M7 C Crypto releases and integrity
Current public release
0.3.0 is a publicly verified source release, released 2026-10-11.
ZIP and tar.gz require compilation and contain the same source, MTL-10 notices,
standalone docs/INSTALL.md build/installation/activation/upgrade/rollback guide,
MANIFEST.json and CHECKSUMS.sha256. No precompiled binaries are offered.
All six public files have been retrieved and matched to the reviewed local bundle.
| Format | Archive | Checksum | Manifest |
|---|---|---|---|
| ZIP source | Download | SHA-256 | Manifest |
| TAR.GZ source | Download | SHA-256 | Manifest |
Start with checksum-first installation. The AlmaLinux C/PHP walkthrough starts with C; C-only consumers can stop before PHP.
Source tag: m7-c-crypto-v0.3.0. Source commit:
6ba4cac742802d1154a229145a2a134250eb3b19. Two independent clean source rebuilds reproduce
all six files byte-for-byte. Stored ZIP entries and fixed stored DEFLATE blocks
in gzip avoid compressor-version differences, at the cost of compression ratio.
Both manifest sidecars are identical to each other and to the embedded manifest.
Each checksum sidecar covers its complete archive; embedded checksums inventory
the allowlisted payload. Checksums detect mismatches, not publisher identity.
Obtain the files through the trusted HTTPS channel.
Exact supported validation matrix
| Platform | Runtime and acceptance |
|---|---|
| AlmaLinux 10.2 aarch64, isolated container | OpenSSL 3.5.8 default provider, GCC 14.3.1; all-profile C correctness and ASan/UBSan with leak detection passed |
| macOS 26.6.1 arm64 | OpenSSL 3.6.3; all-profile C correctness, UBSan trap mode and four native leak checks passed; ASan was not run |
These results cover the exact offered 0.3.0 source payload. All 18 signing/MAC profiles, generation/export, RSA-OAEP-256 and unavailable-provider/failure paths were exercised. Linux PHP memory checks covered signing (1,000 cycles), key generation (three cycles/profile) and encryption (1,000 cycles), with zero errors and no definite/indirect/possible leaks; still-reachable runtime allocations were reported separately. Memory tests cover exercised paths, not exhaustive fuzzing.
Linux results are from an isolated container, including fresh CLI/FPM activation, 0.2-to-0.3 upgrade, rollback and reactivation tests. Production SELinux labeling, application-worker deployment and other architectures remain deployment-specific checks. Additional PHP versions, ZTS/debug builds and precompiled binaries are not validated by this release. PHP's 8.4+ compile gate does not expand the tested matrix. C-only consumers do not need PHP.
Immutable versions and historical evidence
Published archives and sidecars are immutable. Changed archive content requires a new version; separately maintained public documentation may be corrected without replacing archive bytes. A candidate, tagged local bundle, staged files, installed runtime and publicly verified release remain distinct states.
The September 20 macOS 0.3.0 candidate and older Linux 0.1/0.2 installation records remain historical evidence; they did not prove this final release. Current final-artifact acceptance is stated above. Source 0.3 adds the additive RSA-OAEP-256 encryption API and source-distribution tooling; 0.2 added generation and PEM export; 0.1 established import and signing/verification.
Native crypto remains optional for ordinary Identity SDK use. It does not select trusted algorithms or supply keys. The current browser session path stores complete JWTs in single cookies: ML-DSA-65/87 signatures alone exceed cookie limits and ML-DSA-44 depends on payload size. This release does not change that storage contract. See browser limits.
Return to M7 C Crypto.