Bouncy Castle dependency - replaceable with in-box cryptography?

[christophwille]

The four assemblies for netsparkle come in at 3.46MB, with Bouncy Castle accounting for 3.16 (2.2.2 WPF .Core distribution). That is quite a hefty "penalty" - what is Bouncy Castle used for (ie would it be possible to at least replace it on .NET (Core) with in-box cryptography?)

[christophwille]

Unless I am mistaken, there is only one place in the main package, namely https://github.com/NetSparkleUpdater/NetSparkle/blob/develop/src/NetSparkle/SignatureVerifiers/Ed25519Checker.cs (AppCast generation isn't something I am concerned about as this is a dev dependency).

[Deadpikle]

You're not mistaken. That's the one place where it is used.

If you can point me to a library that is similarly trustworthy and unit tested, or a built-in way to do this in .NET that works from 4.5.2 (or 4.6.2) all the way through .NET 7+, I'd be interested in taking a look.

Alternatively, would trimming the DLL in your own application (and making sure NetSparkle was trimmable) be the solution, here? It seems as though that would allow us to continue to use BouncyCastle (with its benefits and google-ability) while not bogging down published apps.

Edit: Links for future ref: bcgit/bc-csharp#451, bcgit/bc-csharp#422

[Deadpikle]

Some additional applicable old discussion here: #98

[christophwille]

Isn't NSec doing just that?