🩹 [Patch]: Secret crypto operations now fail fast on invalid input with lower per-call overhead by MariusStorhaug · Pull Request #45 · PSModule/Sodium

Marius Storhaug (MariusStorhaug) · 2026-05-14T23:52:01Z

Secret encryption and decryption operations in Sodium now validate malformed inputs earlier, return clearer errors for invalid key and payload shapes, and run substantially faster on repeated invocations thanks to a series of targeted performance improvements across the interop layer.

Fixed: Invalid key and sealed payload shapes now fail fast with clear errors

\Get-SodiumPublicKey\ now rejects wrong-length private keys before key derivation, and \ConvertFrom-SodiumSealedBox\ now rejects sealed payloads shorter than the required Sodium overhead. This prevents low-level failures and returns actionable validation messages earlier in the command flow.

Example: \Get-SodiumPublicKey\ rejects a 16-byte private key with 'Invalid private key. Expected 32 bytes but got 16.' Similarly, \ConvertFrom-SodiumSealedBox\ rejects sealed boxes shorter than 48 bytes (the crypto_box_seal overhead).

Changed: Repeated crypto calls now incur significantly less overhead

Seven performance issues were addressed incrementally. Each was benchmarked in isolation against the previous prerelease. All measurements in median µs per 1,000-iteration trial on Windows x64.

Scenario	Baseline	Final	Δ
New-SodiumKeyPair	73.6 µs	49.1 µs	↓33%
New-SodiumKeyPair -Seed	94.9 µs	48.8 µs	↓49%
Get-SodiumPublicKey	66.1 µs	46.7 µs	↓29%
ConvertTo-SodiumSealedBox	135.8 µs	105.4 µs	↓22%
ConvertFrom-SodiumSealedBox	196.3 µs	109.0 µs	↓44%
Cold start (import + one key pair)	287 ms	279 ms	↓3%

Largest contributors: Base64 conversions moved to C# (↓17 to ↓42%), inlining crypto_scalarmult_base in sealed-box open (↓24%), and initializing libsodium at module import (↓6 to ↓14%).

Changed: Runtime loading behavior is now more deterministic across platforms

Runtime selection resolves from process architecture across Windows, Linux, and macOS; Windows support validation aligns with the active process architecture for more predictable module startup on mixed-architecture systems.

Implementation

Added managed validation wrappers in PSModule/Sodium/Sodium.cs with buffer size checks before unmanaged execution.
Migrated all DllImport bindings to LibraryImport source generators for compile-time marshalling.
Added base64-centric C# helpers (SealBase64, OpenSealBase64, DerivePublicKeyBase64, GenerateKeyPairBase64).
Cached crypto_box size constants as static readonly fields; fixed seed validation to use SeedBytes instead of SecretKeyBytes.
Added Initialize-Sodium at module load to call sodium_init once.
Unwrap MethodInvocationException to surface raw error messages to callers.
Updated Assert-VisualCRedistributableInstalled to validate architecture-specific runtime.
Updated PSModule/build.ps1 to fail fast on per-runtime publish failures.
Added regression coverage for short sealed-box payloads and wrong-length private keys.
Built and tested against .NET 8.0 LTS with System.Management.Automation 7.4.7 for broad compatibility.

github-actions · 2026-05-14T23:54:52Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSHARP	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Fail ❌
TRIVY	Pass ✅
YAML	Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

SPELL_CODESPELL

/github/workspace/PSModule/Sodium/Sodium.cs:28: clen ==> clean, clan
/github/workspace/PSModule/Sodium/Sodium.cs:78: clen ==> clean, clan
/github/workspace/PSModule/Sodium/Sodium.cs:81: clen ==> clean, clan
/github/workspace/PSModule/Sodium/Sodium.cs:86: clen ==> clean, clan
/github/workspace/PSModule/Sodium/Sodium.cs:87: clen ==> clean, clan
/github/workspace/PSModule/Sodium/Sodium.cs:91: clen ==> clean, clan

Copilot

Pull request overview

This PR hardens the Sodium PowerShell module by adding a managed validation layer in the C# interop bridge, centralizing module initialization with cached constants, validating input shapes earlier in public commands, clearing sensitive buffers in finally blocks, and making runtime selection deterministic by process architecture.

