Move to SQLCipher 4.19.0

.github/workflows/experimental-release.yml

@@ -101,8 +101,8 @@ jobs:
               "workflow_url": os.environ["WORKFLOW_URL"],
               "xcode_version": os.environ["XCODE_VERSION"],
               "sqlcipher_source_repository": "https://github.com/sqlcipher/sqlcipher.git",
-              "sqlcipher_source_tag": "v4.17.0",
-              "sqlcipher_source_commit": "810db22f575ee7cf94ea96a3e91622b5fcece3dc",
+              "sqlcipher_source_tag": "v4.19.0",
+              "sqlcipher_source_commit": "c4b275a47932888216bade83aff2bbc73df0ff85",
               "assets": [
                   "SQLCipher.xcframework.zip",
                   "SQLCipher.xcframework.sha256",
@@ -126,8 +126,8 @@ jobs:
           - Commit: \`$GITHUB_SHA\`
           - Built at (UTC): \`$BUILT_AT\`
           - Xcode: \`$XCODE_VERSION\`
-          - SQLCipher upstream tag: \`v4.17.0\`
-          - SQLCipher upstream commit: \`810db22f575ee7cf94ea96a3e91622b5fcece3dc\`
+          - SQLCipher upstream tag: \`v4.19.0\`
+          - SQLCipher upstream commit: \`c4b275a47932888216bade83aff2bbc73df0ff85\`
           - Workflow: [$WORKFLOW_URL]($WORKFLOW_URL)
 
           Assets:

.github/workflows/stable-release.yml

@@ -128,8 +128,8 @@ jobs:
               "signer_workflow": f"{os.environ['GITHUB_REPOSITORY']}/.github/workflows/stable-release.yml",
               "xcode_version": os.environ["XCODE_VERSION"],
               "sqlcipher_source_repository": "https://github.com/sqlcipher/sqlcipher.git",
-              "sqlcipher_source_tag": "v4.17.0",
-              "sqlcipher_source_commit": "810db22f575ee7cf94ea96a3e91622b5fcece3dc",
+              "sqlcipher_source_tag": "v4.19.0",
+              "sqlcipher_source_commit": "c4b275a47932888216bade83aff2bbc73df0ff85",
               "assets": [
                   "SQLCipher.xcframework.zip",
                   "SQLCipher.xcframework.sha256",
@@ -153,8 +153,8 @@ jobs:
           - Commit: \`$RELEASE_COMMIT\`
           - Built at (UTC): \`$BUILT_AT\`
           - Xcode: \`$XCODE_VERSION\`
-          - SQLCipher upstream tag: \`v4.17.0\`
-          - SQLCipher upstream commit: \`810db22f575ee7cf94ea96a3e91622b5fcece3dc\`
+          - SQLCipher upstream tag: \`v4.19.0\`
+          - SQLCipher upstream commit: \`c4b275a47932888216bade83aff2bbc73df0ff85\`
           - Workflow: [$WORKFLOW_URL]($WORKFLOW_URL)
 
           Assets:

README.md

@@ -1,126 +1,31 @@
 # SQLCipher XCFramework for CypherAir
 
-This repository builds the CypherAir-owned `SQLCipher.xcframework` for Apple
-targets that need `arm64e` device slices.
+Builds the `SQLCipher.xcframework` that CypherAir links: static
+`SQLCipher.framework` slices with `arm64e` device architectures, which upstream
+SQLCipher does not publish. This is not a fork of SQLCipher. The build consumes
+one explicit upstream tag, verifies its peeled commit, and packages the
+amalgamation over Apple CommonCrypto. The pinned tag, commit, and SQLite
+baseline live in `scripts/`.
 
