# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [Unreleased]
## [0.1.10] — 2026-04-27
### Added
- `synta.crypto.aes_gcm_encrypt` / `aes_gcm_decrypt` — AES-GCM (AEAD)
authenticated encryption with 128/192/256-bit keys, a 12-byte nonce, and
optional additional authenticated data (AAD). Output is `ciphertext ‖
16-byte tag`; decryption raises `ValueError` on authentication failure.
## [0.1.9] — 2026-04-18
This release adds three new Python APIs and usage examples, and rewrites the
CMS builder internals to use generated ASN.1 structs instead of hand-rolled
DER helpers.
### Added
- **`synta.cms.SignedDataBuilder`** — creates RFC 5652 CMS `SignedData`
structures. Supports attached and detached content, multiple signers,
embedded certificates, and the standard signed attributes (`contentType`,
`messageDigest`).
- **`PrivateKey.from_pkcs11_uri(uri)`** — loads a private key from a PKCS#11
URI for HSM-backed signing. Available under both the `openssl` and `nss`
build features.
- **`create_pkcs12(cipher=, mac_algorithm=)`** — the PKCS#12 export helper now
accepts `cipher` (`'aes128'` / `'aes256'`) and `mac_algorithm`
(`'sha256'` / `'sha384'` / `'sha512'`) keyword arguments for configurable
encryption and integrity protection.
- Usage examples: CMS SignedData signing (`examples/cms_signed_data.py`) and
DN formatting / name utilities (`examples/dn_formatting.py`).
- Type stubs (`.pyi`) for `SignedDataBuilder` and supporting types.
### Changed
- CMS `SignedDataBuilder` implementation rewritten to use the generated
`cms_rfc5652_types` structs (`Attribute`, `EncapsulatedContentInfo`,
`SignerInfo`, `IssuerAndSerialNumber`). All hand-rolled DER helpers
(`oid_tlv`, `set_of_one`, `encode_attribute`, `build_iasn_der`) removed.
## [0.1.8] — 2026-04-16
### Added
- Propagate nss/openssl feature flags across workspace crates
### Changed
- Use DefaultCrypto for PKCS12 and read_pki_blocks
- Use DefaultCrypto; remove openssl feature gates
- Openssl takes priority over nss at module level
### Fixed
- Fix misattributed OCSP doc block and add constructor docs
- Gate OpenSSL-only CMS and key ops under openssl feature
## [0.1.7] — 2026-04-15
## [0.1.6] — 2026-04-11
## [0.1.5] — 2026-04-11
### Security
- Add Python wrapper for RFC 2634 Extended Security Services builders
### Added
- Register new RFC builder pyclasses and add __init__.pyi stubs
- Add Python wrapper for RFC 7773 ACE-88 authentication context builder
- Add Python wrapper for RFC 9399 Logotype extension builder
- Add Python wrapper for RFC 8018 PKCS#5 v2.1 parameter builders
- Add Python wrapper for RFC 3161 Time-Stamp Protocol builders
- Add hkdf_extract, hkdf_expand, and HmacDigest to synta.crypto
- Add IPAddress.value returning ipaddress.IPv4Address/IPv6Address
- Expose subject_public_key_info_der on CertificationRequest
- Add OwnedStore to eliminate per-call CA cert re-parsing
- Expose to_der/from_der on primitive and string types
- Add AcmeAuthorization Python binding for RFC 8737
- Propagate nss feature to synta-ffi, synta-python, synta-x509-verification
- Add PublicKey.verify_certificate_signature and Certificate.signature_algorithm_der
- Split _synta.so — synta-python-mtc
- Split synta.krb5 into standalone synta-python-krb5 extension module
- Add AlgorithmIdentifier class to synta and synta.pkixalgs
- Add IssuerAltName, IssuingDistPoint, CertPolicies extension builders
- Expose CRLDistributionPointsBuilder and SAN.other_name() to Python
- Add Krb5PrincipalName.to_othername_der() for PKINIT SAN building
- Expose NameConstraintsBuilder and NAME_CONSTRAINTS OID to Python
- Add ML-DSA and ML-KEM support to PrivateKey and PublicKey
- Add verify_issued_by() to AttributeCertificate
- Add verify_signature() to OCSPResponse
- Add verify_issued_by() to CertificateList
- Add verify_self_signature() to CertificationRequest
- Add generate_ed25519(), generate_ed448(), and sign() to PrivateKey
- Add Python bindings for PKCS#9 attributes
- Add Python bindings for PKCS#8 (OneAsymmetricKey)
- Synta-certificate: add OCSPResponseBuilder for RFC 6960 OCSP responses
- Synta-certificate: add CertificateListBuilder for RFC 5280 §5 CRLs
- Synta-certificate: add SinglePubInfo pubLocation support to CertReqMsgBuilder
- Synta-certificate: add AttributeCertificateBuilder
- Add from_pem/to_pem to PyAttributeCertificate
- Add registered_id to SubjectAlternativeNameBuilder
- Add Python bindings for CertReqMsgBuilder and CertReqMessagesBuilder
- Add CMPMessageBuilder to synta.cmp
- Add synta.kem submodule