Changes:

Added validated wrappers around all native libsodium P/Invoke calls and constrained DLL search paths in PSModule/Sodium/Sodium.cs.
Introduced Initialize-Sodium with module-scoped cached size constants and refactored public crypto commands to use them, plus added explicit length validation and finally-block buffer clearing.
Switched platform/runtime selection to RuntimeInformation.ProcessArchitecture and aligned the Visual C++ Redistributable check to the active architecture; made build.ps1 fail fast on publish errors.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
PSModule/Sodium/Sodium.cs	Wraps native imports in a `Native` inner class with buffer length validation and constrained DLL search paths.
PSModule/build.ps1	Sets `$ErrorActionPreference = 'Stop'`, builds with `-c Release`, checks `$LASTEXITCODE`, and ensures `Pop-Location` in `finally`.
src/main.ps1	Resolves runtime identifier from `ProcessArchitecture` for Linux/macOS/Windows and centralizes module import.
src/functions/private/Assert-VisualCRedistributableInstalled.ps1	Adds `Architecture` parameter, validates `Installed != 0`, and uses `-ErrorAction SilentlyContinue`.
src/functions/private/Initialize-Sodium.ps1	New helper that initializes Sodium once and caches public/private/seal byte sizes.
src/variables/private/Initialized.ps1	Declares module-scoped Sodium state and size variables.
src/functions/public/New-SodiumKeyPair.ps1	Uses cached sizes, disposes SHA256, clears sensitive buffers in `finally`.
src/functions/public/Get-SodiumPublicKey.ps1	Removes duplicate `[CmdletBinding()]`, validates private-key length, clears the key buffer.
src/functions/public/ConvertTo-SodiumSealedBox.ps1	Uses cached sizes, validates public key length, clears plaintext in `finally`.
src/functions/public/ConvertFrom-SodiumSealedBox.ps1	Validates short sealed boxes and key lengths with explicit messages; clears sensitive buffers in `finally`.
tests/Sodium.Tests.ps1	Adds regression tests for short sealed box and wrong-length private key.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…erop

github-actions · 2026-05-15T20:25:15Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSHARP	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

github-actions · 2026-05-16T11:06:34Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSHARP	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

github-actions · 2026-05-16T11:08:10Z

✅ New prerelease: PowerShell Gallery - Sodium 2.2.3-fix44hardensodiuminterop001

github-actions · 2026-05-16T11:08:12Z

✅ New prerelease: GitHub - Sodium v2.2.3-fix44hardensodiuminterop001

Replaces disposable SHA256 instance with the static SHA256.HashData API in the seeded keypair path. Reduces per-call allocations.

github-actions · 2026-05-17T10:46:01Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSHARP	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

github-actions · 2026-05-17T10:47:25Z

✅ New prerelease: PowerShell Gallery - Sodium 2.2.3-fix44hardensodiuminterop002

github-actions · 2026-05-17T10:47:27Z

✅ New prerelease: GitHub - Sodium v2.2.3-fix44hardensodiuminterop002

Skips the registry probe during module import; only runs it as a diagnostic if native sodium_init() throws on Windows. Reduces cold-start overhead.

github-actions · 2026-05-17T10:54:46Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSHARP	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

…ge after lazy probe Adds InModuleScope tests for the private VC++ runtime probe so the deferred-init refactor (#54) does not regress code coverage.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

github-actions · 2026-05-17T12:45:36Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSHARP	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

Copilot

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 1 comment.

github-actions · 2026-05-17T12:59:23Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSHARP	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

…net8-compatible interop build

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

github-actions · 2026-05-17T13:34:39Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSHARP	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Fail ❌
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

