docs: record 5.2.2 release audit results
This commit is contained in:
Cristian Cezar Moisés
parent
ff99770bd0
commit
0a9a63db66
6 changed files with 108 additions and 55 deletions
38
AUDIT.md
38
AUDIT.md
|
|
@ -56,8 +56,9 @@ and LFS pointers; textual assembly is a permitted source type.
|
|||
Archive inspection must also fail closed at bounded recursion depth, member
|
||||
count, individual expanded size, and total expanded size so a nested archive or
|
||||
decompression bomb cannot turn the release scanner into an unbounded resource
|
||||
consumer. This hardening and its adversarial fixtures are release-blocking and
|
||||
remain `PENDING` until rerun on the exact candidate.
|
||||
consumer. On committed Linux candidate `ff99770`, this hardening and its
|
||||
adversarial fixtures passed all 39 source-only scanner cases, including GNU
|
||||
thin-archive and safe-diagnostic-path cases.
|
||||
|
||||
An unknown `.bin` fails by default. A necessary binary data fixture can be
|
||||
declared only through `--data-manifest`, with four tab-separated fields for
|
||||
|
|
@ -98,15 +99,32 @@ Relevant review layers include:
|
|||
| Source reproducibility | two `make dist` runs with identical committed input and epoch | Requires equal SHA-256 digests and clean archive scans |
|
||||
| Installed package | target-native package inspection and `scripts/test-installed-zupt.sh` | Applies only to the exact OS/release/architecture tested |
|
||||
|
||||
This table identifies evidence, not results. The release validation report and
|
||||
`packaging/opensuse/README.md` record `PASS`, `FAIL`, or `SKIP` for each actual
|
||||
run. Missing tools, OBS access, other architectures, Leap, and SLE must not be
|
||||
reported as passing without evidence.
|
||||
This table identifies evidence layers rather than results. Missing tools, OBS
|
||||
access, other architectures, Leap, and SLE must not be reported as passing
|
||||
without evidence.
|
||||
|
||||
The 5.2.2 key-file, terminal-comment, password-prompt, explicit-Bash regression,
|
||||
and scanner-resource-limit changes were added during the final self-audit. All
|
||||
affected checks and the complete required suite must be rerun after they land;
|
||||
no earlier result is a final-candidate `PASS`.
|
||||
## Committed-candidate local Linux evidence
|
||||
|
||||
The following upstream self-audit results apply to commit `ff99770` on the
|
||||
recorded local Linux environments. They are not an independent certification,
|
||||
a result for later commits, or evidence that release assets have been published.
|
||||
|
||||
| Gate | Result | Recorded evidence |
|
||||
|---|---|---|
|
||||
| Full project gate | PASS | `make release-check` completed successfully on `ff99770`, including the late key-file, terminal-comment, password-prompt, explicit-Bash, and scanner-limit regressions. |
|
||||
| Packaging policy/syntax | PASS | `PASS=49 FAIL=0 SKIP=0`. |
|
||||
| Source-only scanner adversarial suite | PASS | 39/39, including GNU thin archives, bounded archive expansion, and safe diagnostic cases. |
|
||||
| Strict compilers and compiler analyzer | PASS | GCC and Clang strict builds passed; GCC `-fanalyzer` passed. |
|
||||
| Static-analysis suite | PASS | 9/9 in the full tool-enabled run. A separate reduced-environment `release-check` run completed six available checks and reported `cppcheck` unavailable; unavailable tooling was not relabelled as a pass. |
|
||||
| Dynamic analysis | PASS | ASan, UBSan, and LSan runs passed. |
|
||||
| Mutation fuzzing | PASS | 1,000 mutation iterations completed without a sanitizer-detected crash. |
|
||||
|
||||
An earlier off-screen GUI smoke run remains supporting evidence, but is not
|
||||
represented as an exact-`ff99770` GUI-package result. Native Windows and macOS
|
||||
gates, hosted GitHub CI and release promotion, authenticated OBS validation,
|
||||
and resolution of the openSUSE automatic `debugsource` rpmlint `no-binary`
|
||||
finding remain pending. The immutable tag and its final artifacts must not be
|
||||
described as released until those applicable gates complete.
