cristiancmoises/zupt
Watch
1
0
Fork
You've already forked zupt
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 3

release: correct ZUPT 5.2.3 integration

Browse source
This commit is contained in:
Cristian Cezar Moisés 2026-08-31 15:33:17 -03:00
commit 09dc804b3e
31 changed files with 336 additions and 187 deletions
Download patch file Download diff file Expand all files Collapse all files

39
AUDIT.md
View file

@ -1,12 +1,12 @@
<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
# ZUPT 5.2.2 audit guide and finding history
# ZUPT 5.2.3 audit guide and finding history
This document describes review surfaces and reproducible checks. It is an
upstream self-review, not an independent audit, certification, or guarantee.
`SECURITY.md` defines reporting policy and `THREAT_MODEL.md` defines the
security boundary.
## 5.2.2 scope
## 5.2.3 scope
The baseline scope is the source-only CLI and its bundled source codec:
@ -28,8 +28,9 @@ output.
## Source-only review
Release 5.2.2 removes incomplete SDK/PQBOX header snapshots and build
expectations for a local precompiled library. Git and new upstream source
The 5.2.3 baseline retains the source-only boundary introduced in 5.2.2, which
removed incomplete SDK/PQBOX header snapshots and local precompiled-library
expectations. Git and new upstream source
archives are intended to contain no compiled executable, object, shared/static
library, distribution package, unsafe symlink, or unresolved Git LFS pointer.
@ -41,10 +42,10 @@ scripts/check-source-only.sh
# committed Git tree or immutable tag
scripts/check-source-only.sh --tag HEAD
scripts/check-source-only.sh --tag v5.2.2
scripts/check-source-only.sh --tag v5.2.3
# generated source archive
scripts/check-source-only.sh --archive /path/to/zupt-5.2.2.tar.gz
scripts/check-source-only.sh --archive /path/to/zupt-5.2.3.tar.gz
```
The scanner checks extensions and magic bytes, nested archives, symlink targets,
@ -103,11 +104,13 @@ This table identifies evidence layers rather than results. Missing tools, OBS
access, other architectures, Leap, and SLE must not be reported as passing
without evidence.
## Committed-candidate local Linux evidence
## Prior 5.2.2 committed-candidate local Linux evidence
The following upstream self-audit results apply to commit `ff99770` on the
recorded local Linux environments. They are not an independent certification,
a result for later commits, or evidence that release assets have been published.
The following upstream self-audit results apply only to the 5.2.2 candidate at
commit `ff99770` on the recorded local Linux environments. The immutable 5.2.2
tag was not promoted after post-tag CI integration failures. These results are
not independent certification, a 5.2.3 result, or evidence that release assets
were published.
| Gate | Result | Recorded evidence |
|---|---|---|
@ -120,11 +123,11 @@ a result for later commits, or evidence that release assets have been published.
| Mutation fuzzing | PASS | 1,000 mutation iterations completed without a sanitizer-detected crash. |
An earlier off-screen GUI smoke run remains supporting evidence, but is not
represented as an exact-`ff99770` GUI-package result. Native Windows and macOS
gates, hosted GitHub CI and release promotion, authenticated OBS validation,
and resolution of the openSUSE automatic `debugsource` rpmlint `no-binary`
finding remain pending. The immutable tag and its final artifacts must not be
described as released until those applicable gates complete.
represented as an exact-`ff99770` GUI-package result. The exact 5.2.3 candidate
must repeat the required suite. Native Windows and macOS gates, hosted GitHub CI
and release promotion, authenticated OBS validation, and resolution of the
openSUSE automatic `debugsource` rpmlint `no-binary` finding remain pending
until recorded otherwise.
## Cryptographic review boundary
@ -143,7 +146,7 @@ AES implementation has documented cache-timing risk on hostile shared hardware.
The following entries are retained as release history. Their regression tests
should be rerun, but the historical resolution does not itself constitute a
5.2.2 test result.
5.2.3 test result.
| First corrected | Severity | Finding | Resolution recorded at the time |
|---|---|---|---|
@ -184,12 +187,12 @@ include SHA-256 checksums. The gated GUI set adds the architecture-independent
DEB, noarch/source RPM, and source-only portable GUI ZIP. Package gates include
exact payload/dependency and installed off-screen integration checks; the
portable ZIP additionally receives source scans, an exact safe-member allowlist,
and an extracted launcher test. An AppImage is not promoted by the 5.2.2
and an extracted launcher test. An AppImage is not promoted by the 5.2.3
policy; AppDir and Flatpak bundles, GUI platform installers, and bare
Linux/Windows executables are also excluded. Windows ZIP and macOS DMG outputs
remain CLI-only.
No Wine result is retained as release evidence for 5.2.2. Cross-compilation
No Wine result is retained as release evidence for 5.2.3. Cross-compilation
does not establish native-Windows behavior. Extended-length/device namespace
paths, raw UNC output roots, and mapped/network-drive output are unsupported;
the native Windows workflow remains a publication gate for the ZIP containing