painfree 0.2.2

The INI letter quoted the wrong fingerprint. A bank telephoned about a letter whose hashes did not match the keys INI and HIA had just delivered. The keys were fine. Two fingerprints exist over the same key — SHA-256 over hex(exponent) + " " + hex(modulus), and SHA-256 over the X.509 certificate in DER — and this engine, which speaks EBICS 3.0 (H005) and nothing else, defaulted to the H004 one. DEFAULT_LETTER_DIGEST is now CERTIFICATE.

The letter itself gains nothing: same three keys, same exponent and modulus, one hash per key, computed over the certificate instead of over the two numbers. letter_digest still selects the other convention for a bank that asks for it.

The letter dated itself from the connection row. connection.updated_at moves on any edit, so a letter already signed and posted would silently re-date itself. The date is now the newest creation time of the three keys the letter quotes.

Two supports. Changing the convention after INI or HIA has been sent now asks for a confirmation — not a refusal, because a bank saying "wrong convention" is exactly when it has to be done, but no longer silent about the paper it invalidates. And the letter names its convention in words ("SHA-256 over the X.509 certificate, in DER form") rather than printing an enum value at a clerk comparing hex strings by eye. All six catalogues.

If you are on 0.2.1 or earlier and have already posted a letter: your keys are unaffected. Reprint the letter and post it again — it will now quote the certificate digest, which is what an EBICS 3.0 bank checks against.