Bundles are big

I’ve been finding that bundles with cosmjs tend to be pretty big (600k+), much of which appears to be due to the dependency on libsodium.

Here’s an example from a recent (next.js) build:

yarn why libsodium
yarn why v1.22.17
[1/4] Why do we have the module "libsodium"...?
[2/4] Initialising dependency graph...
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "libsodium@0.7.9"
info Reasons this module exists
   - "@cosmjs#cosmwasm-stargate#@cosmjs#crypto#libsodium-wrappers" depends on it
   - Hoisted from "@cosmjs#cosmwasm-stargate#@cosmjs#crypto#libsodium-wrappers#libsodium"
info Disk size without dependencies: "508KB"
info Disk size with unique dependencies: "508KB"
info Disk size with transitive dependencies: "508KB"
info Number of shared dependencies: 0
Done in 0.52s.

It seems cosmjs’s dependency on libsodium comes from this import.

I wonder: is it possible to optimize our use of libsodium to minimize its footprint, or at least make it more amenable to optimization by static analyzers?

[webmaster128]

Thank you for bringing this up. This ticket triggered many dependency removals in https://github.com/cosmos/cosmjs/milestone/14, the module type discussion in #1004 and the libsodium replacement discussion in #1031. I think with those more specific ticket, we can close here.

Making CosmJS faster and lighter but preserving a wide range of targets will be a continous effort.

Happy for any follow-up input in more specific tickets.

[webmaster128]

If you want to get rid of libsodium in your application, you can have a look at this trick from Keplr:

• Resolve to a custom package https://github.com/chainapsis/keplr-wallet/blob/c1976b522f610a9d894de7860dc1889486820bc8/package.json#L81-L82
• Create empty package https://github.com/chainapsis/keplr-wallet/tree/master/etc/noop

This is clearly no ideal for maintenance and it can always happen that your app breaks because CosmJS changes. But right now libsodium is only used for wallet related crypto and Ed25519. So it’s an okay trade-off if your app is tested well, production ready and you read CHANGELOGs.