sodium-native: Segmentation fault using 3.4.1 (musl, x64)

Given the following Dockerfile

FROM node:16.16.0-alpine3.16

ENTRYPOINT "sh"

RUN apk add --no-cache \
    python3 \
    build-base \
    cmake \
    cairo-dev \
    jpeg-dev \
    pango-dev \
    git

WORKDIR /app

# Adapted from https://github.com/sodium-friends/sodium-native/blob/32ae395ad558ec86680c547b909daf3a13b2dea8/test/crypto_secretbox.js#L4-L32
RUN echo " \
const sodium = require('sodium-native');\
\
const message = Buffer.from('Hej, Verden!');\
const output = Buffer.alloc(message.length + sodium.crypto_secretbox_MACBYTES);\
\
const key = Buffer.alloc(sodium.crypto_secretbox_KEYBYTES);\
sodium.randombytes_buf(key);\
\
const nonce = Buffer.alloc(sodium.crypto_secretbox_NONCEBYTES);\
sodium.randombytes_buf(nonce);\
\
const result = Buffer.alloc(output.length - sodium.crypto_secretbox_MACBYTES);\
\
sodium.crypto_secretbox_easy(output, message, nonce, key);\
\
sodium.crypto_secretbox_open_easy(result, output, nonce, key);\
\
console.log({ result, message });\
" > index.js

RUN npm init -y && npm install --save sodium-native@3.4.1

Run docker build -t sodium . && docker run sodium followed by node index.js inside the image to see it segfault.

If you install sodium-native@3.3.0 instead, it runs fine.

---

Note that I’m not able to reproduce this when built on an M1 mac, only on an x64 one. So this might be instruction set dependent.