From e7132a8ff16a37335e69392a9dc3543455817270 Mon Sep 17 00:00:00 2001 From: Mark Xue Date: Sun, 20 Sep 2026 01:47:59 -0700 Subject: [PATCH 1/7] Move engine dependencies onto swift-crypto 5 Org-wide swift-crypto 5 move, carried by revision-pinning twomlspq-swift, swift-mls, and autonomous-comm-protocol to their swift-crypto-5 branches and moving swift-secret-bytes to 0.5.0. No source changes. Co-Authored-By: Claude Code --- .changeset/swift-crypto-5.md | 21 +++++++++++++++++++++ Package.resolved | 36 ++++++++++++++++++++---------------- Package.swift | 16 ++++++++++++---- 3 files changed, 53 insertions(+), 20 deletions(-) create mode 100644 .changeset/swift-crypto-5.md diff --git a/.changeset/swift-crypto-5.md b/.changeset/swift-crypto-5.md new file mode 100644 index 0000000..7334995 --- /dev/null +++ b/.changeset/swift-crypto-5.md @@ -0,0 +1,21 @@ +--- +"@germ-network/two-mls-pq": minor +--- + +Move the MLS engine dependencies onto swift-crypto 5, as part of the org-wide +swift-crypto 5 migration. This package has no direct `swift-crypto` +requirement (its `swift-crypto` arrives through swift-mls / swift-secret-bytes); +the move is carried by revision-pinning those: + +- `twomlspq-swift` → its swift-crypto-5 branch (germ-network/twomlspq-swift#60) +- `swift-mls` → its swift-crypto-5 branch (germ-network/swift-mls#103) +- `autonomous-comm-protocol` → its swift-crypto-5 branch + (germ-network/autonomous-comm-protocol#59) +- `swift-secret-bytes` → `.upToNextMinor(from: "0.5.0")` (its swift-crypto-5 + release) + +All revision pins are temporary; replace with released versions once each cuts. + +No source changes were required. (Note: `swift build` on a macOS host fails in +`Sources/TwoMLSPQBinding` on a UniFFI-bindings/xcframework mismatch; that +failure is identical on `main` and predates this change.) diff --git a/Package.resolved b/Package.resolved index 0ec42d3..6b2f089 100644 --- a/Package.resolved +++ b/Package.resolved @@ -1,13 +1,12 @@ { - "originHash" : "8bbbedc0770f4c34e0b47cbd9e0cb8f515776f4269250ae62052846f288b26f2", + "originHash" : "d25ab59853841496adc2ed1adf5e5ceb465e7c3a01f026f0535bbe348368c272", "pins" : [ { "identity" : "atprototypes", "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/AtprotoTypes.git", "state" : { - "revision" : "537310dd07df81f20f91e28164d3a97b21ad0c20", - "version" : "0.6.1" + "revision" : "8e00dd81013fef864de2b0f3dde7ad7fcbdc119b" } }, { @@ -15,8 +14,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/autonomous-comm-protocol.git", "state" : { - "revision" : "3ca940fd943fc99e5e88728d13492ef6d7439640", - "version" : "1.2.2" + "revision" : "d647004ed104bc8838aef9f4475c4625cb1033fe" } }, { @@ -24,8 +22,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/GermConvenience.git", "state" : { - "revision" : "e474915e5ab3f917d5f5496af5fb4814081fb75c", - "version" : "0.8.0" + "revision" : "f907c9018dd4c2f0110ab5f1f37c7c53fa0ae6ca" } }, { @@ -42,7 +39,16 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/swift-libp2p/swift-bases.git", "state" : { - "revision" : "96615d4b582f9f6536d8278304ce2a64c8e5288a", + "revision" : "99bf30ca95313bbf2e815a82023a2aca99491a77", + "version" : "0.4.0" + } + }, + { + "identity" : "swift-cbor", + "kind" : "remoteSourceControl", + "location" : "https://github.com/nnabeyang/swift-cbor.git", + "state" : { + "revision" : "8cba641c7bc644fb2a141d2cdda7ae8ef255fbba", "version" : "0.2.0" } }, @@ -51,8 +57,8 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/apple/swift-crypto.git", "state" : { - "revision" : "1b6b2e274e85105bfa155183145a1dcfd63331f1", - "version" : "4.5.0" + "revision" : "a9d1d5ab8951ada40cafff8c8e2b551dfde4f390", + "version" : "5.0.0" } }, { @@ -78,8 +84,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/swift-mls.git", "state" : { - "revision" : "f5944c869a2efc711a43b4525b4d04402db8f3cf", - "version" : "0.1.1" + "revision" : "9182f8755690c2129b57f8ba5b8ef549c57cb9ab" } }, { @@ -87,8 +92,8 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/swift-secret-bytes.git", "state" : { - "revision" : "f10434b708c8685e28db46258c856ba1b66f4312", - "version" : "0.4.0" + "revision" : "8cadb9c25f855f6c1db4985c97a28af4dcf391dc", + "version" : "0.5.0" } }, { @@ -96,8 +101,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/twomlspq-swift.git", "state" : { - "revision" : "16b10af0be7e4e778f56c79d85532ea4d3a8c2ef", - "version" : "0.1.3" + "revision" : "34c0a3a42595430fca8707c4b97e49c523144b5a" } } ], diff --git a/Package.swift b/Package.swift index 70fc55b..4e9cae7 100644 --- a/Package.swift +++ b/Package.swift @@ -70,9 +70,11 @@ let package = Package( // release. The test target still mints client ids with `AgentPrivateKey` the way // the app does — `ClientID` IS `AgentPublicKey.wireFormat`, carried opaquely but // persisted in MLS group state, so testing against the real encoding is the point. + // Temporary revision pin to autonomous-comm-protocol's swift-crypto-5 + // branch (#59); replace with the released version once it cuts. .package( url: "https://github.com/germ-network/autonomous-comm-protocol.git", - from: "1.2.0" + revision: "d647004ed104bc8838aef9f4475c4625cb1033fe" ), // The native-side migrator dependency (GER-2372): twomlspq-swift carries R1's // `InvitationMigration.mintArchive` + `MigratedIdentity` and R2's @@ -81,9 +83,12 @@ let package = Package( // (SessionMigration + the ML-KEM `hpkeSecretKeySize`); its transitive deps // (swift-mls, swift-secret-bytes, swift-crypto, GermConvenience) resolve // automatically. + // Temporary revision pin to twomlspq-swift's swift-crypto-5 branch + // (germ-network/twomlspq-swift#60); replace with the released version + // once it cuts. .package( url: "https://github.com/germ-network/twomlspq-swift.git", - .upToNextMinor(from: "0.1.1") + revision: "34c0a3a42595430fca8707c4b97e49c523144b5a" ), // Declared directly (not just transitively through twomlspq-swift) because // the migrate targets import their products. Library deps stay ranged @@ -92,13 +97,16 @@ let package = Package( // conflicts against a consumer's own tighter pin; twomlspq-swift's own // swift-mls requirement is ranged the same way (the 0.1.1 floor carries // the C0 `Nsk` length check). Exactness belongs to the app-level repo. + // Temporary revision pin to swift-mls's swift-crypto-5 branch + // (germ-network/swift-mls#103); replace with the released version once + // it cuts. .package( url: "https://github.com/germ-network/swift-mls.git", - .upToNextMinor(from: "0.1.1") + revision: "9182f8755690c2129b57f8ba5b8ef549c57cb9ab" ), .package( url: "https://github.com/germ-network/swift-secret-bytes.git", - .upToNextMinor(from: "0.4.0") + .upToNextMinor(from: "0.5.0") ) ], targets: [ From 196ec26d3d49c51ef80945f430fba617fcda7a30 Mon Sep 17 00:00:00 2001 From: Mark Xue Date: Sun, 20 Sep 2026 02:18:10 -0700 Subject: [PATCH 2/7] Repin the swift-crypto-5 dependencies to current branch tips Following the GermConvenience 0.10.0 release, the remaining revision pins move to the current tips of their swift-crypto-5 branches so every requester agrees on one revision. Replace with released versions as each cuts. Co-Authored-By: Claude Code --- Package.resolved | 13 +++++++------ Package.swift | 6 +++--- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/Package.resolved b/Package.resolved index 6b2f089..afbbdea 100644 --- a/Package.resolved +++ b/Package.resolved @@ -1,12 +1,12 @@ { - "originHash" : "d25ab59853841496adc2ed1adf5e5ceb465e7c3a01f026f0535bbe348368c272", + "originHash" : "dfd7a1a3ee661e97f07c106cd445c7030771b1e5771abf93aebb4bf5bf06687a", "pins" : [ { "identity" : "atprototypes", "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/AtprotoTypes.git", "state" : { - "revision" : "8e00dd81013fef864de2b0f3dde7ad7fcbdc119b" + "revision" : "e4cd0028639cb44b8ea24117f51d876954859493" } }, { @@ -14,7 +14,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/autonomous-comm-protocol.git", "state" : { - "revision" : "d647004ed104bc8838aef9f4475c4625cb1033fe" + "revision" : "397375188ba7cbffa74e2040ac6042d9587b3a35" } }, { @@ -22,7 +22,8 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/GermConvenience.git", "state" : { - "revision" : "f907c9018dd4c2f0110ab5f1f37c7c53fa0ae6ca" + "revision" : "305053c5194bfd129a3feda8fe214ec33addee03", + "version" : "0.10.0" } }, { @@ -84,7 +85,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/swift-mls.git", "state" : { - "revision" : "9182f8755690c2129b57f8ba5b8ef549c57cb9ab" + "revision" : "c6bd2c1521174b0fa3efdde512fa1baeb4ba3cfc" } }, { @@ -101,7 +102,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/twomlspq-swift.git", "state" : { - "revision" : "34c0a3a42595430fca8707c4b97e49c523144b5a" + "revision" : "47cebd1dc278d6bbe67afa46bf319776a6eecf4f" } } ], diff --git a/Package.swift b/Package.swift index 4e9cae7..56265dd 100644 --- a/Package.swift +++ b/Package.swift @@ -74,7 +74,7 @@ let package = Package( // branch (#59); replace with the released version once it cuts. .package( url: "https://github.com/germ-network/autonomous-comm-protocol.git", - revision: "d647004ed104bc8838aef9f4475c4625cb1033fe" + revision: "397375188ba7cbffa74e2040ac6042d9587b3a35" ), // The native-side migrator dependency (GER-2372): twomlspq-swift carries R1's // `InvitationMigration.mintArchive` + `MigratedIdentity` and R2's @@ -88,7 +88,7 @@ let package = Package( // once it cuts. .package( url: "https://github.com/germ-network/twomlspq-swift.git", - revision: "34c0a3a42595430fca8707c4b97e49c523144b5a" + revision: "47cebd1dc278d6bbe67afa46bf319776a6eecf4f" ), // Declared directly (not just transitively through twomlspq-swift) because // the migrate targets import their products. Library deps stay ranged @@ -102,7 +102,7 @@ let package = Package( // it cuts. .package( url: "https://github.com/germ-network/swift-mls.git", - revision: "9182f8755690c2129b57f8ba5b8ef549c57cb9ab" + revision: "c6bd2c1521174b0fa3efdde512fa1baeb4ba3cfc" ), .package( url: "https://github.com/germ-network/swift-secret-bytes.git", From a399872b0bf4ef272bf8aae9c4391a0719a69dfb Mon Sep 17 00:00:00 2001 From: Mark Xue Date: Sun, 20 Sep 2026 02:44:39 -0700 Subject: [PATCH 3/7] Consume swift-mls 0.1.3 and the matching twomlspq-swift tip swift-mls 0.1.3 is cut and carries the swift-crypto 5 move; twomlspq-swift's branch tip now consumes it, so this pin moves to match. Co-Authored-By: Claude Code --- Package.resolved | 7 ++++--- Package.swift | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/Package.resolved b/Package.resolved index afbbdea..d3206ae 100644 --- a/Package.resolved +++ b/Package.resolved @@ -1,5 +1,5 @@ { - "originHash" : "dfd7a1a3ee661e97f07c106cd445c7030771b1e5771abf93aebb4bf5bf06687a", + "originHash" : "325e9f9dcdf5e0ef4783bd5b815970702831691907fb682a740c15ada31a7625", "pins" : [ { "identity" : "atprototypes", @@ -85,7 +85,8 