Release Pithos 0.8 with format 1.1

[St4NNi]

Description

Prepares the 0.8 release. It contains the hardened 1.0 specification and reader from #36 and adds format 1.1. Version 1.1 keeps every 1.0 structure: this release reads 1.0 and 1.1 archives, writes new archives as 1.1, and appends to an archive with the rules of its own version. It also reads archives written by Pithos 0.7.0 and 0.7.3, but does not append to them.

Changes

• Format 1.1 header version 0x0101; readers accept 0x0100 and 0x0101.
• Recipient grant keys are derived with HKDF-SHA256 from the X25519 shared secret, the grant nonce and both public keys.
• A file's block list can be sealed in independent pieces (BlockDataState tag 02). PieceEncoder encodes one part; compose joins parts without opening a key and reports the BLAKE3 content hash when the part offsets line up.
• A metadata digest covers all directories and is checked on open when the caller passes it.
• Optional unique random block keys without deduplication (flag 0x10) and AES-256-GCM block payloads (flag 0x20).
• Fixed 4 MiB blocks by default; FastCDC stays available through Chunking::ContentDefined and --cdc, and PieceEncoder::with_chunking cuts pieces with FastCDC. The spec presents both methods as equal.
• Read-only support for Pithos 0.7 archives (spec Appendix C): the PITH 80 02 header, the 0.7.0 directory checksum, the 0.7 relationship names, full POSIX modes, sizes of directories and symlinks, and repeated grants of one sender. Appends and grants to such archives are refused.
• Default open limits admit objects up to 5 TiB.
• Reader without built-in I/O: ArchiveOpener, ArchiveView and lazy ReadPlan with batched reads. Archive::open no longer reads block markers.
• Async API behind the async feature: AsyncArchive with read_range and the owned read_range_owned, limits on requests and buffered bytes, cancellation on drop, and a BlockingHook for CPU work.
• Secret buffers are wiped when they grow.
• RO-Crate and Crypt4GH adapters are behind the default features ro-crate and crypt4gh.
• CLI: --cipher, --unique-keys and --block-size; read list shows the format version and each file's block-list form.
• The spec is now spec/PITHOS_1.1.0_draft.md with new conformance vectors. The minimum Rust version is 1.89.
• CI: the compile-fail test runs only on Rust 1.89, and the jobs tests and deny carry the names the main ruleset requires.
• Raw X25519 key import and export (PublicKey::from_raw, PublicKey::as_bytes, PrivateKey::from_raw).
• ArchiveView::replace_grants gives an archive new reader grants without re-encoding its blocks, for key rotation.
• Secret and plaintext buffers are wiped on drop, on cancellation and on error paths, including the AEAD cipher keys; zstd's own allocations are documented as not wiped.
• Fixed and content-defined chunking stop reading at the end of input; manifests can be ingested again; piece records validate their keys; chacha20 is updated to 0.10.2.
• CI runs the ignored 5 TiB block-count test in release mode. The library builds only on Linux, as documented.

[codecov]

Codecov Report

❌ Patch coverage is 89.49678% with 718 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.48%. Comparing base (2c27a51) to head (6491570).

Files with missing lines	Patch %	Lines
crates/pithos_lib/src/adapters/ro_crate.rs	72.45%	284 Missing ⚠️
crates/pithos/src/main.rs	80.34%	114 Missing ⚠️
crates/pithos_lib/src/adapters/crypt4gh.rs	83.22%	81 Missing ⚠️
crates/pithos_lib/src/archive/reader.rs	93.55%	36 Missing ⚠️
crates/pithos/src/io/utils.rs	61.95%	35 Missing ⚠️
crates/pithos_lib/src/archive/path_validation.rs	95.03%	32 Missing ⚠️
crates/pithos_lib/src/archive/index.rs	90.39%	29 Missing ⚠️
crates/pithos_lib/src/archive/validation.rs	92.97%	22 Missing ⚠️
crates/pithos_lib/src/archive/pieces.rs	97.17%	18 Missing ⚠️
crates/pithos_lib/src/archive/types.rs	89.28%	18 Missing ⚠️
... and 8 more

Additional details and impacted files

@@             Coverage Diff             @@
##             main      #37       +/-   ##
===========================================
+ Coverage   76.60%   89.48%   +12.88%     
===========================================
  Files          19       34       +15     
  Lines        4154    12902     +8748     
===========================================
+ Hits         3182    11545     +8363     
- Misses        972     1357      +385     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.