Investigate argon2 issue (Termux/Raspberry Pi)

[jsjoeio]

We've had numerous reports of argon2 causing issues on Raspberry Pi and Linux (see here). We need to investigate argon2 (repo here) to see if it's possible to build from source on those devices.

I have a Pixel 2 with Termux so I can test there. Or we can spin up a dev environment on Coder that mimics Termux (Alpine Linux I think) or Raspberry Pi and test there.

If we can get argon2 working, then we'll be able to unblock both Termux and Pi users of code-server.

Special thanks to @im-coder-lg for all their help debugging this!

[im-coder-lg]

I kinda feel like Termux is a combination of FreeBSD and Debian since it includes apt and pkg package managers. But the Argon2 error is affecting the entire NPM package.
Yesterday, I was exploring my Raspberry Pi that has MATE, and an idea flashed in my mind. In one of the discussions, @Slodziak190q told to install code-server's 3.10.0 version and that worked successfully, providing that it took some time. It works now, and it included a hashed password there.

Wait a minute, let's go a minute back. What if Argon2's 0.28.0 release has the error?

I just had a fantastic idea! @jsjoeio can you tell me when did Argon2 get implemented, before 3.10.0 or after 3.10.0? If it's after that, then why can't we use the older hashing module? Because, I observed, the password was hashed in my Pi, and I changed it, but it was hashed. If Argon2 was implemented before 3.10.0, we need to use an older version of Argon2, that might work, right?

[im-coder-lg]

Can we create an x86 installer for code-server?

[jsjoeio]

I just had a fantastic idea! @jsjoeio can you tell me when did Argon2 get implemented, before 3.10.0 or after 3.10.0? If it's after that, then why can't we use the older hashing module? Because, I observed, the password was hashed in my Pi, and I changed it, but it was hashed. If Argon2 was implemented before 3.10.0, we need to use an older version of Argon2, that might work, right?

Hmm...possibly! For hashing, we used sha256 which I think came from crypto which is built-in/native to Node. I added argon2 in this PR which came out in 3.11.0. That explains why 3.10.0 works.

It's supposed to be more secure because it requires more computational effort for the password hashing. I still think we need to look more into argon2 to fix this.

[jwannebo]

I appear to have picked the worst time to try code-server out on Termux, but I may have a lead on the argon issue. I unzipped the pre-built package in my Termux install, then changed the launch script to use the system node, and got this error:

~/.../code-server-3.12.0-linux-arm64/bin $ ./code-server
node:internal/modules/cjs/loader:1183
  return process.dlopen(module, path.toNamespacedPath(filename));
                 ^

Error: dlopen failed: library "libstdc++.so.6" not found: needed by /data/data/com.termux/files/home/code/code-server-3.12.0-linux-arm64/node_modules/argon2/lib/binding/napi-v3/argon2.node in namespace (default)
    at Object.Module._extensions..node (node:internal/modules/cjs/loader:1183:18)
    at Module.load (node:internal/modules/cjs/loader:981:32)
    at Function.Module._load (node:internal/modules/cjs/loader:822:12)
    at Module.require (node:internal/modules/cjs/loader:1005:19)
    at require (node:internal/modules/cjs/helpers:102:18)
    at Object.<anonymous> (/data/data/com.termux/files/home/code/code-server-3.12.0-linux-arm64/node_modules/argon2/argon2.js:9:56)
    at Module._compile (node:internal/modules/cjs/loader:1101:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1153:10)
    at Module.load (node:internal/modules/cjs/loader:981:32)
    at Function.Module._load (node:internal/modules/cjs/loader:822:12) {
  code: 'ERR_DLOPEN_FAILED'
}

I can confirm there's no libstdc++.so of any flavor in the libs folder, build-essentials omitted it, and gcc isn't on pkg to install it.

Edit: I just extracted 3.10 with the script edited in the same way, and was able to launch it ok.

[jsjoeio]

Thanks for the notes @jwannebo! Right now we're recommending people install on Termux via yarn/npm but I know there are also Node version errors.

3.10 doesn't have issues because argon2 was adding in 3.11.0 I believe. Thanks for confirming though!

[im-coder-lg]

Any updates? Should we open a ticket at Argon2 and mention this issue there?

[im-coder-lg]

I just hopped onto the Argon2 repo and discovered something. Issue 317, ranisalt/node-argon2(don't want to mention it here because it might cause problems, idk but @jsjoeio what do you say? Linking our related Argon2 problems here?
Title: node-argon2 version 0.28.2 uses a vulnerable strip-ANSI package
We use 0.28.2, right? Might be related.
Issue 278, 276 and 305 on node-argon2 seems kinda related.
278's title: Installing fails on Windows(is this related?)
276's title: Broken argon2.node on RHEL7(Red Hat Enterprise Linux, I think it's similar to Fedora, I think it uses dnf)
305: Build fails on Node 16.4 ARM M1(this seems too related except the Node version, what processor does your Mac run on @jsjoeio?)
If you want to link them, feel free, but also I think we must open a ticket at Argon2 and get help from the maintainers there.