std.Target;
 
 pub fn build(b: *std.build.Builder) !void {
     const src_path = "src/libsodium";
-    const src_dir = try fs.Dir.openDir(fs.cwd(), src_path, .{ .iterate = true, .no_follow = true });
+    const src_dir = try fs.Dir.openIterableDir(fs.cwd(), src_path, .{ .no_follow = true });
 
-    var target = b.standardTargetOptions(.{});
+    const target = b.standardTargetOptions(.{});
-    var mode = b.standardReleaseOptions();
+    const mode = b.standardReleaseOptions();
 
+    const enable_benchmarks = b.option(bool, "enable_benchmarks", "Whether tests should be benchmarks.") orelse false;
+    const benchmarks_iterations = b.option(u32, "iterations", "Number of iterations for benchmarks.") orelse 200;
+
+    const shared = b.addSharedLibrary(
+        if (target.isWindows()) "sodium_shared" else "sodium",
+        null,
+        .unversioned,
+    );
     const static = b.addStaticLibrary("sodium", null);
-    const shared = b.addSharedLibrary("sodium", null, .unversioned);
     shared.strip = true;
     static.strip = true;
 
-    const libs = [_]*LibExeObjStep{ static, shared };
+    const libs_ = [_]*LibExeObjStep{ shared, static };
+    const libs = if (target.getOsTag() == .wasi) libs_[1..] else libs_[0..];
 
     const prebuilt_version_file_path = "builds/msvc/version.h";
     const version_file_path = "include/sodium/version.h";
 
-    if (src_dir.access(version_file_path, .{ .mode = .read_only })) {} else |_| {
+    if (src_dir.dir.access(version_file_path, .{ .mode = .read_only })) {} else |_| {
-        try fs.cwd().copyFile(prebuilt_version_file_path, src_dir, version_file_path, .{});
+        try fs.cwd().copyFile(prebuilt_version_file_path, src_dir.dir, version_file_path, .{});
     }
 
     for (libs) |lib| {
@@ -36,13 +44,95 @@ pub fn build(b: *std.build.Builder) !void {
         }
         lib.linkLibC();
 
-        lib.addIncludeDir("src/libsodium/include/sodium");
+        lib.addIncludePath("src/libsodium/include/sodium");
+        lib.defineCMacro("_GNU_SOURCE", "1");
         lib.defineCMacro("CONFIGURED", "1");
         lib.defineCMacro("DEV_MODE", "1");
-        lib.defineCMacro("_GNU_SOURCE", "1");
-        lib.defineCMacro("HAVE_INLINE_ASM", "1");
-        lib.defineCMacro("HAVE_TI_MODE", "1");
         lib.defineCMacro("HAVE_ATOMIC_OPS", "1");
+        lib.defineCMacro("HAVE_C11_MEMORY_FENCES", "1");
+        lib.defineCMacro("HAVE_GCC_MEMORY_FENCES", "1");
+        lib.defineCMacro("HAVE_INLINE_ASM", "1");
+        lib.defineCMacro("HAVE_INTTYPES_H", "1");
+        lib.defineCMacro("HAVE_STDINT_H", "1");
+        lib.defineCMacro("HAVE_TI_MODE", "1");
+
+        if (target.cpu_arch) |arch| {
+            switch (arch.endian()) {
+                .Big => lib.defineCMacro("NATIVE_BIG_ENDIAN", "1"),
+                .Little => lib.defineCMacro("NATIVE_LITTLE_ENDIAN", "1"),
+            }
+        }
+
+        switch (target.getOsTag()) {
+            .linux => {
+                lib.defineCMacro("ASM_HIDE_SYMBOL", ".hidden");
+                lib.defineCMacro("TLS", "_Thread_local");
+
+                lib.defineCMacro("HAVE_CATCHABLE_ABRT", "1");
+                lib.defineCMacro("HAVE_CATCHABLE_SEGV", "1");
+                lib.defineCMacro("HAVE_CLOCK_GETTIME", "1");
+                lib.defineCMacro("HAVE_GETPID", "1");
+                lib.defineCMacro("HAVE_INLINE_ASM", "1");
+                lib.defineCMacro("HAVE_MADVISE", "1");
+                lib.defineCMacro("HAVE_MLOCK", "1");
+                lib.defineCMacro("HAVE_MMAP", "1");
+                lib.defineCMacro("HAVE_MPROTECT", "1");
+                lib.defineCMacro("HAVE_NANOSLEEP", "1");
+                lib.defineCMacro("HAVE_POSIX_MEMALIGN", "1");
+                lib.defineCMacro("HAVE_PTHREAD_PRIO_INHERIT", "1");
+                lib.defineCMacro("HAVE_PTHREAD", "1");
+                lib.defineCMacro("HAVE_RAISE", "1");
+                lib.defineCMacro("HAVE_SYSCONF", "1");
+                lib.defineCMacro("HAVE_SYS_AUXV_H", "1");
+                lib.defineCMacro("HAVE_SYS_MMAN_H", "1");
+                lib.defineCMacro("HAVE_SYS_PARAM_H", "1");
+                lib.defineCMacro("HAVE_SYS_RANDOM_H", "1");
+                lib.defineCMacro("HAVE_WEAK_SYMBOLS", "1");
+            },
+            .windows => {
+                lib.defineCMacro("HAVE_RAISE", "1");
+                lib.defineCMacro("HAVE_SYS_PARAM_H", "1");
+            },
+            .macos => {
+                lib.defineCMacro("ASM_HIDE_SYMBOL", ".private_extern");
+                lib.defineCMacro("TLS", "_Thread_local");
+
+                lib.defineCMacro("HAVE_ARC4RANDOM", "1");
+                lib.defineCMacro("HAVE_ARC4RANDOM_BUF", "1");
+                lib.defineCMacro("HAVE_CATCHABLE_ABRT", "1");
+                lib.defineCMacro("HAVE_CATCHABLE_SEGV", "1");
+                lib.defineCMacro("HAVE_CLOCK_GETTIME", "1");
+                lib.defineCMacro("HAVE_GETENTROPY", "1");
+                lib.defineCMacro("HAVE_GETPID", "1");
+                lib.defineCMacro("HAVE_MADVISE", "1");
+                lib.defineCMacro("HAVE_MEMSET_S", "1");
+                lib.defineCMacro("HAVE_MLOCK", "1");
+                lib.defineCMacro("HAVE_MMAP", "1");
+                lib.defineCMacro("HAVE_MPROTECT", "1");
+                lib.defineCMacro("HAVE_NANOSLEEP", "1");
+                lib.defineCMacro("HAVE_POSIX_MEMALIGN", "1");
+                lib.defineCMacro("HAVE_PTHREAD", "1");
+                lib.defineCMacro("HAVE_PTHREAD_PRIO_INHERIT", "1");
+                lib.defineCMacro("HAVE_RAISE", "1");
+                lib.defineCMacro("HAVE_SYSCONF", "1");
+                lib.defineCMacro("HAVE_SYS_MMAN_H", "1");
+                lib.defineCMacro("HAVE_SYS_PARAM_H", "1");
+                lib.defineCMacro("HAVE_SYS_RANDOM_H", "1");
+                lib.defineCMacro("HAVE_WEAK_SYMBOLS", "1");
+            },
+            .wasi => {
+                lib.defineCMacro("HAVE_ARC4RANDOM", "1");
+                lib.defineCMacro("HAVE_ARC4RANDOM_BUF", "1");
+                lib.defineCMacro("HAVE_CLOCK_GETTIME", "1");
+                lib.defineCMacro("HAVE_GETENTROPY", "1");
+                lib.defineCMacro("HAVE_NANOSLEEP", "1");
+                lib.defineCMacro("HAVE_POSIX_MEMALIGN", "1");
+                lib.defineCMacro("HAVE_SYS_AUXV_H", "1");
+                lib.defineCMacro("HAVE_SYS_PARAM_H", "1");
+                lib.defineCMacro("HAVE_SYS_RANDOM_H", "1");
+            },
+            else => {},
+        }
 
         switch (target.getCpuArch()) {
             .x86_64 => {
@@ -52,9 +142,17 @@ pub fn build(b: *std.build.Builder) !void {
                 lib.defineCMacro("HAVE_MMINTRIN_H", "1");
                 lib.defineCMacro("HAVE_EMMINTRIN_H", "1");
                 lib.defineCMacro("HAVE_PMMINTRIN_H", "1");
+                lib.defineCMacro("HAVE_SMMINTRIN_H", "1");
+                lib.defineCMacro("HAVE_TMMINTRIN_H", "1");
+                lib.defineCMacro("HAVE_WMMINTRIN_H", "1");
             },
             .aarch64, .aarch64_be => {
-                lib.defineCMacro("HAVE_ARMCRYTO", "1");
+                const cpu_features = target.getCpuFeatures();
+                const has_neon = cpu_features.isEnabled(@enumToInt(Target.aarch64.Feature.neon));
+                const has_crypto = cpu_features.isEnabled(@enumToInt(Target.aarch64.Feature.crypto));
+                if (has_neon and has_crypto) {
+                    lib.defineCMacro("HAVE_ARMCRYPTO", "1");
+                }
             },
             .wasm32, .wasm64 => {
                 lib.defineCMacro("__wasm__", "1");
@@ -69,6 +167,15 @@ pub fn build(b: *std.build.Builder) !void {
             else => {},
         }
 
+        switch (target.getCpuArch()) {
+            .x86_64 => {
+                lib.target.cpu_features_add.addFeature(@enumToInt(Target.x86.Feature.sse4_1));
+                lib.target.cpu_features_add.addFeature(@enumToInt(Target.x86.Feature.aes));
+                lib.target.cpu_features_add.addFeature(@enumToInt(Target.x86.Feature.pclmul));
+            },
+            else => {},
+        }
+
         var allocator = heap.page_allocator;
         var walker = try src_dir.walk(allocator);
         while (try walker.next()) |entry| {
@@ -88,4 +195,43 @@ pub fn build(b: *std.build.Builder) !void {
             }
         }
     }
+
+    const test_path = "test/default";
+    const out_bin_path = "zig-out/bin";
+    const test_dir = try fs.Dir.openIterableDir(fs.cwd(), test_path, .{ .no_follow = true });
+    fs.Dir.makePath(fs.cwd(), out_bin_path) catch {};
+    const out_bin_dir = try fs.Dir.openDir(fs.cwd(), out_bin_path, .{});
+    try test_dir.dir.copyFile("run.sh", out_bin_dir, "run.sh", .{});
+    var allocator = heap.page_allocator;
+    var walker = try test_dir.walk(allocator);
+    while (try walker.next()) |entry| {
+        const name = entry.basename;
+        if (mem.endsWith(u8, name, ".exp")) {
+            try test_dir.dir.copyFile(name, out_bin_dir, name, .{});
+            continue;
+        }
+        if (!mem.endsWith(u8, name, ".c")) {
+            continue;
+        }
+        const exe_name = name[0 .. name.len - 2];
+        var exe = b.addExecutable(exe_name, null);
+        exe.setTarget(target);
+        exe.setBuildMode(mode);
+        exe.linkLibC();
+        exe.want_lto = false;
+        exe.strip = true;
+        exe.linkLibrary(static);
+        exe.addIncludePath("src/libsodium/include");
+        exe.addIncludePath("test/quirks");
+        const full_path = try fmt.allocPrint(allocator, "{s}/{s}", .{ test_path, entry.path });
+        exe.addCSourceFiles(&.{full_path}, &.{});
+
+        if (enable_benchmarks) {
+            exe.defineCMacro("BENCHMARKS", "1");
+            var buf: [16]u8 = undefined;
+            exe.defineCMacro("ITERATIONS", std.fmt.bufPrintIntToSlice(&buf, benchmarks_iterations, 10, .lower, .{}));
+        }
+
+        exe.install();
+    }
 }

deps/libsodium/builds/msvc/properties/DebugLIB.props

@@ -12,7 +12,7 @@
   
   <ItemDefinitionGroup>
     <ClCompile>
-      <DebugInformationFormat>OldStyle</DebugInformationFormat>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
       <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
       <LinkIncremental>true</LinkIncremental>
     </ClCompile>

deps/libsodium/builds/msvc/properties/Release.props

@@ -14,7 +14,7 @@
   <ItemDefinitionGroup>
     <ClCompile>
       <AdditionalOptions>/Oy- %(AdditionalOptions)</AdditionalOptions>
-      <!--<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>-->
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>

deps/libsodium/configure

@@ -1596,7 +1596,7 @@ Some influential environment variables:
   CPP         C preprocessor
   SAFECODE_HOME
               set to the safecode base directory
-  CWFLAGS     define to compilation flags for generating extra warnings
+  CWFLAGS     compilation flags for generating extra warnings
   LT_SYS_LIBRARY_PATH
               User-defined run-time library search path.
   AR          path to the ar utility
@@ -3753,6 +3753,9 @@ then :
 
 fi
 
+sodium_CFLAGS=${CFLAGS+set}
+: ${CFLAGS=""}
+
 
 
 
