ci: allow sodium as ed25519 provider

Author: jaine

.github/workflows/ci.yml

@@ -20,9 +20,9 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y lua5.4 lua5.4-dev luarocks libsodium-dev
 
-      - name: "Install required rocks (Lua 5.4: lua-cjson/luv/lsqlite3/luaossl/sodium/ed25519)"
+      - name: "Install required rocks (Lua 5.4: lua-cjson/luv/lsqlite3/luaossl/sodium)"
         run: |
-          rocks=(lua-cjson luv lsqlite3 luaossl sodium ed25519)
+          rocks=(lua-cjson luv lsqlite3 luaossl sodium)
           for rock in "${rocks[@]}"; do
             luarocks --lua-version=5.4 install --local "$rock" || exit 1
           done

scripts/verify/deps_check.lua

@@ -1,21 +1,35 @@
 local deps = {
   { name = "luv", mod = "luv" },
-  { name = "ed25519", mod = "ed25519" },
   { name = "lsqlite3", mod = "lsqlite3" },
   { name = "cjson", mod = "cjson.safe" },
   { name = "luaossl", mod = "openssl" },
   { name = "sodium", mod = "sodium" },
 }
 
+local function require_any(label, modules)
+  for _, m in ipairs(modules) do
+    local ok = pcall(require, m)
+    if ok then
+      io.stdout:write(string.format("%-10s: available (%s)\n", label, m))
+      return true
+    end
+  end
+  io.stdout:write(string.format("%-10s: missing\n", label))
+  return false
+end
+
+-- core deps
 for _, d in ipairs(deps) do
-  local ok, _ = pcall(require, d.mod)
-  io.stdout:write(string.format("%-10s: %s\n", d.name, ok and "available" or "missing"))
-  if not ok then os.exit(1) end
+  if not require_any(d.name, { d.mod }) then os.exit(1) end
 end
 
--- Fail-closed if sodium (for ed25519) is missing when signatures are required
+-- Ed25519 signer: allow either ed25519 rock or sodium providing crypto_sign_* API
+local ed25519_ok = require_any("ed25519", { "ed25519", "sodium" })
+if not ed25519_ok then os.exit(1) end
+
+-- Fail-closed if signatures required and no sodium available (used for ed25519)
 if os.getenv("AUTH_REQUIRE_SIGNATURE") == "1" then
-  local ok_sodium, _ = pcall(require, "sodium")
+  local ok_sodium = pcall(require, "sodium")
   if not ok_sodium then
     io.stderr:write("sodium module missing but AUTH_REQUIRE_SIGNATURE=1\n")
     os.exit(1)