|
||||
|
||||
## Cryptographic review boundary
|
||||
|
||||
|
|
|
|||
26
CHANGELOG.md
26
CHANGELOG.md
|
|
@ -133,7 +133,7 @@ path; older readers are not claimed to accept every archive written by 5.2.2.
|
|||
stored as hexadecimal text with its source tag/commit, password, input hash,
|
||||
and archive hash. The 5.2.2 candidate lists, tests, extracts, and restores it byte-exact;
|
||||
the legacy index has no whole-image hash and produces an explicit warning.
|
||||
The exact final candidate must repeat this gate, and no broader historical
|
||||
The full local Linux gate passed on commit `ff99770`; no broader historical
|
||||
compatibility claim is made.
|
||||
- Serialize fixed-width archive/header, footer, index and PBKDF iteration
|
||||
fields explicitly in little-endian order. Varint readers now reject overlong
|
||||
|
|
@ -234,16 +234,20 @@ path; older readers are not claimed to accept every archive written by 5.2.2.
|
|||
- Updated the README, installation, distribution, security, audit, GUI, and
|
||||
manual-page documentation for the 5.2.2 source-only workflow.
|
||||
|
||||
Validation results are recorded by the release process and the openSUSE
|
||||
packaging README. A missing tool or unexecuted platform remains `SKIP`; this
|
||||
entry does not claim successful OBS, architecture, Leap, or SLE builds without
|
||||
corresponding evidence. Runs made before the final positional-AAD and
|
||||
mandatory-AIT changes are intermediate diagnostic evidence, not final release
|
||||
gates. Private-key creation/parsing, terminal-safe comment rendering, prompt
|
||||
signal cleanup, explicit-Bash regression execution, and scanner bomb limits are
|
||||
also final self-audit release blockers. Their focused checks and the complete
|
||||
required suite remain `PENDING` until the exact candidate is rerun before
|
||||
tagging; this entry does not claim a final `PASS`.
|
||||
The committed Linux candidate `ff99770` passed the full local
|
||||
`make release-check`. Recorded results include packaging
|
||||
`PASS=49 FAIL=0 SKIP=0`; 39/39 source-only scanner cases, including GNU thin
|
||||
archives and safe diagnostics; strict GCC and Clang; GCC `-fanalyzer`; 9/9 in
|
||||
the full tool-enabled static-analysis run; ASan/UBSan/LSan; and 1,000
|
||||
mutation-fuzz iterations without a sanitizer-detected crash. An earlier
|
||||
off-screen GUI smoke run remains supporting rather than exact-candidate package
|
||||
evidence.
|
||||
|
||||
These are upstream self-audit results, not independent certification or a
|
||||
published-release claim. Native Windows and macOS, hosted GitHub CI and release
|
||||
promotion, authenticated OBS, and the openSUSE automatic `debugsource` rpmlint
|
||||
`no-binary` finding remain pending. Missing or unexecuted gates remain `SKIP`,
|
||||
not `PASS`.
|
||||
|
||||
|
||||
## [5.2.1] — 2026-07-12 — GUI Verify/Extract robustness; refreshed comparison + audit tables
|
||||
|
|
|
|||
30
README.md
30
README.md
|
|
@ -164,8 +164,9 @@ allowed only with `--data-manifest FILE`; each tab-separated record must name
|
|||
its path, purpose, provenance, and SPDX license. This exception never permits
|
||||
compiled or executable magic, packages, AppImages, bytecode, or Git LFS
|
||||
pointers. Nested scans cap recursion, member count, individual expansion, and
|
||||
total expanded bytes and fail closed at a limit. The exact candidate must rerun
|
||||
the scanner-bomb fixtures before any release result is marked `PASS`.
|
||||
total expanded bytes and fail closed at a limit. On committed Linux candidate
|
||||
`ff99770`, all 39 source-only scanner cases passed, including GNU thin archives,
|
||||
scanner-bomb limits, and safe diagnostic cases.
