diff --git a/AUDIT.md b/AUDIT.md index 70ab270..3a0f78f 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -56,8 +56,9 @@ and LFS pointers; textual assembly is a permitted source type. Archive inspection must also fail closed at bounded recursion depth, member count, individual expanded size, and total expanded size so a nested archive or decompression bomb cannot turn the release scanner into an unbounded resource -consumer. This hardening and its adversarial fixtures are release-blocking and -remain `PENDING` until rerun on the exact candidate. +consumer. On committed Linux candidate `ff99770`, this hardening and its +adversarial fixtures passed all 39 source-only scanner cases, including GNU +thin-archive and safe-diagnostic-path cases. An unknown `.bin` fails by default. A necessary binary data fixture can be declared only through `--data-manifest`, with four tab-separated fields for @@ -98,15 +99,32 @@ Relevant review layers include: | Source reproducibility | two `make dist` runs with identical committed input and epoch | Requires equal SHA-256 digests and clean archive scans | | Installed package | target-native package inspection and `scripts/test-installed-zupt.sh` | Applies only to the exact OS/release/architecture tested | -This table identifies evidence, not results. The release validation report and -`packaging/opensuse/README.md` record `PASS`, `FAIL`, or `SKIP` for each actual -run. Missing tools, OBS access, other architectures, Leap, and SLE must not be -reported as passing without evidence. +This table identifies evidence layers rather than results. Missing tools, OBS +access, other architectures, Leap, and SLE must not be reported as passing +without evidence. -The 5.2.2 key-file, terminal-comment, password-prompt, explicit-Bash regression, -and scanner-resource-limit changes were added during the final self-audit. All -affected checks and the complete required suite must be rerun after they land; -no earlier result is a final-candidate `PASS`. +## Committed-candidate local Linux evidence + +The following upstream self-audit results apply to commit `ff99770` on the +recorded local Linux environments. They are not an independent certification, +a result for later commits, or evidence that release assets have been published. + +| Gate | Result | Recorded evidence | +|---|---|---| +| Full project gate | PASS | `make release-check` completed successfully on `ff99770`, including the late key-file, terminal-comment, password-prompt, explicit-Bash, and scanner-limit regressions. | +| Packaging policy/syntax | PASS | `PASS=49 FAIL=0 SKIP=0`. | +| Source-only scanner adversarial suite | PASS | 39/39, including GNU thin archives, bounded archive expansion, and safe diagnostic cases. | +| Strict compilers and compiler analyzer | PASS | GCC and Clang strict builds passed; GCC `-fanalyzer` passed. | +| Static-analysis suite | PASS | 9/9 in the full tool-enabled run. A separate reduced-environment `release-check` run completed six available checks and reported `cppcheck` unavailable; unavailable tooling was not relabelled as a pass. | +| Dynamic analysis | PASS | ASan, UBSan, and LSan runs passed. | +| Mutation fuzzing | PASS | 1,000 mutation iterations completed without a sanitizer-detected crash. | + +An earlier off-screen GUI smoke run remains supporting evidence, but is not +represented as an exact-`ff99770` GUI-package result. Native Windows and macOS +gates, hosted GitHub CI and release promotion, authenticated OBS validation, +and resolution of the openSUSE automatic `debugsource` rpmlint `no-binary` +finding remain pending. The immutable tag and its final artifacts must not be +described as released until those applicable gates complete. ## Cryptographic review boundary diff --git a/CHANGELOG.md b/CHANGELOG.md index 7813229..06e3c19 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -133,7 +133,7 @@ path; older readers are not claimed to accept every archive written by 5.2.2. stored as hexadecimal text with its source tag/commit, password, input hash, and archive hash. The 5.2.2 candidate lists, tests, extracts, and restores it byte-exact; the legacy index has no whole-image hash and produces an explicit warning. - The exact final candidate must repeat this gate, and no broader historical + The full local Linux gate passed on commit `ff99770`; no broader historical compatibility claim is made. - Serialize fixed-width archive/header, footer, index and PBKDF iteration fields explicitly in little-endian order. Varint readers now reject