Filippo Valsorda

Hmm, that's because autodetection is looking inside the prefix, which doesn't work with Homebrew's symlinking approach. https://github.com/FiloSottile/passage/blob/a42b9c117ac823554ba127a814c297d0aeaaef45/Makefile#L8-L10 The best solution might be to just autodetect installation to the Homebrew Cellar.

This is an intentional design choice of password-store, presumably to catch conflicts that happen during editing, which I don't think I am going to deviate from in passage.

With a recent enough kernel, the random subsystem can be trusted to do the right thing thanks to the changes by Jason Donenfeld. The only thing userspace needs to do...

I might be missing the complexity of the setup, but would generating wrappers like ``` function crypto_hash_sha256(...) { if (!globalIsReady) throw notReadyError; return _crypto_hash_sha256(...) } ``` not solve the issue?...

I think using globalThis.libsodiumIsReady would work. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/globalThis

I think vendorcheck is correct here, but it's subtle and I should document it. If you vendor package A, then import package B, which is *not* vendored, and package B...

Hi @Yawning! Two quick questions. First, we did a bunch of work on the field implementation getting it into filippo.io/edwards25519, and eventually I am hoping to replace the guts of...

None of those affect mkcert. mkcert doesn't even use those packages.

I don't think using automated tools that fail to do even package-level scoping and then pushing the churn onto every upstream project to reduce noise is sustainable. My responsibility is...

There is real risk in updating, too, and an updates policy is a more nuanced topic than "bothering to use up to date libraries". I assure you I am very...