|
||||
|
||||
## Build from source
|
||||
|
||||
|
|
@ -282,16 +283,19 @@ devices are accepted only when their capacity can be determined and is large
|
|||
enough. The privileged undersized-loop-device regression is reported `SKIP`,
|
||||
not `PASS`, when the environment cannot create a loop device.
|
||||
|
||||
The final release gate must also rerun the positional-AAD and mandatory-AIT
|
||||
regressions on the exact tagged candidate. Results obtained before those final
|
||||
integrity changes are useful diagnostic evidence, but are not promoted as final
|
||||
release results. The openSUSE matrix records unexecuted gates as `SKIP`.
|
||||
The committed Linux candidate `ff99770` passed the full local
|
||||
`make release-check`. Recorded results include packaging
|
||||
`PASS=49 FAIL=0 SKIP=0`, the 39/39 source-only scanner suite, strict GCC and
|
||||
Clang, GCC `-fanalyzer`, a 9/9 full tool-enabled static-analysis run,
|
||||
ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations without a
|
||||
sanitizer-detected crash. An earlier off-screen GUI smoke run remains supporting
|
||||
evidence rather than an exact-candidate package result.
|
||||
|
||||
Private-key creation/parsing, terminal-safe comment display, POSIX prompt signal
|
||||
cleanup, explicit-Bash regression execution, and scanner-resource-limit changes
|
||||
are final self-audit release blockers. Their focused regressions and the full
|
||||
required suite remain pending until rerun on the exact candidate; this README
|
||||
does not convert intermediate results into a final `PASS`.
|
||||
These are upstream local self-audit results, not independent certification or a
|
||||
published-release claim. Native Windows and macOS, hosted GitHub CI/release
|
||||
promotion, authenticated OBS, and resolution of the openSUSE automatic
|
||||
`debugsource` rpmlint `no-binary` finding remain pending. Unexecuted gates are
|
||||
`SKIP`, never `PASS`.
|
||||
|
||||
On Windows, 5.2.2 scopes output handling to normal local Win32 paths. A MinGW
|
||||
cross-build or Wine run is not native-Windows evidence; the `windows-latest`
|
||||
|
|
@ -329,8 +333,8 @@ compatibility scope includes an actual v5.2.1 password-encrypted, deduplicated
|
|||
disk archive with a DATA/DATA/REF/DATA sequence using the fixed-width legacy index
|
||||
and the legacy linear AAD sequence. The repository stores that 718-byte archive
|
||||
as auditable hexadecimal text with its provenance and SHA-256; the candidate
|
||||
lists, tests, extracts, and restores it byte-exact. The exact final candidate must repeat
|
||||
the gate. This is not a claim that a 5.2.1 reader understands every new
|
||||
lists, tests, extracts, and restores it byte-exact. The full local Linux gate
|
||||
passed on commit `ff99770`. This is not a claim that a 5.2.1 reader understands every new
|
||||
flag-gated 5.2.2 encoding or that every historical combination was tested.
|
||||
|
||||
The candidate commands and outcome fields for 5.2.2 are maintained in the
|
||||
|
|
|
|||
28
SECURITY.md
28
SECURITY.md
|
|
@ -48,7 +48,7 @@ password read; do not reuse it as a multi-record protocol channel.
|
|||
On POSIX terminals, the explicit prompt saves terminal state and installs
|
||||
signal-aware cleanup so a handled interruption restores echo and other changed
|
||||
settings before termination. This behavior is covered by a PTY regression and
|
||||
must be rerun on the exact release candidate.
|
||||
passed in the full local Linux gate for commit `ff99770`.
|
||||
|
||||
## Native key files
|
||||
|
||||
|
|
@ -225,7 +225,7 @@ gate was rerun on every platform:
|
|||
whole-image content hash. Its regression fixture is an actual v5.2.1
|
||||
password-encrypted DATA/DATA/REF/DATA disk archive stored as hexadecimal text with
|
||||
source and hash provenance. The candidate lists, tests, extracts, and restores it
|
||||
byte-exact; the exact final candidate must repeat that gate. This does not
|
||||
byte-exact; the full local Linux gate passed on commit `ff99770`. This does not
|
||||
claim that 5.2.1 readers accept the new flag-gated 5.2.2 records or that every
|
||||
historical encrypted+dedup combination was validated.