overlong @@ -234,16 +234,20 @@ path; older readers are not claimed to accept every archive written by 5.2.2. - Updated the README, installation, distribution, security, audit, GUI, and manual-page documentation for the 5.2.2 source-only workflow. -Validation results are recorded by the release process and the openSUSE -packaging README. A missing tool or unexecuted platform remains `SKIP`; this -entry does not claim successful OBS, architecture, Leap, or SLE builds without -corresponding evidence. Runs made before the final positional-AAD and -mandatory-AIT changes are intermediate diagnostic evidence, not final release -gates. Private-key creation/parsing, terminal-safe comment rendering, prompt -signal cleanup, explicit-Bash regression execution, and scanner bomb limits are -also final self-audit release blockers. Their focused checks and the complete -required suite remain `PENDING` until the exact candidate is rerun before -tagging; this entry does not claim a final `PASS`. +The committed Linux candidate `ff99770` passed the full local +`make release-check`. Recorded results include packaging +`PASS=49 FAIL=0 SKIP=0`; 39/39 source-only scanner cases, including GNU thin +archives and safe diagnostics; strict GCC and Clang; GCC `-fanalyzer`; 9/9 in +the full tool-enabled static-analysis run; ASan/UBSan/LSan; and 1,000 +mutation-fuzz iterations without a sanitizer-detected crash. An earlier +off-screen GUI smoke run remains supporting rather than exact-candidate package +evidence. + +These are upstream self-audit results, not independent certification or a +published-release claim. Native Windows and macOS, hosted GitHub CI and release +promotion, authenticated OBS, and the openSUSE automatic `debugsource` rpmlint +`no-binary` finding remain pending. Missing or unexecuted gates remain `SKIP`, +not `PASS`. ## [5.2.1] — 2026-07-12 — GUI Verify/Extract robustness; refreshed comparison + audit tables diff --git a/README.md b/README.md index e834ad1..0b6b263 100644 --- a/README.md +++ b/README.md @@ -164,8 +164,9 @@ allowed only with `--data-manifest FILE`; each tab-separated record must name its path, purpose, provenance, and SPDX license. This exception never permits compiled or executable magic, packages, AppImages, bytecode, or Git LFS pointers. Nested scans cap recursion, member count, individual expansion, and -total expanded bytes and fail closed at a limit. The exact candidate must rerun -the scanner-bomb fixtures before any release result is marked `PASS`. +total expanded bytes and fail closed at a limit. On committed Linux candidate +`ff99770`, all 39 source-only scanner cases passed, including GNU thin archives, +scanner-bomb limits, and safe diagnostic cases. ## Build from source @@ -282,16 +283,19 @@ devices are accepted only when their capacity can be determined and is large enough. The privileged undersized-loop-device regression is reported `SKIP`, not `PASS`, when the environment cannot create a loop device. -The final release gate must also rerun the positional-AAD and mandatory-AIT -regressions on the exact tagged candidate. Results obtained before those final -integrity changes are useful diagnostic evidence, but are not promoted as final -release results. The openSUSE matrix records unexecuted gates as `SKIP`. +The committed Linux candidate `ff99770` passed the full local +`make release-check`. Recorded results include packaging +`PASS=49 FAIL=0 SKIP=0`, the 39/39 source-only scanner suite, strict GCC and +Clang, GCC `-fanalyzer`, a 9/9 full tool-enabled static-analysis run, +ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations without a +sanitizer-detected crash. An earlier off-screen GUI smoke run remains supporting +evidence rather than an exact-candidate package result. -Private-key creation/parsing, terminal-safe comment display, POSIX prompt signal -cleanup, explicit-Bash regression execution, and scanner-resource-limit changes -are final self-audit release blockers. Their focused regressions and the full -required suite remain pending until rerun on the exact candidate; this README -does not convert intermediate results into a final `PASS`. +These are upstream local self-audit results, not independent certification or a +published-release claim. Native Windows and macOS, hosted GitHub CI/release +promotion, authenticated OBS, and resolution of the openSUSE automatic +`debugsource` rpmlint `no-binary` finding remain pending. Unexecuted gates are +`SKIP`, never `PASS`. On Windows, 5.2.2 scopes output handling to normal local Win32 