Skip to content

cidrmerge 0.2.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Aug 15:25
· 1 commit to main since this release
Immutable release. Only release title and notes can be modified.
0.2.0
This tag was signed with the committer’s verified signature.
camunro Craig Munro
SSH Key Fingerprint: 98+YpTH+YaWBi/cA3QkruVynTSG8eN4BcQsm5OBpi5c
Verified
Learn about vigilant mode.
117b87b
This commit was signed with the committer’s verified signature.
camunro Craig Munro
SSH Key Fingerprint: 98+YpTH+YaWBi/cA3QkruVynTSG8eN4BcQsm5OBpi5c
Verified
Learn about vigilant mode.

cidrmerge 0.2.0 adds offline crawler-prefix JSON ingestion and exact-byte detached SHA-256 generation while consolidating address-range and exact-coverage math in swift-cidr 0.5.0. Existing exact-coverage semantics and deterministic IPv4-first range/CIDR serialization are preserved.

Highlights

  • --input-format searchbot compiles saved Google/Bing/Apple/OpenAI-compatible crawler-prefix JSON from local files or standard input.
  • --checksum with --output writes <output>.sha256 for the exact rendered raw or JSON bytes.
  • Range, containment, normalization, exact-coverage, and summarization behavior now comes directly from swift-cidr 0.5.0.
  • New CIDRMergeCoverage provides a deterministic mixed-family facade with IPv4-first ranges, CIDRs, and containment lookup.
  • Expanded DocC, external-consumer checks, dependency-floor validation, and four-platform release verification.

Exact coverage and deterministic output

cidrmerge coalesces duplicate, contained, overlapping, and adjacent address coverage. It never fills an uncovered gap merely to shorten output.

  • RouteObjects IP List Text v1 remains the default input grammar.
  • ranges remains the default representation and produces the fewest disjoint closed intervals.
  • --representation cidr produces an exact canonical CIDR cover through swift-cidr.
  • Raw output remains line-oriented and pipeline-ready.
  • JSON records the selected representation and uses separate, stable ipv4 and ipv6 arrays.
  • Parsing, merging, and rendering are buffered, so those failures produce no partial standard output.

Searchbot input

Each searchbot operand is one complete UTF-8 document using the de facto Google/Bing/Apple/OpenAI-compatible crawler-prefix JSON grammar. Every entry must contain exactly one string-valued ipv4Prefix or ipv6Prefix; descriptive metadata is tolerated. Malformed, ambiguous, duplicate policy-bearing, wrong-family, or trailing JSON fails the whole invocation with source and JSON-path diagnostics.

cidrmerge does not download vendor data. Acquire changing inputs explicitly with curl, CI tooling, or another explicit acquisition step, then compile the saved file offline. Selecting this grammar does not prove file provenance or provider identity.

Library upgrade notes

This release intentionally makes a pre-1.0 source-breaking CIDRMergeCore cleanup. CIDRMergeCore no longer declares IPAddressRange<Family>, AnyIPAddressRange, IPv4AddressRange, IPv6AddressRange, or IPAddressCoverage<Family>.

Library clients should:

  1. Depend directly on swift-cidr 0.5.0.
  2. Import CIDR and use its canonical range and coverage declarations.
  3. Continue importing CIDRMergeCore only when the mixed-family CIDRMergeCoverage facade is useful.

IPAddressCoverage.summarizedNetworks() preserves address membership; it does not reconstruct the original prefix fragmentation or prefix lengths. Swift Crypto remains confined to the CLI artifact boundary and is not imported or linked by CIDRMergeCore.

SwiftPM consumers can select this release with:

.package(
    url: "https://github.com/RouteObjects/cidrmerge.git",
    .upToNextMinor(from: "0.2.0")
)

Detached SHA-256 integrity

The detached checksum covers the exact rendered bytes and uses standard lowercase SHA-256 checksum syntax:

<64 lowercase hexadecimal characters><two spaces><output basename><LF>

It detects changed bytes; it is not a signature and does not authenticate provenance, freshness, a vendor, or crawler identity. It also does not bind independent allow and deny files into one generation.

Each checksum and output path is atomically replaced where supported, but the pair is not one filesystem transaction. Checksum-first replacement leaves a mismatch or missing output if the second replacement fails, so a consumer configured to require verification fails closed. Use immutable or versioned generations when pair-level rollout atomicity is required.

Installation and platforms

Prebuilt archives are provided for macOS and Linux on ARM64 and x86-64. Each archive contains only cidrmerge, LICENSE, and THIRD_PARTY_NOTICES.txt. Download the matching archive together with SHA256SUMS and verify it before extraction. See the archive installation guide.

  • Runtime: macOS 15+ or Ubuntu 22.04+
  • Source builds and CIDRMergeCore: Swift 6.1+
  • Apple applications using CIDRMergeCore: iOS 18+

Security and scope

cidrmerge compiles address coverage only:

  • It performs no HTTP fetching, DNS, IRRd, RPKI, admission-policy role assignment, or hot reload.
  • Raw IP List Text is the intended admission-list interchange; cidrmerge JSON is compiler output, not an admission-policy schema.
  • BGP and RPKI metadata such as ASN, AS path, communities, maxLength, TAL, source, and validation state is not retained.
  • Output is not a route advertisement or ROA.

Validation

The release gate passed 56 tests in seven suites, 16 locked one-million-record benchmark runs, DocC and external-consumer checks, macOS/iOS builds, Linux ARM64/x86-64 builds, and native archive/checksum smoke tests.

Full Changelog: 0.1.0...0.2.0

Assets 8
Loading