Prepare 1.3.4 release metadata

Author: eldryoth

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 1.3.4 - 2026-07-03
+
+- Added required `s390x-unknown-linux-gnu` QEMU user-mode evidence for
+  big-endian functional correctness, scalar/fallback runtime reporting,
+  malformed-input behavior, clear-tail behavior, in-place behavior,
+  wrapped/legacy compatibility, and stream behavior.
+- Added stable Rust blocker checks proving `core::arch::s390x` and
+  `core::arch::powerpc64` remain behind unstable `stdarch_*` feature gates on
+  the active release toolchain.
+- Documented that big-endian acceleration is deliberately not admitted in this
+  release; QEMU evidence is fallback/correctness evidence only, not hardware
+  performance, timing, side-channel, or register-retention evidence.
+- Improved the optional PowerPC64 QEMU path with an early glibc sysroot
+  preflight so maintainers get a clear missing-sysroot error instead of a
+  linker dump.
+- Synchronized all workspace crate package versions to `1.3.4`.
+
 ## 1.3.3 - 2026-07-03
 
 - Admitted narrow wasm `simd128` runtime dispatch for Standard and URL-safe

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng"
-version = "1.3.3"
+version = "1.3.4"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"

Cargo.toml

@@ -29,14 +29,15 @@ The crate starts conservative: a small scalar implementation, strict RFC 4648 be
 
 ## Current Status
 
-The current public release is `1.3.3`.
-
-`1.3.3` is a focused wasm SIMD runtime-dispatch and profile-ergonomics patch
-on top of the `1.3.0` implementation-completion release, the `1.3.1` Tokio
-writer patch, and the `1.3.2` non-standard SIMD surface review. It keeps the
-admitted `1.2.x` native encode acceleration posture and the admitted `1.3.0`
-normal strict SIMD decode scope for Standard and URL-safe alphabet families on
-std `x86`/`x86_64` AVX-512 VBMI, AVX2, SSSE3/SSE4.1, and little-endian std
+The current public release is `1.3.4`.
+
+`1.3.4` is a big-endian QEMU evidence and stable-intrinsic-blocker patch on
+top of the `1.3.0` implementation-completion release, the `1.3.1` Tokio
+writer patch, the `1.3.2` non-standard SIMD surface review, and the `1.3.3`
+wasm SIMD runtime-dispatch and profile-ergonomics patch. It keeps the admitted
+`1.2.x` native encode acceleration posture and the admitted `1.3.0` normal
+strict SIMD decode scope for Standard and URL-safe alphabet families on std
+`x86`/`x86_64` AVX-512 VBMI, AVX2, SSSE3/SSE4.1, and little-endian std
 `aarch64` NEON after whole-input scalar validation.
 
 Encode acceleration remains active only for admitted Standard and URL-safe
@@ -51,12 +52,12 @@ and normal strict decode when the binary is compiled with
 `target-feature=+simd128`, the `simd` feature, and the explicit
 `allow-wasm32-best-effort-wipe` feature.
 
-The latest patch in this line is `1.3.3`, which admits narrow wasm `simd128`
-runtime dispatch with Node/V8, Wasmtime, Chromium-family browser,
-Firefox/SpiderMonkey, and Safari/WebKit smoke evidence, keeps the wasm cleanup
-caveat fail-closed by default, and adds
-wrapped-profile helper ergonomics plus stack-staged in-place encode and decode
-dispatch. The workspace crate family stays version-aligned at `1.3.3`.
+The latest patch in this line is `1.3.4`, which adds required
+`s390x-unknown-linux-gnu` QEMU user-mode functional evidence for scalar
+fallback behavior, records that stable Rust still gates `s390x` and
+PowerPC64 vector intrinsics, and documents that big-endian acceleration is not
+admitted until stable intrinsics or a separate assembly-backed review exists.
+The workspace crate family stays version-aligned at `1.3.4`.
 