paths. A MinGW cross-build or Wine run is not native-Windows evidence; the `windows-latest` @@ -329,8 +333,8 @@ compatibility scope includes an actual v5.2.1 password-encrypted, deduplicated disk archive with a DATA/DATA/REF/DATA sequence using the fixed-width legacy index and the legacy linear AAD sequence. The repository stores that 718-byte archive as auditable hexadecimal text with its provenance and SHA-256; the candidate -lists, tests, extracts, and restores it byte-exact. The exact final candidate must repeat -the gate. This is not a claim that a 5.2.1 reader understands every new +lists, tests, extracts, and restores it byte-exact. The full local Linux gate +passed on commit `ff99770`. This is not a claim that a 5.2.1 reader understands every new flag-gated 5.2.2 encoding or that every historical combination was tested. The candidate commands and outcome fields for 5.2.2 are maintained in the diff --git a/SECURITY.md b/SECURITY.md index ff0d9a3..694ab29 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -48,7 +48,7 @@ password read; do not reuse it as a multi-record protocol channel. On POSIX terminals, the explicit prompt saves terminal state and installs signal-aware cleanup so a handled interruption restores echo and other changed settings before termination. This behavior is covered by a PTY regression and -must be rerun on the exact release candidate. +passed in the full local Linux gate for commit `ff99770`. ## Native key files @@ -225,7 +225,7 @@ gate was rerun on every platform: whole-image content hash. Its regression fixture is an actual v5.2.1 password-encrypted DATA/DATA/REF/DATA disk archive stored as hexadecimal text with source and hash provenance. The candidate lists, tests, extracts, and restores it - byte-exact; the exact final candidate must repeat that gate. This does not + byte-exact; the full local Linux gate passed on commit `ff99770`. This does not claim that 5.2.1 readers accept the new flag-gated 5.2.2 records or that every historical encrypted+dedup combination was validated. @@ -245,8 +245,8 @@ scripts/check-source-only.sh --archive /path/to/zupt-5.2.2.tar.gz Nested archive inspection is required to enforce bounded recursion, member count, per-entry expanded size, and total expanded size, and to fail closed on -limit violations. The resource-limit regressions and all other late self-audit -fixes remain pending until the exact candidate completes the final gate suite. +limit violations. On commit `ff99770`, the source-only scanner suite passed +39/39, including GNU thin archives, resource-limit cases, and safe diagnostics. DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI ZIP, Windows ZIP, and macOS DMG release assets are separate outputs. An @@ -285,16 +285,18 @@ make test-asan-run The first command builds the sanitizer configuration; the second executes its test suite. Neither substitutes for the normal optimized build and tests. -Because the positional-AAD and mandatory-AIT behavior changed late in the -candidate, earlier successful runs are intermediate evidence only. The exact -release candidate must rerun the affected regressions and the complete required -suite; unavailable environments remain `SKIP`, not `PASS`. +The full local Linux `make release-check` passed on committed candidate +`ff99770`. Its recorded evidence includes packaging `PASS=49 FAIL=0 SKIP=0`, +the 39/39 source-only scanner suite, strict GCC and Clang builds, GCC +`-fanalyzer`, 9/9 static analysis in a tool-enabled run, ASan/UBSan/LSan, and +1,000 mutation-fuzz iterations without a sanitizer-detected crash. An earlier +off-screen GUI smoke run is supporting evidence, not an exact-candidate package +result. -The same rule applies to private-key creation/parsing, terminal-safe comment -display, POSIX prompt signal cleanup, explicit Bash regression execution, and -source-scanner resource limits added during the final self-audit. This document -records intended candidate behavior, not a final `PASS` for work still being -integrated or rerun. +These are upstream self-audit results, not independent certification. Native +Windows and macOS, hosted GitHub CI/release promotion, authenticated OBS, and +the openSUSE automatic `debugsource` rpmlint `no-binary` finding remain pending. +An unavailable or unexecuted environment remains `SKIP`, never `PASS`. Run target-native static analyzers and package checks as additional evidence. Do not infer x86_64, aarch64, ppc64le, s390x, riscv64, macOS, Windows, Leap, or diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md