# Changelog

All notable changes to `native-ossl` will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]


## [0.1.11] — 2026-06-20

### Fixed

- Use two-call pattern for EVP_MD_CTX_serialize
- Adapt x509 borrowed wrappers to OpenSSL 4.0 const-correct getters

## [0.1.10] — 2026-06-12

### Added

- ML-DSA-44, ML-DSA-65, ML-DSA-87 TLS 1.3 signature scheme support in
  `X509::verify_ml_dsa_tls13_signature()` via the `rustls-native-ossl`
  integration (see that crate's changelog for details; `native-ossl` provides
  `X509::public_key()` and `Verifier::verify_oneshot()` used by the helper)

### Fixed

- `X509StoreCtx::set_time()` now converts `u64 → time_t` via `try_into()`,
  returning `Err` on overflow instead of casting unsafely; on 32-bit targets
  (where `time_t` is 32 bits) timestamps beyond 2038 are now rejected rather
  than silently wrapping to a negative value

## [0.1.9] — 2026-05-24

### Added

- `X509StoreCtx::init_with_chain()` — initialise a verification context with
  an untrusted intermediate certificate stack; the stack is kept alive in the
  context and freed on drop
- `X509StoreCtx::set_time()`, `set_host()`, `set_ip()` — verification parameter
  control via `X509_VERIFY_PARAM`; all three return `Err` if called before
  `init` / `init_with_chain`
- `X509Name::to_der()` — DER-encode a subject name via `i2d_X509_NAME`
- `Debug` impls for `X509Name` (via `to_oneline`), `X509NameEntry` (exposes NID),
  `X509Extension` (exposes NID and critical flag), `X509NameOwned`, and
  `X509Builder` (both via `finish_non_exhaustive`)
- `log` crate dependency for surfacing OpenSSL error-path warnings

### Fixed

- `i2d_asn1_type_to_vec`: emit `log::warn!` and drain the error stack on
  `i2d_ASN1_TYPE` failure instead of silently returning an empty vec
- `asn1_string_data`: emit `log::warn!` on negative ASN1_STRING length
- `OBJ_dup` for `GEN_RID` and `GEN_OTHERNAME` general names: log and drain on
  null result instead of silently dropping the name

## [0.1.8] — 2026-04-28

### Added

- Add native-ossl 0.1.8 changelog entry

## [0.1.7] — 2026-04-27

Version bump for workspace synchronization with `native-ossl-sys 0.1.7`; no
functional changes to this crate.

## [0.1.6] — 2026-04-26

### Added

- `util::hex_encode` / `util::hex_decode` — public hex helpers, available to all
  callers as `native_ossl::util::hex_encode` and `native_ossl::util::hex_decode`

### Fixed

- Remove `hex` crate from dev-dependencies; all internal call sites now use the
  bundled `util::hex_encode` / `util::hex_decode` helpers, eliminating build
  failures in offline or restricted environments (Fedora/COPR) where the external
  crate was unavailable

## [0.1.5] — 2026-04-26

### Fixed

- Include `LICENSE` file in the published crate tarball (previously absent because the file lives at the workspace root)
- Add `hex` dev-dependency to RPM `BuildRequires` so `%check` compiles correctly in Fedora build environments

## [0.1.4] — 2026-04-25

### Added

- `CmsContentInfo` — RFC 5652 CMS `SignedData` sign, verify, DER encode/decode; `CmsSignerInfo` for signer inspection; `CmsSignFlags` / `CmsVerifyFlags` bitflag newtypes
- `LibCtx::load_config` — load an `openssl.cnf`-format file into an isolated library context; `LibCtx::load_pkcs11_provider` — convenience helper for PKCS#11 hardware token providers
- `Pkey::<Private>::from_pkcs11_uri` — load a hardware-backed private key via a PKCS#11 URI using `OSSL_DECODER`
- `Pkey::<Public>::dhx_params_from_der` / `ec_params_from_der` — decode RFC 3279 DHX and EC domain parameters via `OSSL_DECODER`
- `KeyUsage` bitmask, `GeneralName` enum, and `X509::key_usage` / `extended_key_usage_oids` / `subject_alt_names` for structured X.509 extension decoding
- `Oid` — arbitrary Object Identifier wrapper (`OBJ_txt2obj` / `OBJ_cmp`) for OIDs not registered in OpenSSL's NID table; `Clone` via `OBJ_dup`