 Implemented on this branch now:
 
@@ -184,7 +185,7 @@ The active release toolchain is Rust `1.96.1`. MSRV remains Rust `1.90.0` and
 is checked separately in CI so the project can build and test with the latest
 stable compiler without dropping older supported users.
 
-Compatibility evidence for the `1.3.3` workspace:
+Compatibility evidence for the `1.3.4` workspace:
 
 | Rust | Local Evidence |
 | --- | --- |
@@ -201,7 +202,7 @@ Compatibility evidence for the `1.3.3` workspace:
 
 ```toml
 [dependencies]
-base64-ng = "1.3.3"
+base64-ng = "1.3.4"
 ```
 
 The crate is dual-licensed:
@@ -262,8 +263,8 @@ decode directly into `sanitization::LockedSecretBytes` or
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.3.3", default-features = false }
-base64-ng-sanitization = { version = "1.3.3", default-features = false }
+base64-ng = { version = "1.3.4", default-features = false }
+base64-ng-sanitization = { version = "1.3.4", default-features = false }
 ```
 
 ```rust
@@ -282,7 +283,7 @@ assert!(secret.sanitization_verify(
 
 ```toml
 [dependencies]
-base64-ng-sanitization = { version = "1.3.3", features = ["high-assurance"] }
+base64-ng-sanitization = { version = "1.3.4", features = ["high-assurance"] }
 ```
 
 ```rust
@@ -301,8 +302,8 @@ newtypes around fixed byte arrays:
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.3.3", default-features = false }
-base64-ng-derive = "1.3.3"
+base64-ng = { version = "1.3.4", default-features = false }
+base64-ng-derive = "1.3.4"
 ```
 
 ```rust
@@ -321,7 +322,7 @@ assert_eq!(key.encode_base64::<8>().unwrap().as_str(), "aGVsbG8=");
 
 ```toml
 [dependencies]
-base64-ng-serde = "1.3.3"
+base64-ng-serde = "1.3.4"
 serde = { version = "1.0.228", features = ["derive"] }
 ```
 
@@ -340,8 +341,8 @@ Field-level modules are available for `standard`, `standard_no_pad`,
 
 ```toml
 [dependencies]
-base64-ng = "1.3.3"
-base64-ng-bytes = "1.3.3"
+base64-ng = "1.3.4"
+base64-ng-bytes = "1.3.4"
 bytes = "1.12.0"
 ```
 
@@ -358,8 +359,8 @@ projects that already admit `subtle`:
 
 ```toml
 [dependencies]
-base64-ng = "1.3.3"
-base64-ng-subtle = "1.3.3"
+base64-ng = "1.3.4"
+base64-ng-subtle = "1.3.4"
 ```
 
 ```rust
@@ -377,8 +378,8 @@ controlled by a peer:
 
 ```toml
 [dependencies]
-base64-ng = "1.3.3"
-base64-ng-tokio = "1.3.3"
+base64-ng = "1.3.4"
+base64-ng-tokio = "1.3.4"
 tokio = { version = "1.52.3", features = ["io-util"] }
 ```
 