index 8109d26..2fb6832 100644 --- a/THREAT_MODEL.md +++ b/THREAT_MODEL.md @@ -240,9 +240,9 @@ LFS pointers. Nested inspection is itself an untrusted-input boundary. The release scanner must cap recursion depth, archive members, per-entry expansion, and total -expanded bytes and fail closed when a cap is reached. Scanner bomb regressions -and all other late self-audit fixes are pending until rerun on the exact -candidate. +expanded bytes and fail closed when a cap is reached. Commit `ff99770` passed +all 39 source-only scanner cases, including GNU thin archives, scanner-bomb +limits, and safe diagnostic cases. DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI ZIP, Windows ZIP, and macOS DMG files can be published separately from the @@ -259,6 +259,15 @@ after source scans and an exact safe-member check. AppDir and Flatpak bundles and GUI platform installers remain excluded; Windows ZIP and macOS DMG outputs remain CLI-only. +The committed Linux candidate `ff99770` passed the full local +`make release-check`: packaging reported `PASS=49 FAIL=0 SKIP=0`; strict GCC, +strict Clang, GCC `-fanalyzer`, the 9/9 tool-enabled static-analysis run, +ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations passed. Earlier off-screen +GUI smoke evidence is retained separately. This upstream self-review is not an +independent certification, and native Windows/macOS, hosted GitHub CI and +release promotion, authenticated OBS, and the openSUSE automatic `debugsource` +rpmlint `no-binary` finding remain pending. + ## Historical compatibility notes These are historical facts about earlier releases, retained to support recovery: @@ -279,7 +288,7 @@ These are historical facts about earlier releases, retained to support recovery: v5.2.1 password-encrypted DATA/DATA/REF/DATA disk fixture is stored as hexadecimal text with source and hash provenance. The candidate lists, tests, extracts, and restores it byte-exact, with a warning that the legacy index has no whole-image hash; - the exact final candidate must repeat that gate. Older readers are not + the full local Linux gate passed on commit `ff99770`. Older readers are not claimed to accept new flag-gated 5.2.2 records, and untested historical mode combinations remain unclaimed. diff --git a/packaging/opensuse/README.md b/packaging/opensuse/README.md index 483dd16..7525922 100644 --- a/packaging/opensuse/README.md +++ b/packaging/opensuse/README.md @@ -97,8 +97,8 @@ immutable v5.2.1 tag is stored as hexadecimal text with its source and SHA-256 provenance. The 5.2.2 reader reconstructs the legacy linear block-AAD sequence, lists, tests, extracts, and restores its input byte-exact through the fixed-width legacy disk-index parser. This does not cover every historical mode -and must be rerun on the final candidate before it is promoted as a release -gate. +and passed in the full local Linux gate for commit `ff99770`; the target RPM +`%check` must still exercise it before that package is promoted. Disk restore also snapshots the measured archive into a private scratch file before opening the destination, then validates and restores from that same @@ -153,7 +153,23 @@ install it in a disposable openSUSE environment and execute `scripts/test-installed-zupt.sh`. Do not claim a repository or architecture as supported until its build and installed smoke test have actually passed. -## Validation matrix for this handoff +## Committed-candidate local Linux validation + +Commit `ff99770` passed the full local `make release-check`. Packaging policy +and syntax reported `PASS=49 FAIL=0 SKIP=0`; source-only scanner testing passed +39/39, including GNU thin archives and safe diagnostic cases; strict GCC, +strict Clang, GCC `-fanalyzer`, the 9/9 full tool-enabled static-analysis run, +ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations passed. A reduced +environment completed six available static checks and reported `cppcheck` +unavailable rather than passing it. Earlier off-screen GUI smoke evidence is +supporting evidence, not an exact-commit package result. + +These local upstream results do not establish native Windows or macOS success, +hosted GitHub CI/release promotion, authenticated OBS acceptance, or resolution +of the automatic openSUSE `debugsource` rpmlint `no-binary` finding. Those gates +remain pending. + +## Prior openSUSE packaging validation The local results below were produced on 2026-08-24 from the 5.2.2 candidate snapshot captured for the packaging run, in a disposable openSUSE Tumbleweed