# M7 C Crypto releases and integrity

## Current status

Version **0.3.0 is a verified development candidate**, not a confirmed public
release. Candidate source bundles and their two sidecars have passed integrity
and reproducibility checks. Final reviewed source tagging, release generation
and public availability verification remain pending. There are no verified
public download links on this page yet.

Native acceptance recorded on 2026-09-20 UTC covers macOS arm64, OpenSSL 3.6.3,
all 18 signing profiles, key generation/export, RSA-OAEP and provider-failure
tests. UBSan trap mode and native leak checks passed; ASan was not run on macOS.
Linux 0.3.0 and native binary distribution acceptance remain pending. These
results describe the tested candidate, not an arbitrary later source snapshot.

## Distribution contract

Each version has three files:

```text
m7-c-crypto-<version>.tar.gz
m7-c-crypto-<version>.tar.gz.sha256
m7-c-crypto-<version>.tar.gz.manifest.json
```

The planned public path is
`https://m7.org/downloads/m7-c-crypto/<version>/`. A planned path is not proof of
availability. When a release is published, this page will link all three exact
files only after their public bytes have been compared with the reviewed
bundle. Existing immutable versions must not be overwritten with changed bytes.

The archive contains one versioned source root, `MANIFEST.json` and
`CHECKSUMS.sha256`. The JSON sidecar is byte-identical to the embedded manifest;
the SHA-256 sidecar hashes the whole compressed archive. Source version,
changelog, archive name/root, manifest and annotated
`m7-c-crypto-v<version>` tag must agree for a final release. The manifest records
source commit, normalized epoch, dependency constraints and file hashes.

Follow [checksum-first installation](https://m7.org/docs/sdk/m7-c-crypto/integration/installation.md). A source
archive requires compilation; it is not a platform-neutral shared-library
binary. A checksum establishes integrity relative to the sidecar, not publisher
identity. Obtain both through a trusted release channel.

Development candidate, final local release, website staging and verified public
release are separate states. An installed library or a passing test does not
by itself establish the latter. C and PHP artifacts remain separate; the PHP
release must record and test its exact C dependency.

## Changes by source version

| Source version | Main change | Availability meaning |
| --- | --- | --- |
| 0.3.0 | Adds RSA-OAEP-256 through an additive encryption getter; adds immutable source-release tooling | Current verified development candidate |
| 0.2.0 | Adds key generation and PEM export through an additive getter | Historical source milestone; not a current public download claim |
| 0.1.0 | Establishes key import and the signing/verification family tables | Historical source milestone; not a current public download claim |

Current public documentation describes 0.3.0. It is maintained separately from
immutable archive contents; a later documentation correction does not replace
an existing archive. Read the shipped changelog for the selected source bundle.
The package is distributed under MTL-10; `LICENSE.md` is included in the bundle.

Return to [M7 C Crypto](https://m7.org/docs/sdk/m7-c-crypto/README.md).