POWERSHELL


�[32;1mRuleName �[0m�[32;1m Severity �[0m�[32;1m ScriptName�[0m�[32;1m Line �[0m�[32;1m Message�[0m
�[32;1m-------- �[0m �[32;1m-------- �[0m �[32;1m----------�[0m �[32;1m---- �[0m �[32;1m-------�[0m
PSAvoidLongLines Warning Initialize 30 Line exceeds
-Sodium.ps the configure
1 d maximum len
gth of 150 ch
aracters

github-actions · 2026-05-17T13:39:43Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSHARP	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Fail ❌
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

POWERSHELL


�[32;1mRuleName �[0m�[32;1m Severity �[0m�[32;1m ScriptName�[0m�[32;1m Line �[0m�[32;1m Message�[0m
�[32;1m-------- �[0m �[32;1m-------- �[0m �[32;1m----------�[0m �[32;1m---- �[0m �[32;1m-------�[0m
PSUseConsistentIndentation Warning Initialize 31 Indentation n
-Sodium.ps ot consistent
1

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

github-actions · 2026-05-17T13:57:45Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSHARP	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

github-actions · 2026-05-17T13:59:55Z

✅ New prerelease: PowerShell Gallery - Sodium 2.2.3-fix44hardensodiuminterop013

github-actions · 2026-05-17T13:59:57Z

✅ New prerelease: GitHub - Sodium v2.2.3-fix44hardensodiuminterop013

github-actions · 2026-05-17T14:13:35Z

✅ New release: PowerShell Gallery - Sodium 2.2.3

github-actions · 2026-05-17T14:13:37Z

✅ New release: GitHub - Sodium v2.2.3

Harden Sodium interop validation and cache runtime constants
cbc8978

Marius Storhaug (MariusStorhaug) changed the title ~~Draft: Sodium hardening for issue #44~~🩹 [Patch]: Secret crypto operations now fail fast on invalid input with lower per-call overheadMay 14, 2026

Marius Storhaug (MariusStorhaug) added the Patch label May 14, 2026

Marius Storhaug (MariusStorhaug) self-assigned this May 14, 2026

Marius Storhaug (MariusStorhaug) marked this pull request as ready for review May 15, 2026 20:20

CopilotAI review requested due to automatic review settings May 15, 2026 20:20

Copilotstarted reviewing on behalf of Marius Storhaug (MariusStorhaug)May 15, 2026 20:21 View session

CopilotAI reviewed May 15, 2026
View reviewed changes

Fix codespell lint by renaming clen to ciphertextLength in Sodium int…
b5c4f0e
…erop

This was referenced May 15, 2026
Migrate actions/upload-artifact to a Node.js 24-compatible release #46
Closed
Eliminate DEP0005 Buffer() deprecation warnings in CI workflows #47
Closed

Marius Storhaug (MariusStorhaug) added the Prerelease label May 16, 2026

Perf: use SHA256.HashData for seeded key derivation (#50)
b18eabc
Replaces disposable SHA256 instance with the static SHA256.HashData API in the seeded keypair path. Reduces per-call allocations.

CopilotAI review requested due to automatic review settings May 17, 2026 10:43

Copilotstarted reviewing on behalf of Marius Storhaug (MariusStorhaug)May 17, 2026 10:43 View session

CopilotAI reviewed May 17, 2026
View reviewed changes

Comment threadPSModule/Sodium/Sodium.cs Outdated

Perf: defer Windows VC++ runtime probe to init failure path (#54)
ca2877a
Skips the registry probe during module import; only runs it as a diagnostic if native sodium_init() throws on Windows. Reduces cold-start overhead.

test: cover Assert-VisualCRedistributableInstalled to maintain covera…
6a789b0
…ge after lazy probe Adds InModuleScope tests for the private VC++ runtime probe so the deferred-init refactor (#54) does not regress code coverage.