- Add Krb5PrincipalName.name getter, UPN support and typed GeneralName integration
- Expose PolicyQualifier, PolicyInformation and certificate_policies()
- Add Microsoft PKI (AD CS) submodule and stubs
- Add typed GeneralName Python classes and updated stubs
- Add Kerberos FAST and shared krb5 helper modules
- Add Merkle Tree Certificate Python bindings and stubs
- Add SPNEGO Python bindings and stubs
- Add synta-mtc dependency
### Changed
- Extract synta-python-common shared rlib
- Fix fragile double-borrow-mut and deduplicate config
### Fixed
- Resolve all broken intra-doc links and invalid code blocks
- Use single borrow_mut guard in all PyO3 builder setters
- Fix doc comment, single-guard setters, add security category binding
- Correct CertificationRequest.subject_alt_names() docstring
- AttributeCertificate.to_pem() must return bytes, not str
- Use IMPLICIT tagging for GeneralName otherName and ediPartyName
- Make Decoder encoding argument optional, defaulting to DER
- Fix subject_public_key_info_raw_der → subject_public_key_info_der in doc comments
- Fix 8 bugs found in deep review
### Removed
- Remove unused DER helper functions from general_name.rs
## [0.1.4] — 2026-04-05
### Added
- Synta-certificate, synta-python: add missing DN attribute OIDs (Gap D)
- Synta-certificate, synta-python: add PublicKey construction from raw components
- Synta-certificate, synta-python: add CertificateList version/crl_number/extensions API
- Add CertificationRequest extension access API
## [0.1.3] — 2026-04-05
### Added
- Add CHANGELOG.md for v0.1.3
- Add CHANGELOG.md for v0.1.2
- Split cms.rs into a module directory
- Expose SAN/AIA/EKU extension builders in synta.ext
- Synta-certificate, synta-python: add RFC 9925 unsigned certificate OIDs
- Synta-certificate, synta-python: add CMS EnvelopedData decryption
- Add synta.ext submodule for extension DER builders
- Synta-certificate,synta-python: add CMS EnvelopedData builder
- Add create_pkcs12 pyfunction
- Add PrivateKey.to_pkcs8_encrypted / from_pkcs8_encrypted
- Synta-certificate,synta-python: add CsrBuilder for PKCS#10 CSR construction
- Synta-certificate,synta-python: add KeyEncryptor/KeyDecryptor traits; unify RSA crypto
- Synta-certificate: add CertificateBuilder; synta-python: delegate to it
- Add CertificateBuilder with zero-copy DER splicing
- Add tbs_certificate_der, verify_issued_by, OTP, key gen, verify_signature
- Add crypto submodule and X.509 encoding helpers for FreeIPA
- Add PublicKey and PrivateKey classes for FreeIPA migration (Phase 4)
- Add FreeIPA-needed Certificate getters and digest function
- Expose OcspStore and ocsp= kwarg in synta.x509
- Expose CrlStore for CRL-based revocation checking
- Add synta.x509 certificate chain verification submodule
- Reorganize certificate/types into subdirectories; add pkixalgs/ac/crmf/cmp submodules
### Fixed
- Fix //! module doc in crypto.rs
### Removed
- Remove direct OpenSSL dependency; use synta-certificate crypto traits
- Expose NameBuilder and remove backend type leakage
## [0.1.2] — 2026-04-05
### Added
- Add CHANGELOG.md for v0.1.2
- Split cms.rs into a module directory
- Expose SAN/AIA/EKU extension builders in synta.ext
- Synta-certificate, synta-python: add RFC 9925 unsigned certificate OIDs
- Synta-certificate, synta-python: add CMS EnvelopedData decryption
- Add synta.ext submodule for extension DER builders
- Synta-certificate,synta-python: add CMS EnvelopedData builder
- Add create_pkcs12 pyfunction
- Add PrivateKey.to_pkcs8_encrypted / from_pkcs8_encrypted
- Synta-certificate,synta-python: add CsrBuilder for PKCS#10 CSR construction
- Synta-certificate,synta-python: add KeyEncryptor/KeyDecryptor traits; unify RSA crypto
- Synta-certificate: add CertificateBuilder; synta-python: delegate to it
- Add CertificateBuilder with zero-copy DER splicing
- Add tbs_certificate_der, verify_issued_by, OTP, key gen, verify_signature
- Add crypto submodule and X.509 encoding helpers for FreeIPA
- Add PublicKey and PrivateKey classes for FreeIPA migration (Phase 4)
- Add FreeIPA-needed Certificate getters and digest function
- Expose OcspStore and ocsp= kwarg in synta.x509
- Expose CrlStore for CRL-based revocation checking
- Add synta.x509 certificate chain verification submodule
- Reorganize certificate/types into subdirectories; add pkixalgs/ac/crmf/cmp submodules
### Fixed
- Fix //! module doc in crypto.rs
### Removed
- Remove direct OpenSSL dependency; use synta-certificate crypto traits
- Expose NameBuilder and remove backend type leakage