@@ -5289,6 +5292,206 @@ fi
 
 
 
+if test "$sodium_CFLAGS" != "set" ; then
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -Ofast" >&5
+printf %s "checking whether C compiler accepts -Ofast... " >&6; }
+if test ${ax_cv_check_cflags___Ofast+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -Ofast"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___Ofast=yes
+else $as_nop
+  ax_cv_check_cflags___Ofast=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___Ofast" >&5
+printf "%s\n" "$ax_cv_check_cflags___Ofast" >&6; }
+if test "x$ax_cv_check_cflags___Ofast" = xyes
+then :
+  CFLAGS="$CFLAGS -Ofast"
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -O3" >&5
+printf %s "checking whether C compiler accepts -O3... " >&6; }
+if test ${ax_cv_check_cflags___O3+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -O3"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___O3=yes
+else $as_nop
+  ax_cv_check_cflags___O3=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___O3" >&5
+printf "%s\n" "$ax_cv_check_cflags___O3" >&6; }
+if test "x$ax_cv_check_cflags___O3" = xyes
+then :
+  CFLAGS="$CFLAGS -O3"
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -O2" >&5
+printf %s "checking whether C compiler accepts -O2... " >&6; }
+if test ${ax_cv_check_cflags___O2+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -O2"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___O2=yes
+else $as_nop
+  ax_cv_check_cflags___O2=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___O2" >&5
+printf "%s\n" "$ax_cv_check_cflags___O2" >&6; }
+if test "x$ax_cv_check_cflags___O2" = xyes
+then :
+  CFLAGS="$CFLAGS -O2"
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -O1" >&5
+printf %s "checking whether C compiler accepts -O1... " >&6; }
+if test ${ax_cv_check_cflags___O1+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -O1"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___O1=yes
+else $as_nop
+  ax_cv_check_cflags___O1=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___O1" >&5
+printf "%s\n" "$ax_cv_check_cflags___O1" >&6; }
+if test "x$ax_cv_check_cflags___O1" = xyes
+then :
+  CFLAGS="$CFLAGS -O1"
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -O" >&5
+printf %s "checking whether C compiler accepts -O... " >&6; }
+if test ${ax_cv_check_cflags___O+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -O"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___O=yes
+else $as_nop
+  ax_cv_check_cflags___O=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___O" >&5
+printf "%s\n" "$ax_cv_check_cflags___O" >&6; }
+if test "x$ax_cv_check_cflags___O" = xyes
+then :
+  CFLAGS="$CFLAGS -O"
+else $as_nop
+  :
+fi
+
+fi
+
+fi
+
+fi
+
+fi
+
+fi
+
+
 # Check whether --enable-ssp was given.
 if test ${enable_ssp+y}
 then :
@@ -6869,46 +7072,6 @@ then :
   if test "x$enableval" = "xyes"
 then :
 
-    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -Ofast" >&5
-printf %s "checking whether C compiler accepts -Ofast... " >&6; }
-if test ${ax_cv_check_cflags___Ofast+y}
-then :
-  printf %s "(cached) " >&6
-else $as_nop
-
-  ax_check_save_flags=$CFLAGS
-  CFLAGS="$CFLAGS  -Ofast"
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <time.h>
-int
-main (void)
-{
-time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"
-then :
-  ax_cv_check_cflags___Ofast=yes
-else $as_nop
-  ax_cv_check_cflags___Ofast=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam \
-    conftest$ac_exeext conftest.$ac_ext
-  CFLAGS=$ax_check_save_flags
-fi
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___Ofast" >&5
-printf "%s\n" "$ax_cv_check_cflags___Ofast" >&6; }
-if test "x$ax_cv_check_cflags___Ofast" = xyes
-then :
-  CFLAGS="$CFLAGS -Ofast"
-else $as_nop
-  :
-fi
-
     { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -ftree-vectorize" >&5
 printf %s "checking whether C compiler accepts -ftree-vectorize... " >&6; }
 if test ${ax_cv_check_cflags___ftree_vectorize+y}
@@ -7069,6 +7232,46 @@ else $as_nop
   :
 fi
 
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -mtune=native" >&5
+printf %s "checking whether C compiler accepts -mtune=native... " >&6; }
+if test ${ax_cv_check_cflags___mtune_native+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -mtune=native"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_cflags___mtune_native=yes
+else $as_nop
+  ax_cv_check_cflags___mtune_native=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___mtune_native" >&5
+printf "%s\n" "$ax_cv_check_cflags___mtune_native" >&6; }
+if test "x$ax_cv_check_cflags___mtune_native" = xyes
+then :
+  CFLAGS="$CFLAGS -mtune=native"
+else $as_nop
+  :
+fi
+
 
 fi
 
@@ -8458,8 +8661,6 @@ esac
 
 fi
 
-
-
 as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CFLAGS -Wall" | $as_tr_sh`
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CFLAGS -Wall" >&5
 printf %s "checking whether C compiler accepts $CFLAGS -Wall... " >&6; }
@@ -8502,16 +8703,16 @@ else $as_nop
   :
 fi
 
-as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CFLAGS -Wextra" | $as_tr_sh`
+as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CFLAGS -Wno-unknown-pragmas" | $as_tr_sh`
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CFLAGS -Wextra" >&5
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CFLAGS -Wno-unknown-pragmas" >&5
-printf %s "checking whether C compiler accepts $CFLAGS -Wextra... " >&6; }
+printf %s "checking whether C compiler accepts $CFLAGS -Wno-unknown-pragmas... " >&6; }
 if eval test \${$as_CACHEVAR+y}
 then :
   printf %s "(cached) " >&6
 else $as_nop
 
   ax_check_save_flags=$CFLAGS
-  CFLAGS="$CFLAGS  $CFLAGS -Wextra"
+  CFLAGS="$CFLAGS  $CFLAGS -Wno-unknown-pragmas"
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <time.h>
@@ -8539,12 +8740,14 @@ eval ac_res=\$$as_CACHEVAR
 printf "%s\n" "$ac_res" >&6; }
 if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
 then :
-  CWFLAGS="$CFLAGS -Wextra"
+  CFLAGS="$CFLAGS -Wno-unknown-pragmas"
 else $as_nop
   :
 fi
 
 
+
+
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for clang" >&5
 printf %s "checking for clang... " >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -8555,7 +8758,7 @@ main (void)
 {
 
 #ifndef __clang__
-#error Not clang
+#error Not clang nor zig cc
 #endif
 
   ;
@@ -8616,6 +8819,90 @@ printf "%s\n" "no" >&6; }
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 
+as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CWFLAGS -Wextra" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CWFLAGS -Wextra" >&5
+printf %s "checking whether C compiler accepts $CWFLAGS -Wextra... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  $CWFLAGS -Wextra"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  eval "$as_CACHEVAR=yes"
+else $as_nop
+  eval "$as_CACHEVAR=no"
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+eval ac_res=\$$as_CACHEVAR
+	       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
+  CWFLAGS="$WCFLAGS -Wextra"
+else $as_nop
+  :
+fi
+
+as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CWFLAGS -Warray-bounds" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CWFLAGS -Warray-bounds" >&5
+printf %s "checking whether C compiler accepts $CWFLAGS -Warray-bounds... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  $CWFLAGS -Warray-bounds"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <time.h>
+int
+main (void)
+{
+time_t x; int fodder = 0; if (fodder > -1000 && time(&x)) return (int) x
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  eval "$as_CACHEVAR=yes"
+else $as_nop
+  eval "$as_CACHEVAR=no"
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+eval ac_res=\$$as_CACHEVAR
+	       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
+  CWFLAGS="$CWFLAGS -Warray-bounds"
+else $as_nop
+  :
+fi
+
 as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$CWFLAGS -Wbad-function-cast" | $as_tr_sh`
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $CWFLAGS -Wbad-function-cast" >&5
 printf %s "checking whether C compiler accepts $CWFLAGS -Wbad-function-cast... " >&6; }
@@ -9905,6 +10192,8 @@ size_t i;
 signal(SIGSEGV, sig);
 signal(SIGBUS, sig);
 #if !defined(__SANITIZE_ADDRESS__) && !defined(__EMSCRIPTEN__)
+*((volatile unsigned char *) -1) = 0xd0;
+*((volatile unsigned char *) 1) = 0xd0;
 for (i = 0; i < 10000000; i += 1024) { x[-i] = x[i] = (unsigned char) i; }
 #endif
 free((void *) x);
@@ -20630,6 +20919,12 @@ then :
   printf "%s\n" "#define HAVE_NANOSLEEP 1" >>confdefs.h
 
 fi
+ac_fn_c_check_func "$LINENO" "clock_gettime" "ac_cv_func_clock_gettime"
+if test "x$ac_cv_func_clock_gettime" = xyes
+then :
+  printf "%s\n" "#define HAVE_CLOCK_GETTIME 1" >>confdefs.h
+
+fi
 
 
 if test "x$WASI" = "x"
@@ -20646,6 +20941,12 @@ if test "x$ac_cv_func_explicit_bzero" = xyes
 then :
   printf "%s\n" "#define HAVE_EXPLICIT_BZERO 1" >>confdefs.h
 
+fi
+ac_fn_c_check_func "$LINENO" "memset_explicit" "ac_cv_func_memset_explicit"
+if test "x$ac_cv_func_memset_explicit" = xyes
+then :
+  printf "%s\n" "#define HAVE_MEMSET_EXPLICIT 1" >>confdefs.h
+
 fi
 ac_fn_c_check_func "$LINENO" "explicit_memset" "ac_cv_func_explicit_memset"
 if test "x$ac_cv_func_explicit_memset" = xyes

deps/libsodium/configure.ac

@@ -42,10 +42,23 @@ AS_IF([pwd | fgrep ' ' > /dev/null 2>&1],
   [AC_MSG_ERROR([The build directory contains whitespaces - This can cause tests/installation to fail due to limitations of some libtool versions])]
 )
 
