Skip to content

CHANGELOG.md

Latest commit

 

History

History
73 lines (50 loc) · 4.38 KB

CHANGELOG.md

File metadata and controls

73 lines (50 loc) · 4.38 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project follows Semantic Versioning.

Unreleased

2.0.0 - 2026-06-01

Added

  • Configuration#provider_options: keyword options for built-in providers are forwarded to EnvProvider.new / AwsKmsProvider.new (Hash/OrderedOptions, no separate aws_kms / env_provider accessors).
  • Breaking: EnvProvider now accepts encryption_key: directly; pass provider_options[:encryption_key] = ENV.fetch("ACTIVE_CIPHER_MASTER_KEY") instead of configuring an env-var name.
  • Provider String aliases "aws:kms", "env", and related spellings (see Configuration).
  • AwsKmsProvider accepts endpoint, access_key_id, secret_access_key, builds Aws::KMS::Client internally; key_id: is required (configure via provider_options or pass a custom instance).

Changed

  • Breaking: Global Configuration#chunk_size removed — pass chunk_size into StreamCipher, S3Adapter, EncryptedMultipartUpload, and the ActiveCipherStorage Active Storage service (storage.yml).
  • Breaking: Built-in provider config is provider_options only (removed #aws_kms / #env_provider). AwsKmsProvider no longer reads ENV for KMS settings; set provider_options from your app.
  • Blob metadata: Rescue StandardError only; re-raise in Rails.env.development? so misconfiguration surfaces during development.
  • Engine: Remove global ActiveSupport::LogSubscriber.logger assignment (host apps use Rails.logger / ActiveStorage.logger).
  • Engine: Load ActiveStorage::Service::ActiveCipherStorageService directly from the Rails Active Storage hook.
  • ActiveCipherStorageService: Raise NotImplementedError for path_for when the inner service does not implement it (e.g. S3).

Removed

  • ActiveCipherStorage::KeyRotation and related rotation orchestration.
  • Breaking: Legacy ActiveCipherStorage::Adapters::ActiveStorageService alias and active_cipher_storage/active_storage_integration shim.
  • ActiveCipherStorageService#rekey, BlobMetadata.blobs_for, BlobMetadata.update_after_rotation.
  • Provider methods wrap_data_key and rotate_data_key from Providers::Base, EnvProvider, and AwsKmsProvider. Key or provider changes are left to the application (e.g. AWS KMS, custom jobs).

1.0.3 - 2026-04-25

Changed

  • Update the README with clearer usage guidance and improved readability.

1.0.2 - 2026-04-25

Changed

  • Publish updated RubyGems metadata for Rails Active Storage encryption, Ruby encryption/decryption, S3 streaming, multipart uploads, AES-256-GCM, and AWS KMS discoverability.

1.0.1 - 2026-04-25

Changed

  • Back gem configuration with Rails-style ActiveSupport options while preserving the existing public configuration API.
  • Document the Active Storage upload encryption flag and plaintext read compatibility behavior.
  • Mark plaintext Active Storage uploads explicitly when encryption is disabled.

1.0.0 - 2026-04-25

Added

  • Initial public ActiveCipherStorage gem release.
  • Transparent Rails Active Storage encryption service.
  • Direct S3 encrypted upload, download, streaming, and multipart support.
  • Backend-managed encrypted multipart uploads for frontend chunk upload flows.
  • AES-256-GCM envelope encryption with self-describing payload headers.
  • Environment-variable and AWS KMS providers, plus a custom provider interface.
  • Header-only key rotation for re-wrapping encrypted DEKs.
  • Unit and integration coverage for crypto, providers, Active Storage, S3, multipart upload, streaming, metadata, and key rotation.