Fix PR #45 review findings: init guards, validation consistency, and net8-compatible interop build

Author: MariusStorhaug

PSModule/Sodium.csproj

@@ -1,13 +1,13 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
-        <TargetFramework>net10.0</TargetFramework>
+        <TargetFramework>net8.0</TargetFramework>
         <AssemblyName>PSModule.Sodium</AssemblyName>
         <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
     </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="System.Management.Automation" Version="7.6.1" PrivateAssets="All" />
+        <PackageReference Include="System.Management.Automation" Version="7.4.7" PrivateAssets="All" />
         <PackageReference Include="libsodium" Version="1.0.22" />
     </ItemGroup>
 

PSModule/Sodium/Sodium.cs

@@ -228,11 +228,18 @@ public static string SealBase64(string plaintext, string publicKeyBase64)
             var publicKey = DecodeBase64Exact(publicKeyBase64, PublicKeyBytes, "public key");
             var message = Encoding.UTF8.GetBytes(plaintext);
             var ciphertext = new byte[message.Length + SealBytes];
-            if (Native.crypto_box_seal(ciphertext, message, (ulong)message.LongLength, publicKey) != 0)
+            try
+            {
+                if (Native.crypto_box_seal(ciphertext, message, (ulong)message.LongLength, publicKey) != 0)
+                {
+                    throw new InvalidOperationException("Encryption failed.");
+                }
+                return Convert.ToBase64String(ciphertext);
+            }
+            finally
             {
-                throw new InvalidOperationException("Encryption failed.");
+                CryptographicOperations.ZeroMemory(message);
             }
-            return Convert.ToBase64String(ciphertext);
         }
 
         public static string OpenSealBase64(string ciphertextBase64, string privateKeyBase64)
@@ -253,7 +260,7 @@ private static string OpenSealBase64Core(string ciphertextBase64, string private
             var ciphertext = Convert.FromBase64String(ciphertextBase64);
             if (ciphertext.Length < SealBytes)
             {
-                throw new InvalidOperationException($"Invalid sealed box. Expected at least {SealBytes} bytes but got {ciphertext.Length}.");
+                throw new ArgumentException($"Invalid sealed box. Expected at least {SealBytes} bytes but got {ciphertext.Length}.");
             }
             var privateKey = DecodeBase64Exact(privateKeyBase64, SecretKeyBytes, "private key");
             var publicKey = new byte[PublicKeyBytes];
@@ -291,7 +298,7 @@ private static byte[] DecodeBase64Exact(string value, int expectedLength, string
             var bytes = Convert.FromBase64String(value);
             if (bytes.Length != expectedLength)
             {
-                throw new InvalidOperationException($"Invalid {label}. Expected {expectedLength} bytes but got {bytes.Length}.");
+                throw new ArgumentException($"Invalid {label}. Expected {expectedLength} bytes but got {bytes.Length}.");
             }
             return bytes;
         }

PSModule/build.ps1

@@ -19,7 +19,7 @@ try {
             throw "dotnet publish failed for runtime '$_'."
         }
 
-        $source = "$PSScriptRoot/bin/Release/net10.0/$_/publish"
+        $source = "$PSScriptRoot/bin/Release/net8.0/$_/publish"
         $destination = "$PSScriptRoot/../src/libs/$_"
         Copy-Item -Path $source -Destination $destination -Recurse -Force
     }

src/functions/private/Initialize-Sodium.ps1

@@ -22,8 +22,14 @@
         try {
             $initializationResult = [PSModule.Sodium]::sodium_init()
         } catch {
+            $script:Supported = $false
             if ($IsWindows) {
-                $script:Supported = Assert-VisualCRedistributableInstalled -Version '14.0' -Architecture $script:ProcessArchitecture
+                if ($script:ProcessArchitecture -in @('X64', 'X86')) {
+                    $hasRuntime = Assert-VisualCRedistributableInstalled -Version '14.0' -Architecture $script:ProcessArchitecture
+                    if (-not $hasRuntime) {
+                        throw "Sodium native initialization failed; the Visual C++ Redistributable for $($script:ProcessArchitecture) appears to be missing or below the required version."
+                    }
+                }
             }
             throw
         }

src/functions/public/ConvertFrom-SodiumSealedBox.ps1

@@ -68,11 +68,13 @@
         [string] $PrivateKey
     )
 