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/swift-mls.git", "state" : { - "revision" : "c6bd2c1521174b0fa3efdde512fa1baeb4ba3cfc" + "revision" : "663e2eeb2a3f3b86ebdc5db861b04580de72c2b3", + "version" : "0.1.3" } }, { @@ -102,7 +103,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/twomlspq-swift.git", "state" : { - "revision" : "47cebd1dc278d6bbe67afa46bf319776a6eecf4f" + "revision" : "9cca7f9724c5582923f05cabd5cb570f7300c719" } } ], diff --git a/Package.swift b/Package.swift index 56265dd..bf812ba 100644 --- a/Package.swift +++ b/Package.swift @@ -88,7 +88,7 @@ let package = Package( // once it cuts. .package( url: "https://github.com/germ-network/twomlspq-swift.git", - revision: "47cebd1dc278d6bbe67afa46bf319776a6eecf4f" + revision: "9cca7f9724c5582923f05cabd5cb570f7300c719" ), // Declared directly (not just transitively through twomlspq-swift) because // the migrate targets import their products. Library deps stay ranged @@ -102,7 +102,7 @@ let package = Package( // it cuts. .package( url: "https://github.com/germ-network/swift-mls.git", - revision: "c6bd2c1521174b0fa3efdde512fa1baeb4ba3cfc" + from: "0.1.3" ), .package( url: "https://github.com/germ-network/swift-secret-bytes.git", From 73740f5132c76405ab64b4047a4f91a2f17a4682 Mon Sep 17 00:00:00 2001 From: Mark Xue Date: Sun, 20 Sep 2026 08:56:45 -0700 Subject: [PATCH 4/7] Drop the twomlspq-swift pin to its release Per-dependency repin: twomlspq-swift 0.2.0 is released and carries the swift-crypto 5 move, so the revision pin drops. The ACP pin stays until it releases. Co-Authored-By: Claude Code --- Package.resolved | 5 +++-- Package.swift | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/Package.resolved b/Package.resolved index d3206ae..ac247d6 100644 --- a/Package.resolved +++ b/Package.resolved @@ -1,5 +1,5 @@ { - "originHash" : "325e9f9dcdf5e0ef4783bd5b815970702831691907fb682a740c15ada31a7625", + "originHash" : "b79d7a473a66829f5257e1980a0689511624212b61a213b83cc24aa0a39702a0", "pins" : [ { "identity" : "atprototypes", @@ -103,7 +103,8 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/twomlspq-swift.git", "state" : { - "revision" : "9cca7f9724c5582923f05cabd5cb570f7300c719" + "revision" : "17f602fd892418b63e0ebd815321776380f4c364", + "version" : "0.2.0" } } ], diff --git a/Package.swift b/Package.swift index bf812ba..0a395b3 100644 --- a/Package.swift +++ b/Package.swift @@ -88,7 +88,7 @@ let package = Package( // once it cuts. .package( url: "https://github.com/germ-network/twomlspq-swift.git", - revision: "9cca7f9724c5582923f05cabd5cb570f7300c719" + from: "0.2.0" ), // Declared directly (not just transitively through twomlspq-swift) because // the migrate targets import their products. Library deps stay ranged From 1000d2209ad9abd004b602b4412aa22fb30b53d6 Mon Sep 17 00:00:00 2001 From: Mark Xue Date: Sun, 20 Sep 2026 21:14:38 -0700 Subject: [PATCH 5/7] Widen the swift-secret-bytes pin to from: .upToNextMinor(from: "0.5.0") fences out 0.6.0; from: keeps the 0.5.x floor while admitting it once it cuts. Co-Authored-By: Claude Code --- Package.swift | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Package.swift b/Package.swift index 0a395b3..8dcaaf0 100644 --- a/Package.swift +++ b/Package.swift @@ -106,7 +106,7 @@ let package = Package( ), .package( url: "https://github.com/germ-network/swift-secret-bytes.git", - .upToNextMinor(from: "0.5.0") + from: "0.5.0" ) ], targets: [ From bbde084ff649c4e6c849c393fabc0fc700e698a9 Mon Sep 17 00:00:00 2001 From: Mark Xue Date: Sun, 20 Sep 2026 22:10:37 -0700 Subject: [PATCH 6/7] Pick up swift-mls 0.1.4 and twomlspq-swift 0.2.1 