## [0.1.3] — 2026-04-18

### Added

- `SslCtxBuilder<R>` typestate builder for TLS contexts, replacing the bare
  `SslCtx` constructor with a fluent, compile-time-checked configuration API.
  Includes hostname verification flags and access to the current session and
  peer certificate chain.
- Full BIO I/O and chain API: read, write, chain push/pop ownership, chain
  traversal, and pending-byte counts.
- Richer X.509 inspection: signature algorithm info, serial number bytes,
  public key type and size, raw DER extension extraction, ASN.1 time
  conversion to `tm`, and human-readable name formatting via `to_oneline`.
  NID lookups by short name and text now cover both directions
  (NID→name and name→NID).
- OCSP construction: bare constructors for `OcspBasicResp`, `OcspCertId`, and
  `OcspResponse`; response lookup via `get_response` / `find_response`.
- `X509Crl::new` and `X509Crl::new_in` constructors for building CRLs
  programmatically.
- Asymmetric key improvements: DER serialisation for legacy private keys and
  SubjectPublicKeyInfo, `default_digest_name` for detecting which hash an
  algorithm supplies internally, `security_bits` estimate, and
  `set_params`/`get_params` on `PkeyCtx` for provider-specific knobs.
- Parameter context improvements in `KdfCtx` (size, get/set params),
  `CipherCtx` (AEAD tag length, key length, IV length), and `MacCtx` (block
  size, associated algorithm).
- `Params` usability: in-place value setters, `get_long`, and `was_modified`
  to check whether a provider filled in a requested parameter.
- `RandCtx`: `set_params`, `primary` (the global primary DRBG), and
  `params_strength` on algorithm descriptors.
- `DigestCtx::serialize`/`deserialize` for checkpointing a hash context
  mid-stream (OpenSSL 4.0+); `DigestCtx::alg` to retrieve the associated
  algorithm object.
- `Pkcs12::new` bare constructor for building PKCS#12 bundles from scratch.

## [0.1.2] — 2026-04-17

### Added

- Add MessageSigner::sign and MessageVerifier::verify

## [0.1.1] - 2026-04-16

### Added

- Add CI, release, and packaging infrastructure
- Add #[must_use] to GlobalRandCtx::as_rand_ctx()
- Add #[must_use] to is_running()
- Normalize formatting with cargo fmt --all
- Add Pkcs12KdfBuilder (RFC 7292 Appendix B legacy KDF)
- Add Pkey<Private>::from_pem_passphrase() and to_pem_encrypted()
- Add Pkey<Private>::to_pkcs8_der()
- Implement Sync for DigestCtx
- Add ct_eq() constant-time byte-slice comparison
- Add DigestCtx::new_empty() and DigestCtx::reinit()

### Fixed

- Fix constants
- Fix ptr_as_ptr, cast_possible_truncation/wrap
- Fix redundant_closure and doc_markdown
- Fix cast_possible_truncation, manual_div_ceil, elidable_lifetime_names
- Fix manual_let_else, unnecessary_cast, cast_sign_loss
- Examples/pkey: fix Ed25519 signer and RSA-OAEP decrypt buffer
- Fix broken intra-doc link to MessageSigner in RawSigner

## [0.1.0] - 2026-04-15

### Added

- Initial release: idiomatic safe Rust bindings to the OpenSSL 3.x C API
- `LibCtx` — library context and provider loading
- `DigestCtx` — hash/digest operations
- `CipherCtx` — symmetric encryption and decryption
- `MacCtx` — HMAC, CMAC, GMAC, and other MACs
- `KdfCtx` — key derivation: HKDF, PBKDF2, SCRYPT, SSKDF, TLS1-PRF, KBKDF
- `Pkey` / `PkeyCtx` — asymmetric keys: RSA, EC, Ed25519/Ed448, X25519/X448
- `X509`, `X509Crl`, `X509Store` — certificate, CRL, and trust-store handling
- `OcspRequest` / `OcspResponse` — OCSP request and response processing
- PKCS#12 bundle parsing and construction
- `SslCtx` / `SslStream` — TLS/SSL connections
- `fips::is_running()` and FIPS provider enablement helpers
- `RandCtx` / `GlobalRandCtx` — random number generation
- `Bio` — OpenSSL BIO abstraction
- `Params` builder/reader for OpenSSL structured parameter lists
- `ErrStack` — structured OpenSSL error retrieval
- Public `as_ptr()` / `from_ptr()` raw pointer accessors on all wrapper types
- Cfg flags forwarded from `native-ossl-sys`: `ossl320`, `ossl_v400`, and PQC algorithm flags (`ossl_mlkem`, `ossl_mldsa`, `ossl_slhdsa`)
- `fips-provider` feature flag (enables internal FIPS provider APIs from `native-ossl-sys`)

[Unreleased]: https://codeberg.org/abbra/native-ossl/compare/v0.1.10...HEAD
[0.1.10]: https://codeberg.org/abbra/native-ossl/compare/v0.1.9...v0.1.10
[0.1.9]: https://codeberg.org/abbra/native-ossl/compare/v0.1.8...v0.1.9
[0.1.8]: https://codeberg.org/abbra/native-ossl/compare/v0.1.7...v0.1.8
[0.1.7]: https://codeberg.org/abbra/native-ossl/compare/v0.1.6...v0.1.7
[0.1.6]: https://codeberg.org/abbra/native-ossl/compare/v0.1.5...v0.1.6
[0.1.5]: https://codeberg.org/abbra/native-ossl/compare/v0.1.4...v0.1.5
[0.1.4]: https://codeberg.org/abbra/native-ossl/compare/v0.1.3...v0.1.4
[0.1.3]: https://codeberg.org/abbra/native-ossl/compare/v0.1.2...v0.1.3
[0.1.2]: https://codeberg.org/abbra/native-ossl/compare/v0.1.1...v0.1.2
[0.1.1]: https://codeberg.org/abbra/native-ossl/compare/v0.1.0...v0.1.1
[0.1.0]: https://codeberg.org/abbra/native-ossl/releases/tag/v0.1.0