@@ -411,7 +412,7 @@ Disable defaults for embedded or freestanding use:
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.3.3", default-features = false }
+base64-ng = { version = "1.3.4", default-features = false }
 ```
 
 Enable admitted encode acceleration on supported `std` targets with the
@@ -423,7 +424,7 @@ and URL-safe alphabets after whole-input scalar validation:
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.3.3", features = ["simd"] }
+base64-ng = { version = "1.3.4", features = ["simd"] }
 ```
 
 ```rust

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng-bytes"
-version = "1.3.3"
+version = "1.3.4"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"
@@ -23,7 +23,7 @@ default = ["std"]
 std = ["base64-ng/std", "bytes/std"]
 
 [dependencies]
-base64-ng = { version = "1.3.3", path = "../..", default-features = false, features = ["alloc"] }
+base64-ng = { version = "1.3.4", path = "../..", default-features = false, features = ["alloc"] }
 bytes = { version = "1.12.0", default-features = false }
 
 [lints.rust]

crates/base64-ng-bytes/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng-derive"
-version = "1.3.3"
+version = "1.3.4"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"
@@ -27,7 +27,7 @@ default = []
 [dependencies]
 
 [dev-dependencies]
-base64-ng = { version = "1.3.3", path = "../..", default-features = false }
+base64-ng = { version = "1.3.4", path = "../..", default-features = false }
 
 [lints.rust]
 unsafe_code = "deny"

crates/base64-ng-derive/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng-sanitization"
-version = "1.3.3"
+version = "1.3.4"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"
@@ -31,7 +31,7 @@ strict-ct = ["sanitization/strict-ct"]
 wasm-compat = ["sanitization/wasm-compat"]
 
 [dependencies]
-base64-ng = { version = "1.3.3", path = "../..", default-features = false }
+base64-ng = { version = "1.3.4", path = "../..", default-features = false }
 sanitization = { version = "=1.2.2", default-features = false }
 
 [lints.rust]

crates/base64-ng-sanitization/Cargo.toml

@@ -8,8 +8,8 @@ constant-time-oriented Base64 decode into clear-on-drop secret containers.
 
 ```toml
 [dependencies]
-base64-ng = { version = "1.3.3", default-features = false }
-base64-ng-sanitization = { version = "1.3.3", default-features = false }
+base64-ng = { version = "1.3.4", default-features = false }
+base64-ng-sanitization = { version = "1.3.4", default-features = false }
 ```
 
 ```rust
@@ -29,15 +29,15 @@ assert!(secret.sanitization_verify(
 Enable `alloc` for heap-backed `sanitization::SecretVec` helpers:
 
 ```toml
-base64-ng-sanitization = { version = "1.3.3", features = ["alloc"] }
+base64-ng-sanitization = { version = "1.3.4", features = ["alloc"] }
 ```
 
 For high-assurance native deployments, enable locked storage helpers. This
 uses `sanitization` 1.2.2's `memory-lock`, `canary-check`, and
 `random-canary` features and decodes directly into locked memory:
 
 ```toml
-base64-ng-sanitization = { version = "1.3.3", features = ["high-assurance"] }
+base64-ng-sanitization = { version = "1.3.4", features = ["high-assurance"] }
 ```
 
 ```rust
@@ -90,5 +90,5 @@ For deployments that want `sanitization`'s assembly-backed comparison checks,
 enable the passthrough features:
 
 ```toml
-base64-ng-sanitization = { version = "1.3.3", features = ["strict-ct"] }
+base64-ng-sanitization = { version = "1.3.4", features = ["strict-ct"] }
 ```

crates/base64-ng-sanitization/README.md

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng-serde"
-version = "1.3.3"
+version = "1.3.4"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"
@@ -24,7 +24,7 @@ alloc = ["base64-ng/alloc", "serde/alloc"]
 std = ["alloc", "base64-ng/std", "serde/std"]
 
 [dependencies]
-base64-ng = { version = "1.3.3", path = "../..", default-features = false }
+base64-ng = { version = "1.3.4", path = "../..", default-features = false }
 serde = { version = "1.0.228", default-features = false }
 
 [dev-dependencies]

crates/base64-ng-serde/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "base64-ng-subtle"
-version = "1.3.3"
+version = "1.3.4"
 edition = "2024"
 rust-version = "1.90"
 license = "MIT OR Apache-2.0"
@@ -24,7 +24,7 @@ alloc = ["base64-ng/alloc"]
 std = ["alloc", "base64-ng/std", "subtle/std"]
 
 [dependencies]
-base64-ng = { version = "1.3.3", path = "../..", default-features = false }
+base64-ng = { version = "1.3.4", path = "../..", default-features = false }
 subtle = { version = "2.6.1", default-features = false }
 
 [lints.rust]