Skip to content

Fractum v1.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Jul 16:59
v1.4.0
2a43fab
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🔐 Security Verification

GPG Signature: ✅ This release is cryptographically signed
Key ID: D009F6290DCFDAB6
Signed by: S.A.S.U. KATVIO (Fractum Release Signing)

Verify Release Authenticity

# Import KATVIO public key
curl -O https://fractum.katvio.com/fractum-signing-key.asc
gpg --import fractum-signing-key.asc

# Verify tag signature
git tag -v v1.4.0

# Verify package checksum
sha256sum -c checksums.txt

📋 Release Notes

This release focuses on hardening Fractum's cryptographic handling, reducing
metadata exposure, improving operational safety, and expanding real-world test
coverage around the workflows users actually run.

IMPORTNAT: The previous version v1.3.0 is considered secure to use in most contexts, see the best practices.. See also the security bulletin.

🔐 Security Enhancements:

  • Bound encrypted-file metadata to AES-256-GCM authentication so metadata tampering is detected during decryption
  • Removed plaintext file hashes from encrypted metadata to avoid unnecessary disclosure
  • Added per-share hash verification so corrupted or modified shares are detected before reconstruction
  • Reduced share metadata by default: labels, total share count, share set IDs and tool integrity details are now opt-in through --full-metadata
  • Hardened key handling with mutable key buffers, secure cleanup paths, memory locking where available, and explicit clearing of reconstructed share data
  • Replaced mixed entropy helper logic with direct OS-backed randomness
  • Added safer decryption behavior by refusing to overwrite an existing output file
  • Improved ZIP share handling with secure temporary extraction directories and cleanup

👤 User Experience Improvements:

  • Made --label optional during encryption; Fractum now defaults to the input filename when no label is provided
  • Added --bundle-encrypted for users who explicitly want each share ZIP to include a copy of the .enc file
  • Kept .enc files out of share ZIP archives by default to reduce duplication and avoid spreading ciphertext unnecessarily
  • Fixed manual share entry so users only provide the threshold and the actual shares needed for reconstruction
  • Improved manual mode support for both Base64 and hexadecimal share input
  • Improved error messages for duplicate share indices, corrupted shares, incompatible share sets, version mismatches and unsafe overwrite attempts
  • Preserved compatibility with legacy share formats while supporting the new minimal-metadata format

🏗️ Code Quality & Architecture:

  • Unified encryption through FileEncryptor instead of duplicating encryption logic in the CLI
  • Moved metadata parsing into a static helper used by decryption and share routing
  • Removed dead code paths such as unused share verification, share saving and secure string helpers
  • Refined share loading and metadata validation so optional metadata is handled consistently
  • Applied formatting to the source tree and synchronized ignore rules for local tooling and generated artifacts

⚡ Platform, CI & Supply Chain:

  • Pinned the Docker base image by digest
  • Pinned GitHub Actions dependencies by commit SHA and tightened workflow permissions
  • Hardened release workflow shell interpolation to reduce injection risk
  • Added package checksum files and installer-side package integrity validation
  • Pinned Linux, macOS and Windows bootstrap installer downloads with SHA-256 verification
  • Tightened Docker and test container permissions from world-writable directories to restricted permissions
  • Added non-root execution for the Docker test image
  • Fixed Windows test output encoding to avoid Unicode console failures

🧪 Testing & Validation:

  • Added full end-to-end encrypt/decrypt roundtrip coverage through the real fractum CLI
  • Added coverage for minimal metadata, full metadata and share set routing
  • Added tests for .enc bundling behavior, overwrite protection and insufficient-share failures
  • Added deterministic corruption tests for encrypted files and share files
  • Added error-message, UX mode, OS simulation and manual-share test coverage
  • Added memory security coverage for key wiping and runtime Python version enforcement
  • Added bootstrap syntax checks and cross-platform fixture improvements

📚 Documentation:

  • Reworked the README around a clearer cold-storage value proposition and Docker-first quick start
  • Documented the updated CLI options, including --full-metadata, --bundle-encrypted, optional labels and manual-share mode

This release focuses on hardening Fractum's cryptographic handling, reducing
metadata exposure, improving operational safety, and expanding real-world test
coverage around the workflows users actually run.

For technical details see PR: #27

  • Source Code: Use git clone or download ZIP
  • Verification: Always verify GPG signatures before use
    -----BEGIN PGP SIGNATURE-----

iQJPBAABCAA5FiEEF53yS25uPYrv2aeV0An2KQ3P2rYFAmpFQt0bFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJENAJ9ikNz9q2XbIP/R9rRptu1/wtKId+WSa2
9GVdy0mTTuX4BaUcoOxP+Mknbv76ck/206cxO5XD+xUb7I4hCjkcGTh2uD+Iu9+I
YGCvxTRxBh/3dc2UCP0WlZ/EY2W8fZv030HIdqKzkbMV/29GI3hiuqcUsGu/2cW2
S8eXl4q/WAe79Jv0DrtOrQvbdJw9se9SpoUPQUrYIm3lxyfaZiYREkUe+IHT+4TH
ql5T7F7d6mmKIsEggfbHKxiZFOXWtKK3NQa089eLBFOM5niklkzXC/r2icA/Cuo0
HR+jUVM7QD5GoEN6WEO9/T8G25dgAm6dajgjZo3NnbJu0i+QN4tfQMhJwCwmntjh
JySA3xacaLwpbNuABznEaAPEUIwprY2hdEmKvos9oGA8mFDcyhb3DCBcRymipVCa
tXJUvdVLjfKKg8GGmBPDukejxjExHPSux8VV/txHOsS6lvD5PBzhe+wu0Rovm+sz
7Y0/mLSCR4f5Bz0pZPD5cUssQdOgiGLCJ0pslPDRjsg4lyZ3A3ljgEP36ng83mEQ
fqm9Ok0z37jifZ0QEjRZe++Vxw/Za2rfTeYgBJFG6MH6JnSrWYGbtGCKNUkCbNoG
PixoSUWwRHYsoV0Dv9Cv1A6bANkSBECo8StTPInPn3L7KV7Xrx6SbEhqMl8HLV2O
ZaAjT4EqDac3ScYH6pS0MmnA
=6WnY
-----END PGP SIGNATURE-----

📦 Download Options

  • Source Code: Use git clone or download ZIP
  • Verification: Always verify GPG signatures before use
Assets 4
Loading