Encompute 0.3.0

Encompute 0.3.0, the first stable release of 0.3 (commit 03a3394). Release notes: https://github.com/BAder82t/Encompute/blob/v0.3.0/docs/release-notes-0.3.0.md. Verify before use: docs/verify-release.md.

Encompute 0.3.0-rc.4

Encompute 0.3.0-rc.4: draft created by the release workflow from 0fcc8ad.

Verify before use: docs/verify-release.md (checksums, cosign signatures, GitHub attestations).

Container images (by digest):

ghcr.io/bader82t/encompute-evaluator@sha256:9e7f66174584a44a83876bcbf3fbc99a5cedd1a40bcf9bdd39217af2a71ff5f9
ghcr.io/bader82t/encompute-control@sha256:491838b58b92e2f0ed612ac72e00247c96b6b5cdc1bce299987b55d2c391832d
ghcr.io/bader82t/encompute-services@sha256:53efcda2d86d6ba4b8bc886ef7e1464adafa1723a1724a3d5459247f9d266eae

Confidential Space workload images (by digest; the digests key brokers approve):

ghcr.io/bader82t/encompute-confidential-space@sha256:d6d75ab7b96ceabe7c99a7e8d7248bdda8018b0eb46e58a5b6132ec1fa18f624
ghcr.io/bader82t/encompute-training@sha256:646ddc31f26f6a371d13a4097a68c52266a4da9f5eacc6831936e0a7104c543d

Encompute 0.3.0-rc.3

Pre-release: the frozen target for external security review. Encompute 0.3.0-rc.3 is a release candidate, not a stable release. Features are frozen; only security fixes, release-blocking bugs and documentation go in before 0.3.0. No independent review has been completed yet. The reviewer package is in security-review/.

Built from release/0.3 at 336d3bbfc7846b456e4fcfc0d1a4725b1a5849f6. v0.3.0-rc.1 and v0.3.0-rc.2 were tagged but never released: their release workflows failed before signing (see the CHANGELOG). Do not use them.

What you can rely on

• Production: OpenFHE CKKS (approximate), OpenFHE exact (BinFHE, with an OpenFHE BGV subset), remote evaluators with signed receipts, secure aggregation, differential privacy (organization-level and patient-level DP-SGD), confidential fine-tuning, and the control plane (API v1, PostgreSQL, OIDC, OpenBao/Vault root keys).
• Experimental: live Google Confidential Space, Hugging Face RoBERTa, the evaluator and key-broker HTTP APIs, Linux arm64.
• Research only, absent from every artifact below: TFHE-rs and verified execution.

The full status of each capability is in the support matrix. What Encompute does not do is in known limitations. The security assumptions are in the threat model and cryptography. What changed and what breaks since 0.2.0: release notes.

Verify first

Every file below is covered by SHA256SUMS and has a Sigstore bundle, signed by this repository's release workflow on this tag. Binaries, wheels and the source archive also have GitHub build provenance. Steps: verify-release.md.

TAG=v0.3.0-rc.3
gh release download "$TAG" -R BAder82t/Encompute -D "encompute-$TAG" && cd "encompute-$TAG"
shasum -a 256 --check SHA256SUMS
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity "https://github.com/BAder82t/Encompute/.github/workflows/release.yml@refs/tags/$TAG" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Install from these artifacts

CLI, evaluator and control plane (OpenFHE statically linked):

Platform	Archive	Needs
Linux x86_64	encompute-0.3.0-rc.3-linux-x86_64.tar.gz	glibc 2.39 or newer (Ubuntu 24.04+), libgomp1
macOS arm64	encompute-0.3.0-rc.3-macos-arm64.tar.gz	brew install libomp

tar -xzf encompute-0.3.0-rc.3-<platform>.tar.gz
./encompute-0.3.0-rc.3-<platform>/encompute info   # openfhe yes, openfhe-exact yes, tfhe-rs no

Python SDK (Python 3.9+; tested on 3.11 and 3.12):

pip install encompute-0.3.0rc3-cp39-abi3-manylinux_2_38_x86_64.whl   # Linux x86_64, glibc 2.38+
pip install encompute-0.3.0rc3-cp39-abi3-macosx_11_0_arm64.whl       # macOS arm64; needs `brew install libomp`

Containers, pulled by digest only (signed, with signed SBOM attestations):

ghcr.io/bader82t/encompute-evaluator@sha256:5bdc2f221d2154596f33dccaf0fb32e9e3f8214395701b4c6a63fee571123c30
ghcr.io/bader82t/encompute-control@sha256:ad5bef1783f68c6dac066b2d2061570299b3cf999cc922732a122494799dccee
ghcr.io/bader82t/encompute-services@sha256:835af40d95421a4c1797c6914e5310a8355d8434338cfb46504cc59eca929807

The Docker Compose deployment is in deployment.md. Its development-mode OpenBao protects nothing: replace it with your own KMS before you protect real keys.

SBOMs

CycloneDX, one per artifact: each binary (per platform), each wheel and each container image. Each SBOM records its artifact's SHA-256 and lists OpenFHE 1.5.1 (BSD-2-Clause).

Known issues in this candidate

• On macOS, loading the OpenFHE build and PyTorch in the same process can crash, because two OpenMP runtimes are loaded. Run encrypted workloads and training in separate processes.
• Python dependency CVEs in PyTorch 2.3.1 and Transformers 4.46.3 are recorded as not affecting Encompute, with a justification for each, in security/exceptions.toml; they expire 2026-12-31.
• encompute migrate exists in this release, although the release notes still describe it as planned. It checks artifacts and upgrades older formats; see encompute migrate --help.

Reporting problems

Security issues: privately, as described in SECURITY.md. Everything else: GitHub issues.

Encompute 0.2.0

Real private execution: a client encrypts, a separate evaluator computes,
only the client decrypts.

• Client/evaluator split. CkksClient and CkksEvaluator traits; the
  OpenFHE code is split into encompute-openfhe (evaluation only) and
  encompute-openfhe-client (keys, encryption, decryption). The evaluator
  binary links no client crypto; scripts/audit-evaluator-binary.sh checks
  it in CI.
• Envelopes. Every ciphertext, key set and result is wrapped in a
  versioned, SHA-256-checksummed envelope bound to parameter set, program and
  key. Wrong key, program, parameters or kind, and corruption, are rejected
  with ENC16xx codes.
• Evaluator service. encompute-evaluator serve (HTTP): program upload,
  one-time evaluation-key registration, jobs. --workers N runs worker
  processes with crash restart and replay (ADR-005). Container image:
  Dockerfile.evaluator.
• CLI. keys generate, serve, run --remote --keys, audit,
  explain --measure (measured bytes, time, memory, error, ranking).
• Hardening. Parameter conformance against OpenFHE (10 080-point grid,
  nightly) and encrypted execution of random programs; fuzzing of the
  parser, envelopes and artifacts; artifact format 2 with versioned
  compiler, plan and parameter-selector provenance.
• Demo. scripts/two-machine-demo.sh: 384-d encrypted query vs 64
  documents on a containerized evaluator, max error 1.9e-7, top-5 equal to
  plaintext, no secret key in the container. Runs in CI.
• Benchmarks. docs/benchmarks.md: five workloads and evaluator
  concurrency.

Breaking: artifact format 2 (recompile 0.1 artifacts); error codes renamed
VEIL#### → ENC####; project renamed Veil → Encompute.