[Package Request] - libsodium

[neilcook]

What package is missing from Amazon Linux 2023? Please describe and include package name.

libsodium

The encryption library.

Is this an update to existing package or new package request?

New package request

Is this package available in Amazon Linux 2? If it is available via external sources such as EPEL, please specify.

It is available in Amazon Linux 2, as part of the core OS.

Any additional information you'd like to include. (use-cases, etc)

I am an Open-Source software developer, and I'd like to build packages for Amazon Linux 2023 for users who are currently using Amazon Linux 2, but I need libsodium to do so.

[stewartsmith]

What packages are depending on libsodium that aren't also able to be built with a different library such as OpenSSL or GnuTLS?

The tl;dr here is taht cryptographic libraries are "fun" due to FIPS.

[neilcook]

I am the primary developer/maintainer of https://github.com/PowerDNS/weakforced, which uses libsodium for encrypting data that is then sent around in UDP packets. It's not TLS, I'm just using the data encryption/decryption functions.

However I don't really understand the comment about FIPS. I don't care about FIPS.

1. That's a US standard. There is a whole world out there that isn't part of the US.
2. I've never had anyone ask about FIPS ever, and this package is in use by a lot of folks, including large telcos, even in the US

Rewriting to use e.g. libcrypto primitives to get FIPS support when this has never come up before is unlikely at this stage.

[stewartsmith]

While we work on getting some more public documentation on all the FIPS related implications, I'll attempt to summarise a bit here:

• even though its primarily US, there's flow on effects for those who end up somewhere in the supply chain for those who end up using it. The audience is wider that you'd expect.
• We want to be able to be very clear about what running in FIPS mode means for packages and the OS, adding cryptography packages is the easiest way to make this job harder.

Ignoring FIPS, there's a few thoughts we have as distro maintainers:

• I am pretty sure that https://xkcd.com/927/ is entirely about cryptography libraries.
• Ensuring correctness and security patching for cryptographic libraries is a non-trivial amount of specialised work, and we'd rather focus those efforts on fewer libraries rather than expanding the number we have to divide resources between.

That being said, we don't like having things that are blockers for migrating from AL2 to AL2023, and I get that this particular thing has to be frustrating.

Can you point me to the bits of code calling libsodium? I'd like to get an idea of how complex a port to something we already ship is.

[neilcook]

The libsodium code is here:
https://github.com/PowerDNS/weakforced/blob/master/common/sodcrypto.hh
https://github.com/PowerDNS/weakforced/blob/master/common/sodcrypto.cc
I've looked again at the code and I reckon it be fairly straightforward to port to use OpenSSL if libsodium isn't available.

[lphilps]

AL 2023 currently includes PHP, both v8.1 and v8.2, and that is "supposed" to include the sodium extension by default:
https://www.php.net/manual/en/sodium.installation.php
"As of PHP 7.2.0 this extension is bundled with PHP. For older PHP versions this extension is available via PECL."

Lots of software, including PHP packages we depend on, require the sodium PHP extension.

It was straightforward to download both libsodium and the PHP sodium extension and build them, but I feel they really should be part of AL 2023.

The sodium PHP extension was included in all Amazon Linux 2 PHP releases.

[jonkerw85]

I just want to weigh in, tough not planning to use Amazon Linux 2023 myself. I do understand the concerns regarding maintaining additional libraries, and compliancy to some standards.

But regarding PHP, i can confirm that lib-sodium is somewhat expected to be present (or installable) within a PHP installation.

[yoh-m]

Another argument would be that the sodium extension is used by both Laravel and Symfony, two of the most used PHP Frameworks around the world ( https://symfony.com/doc/current/security/passwords.html#the-sodium-password-hasher : "It uses the Argon2 key derivation function. Argon2 support was introduced in PHP 7.2 by bundling the libsodium extension." ). As said above it's expected to come bundled with PHP.

[BernardRobbins]

Magento 2.4.4-p1 upwards requires libsodium.
https://experienceleague.adobe.com/docs/commerce-operations/installation-guide/system-requirements.html
https://github.com/magento/magento2/blob/2.4-develop/lib/internal/Magento/Framework/composer.json

[ozbenh]

We are evaluating inclusion of this package in our next quarterly release

[ozbenh]

libsodium has now been released as part of AL2023.2