Skip to content

CHANGELOG.md

Latest commit

 

History

History
87 lines (61 loc) · 5.98 KB

CHANGELOG.md

File metadata and controls

87 lines (61 loc) · 5.98 KB
Raw

Changelog

All notable changes to CarnyCert will be documented here. Format loosely based on Keep a Changelog but honestly I gave up on strict compliance around v0.9 — ask Priya about it.

[Unreleased]

  • maybe: geo-fence override for Sakha Republic edge case (#441 still open, Dmitri hasn't replied)
  • TODO: figure out why .validate_chain() returns True for expired Kazakh carnival operator certs — это баг или фича?? (#JIRA-8827)

[1.4.2] - 2026-06-29

Fixed

  • Dependency resolver was silently swallowing NullPointerException on nested jurisdiction lookups when the cert chain depth exceeded 4 — रुको, यह तो पागलपन है — fixed by bailing early and re-raising with actual context (#CR-2291)
  • resolver.py: pinned cryptography to >=42.0.1 because 42.0.0 has that weird RSA padding regression that was breaking our Madhya Pradesh carnival authority certs. took me 3 hours to figure this out. three hours.
  • removed accidental print("HERE2") left in jurisdiction/map_loader.py since February. sorry. sorry everyone.
  • jurisdiction map patch: Maharashtra sub-region "Tier-C Travelling Fair" operator codes were mapping to the wrong validation schema (was using schema_v2_legacy, should be schema_v3). How long has this been wrong? since the October refactor. (#ticket-5502, filed retroactively)
  • fixed CertBundle.merge() not respecting the strict_chain flag when one bundle was loaded from a .pem and one from .der — это вообще не должно было работать раньше — I think it worked by accident before because of the padding bug above... жизнь прекрасна
  • jurisdiction map: removed duplicate entry for RU-KGD (Kaliningrad). it was in there twice with conflicting authority_endpoint values. the second one (wrong one) was winning. fixed. added regression test. добавил тест наконец-то.
  • CertStore.__init__ was calling self.reload() twice on startup — once directly and once via the _post_init_hook. doubled cache warming time. dumb bug, my fault. (#509)

Changed

  • dependency resolver now emits a DeprecationWarning when it encounters a v1 cert schema — we will hard-break on these in 1.6 or so. probably 1.6. Rashida wants 1.5 but I think that's too aggressive.
  • bumped pyjurisdiction from 3.1.0 → 3.2.4 — there's a breaking change in how they handle disputed territory codes (cough Western Sahara cough) but we weren't using that codepath anyway
  • resolver.DEFAULT_TIMEOUT changed from 30 to 45 seconds. some of the Rajasthan authority endpoints are slow. very slow. like embarrassingly slow. 45 is still not enough sometimes but whatever (#478)
  • jurisdiction map: BR-SP (São Paulo) operator tier definitions updated to match the 2026 Q1 regulatory revision. — спасибо Fernanda за файлы, она прислала в январе а я только сейчас добавил, простите
  • internal: moved _resolve_chain_depth out of CertValidator into the new resolver_utils.py — это должно было произойти давно — no behavior change

Added

  • CertBundle.diff() helper method — took about 45 mins to write, should've existed from day one. compares two bundles and returns a dict of what changed. यह बहुत काम आएगा
  • jurisdiction map now has entries for 14 additional Indian state-level travelling circus/fair authorities. data sourced from MHA circular 2025-Nov-09. cross-referenced manually because the official API is... not great.
  • --dry-run flag on carny-cert resolve CLI — just logs what it would do without writing anything. asked for in #388, closed #388.

Known Issues / не исправлено

  • map_loader caching is still not thread-safe. есть TODO в коде с марта. it's fine if you use one thread. don't use multiple threads. добавлю фикс в 1.4.3 наверное
  • the RU-CHU (Chukotka) endpoint still times out intermittently. not our fault, their server is just bad. filed upstream, не ответили.

[1.4.1] - 2026-04-03

Fixed

  • hotfix: CertValidator.validate() threw AttributeError when cert had no issuer_locality field — regression from 1.4.0 refactor. got caught by a user in prod, not by our tests. тесты добавил.
  • corrected jurisdiction map typo: "Uttarkhand" → "Uttarakhand". это же базовые вещи

Changed

  • bumped requests to >=2.32.0 (CVE cleanup, not exploitable in our usage but let's not be the guys who didn't update)

[1.4.0] - 2026-03-18

Added

  • full jurisdiction map support for Russian Federal Districts — спасибо Dmitri за данные, наконец-то
  • cert chain depth now configurable via CARNYCERT_MAX_DEPTH env var (default: 4)
  • new CertBundle class for grouping related certs — बड़ा बदलाव है यह, ध्यान रखना
  • CLI: carny-cert inspect command

Changed

  • resolver.py fully rewritten. the old one was "working" in the same way a Jenga tower is "standing"
  • minimum Python bumped to 3.11. это было необходимо.

Removed

  • LegacyCertLoader — deprecated since 0.9, finally gone. если вы всё ещё используете это — удачи

[1.3.1] - 2025-11-14

Fixed

  • packaging: MANIFEST.in was missing jurisdiction_maps/ folder so the pypi release was broken for like 6 days (#CR-1088). I am so sorry.

[1.3.0] - 2025-10-02

Added

  • initial jurisdiction map system (India + Brazil to start)
  • carny-cert validate CLI command
  • basic cert chain resolution