🩹 [Patch]: Common context operations complete faster with Sodium 2.2.5#124
Draft
Marius Storhaug (MariusStorhaug) wants to merge 20 commits into
Draft
🩹 [Patch]: Common context operations complete faster with Sodium 2.2.5#124Marius Storhaug (MariusStorhaug) wants to merge 20 commits into
Marius Storhaug (MariusStorhaug) wants to merge 20 commits into
Conversation
Sodium 2.2.5 delivers significant performance improvements with no breaking API changes. Key gains since 2.2.2: - ConvertFrom-SodiumSealedBox: -44% per-call overhead (196 -> 109 µs) - ConvertTo-SodiumSealedBox: -22% per-call overhead (136 -> 105 µs) - New-SodiumKeyPair -Seed: -49% per-call overhead (95 -> 49 µs) - Module cold import: -37% (67 ms -> 42 ms) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Measures median µs per iteration for the three hot paths: New-SodiumKeyPair seed derivation, Set-Context (seal), and Get-Context (open/decrypt). Script is self-contained, cleans up after itself, and outputs a formatted table plus objects for downstream capture. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter POWERSHELL |
Two-part test confirms the on-disk contract is fully preserved: - Part 1: New-SodiumKeyPair -Seed produces byte-identical keys in both Sodium versions; a sealed box from 2.2.2 is decryptable by 2.2.5. - Part 2: vault files written by Context 8.1.3 (Sodium 2.2.2) are correctly decrypted using Sodium 2.2.5 key derivation directly, including SecureString-prefixed values and null fields. All 9 assertions pass. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter POWERSHELL |
Keep the benchmark and compatibility scripts lint-clean by fixing cleanup handlers, normalizing formatting, and adding narrow script-level suppressions where visible console output is intentional. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The GUID pins module identity (precise pinning), a stricter control than the lock-to-major risk appetite. Keep only the version range.
Replace pipeline-heavy recursion with direct .NET collection and string operations while preserving secure-string and nested-object behavior. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Cache exact-ID file lookups and vault keypairs, defer Sodium loading until cryptography is used, and harden paths used for vault file operations. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Run the suite on Pester 6 and cover populated-vault workloads, repeated context roundtrips, cross-vault exact-ID results, and path traversal protections. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Wrap long calls, declare recursive output types, and document why in-memory cache helpers do not use ShouldProcess. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- Pin workflow to v6.1.13 (SHA fb1bdb8fefd243292f779d2a856a38db6fe6daf4) - Replace secrets: inherit with explicit APIKey secret per v6.0.0 breaking change - Context has no test secrets so TestData is omitted Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Translates all mkdocs.yml settings to Zensical TOML format: - Preserves palette colors (black/green dark, indigo/green light) - Updates palette toggle icons from material/ to lucide/ - Retains all navigation features and markdown extensions - Adds content.code.copy and pymdownx.superfences (Zensical standard) - Social links and cookie consent carried over Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Marius Storhaug (MariusStorhaug)
changed the title
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
This was referenced Jul 25, 2026
Refresh the on-disk index before treating exact-ID lookups as missing, reject wildcard metacharacters in vault names, and use literal paths for vault deletion. Split cache helpers into one function per file so source-code CI recognizes them correctly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Require Sodium 2.2.5 consistently in the lazy-load guard, make the benchmark script run only against an explicitly imported Context module, and pin the cross-version compatibility script to Context 8.1.3 when validating historical vault data. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Quote vault names and file paths safely before embedding them in the cross-version helper's child pwsh commands so the script still works when paths or vault names contain apostrophes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Update both Pester-backed test files to require the latest published Pester 6.0.1 release, and make vault-name validation reject both forward and backslashes on every platform so the Linux/macOS module- local jobs match Windows behavior. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Update the compatibility helper to use named parameters for its local assertion helpers so repository-wide PowerShell lint treats the script as clean. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Add regression tests for stale exact-ID cache entries, on-disk metadata ID drift, decrypt failures, and stricter vault-name validation so the new cache and path-hardening logic stays above the repository coverage threshold. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context vault creation, context storage, retrieval, and repeated session use complete faster while retaining encrypted storage compatibility with existing on-disk data.
Changed: Common operations scale better with populated vaults
Exact-ID reads and writes no longer repeatedly scan every context file in a vault. Context now caches exact-ID file lookups and vault keypairs, invalidates those caches on writes and removals, and uses direct .NET file and collection operations in the hot path.
Measured from the folded performance work:
Changed: Sodium is updated to 2.2.5 without breaking existing vault data
The minimum Sodium requirement is now
2.2.5, picking up the upstream crypto and startup improvements from 2.2.3–2.2.5.New-SodiumKeyPair -SeedConvertFrom-SodiumSealedBoxConvertTo-SodiumSealedBoxA dedicated cross-version compatibility script confirms that vault data written with Sodium 2.2.2 remains readable after the upgrade to 2.2.5.
Changed: CI is aligned with current Process-PSModule and Pester 6
The reusable workflow is now pinned to Process-PSModule
v6.1.13, using the current explicitAPIKeysecret model, and the test suite now requires Pester 6.x.Fixed: Vault file operations stay inside the selected vault
Vault names containing path separators are rejected, and metadata lookups now use the actual discovered file path on disk instead of trusting a stored path value.
Technical Details
Assert-ContextSodiumModule,ContextFileIndexCache, andGet-ContextInfoFromFileto support lazy Sodium validation, indexed lookups, and safer metadata reads.tests/Context.Benchmark.ps1andtests/Context.CrossVersionCompat.ps1..github/zensical.tomlfor the docs site configuration migration.Related issues