-It is not a fork of SQLCipher core. The build script consumes the upstream
-`sqlcipher/sqlcipher` `v4.17.0` tag, verifies the peeled commit, generates the
-SQLCipher amalgamation, and packages a static framework-shaped XCFramework for
-CypherAir app integration.
+## Scope
 
-## Current Status
+Only the slices CypherAir links are built: iOS, macOS, and visionOS devices
+with `arm64` and `arm64e`, plus `arm64` iOS and visionOS simulators. tvOS,
+watchOS, Mac Catalyst, and `x86_64` simulators stay out until the app needs
+them.
 
-- Status: stable external binary dependency infrastructure for CypherAir, with
-  separate experiment and drill channels for validation.
-- Upstream source: `https://github.com/sqlcipher/sqlcipher`
-- Upstream tag: `v4.17.0`
-- Expected peeled commit: `810db22f575ee7cf94ea96a3e91622b5fcece3dc`
-- SQLite baseline: `3.53.3`
-- Package shape: static `SQLCipher.framework` slices inside
-  `SQLCipher.xcframework`.
-- Crypto provider: Apple CommonCrypto / Security framework
-  (`SQLCIPHER_CRYPTO_CC`).
+## Releases
 
-This repository provides the SQLCipher binary artifact consumed by the main
-CypherAir repository. It does not by itself implement Contacts SQLCipher
-storage; that application behavior remains owned by `cypherair/cypherair`.
-
-## Supported Slices
-
-The artifact intentionally builds only the slices needed by CypherAir:
-
-| Library identifier | Platform | Architectures |
-| --- | --- | --- |
-| `ios-arm64_arm64e` | iOS device | `arm64`, `arm64e` |
-| `macos-arm64_arm64e` | macOS | `arm64`, `arm64e` |
-| `xros-arm64_arm64e` | visionOS device | `arm64`, `arm64e` |
-| `ios-arm64-simulator` | iOS Simulator | `arm64` |
-| `xros-arm64-simulator` | visionOS Simulator | `arm64` |
-
-tvOS, watchOS, Mac Catalyst, and `x86_64` simulator slices are intentionally
-out of scope until CypherAir needs them.
-
-## Build
-
-Requirements:
-
-- macOS with Xcode 26.5 platform SDKs
-- `git`
-- `make`
-- `python3`
-- `xcrun` / `xcodebuild`
-
-Build and validate:
-
-```bash
-./scripts/build-sqlcipher-xcframework.sh
-```
-
-The script writes these ignored outputs under `build/`:
-
-- `SQLCipher.xcframework`
-- `SQLCipher.xcframework.zip`
-- `SQLCipher.xcframework.sha256`
-- `SQLCipher.arm64e-build-manifest.json`
-- `SQLCipher-PrivacyInfo.xcprivacy`
-
-Each XCFramework slice contains:
-
-```text
-SQLCipher.framework/
-├── Headers/
-├── Modules/module.modulemap
-├── PrivacyInfo.xcprivacy
-└── SQLCipher
-```
-
-`SQLCipher.framework/SQLCipher` is a static-library binary. This shape lets
-Xcode consume the artifact through the normal Frameworks phase while keeping
-CypherAir's static-linking intent.
-
-Validation also executes a macOS encrypted-database round trip, verifies the
-SQLCipher 4.17.0 and SQLite 3.53.3 runtime identities, and requires a wrong key
-to fail with `SQLITE_NOTADB`.
-
-Run validation again against an existing build:
-
-```bash
-python3 scripts/validate-sqlcipher-xcframework.py \
-  --xcframework build/SQLCipher.xcframework \
-  --manifest build/SQLCipher.arm64e-build-manifest.json \
-  --xcframework-zip build/SQLCipher.xcframework.zip \
-  --checksum-file build/SQLCipher.xcframework.sha256 \
-  --privacy-manifest build/SQLCipher-PrivacyInfo.xcprivacy
-```
-
-## Release Discipline
-
-Stable releases use SSH-signed annotated tags such as
-`sqlcipher-xcframework-v4.17.0-cypherair.1`. The stable release workflow only
-publishes from those tags, produces non-prerelease immutable releases, and
-verifies both GitHub release integrity and artifact attestations after
-publication.
-
-Stable releases publish:
-
-- `SQLCipher.xcframework.zip`
-- `SQLCipher.xcframework.sha256`
-- `SQLCipher.arm64e-build-manifest.json`
-- `SQLCipher-PrivacyInfo.xcprivacy`
-- `SQLCipher.xcframework.release.json`
-
-Experiment and drill releases remain available for validation work and publish
-channel-specific metadata such as `sqlcipher-xcframework-experiment.json`.
-
-Release assets must be immutable. If a stable artifact is wrong, publish a new
-semantic release tag such as `sqlcipher-xcframework-v4.17.0-cypherair.2`
-instead of replacing existing assets.
+A stable release is triggered only by pushing an SSH-signed annotated tag
+`sqlcipher-xcframework-v<upstream version>-cypherair.<n>`. The workflow
+publishes a non-prerelease immutable release and verifies release integrity
+and artifact attestations after publication. Published assets are never
+replaced: a wrong artifact is fixed by a new `-cypherair.<n+1>` tag and
+release. Experiment and drill releases exist for validation only.
 