+sodium_CFLAGS=${CFLAGS+set}
+: ${CFLAGS=""}
+
 AC_PROG_CC
 AM_PROG_AS
 AC_USE_SYSTEM_EXTENSIONS
 
+dnl Default optimization flags
+
+if test "$sodium_CFLAGS" != "set" ; then
+  AX_CHECK_COMPILE_FLAG([-Ofast], [CFLAGS="$CFLAGS -Ofast"],
+    [AX_CHECK_COMPILE_FLAG([-O3], [CFLAGS="$CFLAGS -O3"],
+      [AX_CHECK_COMPILE_FLAG([-O2], [CFLAGS="$CFLAGS -O2"],
+        [AX_CHECK_COMPILE_FLAG([-O1], [CFLAGS="$CFLAGS -O1"],
+          [AX_CHECK_COMPILE_FLAG([-O], [CFLAGS="$CFLAGS -O"])])])])])
+fi
+
 dnl Switches
 
 AC_ARG_ENABLE(ssp,
@@ -197,11 +210,11 @@ AC_ARG_ENABLE(opt,
 [AS_HELP_STRING(--enable-opt,Optimize for the native CPU - The resulting library will be faster but not portable)],
 [
   AS_IF([test "x$enableval" = "xyes"], [
-    AX_CHECK_COMPILE_FLAG([-Ofast], [CFLAGS="$CFLAGS -Ofast"])
     AX_CHECK_COMPILE_FLAG([-ftree-vectorize], [CFLAGS="$CFLAGS -ftree-vectorize"])
     AX_CHECK_COMPILE_FLAG([-ftree-slp-vectorize], [CFLAGS="$CFLAGS -ftree-slp-vectorize"])
     AX_CHECK_COMPILE_FLAG([-fomit-frame-pointer], [CFLAGS="$CFLAGS -fomit-frame-pointer"])
     AX_CHECK_COMPILE_FLAG([-march=native], [CFLAGS="$CFLAGS -march=native"])
+    AX_CHECK_COMPILE_FLAG([-mtune=native], [CFLAGS="$CFLAGS -mtune=native"])
   ])
 ])
 
@@ -310,15 +323,15 @@ AS_CASE([$host_os],
   ])
 ])
 
-AC_ARG_VAR([CWFLAGS], [define to compilation flags for generating extra warnings])
-
 AX_CHECK_COMPILE_FLAG([$CFLAGS -Wall], [CWFLAGS="$CFLAGS -Wall"])
-AX_CHECK_COMPILE_FLAG([$CFLAGS -Wextra], [CWFLAGS="$CFLAGS -Wextra"])
+AX_CHECK_COMPILE_FLAG([$CFLAGS -Wno-unknown-pragmas], [CFLAGS="$CFLAGS -Wno-unknown-pragmas"])
+
+AC_ARG_VAR([CWFLAGS], [compilation flags for generating extra warnings])
 
 AC_MSG_CHECKING(for clang)
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[
 #ifndef __clang__
-#error Not clang
+#error Not clang nor zig cc
 #endif
 ]])],
   [AC_MSG_RESULT(yes)
@@ -328,6 +341,8 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[
   [AC_MSG_RESULT(no)
 ])
 
+AX_CHECK_COMPILE_FLAG([$CWFLAGS -Wextra], [CWFLAGS="$WCFLAGS -Wextra"])
+AX_CHECK_COMPILE_FLAG([$CWFLAGS -Warray-bounds], [CWFLAGS="$CWFLAGS -Warray-bounds"])
 AX_CHECK_COMPILE_FLAG([$CWFLAGS -Wbad-function-cast], [CWFLAGS="$CWFLAGS -Wbad-function-cast"])
 AX_CHECK_COMPILE_FLAG([$CWFLAGS -Wcast-qual], [CWFLAGS="$CWFLAGS -Wcast-qual"])
 AX_CHECK_COMPILE_FLAG([$CWFLAGS -Wdiv-by-zero], [CWFLAGS="$CWFLAGS -Wdiv-by-zero"])
@@ -866,10 +881,10 @@ AS_IF([test "x$WASI" = "x"],[
   AC_CHECK_FUNCS([getauxva elf_aux_info])
 ])
 
-AC_CHECK_FUNCS([posix_memalign nanosleep])
+AC_CHECK_FUNCS([posix_memalign nanosleep clock_gettime])
 
 AS_IF([test "x$WASI" = "x"],[
-  AC_CHECK_FUNCS([memset_s explicit_bzero explicit_memset])
+  AC_CHECK_FUNCS([memset_s explicit_bzero memset_explicit explicit_memset])
 ])
 
 AC_SUBST([LIBTOOL_EXTRA_FLAGS])

deps/libsodium/dist-build/android-aar.sh

@@ -0,0 +1,144 @@
+#! /bin/sh
+
+# Create an AAR with libsodium in all combinations of static | shared | minimal | full.
+#
+# The x86 static library will not work due to text relocation rules, so static x86 versions are limited to shared libraries.
+# To simplify linking, library variants have distinct names: sodium, sodium-static, sodium-minimal and sodium-minimal-static.
+
+SODIUM_VERSION="1.0.18.0"
+NDK_VERSION=$(grep "Pkg.Revision = " <"${ANDROID_NDK_HOME}/source.properties" | cut -f 2 -d '=' | cut -f 2 -d' ' | cut -f 1 -d'.')
+DEST_PATH=$(mktemp -d)
+
+cd "$(dirname "$0")/../" || exit
+
+make_abi_json() {
+  echo "{\"abi\":\"${NDK_ARCH}\",\"api\":${SDK_VERSION},\"ndk\":${NDK_VERSION},\"stl\":\"none\"}" >"$1/abi.json"
+}
+
+make_prefab_json() {
+  echo "{\"name\":\"sodium\",\"schema_version\":1,\"dependencies\":[],\"version\":\"$SODIUM_VERSION\"}" >"$1/prefab.json"
+}
+
+make_manifest() {
+  echo "<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\" package=\"com.android.ndk.thirdparty.sodium\" android:versionCode=\"1\" android:versionName=\"1.0\">
+        <uses-sdk android:minSdkVersion=\"19\" android:targetSdkVersion=\"21\"/>
+</manifest>" >"${1}/AndroidManifest.xml"
+}
+
+make_prefab_structure() {
+  mkdir "$DEST_PATH"
+
+  for variant_dirs in "prefab" "prefab/modules" "META-INF"; do
+    mkdir "${DEST_PATH}/${variant_dirs}"
+  done
+
+  make_prefab_json "${DEST_PATH}/prefab"
+  make_manifest "${DEST_PATH}"
+  cp "LICENSE" "${DEST_PATH}/META-INF"
+
+  for variant in \
+    "prefab/modules/sodium" "prefab/modules/sodium-static" \
+    "prefab/modules/sodium-minimal" "prefab/modules/sodium-minimal-static"; do
+    mkdir "${DEST_PATH}/${variant}"
+
+    if [ "$variant" = "prefab/modules/sodium-minimal" ]; then
+      echo "{\"library_name\":\"libsodium\"}" >"${DEST_PATH}/${variant}/module.json"
+    else
+      echo "{}" >"${DEST_PATH}/${variant}/module.json"
+    fi
+
+    mkdir "${DEST_PATH}/${variant}/libs"
+
+    for arch in "arm64-v8a" "armeabi-v7a" "x86" "x86_64"; do
+      mkdir "$DEST_PATH/${variant}/libs/android.${arch}"
+      mkdir "$DEST_PATH/${variant}/libs/android.${arch}/include"
+      NDK_ARCH="$arch"
+      if [ $arch = "arm64-v8a" ] || [ $arch = "x86_64" ]; then
+        SDK_VERSION="21"
+      else
+        SDK_VERSION="19"
+      fi
+
+      make_abi_json "$DEST_PATH/${variant}/libs/android.${arch}"
+    done
+  done
+}
+
+copy_libs() {
+  SRC_DIR="libsodium-android-${1}"
+
+  SHARED_DEST_DIR="${DEST_PATH}/prefab/modules/sodium${3}/libs/android.${2}"
+  STATIC_DEST_DIR="${DEST_PATH}/prefab/modules/sodium${3}-static/libs/android.${2}"
+
+  cp -r "${SRC_DIR}/include" "$SHARED_DEST_DIR"
+  cp -r "${SRC_DIR}/include" "$STATIC_DEST_DIR"
+  cp "${SRC_DIR}/lib/libsodium.so" "${SHARED_DEST_DIR}/libsodium.so"
+  cp "${SRC_DIR}/lib/libsodium.a" "${STATIC_DEST_DIR}/libsodium${3}-static.a"
+
+  rm -r "$SRC_DIR"
+}
+
+build_all() {
+  dist-build/android-armv7-a.sh
+  dist-build/android-armv8-a.sh
+  dist-build/android-x86_64.sh
+  dist-build/android-x86.sh
+}
+
+make_prefab_structure
+
+build_all
+
+copy_libs "armv7-a" "armeabi-v7a" "-minimal"
+copy_libs "armv8-a+crypto" "arm64-v8a" "-minimal"
+copy_libs "i686" "x86" "-minimal"
+copy_libs "westmere" "x86_64" "-minimal"
+
+LIBSODIUM_FULL_BUILD="Y"
+export LIBSODIUM_FULL_BUILD
+
+build_all
+
+copy_libs "armv7-a" "armeabi-v7a"
+copy_libs "armv8-a+crypto" "arm64-v8a"
+copy_libs "i686" "x86"
+copy_libs "westmere" "x86_64"
+
+AAR_PATH="$(pwd)/libsodium-${SODIUM_VERSION}.aar"
+cd "$DEST_PATH" || exit
+rm "$AAR_PATH"
+zip -9 -r "$AAR_PATH" META-INF prefab AndroidManifest.xml
+cd .. || exit
+rm -r "$DEST_PATH"
+
+echo
+echo "Congrats you have built an AAR containing libsodium! To use it with
+gradle or cmake (as set by default for Android Studio projects):
+
+- Edit the app/build.gradle file to add:
+
+    android {
+        buildFeatures {
+            prefab true
+        }
+    }
+
+  and
+
+    dependencies {
+        implementation fileTree(dir:'path/to/aar/',include:['libsodium-$SODIUM_VERSION.aar'])
+    }
+
+  Optionally, store multiple AAR files in the same folder and include '*.aar'
+
+- Edit your module's CMakeLists.txt file to add:
+
+    find_package(sodium REQUIRED CONFIG)
+
+- Then, specify 'sodium::x' as an item in the relevant 'target_link_libraries' statement.
+    The first part is the AAR name and should be 'sodium'.
+    The second part ('x', to be replaced) should be set to:
+      - 'sodium' for the full shared library,
+      - 'sodium-static' for the full static library
+      - 'sodium-minimal' for the minimal shared library, or
+      - 'sodium-minimal-static' for the minimal static library."

