Skip to content

MALT v0.0.3 — Portable Arc Authentication Core

Choose a tag to compare

View all tags
@BernardLowe BernardLowe released this 11 Jul 17:38
v0.0.3
ba41f3d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MALT v0.0.3 is an experimental source release that exposes MALT as a general, arc-granularity graph data-authentication library. UnixFS is now one layout built on the core rather than the definition of the core.

Highlights

  • Adds the module-root malt facade with typed Query, ReadRequest, ReadResult, Engine.Read, Apply, and VerifyRead contracts.
  • Adds portable auth/verifier verification for radix maps, tree lists, and measured ranges without ArcTable, CAS, runtime, server, daemon, or network access.
  • Keeps graph/verifier as a thin reference-runtime adapter and treats ArcTable as untrusted execution/materialization state.
  • Allows generic relation-only maps to omit or delete @payload; UnixFS continues to require payload bindings as a layout invariant.
  • Splits the UnixFS Reader and Writer facades around explicit CAS capabilities.
  • Finalizes MIP-1011 and the experimental v0alpha1 typed read/result and ProofList binding profile.

Install

go get github.com/dewebprotocol/malt@v0.0.3

This release publishes source tags only. Build with Go 1.25.7 or newer.

Security hardening

The release audit added fail-closed validation for malformed typed commitment roots and KZG proofs. KZG verification now rejects invalid commitment lengths, out-of-domain proof indices, and non-canonical proof lengths instead of truncating input or panicking.

Validation

Release commit: ba41f3d63cbd062bcd21c05137ca61a26e31379e

  • git diff --check
  • go test ./...
  • go vet ./...
  • builds for cmd/cas, cmd/malt, and cmd/eval/malt-eval
  • evaluator smoke plan
  • isolated CAS/daemon add, resolve, and ProofList verification smoke
  • external Go module import/run against v0.0.3-rc.1, with no server dependency
  • targeted race, negative, and fuzz coverage for the portable verifier and KZG parser

The candidate tag v0.0.3-rc.1 and final tag v0.0.3 identify the same commit.

Experimental limits

  • APIs, query labels, ProofList fields, root codecs, and verifier interfaces may change before v1.0.0.
  • ProofList and resolve JSON do not yet have stable named JSON Schema files or an embedded envelope version.
  • Range ProofLists authenticate range metadata and segment CIDs; UnixFS callers must additionally bind returned bytes with layout/unixfs.VerifyRangeBody or an equivalent check.
  • The KZG batch API currently encodes one primitive proof per index; native multi-opening remains an optimization.
  • Managed tenancy, authorization, publication, freshness, quotas, billing, pinning, garbage collection, and backend operations remain outside MALT core.

See the v0.0.3 release record, MIP-1011, and compatibility policy for details.

Assets 2
Loading