-    begin {}
+    begin {
+        Initialize-Sodium
+    }
 
     process {
         try {
-            if ($PublicKey) {
+            if (-not [string]::IsNullOrWhiteSpace($PublicKey)) {
                 return [PSModule.Sodium]::OpenSealBase64($SealedBox, $PrivateKey, $PublicKey)
             }
             return [PSModule.Sodium]::OpenSealBase64($SealedBox, $PrivateKey)

src/functions/public/ConvertTo-SodiumSealedBox.ps1

@@ -55,7 +55,9 @@
         [ValidateNotNullOrEmpty()]
         [string] $PublicKey
     )
-    begin {}
+    begin {
+        Initialize-Sodium
+    }
 
     process {
         try {

src/functions/public/Get-SodiumPublicKey.ps1

@@ -81,24 +81,16 @@
         [switch] $AsByteArray
     )
 
-    begin {}
+    begin {
+        Initialize-Sodium
+    }
 
     process {
         if ($AsByteArray) {
-            $privateKeyByteArray = $null
             try {
-                $publicKeyByteArray = [byte[]]::new($script:SodiumPublicKeyBytes)
-                $privateKeyByteArray = [System.Convert]::FromBase64String($PrivateKey)
-                if ($privateKeyByteArray.Length -ne $script:SodiumPrivateKeyBytes) {
-                    throw "Invalid private key. Expected $script:SodiumPrivateKeyBytes bytes but got $($privateKeyByteArray.Length)."
-                }
-                $deriveResult = [PSModule.Sodium]::crypto_scalarmult_base($publicKeyByteArray, $privateKeyByteArray)
-                if ($deriveResult -ne 0) { throw 'Unable to derive public key from private key.' }
-                return $publicKeyByteArray
-            } finally {
-                if ($null -ne $privateKeyByteArray -and $privateKeyByteArray.Length -gt 0) {
-                    [array]::Clear($privateKeyByteArray, 0, $privateKeyByteArray.Length)
-                }
+                return [System.Convert]::FromBase64String([PSModule.Sodium]::DerivePublicKeyBase64($PrivateKey))
+            } catch [System.Management.Automation.MethodInvocationException] {
+                throw $_.Exception.InnerException
             }
         }
         try {

src/functions/public/New-SodiumKeyPair.ps1

@@ -80,11 +80,13 @@
             ParameterSetName = 'SeededKeyPair',
             ValueFromPipeline
         )]
-        [ValidateNotNullOrEmpty()]
+        [AllowEmptyString()]
         [string] $Seed
     )
 
-    begin {}
+    begin {
+        Initialize-Sodium
+    }
 
     process {
         try {

src/main.ps1

@@ -36,7 +36,7 @@ switch ($true) {
 $assemblyPath = Join-Path -Path $PSScriptRoot -ChildPath "libs/$runtimeIdentifier/PSModule.Sodium.dll"
 Import-Module $assemblyPath -ErrorAction Stop
 
-# Optimistically mark supported; Initialize-Sodium will run the Windows VC++ runtime check lazily only if native init fails.
+# Optimistically mark supported; Initialize-Sodium runs during module import and checks Windows VC++ runtime only if native init fails.
 $script:Supported = $true
 $script:ProcessArchitecture = $processArchitecture.ToString()
 

src/variables/private/Initialized.ps1

@@ -2,3 +2,4 @@
 $script:SodiumPublicKeyBytes = $null
 $script:SodiumPrivateKeyBytes = $null
 $script:SodiumSealBytes = $null
+$script:SodiumSeedBytes = $null