From fc23288e080a449dc421aac3ef624ecf145da9b5 Mon Sep 17 00:00:00 2001 From: cypherair <262752927+cypherair@users.noreply.github.com> Date: Sat, 12 Sep 2026 21:16:44 -0700 Subject: [PATCH] Move to SQLCipher 4.19.0 Upstream tag v4.19.0 (SQLite 3.53.4): two low-risk fixes in sqlcipher_export and hexkey handling plus maintenance fixes. The README is cut to the contracts the scripts cannot state. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/experimental-release.yml | 8 +- .github/workflows/stable-release.yml | 8 +- README.md | 139 ++++----------------- scripts/build-sqlcipher-xcframework.sh | 4 +- scripts/validate-sqlcipher-xcframework.py | 8 +- 5 files changed, 36 insertions(+), 131 deletions(-) diff --git a/.github/workflows/experimental-release.yml b/.github/workflows/experimental-release.yml index 3d18cd7..8c2d246 100644 --- a/.github/workflows/experimental-release.yml +++ b/.github/workflows/experimental-release.yml @@ -101,8 +101,8 @@ jobs: "workflow_url": os.environ["WORKFLOW_URL"], "xcode_version": os.environ["XCODE_VERSION"], "sqlcipher_source_repository": "https://github.com/sqlcipher/sqlcipher.git", - "sqlcipher_source_tag": "v4.17.0", - "sqlcipher_source_commit": "810db22f575ee7cf94ea96a3e91622b5fcece3dc", + "sqlcipher_source_tag": "v4.19.0", + "sqlcipher_source_commit": "c4b275a47932888216bade83aff2bbc73df0ff85", "assets": [ "SQLCipher.xcframework.zip", "SQLCipher.xcframework.sha256", @@ -126,8 +126,8 @@ jobs: - Commit: \`$GITHUB_SHA\` - Built at (UTC): \`$BUILT_AT\` - Xcode: \`$XCODE_VERSION\` - - SQLCipher upstream tag: \`v4.17.0\` - - SQLCipher upstream commit: \`810db22f575ee7cf94ea96a3e91622b5fcece3dc\` + - SQLCipher upstream tag: \`v4.19.0\` + - SQLCipher upstream commit: \`c4b275a47932888216bade83aff2bbc73df0ff85\` - Workflow: [$WORKFLOW_URL]($WORKFLOW_URL) Assets: diff --git a/.github/workflows/stable-release.yml b/.github/workflows/stable-release.yml index afda53a..084442f 100644 --- a/.github/workflows/stable-release.yml +++ b/.github/workflows/stable-release.yml @@ -128,8 +128,8 @@ jobs: "signer_workflow": f"{os.environ['GITHUB_REPOSITORY']}/.github/workflows/stable-release.yml", "xcode_version": os.environ["XCODE_VERSION"], "sqlcipher_source_repository": "https://github.com/sqlcipher/sqlcipher.git", - "sqlcipher_source_tag": "v4.17.0", - "sqlcipher_source_commit": "810db22f575ee7cf94ea96a3e91622b5fcece3dc", + "sqlcipher_source_tag": "v4.19.0", + "sqlcipher_source_commit": "c4b275a47932888216bade83aff2bbc73df0ff85", "assets": [ "SQLCipher.xcframework.zip", "SQLCipher.xcframework.sha256", @@ -153,8 +153,8 @@ jobs: - Commit: \`$RELEASE_COMMIT\` - Built at (UTC): \`$BUILT_AT\` - Xcode: \`$XCODE_VERSION\` - - SQLCipher upstream tag: \`v4.17.0\` - - SQLCipher upstream commit: \`810db22f575ee7cf94ea96a3e91622b5fcece3dc\` + - SQLCipher upstream tag: \`v4.19.0\` + - SQLCipher upstream commit: \`c4b275a47932888216bade83aff2bbc73df0ff85\` - Workflow: [$WORKFLOW_URL]($WORKFLOW_URL) Assets: diff --git a/README.md b/README.md index bf3d59a..bc3294a 100644 --- a/README.md +++ b/README.md @@ -1,126 +1,31 @@ # SQLCipher XCFramework for CypherAir -This repository builds the CypherAir-owned `SQLCipher.xcframework` for Apple -targets that need `arm64e` device slices. +Builds the `SQLCipher.xcframework` that CypherAir links: static +`SQLCipher.framework` slices with `arm64e` device architectures, which upstream +SQLCipher does not publish. This is not a fork of SQLCipher. The build