Release: v1.4.15

Weekly release for May 21 2024

What's Changed

• feat: Modify s2nd/c to do serialization/deserialization by @maddeleine in #4533
• refactor: Avoid unnecessary s2n_hmac calls in s2n_record_write by @goatgoose in #4539
• chore: bindings release 0.2.5 by @dougch in #4551
• feat: add key preferences to rfc9151 policy by @jmayclin in #4540
• fix: Send zero-length NST when session key is expired by @jouho in #4532
• feat(bindings): Add API to check for resumption by @goatgoose in #4552
• bug(nix:corretto): use autoPatchelfHook on all systems and ignore als… by @dougch in #4561

Full Changelog: v1.4.14...v1.4.15

Release: v1.4.14

Weekly release for May 10 2024

What's Changed

• feat: set certificate_authorities from trust store by @lrstewart in #4509
• feat[bindings]: fips feature flag by @toidiu in #4527
• bin: tool to print security policies by @lrstewart in #4524
• style(bindings): fix new clippy lint by @jmayclin in #4536
• ci: grep for S2N_RESULT_ERR without setting s2n_errno by @lrstewart in #4534
• fix: Fix a bug in tls1.3 code path by @jouho in #4513
• fix: Increase received signature scheme limit by @goatgoose in #4544

Full Changelog: v1.4.13...v1.4.14

Release: v1.4.13

Weekly release for May 01 2024

What's Changed

• fix: rename error + extension iana for consistency by @lrstewart in #4503
• fix(sidetrail): Invalid stream cipher struct in proof wrapper by @goatgoose in #4484
• chore: Rust bindings bump v1.4.12 by @maddeleine in #4505
• fix: Fix redundant code by @jouho in #4504
• feat: add basic support for certificate_authorities by @lrstewart in #4506
• docs: add more warnings about security policy defaults by @lrstewart in #4507
• docs(bindings): fix client hello doc tests by @jmayclin in #4495
• feat: add missing numbered security policies by @lrstewart in #4511
• chore(bindings): Pin zeroize to avoid MSRV increase by @goatgoose in #4519
• ci: Remove actions-rs by @goatgoose in #4514
• Nix libcrypto helpers by @dougch in #4422
• fix: Python integ tests are flaky on arm by @maddeleine in #4512
• chore: update s2n-core team by @dougch in #4520
• binding: Add s2n_connection_get_session on the Connection by @mathpal in #4522
• nix gdb/lldb utils by @dougch in #4460
• chore(bindings): release 0.2.4 by @jmayclin in #4530

New Contributors

• @jouho made their first contribution in #4504

Full Changelog: v1.4.12...v1.4.13

Release: v1.4.12

Weekly release for April 16 2024

What's Changed

• fix: Wipe conn->in on all record parse failures by @goatgoose in #4499
• feat: Release C APIs for serialization by @maddeleine in #4501
• refactor: combine TLS1.2 and TLS1.3 sig scheme representations by @lrstewart in #4498
• feat: Serialization Rust APIs by @maddeleine in #4493

Full Changelog: v1.4.11...v1.4.12

Release v1.4.11

Release for Apr 11 2023

What's Changed

• fix: better errors for all client auth failures by @lrstewart in #4492
• fix: correct broken early data test by @lrstewart in #4494
• fix: add missing TLS1.3 p521 sig schemes by @lrstewart in #4496
• tests: Serialization feature with post-handshake features by @maddeleine in #4489
• feat(binding): add key update request api by @jmayclin in #4469
• chore(bindings): release 0.2.2 by @toidiu in #4497

Full Changelog: v1.4.10...v1.4.11

Release: v1.4.10

Weekly release for April 10 2024

What's Changed

• fix(bindings): print cargo commands to stdout by @camshaft in #4482
• chore(bindings): release 0.2.1 by @lrstewart in #4486
• feat: connection serialization by @maddeleine in #4468
• feat: reduce read syscalls to improve performance by @lrstewart in #4485
• feat: add s2n_peek_buffered by @lrstewart in #4490

Full Changelog: v1.4.9...v1.4.10

Release: v1.4.9

Weekly release for April 02 2024

What's Changed

• chore(bindings): release 0.1.7 by @camshaft in #4462
• fix: pedantic memory leak in handshake test by @jmayclin in #4463
• fix(test): narrow valgrind suppressions by @jmayclin in #4369
• Make S2N_CERT_AUTH_OPTIONAL the default for clients by @lrstewart in #4390
• bindings: mark Connection as Sync by @lrstewart in #4467
• bindings: ensure CFLAGS includes come after build script includes by @lrstewart in #4475
• feat: getter for TLS1.2 master secrets by @lrstewart in #4470
• example(bindings): client hello cb example by @jmayclin in #4385
• fix: refactor rust bindings fingerprint methods by @maddeleine in #4474
• fix: Adds non_exhaustive flag to FingerprintType by @maddeleine in #4481
• ci: add asan runs under gcc by @jmayclin in #4402
• New TLS1.2-only variant of 20230317 policy by @lrstewart in #4483

Full Changelog: v1.4.8...v1.4.9

Release: v1.4.8

What's Changed

• fix(bindings): Apply with_system_certs to Config builder() API by @goatgoose in #4456
• refactor: make memmove vs memcpy behavior clearer by @lrstewart in #4447
• refactor: clang-tidy null deref and undefined mod by @jmayclin in #4436
• build: remove unnecessary includes by @jmayclin in #4451
• feat: Add FIPS mode getter API by @goatgoose in #4450
• style: fix declarations without initial value by @jmayclin in #4404
• Add s2n_stuffer_shift by @lrstewart in #4458
• refactor: UBSAN build and address out of bound reads by @jmayclin in #4440
• feat: Add additional EC key validation for FIPS by @goatgoose in #4452

Full Changelog: v1.4.7...v1.4.8

Release v1.4.7

What's Changed

• style: manual initial value fix by @jmayclin in #4449
• api: add key update request functionality by @jmayclin in #4453

Full Changelog: v1.4.6...v1.4.7

Release: v1.4.6

What's Changed

• Add Rust bindings for certificate chains by @Mark-Simulacrum in #4398
• fix(test): fix dangling pointers in cert verify test by @jmayclin in #4430
• Extend license check to .rs files by @Mark-Simulacrum in #4428
• feat: apply cert signature preferences locally by @jmayclin in #4407
• test: add cert chain with mixed key sizes by @jmayclin in #4433
• chore: bindings bump by @maddeleine in #4437
• feat: add cert key preferences by @jmayclin in #4434
• fix: prevent enabling ktls with a buffered record header fragment by @lrstewart in #4426
• Relax HRR consistency requirements for second client hello by @goatgoose in #4429
• fix: Unsets global libcrypto rand by @maddeleine in #4424
• refactor: fix unread variable warnings by @jmayclin in #4405
• refactor: enforce stuffer return check by @jmayclin in #4399
• docs: Specify the return value of S2N_FAILURE for IO APIs by @goatgoose in #4446

Full Changelog: v1.4.5...v1.4.6