|
||||
|
||||
|
|
@ -245,8 +245,8 @@ scripts/check-source-only.sh --archive /path/to/zupt-5.2.2.tar.gz
|
|||
|
||||
Nested archive inspection is required to enforce bounded recursion, member
|
||||
count, per-entry expanded size, and total expanded size, and to fail closed on
|
||||
limit violations. The resource-limit regressions and all other late self-audit
|
||||
fixes remain pending until the exact candidate completes the final gate suite.
|
||||
limit violations. On commit `ff99770`, the source-only scanner suite passed
|
||||
39/39, including GNU thin archives, resource-limit cases, and safe diagnostics.
|
||||
|
||||
DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI
|
||||
ZIP, Windows ZIP, and macOS DMG release assets are separate outputs. An
|
||||
|
|
@ -285,16 +285,18 @@ make test-asan-run
|
|||
The first command builds the sanitizer configuration; the second executes its
|
||||
test suite. Neither substitutes for the normal optimized build and tests.
|
||||
|
||||
Because the positional-AAD and mandatory-AIT behavior changed late in the
|
||||
candidate, earlier successful runs are intermediate evidence only. The exact
|
||||
release candidate must rerun the affected regressions and the complete required
|
||||
suite; unavailable environments remain `SKIP`, not `PASS`.
|
||||
The full local Linux `make release-check` passed on committed candidate
|
||||
`ff99770`. Its recorded evidence includes packaging `PASS=49 FAIL=0 SKIP=0`,
|
||||
the 39/39 source-only scanner suite, strict GCC and Clang builds, GCC
|
||||
`-fanalyzer`, 9/9 static analysis in a tool-enabled run, ASan/UBSan/LSan, and
|
||||
1,000 mutation-fuzz iterations without a sanitizer-detected crash. An earlier
|
||||
off-screen GUI smoke run is supporting evidence, not an exact-candidate package
|
||||
result.
|
||||
|
||||
The same rule applies to private-key creation/parsing, terminal-safe comment
|
||||
display, POSIX prompt signal cleanup, explicit Bash regression execution, and
|
||||
source-scanner resource limits added during the final self-audit. This document
|
||||
records intended candidate behavior, not a final `PASS` for work still being
|
||||
integrated or rerun.
|
||||
These are upstream self-audit results, not independent certification. Native
|
||||
Windows and macOS, hosted GitHub CI/release promotion, authenticated OBS, and
|
||||
the openSUSE automatic `debugsource` rpmlint `no-binary` finding remain pending.
|
||||
An unavailable or unexecuted environment remains `SKIP`, never `PASS`.
|
||||
|
||||
Run target-native static analyzers and package checks as additional evidence.
|
||||
Do not infer x86_64, aarch64, ppc64le, s390x, riscv64, macOS, Windows, Leap, or
|
||||
|
|
|
|||
|
|
@ -240,9 +240,9 @@ LFS pointers.
|
|||
|
||||
Nested inspection is itself an untrusted-input boundary. The release scanner
|
||||
must cap recursion depth, archive members, per-entry expansion, and total
|
||||
expanded bytes and fail closed when a cap is reached. Scanner bomb regressions
|
||||
and all other late self-audit fixes are pending until rerun on the exact
|
||||
candidate.
|
||||
expanded bytes and fail closed when a cap is reached. Commit `ff99770` passed
|
||||
all 39 source-only scanner cases, including GNU thin archives, scanner-bomb
|
||||
limits, and safe diagnostic cases.
|
||||
|
||||
DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI
|
||||
ZIP, Windows ZIP, and macOS DMG files can be published separately from the
|
||||
|
|
@ -259,6 +259,15 @@ after source scans and an exact safe-member check. AppDir and Flatpak bundles
|
|||
and GUI platform installers remain excluded; Windows ZIP and macOS DMG outputs
|
||||
remain CLI-only.
|
||||
|
||||
The committed Linux candidate `ff99770` passed the full local
|
||||
`make release-check`: packaging reported `PASS=49 FAIL=0 SKIP=0`; strict GCC,
|
||||
strict Clang, GCC `-fanalyzer`, the 9/9 tool-enabled static-analysis run,
|
||||
ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations passed. Earlier off-screen
|
||||
GUI smoke evidence is retained separately. This upstream self-review is not an
|
||||
independent certification, and native Windows/macOS, hosted GitHub CI and
|
||||
release promotion, authenticated OBS, and the openSUSE automatic `debugsource`
|
||||
rpmlint `no-binary` finding remain pending.
|
||||
|
||||
## Historical compatibility notes
|
||||
|
||||
These are historical facts about earlier releases, retained to support recovery:
|
||||
|
|
@ -279,7 +288,7 @@ These are historical facts about earlier releases, retained to support recovery:
|
|||
v5.2.1 password-encrypted DATA/DATA/REF/DATA disk fixture is stored as hexadecimal
|
||||
text with source and hash provenance. The candidate lists, tests, extracts, and restores
|
||||
it byte-exact, with a warning that the legacy index has no whole-image hash;
|
||||
the exact final candidate must repeat that gate. Older readers are not
|
||||
the full local Linux gate passed on commit `ff99770`. Older readers are not
|
||||
claimed to accept new flag-gated 5.2.2 records, and untested historical mode
|
||||
combinations remain unclaimed.
|
||||
|
||||
|
|
|
|||
|
|
@ -97,8 +97,8 @@ immutable v5.2.1 tag is stored as hexadecimal text with its source and SHA-256
|
|||
provenance. The 5.2.2 reader reconstructs the legacy linear block-AAD sequence,
|
||||
lists, tests, extracts, and restores its input byte-exact through the
|
||||
fixed-width legacy disk-index parser. This does not cover every historical mode
|
||||
and must be rerun on the final candidate before it is promoted as a release
|
||||
gate.
|
||||
and passed in the full local Linux gate for commit `ff99770`; the target RPM
|
||||
`%check` must still exercise it before that package is promoted.
|
||||
|
||||
Disk restore also snapshots the measured archive into a private scratch file
|
||||
before opening the destination, then validates and restores from that same
|
||||
|
|
@ -153,7 +153,23 @@ install it in a disposable openSUSE environment and execute
|
|||
`scripts/test-installed-zupt.sh`. Do not claim a repository or architecture
|
||||
as supported until its build and installed smoke test have actually passed.
|
||||
|
||||
## Validation matrix for this handoff
|
||||
## Committed-candidate local Linux validation
|
||||
|
||||
Commit `ff99770` passed the full local `make release-check`. Packaging policy
|
||||
and syntax reported `PASS=49 FAIL=0 SKIP=0`; source-only scanner testing passed
|
||||
39/39, including GNU thin archives and safe diagnostic cases; strict GCC,
|
||||
strict Clang, GCC `-fanalyzer`, the 9/9 full tool-enabled static-analysis run,
|
||||
ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations passed. A reduced
|
||||
environment completed six available static checks and reported `cppcheck`
|
||||
unavailable rather than passing it. Earlier off-screen GUI smoke evidence is
|
||||
supporting evidence, not an exact-commit package result.
|
||||
|
||||
These local upstream results do not establish native Windows or macOS success,
|
||||
hosted GitHub CI/release promotion, authenticated OBS acceptance, or resolution
|
||||
of the automatic openSUSE `debugsource` rpmlint `no-binary` finding. Those gates
|
||||
remain pending.
|
||||
|
||||
## Prior openSUSE packaging validation
|
||||
|
||||
The local results below were produced on 2026-08-24 from the 5.2.2 candidate
|
||||
snapshot captured for the packaging run, in a disposable openSUSE Tumbleweed
|
||||
|
|
|
|||
Loading…
Reference in a new issue