Notable changes to CSha are recorded here, newest first, using the
Keep a Changelog categories.
Versions 1.2.0–1.5.0 organize the recent implemented changes into version
milestones; release tags and packaged binaries are tracked separately. Dates
on older entries come from the existing Git tags.[Unreleased]#
No additional changes recorded.[1.5.0] — Shared cipher interface and expanded documentation#
Added#
A shared C++20 csha.encoder module with whole-message and streaming encoder
interfaces, used by AES and the additional cipher implementations.
Ten authenticated cipher choices: ChaCha20-Poly1305, XChaCha20-Poly1305,
Camellia-EAX, ARIA-EAX, Twofish-EAX, Serpent-EAX, CAST-256-EAX, RC6-EAX,
MARS-EAX, and SM4-EAX.
--cipher NAME and --list-ciphers for stored image, file, ZIP, map,
image-pair, and Docker PNG workflows. Decoders detect the stored algorithm.
Password envelopes for the new ciphers with a fresh 16-byte salt,
PBKDF2-HMAC-SHA256 at 600,000 iterations, and authenticated format metadata.
Coverage for all 21 image/map CLI modes, cipher known-answer vectors, binary
boundaries, tampering, stream lifecycle, relay rejection, and Docker failures.
A 15-page Apidog documentation set, including quick start, formats and keys,
C++ API, encryption algorithms, testing, and troubleshooting guides.
Changed#
Raised the build requirements to C++20, CMake 3.28+, Ninja 1.11+, upstream
Clang 16+ with clang-scan-deps, and Crypto++ 8.9+. Fresh macOS builds discover
Homebrew LLVM; AppleClang is not supported for the named-module build.
Kept the default AES formats and legacy reads compatible. New cipher outputs
use distinct envelopes, including version-2 Docker PNGs, and need a current decoder.
Expanded CTest to 12 groups, including process-level and deterministic Docker
fixture checks. A real Docker daemon remains an optional integration check.
Expanded command examples and documented key semantics, payload limits,
recovery procedures, and C++ module integration while preserving the site's
existing GitBook-style appearance.
Fixed#
Restored fdz recovery from indexed master maps and their .chunks
directories, including rejection of missing or undecodable chunks.
Corrected shared validation so mfi and mfz can generate maps from derived
seeds using -G without a separate -S; ZIP seed derivation no longer needs
an unrelated image input.
[1.4.0] — Blob Streams and Docker archive PNGs#
Added#
Authenticated, bidirectional Blob Streams using TLS 1.3, local device
identities, and verified peer certificates.
Direct TCP listen/connect commands and a paired HTTP CONNECT relay that
forwards encrypted bytes between an initiator and responder.
A transport-independent C++ session API with bounded queues, backpressure,
independent send/receive completion, and authenticated shutdown checks.
Docker keygen, pack, inspect, restore, load, and run commands.
Packing resolves a tag to its image ID and stores its Docker-save archive in a PNG.
Bounded-memory Docker archive encryption with a separate 32-byte key file,
authenticated metadata, archive SHA-256 verification, and private temporary files.
Verification before publishing restored archives or invoking Docker, plus
output-overwrite protection and Docker argument/exit-code forwarding.
Changed#
Kept network transport and Docker archive code in separate C++ libraries and
CLI adapters alongside the existing image/map application.
Added dedicated guides and tests for peer communication and Docker PNG
recovery. Docker archive storage is separate from the removed server deployment.
Added#
Lossless PNG data URL export with --data-url-output and import with
--image-data-url, including @file input for large encoded images.
Image-password maps using two --key-image credentials. Either original
image can independently unlock the payload, including exact file recovery.
Explicit ciphertext lengths in the binary pixel format, preserving arbitrary
bytes and trailing zeros in newly encoded images.
Changed#
Replaced per-pixel hexadecimal conversions and intermediate PNG file work
with direct in-memory binary conversions while retaining legacy image reads.
Kept generated seed metadata in a single row. Maps widen when needed instead
of dropping seed entries, and the reader still accepts older multi-row layouts.
Used a random AES-GCM payload key with independently wrapped image-key slots
for the original image-pair format.
Fixed#
Corrected environment-map capacity calculations and rejected oversize
payloads instead of truncating them or returning raw ciphertext pixels.
Added malformed data URL rejection and incompatible input/output checks.
Verified binary round trips across AES modes, PNG reloads, non-contiguous
matrices, legacy formats, and either-image recovery.
[1.2.0] — One CMake application#
Changed#
Consolidated the project into one C++ csha executable built by the root
CMakeLists.txt, initially using C++17 before the later C++20 migration.
Organized application code under src/ and bundled Cubiomes under
third_party/, with explicit library targets and source lists.
Moved CLI parsing and dispatch into src/heler.cpp and src/heler.h;
main.cpp now forwards arguments and returns the helper's exit code.
Replaced container-based CI with a CMake build, CTest run, and install check.
Migrated documentation from GitBook to Apidog, preserving the light theme,
blue accents, original illustrations, and versioned documentation sources.
Fixed#
Added Homebrew OpenSSL discovery for macOS and GUI-launched CLion builds,
while respecting explicit OPENSSL_ROOT_DIR settings.
