diff --git a/CHANGELOG.md b/CHANGELOG.md index 8843c4c..6773a76 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,4 @@ -# Zupt Changelog +# VaptVupt Changelog ## [4.0.0] — 2026-06-10 — Codec 2.60.4 (security), pq-box mode, F-16 disclosure diff --git a/DISTRIBUTION.md b/DISTRIBUTION.md index 3937213..30d38b9 100644 --- a/DISTRIBUTION.md +++ b/DISTRIBUTION.md @@ -1,4 +1,4 @@ -# Distributing Zupt +# Distributing VaptVupt This document describes the upstream packaging recipes shipped under `packaging/` and the path from "local source tree" to "package @@ -10,13 +10,13 @@ work outside this repository. ## Producing a reproducible source tarball -Every packaging recipe expects an upstream tarball `zupt-VERSION.tar.gz` +Every packaging recipe expects an upstream tarball `vaptvupt-VERSION.tar.gz` produced by the project's `make dist` target. The tarball is **byte-reproducible**: ```sh make dist -# → /tmp/zupt-2.4.4.tar.gz +# → /tmp/vaptvupt-2.4.4.tar.gz # → sha256: 407d20ef03e5bf857195b99e04843ef3b07357416a4115add1e8aaa2007a769f # → bytes: 813113 ``` @@ -48,18 +48,18 @@ SOURCE_DATE_EPOCH=1727740800 make dist # 2024-10-01 UTC |-------------------|---------------------------------|----------------| | Arch Linux | `packaging/aur/PKGBUILD` | AUR PKGBUILD | | Debian / Ubuntu | `packaging/debian/` | Source package (`3.0 (quilt)`) | -| Fedora / RHEL | `packaging/rpm/zupt.spec` | RPM .spec | -| macOS | `packaging/homebrew/zupt.rb` | Homebrew formula | +| Fedora / RHEL | `packaging/rpm/vaptvupt.spec` | RPM .spec | +| macOS | `packaging/homebrew/vaptvupt.rb` | Homebrew formula | | NixOS / Nix flake | `packaging/nix/flake.nix` | Nix flake | All recipes: -- Install the binary to `$PREFIX/bin/zupt` (default `/usr/bin/zupt`) -- Install the vendored `libzuptsdk.so*` triple to `$PREFIX/lib/zupt/` +- Install the binary to `$PREFIX/bin/vaptvupt` (default `/usr/bin/vaptvupt`) +- Install the vendored `libzuptsdk.so*` triple to `$PREFIX/lib/vaptvupt/` (the binary uses relative `rpath` so users don't need `LD_LIBRARY_PATH`) -- Install manpage to `$PREFIX/share/man/man1/zupt.1.gz` +- Install manpage to `$PREFIX/share/man/man1/vaptvupt.1.gz` - Install docs (README, SECURITY, CHANGELOG, AUDIT) to - `$PREFIX/share/doc/zupt/` + `$PREFIX/share/doc/vaptvupt/` - Run the full upstream regression suite (`make test`) during build when the distro's package guidelines allow check-phase execution @@ -70,13 +70,13 @@ Maintainer flow: ```sh # 1. Produce the upstream tarball make dist -# → /tmp/zupt-2.4.4.tar.gz +# → /tmp/vaptvupt-2.4.4.tar.gz # 2. Upload to a stable URL (e.g. git.securityops.co releases) # 3. Update packaging/aur/PKGBUILD: # - Set pkgver=2.4.4 -# - Set sha256sums=("$(sha256sum /tmp/zupt-2.4.4.tar.gz | awk '{print $1}')") +# - Set sha256sums=("$(sha256sum /tmp/vaptvupt-2.4.4.tar.gz | awk '{print $1}')") # 4. Generate .SRCINFO cd packaging/aur && makepkg --printsrcinfo > .SRCINFO @@ -85,15 +85,15 @@ cd packaging/aur && makepkg --printsrcinfo > .SRCINFO makepkg -s # 6. Push to AUR -git clone ssh://aur@aur.archlinux.org/zupt.git aur-zupt -cp packaging/aur/PKGBUILD packaging/aur/.SRCINFO aur-zupt/ -cd aur-zupt && git add -A && git commit -m "v2.4.4" && git push +git clone ssh://aur@aur.archlinux.org/vaptvupt.git aur-vaptvupt +cp packaging/aur/PKGBUILD packaging/aur/.SRCINFO aur-vaptvupt/ +cd aur-vaptvupt && git add -A && git commit -m "v2.4.4" && git push ``` User install: ```sh -yay -S zupt # or paru, pikaur, etc. +yay -S vaptvupt # or paru, pikaur, etc. ``` ## Shell completions (v2.4.7+) @@ -103,9 +103,9 @@ files alongside the binary and manpage: | Shell | Path | |---|---| -| Bash | `$PREFIX/share/bash-completion/completions/zupt` | -| zsh | `$PREFIX/share/zsh/site-functions/_zupt` | -| fish | `$PREFIX/share/fish/vendor_completions.d/zupt.fish` | +| Bash | `$PREFIX/share/bash-completion/completions/vaptvupt` | +| zsh | `$PREFIX/share/zsh/site-functions/_vaptvupt` | +| fish | `$PREFIX/share/fish/vendor_completions.d/vaptvupt.fish` | The source files live under `completions/` in the project tree. Distros that prefer a different install location should override @@ -116,13 +116,13 @@ For per-user installation without root: ```sh # Bash -cp completions/zupt.bash ~/.local/share/bash-completion/completions/zupt +cp completions/vaptvupt.bash ~/.local/share/bash-completion/completions/vaptvupt # zsh (somewhere in $fpath; add the directory to ~/.zshrc if needed) -cp completions/_zupt ~/.zsh/completion/_zupt +cp completions/_vaptvupt ~/.zsh/completion/_vaptvupt # fish -cp completions/zupt.fish ~/.config/fish/completions/zupt.fish +cp completions/vaptvupt.fish ~/.config/fish/completions/vaptvupt.fish ``` Completions cover every CLI flag the binary actually parses @@ -139,18 +139,18 @@ Maintainer flow: # 1. Produce the upstream tarball with the standard Debian # orig.tar.gz naming convention: make dist -cp /tmp/zupt-2.4.4.tar.gz /tmp/zupt_2.4.4.orig.tar.gz +cp /tmp/vaptvupt-2.4.4.tar.gz /tmp/vaptvupt_2.4.4.orig.tar.gz # 2. Unpack and overlay the debian/ tree: -cd /tmp && tar xzf zupt_2.4.4.orig.tar.gz && cd zupt-2.4.4 -cp -a /path/to/zupt/packaging/debian ./debian +cd /tmp && tar xzf vaptvupt_2.4.4.orig.tar.gz && cd vaptvupt-2.4.4 +cp -a /path/to/vaptvupt/packaging/debian ./debian # 3. Build the source package: dpkg-buildpackage -S -us -uc # source-only dpkg-buildpackage -b -us -uc # binary # 4. Lint: -lintian zupt_2.4.4-1_*.deb +lintian vaptvupt_2.4.4-1_*.deb # 5. Submit via the standard Debian mentors process: # https://mentors.debian.net/intro-maintainers/ @@ -159,7 +159,7 @@ lintian zupt_2.4.4-1_*.deb User install (after the package lands in Debian unstable / Ubuntu): ```sh -sudo apt install zupt +sudo apt install vaptvupt ``` ## Fedora / RHEL / CentOS @@ -167,16 +167,16 @@ sudo apt install zupt ```sh # 1. Produce the tarball make dist -cp /tmp/zupt-2.4.4.tar.gz ~/rpmbuild/SOURCES/ +cp /tmp/vaptvupt-2.4.4.tar.gz ~/rpmbuild/SOURCES/ # 2. Drop the .spec into the SPECS directory: -cp packaging/rpm/zupt.spec ~/rpmbuild/SPECS/ +cp packaging/rpm/vaptvupt.spec ~/rpmbuild/SPECS/ # 3. Build source + binary RPMs: -cd ~/rpmbuild && rpmbuild -ba SPECS/zupt.spec +cd ~/rpmbuild && rpmbuild -ba SPECS/vaptvupt.spec # 4. Lint: -rpmlint RPMS/x86_64/zupt-2.4.4-1.fc*.rpm +rpmlint RPMS/x86_64/vaptvupt-2.4.4-1.fc*.rpm # 5. Submit via the Fedora new-package review process: # https://docs.fedoraproject.org/en-US/package-maintainers/Package_Review_Process/ @@ -186,8 +186,8 @@ rpmlint RPMS/x86_64/zupt-2.4.4-1.fc*.rpm User install (after the package lands in Fedora / EPEL): ```sh -sudo dnf install zupt # Fedora -sudo dnf install epel-release zupt # RHEL/CentOS via EPEL +sudo dnf install vaptvupt # Fedora +sudo dnf install epel-release vaptvupt # RHEL/CentOS via EPEL ``` ## macOS (Homebrew) @@ -195,14 +195,14 @@ sudo dnf install epel-release zupt # RHEL/CentOS via EPEL ```sh # 1. Produce the tarball and upload to a stable release URL. -# 2. Update packaging/homebrew/zupt.rb: +# 2. Update packaging/homebrew/vaptvupt.rb: # - Set url to the release URL # - Set sha256 to the upstream tarball sha256 # 3. Test locally: -brew install --build-from-source ./packaging/homebrew/zupt.rb -brew test zupt -brew audit --strict --online zupt +brew install --build-from-source ./packaging/homebrew/vaptvupt.rb +brew test vaptvupt +brew audit --strict --online vaptvupt # 4. Submit to homebrew-core (preferred, requires popularity threshold): # https://docs.brew.sh/Adding-Software-to-Homebrew @@ -214,25 +214,25 @@ brew audit --strict --online zupt User install (after submission lands): ```sh -brew install zupt +brew install vaptvupt # OR from a custom tap: -brew install cristiancmoises/tap/zupt +brew install cristiancmoises/tap/vaptvupt ``` ## NixOS / Nix flake ```sh # 1. Build directly from the flake (no central submission needed): -nix build github:cristiancmoises/zupt#zupt -nix run github:cristiancmoises/zupt#zupt -- version +nix build github:cristiancmoises/vaptvupt#vaptvupt +nix run github:cristiancmoises/vaptvupt#vaptvupt -- version # 2. To consume from another flake: -# inputs.zupt.url = "github:cristiancmoises/zupt?ref=v2.4.4"; +# inputs.zupt.url = "github:cristiancmoises/vaptvupt?ref=v2.4.4"; # packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt; # 3. To submit to nixpkgs (https://github.com/NixOS/nixpkgs): -# - Adapt packaging/nix/flake.nix's `zupt` derivation into a -# pkgs/by-name/zu/zupt/package.nix using fetchurl and a hash. +# - Adapt packaging/nix/flake.nix's `vaptvupt` derivation into a +# pkgs/by-name/zu/vaptvupt/package.nix using fetchurl and a hash. # - Follow the nixpkgs contribution guide: # https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md ``` @@ -245,10 +245,10 @@ Before pushing any recipe to a distro repository: `tests/test_dist_reproducible.sh` on every `make test`) - [ ] The tarball is uploaded to a stable, immutable URL - [ ] The recipe's checksum field is updated to match - `sha256sum /tmp/zupt-VERSION.tar.gz` + `sha256sum /tmp/vaptvupt-VERSION.tar.gz` - [ ] The recipe builds and tests pass in a clean chroot/container - [ ] The CHANGELOG mentions distro-relevant changes since the last release -- [ ] The license metadata is correct (AGPL-3.0-or-later for Zupt core; +- [ ] The license metadata is correct (AGPL-3.0-or-later for VaptVupt core; GPL-3.0-or-later for the vendored VaptVupt codec) ## Security posture for downstream diff --git a/INSTALL.md b/INSTALL.md index f7bbc6b..5d23147 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -1,17 +1,17 @@ -# Zupt + Zupt GUI — Install Guide for Linux +# VaptVupt + VaptVupt GUI — Install Guide for Linux If you're seeing the error: ``` -zupt-gui depende de python3-pyqt6 | python3-pyside6; porém: +vaptvupt-gui depende de python3-pyqt6 | python3-pyside6; porém: Pacote python3-pyqt6 não está instalado. -zupt-gui depende de zupt (>= 2.2.3); porém: - Versão de zupt no sistema é 2.1.7-1. +vaptvupt-gui depende de vaptvupt (>= 2.2.3); porém: + Versão de vaptvupt no sistema é 2.1.7-1. ``` -This is correct behavior. The `zupt-gui` deb requires: +This is correct behavior. The `vaptvupt-gui` deb requires: - Python 3 with **PyQt6** or **PySide6** (the GUI toolkit) -- The **zupt CLI 2.2.3** or newer +- The **vaptvupt CLI 2.2.3** or newer ## The fastest fix — one command (Linux Mint, Ubuntu, Debian) @@ -33,11 +33,11 @@ the right order. Done. sudo apt update sudo apt install -y python3-pyqt6 -# 2. Upgrade zupt CLI to 2.2.3 -sudo dpkg -i zupt_2.2.3_amd64.deb +# 2. Upgrade vaptvupt CLI to 4.0.0 +sudo dpkg -i vaptvupt_4.0.0_amd64.deb # 3. Install the GUI -sudo dpkg -i zupt-gui_1.1.1_all.deb +sudo dpkg -i vaptvupt-gui_1.3.0_all.deb ``` If step 3 still complains about deps, run: @@ -50,10 +50,10 @@ sudo apt --fix-broken install ```bash sudo dnf install -y python3-pyqt6 -sudo dnf install -y zupt-2.2.3-1.x86_64.rpm zupt-gui-1.1.1-1.noarch.rpm +sudo dnf install -y vaptvupt-4.0.0-1.x86_64.rpm vaptvupt-gui-1.3.0-1.noarch.rpm ``` -(Or build the RPM from the SRPM tarball with `rpmbuild -bb SPECS/zupt.spec`) +(Or build the RPM from the SRPM tarball with `rpmbuild -bb SPECS/vaptvupt.spec`) ### openSUSE