Bump libsodium to the latest 1.0.20

src/libsodium/.github/workflows/ci.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Install Zig
         uses: mlugg/setup-zig@v2
         with:
-          version: 0.15.1
+          version: 0.15.2
 
       - name: Autogen
         run: ./autogen.sh -s
@@ -155,6 +155,36 @@ jobs:
           make -j $(nproc)
           make clean > /dev/null
 
+  wasi:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Zig
+        uses: mlugg/setup-zig@v2
+        with:
+          version: master
+
+      - name: Install Wasmer
+        uses: wasmerio/setup-wasmer@v3.1
+
+      - name: Build for wasi-core
+        run: zig build -Dtarget=wasm32-wasi -Doptimize=ReleaseSafe
+
+      - name: Run tests with Wasmer
+        run: |
+          cd zig-out/bin
+          failed=0
+          for wasm in *.wasm; do
+            name="${wasm%.wasm}"
+            echo "[$name]"
+            if ! wasmer run "$wasm" --mapdir=./:.  2>&1; then
+              echo "*** [$name] FAILED" >&2
+              failed=1
+            fi
+          done
+          exit $failed
+
   android:
     runs-on: ubuntu-latest
     steps:
@@ -172,7 +202,7 @@ jobs:
       - name: Install Android NDK
         run: |
           mkdir /tmp/android && cd /tmp/android
-          curl -o ndk.zip -L https://dl.google.com/android/repository/android-ndk-r27c-linux.zip
+          curl -o ndk.zip -L https://dl.google.com/android/repository/android-ndk-r29-linux.zip
           unzip ndk.zip && rm -f *.zip && mv android-ndk* ndk
 
       - name: Android compilation

src/libsodium/.gitignore

@@ -1,6 +1,13 @@
+!build
+.deps
+.dirstamp
+.done
+.DS_Store
+.libs
+.zig-cache
 *.bc
-*.dSYM
 *.done
+*.dSYM
 *.final
 *.gcda
 *.gcno
@@ -16,33 +23,26 @@
 *.sdf
 *.status
 *.tar.*
+*.vs/
 *.wasm
 *.wast
 *~
-.DS_Store
-.deps
-.dirstamp
-.done
-.libs
 /bin/
 /obj/
-Build
-INSTALL
-Makefile
-Makefile.in
-Vagrantfile
 aclocal.m4
 android-toolchain
 android-toolchain-*
 autom4te.cache
 build
+Build
 compile
 confdefs.h
 config.*
 configure
 configure.lineno
 coverage.info
 depcomp
+INSTALL
 install-sh
 libsodium-*.tar.bz2
 libsodium-*.tar.gz
@@ -66,10 +66,12 @@ libtool
 ltmain.sh
 m4/argz.m4
 m4/libtool.m4
+m4/lt~obsolete.m4
 m4/ltoptions.m4
 m4/ltsugar.m4
 m4/ltversion.m4
-m4/lt~obsolete.m4
+Makefile
+Makefile.in
 man/*.html
 man/Makefile.in
 missing
@@ -94,24 +96,24 @@ test/default/auth5
 test/default/auth6
 test/default/auth7
 test/default/box
-test/default/box2
-test/default/box7
-test/default/box8
 test/default/box_easy
 test/default/box_easy2
 test/default/box_seal
 test/default/box_seed
+test/default/box2
+test/default/box7
+test/default/box8
 test/default/browser
 test/default/chacha20
 test/default/codecs
+test/default/core_ed25519
+test/default/core_ristretto255
 test/default/core1
 test/default/core2
 test/default/core3
 test/default/core4
 test/default/core5
 test/default/core6
-test/default/core_ed25519
-test/default/core_ristretto255
 test/default/ed25519_convert
 test/default/generichash
 test/default/generichash2
@@ -133,19 +135,19 @@ test/default/pwhash_scrypt
 test/default/pwhash_scrypt_ll
 test/default/randombytes
 test/default/scalarmult
+test/default/scalarmult_ed25519
+test/default/scalarmult_ristretto255
 test/default/scalarmult2
 test/default/scalarmult5
 test/default/scalarmult6
 test/default/scalarmult7
 test/default/scalarmult8
-test/default/scalarmult_ed25519
-test/default/scalarmult_ristretto255
 test/default/secretbox
+test/default/secretbox_easy
+test/default/secretbox_easy2
 test/default/secretbox2
 test/default/secretbox7
 test/default/secretbox8
-test/default/secretbox_easy
-test/default/secretbox_easy2
 test/default/secretstream_xchacha20poly1305
 test/default/shorthash
 test/default/sign
@@ -163,6 +165,6 @@ test/default/verify1
 test/default/xchacha20
 test/js.done
 testing
-.zig-cache
+Vagrantfile
 zig-cache
 zig-out