consumes +one explicit upstream tag, verifies its peeled commit, and packages the +amalgamation over Apple CommonCrypto. The pinned tag, commit, and SQLite +baseline live in `scripts/`. -It is not a fork of SQLCipher core. The build script consumes the upstream -`sqlcipher/sqlcipher` `v4.17.0` tag, verifies the peeled commit, generates the -SQLCipher amalgamation, and packages a static framework-shaped XCFramework for -CypherAir app integration. +## Scope -## Current Status +Only the slices CypherAir links are built: iOS, macOS, and visionOS devices +with `arm64` and `arm64e`, plus `arm64` iOS and visionOS simulators. tvOS, +watchOS, Mac Catalyst, and `x86_64` simulators stay out until the app needs +them. -- Status: stable external binary dependency infrastructure for CypherAir, with - separate experiment and drill channels for validation. -- Upstream source: `https://github.com/sqlcipher/sqlcipher` -- Upstream tag: `v4.17.0` -- Expected peeled commit: `810db22f575ee7cf94ea96a3e91622b5fcece3dc` -- SQLite baseline: `3.53.3` -- Package shape: static `SQLCipher.framework` slices inside - `SQLCipher.xcframework`. -- Crypto provider: Apple CommonCrypto / Security framework - (`SQLCIPHER_CRYPTO_CC`). +## Releases -This repository provides the SQLCipher binary artifact consumed by the main -CypherAir repository. It does not by itself implement Contacts SQLCipher -storage; that application behavior remains owned by `cypherair/cypherair`. - -## Supported Slices - -The artifact intentionally builds only the slices needed by CypherAir: - -| Library identifier | Platform | Architectures | -| --- | --- | --- | -| `ios-arm64_arm64e` | iOS device | `arm64`, `arm64e` | -| `macos-arm64_arm64e` | macOS | `arm64`, `arm64e` | -| `xros-arm64_arm64e` | visionOS device | `arm64`, `arm64e` | -| `ios-arm64-simulator` | iOS Simulator | `arm64` | -| `xros-arm64-simulator` | visionOS Simulator | `arm64` | - -tvOS, watchOS, Mac Catalyst, and `x86_64` simulator slices are intentionally -out of scope until CypherAir needs them. - -## Build - -Requirements: - -- macOS with Xcode 26.5 platform SDKs -- `git` -- `make` -- `python3` -- `xcrun` / `xcodebuild` - -Build and validate: - -```bash -./scripts/build-sqlcipher-xcframework.sh -``` - -The script writes these ignored outputs under `build/`: - -- `SQLCipher.xcframework` -- `SQLCipher.xcframework.zip` -- `SQLCipher.xcframework.sha256` -- `SQLCipher.arm64e-build-manifest.json` -- `SQLCipher-PrivacyInfo.xcprivacy` - -Each XCFramework slice contains: - -```text -SQLCipher.framework/ -├── Headers/ -├── Modules/module.modulemap -├── PrivacyInfo.xcprivacy -└── SQLCipher -``` - -`SQLCipher.framework/SQLCipher` is a static-library binary. This shape lets -Xcode consume the artifact through the normal Frameworks phase while keeping -CypherAir's static-linking intent. - -Validation also executes a macOS encrypted-database round trip, verifies the -SQLCipher 4.17.0 and SQLite 3.53.3 runtime identities, and requires a wrong key -to fail with `SQLITE_NOTADB`. - -Run validation again against an existing build: - -```bash -python3 scripts/validate-sqlcipher-xcframework.py \ - --xcframework build/SQLCipher.xcframework \ - --manifest build/SQLCipher.arm64e-build-manifest.json \ - --xcframework-zip build/SQLCipher.xcframework.zip \ - --checksum-file build/SQLCipher.xcframework.sha256 \ - --privacy-manifest build/SQLCipher-PrivacyInfo.xcprivacy -``` - -## Release Discipline - -Stable releases use