Both releases carry the widened swift-secret-bytes pin (from: 0.5.0), which is what makes 0.6.0 reachable through this package. Co-Authored-By: Claude Code --- Package.resolved | 10 +++++----- Package.swift | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Package.resolved b/Package.resolved index ac247d6..a171ecd 100644 --- a/Package.resolved +++ b/Package.resolved @@ -1,5 +1,5 @@ { - "originHash" : "b79d7a473a66829f5257e1980a0689511624212b61a213b83cc24aa0a39702a0", + "originHash" : "2c9756d0238b424cff19d005ff35632d5518a923716de06a42fd3d59d28007ba", "pins" : [ { "identity" : "atprototypes", @@ -85,8 +85,8 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/swift-mls.git", "state" : { - "revision" : "663e2eeb2a3f3b86ebdc5db861b04580de72c2b3", - "version" : "0.1.3" + "revision" : "4dd46ab97af684652f8ceb7ef418d6273eb04543", + "version" : "0.1.4" } }, { @@ -103,8 +103,8 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/twomlspq-swift.git", "state" : { - "revision" : "17f602fd892418b63e0ebd815321776380f4c364", - "version" : "0.2.0" + "revision" : "6d9b1fdfaa2bc9fa91cfcc3ea30945f06c4324cc", + "version" : "0.2.1" } } ], diff --git a/Package.swift b/Package.swift index 8dcaaf0..40a69f0 100644 --- a/Package.swift +++ b/Package.swift @@ -88,7 +88,7 @@ let package = Package( // once it cuts. .package( url: "https://github.com/germ-network/twomlspq-swift.git", - from: "0.2.0" + from: "0.2.1" ), // Declared directly (not just transitively through twomlspq-swift) because // the migrate targets import their products. Library deps stay ranged @@ -102,7 +102,7 @@ let package = Package( // it cuts. .package( url: "https://github.com/germ-network/swift-mls.git", - from: "0.1.3" + from: "0.1.4" ), .package( url: "https://github.com/germ-network/swift-secret-bytes.git", From 10d0d81a4ba8581c1a0d861cb484feaad882ec04 Mon Sep 17 00:00:00 2001 From: Mark Xue Date: Sun, 20 Sep 2026 23:06:17 -0700 Subject: [PATCH 7/7] Drop the released dependency pin Per-dependency repin: the dependency is released and carries the swift-crypto 5 move, so the revision pin drops. No revision pins remain here. Co-Authored-By: Claude Code --- Package.resolved | 8 +++++--- Package.swift | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/Package.resolved b/Package.resolved index a171ecd..cc56e16 100644 --- a/Package.resolved +++ b/Package.resolved @@ -1,12 +1,13 @@ { - "originHash" : "2c9756d0238b424cff19d005ff35632d5518a923716de06a42fd3d59d28007ba", + "originHash" : "dce512909c4b52bf34b936932f4d92ceae94a75e0c9b9bcb7656b8ac58317eef", "pins" : [ { "identity" : "atprototypes", "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/AtprotoTypes.git", "state" : { - "revision" : "e4cd0028639cb44b8ea24117f51d876954859493" + "revision" : "46fbeeac594d236ed992cdffe547eebb9bce7ae6", + "version" : "0.7.0" } }, { @@ -14,7 +15,8 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/germ-network/autonomous-comm-protocol.git", "state" : { - "revision" : "397375188ba7cbffa74e2040ac6042d9587b3a35" + "revision" : "68d3a2432dee6f966edd8403e1778e44e0423bf5", + "version" : "1.13.0" } }, { diff --git a/Package.swift b/Package.swift index 40a69f0..7612d96 100644 --- a/Package.swift +++ b/Package.swift @@ -74,7 +74,7 @@ let package = Package( // branch (#59); replace with the released version once it cuts. .package( url: "https://github.com/germ-network/autonomous-comm-protocol.git", - revision: "397375188ba7cbffa74e2040ac6042d9587b3a35" + from: "1.13.0" ), // The native-side migrator dependency (GER-2372): twomlspq-swift carries R1's // `InvitationMigration.mintArchive` + `MigratedIdentity` and R2's