 ## Licensing
 
-The build scripts and repository-specific glue are distributed under the
-BSD 3-Clause license in `LICENSE`.
-
-SQLCipher remains under its upstream BSD-style license, and SQLite remains
-public domain. Generated artifacts must preserve upstream SQLCipher, SQLite,
-and privacy-manifest notices when consumed by CypherAir.
+Build scripts and repository glue: BSD 3-Clause (`LICENSE`). SQLCipher keeps
+its upstream BSD-style license and SQLite is public domain; artifacts must
+preserve the upstream SQLCipher, SQLite, and privacy-manifest notices when
+consumed by CypherAir.

scripts/build-sqlcipher-xcframework.sh

@@ -9,8 +9,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 
 SQLCIPHER_REPOSITORY="${SQLCIPHER_REPOSITORY:-https://github.com/sqlcipher/sqlcipher.git}"
-SQLCIPHER_TAG="${SQLCIPHER_TAG:-v4.17.0}"
-SQLCIPHER_EXPECTED_COMMIT="${SQLCIPHER_EXPECTED_COMMIT:-810db22f575ee7cf94ea96a3e91622b5fcece3dc}"
+SQLCIPHER_TAG="${SQLCIPHER_TAG:-v4.19.0}"
+SQLCIPHER_EXPECTED_COMMIT="${SQLCIPHER_EXPECTED_COMMIT:-c4b275a47932888216bade83aff2bbc73df0ff85}"
 SQLCIPHER_VERSION="${SQLCIPHER_TAG#v}"
 SQLCIPHER_RELEASE_STATUS="${SQLCIPHER_RELEASE_STATUS:-experimental}"
 

scripts/validate-sqlcipher-xcframework.py

@@ -47,10 +47,10 @@
 COMPILE_OPTIONS = ["SQLITE_HAS_CODEC", "SQLITE_TEMP_STORE=2"]
 LINK_FRAMEWORKS = ["Security", "CoreFoundation", "Foundation"]
 EXPECTED_SOURCE_REPOSITORY = "https://github.com/sqlcipher/sqlcipher.git"
-EXPECTED_SOURCE_TAG = "v4.17.0"
-EXPECTED_SOURCE_COMMIT = "810db22f575ee7cf94ea96a3e91622b5fcece3dc"
-EXPECTED_SQLCIPHER_VERSION = "4.17.0"
-EXPECTED_SQLITE_VERSION = "3.53.3"
+EXPECTED_SOURCE_TAG = "v4.19.0"
+EXPECTED_SOURCE_COMMIT = "c4b275a47932888216bade83aff2bbc73df0ff85"
+EXPECTED_SQLCIPHER_VERSION = "4.19.0"
+EXPECTED_SQLITE_VERSION = "3.53.4"
 CFLAGS = [
     "-DNDEBUG",
     "-DSQLCIPHER_CRYPTO_CC",