ragleap-security v0.2.0 release notes

ragleap-security 0.2.0

Adds three modules (and a small key module they share). Behaviour changes: none. The 0.1.0 API (Scope, AuditLog, SecretStr, limits) is unchanged, and the new crypto extra is optional. Python 3.10 and newer.

What is new

keys (standard library only): Key never prints its value and cannot be pickled or hashed; KeyRing holds several keys for rotation.
crypto (optional: pip install ragleap-security[crypto]): AES-256-GCM through the cryptography package, a versioned envelope with the key id, an authenticated context (for example a Scope key), key rotation (reencrypt), and encryption from a passphrase (scrypt). One generic error for every decrypt failure.
ratelimit (standard library only): token bucket keyed by a Scope key or a string, in memory or shared between processes through SQLite. Bounded number of tracked keys; a throttled key cannot be reset by flooding new keys; fails closed.
integrity (standard library only): bounded SHA-256 file digests and a directory manifest with an optional HMAC. Symlinks and special files are never followed.

What this does not defend

Encryption does not protect data inside a running process or against someone who holds the key. The rate limiters do not stop attacks spread over many machines, and the in-memory one resets on restart. Integrity checks detect changes; they do not prevent copying. See docs/threat-model.md. No independent security review has happened.

Verified (real output)

Pull request #1261: all 52 CI checks passed.
VPS (python3.10): 328 tests pass with cryptography; 295 pass and 1 is skipped without it.
Sandbox: 328 tests pass on Python 3.10.20 and 3.12.3, and with cryptography 42.0.0 (the lowest allowed) on 3.10. Mutation check: 135 of 135 mutations killed on 3.10.20 and on 3.12.3.
The released wheel was installed fresh from PyPI on Python 3.10.20: plain (core works, importing crypto gives the install message) and with the crypto extra (round trip, wrong context refused, key rotation, passphrase round trip all worked). The nine Python files in the wheel are identical to the files merged in #1261.
ragleap-memory (306 tests) and ragleap-optimizer (156 tests) pass against this code.

Not verified

Windows and macOS; cryptography versions other than 42.0.0 and 50.0.2; SQLiteRateLimiter on network filesystems or under heavy multi-process load.
The mutation check was not run on the VPS. The provenance record of the source archive was not checked (only the wheel's).

Provenance

Tag ragleap-security-v0.2.0 on commit 6f40f7de12520908ce6706748ec910b9fced61bf (merge of #1261).
Published from GitHub Actions by trusted publishing (repository ragleap/ragleap-core, workflow release.yml, environment pypi). PyPI holds a provenance record for the wheel; its digest matches the wheel.
SHA-256: wheel 0c5d7e93e9227a36012b648207271337b3c4a9be0d0307f69cef500ae1d82532; source archive af1ae3b21704f872adc71e4711d5f29c24aa7910d385dfdbfd65a15d0496797a.