v1.0.1

1.0.1 (2026-11-10)

Fixed

• check answers for a database that a crash left with a hot journal (#28) (3478817)
• closing a connection checkpoints its wal again (#27) (6560154)
• end a running statement before clearing its bindings (#25) (7c7391c)

Performance

• native: build only the parts of openssl sqlcipher uses (#18) (551b9ca)

Documentation

• close the temporary key in every example, name the real temporary files (#20) (34b82ae)

Verify what you download

Every native library and every file of the library is attested (build provenance), and the SBOM is attested too:

• provenance: https://github.com/pasichDev/sealite/attestations/65909853
• SBOM: https://github.com/pasichDev/sealite/attestations/65909861

gh attestation verify <file> --repo pasichDev/sealite
sha256sum --check --ignore-missing SHA256SUMS

SHA256SUMS lists the native libraries (natives/), the SBOM and the Maven files (maven/).

v1.0.0

Sealite 1.0.0

First stable release: an androidx.sqlite.SQLiteDriver that opens every connection encrypted with
SQLCipher Community Edition 4.20.0 (SQLite 3.54.1). Works with Room 2.8, Room 3 and plain
androidx.sqlite.

• Targets: Android (arm64-v8a, armeabi-v7a, x86_64, x86; API 24), iOS (arm64, simulator arm64;
  iOS 14), macOS native (arm64; macOS 11) and the desktop JVM on macOS, Windows and Linux (JDK 17+).
• Keys: SealiteKey holds raw 256-bit keys (no key derivation), raw keys with an explicit salt
  and passphrase keys. ByteArray / CharArray only, wiped on close(). An all-zero raw key, a
  passphrase with an unpaired surrogate and a passphrase in SQLCipher's raw-key form (which would
  skip PBKDF2) are rejected.
• Configuration: SealiteConfig, built with a builder (SealiteConfig { ... },
  SealiteConfig.builder(), SealiteConfig.DEFAULT): SQLCipher 3 or 4 compatibility, KDF
  iterations, page size. SQLCipher's memory sanitization is always on.
• Errors: SealiteException with a typed SealiteError (WRONG_KEY, NOT_ENCRYPTED,
  NOT_KEYED, PROVIDER_MISSING, REKEY_FAILED, REKEY_UNVERIFIED); Sealite.errorOf(throwable)
  finds it inside the exceptions Room wraps it in, by type. Because it is not a SQLiteException,
  Room's corruption recovery never deletes a database over a wrong key.
• Threading and data fidelity: one lock per connection; close() interrupts a running query and
  never frees memory a statement still uses. Embedded U+0000, empty BLOBs and non-BMP text
  round-trip identically on every target.
• Maintenance: Sealite.check, Sealite.rekey (atomic, with a documented key-storage
  protocol), Sealite.encryptPlaintext (a verified copy published without replacing anything) and
  Sealite.versions.
• Compatibility: files are interchangeable with net.zetetic:sqlcipher-android 4.x, SQLCipher
  for Apple platforms and the sqlcipher command line tool, verified by golden fixtures on every
  target.
• No symbol clashes: all SQLite and SQLCipher symbols are renamed to sealite_*, so the library
  coexists with sqlite-bundled, the system SQLite and other SQLite copies in one process.
• Limits: SQLCipher files with a plaintext header are not supported; memory wiping is best
  effort; deleting a file does not erase flash storage. See the README.
• Quality gates: 100% line and branch coverage of the Kotlin code (Kover), AddressSanitizer run
  of the JNI layer, tests on every shipped binary's real OS and architecture, Kotlin binary
  compatibility validation (api/ dumps) and API documentation (Dokka).

1.0.0 (2026-10-28)

First stable release. See the release notes
for the full overview.

Added

• SealiteDriver: an androidx.sqlite.SQLiteDriver that opens every connection encrypted with
  SQLCipher Community Edition 4.20.0 (SQLite 3.54.1); works with Room 2.8, Room 3 and plain
  androidx.sqlite on Android, iOS, macOS and the desktop JVM (macOS, Windows, Linux).
• SealiteKey (raw and passphrase keys, wiped on close), SealiteConfig (builder; SQLCipher 3 or 4
  compatibility, KDF iterations, page size).
• SealiteException with a typed SealiteError, and Sealite.errorOf; a wrong key never makes
  Room's corruption recovery delete the database.
• Sealite.check, Sealite.rekey (atomic and verified), Sealite.encryptPlaintext (a verified copy
  published without replacing anything) and Sealite.versions.
• File compatibility with net.zetetic:sqlcipher-android 4.x, SQLCipher for Apple platforms and the
  sqlcipher command line tool, verified by golden fixtures on every target.

Verify what you download

Every native library and every file of the library is attested (build provenance), and the SBOM is attested too:

• provenance: https://github.com/pasichDev/sealite/attestations/60995539
• SBOM: https://github.com/pasichDev/sealite/attestations/60995569

gh attestation verify <file> --repo pasichDev/sealite
sha256sum --check --ignore-missing SHA256SUMS

SHA256SUMS lists the native libraries (natives/), the SBOM and the Maven files (maven/).