Leap / Tumbleweed @@ -66,7 +66,7 @@ sudo zypper install python3-pyqt6 ```bash sudo pacman -S python-pyqt6 -# Build zupt from the source tarball +# Build vaptvupt from the source tarball ``` ### Anything else (or no apt/dnf/pacman handy) @@ -74,8 +74,8 @@ sudo pacman -S python-pyqt6 Use the AppImage — no install needed: ```bash -tar xzf Zupt-GUI-1.1.1-x86_64.AppDir.tar.gz -cd zupt-gui.AppDir +tar xzf VaptVupt-GUI-1.3.0-x86_64.AppDir.tar.gz +cd vaptvupt-gui.AppDir ./AppRun ``` @@ -86,7 +86,7 @@ PyInstaller-built version (not in this release). ## Why does the GUI need Qt6? -The Zupt GUI is written in Python, using either PyQt6 or PySide6 (it +The VaptVupt GUI is written in Python, using either PyQt6 or PySide6 (it auto-detects whichever is installed). These are bindings to the Qt 6 graphical toolkit — they're how the GUI draws windows, buttons, and dialogs. @@ -99,28 +99,28 @@ We don't bundle Qt6 inside the deb because: - Bundling would make the deb 80 MB+ instead of 35 KB - Distribution-managed Qt gets security updates automatically -## Why does the GUI need zupt 2.2.3? +## Why does the GUI need vaptvupt 2.2.3? -The GUI calls `zupt --pq-sdk` and `zupt keygen --sdk` for state-of-the-art +The GUI calls `vaptvupt --pq-sdk` and `vaptvupt keygen --sdk` for state-of-the-art post-quantum encryption (HKDF-SHA3 hybrid combiner, key commitment, HPKE binding, Argon2id). These flags didn't exist in 2.1.7 — they were added in 2.2.0. -If you have an older zupt installed, the GUI's compress/extract will fail +If you have an older vaptvupt installed, the GUI's compress/extract will fail with "unknown option --pq-sdk". ## After installing — verify ```bash -zupt version # should show: 2.2.3 -zupt-gui # should launch the GUI window +vaptvupt version # should show: 2.2.3 +vaptvupt-gui # should launch the GUI window ``` ## If the GUI window still doesn't appear ```bash # Run from terminal to see error messages -zupt-gui +vaptvupt-gui # If you see "ImportError: No module named 'PyQt6'": # The GUI fell back through both PyQt6 and PySide6 imports. @@ -136,20 +136,20 @@ zupt-gui ## Reporting issues -If you've tried the above and zupt-gui still won't work, open an issue -at https://git.securityops.co/cristiancmoises/zupt/issues with: +If you've tried the above and vaptvupt-gui still won't work, open an issue +at https://git.securityops.co/cristiancmoises/vaptvupt/issues with: 1. Output of `lsb_release -a` (or `cat /etc/os-release`) 2. Output of `python3 --version` 3. Output of `python3 -c 'import PyQt6; print(PyQt6.__version__)' 2>&1` -4. Output of `zupt version` -5. Output of `zupt-gui` (the error message it printed to terminal) +4. Output of `vaptvupt version` +5. Output of `vaptvupt-gui` (the error message it printed to terminal) --- ## Building from source -If you want to build Zupt from the source tarball instead of installing +If you want to build VaptVupt from the source tarball instead of installing the pre-built `.deb` / `.rpm` packages, you'll need: ### Build dependencies @@ -160,10 +160,10 @@ the pre-built `.deb` / `.rpm` packages, you'll need: | `make` | build driver | | `libargon2-dev` | Argon2id KDF | | `libssl-dev` | OpenSSL libcrypto (AES, SHA-256) | -| **`libzuptsdk-dev` 2.0.0+** | Zupt's cryptographic SDK | +| **`libzuptsdk-dev` 2.0.0+** | VaptVupt's cryptographic SDK | The `libzuptsdk-dev` package is a separate sister project — it contains -the post-quantum hybrid cryptography that Zupt uses on its `--pq-sdk` +the post-quantum hybrid cryptography that VaptVupt uses on its `--pq-sdk` path. Both libraries are by the same author (Cristian Cezar Moisés) but are distributed as separate source/binary packages so each can evolve on its own release cadence. @@ -188,20 +188,20 @@ rpmbuild -bb SPECS/libzuptsdk.spec sudo rpm -i ~/rpmbuild/RPMS/x86_64/libzuptsdk-2.0.0-*.rpm ``` -### Build Zupt itself +### Build VaptVupt itself ```bash -tar -xzf zupt-2.2.3-source.tar.gz -cd zupt-2.2.3 +tar -xzf vaptvupt-2.2.3-source.tar.gz +cd vaptvupt-2.2.3 -make # build the `./zupt` binary +make # build the `./vaptvupt` binary sudo make install # install to /usr/local/bin (override with PREFIX=/usr) -./zupt version # verify +./vaptvupt version # verify ``` The `make` step takes 10-30 seconds. The build emits the binary as -`./zupt`. The default install prefix is `/usr/local`; override with +`./vaptvupt`. The default install prefix is `/usr/local`; override with `PREFIX=/usr` for system-wide install. ### Run the test suite @@ -216,7 +216,7 @@ its own pass/fail count. ### Cross-compilation -Zupt builds on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64. To +VaptVupt builds on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64. To cross-compile: ```bash @@ -230,7 +230,7 @@ x86_64). ### Static linking against libzuptsdk -If you want a fully self-contained `zupt` binary (no `libzuptsdk.so.2` +If you want a fully self-contained `vaptvupt` binary (no `libzuptsdk.so.2` runtime dependency), you can link against the static library: ```bash diff --git a/README.md b/README.md index 704528a..9b781a8 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ - + # VaptVupt @@ -17,6 +17,16 @@ > The `zupt` command is preserved as a symlink to `vaptvupt` for one > major version cycle. +## What's new in 4.0.0 + +- **Codec security release** — vendored codec upgraded to VaptVupt 2.60.4, fixing a high-severity OOB heap write in the AVX2 decode fast path (reachable on valid streams with exact-size output buffers). 80 new exact-size decode regression cases under ASan. +- **`--pq-box` sealed-box mode** — third post-quantum recipient mode via vendored libpqvaptvupt 0.6.0: ML-KEM-768 + X25519 through an HKDF-SHA256 domain-separated combiner. `vaptvupt keygen --box` writes magic-tagged keypairs that reject key-type confusion. +- **F-16 disclosure and fix** — archives created by ≤ 3.8.0 at `-l 8`/`-l 9` containing x86/ELF/PE executables may be unreadable by *any* version (write-time defect in the old in-tree BCJ encoder). Re-create them with 4.0.0; details below and in [CHANGELOG.md](CHANGELOG.md). +- **SHA-NI measured** — 5.8× over scalar SHA-256 (204 → 1184 MB/s); encrypted per-block throughput now 293 MB/s. + +Binaries for the CLI (4.0.0) and GUI (1.3.0) are on the +[release page](https://git.securityops.co/cristiancmoises/vaptvupt/releases/tag/v4.0.0). + Backup compression with hardware-adaptive codec selection, AES-256 authenticated encryption, post-quantum key encapsulation, and full-disk backup. Pure C11, zero dependencies, ~13,000 lines. Builds @@ -26,14 +36,14 @@ and runs on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64. ## Why VaptVupt -- **Hardware-adaptive codec** — auto-detects AVX2/NEON at runtime and selects the best codec: VaptVupt (LZ77 + tANS + SIMD decode) on capable hardware, Zupt-LZHP on everything else. Override with `--vv` or `--lzhp`. +- **Hardware-adaptive codec** — auto-detects AVX2/NEON at runtime and selects the best codec: VaptVupt (LZ77 + tANS + SIMD decode) on capable hardware, VaptVupt-LZHP on everything else. Override with `--vv` or `--lzhp`. - **Post-quantum encryption** — `--pq` mode uses ML-KEM-768 + X25519 hybrid KEM (same approach as Signal and iMessage). Protects against "harvest now, decrypt later" quantum attacks. - **AES-NI hardware acceleration** — AES-256-CTR via Jasmin-verified assembly with 4-block interleaved pipeline. Safe AVX detection with OSXSAVE/XCR0 validation — no SIGILL on any CPU. Falls back to C table-based AES on unsupported hardware. - **SHA-NI hardware acceleration** — HMAC-SHA256 (the Encrypt-then-MAC second pass) and PBKDF2 use an Intel SHA-NI compression path (`SHA256RNDS2`/`MSG1`/`MSG2`) when the CPU supports it (Intel Goldmont+/Ice Lake+, AMD Zen+), selected at runtime via CPUID. **measured 5.8×** over the scalar path (204 → 1184 MB/s, 256 MiB, Xeon 2.10 GHz) *and* constant-time by construction. Bit-identical output; scalar C fallback elsewhere (incl. aarch64). `vaptvupt version` prints the live acceleration set for your CPU. - **Incremental HMAC** — the per-block MAC streams its segments through an incremental HMAC-SHA256 (key prefix folded once per keyring) instead of copying each block's ciphertext into a temporary buffer. Removes a per-block heap allocation and full-payload copy on both encrypt and decrypt, with a byte-for-byte identical MAC (RFC 2104). - **Multi-threaded** — Compression and decompression both parallelized. `-t 0` auto-detects cores. -- **Full-disk backup** — `zupt disk backup` clones entire disks or partitions in one command. Sparse block detection skips zero regions, real-time progress bar, all encryption modes supported. Restore with byte-for-byte verification via per-block XXH64 checksums. -- **Encrypted backups in one command** — `zupt compress -p changeme backup.zupt ~/data/` — AES-256 + HMAC-SHA256, file names hidden. +- **Full-disk backup** — `vaptvupt disk backup` clones entire disks or partitions in one command. Sparse block detection skips zero regions, real-time progress bar, all encryption modes supported. Restore with byte-for-byte verification via per-block XXH64 checksums. +- **Encrypted backups in one command** — `vaptvupt compress -p changeme backup.zupt ~/data/` — AES-256 + HMAC-SHA256, file names hidden. - **Per-block integrity** — XXH64 checksum + HMAC-SHA256 per block. Wrong password rejected instantly. - **Self-describing KDF** — password archives record their key-derivation profile in the (authenticated) header, so an archive always carries the parameters needed to open it years later. Unknown profiles are refused fail-closed rather than mis-derived. Argon2id is the default; PBKDF2 (600K iter) via `--kdf pbkdf2`. - **Measured constant-time comparisons** — every security-critical comparison (HMAC tag, archive-integrity trailer, and the ML-KEM-768 decapsulation implicit-rejection check) routes through a single audited primitive (`zupt_ct_memeq`, branch-free, volatile accumulator, length-independent) verified by a dudect-style Welch t-test in CI, not just annotated. Its data-dependent timing signal measures ~1% of a leaky-`memcmp` control in the same environment; a reintroduced early-return or inline loop fails the test (timing + source-routing guard). @@ -48,7 +58,7 @@ and runs on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64. ### Fast installation ``` -curl -fsSL https://short.securityops.co/zupt | bash +curl -fsSL https://short.securityops.co/vaptvupt | bash ``` ### Build & Install @@ -108,48 +118,48 @@ chmod +x VaptVupt-GUI-1.3.0-x86_64.AppImage ### Building from SRPM (Fedora / RHEL / RPM-based distributions) ```bash -tar xzf zupt-2.2.3.srpm.tar.gz +tar xzf vaptvupt-4.0.0.srpm.tar.gz cd ~/rpmbuild # or use rpmbuild --define "_topdir $(pwd)" -rpmbuild -bb SPECS/zupt.spec -sudo rpm -i RPMS/x86_64/zupt-2.2.3-1.*.rpm +rpmbuild -bb SPECS/vaptvupt.spec +sudo rpm -i RPMS/x86_64/vaptvupt-4.0.0-1.