# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [Unreleased]
## [0.2.2] — 2026-05-08
Version bump to stay in sync with the workspace. No functional changes in the
Python extension itself; `synta.mtc.InclusionProof` now exposes `subtree_start`
and `subtree_end` instead of the removed `log_entry_index` and `tree_size`
attributes — see the `synta-mtc` changelog for details.
## [0.2.1] — 2026-05-02
### Fixed
- CRL and OCSP serial number bytes are now decoded with `from_unsigned_bytes()`
so that values with the high bit set round-trip correctly without sign
extension.
## [0.2.0] — 2026-05-01
### Added
- **`synta.pkcs11`** — new submodule for PKCS#11 token management.
`Pkcs11Token(uri)` exposes `find_key(uri)`, `list_keys()`,
`delete_key(uri)`, and `generate_key_pair(key_type, param, label)`.
The module-level `list_slots()` enumerates all available tokens.
`SlotInfo` and `KeyInfo` carry token and key metadata respectively.
PINs are redacted in error messages and `repr` output.
## [0.1.12] — 2026-04-30
This release completes the OCSP Python surface: parsed request types, a fluent
request builder, and a CRL Number extension helper round out the OCSP and CRL
tooling introduced in 0.1.11.
### Added
- **`OCSPRequest` / `CertID`** — parsed OCSP request types (RFC 6960).
`OCSPRequest.from_der` / `from_pem` / `to_der` / `to_pem` decode and
re-encode OCSP requests; the `request_list` property returns a list of
`CertID` objects exposing `hash_algorithm_oid`, `issuer_name_hash`,
`issuer_key_hash`, and `serial_number`. `requestor_name` and
`request_extensions` return the raw DER bytes of the optional fields.
- **`OCSPRequestBuilder` / `OCSPCertIDSpec`** — fluent builder for unsigned
and signed OCSP requests. `OCSPCertIDSpec` carries the per-certificate
parameters (hash algorithm, issuer hashes, serial); chain `.add_request()`
calls to bundle multiple certificates in one request. `build_tbs()` produces
a ready-to-submit unsigned `OCSPRequest`; `build_tbs_inner()` + `assemble()`
support the external-signing path. `requestor_name()` sets the optional
`[0] EXPLICIT GeneralName` field.
- **`synta.ext.crl_number(n)`** — builds the DER extension value for the CRL
Number extension (OID 2.5.29.20). Pass the result as `value_der` to
`CertificateListBuilder.add_extension()`.
- **`synta.oids.CRL_NUMBER`** — `ObjectIdentifier` constant for OID 2.5.29.20
(`id-ce-cRLNumber`), re-exported from the generated X.509 types.
- **`CertificateListBuilder.add_extension(oid, ...)`** — the `oid` parameter
now accepts either a dotted-decimal OID string or a `synta.ObjectIdentifier`
instance (e.g. `synta.oids.CRL_NUMBER`), eliminating manual string
conversion for callers who already hold an OID constant.
### Changed
- **`CMS SignedDataBuilder`** internals rewritten to use the generated
`ContentInfo` / `SignedData` ASN.1 structs instead of hand-rolled DER
helpers. The Python API is unchanged; the rewrite fixes edge-case encoding
differences and reduces maintenance surface.
- PKCS#9 attribute OIDs in `SignedDataBuilder` are now referenced by named
constants (`synta.oids.pkcs9.*`) instead of hardcoded hex strings.
## [0.1.11] — 2026-04-29
Version bump to stay in sync with the workspace. No functional changes.
## [0.1.10] — 2026-04-27
### Added
- `synta.crypto.aes_gcm_encrypt` / `aes_gcm_decrypt` — AES-GCM (AEAD)
authenticated encryption with 128/192/256-bit keys, a 12-byte nonce, and
optional additional authenticated data (AAD). Output is `ciphertext ‖
16-byte tag`; decryption raises `ValueError` on authentication failure.
## [0.1.9] — 2026-04-18
This release adds three new Python APIs and usage examples, and rewrites the
CMS builder internals to use generated ASN.1 structs instead of hand-rolled
DER helpers.
### Added
- **`synta.cms.SignedDataBuilder`** — creates RFC 5652 CMS `SignedData`
structures. Supports attached and detached content, multiple signers,
embedded certificates, and the standard signed attributes (`contentType`,
`messageDigest`).
- **`PrivateKey.from_pkcs11_uri(uri)`** — loads a private key from a PKCS#11
URI for HSM-backed signing. Available under both the `openssl` and `nss`
build features.