deps/libsodium/dist-build/android-armv7-a.sh

@@ -1,4 +1,4 @@
 #!/bin/sh
 export TARGET_ARCH=armv7-a
 export CFLAGS="-Os -mfloat-abi=softfp -mfpu=vfpv3-d16 -mthumb -marm -march=${TARGET_ARCH}"
-ARCH=arm HOST_COMPILER=arm-linux-androideabi "$(dirname "$0")/android-build.sh"
+ARCH=arm HOST_COMPILER=armv7a-linux-androideabi "$(dirname "$0")/android-build.sh"

deps/libsodium/dist-build/android-armv8-a.sh

@@ -1,4 +1,4 @@
 #!/bin/sh
-export TARGET_ARCH=armv8-a
+export TARGET_ARCH=armv8-a+crypto
 export CFLAGS="-Os -march=${TARGET_ARCH}"
 NDK_PLATFORM=android-21 ARCH=arm64 HOST_COMPILER=aarch64-linux-android "$(dirname "$0")/android-build.sh"

deps/libsodium/dist-build/android-build.sh

@@ -1,11 +1,11 @@
 #! /bin/sh
 
 if [ -z "$NDK_PLATFORM" ]; then
-  export NDK_PLATFORM="android-16"
+  export NDK_PLATFORM="android-19"
 fi
 export NDK_PLATFORM_COMPAT="${NDK_PLATFORM_COMPAT:-${NDK_PLATFORM}}"
-export NDK_API_VERSION=$(echo "$NDK_PLATFORM" | sed 's/^android-//')
+export NDK_API_VERSION="$(echo "$NDK_PLATFORM" | sed 's/^android-//')"
-export NDK_API_VERSION_COMPAT=$(echo "$NDK_PLATFORM_COMPAT" | sed 's/^android-//')
+export NDK_API_VERSION_COMPAT="$(echo "$NDK_PLATFORM_COMPAT" | sed 's/^android-//')"
 
 if [ -z "$ANDROID_NDK_HOME" ]; then
   echo "You should probably set ANDROID_NDK_HOME to the directory containing"
@@ -18,20 +18,19 @@ if [ ! -f ./configure ]; then
   exit 1
 fi
 
-if [ "x$TARGET_ARCH" = 'x' ] || [ "x$ARCH" = 'x' ] || [ "x$HOST_COMPILER" = 'x' ]; then
+if [ -z "$TARGET_ARCH" ] || [ -z "$ARCH" ] || [ -z "$HOST_COMPILER" ]; then
   echo "You shouldn't use android-build.sh directly, use android-[arch].sh instead" >&2
   exit 1
 fi
 
-export MAKE_TOOLCHAIN="${ANDROID_NDK_HOME}/build/tools/make_standalone_toolchain.py"
-
 export PREFIX="$(pwd)/libsodium-android-${TARGET_ARCH}"
-export TOOLCHAIN_DIR="$(pwd)/android-toolchain-${TARGET_ARCH}"
+export TOOLCHAIN_OS_DIR="$(uname | tr '[:upper:]' '[:lower:]')-x86_64/"
+export TOOLCHAIN_DIR="$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/${TOOLCHAIN_OS_DIR}"
+echo "$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/${TOOLCHAIN_OS_DIR}/${HOST_COMPILER}"
+
 export PATH="${PATH}:${TOOLCHAIN_DIR}/bin"
-
+SDK_VERSION_NUM=$(echo $NDK_PLATFORM | cut -d'-' -f2)
-export CC=${CC:-"${HOST_COMPILER}-clang"}
+export CC=${CC:-"${HOST_COMPILER}${SDK_VERSION_NUM}-clang"}
-
-rm -rf "${TOOLCHAIN_DIR}" "${PREFIX}"
 
 echo
 echo "Warnings related to headers being present but not usable are due to functions"
@@ -47,9 +46,6 @@ else
 fi
 echo
 
-env - PATH="$PATH" \
-    "$MAKE_TOOLCHAIN" --force --api="$NDK_API_VERSION_COMPAT" \
-    --arch="$ARCH" --install-dir="$TOOLCHAIN_DIR" || exit 1
 
 if [ -z "$LIBSODIUM_FULL_BUILD" ]; then
   export LIBSODIUM_ENABLE_MINIMAL_FLAG="--enable-minimal"
@@ -59,6 +55,7 @@ fi
 
 ./configure \
   --disable-soname-versions \
+  --disable-pie \
   ${LIBSODIUM_ENABLE_MINIMAL_FLAG} \
   --host="${HOST_COMPILER}" \
   --prefix="${PREFIX}" \
@@ -69,18 +66,16 @@ if [ "$NDK_PLATFORM" != "$NDK_PLATFORM_COMPAT" ]; then
   echo
   echo "Configuring again for platform [${NDK_PLATFORM}]"
   echo
-  env - PATH="$PATH" \
-      "$MAKE_TOOLCHAIN" --force --api="$NDK_API_VERSION" \
-      --arch="$ARCH" --install-dir="$TOOLCHAIN_DIR" || exit 1
 
   ./configure \
     --disable-soname-versions \
+    --disable-pie \
     ${LIBSODIUM_ENABLE_MINIMAL_FLAG} \
     --host="${HOST_COMPILER}" \
     --prefix="${PREFIX}" \
     --with-sysroot="${TOOLCHAIN_DIR}/sysroot" || exit 1
 
-  egrep '^#define ' config.log | sort -u > config-def.log
+  grep -E '^#define ' config.log | sort -u >config-def.log
   if ! cmp config-def.log config-def-compat.log; then
     echo "Platform [${NDK_PLATFORM}] is not backwards-compatible with [${NDK_PLATFORM_COMPAT}]" >&2
     diff -u config-def.log config-def-compat.log >&2
@@ -89,10 +84,9 @@ if [ "$NDK_PLATFORM" != "$NDK_PLATFORM_COMPAT" ]; then
   rm -f config-def.log config-def-compat.log
 fi
 
-
 NPROCESSORS=$(getconf NPROCESSORS_ONLN 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null)
 PROCESSORS=${NPROCESSORS:-3}
 
-make clean && \
+make clean &&
-make -j${PROCESSORS} install && \
+  make -j${PROCESSORS} install &&
   echo "libsodium has been installed into ${PREFIX}"

deps/libsodium/dist-build/apple-xcframework.sh

@@ -11,6 +11,7 @@ export IOS_SIMULATOR_I386_PREFIX="${PREFIX}/tmp/ios-simulator-i386"
 export IOS_SIMULATOR_X86_64_PREFIX="${PREFIX}/tmp/ios-simulator-x86_64"
 export WATCHOS32_PREFIX="${PREFIX}/tmp/watchos32"
 export WATCHOS64_32_PREFIX="${PREFIX}/tmp/watchos64_32"
+export WATCHOS64_PREFIX="${PREFIX}/tmp/watchos64"
 export WATCHOS_SIMULATOR_ARM64_PREFIX="${PREFIX}/tmp/watchos-simulator-arm64"
 export WATCHOS_SIMULATOR_I386_PREFIX="${PREFIX}/tmp/watchos-simulator-i386"
 export WATCHOS_SIMULATOR_X86_64_PREFIX="${PREFIX}/tmp/watchos-simulator-x86_64"
@@ -35,6 +36,12 @@ echo "Warnings related to headers being present but not usable are due to functi
 echo "that didn't exist in the specified minimum iOS version level."
 echo "They can be safely ignored."
 echo
+echo "Define the LIBSODIUM_FULL_BUILD environment variable to build the full"
+echo "library (including all deprecated/undocumented/low-level functions)."
+echo
+echo "Define the LIBSODIUM_SKIP_SIMULATORS environment variable to skip building"
+echo "the simulators libraries (iOS, watchOS, tvOS simulators)."
+echo
 
 if [ -z "$LIBSODIUM_FULL_BUILD" ]; then
   export LIBSODIUM_ENABLE_MINIMAL_FLAG="--enable-minimal"
@@ -87,8 +94,8 @@ build_ios() {
   export SDK="${BASEDIR}/SDKs/iPhoneOS.sdk"
 
   ## 32-bit iOS
-  export CFLAGS="-fembed-bitcode -O2 -mthumb -arch armv7 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export CFLAGS="-O2 -mthumb -arch armv7 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -mthumb -arch armv7 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export LDFLAGS="-mthumb -arch armv7 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
 
   make distclean >/dev/null 2>&1
   ./configure --host=arm-apple-darwin10 --prefix="$IOS32_PREFIX" \
@@ -96,8 +103,8 @@ build_ios() {
   make -j${PROCESSORS} install || exit 1
 
   ## 32-bit armv7s iOS
-  export CFLAGS="-fembed-bitcode -O2 -mthumb -arch armv7s -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export CFLAGS="-O2 -mthumb -arch armv7s -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -mthumb -arch armv7s -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export LDFLAGS="-mthumb -arch armv7s -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
 
   make distclean >/dev/null 2>&1
   ./configure --host=arm-apple-darwin10 --prefix="$IOS32s_PREFIX" \
@@ -105,8 +112,8 @@ build_ios() {
   make -j${PROCESSORS} install || exit 1
 
   ## 64-bit iOS
-  export CFLAGS="-fembed-bitcode -O2 -arch arm64 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export CFLAGS="-O2 -arch arm64 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch arm64 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
+  export LDFLAGS="-arch arm64 -isysroot ${SDK} -mios-version-min=${IOS_VERSION_MIN}"
 
   make distclean >/dev/null 2>&1
   ./configure --host=arm-apple-darwin10 --prefix="$IOS64_PREFIX" \
@@ -121,8 +128,8 @@ build_ios_simulator() {
 
   ## arm64 simulator
   if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    export CFLAGS="-fembed-bitcode -O2 -arch arm64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+    export CFLAGS="-O2 -arch arm64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
-    export LDFLAGS="-fembed-bitcode -arch arm64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+    export LDFLAGS="-arch arm64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
 
     make distclean >/dev/null 2>&1
     ./configure --host=arm-apple-darwin20 --prefix="$IOS_SIMULATOR_ARM64_PREFIX" \
@@ -131,8 +138,8 @@ build_ios_simulator() {
   fi
 
   ## i386 simulator
-  export CFLAGS="-fembed-bitcode -O2 -arch i386 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+  export CFLAGS="-O2 -arch i386 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch i386 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+  export LDFLAGS="-arch i386 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
 
   make distclean >/dev/null 2>&1
   ./configure --host=i686-apple-darwin10 --prefix="$IOS_SIMULATOR_I386_PREFIX" \
@@ -140,8 +147,8 @@ build_ios_simulator() {
   make -j${PROCESSORS} install || exit 1
 
   ## x86_64 simulator
-  export CFLAGS="-fembed-bitcode -O2 -arch x86_64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+  export CFLAGS="-O2 -arch x86_64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch x86_64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
+  export LDFLAGS="-arch x86_64 -isysroot ${SDK} -mios-simulator-version-min=${IOS_SIMULATOR_VERSION_MIN}"
 
   make distclean >/dev/null 2>&1
   ./configure --host=x86_64-apple-darwin10 --prefix="$IOS_SIMULATOR_X86_64_PREFIX" \
@@ -155,8 +162,8 @@ build_watchos() {
   export SDK="${BASEDIR}/SDKs/WatchOS.sdk"
 
   # 32-bit watchOS
-  export CFLAGS="-fembed-bitcode -O2 -mthumb -arch armv7k -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+  export CFLAGS="-O2 -mthumb -arch armv7k -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -mthumb -arch armv7k -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+  export LDFLAGS="-mthumb -arch armv7k -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
 
   make distclean >/dev/null 2>&1
   ./configure --host=arm-apple-darwin10 --prefix="$WATCHOS32_PREFIX" \
@@ -164,13 +171,22 @@ build_watchos() {
   make -j${PROCESSORS} install || exit 1
 