src/libsodium/ChangeLog

@@ -1,21 +1,39 @@
 * Version 1.0.20-stable
- - Performance of AES256-GCM and AEGIS on ARM has been improved.
+ - The Fil-C compiler is supported out of the box
+ - MSVC 2026 (Visual Studio 2026) is now supported
+ - Performance of AES256-GCM and AEGIS on ARM has been improved
+with some compilers
  - Android binaries have been added to the NuGet package
  - Windows ARM binaries have been added to the NuGet package
  - The Android build script has been improved. The base SDK is
-now 27c, and the default platform is 21
- - The library can now be compiled with Zig 0.14+
+now 27c, and the default platform is 21, supporting 16 KB page sizes.
+ - The library can now be compiled with Zig 0.15 and Zig 0.16
+ - Zig builds now generate position-independent static libraries by
+default on targets that support PIC
  - arm64e builds have been added to the XCFramework packages
  - XCFramework packages are now full builds instead of minimal
 builds
  - MSVC builds have been enabled for ARM64
+ - iOS 32-bit (armv7/armv7s) support has been removed from the
+XCFramework build script
+ - Security: optblockers have been introduced in critical code paths
+to prevent compilers from introducing unwanted side channels via
+conditional jumps. This was observed on RISC-V targets with specific
+compilers and options.
+ - Security: `crypto_core_ed25519_is_valid_point()` now properly
+rejects small-order points that are not in the main subgroup
+ - `((nonnull))` attributes have been relaxed on some `crypto_stream*`
+functions to allow NULL output buffers when the output length is zero
  - A cross-compilation issue with old clang versions has been
 fixed
  - 16K page sizes are now supported on Android
  - JavaScript: support for Cloudflare Workers has been added
+ - JavaScript: WASM_BIGINT is forcibly disabled to retain
+compatibility with older runtimes
  - A compilation issue with old toolchains on Solaris has been
 fixed
  - `crypto_aead_aes256gcm_is_available` is exported to JavaScript
+ - libsodium is now compatible with Emscripten 4.x
 
 * Version 1.0.20
   This point release includes all the changes from 1.0.19-stable,

src/libsodium/LICENSE

@@ -1,7 +1,7 @@
 /*
  * ISC License
  *
- * Copyright (c) 2013-2025
+ * Copyright (c) 2013-2026
  * Frank Denis <j at pureftpd dot org>
  *
  * Permission to use, copy, modify, and/or distribute this software for any

src/libsodium/Makefile.in

@@ -178,10 +178,6 @@ am__recursive_targets = \
   $(am__extra_recursive_targets)
 AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
 	cscope distdir distdir-am dist dist-all distcheck
-am__extra_recursive_targets = check-valgrind-recursive \
-	check-valgrind-memcheck-recursive \
-	check-valgrind-helgrind-recursive check-valgrind-drd-recursive \
-	check-valgrind-sgcheck-recursive
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
 # Read a list of newline-separated strings from the standard input,
 # and print each of them once, without duplicates.  Input order is
@@ -555,11 +551,6 @@ $(am__recursive_targets):
 	if test "$$dot_seen" = "no"; then \
 	  $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \
 	fi; test -z "$$fail"
-check-valgrind-local: 
-check-valgrind-memcheck-local: 
-check-valgrind-helgrind-local: 
-check-valgrind-drd-local: 
-check-valgrind-sgcheck-local: 
 
 ID: $(am__tagged_files)
 	$(am__define_uniq_tagged_files); mkid -fID $$unique
@@ -874,26 +865,6 @@ distclean-generic:
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
 	@echo "it deletes files that may require special tools to rebuild."
-check-valgrind: check-valgrind-recursive
-
-check-valgrind-am: check-valgrind-local
-
-check-valgrind-drd: check-valgrind-drd-recursive
-
-check-valgrind-drd-am: check-valgrind-drd-local
-
-check-valgrind-helgrind: check-valgrind-helgrind-recursive
-
-check-valgrind-helgrind-am: check-valgrind-helgrind-local
-
-check-valgrind-memcheck: check-valgrind-memcheck-recursive
-
-check-valgrind-memcheck-am: check-valgrind-memcheck-local
-
-check-valgrind-sgcheck: check-valgrind-sgcheck-recursive
-
-check-valgrind-sgcheck-am: check-valgrind-sgcheck-local
-
 clean: clean-recursive
 
 clean-am: clean-generic clean-libtool mostlyclean-am
@@ -967,12 +938,7 @@ uninstall-am: uninstall-pkgconfigDATA
 .MAKE: $(am__recursive_targets) install-am install-strip
 