- **`create_pkcs12(cipher=, mac_algorithm=)`** — the PKCS#12 export helper now
accepts `cipher` (`'aes128'` / `'aes256'`) and `mac_algorithm`
(`'sha256'` / `'sha384'` / `'sha512'`) keyword arguments for configurable
encryption and integrity protection.
- Usage examples: CMS SignedData signing (`examples/cms_signed_data.py`) and
DN formatting / name utilities (`examples/dn_formatting.py`).
- Type stubs (`.pyi`) for `SignedDataBuilder` and supporting types.
### Changed
- CMS `SignedDataBuilder` implementation rewritten to use the generated
`cms_rfc5652_types` structs (`Attribute`, `EncapsulatedContentInfo`,
`SignerInfo`, `IssuerAndSerialNumber`). All hand-rolled DER helpers
(`oid_tlv`, `set_of_one`, `encode_attribute`, `build_iasn_der`) removed.
## [0.1.8] — 2026-04-16
### Added
- Propagate nss/openssl feature flags across workspace crates
### Changed
- Use DefaultCrypto for PKCS12 and read_pki_blocks
- Use DefaultCrypto; remove openssl feature gates
- Openssl takes priority over nss at module level
### Fixed
- Fix misattributed OCSP doc block and add constructor docs
- Gate OpenSSL-only CMS and key ops under openssl feature
## [0.1.7] — 2026-04-15
## [0.1.6] — 2026-04-11
## [0.1.5] — 2026-04-11
### Security
- Add Python wrapper for RFC 2634 Extended Security Services builders
### Added
- Register new RFC builder pyclasses and add __init__.pyi stubs
- Add Python wrapper for RFC 7773 ACE-88 authentication context builder
- Add Python wrapper for RFC 9399 Logotype extension builder
- Add Python wrapper for RFC 8018 PKCS#5 v2.1 parameter builders
- Add Python wrapper for RFC 3161 Time-Stamp Protocol builders
- Add hkdf_extract, hkdf_expand, and HmacDigest to synta.crypto
- Add IPAddress.value returning ipaddress.IPv4Address/IPv6Address
- Expose subject_public_key_info_der on CertificationRequest
- Add OwnedStore to eliminate per-call CA cert re-parsing
- Expose to_der/from_der on primitive and string types
- Add AcmeAuthorization Python binding for RFC 8737
- Propagate nss feature to synta-ffi, synta-python, synta-x509-verification
- Add PublicKey.verify_certificate_signature and Certificate.signature_algorithm_der
- Split _synta.so — synta-python-mtc
- Split synta.krb5 into standalone synta-python-krb5 extension module
- Add AlgorithmIdentifier class to synta and synta.pkixalgs
- Add IssuerAltName, IssuingDistPoint, CertPolicies extension builders
- Expose CRLDistributionPointsBuilder and SAN.other_name() to Python
- Add Krb5PrincipalName.to_othername_der() for PKINIT SAN building
- Expose NameConstraintsBuilder and NAME_CONSTRAINTS OID to Python
- Add ML-DSA and ML-KEM support to PrivateKey and PublicKey
- Add verify_issued_by() to AttributeCertificate
- Add verify_signature() to OCSPResponse
- Add verify_issued_by() to CertificateList
- Add verify_self_signature() to CertificationRequest
- Add generate_ed25519(), generate_ed448(), and sign() to PrivateKey
- Add Python bindings for PKCS#9 attributes
- Add Python bindings for PKCS#8 (OneAsymmetricKey)
- Synta-certificate: add OCSPResponseBuilder for RFC 6960 OCSP responses
- Synta-certificate: add CertificateListBuilder for RFC 5280 §5 CRLs
- Synta-certificate: add SinglePubInfo pubLocation support to CertReqMsgBuilder
- Synta-certificate: add AttributeCertificateBuilder
- Add from_pem/to_pem to PyAttributeCertificate
- Add registered_id to SubjectAlternativeNameBuilder
- Add Python bindings for CertReqMsgBuilder and CertReqMessagesBuilder
- Add CMPMessageBuilder to synta.cmp
- Add synta.kem submodule
- Add Krb5PrincipalName.name getter, UPN support and typed GeneralName integration
- Expose PolicyQualifier, PolicyInformation and certificate_policies()
- Add Microsoft PKI (AD CS) submodule and stubs
- Add typed GeneralName Python classes and updated stubs
- Add Kerberos FAST and shared krb5 helper modules
- Add Merkle Tree Certificate Python bindings and stubs
- Add SPNEGO Python bindings and stubs
- Add synta-mtc dependency
### Changed
- Extract synta-python-common shared rlib