   ## 64-bit arm64_32 watchOS
-  export CFLAGS="-fembed-bitcode -O2 -mthumb -arch arm64_32 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+  export CFLAGS="-O2 -mthumb -arch arm64_32 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -mthumb -arch arm64_32 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+  export LDFLAGS="-mthumb -arch arm64_32 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
 
   make distclean >/dev/null 2>&1
   ./configure --host=arm-apple-darwin10 --prefix="$WATCHOS64_32_PREFIX" \
     ${LIBSODIUM_ENABLE_MINIMAL_FLAG} || exit 1
   make -j${PROCESSORS} install || exit 1
+
+  ## 64-bit arm64 watchOS
+  export CFLAGS="-O2 -mthumb -arch arm64 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+  export LDFLAGS="-mthumb -arch arm64 -isysroot ${SDK} -mwatchos-version-min=${WATCHOS_VERSION_MIN}"
+
+  make distclean >/dev/null 2>&1
+  ./configure --host=arm-apple-darwin10 --prefix="$WATCHOS64_PREFIX" \
+    ${LIBSODIUM_ENABLE_MINIMAL_FLAG} || exit 1
+  make -j${PROCESSORS} install || exit 1
 }
 
 build_watchos_simulator() {
@@ -180,8 +196,8 @@ build_watchos_simulator() {
 
   ## arm64 simulator
   if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    export CFLAGS="-fembed-bitcode -O2 -arch arm64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+    export CFLAGS="-O2 -arch arm64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
-    export LDFLAGS="-fembed-bitcode -arch arm64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+    export LDFLAGS="-arch arm64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
 
     make distclean >/dev/null 2>&1
     ./configure --host=arm-apple-darwin20 --prefix="$WATCHOS_SIMULATOR_ARM64_PREFIX" \
@@ -190,8 +206,8 @@ build_watchos_simulator() {
   fi
 
   ## i386 simulator
-  export CFLAGS="-fembed-bitcode -O2 -arch i386 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+  export CFLAGS="-O2 -arch i386 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch i386 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+  export LDFLAGS="-arch i386 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
 
   make distclean >/dev/null 2>&1
   ./configure --host=i686-apple-darwin10 --prefix="$WATCHOS_SIMULATOR_I386_PREFIX" \
@@ -199,8 +215,8 @@ build_watchos_simulator() {
   make -j${PROCESSORS} install || exit 1
 
   ## x86_64 simulator
-  export CFLAGS="-fembed-bitcode -O2 -arch x86_64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+  export CFLAGS="-O2 -arch x86_64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch x86_64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
+  export LDFLAGS="-arch x86_64 -isysroot ${SDK} -mwatchos-simulator-version-min=${WATCHOS_SIMULATOR_VERSION_MIN}"
 
   make distclean >/dev/null 2>&1
   ./configure --host=x86_64-apple-darwin10 --prefix="$WATCHOS_SIMULATOR_X86_64_PREFIX" \
@@ -214,8 +230,8 @@ build_tvos() {
   export SDK="${BASEDIR}/SDKs/AppleTVOS.sdk"
 
   ## 64-bit tvOS
-  export CFLAGS="-fembed-bitcode -O2 -arch arm64 -isysroot ${SDK} -mtvos-version-min=${TVOS_VERSION_MIN}"
+  export CFLAGS="-O2 -arch arm64 -isysroot ${SDK} -mtvos-version-min=${TVOS_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch arm64 -isysroot ${SDK} -mtvos-version-min=${TVOS_VERSION_MIN}"
+  export LDFLAGS="-arch arm64 -isysroot ${SDK} -mtvos-version-min=${TVOS_VERSION_MIN}"
 
   make distclean >/dev/null 2>&1
   ./configure --host=arm-apple-darwin10 --prefix="$TVOS64_PREFIX" \
@@ -230,8 +246,8 @@ build_tvos_simulator() {
 
   ## arm64 simulator
   if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    export CFLAGS="-fembed-bitcode -O2 -arch arm64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
+    export CFLAGS="-O2 -arch arm64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
-    export LDFLAGS="-fembed-bitcode -arch arm64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
+    export LDFLAGS="-arch arm64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
 
     make distclean >/dev/null 2>&1
     ./configure --host=arm-apple-darwin20 --prefix="$TVOS_SIMULATOR_ARM64_PREFIX" \
@@ -240,8 +256,8 @@ build_tvos_simulator() {
   fi
 
   ## x86_64 simulator
-  export CFLAGS="-fembed-bitcode -O2 -arch x86_64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
+  export CFLAGS="-O2 -arch x86_64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
-  export LDFLAGS="-fembed-bitcode -arch x86_64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
+  export LDFLAGS="-arch x86_64 -isysroot ${SDK} -mtvos-simulator-version-min=${TVOS_SIMULATOR_VERSION_MIN}"
 
   make distclean >/dev/null 2>&1
   ./configure --host=x86_64-apple-darwin10 --prefix="$TVOS_SIMULATOR_X86_64_PREFIX" \
@@ -276,23 +292,29 @@ build_catalyst() {
 }
 
 mkdir -p "${PREFIX}/tmp"
+
 echo "Building for macOS..."
 build_macos >"$LOG_FILE" 2>&1 || exit 1
 echo "Building for iOS..."
 build_ios >"$LOG_FILE" 2>&1 || exit 1
-echo "Building for the iOS simulator..."
-build_ios_simulator >"$LOG_FILE" 2>&1 || exit 1
 echo "Building for watchOS..."
 build_watchos >"$LOG_FILE" 2>&1 || exit 1
-echo "Building for the watchOS simulator..."
-build_watchos_simulator >"$LOG_FILE" 2>&1 || exit 1
 echo "Building for tvOS..."
 build_tvos >"$LOG_FILE" 2>&1 || exit 1
-echo "Building for the tvOS simulator..."
-build_tvos_simulator >"$LOG_FILE" 2>&1 || exit 1
 echo "Building for Catalyst..."
 build_catalyst >"$LOG_FILE" 2>&1 || exit 1
 
+if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then
+  echo "Building for the iOS simulator..."
+  build_ios_simulator >"$LOG_FILE" 2>&1 || exit 1
+  echo "Building for the watchOS simulator..."
+  build_watchos_simulator >"$LOG_FILE" 2>&1 || exit 1
+  echo "Building for the tvOS simulator..."
+  build_tvos_simulator >"$LOG_FILE" 2>&1 || exit 1
+  else
+  echo "[Skipping the simulators]"
+fi
+
 echo "Adding the Clibsodium module map for Swift..."
 
 find "$PREFIX" -name "include" -type d -print | while read -r f; do
@@ -328,25 +350,6 @@ for ext in a dylib; do
     -output "$PREFIX/ios/lib/libsodium.${ext}"
 done
 
-echo "Bundling iOS simulators..."
-
-mkdir -p "${PREFIX}/ios-simulators/lib"
-cp -a "${IOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/ios-simulators/"
-for ext in a dylib; do
-  if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    lipo -create \
-      "${IOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
-      "${IOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
-      "${IOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/ios-simulators/lib/libsodium.${ext}" || exit 1
-  else
-    lipo -create \
-      "${IOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
-      "${IOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/ios-simulators/lib/libsodium.${ext}" || exit 1
-  fi
-done
-
 echo "Bundling watchOS targets..."
 
 mkdir -p "${PREFIX}/watchos/lib"
@@ -355,28 +358,10 @@ for ext in a dylib; do
   lipo -create \
     "${WATCHOS32_PREFIX}/lib/libsodium.${ext}" \
     "${WATCHOS64_32_PREFIX}/lib/libsodium.${ext}" \
+    "${WATCHOS64_PREFIX}/lib/libsodium.${ext}" \
     -output "${PREFIX}/watchos/lib/libsodium.${ext}"
 done
 
-echo "Bundling watchOS simulators..."
-
-mkdir -p "${PREFIX}/watchos-simulators/lib"
-cp -a "${WATCHOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/watchos-simulators/"
-for ext in a dylib; do
-  if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    lipo -create \
-      "${WATCHOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
-      "${WATCHOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
-      "${WATCHOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/watchos-simulators/lib/libsodium.${ext}"
-  else
-    lipo -create \
-      "${WATCHOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
-      "${WATCHOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/watchos-simulators/lib/libsodium.${ext}"
-  fi
-done
-
 echo "Bundling tvOS targets..."
 
 mkdir -p "${PREFIX}/tvos/lib"
@@ -387,23 +372,6 @@ for ext in a dylib; do
     -output "$PREFIX/tvos/lib/libsodium.${ext}"
 done
 
-echo "Bundling tvOS simulators..."
-
-mkdir -p "${PREFIX}/tvos-simulators/lib"
-cp -a "${TVOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/tvos-simulators/"
-for ext in a dylib; do
-  if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
-    lipo -create \
-      "${TVOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
-      "${TVOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/tvos-simulators/lib/libsodium.${ext}" || exit 1
-  else
-    lipo -create \
-      "${TVOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
-      -output "${PREFIX}/tvos-simulators/lib/libsodium.${ext}" || exit 1
-  fi
-done
-
 echo "Bundling Catalyst targets..."
 
 mkdir -p "${PREFIX}/catalyst/lib"
@@ -424,15 +392,78 @@ for ext in a dylib; do
   fi
 done
 
+if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then
+  echo "Bundling iOS simulators..."
+
+  mkdir -p "${PREFIX}/ios-simulators/lib"
+  cp -a "${IOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/ios-simulators/"
+  for ext in a dylib; do
+    if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
+      lipo -create \
+        "${IOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
+        "${IOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
+        "${IOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/ios-simulators/lib/libsodium.${ext}" || exit 1
+    else
+      lipo -create \
+        "${IOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
+        "${IOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/ios-simulators/lib/libsodium.${ext}" || exit 1
+    fi
+  done
+
+  echo "Bundling watchOS simulators..."
+
+  mkdir -p "${PREFIX}/watchos-simulators/lib"
+  cp -a "${WATCHOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/watchos-simulators/"
+  for ext in a dylib; do
+    if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
+      lipo -create \
+        "${WATCHOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
+        "${WATCHOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
+        "${WATCHOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/watchos-simulators/lib/libsodium.${ext}"
+    else
+      lipo -create \
+        "${WATCHOS_SIMULATOR_I386_PREFIX}/lib/libsodium.${ext}" \
+        "${WATCHOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/watchos-simulators/lib/libsodium.${ext}"
+    fi
+  done
+
+  echo "Bundling tvOS simulators..."
+
+  mkdir -p "${PREFIX}/tvos-simulators/lib"
+  cp -a "${TVOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/tvos-simulators/"
+  for ext in a dylib; do
+    if [ "$APPLE_SILICON_SUPPORTED" = "true" ]; then
+      lipo -create \
+        "${TVOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
+        "${TVOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/tvos-simulators/lib/libsodium.${ext}" || exit 1
+    else
+      lipo -create \
+        "${TVOS_SIMULATOR_X86_64_PREFIX}/lib/libsodium.${ext}" \
+        -output "${PREFIX}/tvos-simulators/lib/libsodium.${ext}" || exit 1
+    fi
+  done
+fi
+
 echo "Creating Clibsodium.xcframework..."
 
 rm -rf "${PREFIX}/Clibsodium.xcframework"
 
