M7 C Crypto releases and integrity

Current status

Version 0.3.0 is a verified development candidate, not a confirmed public release. Candidate source bundles and their two sidecars have passed integrity and reproducibility checks. Final reviewed source tagging, release generation and public availability verification remain pending. There are no verified public download links on this page yet.

Native acceptance recorded on 2026-09-20 UTC covers macOS arm64, OpenSSL 3.6.3, all 18 signing profiles, key generation/export, RSA-OAEP and provider-failure tests. UBSan trap mode and native leak checks passed; ASan was not run on macOS. Linux 0.3.0 and native binary distribution acceptance remain pending. These results describe the tested candidate, not an arbitrary later source snapshot.

Distribution contract

Each version has three files:

m7-c-crypto-<version>.tar.gz
m7-c-crypto-<version>.tar.gz.sha256
m7-c-crypto-<version>.tar.gz.manifest.json

The planned public path is https://m7.org/downloads/m7-c-crypto/<version>/. A planned path is not proof of availability. When a release is published, this page will link all three exact files only after their public bytes have been compared with the reviewed bundle. Existing immutable versions must not be overwritten with changed bytes.

The archive contains one versioned source root, MANIFEST.json and CHECKSUMS.sha256. The JSON sidecar is byte-identical to the embedded manifest; the SHA-256 sidecar hashes the whole compressed archive. Source version, changelog, archive name/root, manifest and annotated m7-c-crypto-v<version> tag must agree for a final release. The manifest records source commit, normalized epoch, dependency constraints and file hashes.

Follow checksum-first installation. A source archive requires compilation; it is not a platform-neutral shared-library binary. A checksum establishes integrity relative to the sidecar, not publisher identity. Obtain both through a trusted release channel.

Development candidate, final local release, website staging and verified public release are separate states. An installed library or a passing test does not by itself establish the latter. C and PHP artifacts remain separate; the PHP release must record and test its exact C dependency.

Changes by source version

Source version Main change Availability meaning
0.3.0 Adds RSA-OAEP-256 through an additive encryption getter; adds immutable source-release tooling Current verified development candidate
0.2.0 Adds key generation and PEM export through an additive getter Historical source milestone; not a current public download claim
0.1.0 Establishes key import and the signing/verification family tables Historical source milestone; not a current public download claim

Current public documentation describes 0.3.0. It is maintained separately from immutable archive contents; a later documentation correction does not replace an existing archive. Read the shipped changelog for the selected source bundle. The package is distributed under MTL-10; LICENSE.md is included in the bundle.

Return to M7 C Crypto.