crypto2/SECURITY-0.9.5.md

crypto2 0.9.5 security fix

Multikey.Keys.check now counts distinct authorized signer keys. Earlier versions could count repeated copies of one allowed key toward an N-of-M threshold. A serialized SealedBox containing repeated copies of a valid seal could therefore pass threshold authorization without the required distinct signers. Signature verification itself was not forged. Policies built with someOf or allOf, including these thresholds inside nested expressions, were affected.

Upgrade consumers to 0.9.5. Wire formats and public APIs are unchanged. Repeated seals remain readable but cannot supply extra votes. Boolean expression semantics (including intentionally overlapping branches) are unchanged.

Regression coverage includes exhaustive subsets for one through four required keys, duplicate and unauthorized signers, nested policies, and serialized seal repetition with valid distinct-signature controls.

Release qualification: all 64 JVM tests and all 64 Linux x64 native tests pass. The JavaScript/Node suite cannot complete: 61 of 64 tests fail at the existing libsodium loader (_sodium_init is not a function). An unchanged-source signing test reproduces that same failure; this release does not fix the JS loader. All 12 configured publications were uploaded to Maven Local and the private Maven repository; SHA-256 comparison of 53 downloaded release files matched Maven Local.