cloud-sdk 1.0.0

[eldryoth]

cloud-sdk 1.0.0

cloud-sdk 1.0.0 is the first stable release of the provider-neutral Rust cloud SDK foundation and its complete Hetzner provider implementation.

This release establishes the stable public API, security boundaries, platform contract, provider coverage, and release process that future 1.x versions will maintain under semantic versioning.

Highlights

• no_std-first provider-neutral SDK foundation.
• Complete claimed coverage of active Hetzner Cloud, DNS, Security, Console Storage, Server Metadata, and Robot APIs.
• Blocking, Send asynchronous, and local asynchronous execution contracts.
• Optional Reqwest transports with Rustls TLS.
• Bounded request and response processing.
• Explicit retry, mutation, destructive-operation, and cost controls.
• Secret redaction and caller-controlled sensitive-buffer cleanup.
• Source-locked API drift detection for Hetzner services.
• Linux, Windows, BSD, macOS, Android, iOS, WebAssembly, and bare-metal portability contracts.
• Full-project penetration testing, fuzzing, dependency review, SBOM generation, and reproducible package verification.

Workspace Crates

All public workspace crates are released as version 1.0.0:

Crate	Purpose
cloud-sdk	Provider-neutral operations, transport, authentication, pagination, retry, cleanup, execution, and policy contracts
cloud-sdk-hetzner	Hetzner Cloud, DNS, Security, Console Storage, Server Metadata, and Robot provider implementation
cloud-sdk-reqwest	Optional blocking and asynchronous Reqwest transport adapters
cloud-sdk-sanitization	Reviewed secret handling, sanitization, and memory-cleanup primitives
cloud-sdk-testkit	Provider and transport testing utilities

Use exact versions for the reviewed release graph:

[dependencies]
cloud-sdk = "=1.0.0"
cloud-sdk-hetzner = "=1.0.0"

Optional blocking transport:

cloud-sdk-reqwest = { version = "=1.0.0", features = ["blocking-rustls"] }

Hetzner Coverage

The v1.0 executable scope contains 304 active operations and routes:

Source	Active scope
Cloud, DNS, Security, and Console Storage OpenAPI	208 operations
Robot Webservice	89 operations
Server Metadata	7 routes
Total	304

An additional 29 deprecated or removed operations are tracked by the drift tooling but are intentionally not exposed as public executable operations.

Cloud API

Coverage includes:

• Actions
• Servers and server actions
• Server metrics
• Server types
• Images and image actions
• ISOs
• Placement groups
• Primary IPs and actions
• Volumes and actions
• Floating IPs and actions
• Firewalls and actions
• Load balancers, actions, and types
• Networks and actions
• Locations
• Pricing

DNS and Security APIs

Coverage includes:

• Zones and zone actions
• RRsets and RRset actions
• Certificates and certificate actions
• SSH keys

Console Storage

The active Console Storage Box OpenAPI surface is modeled, including storage boxes, storage-box types, snapshots, subaccounts, and related operations.

Robot Webservice

The active Robot API surface includes:

• Dedicated servers and server information
• Server cancellation
• IPs and subnets
• Resets and wake-on-LAN
• Failover addresses
• Boot configuration
• Reverse DNS
• Traffic
• SSH keys
• Firewalls
• vSwitches
• Product and order catalogs
• Order mutations and transactions

Server Metadata

The canonical link-local metadata routes are supported:

• /hetzner/v1/metadata
• /hetzner/v1/metadata/hostname
• /hetzner/v1/metadata/instance-id
• /hetzner/v1/metadata/public-ipv4
• /hetzner/v1/metadata/private-networks
• /hetzner/v1/metadata/availability-zone
• /hetzner/v1/metadata/region

Metadata requests are restricted to the canonical 169.254.169.254 authority. They do not accept credentials, proxies, custom endpoints, or implicit retries.

Object Storage is intentionally excluded because it uses the standard S3 protocol. Deprecated operations and Robot domain registration through its mail interface are also outside the SDK scope.

Security Model

Security-sensitive behavior is explicit throughout the API:

• Default features do not activate networking, TLS, an async runtime, filesystem access, clocks, or secret storage.
• First-party crates forbid unsafe Rust.
• Requests and responses use explicit size limits.
• Credentials and sensitive values use redacted diagnostics.
• Sensitive output cleanup remains explicit and testable.
• Retries are disabled unless the caller supplies a policy.
• Mutation, destructive, and cost-bearing operations expose operation metadata and policy controls.
• Custom endpoints require explicit construction and must never originate from tenant-controlled input.
• Provider errors are decoded through checked, bounded response paths.
• Direct third-party dependency requirements are exactly pinned to the reviewed graph.

The v1.0.0 release received a full-project penetration test and final retest. The reported dependency-policy inconsistency was remediated, and the final retest found no remaining findings.

This does not constitute regulatory or military accreditation. FIPS support is deliberately deferred until the planned Brynja integration can provide an independently qualified cryptographic boundary.

Portability

The provider-neutral crates support portable compilation contracts for:

• Linux
• Windows
• FreeBSD
• macOS
• Android
• iOS
• wasm32-unknown-unknown
• Bare-metal thumbv7em-none-eabihf

Native Reqwest transport CI covers Linux, Windows, and macOS. FreeBSD transport support is maintained on a best-effort basis. Android, iOS, WebAssembly, and bare-metal consumers use the provider-neutral transport contracts with a platform-appropriate transport implementation.

The minimum supported Rust version is Rust 1.92.0. Development and final release verification use Rust 1.97.1.

API Drift Protection

The repository includes fail-closed drift checks for:

• Hetzner Cloud, DNS, Security, and Console Storage OpenAPI documents
• Operation and schema fingerprints
• Robot Webservice documentation and endpoint locks
• Server Metadata documentation
• Hetzner changelog RSS entries
• Relevant IANA registry data

Run the maintained API-surface check with:

scripts/check_hetzner_api_surface.sh --fetch

New operations, removals, deprecations, parameter changes, schema changes, metadata changes, and relevant changelog updates require an explicit reviewed update.

Release Verification

The v1.0.0 release gate includes:

• Complete workspace tests and documentation tests
• Rust version and portable-target checks
• Cargo audit and dependency-policy validation
• Full-project penetration testing and retesting
• CodeQL analysis
• 35 fuzz targets and smoke campaigns
• Adversarial request and response fixtures
• API and registry drift checks
• Secret-redaction and cleanup checks
• File-size and public-API policy checks
• Fresh SPDX SBOM verification
• Reproducible package construction from two clean clones
• Package-content and release-metadata validation

Compatibility

Version 1.0.0 promotes the completed 0.100.0 provider and runtime scope to the stable API line. The final dependency requirements were narrowed to exact versions already present in the reviewed lockfile; this does not change the resolved runtime graph.

Future compatible additions and corrections will follow semantic versioning. Breaking public API changes will be reserved for a future major version.

Documentation

• Quickstart
• Hetzner examples
• Hetzner v1.0 scope
• Platform support
• Threat model
• API drift maintenance
• Security policy
• v1.0.0 pentest report

Cost and Production Warning

Cloud API operations can create billable resources, modify infrastructure, cause downtime, or destroy data. No SDK can guarantee that every request, provider response, integration, or application is free from defects.

Review generated operations, permissions, retry behavior, resource identifiers, and current provider pricing before running code against production infrastructure. The caller remains responsible for resulting costs, downtime, and data loss. Security and correctness reports are welcome through the repository's documented reporting process.

Full changelog: v0.100.0...v1.0.0