[cypherair]

Summary

• advance the owned wrapper from SQLCipher 4.16.0 / SQLite 3.53.1 to official SQLCipher 4.17.0 / SQLite 3.53.3
• pin upstream tag v4.17.0 to peeled commit 810db22f575ee7cf94ea96a3e91622b5fcece3dc
• update stable and experimental release metadata plus the stable tag gate to the sqlcipher-xcframework-v4.17.0-cypherair.N series
• derive framework bundle versions from the exact source tag and validate both bundle-version fields
• strengthen the runtime/manifest gate to require SQLCipher 4.17.0 community, SQLite 3.53.3, the exact owned source identity, and SQLITE_NOTADB when a wrong key's first operation modifies schema

Why

SQLCipher 4.17.0 is the latest stable upstream release. It takes SQLite 3.53.3, including upstream security and correctness fixes, and normalizes wrong-key behavior so schema-modifying first operations fail consistently with SQLITE_NOTADB. CypherAir uses the CommonCrypto community provider and a fixed 32-byte raw key; no database migration or rekey is required within SQLCipher major version 4.

This PR changes only the owned artifact builder and its release contract. It does not publish a stable tag or release, and it does not modify SQLCipher upstream.

Validation

• two clean full local builds from the exact upstream tag passed under Xcode 26.6 / Apple 26.5 SDKs
• all five expected slices passed: arm64 + arm64e for iOS, macOS, and visionOS devices; arm64 for iOS and visionOS simulators
• encrypted create/read round trip passed with CommonCrypto
• runtime identity checks passed for SQLCipher 4.17.0 community and SQLite 3.53.3
• wrong-key schema operation returned exactly SQLITE_NOTADB
• static-link audit confirmed neither the validator nor compatibility binaries link system libsqlite3
• bidirectional raw-key database compatibility passed: 4.16-created database read by 4.17, and 4.17-created database read by 4.16
• bundle versions, source manifest, privacy manifest, slice architectures, ZIP checksum, and artifact manifest all validated
• shell syntax, Python compilation, workflow syntax/regex cases, and git diff --check passed
• independent read-only review returned PASS with no findings

The upstream annotated tag contains a PGP signature that GitHub reports as unknown_key; the existing wrapper trust contract remains the exact peeled commit pin, while our stable wrapper release will retain its SSH-signed tag, immutable assets, and GitHub attestations.

Part of cypherair/cypherair#674.

[cypherair]

Merged via regular merge commit 9d8c3627ad67b521a5bd5145bdea98632c80a22b after:

• exact-head build-and-validate CI passed
• two local five-slice builds and the strengthened runtime/provenance validator passed
• bidirectional SQLCipher 4.16 ↔ 4.17 raw-key database compatibility passed
• independent read-only review returned PASS with no findings

Next release step, pending the required explicit publication confirmation: signed immutable tag sqlcipher-xcframework-v4.17.0-cypherair.1, followed by the separate CypherAir consumer repin.

[cypherair]

Release follow-through is complete.

• SSH-signed annotated tag: sqlcipher-xcframework-v4.17.0-cypherair.1
• Immutable stable release: https://github.com/cypherair/sqlcipher-xcframework/releases/tag/sqlcipher-xcframework-v4.17.0-cypherair.1
• Successful release workflow: https://github.com/cypherair/sqlcipher-xcframework/actions/runs/29501460869
• Exact target commit: 9d8c362

Independent readback passed: GitHub release verification, all five release-asset checks, all five provenance checks constrained to the exact stable workflow/tag ref/source digest, local SHA-256 and size comparison, and the archive checksum file. The CypherAir consumer repin can now use the published release data. No upstream action was taken.