- Fix fragile double-borrow-mut and deduplicate config
### Fixed
- Resolve all broken intra-doc links and invalid code blocks
- Use single borrow_mut guard in all PyO3 builder setters
- Fix doc comment, single-guard setters, add security category binding
- Correct CertificationRequest.subject_alt_names() docstring
- AttributeCertificate.to_pem() must return bytes, not str
- Use IMPLICIT tagging for GeneralName otherName and ediPartyName
- Make Decoder encoding argument optional, defaulting to DER
- Fix subject_public_key_info_raw_der → subject_public_key_info_der in doc comments
- Fix 8 bugs found in deep review
### Removed
- Remove unused DER helper functions from general_name.rs
## [0.1.4] — 2026-04-05
### Added
- Synta-certificate, synta-python: add missing DN attribute OIDs (Gap D)
- Synta-certificate, synta-python: add PublicKey construction from raw components
- Synta-certificate, synta-python: add CertificateList version/crl_number/extensions API
- Add CertificationRequest extension access API
## [0.1.3] — 2026-04-05
### Added
- Add CHANGELOG.md for v0.1.3
- Add CHANGELOG.md for v0.1.2
- Split cms.rs into a module directory
- Expose SAN/AIA/EKU extension builders in synta.ext
- Synta-certificate, synta-python: add RFC 9925 unsigned certificate OIDs
- Synta-certificate, synta-python: add CMS EnvelopedData decryption
- Add synta.ext submodule for extension DER builders
- Synta-certificate,synta-python: add CMS EnvelopedData builder
- Add create_pkcs12 pyfunction
- Add PrivateKey.to_pkcs8_encrypted / from_pkcs8_encrypted
- Synta-certificate,synta-python: add CsrBuilder for PKCS#10 CSR construction
- Synta-certificate,synta-python: add KeyEncryptor/KeyDecryptor traits; unify RSA crypto
- Synta-certificate: add CertificateBuilder; synta-python: delegate to it
- Add CertificateBuilder with zero-copy DER splicing
- Add tbs_certificate_der, verify_issued_by, OTP, key gen, verify_signature
- Add crypto submodule and X.509 encoding helpers for FreeIPA
- Add PublicKey and PrivateKey classes for FreeIPA migration (Phase 4)
- Add FreeIPA-needed Certificate getters and digest function
- Expose OcspStore and ocsp= kwarg in synta.x509
- Expose CrlStore for CRL-based revocation checking
- Add synta.x509 certificate chain verification submodule
- Reorganize certificate/types into subdirectories; add pkixalgs/ac/crmf/cmp submodules
### Fixed
- Fix //! module doc in crypto.rs
### Removed
- Remove direct OpenSSL dependency; use synta-certificate crypto traits
- Expose NameBuilder and remove backend type leakage
## [0.1.2] — 2026-04-05
### Added
- Add CHANGELOG.md for v0.1.2
- Split cms.rs into a module directory
- Expose SAN/AIA/EKU extension builders in synta.ext
- Synta-certificate, synta-python: add RFC 9925 unsigned certificate OIDs
- Synta-certificate, synta-python: add CMS EnvelopedData decryption
- Add synta.ext submodule for extension DER builders
- Synta-certificate,synta-python: add CMS EnvelopedData builder
- Add create_pkcs12 pyfunction
- Add PrivateKey.to_pkcs8_encrypted / from_pkcs8_encrypted
- Synta-certificate,synta-python: add CsrBuilder for PKCS#10 CSR construction
- Synta-certificate,synta-python: add KeyEncryptor/KeyDecryptor traits; unify RSA crypto
- Synta-certificate: add CertificateBuilder; synta-python: delegate to it
- Add CertificateBuilder with zero-copy DER splicing
- Add tbs_certificate_der, verify_issued_by, OTP, key gen, verify_signature
- Add crypto submodule and X.509 encoding helpers for FreeIPA
- Add PublicKey and PrivateKey classes for FreeIPA migration (Phase 4)
- Add FreeIPA-needed Certificate getters and digest function
- Expose OcspStore and ocsp= kwarg in synta.x509
- Expose CrlStore for CRL-based revocation checking
- Add synta.x509 certificate chain verification submodule
- Reorganize certificate/types into subdirectories; add pkixalgs/ac/crmf/cmp submodules
### Fixed
- Fix //! module doc in crypto.rs
### Removed
- Remove direct OpenSSL dependency; use synta-certificate crypto traits
- Expose NameBuilder and remove backend type leakage