SSH-signed annotated tags such as -`sqlcipher-xcframework-v4.17.0-cypherair.1`. The stable release workflow only -publishes from those tags, produces non-prerelease immutable releases, and -verifies both GitHub release integrity and artifact attestations after -publication. - -Stable releases publish: - -- `SQLCipher.xcframework.zip` -- `SQLCipher.xcframework.sha256` -- `SQLCipher.arm64e-build-manifest.json` -- `SQLCipher-PrivacyInfo.xcprivacy` -- `SQLCipher.xcframework.release.json` - -Experiment and drill releases remain available for validation work and publish -channel-specific metadata such as `sqlcipher-xcframework-experiment.json`. - -Release assets must be immutable. If a stable artifact is wrong, publish a new -semantic release tag such as `sqlcipher-xcframework-v4.17.0-cypherair.2` -instead of replacing existing assets. +A stable release is triggered only by pushing an SSH-signed annotated tag +`sqlcipher-xcframework-v-cypherair.`. The workflow +publishes a non-prerelease immutable release and verifies release integrity +and artifact attestations after publication. Published assets are never +replaced: a wrong artifact is fixed by a new `-cypherair.` tag and +release. Experiment and drill releases exist for validation only. ## Licensing -The build scripts and repository-specific glue are distributed under the -BSD 3-Clause license in `LICENSE`. - -SQLCipher remains under its upstream BSD-style license, and SQLite remains -public domain. Generated artifacts must preserve upstream SQLCipher, SQLite, -and privacy-manifest notices when consumed by CypherAir. +Build scripts and repository glue: BSD 3-Clause (`LICENSE`). SQLCipher keeps +its upstream BSD-style license and SQLite is public domain; artifacts must +preserve the upstream SQLCipher, SQLite, and privacy-manifest notices when +consumed by CypherAir. diff --git a/scripts/build-sqlcipher-xcframework.sh b/scripts/build-sqlcipher-xcframework.sh index b87d772..e3af717 100755 --- a/scripts/build-sqlcipher-xcframework.sh +++ b/scripts/build-sqlcipher-xcframework.sh @@ -9,8 +9,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" SQLCIPHER_REPOSITORY="${SQLCIPHER_REPOSITORY:-https://github.com/sqlcipher/sqlcipher.git}" -SQLCIPHER_TAG="${SQLCIPHER_TAG:-v4.17.0}" -SQLCIPHER_EXPECTED_COMMIT="${SQLCIPHER_EXPECTED_COMMIT:-810db22f575ee7cf94ea96a3e91622b5fcece3dc}" +SQLCIPHER_TAG="${SQLCIPHER_TAG:-v4.19.0}" +SQLCIPHER_EXPECTED_COMMIT="${SQLCIPHER_EXPECTED_COMMIT:-c4b275a47932888216bade83aff2bbc73df0ff85}" SQLCIPHER_VERSION="${SQLCIPHER_TAG#v}" SQLCIPHER_RELEASE_STATUS="${SQLCIPHER_RELEASE_STATUS:-experimental}" diff --git a/scripts/validate-sqlcipher-xcframework.py b/scripts/validate-sqlcipher-xcframework.py index c854070..3758073 100755 --- a/scripts/validate-sqlcipher-xcframework.py +++ b/scripts/validate-sqlcipher-xcframework.py @@ -47,10 +47,10 @@ COMPILE_OPTIONS = ["SQLITE_HAS_CODEC", "SQLITE_TEMP_STORE=2"] LINK_FRAMEWORKS = ["Security", "CoreFoundation", "Foundation"] EXPECTED_SOURCE_REPOSITORY = "https://github.com/sqlcipher/sqlcipher.git" -EXPECTED_SOURCE_TAG = "v4.17.0" -EXPECTED_SOURCE_COMMIT = "810db22f575ee7cf94ea96a3e91622b5fcece3dc" -EXPECTED_SQLCIPHER_VERSION = "4.17.0" -EXPECTED_SQLITE_VERSION = "3.53.3" +EXPECTED_SOURCE_TAG = "v4.19.0" +EXPECTED_SOURCE_COMMIT = "c4b275a47932888216bade83aff2bbc73df0ff85" +EXPECTED_SQLCIPHER_VERSION = "4.19.0" +EXPECTED_SQLITE_VERSION = "3.53.4" CFLAGS = [ "-DNDEBUG", "-DSQLCIPHER_CRYPTO_CC",