Version 2.0.2

[Summary]

StormByte Crypto is the cryptography module of the StormByte C++ suite.

It depends on StormByte Base 2.1.0, StormByte Buffer 2.0.2, StormByte-Logger 2.0.2 and StormByte System 2.0.2. Base, Logger and System are declared here: Buffer no longer brings them as submodules. This repository is not Base, Buffer, Config, Database, Logger, Multimedia, Network or System.

Public headers under StormByte/crypto/ cover Hasher, Compressor, Crypter (symmetric and asymmetric), Signer, Secret, KeyPair, Password and Vault. Crypto++ never leaves the private tree.

If you landed here from a release link and have not read the tree:

• What this module is, how to build it, and short examples: README.md
• License: GNU Lesser General Public License version 3 or later, LICENSE

Added

• ENABLE_PGO and ENABLE_LTO. Profile-guided optimization trains in pgo-instr and installs this build. Link-time optimization follows ENABLE_LTO (default ON) for every build type. Both apply to Crypto. Base, Buffer, Logger and System are not rebuilt. Windows stays MSVC because Crypto++ does not build with clang-cl.
• Release archives include THIRD-PARTY (not THIRDPARTY: on Windows and macOS that name is the same path as the thirdparty/ directory, so the file never landed in those zips), COPYING.CryptoPP and COPYING.bzip2. Crypto++ 8.9.0 (843d74c7) and libbzip2 1.0.8 (6a8690fc) are compiled into the shared library. The notices are the upstream texts of those commits. Base, Buffer, Logger and System stay separate shared libraries.

Changed

• CI builds with ENABLE_LTO=ON, ENABLE_PGO=OFF and ENABLE_TEST=ON, then runs ctest. Profile-guided optimization stays on the release workflow.
• cmake/optimizations.cmake is the same file as Base. On Release, and only when that language was not set from the outside, it appends OPTIMIZATION_FLAGS_LINUX, OPTIMIZATION_FLAGS_MAC or OPTIMIZATION_FLAGS_WINDOWS. Linux is -O2 -march=x86-64-v3, Apple is -O2 -mcpu=apple-m1, Windows is /O2 /arch:AVX2. There is no /fp:fast and no /EHsc. cmake/pgo.cmake is the same file as Base, so a forwarded list keeps its semicolons. MSVC PGO links with /LTCG:PGINSTRUMENT and /LTCG:PGOPTIMIZE. /GENPROFILE alone fails with LNK1220 because the current link.exe requires an /LTCG specification, and CMake's own /LTCG stays off so it does not replace the profile mode. The profile mode is add_link_options on this project, not CMAKE_EXE_LINKER_FLAGS. A nested project() inherits the cache and its compiler test links cmTC_*.exe, which was never instrumented, so /LTCG:PGOPTIMIZE aborted with LNK1266 (cmTC_*.pgd missing). The cache keeps a bare /LTCG so those /GL objects still link. A static dependency stays LTCG and is optimized by the link that owns the .pgd.
• Requires StormByte-BuildMaster >= 2.1.0. An older install is not used; the buildmaster submodule supplies 2.1.0.
• Requires StormByte Base 2.1.0, StormByte Buffer 2.0.2, StormByte-Logger 2.0.2 and StormByte System 2.0.2. Each is a release archive (stormbyte_component_url) linked with BACKEND=binary. Base, Logger and System are declared here because Buffer no longer vendors them. The archive matches this OS and C++ runtime: libstdc++ or libc++ on Linux and macOS, no runtime suffix on Windows. Doxygen include path is ${BUILDMASTER_INSTALL_INCLUDEDIR}.
• Breaking: Crypto exceptions no longer format with std::format. A message with arguments replaces literal {} through Safe::String::ReplaceToken, the same rule as Base 2.1.0. what() stays StormByte.Crypto: message, and a child segment is only the part under Crypto (StormByte.Crypto.Hasher, StormByte.Crypto.Secure.Vault).
• Bumped project version to 2.0.2.
• Symmetric key derivation is always PBKDF2-HMAC-SHA256 with 600000 iterations. STORMBYTE_CRYPTO_INSECURE_PBKDF2_ITERATIONS_FOR_CI is gone, and CI no longer compiles with it.
• Part of the port: the DLL does not return a std:: object. The Windows fault in Bzip2Tests (i < big.size()) was a null write in StormByte.dll!operator<=>, not Crypto++. clang-cl returns std::strong_ordering through a hidden pointer and MSVC does not pass one. The port requires the rebuilt Base 2.1.0, where that operator is STORMBYTE_FORCE_INLINE and is not an extern template. A signature that must return std:: is STORMBYTE_FORCE_INLINE in the header too. The tests must be recompiled against that archive. An old object file still imports the DLL symbol.

Fixed

• -stdlib=libc++ and -stdlib=libstdc++ do not count as custom C++ flags. If either is the only extra flag, Release still gets -O2 and the CPU baseline.
• Clang PGO drops .profraw files left by compiler probes before ctest, and llvm-profdata merge uses -failure-mode=all. A probe writes a few hundred bytes for main, with a padded empty symbol name. The default failure mode is any, so that one file aborted the merge even after the instrumented tests had passed.