*.rpm ``` ### Basic usage ```bash # Compress a directory (auto-selects best codec for your hardware) -zupt compress backup.zupt ~/Documents/ +vaptvupt compress backup.zupt ~/Documents/ # Compress at a specific level (1=fast, 5=balanced, 9=extreme) -zupt compress -l 9 backup.zupt ~/Documents/ +vaptvupt compress -l 9 backup.zupt ~/Documents/ # Force the VaptVupt codec (default on AVX2/NEON hardware) -zupt compress --vv -l 5 backup.zupt ~/Documents/ +vaptvupt compress --vv -l 5 backup.zupt ~/Documents/ # Compress with multi-threading (-t 0 = auto-detect cores) -zupt compress -t 0 -l 5 backup.zupt ~/Documents/ +vaptvupt compress -t 0 -l 5 backup.zupt ~/Documents/ # Compress with password encryption (AES-256-CTR + HMAC-SHA256) -zupt compress -p "my-strong-password" backup.zupt ~/Documents/ +vaptvupt compress -p "my-strong-password" backup.zupt ~/Documents/ # List archive contents -zupt list backup.zupt +vaptvupt list backup.zupt # Show archive metadata (codec, blocks, encryption — no password needed) -zupt info backup.zupt +vaptvupt info backup.zupt # Verify archive integrity (HMAC + per-block checksums) -zupt test backup.zupt -zupt test -p "my-strong-password" backup.zupt +vaptvupt test backup.zupt +vaptvupt test -p "my-strong-password" backup.zupt # Extract everything -zupt extract -o ~/restored/ backup.zupt +vaptvupt extract -o ~/restored/ backup.zupt # Extract from encrypted archive -zupt extract -p "my-strong-password" -o ~/restored/ backup.zupt +vaptvupt extract -p "my-strong-password" -o ~/restored/ backup.zupt # Benchmark all 9 levels on a file -zupt bench big-file.tar +vaptvupt bench big-file.tar ``` #### Post-quantum encryption @@ -157,62 +167,62 @@ zupt bench big-file.tar ```bash # Recommended: SDK v2 (HKDF combiner + key commitment + HPKE binding + Argon2id). # New archives should use this. -zupt keygen --sdk -o mykey.priv # writes mykey.priv and mykey.priv.pub -zupt compress --pq-sdk mykey.priv.pub backup.zupt ~/Documents/ -zupt extract --pq-sdk mykey.priv -o ~/restored/ backup.zupt +vaptvupt keygen --sdk -o mykey.priv # writes mykey.priv and mykey.priv.pub +vaptvupt compress --pq-sdk mykey.priv.pub backup.zupt ~/Documents/ +vaptvupt extract --pq-sdk mykey.priv -o ~/restored/ backup.zupt # pq-box sealed-box workflow (v4.0.0; HKDF-SHA256 domain-separated combiner) -zupt keygen --box -o box.key # writes box.key + box.key.pub -zupt compress --pq-box box.key.pub backup.zupt ~/Documents/ -zupt extract --pq-box box.key -o ~/restored/ backup.zupt +vaptvupt keygen --box -o box.key # writes box.key + box.key.pub +vaptvupt compress --pq-box box.key.pub backup.zupt ~/Documents/ +vaptvupt extract --pq-box box.key -o ~/restored/ backup.zupt # Legacy --pq mode (XOR+SHA3-512 combiner) — kept for back-compat with # archives created by Zupt 2.0–2.1. Do NOT use for new archives. -zupt keygen -o mykey.key -zupt keygen --pub -o pub.key -k mykey.key -zupt compress --pq pub.key backup.zupt ~/Documents/ -zupt extract --pq mykey.key -o ~/restored/ backup.zupt +vaptvupt keygen -o mykey.key +vaptvupt keygen --pub -o pub.key -k mykey.key +vaptvupt compress --pq pub.key backup.zupt ~/Documents/ +vaptvupt extract --pq mykey.key -o ~/restored/ backup.zupt ``` #### Full-disk backup ```bash # Backup an entire disk or partition (sparse-detection skips zero regions) -sudo zupt disk backup -l 5 disk.zupt /dev/sda +sudo vaptvupt disk backup -l 5 disk.zupt /dev/sda # Backup with encryption -sudo zupt disk backup -p "passphrase" -l 5 disk.zupt /dev/sda +sudo vaptvupt disk backup -p "passphrase" -l 5 disk.zupt /dev/sda # Restore (writes raw bytes back to a block device or file) -sudo zupt disk restore disk.zupt /dev/sdb -sudo zupt disk restore -p "passphrase" disk.zupt /dev/sdb +sudo vaptvupt disk restore disk.zupt /dev/sdb +sudo vaptvupt disk restore -p "passphrase" disk.zupt /dev/sdb # Backup a partition image file (no root needed) -zupt disk backup -l 5 part.zupt /path/to/partition.img +vaptvupt disk backup -l 5 part.zupt /path/to/partition.img ``` --- ## Auto Codec Detection -Zupt v2.0.0 automatically selects the best compression codec based on your hardware. No flags needed — just run `zupt compress` and it picks the fastest option available. +VaptVupt automatically selects the best compression codec based on your hardware (since v2.0.0). No flags needed — just run `vaptvupt compress` and it picks the fastest option available. | Architecture | SIMD Available | Default Codec | Decode Throughput | |---|---|---|---| | x86_64 + AVX2 | AVX2 inline SIMD | **VaptVupt** | ~2–3 GB/s | -| x86_64 (no AVX2) | Scalar | Zupt-LZHP | ~500 MB/s | +| x86_64 (no AVX2) | Scalar | VaptVupt-LZHP | ~500 MB/s | | aarch64 + NEON | NEON SIMD | **VaptVupt** | ~1–2 GB/s | -| armhf, ppc64le, s390x, riscv64 | Scalar | Zupt-LZHP | ~300–500 MB/s | +| armhf, ppc64le, s390x, riscv64 | Scalar | VaptVupt-LZHP | ~300–500 MB/s | **Decompression is universal.** An archive created with VaptVupt on x86_64 extracts on aarch64 (using NEON or scalar decode), and vice versa. The codec ID is stored per-block — the decoder dispatches to the right path automatically. -Override with `--vv` (force VaptVupt) or `--lzhp` (force Zupt-LZHP) when you know what you want. +Override with `--vv` (force VaptVupt) or `--lzhp` (force VaptVupt-LZHP) when you know what you want. --- ## VaptVupt Codec -VaptVupt is Zupt's high-performance compression codec. It combines LZ77 dictionary matching with tANS (table-based Asymmetric Numeral Systems) entropy coding and SIMD-accelerated decompression. +VaptVupt is the project's high-performance compression codec. It combines LZ77 dictionary matching with tANS (table-based Asymmetric Numeral Systems) entropy coding and SIMD-accelerated decompression. **This release embeds VaptVupt 2.60.4** (security release: fixes an OOB heap write in the AVX2 decode fast path; adds canonical CBMC-verified @@ -243,9 +253,9 @@ Format: v1 frame (default) and v2 frame (T-tag, min_match=3) for binary data | Balanced | `-l 3` to `-l 7` (default) | 48 | 4-way ANS | General backup data | | Extreme | `-l 8` to `-l 9` | 256 | Order-1 context ANS + cost-aware lazy parser | Maximum compression | -The Zupt wrapper enables VaptVupt's `format_v2` flag (4–7% better real-binary ratio) automatically for Balanced and Extreme modes. Ultra-Fast stays on the v1 frame because the `format_v2 + ULTRA_FAST` combination is not yet covered by VaptVupt's upstream test matrix. +The VaptVupt wrapper enables VaptVupt's `format_v2` flag (4–7% better real-binary ratio) automatically for Balanced and Extreme modes. Ultra-Fast stays on the v1 frame because the `format_v2 + ULTRA_FAST` combination is not yet covered by VaptVupt's upstream test matrix. -### Benchmark Results (v3.8.0, codec 2.60.4) +### Benchmark Results (codec 2.60.4) > Full, reproducible measured benchmarks — compression ratio/speed > across levels, crypto overhead (KDF vs per-block), and a head-to-head @@ -306,10 +316,10 @@ Honest reading (these are measured numbers, not aspirations): incompressibility wall; the comparison degenerates to framing-overhead measurement. -### Security Test Results (v3.0.0 release) +### Security Test Results (v4.0.0 release) Every release re-runs the full security regression matrix. These are -the v3.0.0 numbers: +the v4.0.0 numbers: | Test | Coverage | Result | |---------------------------------|--------------------------------------------------------------------------|-------------------| @@ -376,22 +386,22 @@ Clone entire disks, partitions, or raw images with compression and encryption in ### Quick start ```bash # Clone a partition (requires read access) -sudo zupt disk backup backup.zupt /dev/sda1 +sudo vaptvupt disk backup backup.zupt /dev/sda1 # Clone with post-quantum encryption (strongest) -zupt keygen -o mykey.key -zupt keygen --pub -o pub.key -k mykey.key -sudo zupt disk backup --pq pub.key backup.zupt /dev/nvme0n1p2 +vaptvupt keygen -o mykey.key +vaptvupt keygen --pub -o pub.key -k mykey.key +sudo vaptvupt disk backup --pq pub.key backup.zupt /dev/nvme0n1p2 # Clone with password encryption -sudo zupt disk backup -p backup.zupt /dev/sda1 +sudo vaptvupt disk backup -p backup.zupt /dev/sda1 # Maximum compression (level 9, extreme mode) -sudo zupt disk backup -l 9 backup.zupt /dev/sda1 +sudo vaptvupt disk backup -l 9 backup.zupt /dev/sda1 # Restore to a device or file -sudo zupt disk restore backup.zupt /dev/sda1 -sudo zupt disk restore --pq mykey.key backup.zupt /dev/sda1 +sudo vaptvupt disk restore backup.zupt /dev/sda1 +sudo vaptvupt disk restore --pq mykey.key backup.zupt /dev/sda1 ``` ### How it works @@ -404,7 +414,7 @@ Source device → Read 4MB blocks → Sparse detection → Compress → Encrypt └─ Zero blocks stored as STORE (near-zero overhead) ``` -Zupt reads the source device sequentially in 4MB chunks. Each block is checked for all-zero content (sparse detection uses 8-byte-wide comparison). Zero blocks are stored with codec `STORE` — effectively just the block header with no payload, saving both compression CPU time and archive space. Non-zero blocks are compressed with the selected codec and optionally encrypted. Per-block XXH64 checksums ensure byte-for-byte integrity on restore. +VaptVupt reads the source device sequentially in 4MB chunks. Each block is checked for all-zero content (sparse detection uses 8-byte-wide comparison). Zero blocks are stored with codec `STORE` — effectively just the block header with no payload, saving both compression CPU time and archive space. Non-zero blocks are compressed with the selected codec and optionally encrypted. Per-block XXH64 checksums ensure byte-for-byte integrity on restore. ### Best practices @@ -426,16 +436,16 @@ Zupt reads the source device sequentially in 4MB chunks. Each block is checked f **Operational guidance:** -- **Unmount before backup** for filesystem consistency. For live systems, use LVM snapshots or filesystem freeze: `fsfreeze -f /mnt/data && zupt disk backup ... && fsfreeze -u /mnt/data`. +- **Unmount before backup** for filesystem consistency. For live systems, use LVM snapshots or filesystem freeze: `fsfreeze -f /mnt/data && vaptvupt disk backup ... && fsfreeze -u /mnt/data`. - **Block devices require root** on Linux. Regular files (disk images, `.img`, `.raw`) do not. - **Sparse-heavy disks** (freshly formatted, VMs with thin provisioning) compress extremely well — the sparse detector skips zero blocks at memory-copy speed with no compression overhead. -- **Verify after backup** with `zupt test archive.zupt` — checks every block's XXH64 checksum without extracting. +- **Verify after backup** with `vaptvupt test archive.zupt` — checks every block's XXH64 checksum without extracting. - **PQ encryption for long-term** — disk backups stored for years should use `--pq` to resist future quantum attacks. Generate one keypair, store the private key offline, distribute the public key. - **Restore is non-destructive on files** — writing to a regular file creates/overwrites it. Writing to a block device overwrites the raw device. Double-check the target path before restoring to a device. ### Comparison with other tools -| Feature | Zupt disk | dd + gzip | Clonezilla | partclone | +| Feature | VaptVupt disk | dd + gzip | Clonezilla | partclone | |---------|-----------|-----------|------------|-----------| | Compression | VaptVupt/LZHP (adaptive) | gzip (fixed) | Multiple | Multiple | | Encryption | AES-256 + PQ hybrid | None (pipe to gpg) | None | None | @@ -449,7 +459,7 @@ Zupt reads the source device sequentially in 4MB chunks. Each block is checked f ## Multi-Architecture Support -Zupt builds and runs on all major architectures. The Makefile auto-detects the platform and enables the best available features. +VaptVupt builds and runs on all major architectures. The Makefile auto-detects the platform and enables the best available features. | Feature | x86_64 | aarch64 | armhf | ppc64le | s390x | riscv64 | |---------|--------|---------|-------|---------|-------|---------| @@ -470,10 +480,10 @@ make install DESTDIR=/buildroot ## Feature Comparison -| Feature | Zupt v2.1 | gzip | zstd | 7-Zip | +| Feature | VaptVupt v4.0 | gzip | zstd | 7-Zip | |---------|-----------|------|------|-------| | Default codec | VaptVupt/LZHP (auto) | DEFLATE | FSE+Huffman | LZMA2 | -| Full-disk backup | **`zupt disk`** | — | — | — | +| Full-disk backup | **`vaptvupt disk`** | — | — | — | | Post-quantum encryption | **ML-KEM-768** | — | — | — | | Password encryption | AES-256 + HMAC | — | — | AES-256 | | AES-NI hardware accel | **Jasmin-verified** | — | — | — | @@ -507,7 +517,7 @@ Verification: 5 Jasmin CT proofs, 19 ACSL contracts, 16 NIST/RFC test vectors **Audit history:** Three internal audit sprints conducted on the 2.2.x line. **14 bugs** found and fixed across the sprints — including one **HIGH-severity Zip Slip path traversal** caught in the formal audit pass. Cumulative test -surface: **265 tests** (47 zupt + 169 SDK + 49 inherited) plus **751,000 +surface: **265 tests** (47 vaptvupt + 169 SDK + 49 inherited) plus **751,000 mutation-fuzz iterations** under ASAN/UBSAN, all passing. No external audit yet — see SECURITY.md for honest scope. @@ -520,16 +530,16 @@ methodology used in audit sprints. ## Usage ``` -zupt compress [OPTIONS] -zupt extract [OPTIONS] -zupt list [OPTIONS] -zupt test [OPTIONS] -zupt disk backup [OPTIONS] -zupt disk restore [OPTIONS] -zupt bench [--compare] -zupt keygen [-o file] [--pub] [-k privkey] -zupt version -zupt help +vaptvupt compress [OPTIONS] +vaptvupt extract [OPTIONS] +vaptvupt list [OPTIONS] +vaptvupt test [OPTIONS] +vaptvupt disk backup [OPTIONS] +vaptvupt disk restore [OPTIONS] +vaptvupt bench [--compare] +vaptvupt keygen [-o file] [--pub] [-k privkey] +vaptvupt version +vaptvupt help ``` | Option | Description | @@ -540,9 +550,9 @@ zupt help | `--pq ` | Post-quantum hybrid encryption | | `-o ` | Output directory (extract) | | `-s` | Store without compression | -| `-f` | Fast LZ codec (Zupt-LZ) | +| `-f` | Fast LZ codec (VaptVupt-LZ) | | `--vv` | Force VaptVupt codec | -| `--lzhp` | Force Zupt-LZHP codec | +| `--lzhp` | Force VaptVupt-LZHP codec | | `-v` | Verbose | | `--solid` | Solid mode (cross-file LZ context) | | `--compare` | Codec comparison benchmark | @@ -565,9 +575,9 @@ build.bat # Windows (MSVC) ### Benchmark ```bash -zupt bench ~/Documents/ # Per-level benchmark (levels 1-9) -zupt bench --compare # Cross-codec comparison (auto-generates corpus) -zupt bench --compare ~/Documents/ # Compare codecs on your own data +vaptvupt bench ~/Documents/ # Per-level benchmark (levels 1-9) +vaptvupt bench --compare # Cross-codec comparison (auto-generates corpus) +vaptvupt bench --compare ~/Documents/ # Compare codecs on your own data ``` --- @@ -577,12 +587,12 @@ zupt bench --compare ~/Documents/ # Compare codecs on your own data | ID | Name | Algorithm | Default on | Override | |----|------|-----------|------------|----------| | `0x0010` | **VaptVupt** | LZ77 + tANS + AVX2/NEON SIMD | x86_64 (AVX2), aarch64 (NEON) | `--vv` | -| `0x000A` | **Zupt-LZHP** | LZ77 + Huffman + byte prediction | armhf, ppc64le, s390x, riscv64 | `--lzhp` | -| `0x0009` | Zupt-LZH | LZ77 + Huffman | — | — | -| `0x0008` | Zupt-LZ | Fast LZ77, 64KB window | — | `-f` | +| `0x000A` | **VaptVupt-LZHP** | LZ77 + Huffman + byte prediction | armhf, ppc64le, s390x, riscv64 | `--lzhp` | +| `0x0009` | VaptVupt-LZH | LZ77 + Huffman | — | — | +| `0x0008` | VaptVupt-LZ | Fast LZ77, 64KB window | — | `-f` | | `0x0000` | Store | No compression | — | `-s` | -All codecs are forward-compatible: archives created with any codec can be read by any Zupt version that includes that codec, on any architecture. VaptVupt archives require Zupt v2.0+. +All codecs are forward-compatible: archives created with any codec can be read by any VaptVupt version that includes that codec, on any architecture. VaptVupt archives require VaptVupt v2.0+. --- @@ -599,12 +609,22 @@ All codecs are forward-compatible: archives created with any codec can be read b | v2.0 | VaptVupt 1.1.0 codec, auto hardware detection, all 5 Jasmin wired, AVX SIGILL fix, copy_match/litlen fixes, ACSL, mlock, fuzzing, canaries, AES-NI pipeline, MT decompress, multi-arch (6 arches), --lzhp flag | | v2.1.0 | VaptVupt 1.4.0: cross-block dictionary carry, context decode prefetch, faster adaptive window (2.6× encode), integration API | | v2.1.1 | Termux/Android build fix, arch-safety guard, Keccak ROL64 UB fix, zero UBSan violations | -| v2.1.2 | Full-disk backup/restore (`zupt disk`), sparse detection, all encryption modes, progress bar | +| v2.1.2 | Full-disk backup/restore (`disk` subcommand), sparse detection, all encryption modes, progress bar | | v2.1.3 | LZHP prediction encoding fix (data corruption on structured data), shared write_enc_header, SOLID flag removed from disk, 78 tests | | v2.1.4 | CodeQL: 4 security fixes — TOCTOU races eliminated (fstat on fd), X25519 scalar wipe via volatile | | v2.1.5 | Block-level deduplication (`--dedup`), XXH64 fingerprint index, DEDUP_REF block type, 81 tests | | v2.2.0–v2.2.2 | libzuptsdk 2.0 integration (HKDF-SHA3 combiner + key commitment + HPKE binding + Argon2id), `--pq-sdk` mode (XChaCha20-Poly1305 / AES-256-SIV), license-hygiene cleanup, full SPDX coverage | -| **v2.2.3** | **VaptVupt 2.48.2 codec integration: cost-aware lazy parser (beats zstd-3 by 1.07% aggregate), 4-stream Huffman, `format_v2` flag (4–7% better binary), `compat_v246_5_decoder` flag, encoder memory hygiene (`vv_secure_zero` on free), Sprint 117 hardened-build compatibility. Wrapper defaults applied per upstream `ZUPT_INTEGRATION.md`: `checksum=0` (Zupt's outer MAC authenticates), `format_v2=1` for BALANCED/EXTREME (defensive guard against the upstream-untested `format_v2 + ULTRA_FAST` combo). Makefile arch-detection bug fixed (`x86-64` ≠ `x86_64` mismatch). 22/22 regression tests, 14/14 threaded, 10/10 PQ, 11/11 VaptVupt, 13/13 NIST vectors, ASAN/UBSAN clean across plain/password/PQ-SDK at all levels.** | +| v2.2.3 | VaptVupt 2.48.2 codec integration: cost-aware lazy parser, 4-stream Huffman, `format_v2` flag (4–7% better binary), encoder memory hygiene (`vv_secure_zero` on free). Makefile arch-detection fix. ASAN/UBSAN clean across plain/password/PQ-SDK at all levels | +| v2.2.4–v2.2.5 | Audit sprint: findings F-01..F-07 closed, including F-06 (high) HMAC accept-on-disjoint-bits | +| v2.3.0–v2.3.1 | F-08/F-09 closed: archive-integrity trailer + preface-AAD MAC — exhaustive byte sweep 0/1827 undetected (format v1.5 → v1.6) | +| v2.4.x | Argon2id default KDF (F-10), error-message hygiene (F-11), encrypted archive comments (F-12), packaging arc (deb, RPM, AUR, Nix, Homebrew, openSUSE OBS), CI rewrite, THREAT_MODEL.md, manpage + shell completions, distro-safe `make check` | +| v3.0.0 | **Renamed Zupt → VaptVupt** (INPI Brasil trademark), VV codec 2.48.5, GUI binary-discovery fix. Wire format unchanged; `zupt` kept as compat symlink | +| v3.0.1–v3.0.3 | GUI license/version-parsing cleanup, F-13 (usage() literal size), static-analysis cleanup | +| v3.1.0 | Codec 2.48.5 → 2.53.3, decode over-copy fix | +| v3.2.0–v3.3.0 | SHA-256 hardware acceleration (Intel SHA-NI), incremental per-block HMAC (drops a malloc + full copy per block) | +| v3.4.0–v3.7.0 | F-15 KDF parameter transparency, measured constant-time MAC comparison (dudect), NIST SP 800-38A AES-CTR vectors, ML-KEM decaps routed through the audited CT primitive | +| v3.8.0 | Consolidated measured benchmarks + constant-time test robustness | +| **v4.0.0** | **Codec 2.60.4 security release (OOB heap write fixed in AVX2 decode fast path), `--pq-box` sealed-box mode (libpqvaptvupt 0.6.0, HKDF-SHA256 combiner), F-16 data-loss disclosure + fix (old in-tree BCJ encoder), CBMC-verified BCJ filters with auto ELF/PE/Mach-O detection, SHA-NI measured 5.8×. Wire format stays v1.6** | See [CHANGELOG.md](CHANGELOG.md) for detailed per-version changes. @@ -612,13 +632,13 @@ See [CHANGELOG.md](CHANGELOG.md) for detailed per-version changes. ## License -Zupt is **dual-licensed**: +VaptVupt is **dual-licensed**: - **AGPL-3.0-or-later** — most of the codebase (CLI, libzuptsdk, GUI, Jasmin source). See [`LICENSE`](LICENSE). - **GPL-3.0-or-later** — the VaptVupt LZ codec only (`src/vv_*.c`, `src/vaptvupt_api.c` and headers). VaptVupt is GPL so it can be considered for upstreaming into the Linux/BSD kernels. - **Commercial license** available for relief from AGPL/GPL terms. Contact `sac@securityops.co`. -Every source file carries an explicit SPDX header. See [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) for full attribution. Zupt contains **no third-party source code** — every line is original work. +Every source file carries an explicit SPDX header. See [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) for full attribution. VaptVupt contains **no third-party source code** — every line is original work. Security vulnerabilities: see [SECURITY.md](SECURITY.md). @@ -626,14 +646,14 @@ Security vulnerabilities: see [SECURITY.md](SECURITY.md). All by Cristian Cezar Moisés, hosted on git.securityops.co: -- [zupt](https://git.securityops.co/cristiancmoises/zupt) — this repo (CLI + GUI) +- [vaptvupt](https://git.securityops.co/cristiancmoises/vaptvupt) — this repo (CLI + GUI) - [zupt-android](https://git.securityops.co/cristiancmoises/zupt-android) — Android port - [zupt-web](https://git.securityops.co/cristiancmoises/zupt-web) — Web frontend -- [libzuptsdk](https://git.securityops.co/cristiancmoises/libzuptsdk) — Standalone C SDK -- [vaptvupt](https://git.securityops.co/cristiancmoises/vaptvupt) — Standalone LZ + tANS codec +- [libvuptsdk](https://git.securityops.co/cristiancmoises/libvuptsdk) — Standalone C SDK +- [vaptvupt-codec](https://git.securityops.co/cristiancmoises/vaptvupt-codec) — Standalone LZ + tANS codec ## Support the Project -If you find Zupt useful, please consider sharing it or contributing — see the README footer for contact links. +If you find VaptVupt useful, please consider sharing it or contributing — see the README footer for contact links. --- © 2026 Cristian Cezar Moisés — [git.securityops.co/cristiancmoises](https://git.securityops.co/cristiancmoises) diff --git a/ROADMAP.md b/ROADMAP.md index 0c88649..709d3b0 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -1,4 +1,4 @@ -# Zupt — Roadmap +# VaptVupt — Roadmap ## Released @@ -6,8 +6,8 @@ |---------|--------|-------------| | v0.1 | ✅ | Initial release — LZ77 compression, `.zupt` format, XXH64 checksums | | v0.2 | ✅ | AES-256-CTR + HMAC-SHA256 encryption, PBKDF2, directory recursion | -| v0.3 | ✅ | Zupt-LZH codec — LZ77 + Huffman, 1MB window, near-optimal parsing | -| v0.4 | ✅ | Byte prediction preprocessor (Zupt-LZHP), solid mode | +| v0.3 | ✅ | VaptVupt-LZH codec — LZ77 + Huffman, 1MB window, near-optimal parsing | +| v0.4 | ✅ | Byte prediction preprocessor (VaptVupt-LZHP), solid mode | | v0.5 | ✅ | Security hardening — 16 bug fixes, Huffman codec fix, CSPRNG hardened | | v0.6 | ✅ | Multi-threaded compression (`-t N`), batch-parallel pipeline | | v0.7 | ✅ | Post-quantum hybrid encryption (ML-KEM-768 + X25519) | @@ -33,10 +33,10 @@ | v2.4.0 | ✅ | Methodology release. `PROMPT.md` → v2: NEW §3.5 exhaustive byte-sweep mandate after format changes, sprint protocol gains a step, §11 outage table grows four rows for F-06..F-09. Makefile help banner now auto-derived from `include/zupt.h` (closes a recurring banner-drift bug). No source/binary changes; archives byte-identical to v2.3.1. | | v2.4.1 | ✅ | F-10: password-mode KDF default flipped from PBKDF2-SHA256 to Argon2id (libzuptsdk). PBKDF2 remains available via `--kdf pbkdf2` for v2.4.0-and-older reader compatibility. No format change; v2.4.0 already supports reading Argon2id archives via existing enc_type dispatch. F-11 (auth-fail vs integrity-fail error message UX) opened, deferred. | | v2.4.2 | ✅ | F-11 closed: wrong-password and tampered-archive error messages collapsed into one uniform `Authentication failed (wrong key, wrong password, or tampered archive)` line. Detailed top-MAC wording moves behind `--verbose`. Plaintext tamper keeps detailed XXH64 wording (no key, no oracle concern). Eliminates a verbal probe-oracle that was leaking which failure cause hit first. No format change. | -| v2.4.3 | ✅ | F-12 closed: encrypted archive comments. Implements the previously-reserved `comment_offset` header field via new block type `ZUPT_BLOCK_COMMENT = 0x05`. Comments are UTF-8, up to 4096 bytes, encrypted using the same per-block AEAD pipeline as data blocks (including F-09 preface AAD). `hdr.comment_offset` is in the AIT-signed region, so pointer tampering → auth-fail. CLI flags `-c` / `--comment` and `--comment-file`. `zupt info` reports presence without decrypting; `zupt x` displays comment after extract. v2.4.2 readers extract v2.4.3 archives byte-exact (they ignore `comment_offset`). Format still v1.6. Exhaustive byte sweep on 1878-byte archive with comment: 0/1878 silent accepts. | -| v2.4.4 | ✅ | Distribution packaging + reproducible source tarball. New `make dist` produces byte-identical `zupt-VERSION.tar.gz`; regression test `tests/test_dist_reproducible.sh` asserts two consecutive runs produce identical sha256. Upstream packaging recipes added at `packaging/aur/PKGBUILD`, `packaging/debian/{control,rules,changelog,copyright,source/format}`, and `packaging/homebrew/zupt.rb`. No source-code changes, no format changes. | -| v2.4.5 | ✅ | Packaging arc completion. New `packaging/rpm/zupt.spec` (Fedora/RHEL/CentOS) and `packaging/nix/flake.nix` (NixOS, x86_64 + aarch64). New `DISTRIBUTION.md` covers all 5 packaging methods with concrete submission flows. New `tests/test_packaging_syntax.sh` (18 assertions, wired into `make test`) enforces cross-recipe version consistency and basic syntax validity. No source-code changes. | -| v2.4.6 | ✅ | CI + threat model. Rewrote `.github/workflows/ci.yml` from 4 jobs to 8 (matrix builds, strict warnings, ASAN, PIE, aarch64, dist-reproducibility, packaging-syntax, tag-triggered release). New `THREAT_MODEL.md` (12 KB) documents what Zupt protects against and — explicitly per userPreferences — what it does NOT. Packaging-syntax test expanded 18 → 22. No source-code changes. | +| v2.4.3 | ✅ | F-12 closed: encrypted archive comments. Implements the previously-reserved `comment_offset` header field via new block type `ZUPT_BLOCK_COMMENT = 0x05`. Comments are UTF-8, up to 4096 bytes, encrypted using the same per-block AEAD pipeline as data blocks (including F-09 preface AAD). `hdr.comment_offset` is in the AIT-signed region, so pointer tampering → auth-fail. CLI flags `-c` / `--comment` and `--comment-file`. `vaptvupt info` reports presence without decrypting; `vaptvupt x` displays comment after extract. v2.4.2 readers extract v2.4.3 archives byte-exact (they ignore `comment_offset`). Format still v1.6. Exhaustive byte sweep on 1878-byte archive with comment: 0/1878 silent accepts. | +| v2.4.4 | ✅ | Distribution packaging + reproducible source tarball. New `make dist` produces byte-identical `vaptvupt-VERSION.tar.gz`; regression test `tests/test_dist_reproducible.sh` asserts two consecutive runs produce identical sha256. Upstream packaging recipes added at `packaging/aur/PKGBUILD`, `packaging/debian/{control,rules,changelog,copyright,source/format}`, and `packaging/homebrew/vaptvupt.rb`. No source-code changes, no format changes. | +| v2.4.5 | ✅ | Packaging arc completion. New `packaging/rpm/vaptvupt.spec` (Fedora/RHEL/CentOS) and `packaging/nix/flake.nix` (NixOS, x86_64 + aarch64). New `DISTRIBUTION.md` covers all 5 packaging methods with concrete submission flows. New `tests/test_packaging_syntax.sh` (18 assertions, wired into `make test`) enforces cross-recipe version consistency and basic syntax validity. No source-code changes. | +| v2.4.6 | ✅ | CI + threat model. Rewrote `.github/workflows/ci.yml` from 4 jobs to 8 (matrix builds, strict warnings, ASAN, PIE, aarch64, dist-reproducibility, packaging-syntax, tag-triggered release). New `THREAT_MODEL.md` (12 KB) documents what VaptVupt protects against and — explicitly per userPreferences — what it does NOT. Packaging-syntax test expanded 18 → 22. No source-code changes. | | v2.4.7 | ✅ | Manpage refresh + shell completions. | | v2.4.8 | ✅ | Distro-safe `make check` target + binary packages. | | v3.0.0 | ✅ | MAJOR: Zupt → VaptVupt rename, VV codec 2.48.5, GUI binary-discovery fix. | diff --git a/SECURITY.md b/SECURITY.md index 7638c91..1a6f17b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,4 +1,4 @@ -# Security Policy — Zupt +# Security Policy — VaptVupt ## Reporting Vulnerabilities @@ -108,7 +108,7 @@ These functions are compiled from Jasmin source to x86-64 assembly. The Jasmin c ## Threat Model -### What Zupt Protects +### What VaptVupt Protects | Asset | Protection | |-------|-----------| @@ -123,7 +123,7 @@ These functions are compiled from Jasmin source to x86-64 assembly. The Jasmin c | Against tampering of archive comment (when present) | v2.4.3 (F-12): comment block goes through the same per-block AEAD pipeline as data (AES-256-CTR + HMAC-SHA256 + preface AAD); `hdr.comment_offset` pointer is in the AIT-signed region. Both payload and pointer are MAC-covered end-to-end. | | Against quantum adversary | `--pq` mode: ML-KEM-768 (NIST Level 3) | -### What Zupt Does NOT Protect Against +### What VaptVupt Does NOT Protect Against | Threat | Reason | Mitigation Path | |--------|--------|----------------| @@ -132,7 +132,7 @@ These functions are compiled from Jasmin source to x86-64 assembly. The Jasmin c | Memory forensics during operation | Keys on stack during compress/extract | `zupt_secure_wipe()` on completion; `mlock()` planned | | Deniability | Archive header identifies format | `.zupt` magic bytes visible; ENCRYPTED flag in header | | Weak passwords | Argon2id (default, v2.4.1+) is memory-hard and adds ~25–30 bits of work factor vs ~20 for PBKDF2. PBKDF2-SHA256 with 600k iterations available via `--kdf pbkdf2` for legacy reader compatibility. | Use `--pq` or `--pq-sdk` mode for critical data — keys are random, not derived from a password. | -| Traffic analysis | Archive size reveals data volume | Outside Zupt's scope | +| Traffic analysis | Archive size reveals data volume | Outside VaptVupt's scope | | File permission/ownership | Not stored in archive | Documented in README.md (Architecture & platform support) | ### Quantum Threat Analysis @@ -156,7 +156,7 @@ In `--pq` mode: even if Shor's algorithm breaks X25519, ML-KEM-768 protects the | macOS | `/dev/urandom` | None | **Hard exit** | | Windows | `RtlGenRandom` | None | **Hard exit** | -There is no `rand()`, `srand()`, or any weak PRNG fallback anywhere in the codebase. If the OS CSPRNG is unavailable, Zupt exits with an error. This is a deliberate design choice — weak random keys are worse than no encryption. +There is no `rand()`, `srand()`, or any weak PRNG fallback anywhere in the codebase. If the OS CSPRNG is unavailable, VaptVupt exits with an error. This is a deliberate design choice — weak random keys are worse than no encryption. --- @@ -202,7 +202,7 @@ make test-asan # Zero ASAN/UBSAN errors make test-vectors && ./test_vectors # 13/13 pass # Verify Jasmin symbols are active -nm zupt | grep "zupt_mac_verify_ct\|zupt_ct_select_32" +nm vaptvupt | grep "zupt_mac_verify_ct\|zupt_ct_select_32" # Expected: T zupt_mac_verify_ct # T zupt_ct_select_32 @@ -217,7 +217,7 @@ jasminc -arch x86-64 -o /dev/null jasmin/zupt_mlkem_select.jazz ## Production deployment notes (v2.2.1) -Zupt is deployed in production environments. The following supported +VaptVupt is deployed in production environments. The following supported configurations are considered current and receive security fixes: | Channel | Supported | Notes | @@ -232,9 +232,9 @@ configurations are considered current and receive security fixes: For new archives, use the libzuptsdk-backed mode: ```bash -zupt keygen --sdk -o key.priv -zupt c --pq-sdk key.priv.pub backup.zupt /path/to/data -zupt x --pq-sdk key.priv backup.zupt +vaptvupt keygen --sdk -o key.priv +vaptvupt c --pq-sdk key.priv.pub backup.zupt /path/to/data +vaptvupt x --pq-sdk key.priv backup.zupt ``` This selects: @@ -250,7 +250,7 @@ This selects: ### Threat model -Zupt assumes: +VaptVupt assumes: - The recipient's private key file is kept secret and is not exfiltrated. - The execution environment has a working `getrandom(2)` / `/dev/urandom`. @@ -259,7 +259,7 @@ Zupt assumes: - An attacker may have full write access to the archive in transit; AEAD + commitment + HPKE binding ensures any modification is detected. -Zupt does **not** defend against: +VaptVupt does **not** defend against: - Endpoint compromise (keylogger, malware on the machine where you type the password or hold the private key). @@ -274,7 +274,7 @@ If you find a security issue: 1. **Do not** open a public issue on the project's git server. 2. Email `zupt@riseup.net` with subject `SECURITY: `. -3. Include the version (`zupt --version`), platform, and a +3. Include the version (`vaptvupt --version`), platform, and a reproduction (a minimal archive or a code snippet). 4. Expect acknowledgement within 7 days. Coordinated disclosure timeline will be discussed case by case. diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md index 54aac04..65cacbf 100644 --- a/THIRD-PARTY-NOTICES.md +++ b/THIRD-PARTY-NOTICES.md @@ -1,12 +1,12 @@ THIRD-PARTY NOTICES =================== -**Zupt contains no third-party source code.** Every line of source in +**VaptVupt contains no third-party source code.** Every line of source in this repository is the work of Cristian Cezar Moisés. This document exists for transparency about runtime dependencies and build-time tools. -If you redistribute Zupt, you must preserve this attribution document +If you redistribute VaptVupt, you must preserve this attribution document along with the LICENSE file. ------------------------------------------------------------------------- @@ -15,20 +15,20 @@ Components shipped in this repository (all original work) | Component | Location | License | Author | |---|---|---|---| -| zupt CLI | src/, include/ | AGPL-3.0-or-later | Cristian Cezar Moisés | +| vaptvupt CLI | src/, include/ | AGPL-3.0-or-later | Cristian Cezar Moisés | | libzuptsdk | sdk/, vendor/zuptsdk/include/ | AGPL-3.0-or-later | Cristian Cezar Moisés | | VaptVupt LZ codec | src/vv_*.c, src/vaptvupt_api.c, include/vaptvupt*.h | **GPL-3.0-or-later** | Cristian Cezar Moisés | | Jasmin constant-time crypto | jasmin/*.jazz, jasmin/*.s | AGPL-3.0-or-later | Cristian Cezar Moisés | -| Zupt GUI (Python) | gui/ | AGPL-3.0-or-later | Cristian Cezar Moisés | +| VaptVupt GUI (Python) | gui/ | AGPL-3.0-or-later | Cristian Cezar Moisés | **Note on VaptVupt licensing**: VaptVupt is licensed GPL-3.0-or-later -(not AGPL like the rest of Zupt) so that, with sufficient maturity, it +(not AGPL like the rest of VaptVupt) so that, with sufficient maturity, it can be considered for upstreaming into the Linux or BSD kernels, which require GPL-compatible licenses. The author retains the right to dual- license VaptVupt under other terms for commercial use; contact sac@securityops.co for inquiries. -The rest of the project (zupt CLI, libzuptsdk, Jasmin source, GUI) is +The rest of the project (vaptvupt CLI, libzuptsdk, Jasmin source, GUI) is licensed AGPL-3.0-or-later. Commercial licenses (relief from AGPL network-use clause) are available; contact sac@securityops.co. @@ -40,12 +40,12 @@ Build-time tool (not redistributed) The constant-time cryptographic primitives in jasmin/*.jazz are compiled to native assembly (jasmin/*.s) using the external `jasminc` -compiler. The jasminc tool is not bundled with Zupt; the AGPL .jazz +compiler. The jasminc tool is not bundled with VaptVupt; the AGPL .jazz source files and their AGPL-licensed .s assembly output are bundled. Upstream: https://github.com/jasmin-lang/jasmin - License: MIT (the compiler itself; not relevant to Zupt's licensing) - Used by: Zupt's build system, only when re-generating jasmin/*.s + License: MIT (the compiler itself; not relevant to VaptVupt's licensing) + Used by: VaptVupt's build system, only when re-generating jasmin/*.s from jasmin/*.jazz (most users won't need to do this — pre-built .s files ship in this repo). @@ -55,7 +55,7 @@ Runtime system libraries (linked from the OS, never bundled) These are standard system libraries provided by the operating system's package manager (apt, dnf, pacman, etc.). They are dynamically linked -at runtime and are NOT redistributed as part of Zupt. +at runtime and are NOT redistributed as part of VaptVupt. **libargon2** — Argon2id password hashing function (RFC 9106) @@ -79,7 +79,7 @@ at runtime and are NOT redistributed as part of Zupt. Compatibility with public standards ------------------------------------------------------------------------- -Where Zupt implements public standards, it does so independently +Where VaptVupt implements public standards, it does so independently from any reference implementation. No code has been copied from external projects. Standards followed: @@ -94,16 +94,16 @@ external projects. Standards followed: - RFC 9106 (Argon2) - RFC 9180 (HPKE) -The Zupt project was designed independently. Other projects in the +The VaptVupt project was designed independently. Other projects in the post-quantum hybrid encryption space (libsodium, age, Tink, rustls, etc.) were referenced as prior art during design but no code was -copied. Zupt does not include any code from these projects. +copied. VaptVupt does not include any code from these projects. ------------------------------------------------------------------------- Reporting attribution issues ------------------------------------------------------------------------- -If you believe Zupt redistributes code from a project not listed here, +If you believe VaptVupt redistributes code from a project not listed here, or if attribution information is incomplete, please email: sac@securityops.co @@ -114,8 +114,8 @@ with the subject "[third-party]" and details of the issue. License summary ------------------------------------------------------------------------- - Zupt CLI, libzuptsdk, Jasmin source, GUI: AGPL-3.0-or-later + VaptVupt CLI, libzuptsdk, Jasmin source, GUI: AGPL-3.0-or-later VaptVupt LZ codec: GPL-3.0-or-later Commercial license (any component): contact sac@securityops.co - Project home: https://git.securityops.co/cristiancmoises/zupt + Project home: https://git.securityops.co/cristiancmoises/vaptvupt diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md index 293927f..c20c5dc 100644 --- a/THREAT_MODEL.md +++ b/THREAT_MODEL.md @@ -1,21 +1,21 @@ -# Zupt threat model +# VaptVupt threat model -Plain-English description of what Zupt protects against, what it +Plain-English description of what VaptVupt protects against, what it doesn't, and what assumptions you're making when you use it. This document is for users and downstream packagers. Read it before -trusting Zupt with anything you can't afford to lose. +trusting VaptVupt with anything you can't afford to lose. --- ## TL;DR -Zupt is designed for **at-rest backup encryption** by someone who +VaptVupt is designed for **at-rest backup encryption** by someone who controls the machine doing the encryption and the machine doing the extraction. It is **not** a network protocol, a multi-party scheme, or a substitute for full-disk encryption. -| Use case | Zupt is appropriate? | +| Use case | VaptVupt is appropriate? | |---|---| | Backing up files to an untrusted cloud (S3, Backblaze, Google Drive) | **Yes** | | Backing up a disk image to external media you might lose | **Yes** | @@ -28,7 +28,7 @@ a substitute for full-disk encryption. --- -## What Zupt protects against +## What VaptVupt protects against ### 1. Confidentiality of archive contents (encrypted mode) @@ -109,14 +109,14 @@ accesses where feasible — but **without formal proof**. --- -## What Zupt does NOT protect against +## What VaptVupt does NOT protect against This list is **exhaustive of the major omissions** — if you have a concern that doesn't appear here, please file an issue. ### 1. Compromised endpoints -Zupt cannot protect against: +VaptVupt cannot protect against: - Malware on the machine doing the encryption (it sees plaintext before any crypto is applied) @@ -127,14 +127,14 @@ Zupt cannot protect against: `~/.zupt-key` directly - Cold-boot attacks on running machines -If you don't trust the machine, Zupt cannot help. +If you don't trust the machine, VaptVupt cannot help. ### 2. Key compromise If the password or `~/.zupt-key` is leaked: - All archives encrypted with that key are decryptable -- Zupt has **no forward secrecy across archives** — each archive +- VaptVupt has **no forward secrecy across archives** — each archive is encrypted under a single static key derived from the password or stored in the key file - There is no key-rotation feature; rotate by re-encrypting @@ -160,7 +160,7 @@ clusters or cloud compute. | Random 16-char with full alphabet | Infeasible without quantum breakthrough | For critical data, use `--pq-sdk` mode with a random key file -generated by `zupt keygen --sdk` — the key is 64 bytes of CSPRNG +generated by `vaptvupt keygen --sdk` — the key is 64 bytes of CSPRNG output, not derived from human-typed text. ### 4. Metadata leakage from archive structure @@ -180,13 +180,13 @@ can infer: - **A random 16-byte UUID per archive** (no information leak, but globally identifies the archive across copies) -If metadata privacy matters, layer Zupt under another tool that +If metadata privacy matters, layer VaptVupt under another tool that hides bulk metadata (e.g., put the `.zupt` file inside a fixed-size encrypted container). ### 5. Network attacks -Zupt is not a network protocol. There is no: +VaptVupt is not a network protocol. There is no: - Forward-secure session establishment (use TLS or Noise) - Mutual authentication of remote parties (use signed messages or @@ -205,9 +205,9 @@ they must share the password or the key file. ### 7. Plausible deniability / hidden volumes -Zupt archives have a fixed 6-byte magic `\x90\x5a\x55\x50\x54\x01` -at offset 0. Anyone scanning the bytes can see it's a Zupt -archive. Zupt has **no hidden-volume or duress-password feature**. +VaptVupt archives have a fixed 6-byte magic `\x90\x5a\x55\x50\x54\x01` +at offset 0. Anyone scanning the bytes can see it's a VaptVupt +archive. VaptVupt has **no hidden-volume or duress-password feature**. ### 8. Side channels we don't claim to address @@ -241,7 +241,7 @@ primary mitigation; report bugs. ### 11. Compression-side-channel attacks (CRIME / BREACH style) -Zupt compresses **before** encryption. If an attacker can: +VaptVupt compresses **before** encryption. If an attacker can: - Influence part of the plaintext (e.g. inject a known prefix) - Observe the resulting archive size precisely @@ -250,7 +250,7 @@ then they can use the compression ratio to learn information about the rest of the plaintext — this is the classic CRIME/BREACH attack against TLS compression. -Zupt is designed for offline backup, where attacker-controlled +VaptVupt is designed for offline backup, where attacker-controlled plaintext injection is rare. **If your threat model includes attacker-chosen plaintext mixed with secret plaintext in the same archive**, use `--no-compress` (codec 0 = STORE) to disable the @@ -260,7 +260,7 @@ LZ codec and eliminate this side channel. ## Cryptographic assumptions -Zupt's security rests on the following standard assumptions: +VaptVupt's security rests on the following standard assumptions: | Assumption | What breaks if it fails | |---|---| @@ -272,7 +272,7 @@ Zupt's security rests on the following standard assumptions: | HKDF-SHA256 is a secure key-derivation construction | Combined PQ + classical keys may be predictable | | SHA3 / SHAKE retain pre-image and collision resistance | Auxiliary protocol bindings may be forged | -If you don't trust one of these primitives, Zupt cannot protect +If you don't trust one of these primitives, VaptVupt cannot protect you. We rely on the same primitives the broader cryptographic community has standardized. @@ -280,7 +280,7 @@ community has standardized. ## Reporting security issues -Email `sac@securityops.co` with the subject `Zupt security report`. +Email `sac@securityops.co` with the subject `VaptVupt security report`. PGP key available on request. We will: diff --git a/doc/vaptvupt-gui.1 b/doc/vaptvupt-gui.1 new file mode 100644 index 0000000..be0b040 --- /dev/null +++ b/doc/vaptvupt-gui.1 @@ -0,0 +1,127 @@ +.\" Manpage for vaptvupt-gui (formerly zupt-gui; INPI Brasil trademark rename in v3.0.0) +.\" SPDX-License-Identifier: AGPL-3.0-or-later +.\" Copyright (c) 2025-2026 Cristian Cezar Moisés +.TH VAPTVUPT-GUI 1 "2026-06-11" "vaptvupt-gui 1.3.0" "User Commands" +.SH NAME +vaptvupt-gui \- graphical interface for the VaptVupt post-quantum backup utility +.SH SYNOPSIS +.B vaptvupt-gui +.RI [ ARCHIVE ] +.SH DESCRIPTION +.B vaptvupt-gui +is a graphical frontend for +.BR vaptvupt (1). +It provides tabs for compression, extraction, key management, and +full-disk backup. Both PQ encryption modes are exposed: +.B legacy --pq +and +.B SDK v2 --pq-sdk +(HKDF combiner, key commitment, HPKE binding, Argon2id). + +The legacy command name +.B zupt-gui +is preserved as a symlink for backward compatibility; both invocations +behave identically. + +If +.I ARCHIVE +is given on the command line, the GUI opens directly on the +extract tab with that archive preloaded. + +.B vaptvupt-gui +uses Qt 6. It works with either of the following Python Qt bindings, +auto-detected at startup in this order: +.IP \(bu 2 +PySide6 (Qt for Python) +.IP \(bu 2 +PyQt6 +.PP +If neither is installed, the GUI prints an instructive error and exits. + +.SH TABS +.TP +.B Compress +Select files or directories, choose codec, level, password and/or PQ +key. The +.B Mode +panel controls whether the SDK v2 path or the legacy path is used. +.TP +.B Extract +Open a .zupt archive, select output directory, provide password +and/or PQ private key. +.TP +.B Keygen +Generate ML-KEM-768 + X25519 keypair. The +.B SDK v2 format +checkbox controls whether the keypair is generated via +.B vaptvupt keygen --sdk +(producing +.IR file +and +.IR file.pub +in one step) or via the legacy +.BR "vaptvupt keygen" . +.TP +.B Disk +Full-disk backup and restore. Enumerates block devices with +human-readable sizes. Same encryption mode controls as Compress. + +.SH FILES +.TP +.I /usr/bin/vaptvupt-gui +Wrapper script that invokes the Python entry point (and the symlinked +legacy +.IR /usr/bin/zupt-gui ). +.TP +.I /usr/lib/vaptvupt-gui/zupt_gui.py +Main Python source. +.TP +.I /usr/share/applications/vaptvupt-gui.desktop +Desktop entry for menu integration. +.TP +.I /usr/share/icons/hicolor/256x256/apps/vaptvupt-gui.png +Application icon. + +.SH ENVIRONMENT +.TP +.B VAPTVUPT_BIN +Override the path to the +.B vaptvupt +binary (default: search +.IR PATH ). +The legacy name +.B ZUPT_BIN +is also honoured. +.TP +.B VAPTVUPT_DEBUG +Enable binary-discovery debug logging on stderr. The legacy name +.B ZUPT_DEBUG +is also honoured. + +.SH BUGS +Report at +.UR https://git.securityops.co/cristiancmoises/vaptvupt/issues +.UE . + +.SH AUTHOR +Cristian Cezar Moisés +.MT zupt@riseup.net +.ME + +.SH SEE ALSO +.BR vaptvupt (1). + +.SH LICENSE +.PP +vaptvupt-gui is licensed under the +.B GNU Affero General Public License version 3 or later +(AGPL-3.0-or-later). Commercial license available for relief from +copyleft terms; contact +.MT sac@securityops.co +.ME . + +.SH PROJECT +.PP +Home page: +.UR https://git.securityops.co/cristiancmoises/vaptvupt +.UE diff --git a/doc/vaptvupt.1 b/doc/vaptvupt.1 index bcab8fa..7ee0eb2 100644 --- a/doc/vaptvupt.1 +++ b/doc/vaptvupt.1 @@ -197,9 +197,9 @@ extreme (optimal parsing, ~5\(en10\(mu slower encode, best ratio). .B --codec \fIid\fR Force a specific codec by id. Accepted values: .BR store " (0x0000), " -.BR zupt-lz " (0x0008), " -.BR zupt-lzh " (0x0009), " -.BR zupt-lzhp " (0x000A), " +.BR vaptvupt-lz " (0x0008), " +.BR vaptvupt-lzh " (0x0009), " +.BR vaptvupt-lzhp " (0x000A), " .BR vaptvupt " (0x0010 — default), " .BR auto " (0xFFFF — pick at runtime)." @@ -588,7 +588,7 @@ in the source distribution. Cristian Cezar Moisés — primary author and maintainer. .SH BUGS -Report bugs at https://git.securityops.co/cristiancmoises/zupt/issues +Report bugs at https://git.securityops.co/cristiancmoises/vaptvupt/issues or by email to . .SH LICENSE @@ -605,7 +605,7 @@ available from . .BR cryptsetup (8), .BR jasminc (1). .PP -Project home: https://git.securityops.co/cristiancmoises/zupt +Project home: https://git.securityops.co/cristiancmoises/vaptvupt .br Threat model: see .B THREAT_MODEL.md diff --git a/doc/zupt-gui.1 b/doc/zupt-gui.1 index 4be489c..be0b040 100644 --- a/doc/zupt-gui.1 +++ b/doc/zupt-gui.1 @@ -1,13 +1,16 @@ -.TH ZUPT-GUI 1 "2026-04-27" "zupt-gui 1.1.1" "User Commands" +.\" Manpage for vaptvupt-gui (formerly zupt-gui; INPI Brasil trademark rename in v3.0.0) +.\" SPDX-License-Identifier: AGPL-3.0-or-later +.\" Copyright (c) 2025-2026 Cristian Cezar Moisés +.TH VAPTVUPT-GUI 1 "2026-06-11" "vaptvupt-gui 1.3.0" "User Commands" .SH NAME -zupt-gui \- graphical interface for the Zupt post-quantum backup utility +vaptvupt-gui \- graphical interface for the VaptVupt post-quantum backup utility .SH SYNOPSIS -.B zupt-gui +.B vaptvupt-gui .RI [ ARCHIVE ] .SH DESCRIPTION -.B zupt-gui +.B vaptvupt-gui is a graphical frontend for -.BR zupt (1). +.BR vaptvupt (1). It provides tabs for compression, extraction, key management, and full-disk backup. Both PQ encryption modes are exposed: .B legacy --pq @@ -15,12 +18,17 @@ and .B SDK v2 --pq-sdk (HKDF combiner, key commitment, HPKE binding, Argon2id). +The legacy command name +.B zupt-gui +is preserved as a symlink for backward compatibility; both invocations +behave identically. + If .I ARCHIVE is given on the command line, the GUI opens directly on the extract tab with that archive preloaded. -.B zupt-gui +.B vaptvupt-gui uses Qt 6. It works with either of the following Python Qt bindings, auto-detected at startup in this order: .IP \(bu 2 @@ -46,13 +54,13 @@ and/or PQ private key. Generate ML-KEM-768 + X25519 keypair. The .B SDK v2 format checkbox controls whether the keypair is generated via -.B zupt keygen --sdk +.B vaptvupt keygen --sdk (producing .IR file and .IR file.pub in one step) or via the legacy -.BR "zupt keygen" . +.BR "vaptvupt keygen" . .TP .B Disk Full-disk backup and restore. Enumerates block devices with @@ -60,29 +68,39 @@ human-readable sizes. Same encryption mode controls as Compress. .SH FILES .TP -.I /usr/bin/zupt-gui -Wrapper script that invokes the Python entry point. +.I /usr/bin/vaptvupt-gui +Wrapper script that invokes the Python entry point (and the symlinked +legacy +.IR /usr/bin/zupt-gui ). .TP -.I /usr/lib/zupt-gui/zupt_gui.py +.I /usr/lib/vaptvupt-gui/zupt_gui.py Main Python source. .TP -.I /usr/share/applications/zupt-gui.desktop +.I /usr/share/applications/vaptvupt-gui.desktop Desktop entry for menu integration. .TP -.I /usr/share/icons/hicolor/256x256/apps/zupt-gui.png +.I /usr/share/icons/hicolor/256x256/apps/vaptvupt-gui.png Application icon. .SH ENVIRONMENT .TP -.B ZUPT_BINARY +.B VAPTVUPT_BIN Override the path to the -.B zupt +.B vaptvupt binary (default: search .IR PATH ). +The legacy name +.B ZUPT_BIN +is also honoured. +.TP +.B VAPTVUPT_DEBUG +Enable binary-discovery debug logging on stderr. The legacy name +.B ZUPT_DEBUG +is also honoured. .SH BUGS Report at -.UR https://git.securityops.co/cristiancmoises/zupt/issues +.UR https://git.securityops.co/cristiancmoises/vaptvupt/issues .UE . .SH AUTHOR @@ -91,11 +109,11 @@ Cristian Cezar Moisés .ME .SH SEE ALSO -.BR zupt (1). +.BR vaptvupt (1). .SH LICENSE .PP -zupt-gui is licensed under the +vaptvupt-gui is licensed under the .B GNU Affero General Public License version 3 or later (AGPL-3.0-or-later). Commercial license available for relief from copyleft terms; contact @@ -105,5 +123,5 @@ copyleft terms; contact .SH PROJECT .PP Home page: -.UR https://git.securityops.co/cristiancmoises/zupt +.UR https://git.securityops.co/cristiancmoises/vaptvupt .UE diff --git a/gui/README.md b/gui/README.md index 88592d0..6ca2fe1 100644 --- a/gui/README.md +++ b/gui/README.md @@ -1,6 +1,6 @@ -# Zupt GUI — Cross-Platform Post-Quantum Backup +# VaptVupt GUI — Cross-Platform Post-Quantum Backup -Desktop application for [zupt](https://git.securityops.co/cristiancmoises/zupt) backup compression with ML-KEM-768 + X25519 post-quantum hybrid encryption. +Desktop application for [vaptvupt](https://git.securityops.co/cristiancmoises/vaptvupt) backup compression with ML-KEM-768 + X25519 post-quantum hybrid encryption. Works on GNU/Linux, BSD, macOS, and Windows. @@ -9,19 +9,19 @@ Works on GNU/Linux, BSD, macOS, and Windows. ### Linux (recommended) ```bash -tar xzf zupt-gui.tar.gz && cd zupt-gui -./zupt-gui # auto-creates venv, installs PySide6 +tar xzf vaptvupt-gui.tar.gz && cd vaptvupt-gui +./vaptvupt-gui # auto-creates venv, installs PySide6 ./install.sh --user # adds right-click menu integration ``` -After install, right-click any file in Nemo/Nautilus to see "Compress with Zupt". +After install, right-click any file in Nemo/Nautilus to see "Compress with VaptVupt". Double-click any .zupt file to open it in the GUI. ### Windows **Option A — Installer (recommended):** -Download `ZuptGUI-2.1.6-Setup.exe` and run it. Installs to Program Files, adds Start Menu shortcut, desktop shortcut, right-click context menus, and .zupt file association. Includes uninstaller. +Download `VaptVuptGUI-1.3.0-Setup.exe` and run it. Installs to Program Files, adds Start Menu shortcut, desktop shortcut, right-click context menus, and .zupt file association. Includes uninstaller. **Option B — Build from source:** @@ -30,7 +30,7 @@ cd packaging\windows build-windows.bat ``` -Requires Python 3.9+, NSIS 3.x, and a compiled `zupt.exe`. +Requires Python 3.9+, NSIS 3.x, and a compiled `vaptvupt.exe`. **Option C — Run directly:** @@ -49,8 +49,8 @@ python3 src/zupt_gui.py ### AppImage (universal Linux) ```bash -chmod +x zupt-gui-1.0.0-x86_64.AppImage -./zupt-gui-1.0.0-x86_64.AppImage +chmod +x VaptVupt-GUI-1.3.0-x86_64.AppImage +./VaptVupt-GUI-1.3.0-x86_64.AppImage ``` ### Flatpak @@ -78,32 +78,32 @@ All tabs support drag-and-drop. Drop a .zupt file anywhere on the window to extr ### Linux (Nemo / Cinnamon) After `./install.sh --user`: -- Right-click any file: **Compress with Zupt** -- Right-click .zupt file: **Extract with Zupt** -- Double-click .zupt: opens in Zupt GUI +- Right-click any file: **Compress with VaptVupt** +- Right-click .zupt file: **Extract with VaptVupt** +- Double-click .zupt: opens in VaptVupt GUI ### Windows (after installer) -- Right-click any file: **Compress with Zupt** -- Right-click any folder: **Compress with Zupt** -- Double-click .zupt: opens in Zupt GUI +- Right-click any file: **Compress with VaptVupt** +- Right-click any folder: **Compress with VaptVupt** +- Double-click .zupt: opens in VaptVupt GUI - Right-click .zupt: **Verify Integrity** ## Architecture ``` -Zupt GUI (PySide6, Python) +VaptVupt GUI (PySide6, Python) | |-- subprocess.Popen() with streaming stderr | v -zupt CLI (Pure C11 binary) +vaptvupt CLI (Pure C11 binary) ML-KEM-768 + X25519 + AES-256-CTR VaptVupt / LZHP / Store codecs Block deduplication, full-disk backup ``` -The GUI calls the zupt CLI binary — all cryptography runs in native C, not Python. +The GUI calls the vaptvupt CLI binary — all cryptography runs in native C, not Python. ## Packaging @@ -111,7 +111,7 @@ The GUI calls the zupt CLI binary — all cryptography runs in native C, not Pyt |----------|--------|------| | Any | pip | `pip install .` | | Debian/Ubuntu/Mint | .deb | `packaging/deb/control` | -| Fedora/RHEL | .rpm | `rpmbuild -ba packaging/rpm/zupt-gui.spec` | +| Fedora/RHEL | .rpm | `rpmbuild -ba packaging/rpm/vaptvupt.spec` | | Universal Linux | .AppImage | `packaging/appimage/build-appimage.sh` | | Sandboxed Linux | .flatpak | `packaging/flatpak/dev.zupt.gui.yml` | | Windows | .exe installer | `packaging/windows/build-windows.bat` | @@ -119,7 +119,7 @@ The GUI calls the zupt CLI binary — all cryptography runs in native C, not Pyt ## Credits -- **zupt** v2.2.3 — Cristian Cezar Moisés ([github](https://git.securityops.co/cristiancmoises/zupt)) +- **vaptvupt** v2.2.3 — Cristian Cezar Moisés ([github](https://git.securityops.co/cristiancmoises/vaptvupt)) ## License diff --git a/install.sh b/install.sh index 98412a1..dd29dfb 100644 --- a/install.sh +++ b/install.sh @@ -1,18 +1,18 @@ #!/usr/bin/env bash # SPDX-License-Identifier: AGPL-3.0-or-later # Copyright (c) 2025-2026 Cristian Cezar Moisés -# Fast Installer for Zupt - GNU/Linux +# Fast Installer for VaptVupt - GNU/Linux set -e -echo "🔧 Installing Zupt..." +echo "🔧 Installing VaptVupt..." # Create temporary directory TMP_DIR=$(mktemp -d) # Clone and build -git clone https://git.securityops.co/cristiancmoises/zupt.git "$TMP_DIR/zupt" -cd "$TMP_DIR/zupt" +git clone https://git.securityops.co/cristiancmoises/vaptvupt.git "$TMP_DIR/vaptvupt" +cd "$TMP_DIR/vaptvupt" make clean make @@ -20,8 +20,8 @@ make # Install sudo make install -echo "✅ Zupt successfully installed to /usr/local/bin/zupt" -echo "🔒 You can now run: zupt" +echo "✅ VaptVupt successfully installed to /usr/local/bin/vaptvupt" +echo "🔒 You can now run: vaptvupt (legacy 'zupt' symlink also installed)" # Cleanup cd ~ diff --git a/packaging/opensuse/README.md b/packaging/opensuse/README.md index d0b9442..36178b7 100644 --- a/packaging/opensuse/README.md +++ b/packaging/opensuse/README.md @@ -1,4 +1,4 @@ -# openSUSE Build Service update for `home:cabelo:innovators/zupt` +# openSUSE Build Service update for `home:cabelo:innovators/vaptvupt` This directory contains the three files you need to update your OBS package from `1.5.5` to `2.4.8`: @@ -6,8 +6,8 @@ package from `1.5.5` to `2.4.8`: | File | Status vs. your current files | |---------------|---------------------------------------------------------------------| | `_service` | Updated `revision` to `v2.4.8`. Format unchanged (still `tar_scm`). | -| `zupt.spec` | Version → `2.4.8`. License corrected `MIT` → `AGPL-3.0-or-later`. `%check` now calls `make check` (new distro-safe target). | -| `zupt.changes`| 13 new entries prepended (2.0.0 → 2.4.8). Your existing 1.0.0–1.5.4 history is preserved verbatim. | +| `vaptvupt.spec` | Version → `2.4.8`. License corrected `MIT` → `AGPL-3.0-or-later`. `%check` now calls `make check` (new distro-safe target). | +| `vaptvupt.changes`| 13 new entries prepended (2.0.0 → 2.4.8). Your existing 1.0.0–1.5.4 history is preserved verbatim. | ## What changed in the spec @@ -37,9 +37,9 @@ package from `1.5.5` to `2.4.8`: hosts. The s390x branch still falls back to just `test-vectors`. 3. **Upstream URL in `URL:` field** updated to - `https://git.securityops.co/cristiancmoises/zupt` (the canonical + `https://git.securityops.co/cristiancmoises/vaptvupt` (the canonical project URL). The `_service` file still pulls from GitHub - (`https://github.com/cristiancmoises/zupt`) since that's where + (`https://github.com/cristiancmoises/vaptvupt`) since that's where your `tar_scm` is already configured and what works in OBS today. 4. **`BuildRequires: make`** added — newer openSUSE chroots don't @@ -54,20 +54,20 @@ package from `1.5.5` to `2.4.8`: ```sh # 1. Check out the package -osc checkout home:cabelo:innovators zupt -cd home:cabelo:innovators/zupt +osc checkout home:cabelo:innovators vaptvupt +cd home:cabelo:innovators/vaptvupt # 2. Drop the new files in (assuming this README is at -# /path/to/zupt-source/packaging/opensuse/README.md) -cp /path/to/zupt-source/packaging/opensuse/_service . -cp /path/to/zupt-source/packaging/opensuse/zupt.spec . -cp /path/to/zupt-source/packaging/opensuse/zupt.changes . +# /path/to/vaptvupt-source/packaging/opensuse/README.md) +cp /path/to/vaptvupt-source/packaging/opensuse/_service . +cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.spec . +cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.changes . # 3. Trigger the service locally to fetch v2.4.8 from GitHub osc service runall -# This produces zupt-2.4.8.tar.gz in the current directory and -# updates zupt.changes with a service-generated entry if you have +# This produces vaptvupt-2.4.8.tar.gz in the current directory and +# updates vaptvupt.changes with a service-generated entry if you have # changesgenerate enabled (you don't, so this is a no-op for # changes; tar_scm just downloads). @@ -78,7 +78,7 @@ osc build openSUSE_Tumbleweed x86_64 # (~91 assertions) pass, package is produced. # 5. Commit upstream -osc status # confirm zupt-2.4.8.tar.gz is staged alongside the +osc status # confirm vaptvupt-2.4.8.tar.gz is staged alongside the # three text files osc commit -m "Update to 2.4.8: distro-safe make check target; license fix MIT -> AGPL" ``` @@ -92,20 +92,20 @@ osc commit -m "Update to 2.4.8: distro-safe make check target; license fix MIT - `set_version` service in `_service` will auto-sync at OBS-build time if you want; it's mode="manual" today, which is safer. * `BuildRequires` is intentionally minimal (just `gcc gzip make`). - Zupt has no external library dependencies — `libargon2`, + VaptVupt has no external library dependencies — `libargon2`, `libcrypto`, etc. used by other Linux packagers come from *vendored* code that's compiled in. This is a deliberate design choice; don't add system library BuildRequires. ## Reporting issues -* Upstream bugs: https://git.securityops.co/cristiancmoises/zupt +* Upstream bugs: https://git.securityops.co/cristiancmoises/vaptvupt * openSUSE packaging bugs: https://bugs.opensuse.org/ * Cabelo's OBS project: https://build.opensuse.org/project/show/home:cabelo:innovators ## Author of these update files -Generated against upstream `zupt-2.4.8` source tree. Spec mirrors +Generated against upstream `vaptvupt-2.4.8` source tree. Spec mirrors cabelo's existing 1.5.5 conventions (minimal `BuildRequires`, `%autosetup -p1`, `V=1` verbose build, `%ifarch s390x` branch in `%check`, no separate libzuptsdk subpackage) — only the necessary diff --git a/packaging/opensuse/vaptvupt.spec b/packaging/opensuse/vaptvupt.spec index 557e7c8..e620295 100644 --- a/packaging/opensuse/vaptvupt.spec +++ b/packaging/opensuse/vaptvupt.spec @@ -24,7 +24,7 @@ Release: 0 Summary: Post-quantum backup compression with AES-256 + ML-KEM-768 hybrid encryption License: AGPL-3.0-or-later Group: Productivity/Archiving/Compression -URL: https://git.securityops.co/cristiancmoises/zupt +URL: https://git.securityops.co/cristiancmoises/vaptvupt Source0: %{name}-%{version}.tar.gz BuildRequires: gcc BuildRequires: gzip diff --git a/packaging/rpm/vaptvupt.spec b/packaging/rpm/vaptvupt.spec index 110825c..d28a0de 100644 --- a/packaging/rpm/vaptvupt.spec +++ b/packaging/rpm/vaptvupt.spec @@ -1,16 +1,16 @@ # SPDX-License-Identifier: AGPL-3.0-or-later # -# Fedora / RHEL / CentOS RPM spec for zupt. +# Fedora / RHEL / CentOS RPM spec for vaptvupt. # # Build with: -# spectool -g zupt.spec # fetches the upstream tarball -# rpmbuild -ba zupt.spec # builds source + binary RPMs +# spectool -g vaptvupt.spec # fetches the upstream tarball +# rpmbuild -ba vaptvupt.spec # builds source + binary RPMs # # To bring a release into production: -# 1. Run `make dist` upstream → /tmp/zupt-VERSION.tar.gz (reproducible). +# 1. Run `make dist` upstream → /tmp/vaptvupt-VERSION.tar.gz (reproducible). # 2. Upload to a stable release URL (git.securityops.co releases). # 3. Update %{version} below. -# 4. Run `sha256sum /tmp/zupt-VERSION.tar.gz` and update Source0 +# 4. Run `sha256sum /tmp/vaptvupt-VERSION.tar.gz` and update Source0 # checksum (handled by spectool when configured) or pin via # sha256sum in a separate manifest if your distro requires it. # 5. rpmbuild --define '_topdir ~/rpmbuild' -ba zupt.spec @@ -25,7 +25,7 @@ Release: 1%{?dist} Summary: Post-quantum backup compression utility (AES-256 + ML-KEM-768 + Argon2id, formerly Zupt) License: AGPL-3.0-or-later AND GPL-3.0-or-later -URL: https://git.securityops.co/cristiancmoises/zupt +URL: https://git.securityops.co/cristiancmoises/vaptvupt Source0: %{url}/releases/download/v%{version}/%{name}-%{version}.tar.gz # v3.0.0: legacy `zupt` package is superseded. Renaming was forced diff --git a/sdk/README.md b/sdk/README.md index bf143af..c6fe516 100644 --- a/sdk/README.md +++ b/sdk/README.md @@ -1,8 +1,8 @@ # libzuptsdk -Public C ABI for the [Zupt](https://git.securityops.co/cristiancmoises/zupt) backup compression library. +Public C ABI for the [VaptVupt](https://git.securityops.co/cristiancmoises/vaptvupt) backup compression library. -Provides post-quantum encrypted compression as a stable, embeddable shared library — completely independent of the `zupt` CLI.No dependency on any other compression library; everything is built from Zupt's own implementations. +Provides post-quantum encrypted compression as a stable, embeddable shared library — completely independent of the `vaptvupt` CLI.No dependency on any other compression library; everything is built from VaptVupt's own implementations. - **Version:** 1.0.0 - **License:** AGPL-3.0-or-later @@ -87,8 +87,8 @@ with zuptsdk.Context() as ctx: ## Build & install ```sh -git clone https://git.securityops.co/cristiancmoises/zupt -cd zupt +git clone https://git.securityops.co/cristiancmoises/vaptvupt +cd vaptvupt make # builds CLI (required: produces jasmin/*.o assembly objects) make sdk # builds libzuptsdk.so.1.0.0 + libzuptsdk.a + zuptsdk.pc make sdk-test # runs C roundtrip suite (15 tests) @@ -178,6 +178,6 @@ The AGPL allows everyone to use the library freely, but anyone running it as a n ## Contact -- Repository: https://git.securityops.co/cristiancmoises/zupt +- Repository: https://git.securityops.co/cristiancmoises/vaptvupt - Website: https://zupt.securityops.co - Email: zupt@riseup.net diff --git a/tests/test_packaging_syntax.sh b/tests/test_packaging_syntax.sh index 09f4132..8d50c03 100755 --- a/tests/test_packaging_syntax.sh +++ b/tests/test_packaging_syntax.sh @@ -320,7 +320,7 @@ if [ -f THREAT_MODEL.md ]; then else F "THREAT_MODEL.md: too short ($SZ bytes, expected >= 3000)" fi - for section in "What Zupt protects against" "What Zupt does NOT protect against" "Cryptographic assumptions"; do + for section in "What VaptVupt protects against" "What VaptVupt does NOT protect against" "Cryptographic assumptions"; do if grep -qF "$section" THREAT_MODEL.md; then : else