Skip to content

release 0.9.0: the A0 re-seal, and what this release does not change - #26

Merged
rgfaber merged 2 commits into
mainfrom
titan/a0-release
Oct 29, 2026
Merged

rgfaber merged 2 commits into
mainfrom
titan/a0-release

Conversation

@rgfaber

@rgfaber rgfaber commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

Refs macula-dotnet#21, macula-dotnet#24, macula-dotnet#25.

Proposed tag: v0.9.0. Macula.csproj already carries 0.9.0 and the last tag is v0.9.0-rc.5, so the version needs no bump.

  • CHANGELOG: the 0.9.0 intro said libmacula is macula-go v0.27.0 while the pin is v0.29.0, and the heading was dated the flag day on a release first tagged now. The intro names v0.29.0 with v0.27.0 kept as history, and the heading carries the release day.
  • "Changed since this entry was written": the A0 re-seal, stated as behaviour (a sealed_required refusal is resealed to the key in the refusal's signed tbs and answered) rather than as a library bump.
  • "What this release does not change": KemAdvertise is off by default (src/Macula/Pool.cs:42), so two pools on default options talk in the clear; and a procedure served with no policy is advertised open, unary and streaming alike (macula-dotnet#24, a unary procedure served with no policy is advertised open, and the code never says so #25).
  • README sealing section: the same re-seal sentence, and it names the right cause (a keyless advertisement, not a rotated key — a rotated key is sealed_refused).

dotnet build -c Release green locally (0 warnings, 0 errors). No tag, no publish.

libmacula is pinned to macula-go v0.29.0, the release that carries the A0
contract: a call a keyed provider refuses sealed_required is resealed to the key
in the refusal's signed tbs and answered, instead of the caller failing on a
stale keyless candidate.

The 0.9.0 intro said v0.27.0 while the pin is v0.29.0, and the heading was dated
the flag day on a release first tagged now. Both fixed, with v0.27.0 kept as
history. The note states what does not change as well: KemAdvertise is off by
default (src/Macula/Pool.cs:42), so two pools on default options talk in the
clear, and a procedure served with no policy is advertised open, unary and
streaming alike (macula-dotnet#24, macula-dotnet#25).

Refs macula-dotnet#21, macula-dotnet#24, macula-dotnet#25.
…ted key

The paragraph as first written gave the wrong cause: sealed_required comes from a
caller holding a KEYLESS advertisement and calling clear, while a caller holding
an old key gets sealed_refused with the current key id in detail. Caught in the
macula-py review of the same sentence before this branch was reviewed.

Refs macula-dotnet#21.
@rgfaber
rgfaber merged commit d5d53c1 into main Oct 29, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant