M7 PHP Crypto releases and integrity
Current public release
0.3.0 is a publicly verified source release, released 2026-10-11.
ZIP and tar.gz require compilation and contain the same source, MTL-10 notices,
standalone docs/INSTALL.md build/installation/activation/upgrade/rollback guide,
MANIFEST.json and CHECKSUMS.sha256. No precompiled binaries are offered.
All six public files have been retrieved and matched to the reviewed local bundle.
| Format | Archive | Checksum | Manifest |
|---|---|---|---|
| ZIP source | Download | SHA-256 | Manifest |
| TAR.GZ source | Download | SHA-256 | Manifest |
Start with checksum-first installation and the AlmaLinux C/PHP walkthrough.
Source tag: m7-php-crypto-v0.3.0. Source commit:
ded5faa236cc7356799bff1825da16295c86b72c. Two independent clean source rebuilds reproduce
all six files byte-for-byte. Stored ZIP entries and fixed stored DEFLATE blocks
in gzip avoid compressor-version differences, at the cost of compression ratio.
Both manifest sidecars are identical to each other and to the embedded manifest.
Each checksum sidecar covers its complete archive; embedded checksums inventory
the allowlisted payload. Checksums detect mismatches, not publisher identity.
Obtain the files through the trusted HTTPS channel.
Exact supported validation matrix
| Platform | Runtime and acceptance |
|---|---|
| AlmaLinux 10.2 aarch64, isolated container | PHP 8.4.24 NTS/non-debug, API 20240924, OpenSSL 3.5.8 default provider; six PHPT passes, zero failures/warnings/skips, Node interoperability and three Valgrind drivers passed |
| macOS 26.6.1 arm64 | PHP 8.4.4 NTS/non-debug, API 20240924, OpenSSL 3.6.3; six PHPT passes, Node interoperability and three native leak checks passed |
These results cover the exact offered 0.3.0 source payload. All 18 signing/MAC profiles, generation/export, RSA-OAEP-256 and unavailable-provider/failure paths were exercised. Linux PHP memory checks covered signing (1,000 cycles), key generation (three cycles/profile) and encryption (1,000 cycles), with zero errors and no definite/indirect/possible leaks; still-reachable runtime allocations were reported separately. Memory tests cover exercised paths, not exhaustive fuzzing.
This release was built and tested against M7 C Crypto 0.3.0, tag
m7-c-crypto-v0.3.0. Its exact dependency hashes are:
- C ZIP SHA-256:
98358fea75dc7b6ec6f17a69e9330baf61cc1e9830a959d5fa176683e9689239. - C tar.gz SHA-256:
aa41391bbf5ab857d9e9d6d1b4aca4821befce4b1bd07b6040c35ae584ae1ede.
The PHP manifest pins both hashes. C remains a separate package; PHP does not bundle a C binary. Headers and loaded C runtime must provide the 0.3 encryption getter as well as the existing signing and generation tables.
Linux results are from an isolated container, including fresh CLI/FPM activation, 0.2-to-0.3 upgrade, rollback and reactivation tests. Production SELinux labeling, application-worker deployment and other architectures remain deployment-specific checks. Additional PHP versions, ZTS/debug builds and precompiled binaries are not validated by this release. PHP's 8.4+ compile gate does not expand the tested matrix. C-only consumers do not need PHP.
Immutable versions and historical evidence
Published archives and sidecars are immutable. Changed archive content requires a new version; separately maintained public documentation may be corrected without replacing archive bytes. A candidate, tagged local bundle, staged files, installed runtime and publicly verified release remain distinct states.
The September 20 macOS 0.3.0 candidate and older Linux 0.1/0.2 installation records remain historical evidence; they did not prove this final release. Current final-artifact acceptance is stated above. Source 0.3 adds the additive RSA-OAEP-256 encryption API and source-distribution tooling; 0.2 added generation and PEM export; 0.1 established import and signing/verification.
Native crypto remains optional for ordinary Identity SDK use. It does not select trusted algorithms or supply keys. The current browser session path stores complete JWTs in single cookies: ML-DSA-65/87 signatures alone exceed cookie limits and ML-DSA-44 depends on payload size. This release does not change that storage contract. See browser limits.
Return to M7 PHP Crypto.