Bouncy Castle dependency - replaceable with in-box cryptography? about netsparkle

[christophwille]

Unless I am mistaken, there is only one place in the main package, namely https://github.com/NetSparkleUpdater/NetSparkle/blob/develop/src/NetSparkle/SignatureVerifiers/Ed25519Checker.cs (AppCast generation isn't something I am concerned about as this is a dev dependency).

[Deadpikle]

You're not mistaken. That's the one place where it is used.

If you can point me to a library that is similarly trustworthy and unit tested, or a built-in way to do this in .NET that works from 4.5.2 (or 4.6.2) all the way through .NET 7+, I'd be interested in taking a look.

Alternatively, would trimming the DLL in your own application (and making sure NetSparkle was trimmable) be the solution, here? It seems as though that would allow us to continue to use BouncyCastle (with its benefits and google-ability) while not bogging down published apps.

Edit: Links for future ref: bcgit/bc-csharp#451, bcgit/bc-csharp#422

[Deadpikle]

Some additional applicable old discussion here: #98

[christophwille]

Isn't NSec doing just that?