 XCFRAMEWORK_ARGS=""
-for f in macos ios ios-simulators watchos watchos-simulators tvos tvos-simulators catalyst; do
+for f in macos ios watchos tvos catalyst; do
   XCFRAMEWORK_ARGS="${XCFRAMEWORK_ARGS} -library ${PREFIX}/${f}/lib/libsodium.a"
   XCFRAMEWORK_ARGS="${XCFRAMEWORK_ARGS} -headers ${PREFIX}/${f}/include"
 done
+if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then
+  for f in ios-simulators watchos-simulators tvos-simulators; do
+    XCFRAMEWORK_ARGS="${XCFRAMEWORK_ARGS} -library ${PREFIX}/${f}/lib/libsodium.a"
+    XCFRAMEWORK_ARGS="${XCFRAMEWORK_ARGS} -headers ${PREFIX}/${f}/include"
+  done
+fi
 xcodebuild -create-xcframework \
   ${XCFRAMEWORK_ARGS} \
   -output "${PREFIX}/Clibsodium.xcframework" >/dev/null

deps/libsodium/dist-build/emscripten-symbols.def

@@ -289,10 +289,10 @@ _crypto_onetimeauth_primitive 0 1
 _crypto_onetimeauth_statebytes 0 1
 _crypto_onetimeauth_update 0 1
 _crypto_onetimeauth_verify 0 1
-_crypto_pwhash 1 1
+_crypto_pwhash 0 1
-_crypto_pwhash_alg_argon2i13 1 1
+_crypto_pwhash_alg_argon2i13 0 1
-_crypto_pwhash_alg_argon2id13 1 1
+_crypto_pwhash_alg_argon2id13 0 1
-_crypto_pwhash_alg_default 1 1
+_crypto_pwhash_alg_default 0 1
 _crypto_pwhash_argon2i 0 1
 _crypto_pwhash_argon2i_alg_argon2i13 0 1
 _crypto_pwhash_argon2i_bytes_max 0 1
@@ -337,22 +337,22 @@ _crypto_pwhash_argon2id_str_needs_rehash 0 1
 _crypto_pwhash_argon2id_str_verify 0 1
 _crypto_pwhash_argon2id_strbytes 0 1
 _crypto_pwhash_argon2id_strprefix 0 1
-_crypto_pwhash_bytes_max 1 1
+_crypto_pwhash_bytes_max 0 1
-_crypto_pwhash_bytes_min 1 1
+_crypto_pwhash_bytes_min 0 1
-_crypto_pwhash_memlimit_interactive 1 1
+_crypto_pwhash_memlimit_interactive 0 1
-_crypto_pwhash_memlimit_max 1 1
+_crypto_pwhash_memlimit_max 0 1
-_crypto_pwhash_memlimit_min 1 1
+_crypto_pwhash_memlimit_min 0 1
-_crypto_pwhash_memlimit_moderate 1 1
+_crypto_pwhash_memlimit_moderate 0 1
-_crypto_pwhash_memlimit_sensitive 1 1
+_crypto_pwhash_memlimit_sensitive 0 1
-_crypto_pwhash_opslimit_interactive 1 1
+_crypto_pwhash_opslimit_interactive 0 1
-_crypto_pwhash_opslimit_max 1 1
+_crypto_pwhash_opslimit_max 0 1
-_crypto_pwhash_opslimit_min 1 1
+_crypto_pwhash_opslimit_min 0 1
-_crypto_pwhash_opslimit_moderate 1 1
+_crypto_pwhash_opslimit_moderate 0 1
-_crypto_pwhash_opslimit_sensitive 1 1
+_crypto_pwhash_opslimit_sensitive 0 1
-_crypto_pwhash_passwd_max 1 1
+_crypto_pwhash_passwd_max 0 1
-_crypto_pwhash_passwd_min 1 1
+_crypto_pwhash_passwd_min 0 1
 _crypto_pwhash_primitive 0 1
-_crypto_pwhash_saltbytes 1 1
+_crypto_pwhash_saltbytes 0 1
 _crypto_pwhash_scryptsalsa208sha256 0 1
 _crypto_pwhash_scryptsalsa208sha256_bytes_max 0 1
 _crypto_pwhash_scryptsalsa208sha256_bytes_min 0 1
@@ -373,12 +373,12 @@ _crypto_pwhash_scryptsalsa208sha256_str_needs_rehash 0 1
 _crypto_pwhash_scryptsalsa208sha256_str_verify 0 1
 _crypto_pwhash_scryptsalsa208sha256_strbytes 0 1
 _crypto_pwhash_scryptsalsa208sha256_strprefix 0 1
-_crypto_pwhash_str 1 1
+_crypto_pwhash_str 0 1
-_crypto_pwhash_str_alg 1 1
+_crypto_pwhash_str_alg 0 1
-_crypto_pwhash_str_needs_rehash 1 1
+_crypto_pwhash_str_needs_rehash 0 1
-_crypto_pwhash_str_verify 1 1
+_crypto_pwhash_str_verify 0 1
-_crypto_pwhash_strbytes 1 1
+_crypto_pwhash_strbytes 0 1
-_crypto_pwhash_strprefix 1 1
+_crypto_pwhash_strprefix 0 1
 _crypto_scalarmult 1 1
 _crypto_scalarmult_base 1 1
 _crypto_scalarmult_bytes 1 1

deps/libsodium/dist-build/generate-emscripten-symbols.sh

@@ -2,6 +2,8 @@
 
 set -e
 
+LIBSODIUM=${LIBSODIUM:-/tmp/sodium/lib/libsodium.23.dylib}
+
 symbols() {
   {
     SUMO="$1"
@@ -17,8 +19,8 @@ symbols() {
       fi
     done < emscripten-symbols.def
 
-    /usr/bin/nm /usr/local/lib/libsodium.23.dylib | \
+    /usr/bin/nm "$LIBSODIUM" |
-    fgrep ' T _' | \
+      fgrep ' T _' |
       cut -d' ' -f3 | {
       while read symbol; do
         eval "found=\$defined_${symbol}"

deps/libsodium/dist-build/wasm32-wasi.sh

@@ -7,8 +7,8 @@ export PREFIX="$(pwd)/libsodium-wasm32-wasi"
 mkdir -p $PREFIX || exit 1
 
 export CC="zig cc"
-export CFLAGS="--target=wasm32-wasi -O2"
+export CFLAGS="--target=wasm32-wasi -O3"
-export LDFLAGS="-s -Wl,--stack-first"
+export LDFLAGS="-s"
 export AR="zig ar"
 export RANLIB="zig ranlib"
 
@@ -16,7 +16,7 @@ make distclean >/dev/null
 
 if [ "x$1" = "x--bench" ]; then
   export BENCHMARKS=1
-  export CPPFLAGS="-DBENCHMARKS -DITERATIONS=100"
+  export CPPFLAGS="-DBENCHMARKS -DITERATIONS=200"
 else
   export CPPFLAGS="-DED25519_NONDETERMINISTIC=1"
 fi

deps/libsodium/m4/ax_check_catchable_segv.m4

@@ -24,6 +24,8 @@ size_t i;
 signal(SIGSEGV, sig);
 signal(SIGBUS, sig);
 #if !defined(__SANITIZE_ADDRESS__) && !defined(__EMSCRIPTEN__)
+*((volatile unsigned char *) -1) = 0xd0;
+*((volatile unsigned char *) 1) = 0xd0;
 for (i = 0; i < 10000000; i += 1024) { x[-i] = x[i] = (unsigned char) i; }
 #endif
 free((void *) x);

deps/libsodium/packaging/dotnet-core/libsodium.pkgproj

@@ -9,7 +9,7 @@
 
   <PropertyGroup>
     <PackageId>libsodium</PackageId>
-    <Version>1.0.18.2</Version>
+    <Version>1.0.18.4</Version>
     <Authors>Frank Denis</Authors>
     <Description>Internal implementation package not meant for direct consumption. Please do not reference directly.</Description>
     <Copyright>&#169; $([System.DateTime]::UtcNow.ToString(yyyy)) Frank Denis</Copyright>
@@ -28,9 +28,11 @@
     <Content Include="runtimes/win-x64/native/libsodium.dll" PackagePath="runtimes/win-x64/native/" />
     <Content Include="runtimes/win-x86/native/libsodium.dll" PackagePath="runtimes/win-x86/native/" />
     <Content Include="runtimes/linux-x64/native/libsodium.so" PackagePath="runtimes/linux-x64/native/" />
-    <Content Include="runtimes/linux-arm64/native/libsodium.so" PackagePath="runtimes/linux-arm64/native/" />
     <Content Include="runtimes/linux-arm/native/libsodium.so" PackagePath="runtimes/linux-arm/native/" />
+    <Content Include="runtimes/linux-arm64/native/libsodium.so" PackagePath="runtimes/linux-arm64/native/" />
     <Content Include="runtimes/linux-musl-x64/native/libsodium.so" PackagePath="runtimes/linux-musl-x64/native/" />
+    <Content Include="runtimes/linux-musl-arm/native/libsodium.so" PackagePath="runtimes/linux-musl-arm/native/" />
+    <Content Include="runtimes/linux-musl-arm64/native/libsodium.so" PackagePath="runtimes/linux-musl-arm64/native/" />
     <Content Include="runtimes/osx-x64/native/libsodium.dylib" PackagePath="runtimes/osx-x64/native/" />
     <Content Include="runtimes/osx-arm64/native/libsodium.dylib" PackagePath="runtimes/osx-arm64/native/" />    
   </ItemGroup>

deps/libsodium/packaging/nuget/package.config

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- These values are populated into the package.gsl templates by package.bat. -->
 <!-- The target attribute controls path and file name only, id controls package naming. -->
-<package id="libsodium_vc120" target="libsodium" version = "1.0.18.2" pathversion="1_0_18_2" platformtoolset="v120" />
+<package id="libsodium_vc120" target="libsodium" version = "1.0.18.4" pathversion="1_0_18_4" platformtoolset="v120" />

deps/libsodium/src/libsodium/crypto_pwhash/argon2/argon2.c

@@ -17,6 +17,7 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "randombytes.h"
 #include "utils.h"
 
 #include "argon2-core.h"
@@ -93,6 +94,10 @@ argon2_hash(const uint32_t t_cost, const uint32_t m_cost,
     int            result;
     uint8_t       *out;
 
+    if (hash != NULL) {
+        randombytes_buf(hash, hashlen);
+    }
+
     if (pwdlen > ARGON2_MAX_PWD_LENGTH) {
         return ARGON2_PWD_TOO_LONG;
     }

deps/libsodium/src/libsodium/crypto_pwhash/scryptsalsa208sha256/crypto_scrypt-common.c

@@ -24,6 +24,7 @@
 #include "crypto_pwhash_scryptsalsa208sha256.h"
 #include "crypto_scrypt.h"
 #include "private/common.h"
+#include "randombytes.h"
 #include "runtime.h"
 #include "utils.h"
 
@@ -150,6 +151,10 @@ escrypt_r(escrypt_local_t *local, const uint8_t *passwd, size_t passwdlen,
     uint32_t       r;
     uint32_t       p;
 
+    if (buf != NULL) {
+        randombytes_buf(buf, buflen);
+    }
+
     src = escrypt_parse_setting(setting, &N_log2, &r, &p);
     if (!src) {
         return NULL;

deps/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c

@@ -74,7 +74,7 @@ crypto_scalarmult_curve25519_ref10(unsigned char *q,
                                    const unsigned char *n,
                                    const unsigned char *p)
 {
-    unsigned char *t = q;
+    unsigned char  t[32];
     unsigned int   i;
     fe25519        x1;
     fe25519        x2;
@@ -136,6 +136,8 @@ crypto_scalarmult_curve25519_ref10(unsigned char *q,
     fe25519_mul(x2, x2, z2);
     fe25519_tobytes(q, x2);
 
+    sodium_memzero(t, sizeof t);
+
     return 0;
 }
 

deps/libsodium/src/libsodium/crypto_scalarmult/curve25519/sandy2x/curve25519_sandy2x.c

