From 44ad7cd17d075cfd1abbd5f84cee7ba555da58c8 Mon Sep 17 00:00:00 2001 From: Chris Fink <7587613+deadpoets@users.noreply.github.com> Date: Sun, 19 Jul 2026 20:43:23 -0400 Subject: [PATCH 1/3] build(secmem-crypto): require secmem v0.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependency-only patch, released as secmem-crypto/v0.1.1. The module pinned secmem v0.1.0, so anyone importing only secmem-crypto kept resolving the core that faults the process when a mutating call follows ReadOnly(). Bumping the require propagates that fix to crypto-only consumers. No secmem-crypto API or behavior change: the only source additions since its v0.1.0 are the FuzzSignerLifecycle fuzzer and seed corpus, both test-only, so gorelease puts this at the patch level. Note on ordering: this cannot build until v0.2.0 is a pushed tag — Go reads the required version's go.mod to build the module graph even in workspace mode (verified: 'unknown revision v0.2.0'). Merge and tag v0.2.0 first, then re-run this PR's checks. --- CHANGELOG.md | 11 +++++++++++ secmem-crypto/go.mod | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0430d57..f896297 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,16 @@ mark the stability commitment. > This repo holds three independently versioned Go modules; entries are tagged > by module. Untagged entries belong to the core `secmem` module. +## [secmem-crypto/v0.1.1] - 2026-07-19 + +Dependency-only patch. `secmem-crypto` now requires `secmem` v0.2.0, so code +that imports only this module picks up the read-only crash fix below — +v0.1.0 of this module pins `secmem` v0.1.0 and would otherwise keep resolving +the faulting core. No API or behavior change here: the only source additions +since `secmem-crypto/v0.1.0` are the `FuzzSignerLifecycle` state-machine +fuzzer and its seed corpus, both test-only (`gorelease` confirms the patch +level). + ## [0.2.0] - 2026-07-19 A bug-fix release for the core `secmem` module, and the reason to upgrade @@ -216,6 +226,7 @@ First tagged release of the core `secmem` module. [Unreleased]: https://github.com/deadpoets/secmem/compare/v0.2.0...HEAD [0.2.0]: https://github.com/deadpoets/secmem/compare/v0.1.0...v0.2.0 +[secmem-crypto/v0.1.1]: https://github.com/deadpoets/secmem/releases/tag/secmem-crypto%2Fv0.1.1 [secmem-lint/v0.1.0]: https://github.com/deadpoets/secmem/releases/tag/secmem-lint%2Fv0.1.0 [secmem-crypto/v0.1.0]: https://github.com/deadpoets/secmem/releases/tag/secmem-crypto%2Fv0.1.0 [0.1.0]: https://github.com/deadpoets/secmem/releases/tag/v0.1.0 diff --git a/secmem-crypto/go.mod b/secmem-crypto/go.mod index 6842c0e..53ac50f 100644 --- a/secmem-crypto/go.mod +++ b/secmem-crypto/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( filippo.io/edwards25519 v1.2.0 - github.com/deadpoets/secmem v0.1.0 + github.com/deadpoets/secmem v0.2.0 golang.org/x/crypto v0.54.0 ) From edbb057197c59eca02b2b439f654862cff477aee Mon Sep 17 00:00:00 2001 From: Chris Fink <7587613+deadpoets@users.noreply.github.com> Date: Sun, 19 Jul 2026 21:29:26 -0400 Subject: [PATCH 2/3] build: tidy go.sum for the secmem v0.2.0 bump go mod edit -require does not touch go.sum, so secmem-crypto lacked the v0.2.0 sums and the examples module (which consumes crypto) needed its own go.mod/go.sum refresh. Both now tidy and build standalone under GOWORK=off. --- examples/go.mod | 2 +- secmem-crypto/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/go.mod b/examples/go.mod index 7f0f901..ef74f45 100644 --- a/examples/go.mod +++ b/examples/go.mod @@ -3,7 +3,7 @@ module github.com/deadpoets/secmem/examples go 1.26 require ( - github.com/deadpoets/secmem v0.1.0 + github.com/deadpoets/secmem v0.2.0 github.com/deadpoets/secmem/secmem-crypto v0.1.0 golang.org/x/crypto v0.54.0 ) diff --git a/secmem-crypto/go.sum b/secmem-crypto/go.sum index f198e4f..ac5966e 100644 --- a/secmem-crypto/go.sum +++ b/secmem-crypto/go.sum @@ -1,7 +1,7 @@ filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo= filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc= -github.com/deadpoets/secmem v0.1.0 h1:Nzf/SJLM9fYL4ZUrH5WQspmtwH6BX8Vh2vpd7qS1YNk= -github.com/deadpoets/secmem v0.1.0/go.mod h1:E3WiQ0gBANyIV5SiXQ4oRrasbv5aZ5zC3gYwbyf+DcQ= +github.com/deadpoets/secmem v0.2.0 h1:4+TnqmcluZhDyDRZhH7z2o9vvvg0VmxmmdxEjf9d7rA= +github.com/deadpoets/secmem v0.2.0/go.mod h1:E3WiQ0gBANyIV5SiXQ4oRrasbv5aZ5zC3gYwbyf+DcQ= golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= From 686e890fc4090375128241d556bf5f4e7af8c400 Mon Sep 17 00:00:00 2001 From: Chris Fink <7587613+deadpoets@users.noreply.github.com> Date: Sun, 19 Jul 2026 21:30:18 -0400 Subject: [PATCH 3/3] docs: crypto release is v0.2.0, not v0.1.1 Re-running gorelease after the require bump (not before it) reports secmem-crypto/v0.2.0. The bump is itself the change that forces a minor: this module's exported API returns *secmem.SecureBuffer, so raising its secmem floor to v0.2.0 raises the minimum for every consumer, which is a dependency-graph change rather than a patch. --- CHANGELOG.md | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f896297..5e996f5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,15 +13,20 @@ mark the stability commitment. > This repo holds three independently versioned Go modules; entries are tagged > by module. Untagged entries belong to the core `secmem` module. -## [secmem-crypto/v0.1.1] - 2026-07-19 +## [secmem-crypto/v0.2.0] - 2026-07-19 -Dependency-only patch. `secmem-crypto` now requires `secmem` v0.2.0, so code -that imports only this module picks up the read-only crash fix below — -v0.1.0 of this module pins `secmem` v0.1.0 and would otherwise keep resolving -the faulting core. No API or behavior change here: the only source additions -since `secmem-crypto/v0.1.0` are the `FuzzSignerLifecycle` state-machine -fuzzer and its seed corpus, both test-only (`gorelease` confirms the patch -level). +Dependency-only release. `secmem-crypto` now requires `secmem` v0.2.0, so code +that imports only this module picks up the read-only crash fix below — v0.1.0 +of this module pins `secmem` v0.1.0 and would otherwise keep resolving the +faulting core. + +No `secmem-crypto` source change: the only additions since +`secmem-crypto/v0.1.0` are the `FuzzSignerLifecycle` state-machine fuzzer and +its seed corpus, both test-only. It is a **minor** bump rather than a patch +because this module's exported API hands back `*secmem.SecureBuffer` values, +so raising its `secmem` floor to v0.2.0 raises the minimum for every consumer +too — a dependency-graph change they should opt into deliberately +(`gorelease` classifies it the same way). ## [0.2.0] - 2026-07-19 @@ -226,7 +231,7 @@ First tagged release of the core `secmem` module. [Unreleased]: https://github.com/deadpoets/secmem/compare/v0.2.0...HEAD [0.2.0]: https://github.com/deadpoets/secmem/compare/v0.1.0...v0.2.0 -[secmem-crypto/v0.1.1]: https://github.com/deadpoets/secmem/releases/tag/secmem-crypto%2Fv0.1.1 +[secmem-crypto/v0.2.0]: https://github.com/deadpoets/secmem/releases/tag/secmem-crypto%2Fv0.2.0 [secmem-lint/v0.1.0]: https://github.com/deadpoets/secmem/releases/tag/secmem-lint%2Fv0.1.0 [secmem-crypto/v0.1.0]: https://github.com/deadpoets/secmem/releases/tag/secmem-crypto%2Fv0.1.0 [0.1.0]: https://github.com/deadpoets/secmem/releases/tag/v0.1.0