M7 C Crypto releases and integrity
Current status
Version 0.3.0 is a verified development candidate, not a confirmed public release. Candidate source bundles and their two sidecars have passed integrity and reproducibility checks. Final reviewed source tagging, release generation and public availability verification remain pending. There are no verified public download links on this page yet.
Native acceptance recorded on 2026-09-20 UTC covers macOS arm64, OpenSSL 3.6.3, all 18 signing profiles, key generation/export, RSA-OAEP and provider-failure tests. UBSan trap mode and native leak checks passed; ASan was not run on macOS. Linux 0.3.0 and native binary distribution acceptance remain pending. These results describe the tested candidate, not an arbitrary later source snapshot.
Distribution contract
Each version has three files:
m7-c-crypto-<version>.tar.gz
m7-c-crypto-<version>.tar.gz.sha256
m7-c-crypto-<version>.tar.gz.manifest.json
The planned public path is
https://m7.org/downloads/m7-c-crypto/<version>/. A planned path is not proof of
availability. When a release is published, this page will link all three exact
files only after their public bytes have been compared with the reviewed
bundle. Existing immutable versions must not be overwritten with changed bytes.
The archive contains one versioned source root, MANIFEST.json and
CHECKSUMS.sha256. The JSON sidecar is byte-identical to the embedded manifest;
the SHA-256 sidecar hashes the whole compressed archive. Source version,
changelog, archive name/root, manifest and annotated
m7-c-crypto-v<version> tag must agree for a final release. The manifest records
source commit, normalized epoch, dependency constraints and file hashes.
Follow checksum-first installation. A source archive requires compilation; it is not a platform-neutral shared-library binary. A checksum establishes integrity relative to the sidecar, not publisher identity. Obtain both through a trusted release channel.
Development candidate, final local release, website staging and verified public release are separate states. An installed library or a passing test does not by itself establish the latter. C and PHP artifacts remain separate; the PHP release must record and test its exact C dependency.
Changes by source version
| Source version | Main change | Availability meaning |
|---|---|---|
| 0.3.0 | Adds RSA-OAEP-256 through an additive encryption getter; adds immutable source-release tooling | Current verified development candidate |
| 0.2.0 | Adds key generation and PEM export through an additive getter | Historical source milestone; not a current public download claim |
| 0.1.0 | Establishes key import and the signing/verification family tables | Historical source milestone; not a current public download claim |
Current public documentation describes 0.3.0. It is maintained separately from
immutable archive contents; a later documentation correction does not replace
an existing archive. Read the shipped changelog for the selected source bundle.
The package is distributed under MTL-10; LICENSE.md is included in the bundle.
Return to M7 C Crypto.