@@ -24,7 +24,7 @@ static int
 crypto_scalarmult_curve25519_sandy2x(unsigned char *q, const unsigned char *n,
                                      const unsigned char *p)
 {
-  unsigned char *t = q;
+    unsigned char  t[32];
     fe             var[3];
     fe51           x_51;
     fe51           z_51;
@@ -57,6 +57,8 @@ crypto_scalarmult_curve25519_sandy2x(unsigned char *q, const unsigned char *n,
     fe51_mul(&x_51, &x_51, &z_51);
     fe51_pack(q, &x_51);
 
+    sodium_memzero(t, sizeof t);
+
     return 0;
 }
 

deps/libsodium/src/libsodium/crypto_stream/salsa20/xmm6int/u0.h

@@ -5,7 +5,7 @@ if (bytes > 0) {
     __m128i diag3 = _mm_loadu_si128((const __m128i *) (x + 12));
     __m128i a0, a1, a2, a3, a4, a5, a6, a7;
     __m128i b0, b1, b2, b3, b4, b5, b6, b7;
-    uint8_t partialblock[64];
+    uint8_t partialblock[64] = { 0 };
 
     unsigned int i;
 

deps/libsodium/src/libsodium/sodium/utils.c

@@ -121,7 +121,7 @@ _sodium_dummy_symbol_to_prevent_memzero_lto(void *const  pnt,
 void
 sodium_memzero(void * const pnt, const size_t len)
 {
-#ifdef _WIN32
+#if defined(_WIN32) && !defined(__CRT_INLINE)
     SecureZeroMemory(pnt, len);
 #elif defined(HAVE_MEMSET_S)
     if (len > 0U && memset_s(pnt, (rsize_t) len, 0, (rsize_t) len) != 0) {
@@ -129,6 +129,8 @@ sodium_memzero(void * const pnt, const size_t len)
     }
 #elif defined(HAVE_EXPLICIT_BZERO)
     explicit_bzero(pnt, len);
+#elif defined(HAVE_MEMSET_EXPLICIT)
+    memset_explicit(pnt, 0, len);
 #elif defined(HAVE_EXPLICIT_MEMSET)
     explicit_memset(pnt, 0, len);
 #elif HAVE_WEAK_SYMBOLS
@@ -614,7 +616,7 @@ _sodium_malloc(const size_t size)
     memcpy(unprotected_ptr + unprotected_size, canary, sizeof canary);
 # endif
     _mprotect_noaccess(unprotected_ptr + unprotected_size, page_size);
-    sodium_mlock(unprotected_ptr, unprotected_size);
+    (void) sodium_mlock(unprotected_ptr, unprotected_size); /* not a hard error in the context of sodium_malloc() */
     canary_ptr =
         unprotected_ptr + _page_round(size_with_canary) - size_with_canary;
     user_ptr = canary_ptr + sizeof canary;
@@ -684,7 +686,7 @@ sodium_free(void *ptr)
         _out_of_bounds();
     }
 # endif
-    sodium_munlock(unprotected_ptr, unprotected_size);
+    (void) sodium_munlock(unprotected_ptr, unprotected_size);
     _free_aligned(base_ptr, total_size);
 }
 #endif /* HAVE_ALIGNED_MALLOC */

deps/libsodium/test/default/Makefile.am

@@ -1,5 +1,6 @@
 
 EXTRA_DIST = \
+	run.sh \
 	cmptest.h \
 	wasi-test-wrapper.sh \
 	wintest.bat \

deps/libsodium/test/default/Makefile.in

@@ -901,6 +901,7 @@ top_srcdir = @top_srcdir@
 valgrind_enabled_tools = @valgrind_enabled_tools@
 valgrind_tools = @valgrind_tools@
 EXTRA_DIST = \
+	run.sh \
 	cmptest.h \
 	wasi-test-wrapper.sh \
 	wintest.bat \

deps/libsodium/test/default/aead_aes256gcm.c

@@ -3081,6 +3081,7 @@ tv(void)
 {
     unsigned char      *ad;
     unsigned char      *ciphertext;
+    unsigned char      *ciphertext2;
     unsigned char      *decrypted;
     unsigned char      *detached_ciphertext;
     unsigned char      *expected_ciphertext;
@@ -3210,6 +3211,32 @@ tv(void)
             printf("Incorrect decryption of test vector #%u\n", (unsigned int) i);
         }
 
+        ciphertext2 = (unsigned char *) sodium_malloc(ciphertext_len);
+        crypto_aead_aes256gcm_encrypt(ciphertext, &found_ciphertext_len, message,
+                                      message_len, ad, ad_len, NULL, nonce, key);
+        assert(found_ciphertext_len == ciphertext_len);
+        memcpy(ciphertext2, message, message_len);
+        crypto_aead_aes256gcm_encrypt(ciphertext2, &found_ciphertext_len,
+                                      ciphertext2, message_len, ad, ad_len, NULL,
+                                      nonce, key);
+        assert(found_ciphertext_len == ciphertext_len);
+        assert(memcmp(ciphertext, ciphertext2, ciphertext_len) == 0);
+        if (crypto_aead_aes256gcm_decrypt(ciphertext2, &found_message_len, NULL,
+                                          ciphertext2, ciphertext_len, ad, ad_len,
+                                          nonce, key) != 0) {
+            printf("In-place decryption of vector #%u failed\n", (unsigned int) i);
+        }
+        assert(found_message_len == message_len);
+        assert(memcmp(ciphertext2, message, message_len) == 0);
+        if (crypto_aead_aes256gcm_decrypt(message, &found_message_len, NULL,
+                                          ciphertext, ciphertext_len, ad, ad_len,
+                                          nonce, key) != 0) {
+            printf("Decryption of vector #%u failed\n", (unsigned int) i);
+        }
+        assert(found_message_len == message_len);
+        assert(memcmp(ciphertext2, message, message_len) == 0);
+
+        sodium_free(ciphertext2);
         sodium_free(message);
         sodium_free(ad);
         sodium_free(expected_ciphertext);
@@ -3225,11 +3252,54 @@ tv(void)
     return 0;
 }
 
+static int
+tv2(void)
+{
+    unsigned char *ciphertext;
+    unsigned char *message;
+    unsigned char *message2;
+    unsigned char *nonce;
+    unsigned char *key;
+    size_t         message_len;
+    size_t         ciphertext_len;
+    int            i;
+
+    for (i = 0; i < 250; i++) {
+        message_len = randombytes_uniform(1000);
+        ciphertext_len = message_len + crypto_aead_aes256gcm_ABYTES;
+        message = (unsigned char *) sodium_malloc(message_len);
+        message2 = (unsigned char *) sodium_malloc(message_len);
+        ciphertext = (unsigned char *) sodium_malloc(ciphertext_len);
+        nonce = (unsigned char *) sodium_malloc(crypto_aead_aes256gcm_NPUBBYTES);
+        key = (unsigned char *) sodium_malloc(crypto_aead_aes256gcm_KEYBYTES);
+
+        crypto_aead_aes256gcm_keygen(key);
+        randombytes_buf(nonce, crypto_aead_aes256gcm_NPUBBYTES);
+        randombytes_buf(message, message_len);
+        crypto_aead_aes256gcm_encrypt(ciphertext, NULL, message, message_len,
+                                      NULL, 0, NULL, nonce, key);
+        if (crypto_aead_aes256gcm_decrypt(message2, NULL, NULL,
+                                          ciphertext, ciphertext_len,
+                                          NULL, 0, nonce, key) != 0) {
+            printf("Decryption of random ciphertext failed");
+        }
+        assert(message_len == 0 || memcmp(message, message2, message_len) == 0);
+        sodium_free(key);
+        sodium_free(nonce);
+        sodium_free(ciphertext);
+        sodium_free(message2);
+        sodium_free(message);
+    }
+
+    return 0;
+}
+
 int
 main(void)
 {
     if (crypto_aead_aes256gcm_is_available()) {
         tv();
+        tv2();
     }
     assert(crypto_aead_aes256gcm_keybytes() == crypto_aead_aes256gcm_KEYBYTES);
     assert(crypto_aead_aes256gcm_nsecbytes() == crypto_aead_aes256gcm_NSECBYTES);

deps/libsodium/test/default/cmptest.h

@@ -118,16 +118,23 @@ static int mempool_free_all(void)
 
 static unsigned long long now(void)
 {
+#if defined(HAVE_CLOCK_GETTIME) && defined(CLOCK_MONOTONIC)
+    struct timespec tp;
+
+    if (clock_gettime(CLOCK_MONOTONIC, &tp) != 0) {
+        abort();
+    }
+    return (unsigned long long) tp.tv_sec * 1000000ULL +
+        (unsigned long long) tp.tv_nsec / 1000ULL;
+#else
     struct timeval tp;
-    unsigned long long now;
 
     if (gettimeofday(&tp, NULL) != 0) {
         abort();
     }
-    now = ((unsigned long long) tp.tv_sec * 1000000ULL) +
+    return (unsigned long long) tp.tv_sec * 1000000ULL +
         (unsigned long long) tp.tv_usec;
-
+#endif
-    return now;
 }
 
 int main(void)

deps/libsodium/test/default/misuse.c

@@ -4,12 +4,15 @@
 
 #ifdef HAVE_CATCHABLE_ABRT
 # include <signal.h>
+#ifndef _WIN32
+# include <unistd.h>
+#endif
 
 static void
 sigabrt_handler_15(int sig)
 {
     (void) sig;
-    exit(0);
+    _exit(0);
 }
 
 # ifndef SODIUM_LIBRARY_MINIMAL
@@ -21,7 +24,7 @@ sigabrt_handler_14(int sig)
     assert(crypto_box_curve25519xchacha20poly1305_easy
            (guard_page, guard_page, crypto_stream_xchacha20_MESSAGEBYTES_MAX - 1,
             guard_page, guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -32,7 +35,7 @@ sigabrt_handler_13(int sig)
     assert(crypto_box_curve25519xchacha20poly1305_easy_afternm
            (guard_page, guard_page, crypto_stream_xchacha20_MESSAGEBYTES_MAX - 1,
             guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }
 # endif
 
