dstu_core 0.1.0-x86_64-linux → 0.2.0-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d2334ab3aa0124cebb58c7581ae4aeb17da063c86cc204c81c4520d2828e31f5
-  data.tar.gz: ed3fd69afa6c610c3ab0400b57df533d1884a1b7890b87f3cba4dbf3578a4d1f
+  metadata.gz: d2f53e978cc8ecfe16e1c2e876e70131e172284a0faacd144e947d62f0f297d1
+  data.tar.gz: 530177311f2ba11b2499f0c8154dd182360ebbfa93cfe3210efe49b59bfce36f
 SHA512:
-  metadata.gz: 8e1f3bd238c2610b0d49f299d5491da7edcb8c44ad64ec2a1dae830909e5c731e6be51133373179da81ca370e0adbfd7296e23cb0feb4548fe6c15fbcb58886e
-  data.tar.gz: 8239f6561bb4ab5882b40d75c415cbb45dc6c607d46bb9737fa32dbfc7121a219a6f30d5497d1b3f26eae767cdbd1901f7a77d9b3eb1b1cc48fbdc1d9fac62be
+  metadata.gz: d980fe67fb1b9f7e7b4b2a4efc37e3b1064241e194f178eabfcfb758fd6f77abf07e4a2d77f455398084b9a8ef5c1309958df12f147c213d18fa079a6eb41ff5
+  data.tar.gz: 3ed1f834b608ad8ddebba72dd5ad012639064e48edd2d82aa1f8526e368f6618b5a94ca2e6b22cc23923bf4e4142e5aa9ecf1d672f5088a4a5b84610493b5bd8

data/README.md

@@ -1,11 +1,21 @@
 # dstu-core (Ruby bindings)
 
-**Provisional — not published to RubyGems, not independently audited.** See the root project's
-`docs/SECURITY.md` and `docs/DECISIONS.md` for the full threat model and per-construction status.
-This binding wraps the full `dstu_core::crypto_*` surface (`docs/bindings-strategy.md` T-160) —
-install from source as shown below.
+**Pre-1.0. Not independently audited.** See the root project's `docs/SECURITY.md` and
+`docs/DECISIONS.md` for the full threat model and per-construction status. This binding wraps the
+full `dstu_core::crypto_*` surface (`docs/bindings-strategy.md` T-160).
 
-## Installing (from source)
+## Installing
+
+```sh
+gem install dstu_core
+```
+
+```ruby
+require "dstu_core"
+DstuCore.self_test
+```
+
+## Building from source (contributors)
 
 ```sh
 gem install bundler

data/lib/dstu_core/secretstream.rb

@@ -10,10 +10,11 @@
 #
 # **Wire format matches `uacrypt encrypt`/`decrypt` exactly**
 # (crates/uacrypt/src/lib.rs's `run_secretstream_encrypt`/`run_secretstream_decrypt`, D-68):
-# `header (32 bytes)` followed by one record per chunk, `tag_byte (1) || chunk_len_u32_le (4) ||
-# ciphertext (chunk_len) || auth_tag (16)`, chunks capped at 8 KiB (matching
-# `SECRETSTREAM_CHUNK_BYTES`, not an independent choice) - a file `SecretStreamWriter` writes is
-# decryptable by `uacrypt decrypt` and vice versa.
+# `version (1) || header (32 bytes)` followed by one record per chunk, `tag_byte (1) ||
+# chunk_len_u32_le (4) || ciphertext (chunk_len) || auth_tag (16)`. Every record but the Final one is
+# exactly 8 KiB (`SECRETSTREAM_CHUNK_BYTES`, part of the format since D-208, not an independent
+# choice) - a file `SecretStreamWriter` writes is decryptable by `uacrypt decrypt` and vice versa.
+# The shared vectors in crates/dstu-core/tests/vectors/secretstream-file/ pin this.
 #
 # **Every `String` this wrapper touches is binary (`ASCII-8BIT`/`BINARY`)**, both what it writes
 # to `out`/`inp` and what `#read_all`/`#each` yield - matching every underlying `crypto_*` wrapper
@@ -26,6 +27,8 @@ module DstuCore
   # wire-format interop with `uacrypt encrypt`/`decrypt`, not an independent choice.
   SECRETSTREAM_CHUNK_BYTES = 8 * 1024
   SECRETSTREAM_AUTH_TAG_BYTES = 16
+  # Matches dstu-core's crypto_secretstream::FORMAT_VERSION (D-208); the shared vectors pin it.
+  SECRETSTREAM_FORMAT_VERSION = 2
 
   # Write-only wrapper: buffers input and pushes each full 8 KiB chunk to `out` as it fills, hiding
   # the header/tag/framing bookkeeping entirely.
@@ -38,6 +41,7 @@ module DstuCore
       @out = out
       @out.binmode if @out.respond_to?(:binmode)
       @push = SecretStreamPushState.new(key)
+      @out.write([SECRETSTREAM_FORMAT_VERSION].pack("C"))
       @out.write(@push.header)
       @buf = +""
       @closed = false
@@ -115,6 +119,11 @@ module DstuCore
     def initialize(key, inp)
       @inp = inp
       @inp.binmode if @inp.respond_to?(:binmode)
+      version = read_exact(1, "format version").unpack1("C")
+      if version != SECRETSTREAM_FORMAT_VERSION
+        raise DstuCore::Error,
+              "unsupported stream format version #{version} (this build reads #{SECRETSTREAM_FORMAT_VERSION})"
+      end
       header = read_exact(32, "header")
       @pull = SecretStreamPullState.new(key, header)
       @done = false
@@ -152,6 +161,10 @@ module DstuCore
         raise DstuCore::Error,
               "secretstream chunk too large: declared #{chunk_len} bytes, max #{SECRETSTREAM_CHUNK_BYTES}"
       end
+      if tag_byte != SECRETSTREAM_TAG_FINAL && chunk_len != SECRETSTREAM_CHUNK_BYTES
+        raise DstuCore::Error,
+              "non-final chunk of #{chunk_len} bytes, must be exactly #{SECRETSTREAM_CHUNK_BYTES} (D-208)"
+      end
       ciphertext = read_exact(chunk_len, "chunk ciphertext")
       auth_tag = read_exact(SECRETSTREAM_AUTH_TAG_BYTES, "chunk auth tag")
       tag, plaintext = @pull.pull(tag_byte, ciphertext, auth_tag)

data/lib/dstu_core/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DstuCore
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,17 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: dstu_core
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: x86_64-linux
 authors:
 - dstu-core contributors
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-13 00:00:00.000000000 Z
+date: 2026-10-08 00:00:00.000000000 Z
 dependencies: []
 description: Ruby bindings for dstu-core (Ukrainian DSTU cryptographic standards)
-  - provisional, not yet published to RubyGems.
+  - not independently audited.
 email: 
 executables: []
 extensions: []