CopilotAI review requested due to automatic review settings May 17, 2026 10:57

Copilotstarted reviewing on behalf of Marius Storhaug (MariusStorhaug)May 17, 2026 10:57 View session

CopilotAI reviewed May 17, 2026
View reviewed changes

Comment threadPSModule/Sodium/Sodium.cs Outdated
Comment threadsrc/functions/private/Initialize-Sodium.ps1 Outdated

CopilotAI review requested due to automatic review settings May 17, 2026 12:43

Copilotstarted reviewing on behalf of Marius Storhaug (MariusStorhaug)May 17, 2026 12:43 View session

CopilotAI reviewed May 17, 2026
View reviewed changes

Comment threadsrc/functions/private/Initialize-Sodium.ps1

fix: remove local performance harness from .gitignore
b457c6d

Fix PR#45review findings: init guards, validation consistency, and …
5e142d1
…net8-compatible interop build

CopilotAI review requested due to automatic review settings May 17, 2026 13:32

Marius Storhaug (MariusStorhaug) mentioned this pull request May 17, 2026
Evaluate lazy initialization for Sodium size constants to avoid type-initialization lockout #59
Open

Copilotstarted reviewing on behalf of Marius Storhaug (MariusStorhaug)May 17, 2026 13:32 View session

Marius Storhaug (MariusStorhaug) mentioned this pull request May 17, 2026
Assess deferred sodium initialization fallback during module import #60
Open

CopilotAI reviewed May 17, 2026
View reviewed changes

Fix lint: wrap Initialize-Sodium VC++ diagnostic message
8599c01

Marius Storhaug (MariusStorhaug) mentioned this pull request May 17, 2026
Harden Sodium native interop and reduce per-call cryptographic overhead #44
Closed

Fix PSUseConsistentIndentation lint error on line 31
c35e5e5

CopilotAI review requested due to automatic review settings May 17, 2026 13:55

Copilotstarted reviewing on behalf of Marius Storhaug (MariusStorhaug)May 17, 2026 13:56 View session

CopilotAI reviewed May 17, 2026
View reviewed changes

Marius Storhaug (MariusStorhaug) removed the Prerelease label May 17, 2026

Marius Storhaug (MariusStorhaug) mentioned this pull request May 17, 2026
Upgrade to .NET 10 LTS and System.Management.Automation 7.6.1 #61
Open
6 tasks

Marius Storhaug (MariusStorhaug) merged commit 44fed7f into mainMay 17, 2026
45 checks passed

Marius Storhaug (MariusStorhaug) deleted the fix/44-harden-sodium-interop branch May 17, 2026 14:09

Marius Storhaug (MariusStorhaug)temporarily deployed to github-pages May 17, 2026 14:13 — with GitHub Actions Inactive

Uh oh!

Conversation

Marius Storhaug (MariusStorhaug) commented May 14, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fixed: Invalid key and sealed payload shapes now fail fast with clear errors

Changed: Repeated crypto calls now incur significantly less overhead

Changed: Runtime loading behavior is now more deterministic across platforms

Implementation

Uh oh!

github-actionsBot commented May 14, 2026

Super-linter summary

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actionsBot commented May 15, 2026

Super-linter summary

Uh oh!

github-actionsBot commented May 16, 2026

Super-linter summary

Uh oh!

github-actionsBot commented May 16, 2026

Uh oh!

github-actionsBot commented May 16, 2026

Uh oh!

github-actionsBot commented May 17, 2026

Super-linter summary

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

github-actionsBot commented May 17, 2026

Uh oh!

github-actionsBot commented May 17, 2026

Uh oh!

github-actionsBot commented May 17, 2026

Super-linter summary

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

github-actionsBot commented May 17, 2026

Super-linter summary

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

github-actionsBot commented May 17, 2026

Super-linter summary

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

github-actionsBot commented May 17, 2026

Super-linter summary

Uh oh!

github-actionsBot commented May 17, 2026

Super-linter summary

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

github-actionsBot commented May 17, 2026

Super-linter summary

Uh oh!

github-actionsBot commented May 17, 2026

Uh oh!

github-actionsBot commented May 17, 2026

Uh oh!

Marius Storhaug (MariusStorhaug) commented May 14, 2026•
edited
Loading