@@ -47,7 +50,7 @@ sigabrt_handler_12(int sig)
 # endif
     assert(crypto_pwhash_str_alg((char *) guard_page,
                                  "", 0U, 1U, 1U, -1) == -1);
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -58,7 +61,7 @@ sigabrt_handler_11(int sig)
     assert(crypto_box_easy(guard_page, guard_page,
                            crypto_stream_xsalsa20_MESSAGEBYTES_MAX,
                            guard_page, guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -69,7 +72,7 @@ sigabrt_handler_10(int sig)
     assert(crypto_box_easy_afternm(guard_page, guard_page,
                                    crypto_stream_xsalsa20_MESSAGEBYTES_MAX,
                                    guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -79,7 +82,7 @@ sigabrt_handler_9(int sig)
     signal(SIGABRT, sigabrt_handler_10);
     assert(sodium_base642bin(guard_page, 1, (const char *) guard_page, 1,
                              NULL, NULL, NULL, -1) == -1);
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -89,7 +92,7 @@ sigabrt_handler_8(int sig)
     signal(SIGABRT, sigabrt_handler_9);
     assert(sodium_bin2base64((char *) guard_page, 1, guard_page, 1,
                              sodium_base64_VARIANT_ORIGINAL) == NULL);
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -99,7 +102,7 @@ sigabrt_handler_7(int sig)
     signal(SIGABRT, sigabrt_handler_8);
     assert(sodium_bin2base64((char *) guard_page, 1,
                              guard_page, 1, -1) == NULL);
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -108,7 +111,7 @@ sigabrt_handler_6(int sig)
     (void) sig;
     signal(SIGABRT, sigabrt_handler_7);
     assert(sodium_pad(NULL, guard_page, SIZE_MAX, 16, 1) == -1);
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -119,7 +122,7 @@ sigabrt_handler_5(int sig)
     assert(crypto_aead_xchacha20poly1305_ietf_encrypt(guard_page, NULL, NULL, UINT64_MAX,
                                                       NULL, 0, NULL,
                                                       guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -130,7 +133,7 @@ sigabrt_handler_4(int sig)
     assert(crypto_aead_chacha20poly1305_ietf_encrypt(guard_page, NULL, NULL, UINT64_MAX,
                                                      NULL, 0, NULL,
                                                      guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -141,7 +144,7 @@ sigabrt_handler_3(int sig)
     assert(crypto_aead_chacha20poly1305_encrypt(guard_page, NULL, NULL, UINT64_MAX,
                                                 NULL, 0, NULL,
                                                 guard_page, guard_page) == -1);
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -154,7 +157,7 @@ sigabrt_handler_2(int sig)
 #else
     abort();
 #endif
-    exit(1);
+    _exit(1);
 }
 
 static void
@@ -164,7 +167,7 @@ sigabrt_handler_1(int sig)
     signal(SIGABRT, sigabrt_handler_2);
     assert(crypto_kx_server_session_keys(NULL, NULL, guard_page, guard_page,
                                          guard_page) == -1);
-    exit(1);
+    _exit(1);
 }
 
 int

deps/libsodium/test/default/pwhash_argon2i.c

@@ -290,11 +290,25 @@ str_tests(void)
         -1) {
         printf("pwhash_str() with a small opslimit should have failed\n");
     }
-    if (crypto_pwhash_argon2i_str_verify("$argon2i$m=65536,t=2,p=1c29tZXNhbHQ"
+    {
-                                         "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ",
+        const char *str_in_ = "$argon2i$m=65536,t=2,p=1c29tZXNhbHQ"
-                                         "password", 0x100000000ULL) != -1) {
+            "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ";
+        char       *str_in = (char *) sodium_malloc(strlen(str_in_) + 1U);
+
+        const char *password_in_ = "password";
+        char       *password_in = (char *) sodium_malloc(strlen(password_in_) + 1U);
+
+        memcpy(str_in, str_in_, strlen(str_in_) + 1U);
+        memcpy(password_in, password_in_, strlen(password_in_) + 1U);
+
+        if (crypto_pwhash_argon2i_str_verify(str_in, password_in,
+                                             0x100000000ULL) != -1) {
             printf("pwhash_str_verify(invalid(0)) failure\n");
         }
+
+        sodium_free(password_in);
+        sodium_free(str_in);
+    }
     if (crypto_pwhash_argon2i_str_verify("$argon2i$m=65536,t=2,p=1c29tZXNhbHQ"
                                  "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ",
                                  "password", strlen("password")) != -1) {

deps/libsodium/test/default/pwhash_argon2id.c

@@ -304,11 +304,25 @@ str_tests(void)
     if (crypto_pwhash_str(str_out2, passwd, strlen(passwd), 0, MEMLIMIT) != -1) {
         printf("pwhash_argon2id_str() with a null opslimit should have failed\n");
     }
-    if (crypto_pwhash_str_verify("$argon2id$m=65536,t=2,p=1c29tZXNhbHQ"
+    {
-                                 "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ",
+        const char *str_in_ ="$argon2id$m=65536,t=2,p=1c29tZXNhbHQ"
-                                 "password", 0x100000000ULL) != -1) {
+            "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ";
+        char       *str_in = (char *) sodium_malloc(strlen(str_in_) + 1U);
+
+        const char *password_in_ = "password";
+        char       *password_in = (char *) sodium_malloc(strlen(password_in_) + 1U);
+
+        memcpy(str_in, str_in_, strlen(str_in_) + 1U);
+        memcpy(password_in, password_in_, strlen(password_in_) + 1U);
+
+        if (crypto_pwhash_argon2i_str_verify(str_in, password_in,
+                                             0x100000000ULL) != -1) {
             printf("pwhash_str_verify(invalid(0)) failure\n");
         }
+
+        sodium_free(password_in);
+        sodium_free(str_in);
+    }
     if (crypto_pwhash_str_verify("$argon2id$m=65536,t=2,p=1c29tZXNhbHQ"
                                  "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ",
                                  "password", strlen("password")) != -1) {

deps/libsodium/test/default/run.sh

@@ -0,0 +1,9 @@
+#! /bin/sh
+
+find . -type f -perm -100 -print | grep -v run.sh | sort | while read -r x; do
+  echo "[$x]"
+  if ! "$x"; then
+    echo "*** [$x] FAILED" >&2
+    exit 1
+  fi
+done

deps/libsodium/test/default/sodium_core.c

@@ -31,11 +31,11 @@ main(void)
     (void) sodium_runtime_has_rdrand();
 
     sodium_set_misuse_handler(misuse_handler);
-#ifndef __EMSCRIPTEN__
+#if defined(__EMSCRIPTEN__) || defined(__wasm__) || defined(BENCHMARKS)
+    printf("misuse_handler()\n");
+#else
     sodium_misuse();
     printf("Misuse handler returned\n");
-#else
-    printf("misuse_handler()\n");
 #endif
 
     return 0;

deps/libsodium/test/default/sodium_utils2.c

@@ -6,6 +6,9 @@
 #ifdef HAVE_CATCHABLE_SEGV
 # include <signal.h>
 #endif
+#ifndef _WIN32
+# include <unistd.h>
+#endif
 
 #define TEST_NAME "sodium_utils2"
 #include "cmptest.h"
@@ -36,7 +39,7 @@ segv_handler(int sig)
     signal(SIGABRT, SIG_DFL);
 # endif
 #endif
-    exit(0);
+    _exit(0);
 }
 
 int

deps/libsodium/test/default/sodium_utils3.c

@@ -6,6 +6,9 @@
 #ifdef HAVE_CATCHABLE_SEGV
 # include <signal.h>
 #endif
+#ifndef _WIN32
+# include <unistd.h>
+#endif
 
 #define TEST_NAME "sodium_utils3"
 #include "cmptest.h"
@@ -32,7 +35,7 @@ segv_handler(int sig)
     signal(SIGABRT, SIG_DFL);
 # endif
 #endif
-    exit(0);
+    _exit(0);
 }
 
 int

deps/libsodium/test/default/wasi-test-wrapper.sh

@@ -1,7 +1,5 @@
 #! /bin/sh
 
-MAX_MEMORY_TESTS="67108864"
-
 unset LDFLAGS
 unset CFLAGS
 
@@ -9,36 +7,6 @@ if command -v wasm-opt >/dev/null; then
   wasm-opt -O4 -o "${1}.tmp" "$1" && mv -f "${1}.tmp" "$1"
 fi
 
-if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wavm" ]; then
-  if command -v wavm >/dev/null; then
-    wavm run --abi=wasi "$1" && exit 0
-  fi
-fi
-
-if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmtime" ]; then
-  if command -v wasmtime >/dev/null; then
-    wasmtime run --dir=. "$1" && exit 0
-  fi
-fi
-
-if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmer" ]; then
-  if command -v wasmer >/dev/null; then
-    wasmer run "$1" "--${WASMER_BACKEND:-cranelift}" --dir=. && exit 0
-  fi
-fi
-
-if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasm3" ]; then
-  if command -v wasm3 >/dev/null; then
-    wasm3 "$1" && exit 0
-  fi
-fi
-
-if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "iwasm" ]; then
-  if iwasm | grep -qi wasi >/dev/null 2>&1; then
-    iwasm "$1" && exit 0
-  fi
-fi
-
 if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmedge" ]; then
   if command -v wasmedgec >/dev/null && command -v wasmedge >/dev/null; then
     wasmedgec "$1" "${1}.so" &&
@@ -48,22 +16,84 @@ if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmedge" ]; then
   fi
 fi
 
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmer" ]; then
+  if command -v wasmer >/dev/null; then
+    wasmer run "$1" "--${WASMER_BACKEND:-cranelift}" --dir=. && exit 0
+  fi
+fi
+
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmtime" ]; then
+  if command -v wasmtime >/dev/null; then
+    wasmtime run --dir=. "$1" && exit 0
+  fi
+fi
+
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wavm" ]; then
+  if command -v wavm >/dev/null; then
+    wavm run --abi=wasi "$1" && exit 0
+  fi
+fi
+
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "bun" ]; then
+  if echo | bun help >/dev/null 2>&1; then
+    {
+      echo "import fs from 'fs'; import { init, WASI } from '@wasmer/wasi';"
+      echo "await init();"
+      echo "const wasi = new WASI({args: process.argv, env: process.env, preopens: {'.':'/'}});"
+      echo "await (async function() {"
+      echo "  const wasm = await WebAssembly.compile(fs.readFileSync('${1}'));"
+      echo "  await wasi.instantiate(wasm, {});"
+      echo "  wasi.start();"
+      echo "  console.log(wasi.getStdoutString());"
+      echo "})().catch(e => { console.error(e); process.exit(1); });"
+    } >"${1}.mjs"
+    bun run "${1}.mjs" 2>/tmp/err &&
+      rm -f "${1}.mjs" && exit 0
+  fi
+fi
+
 if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "node" ]; then
   if echo | node --experimental-wasi-unstable-preview1 >/dev/null 2>&1; then
     {
       echo "import fs from 'fs'; import { WASI } from 'wasi';"
       echo "const wasi = new WASI({args: process.argv, env: process.env, preopens: {'.':'.'}});"
       echo "const importObject = { wasi_snapshot_preview1: wasi.wasiImport };"
+      echo "await (async function() {"
       echo "  const wasm = await WebAssembly.compile(fs.readFileSync('${1}'));"
       echo "  const instance = await WebAssembly.instantiate(wasm, importObject);"
       echo "  wasi.start(instance);"
+      echo "})().catch(e => { console.error(e); process.exit(1); });"
     } >"${1}.mjs"
-    cat "${1}.mjs" >/tmp/a
+    node --experimental-wasm-bigint --experimental-wasi-unstable-preview1 "${1}.mjs" 2>/tmp/err &&
-    node --experimental-wasi-unstable-preview1 "${1}.mjs" 2>/tmp/err &&
       rm -f "${1}.mjs" && exit 0
   fi
 fi
 
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasm3" ]; then
+  if command -v wasm3 >/dev/null; then
+    wasm3 "$1" && exit 0
+  fi
+fi
+
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "iwasm" ]; then
+  if command -v iwasm >/dev/null; then
+  if iwasm | grep -qi wasi >/dev/null 2>&1; then
+    if wamrc --version; then
+      wamrc -o "${1}.o" "$1" >/dev/null &&
+        iwasm --dir=. "${1}.o" && exit 0
+    else
+      iwasm --dir=. "$1" && exit 0
+    fi
+  fi
+  fi
+fi
+
+if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wazero" ]; then
+  if command -v wazero >/dev/null; then
+    wazero run -mount .:/ "$1" && exit 0
+  fi
+fi
+
 if [ -z "$WASI_RUNTIME" ] || [ "$WASI_RUNTIME" = "wasmer-js" ]; then
   if command -v wasmer-js >/dev/null; then
     wasmer-js run "$1" --dir=. && exit 0