Removed#
Kubernetes manifests, the Python/web server, legacy service containers, and
deployment scripts.
Handwritten Makefiles, standalone component builds, duplicate CLI entry points,
unused helper code, the bundled Catch2 v2 header, and release-specific Ruby packaging.
[1.1.9] - 2025-11-29#
Added#
Large fz exports split into numbered chunk PNGs and a master seed map.
A legacy mosaic decoding path alongside single-map ZIP recovery.
Fixed#
Included sys/stat.h so directory creation with mkdir compiles on macOS.
companion-directory recovery path. That mismatch is corrected in 1.5.0 above.[1.1.5] - 2025-11-29#
Added#
Full-ZIP modes fz and fdz for encoding ZIP archives into Minecraft
environment maps and restoring archive bytes.
Mode aliases, help text, and CLI dispatch for the ZIP map workflow.
[1.1.0] - 2025-11-29#
Added#
Full environment-map encode/decode with encrypted data embedded in the low
bits of Minecraft map pixels.
A workflow deriving a seed from an encrypted image, rendering a biome map,
and embedding the encrypted payload for later recovery.
Changed#
Updated CLI and Homebrew version metadata for the environment-map release.
Improved deployment version handling and added deployment retries.
[1.0.4] - 2025-11-29#
Added#
A Homebrew formula for package distribution and deployment pipeline support.
ZIP tooling in the container build for archive-related tests.
Fixed#
ZIP fixture creation and reliability in tests.
The copied table binary name in its Dockerfile.
Hardcoded local paths and Homebrew CMake paths in the component Makefile.
[1.0.2] - 2025-11-28#
Fixed#
Replaced the Cubiomes submodule reference with source files committed directly
to the repository, ensuring release tarballs include the dependency needed by
Homebrew builds.
[1.0.1] - 2025#
Added#
Automated deployment stage for Homebrew package builds
Fixed#
Improved zip file creation reliability in tests
Corrected binary name in table Dockerfile
Replaced hardcoded absolute paths with relative paths in Makefile
Removed hardcoded Homebrew cmake paths in Makefile
[1.0.0] - 2025#
Initial Stable Release - Core cryptography features and Minecraft map generationAdded#
Core AES encryption/decryption functionality
SHA-256 hashing with one-way verification
Minecraft map generation from seeds using Cubiomes library
Steganographic metadata embedding in image pixels
Multiple operation modes:Full encode/decode with environment maps
Encode/decode with/without seed maps
String, file, and zip encoding
Map generation from various sources
Docker support with multi-service architecture:csha (main encryption tool)
map-sha (Minecraft map generation)
table (data encoding/decoding)
server (FastAPI Python server)
FastAPI server with web interface for encryption operations
Comprehensive test suite using Catch2 v3
CI/CD pipeline with GitLab CI
Coverage reporting and badges
Install target for Homebrew distribution
Core Features#
Encryption Methods
AES-256 encryption in CBC, CTR, and GCM modes
Three key derivation strategies (DIRECT/SHA-256, PBKDF2, FIXED)
Configurable salt and padding
Map Generation
64-bit seed generation from passwords, images, or strings
Minecraft world generation using Cubiomes C library
Support for multiple Minecraft versions (1.7, 1.8+)
Metadata System
Pixel-based steganographic data embedding
BGR value encoding for encryption parameters
Seed, spawn coordinates, and version information storage
Visually imperceptible modifications
Data Encoding
File and environment file encoding
Zip archive encoding with Base64 support
Multi-chunk mosaic generation for large data
Security#
Security Features: One-way SHA-256 hashing is non-reversible. Always keep your encryption keys secure.One-way SHA-256 hashing (non-reversible)
AES-256 encryption with multiple modes
Configurable key derivation for enhanced security
Salt support for improved password security
macOS#
Homebrew package manager support
Linux#
Docker containerized deployment
Docker#
Multi-platform support (linux/amd64, linux/arm64)
Pre-built images available on GitLab Container Registry
Documentation#
Comprehensive README with flowcharts
Docker deployment instructions
Homebrew installation guide
AI usage transparency statement
Historical project structure (1.0.0)#
Components#
table/: Core AES encryption/decryption engineAES implementation with multiple modes
map-sha/: Minecraft map generationJava Random seed compatibility
cubiomes/: Minecraft biome generation libraryWorld generation algorithms
server/: Python FastAPI web serverImage processing interface
Build System#
CMake configuration for C++ components
Makefiles for individual components
Docker multi-stage builds
Testing#
Functional tests for CSha class
Integration tests for encoding/decoding
Coverage reporting with gcovr
License#
This project is licensed under the Mozilla Public License 2.0 (MPL-2.0). See LICENSE for details.Credits#
Third-Party Libraries#
Cubiomes: Minecraft biome generation (included in repository)
OpenCV: Image processing and manipulation
OpenSSL: Cryptographic operations
Catch2: C++ testing framework
FastAPI: Python web framework
AI Assistance#
This project was developed with assistance from AI tools for code refactoring, build configuration, and documentation. See the AI Usage Statement for detailed information.Code refactoring and optimization
Makefile and build configuration
Homebrew formula creation
Documentation and README generation
Bit-level mathematical operations
Modified at 2026-10-17 15:06:55