 .PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am \
-	am--refresh check check-am check-valgrind-am \
-	check-valgrind-drd-am check-valgrind-drd-local \
-	check-valgrind-helgrind-am check-valgrind-helgrind-local \
-	check-valgrind-local check-valgrind-memcheck-am \
-	check-valgrind-memcheck-local check-valgrind-sgcheck-am \
-	check-valgrind-sgcheck-local clean clean-cscope clean-generic \
+	am--refresh check check-am clean clean-cscope clean-generic \
 	clean-libtool cscope cscopelist-am ctags ctags-am dist \
 	dist-all dist-bzip2 dist-bzip3 dist-gzip dist-lzip dist-shar \
 	dist-tarZ dist-xz dist-zip dist-zstd distcheck distclean \

src/libsodium/README.markdown

@@ -1,5 +1,4 @@
 [![GitHub CI](https://github.com/jedisct1/libsodium/workflows/CI/badge.svg)](https://github.com/jedisct1/libsodium/actions)
-[![Windows build status](https://ci.appveyor.com/api/projects/status/fu8s2elx25il98hj?svg=true)](https://ci.appveyor.com/project/jedisct1/libsodium)
 [![Coverity Scan Build Status](https://scan.coverity.com/projects/2397/badge.svg)](https://scan.coverity.com/projects/2397)
 [![Azure build status](https://jedisct1.visualstudio.com/Libsodium/_apis/build/status/jedisct1.libsodium?branchName=stable)](https://jedisct1.visualstudio.com/Libsodium/_build/latest?definitionId=3&branchName=stable)
 [![CodeQL scan](https://github.com/jedisct1/libsodium/workflows/CodeQL%20scan/badge.svg)](https://github.com/jedisct1/libsodium/actions)
@@ -16,24 +15,29 @@ It is a portable, cross-compilable, installable, and packageable fork of [NaCl](
 
 - **Encryption & Decryption:** Securely encrypt and decrypt data with modern algorithms.
 - **Digital Signatures:** Create and verify signatures to ensure data authenticity.
-- **Cross-Platform Compatibility:** Supported on Windows (MinGW and Visual Studio, both x86 and x64), iOS, Android, JavaScript, and WebAssembly.
+- **Cross-Platform Compatibility:** Supported on Windows (MinGW and Visual Studio, x86, x64 and arm64), iOS, Android, JavaScript, and WebAssembly.
 - **User-Friendly API:** Designed to provide all core cryptographic operations while remaining easy to integrate into your projects.
 
 ---
 
 ## Documentation
 
-Detailed documentation is available online. It is generated from the [libsodium-doc](https://github.com/jedisct1/libsodium-doc) repository and requires JavaScript for full functionality:
-
-- [libsodium Documentation](https://doc.libsodium.org)
+- [Installation](https://doc.libsodium.org/installation)
+- [Quickstart](https://doc.libsodium.org/quickstart)
+- [Full Documentation](https://doc.libsodium.org)
+- [Releases](https://download.libsodium.org/libsodium/releases/)
+- [Integrity Checking](https://doc.libsodium.org/installation#integrity-checking)
 
 ---
 
-## Integrity Checking
+## Versioning
+
+libsodium uses a two-tier release system:
 
-For security and authenticity, please review the integrity checking instructions. These include the signing keys and methods to verify your installation:
+- **Point releases** (e.g., 1.0.19, 1.0.20, 1.0.21) are tagged when new features are added or significant changes are made.
+- **Stable releases** are frequent maintainance updates between point releases. They fix minor issues while remaining fully compatible with their parent point release. No new features, no breaking changes.
 
-- [Integrity Checking Instructions](https://download.libsodium.org/doc/installation#integrity-checking)
+If your application depends on a specific point release, stable updates are safe to apply. Security fixes go to the `stable` branch immediately, with a new point release tagged shortly after.
 
 ---
 

src/libsodium/aclocal.m4

@@ -418,23 +418,6 @@ AC_DEFUN([AM_OUTPUT_DEPENDENCY_COMMANDS],
      [test x"$AMDEP_TRUE" != x"" || _AM_OUTPUT_DEPENDENCY_COMMANDS],
      [AMDEP_TRUE="$AMDEP_TRUE" MAKE="${MAKE-make}"])])
 
-# AM_EXTRA_RECURSIVE_TARGETS                                -*- Autoconf -*-
-
-# Copyright (C) 2012-2025 Free Software Foundation, Inc.
-#
-# This file is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# AM_EXTRA_RECURSIVE_TARGETS
-# --------------------------
-# Define the list of user recursive targets.  This macro exists only to
-# be traced by Automake, which will ensure that a proper definition of
-# user-defined recursive targets (and associated rules) is propagated
-# into all the generated Makefiles.
-# TODO: We should really reject non-literal arguments here...
-AC_DEFUN([AM_EXTRA_RECURSIVE_TARGETS], [])
-
 # Do all the work for Automake.                             -*- Autoconf -*-
 
 # Copyright (C) 1996-2025 Free Software Foundation, Inc.

src/libsodium/appveyor.yml

@@ -1,6 +1,6 @@
 version: 1.0.20.{build}
 
-os: Visual Studio 2017
+os: Visual Studio 2022
 
 environment:
   matrix: