cristiancmoises/zupt
Watch
1
0
Fork
You've already forked zupt
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 3

docs: complete zupt → vaptvupt rename; README v4.0.0 refresh

Browse source 
- README: add 'What's new in 4.0.0' section, extend release history
  v2.2.4 → v4.0.0, fix stale section titles (benchmark/security/feature
  tables), point fast-install at short.securityops.co/vaptvupt, fix
  related-project links (vaptvupt-codec, libvuptsdk, real repo names)
- install.sh: clone the renamed repo, vaptvupt success message
- Rename remaining zupt → vaptvupt across INSTALL.md, DISTRIBUTION.md,
  SECURITY.md, THREAT_MODEL.md, ROADMAP.md, THIRD-PARTY-NOTICES.md,
  gui/ + sdk/ + packaging READMEs, doc/vaptvupt.1, spec comments/URLs
- New doc/vaptvupt-gui.1 (GUI 1.3.0, VAPTVUPT_BIN/ZUPT_BIN env vars);
  doc/zupt-gui.1 kept as hardlinked compat copy
- Deliberately unchanged: .zupt extension, ZUPT header magic,
  ZUPT-* crypto domain-separation constants, zupt_*/ZUPT_* code
  identifiers, libzuptsdk artifact names, legacy symlink notes,
  CHANGELOG/AUDIT historical entries, Provides/Obsoletes upgrade path
- tests/test_packaging_syntax.sh: THREAT_MODEL section titles updated
This commit is contained in:
Cristian Cezar Moisés 2026-06-11 21:46:20 -03:00
commit 136a96ed20
18 changed files with 471 additions and 306 deletions
Download patch file Download diff file Expand all files Collapse all files

2
CHANGELOG.md
View file

@ -1,4 +1,4 @@
# Zupt Changelog # VaptVupt Changelog
## [4.0.0] — 2026-06-10 — Codec 2.60.4 (security), pq-box mode, F-16 disclosure ## [4.0.0] — 2026-06-10 — Codec 2.60.4 (security), pq-box mode, F-16 disclosure

90
DISTRIBUTION.md
View file

@ -1,4 +1,4 @@
# Distributing Zupt # Distributing VaptVupt
This document describes the upstream packaging recipes shipped under This document describes the upstream packaging recipes shipped under
`packaging/` and the path from "local source tree" to "package `packaging/` and the path from "local source tree" to "package
@ -10,13 +10,13 @@ work outside this repository.
## Producing a reproducible source tarball ## Producing a reproducible source tarball
Every packaging recipe expects an upstream tarball `zupt-VERSION.tar.gz` Every packaging recipe expects an upstream tarball `vaptvupt-VERSION.tar.gz`
produced by the project's `make dist` target. The tarball is produced by the project's `make dist` target. The tarball is
**byte-reproducible**: **byte-reproducible**:
```sh ```sh
make dist make dist
# → /tmp/zupt-2.4.4.tar.gz # → /tmp/vaptvupt-2.4.4.tar.gz
# → sha256: 407d20ef03e5bf857195b99e04843ef3b07357416a4115add1e8aaa2007a769f # → sha256: 407d20ef03e5bf857195b99e04843ef3b07357416a4115add1e8aaa2007a769f
# → bytes: 813113 # → bytes: 813113
``` ```
@ -48,18 +48,18 @@ SOURCE_DATE_EPOCH=1727740800 make dist # 2024-10-01 UTC
|-------------------|---------------------------------|----------------| |-------------------|---------------------------------|----------------|
| Arch Linux | `packaging/aur/PKGBUILD` | AUR PKGBUILD | | Arch Linux | `packaging/aur/PKGBUILD` | AUR PKGBUILD |
| Debian / Ubuntu | `packaging/debian/` | Source package (`3.0 (quilt)`) | | Debian / Ubuntu | `packaging/debian/` | Source package (`3.0 (quilt)`) |
| Fedora / RHEL | `packaging/rpm/zupt.spec` | RPM .spec | | Fedora / RHEL | `packaging/rpm/vaptvupt.spec` | RPM .spec |
| macOS | `packaging/homebrew/zupt.rb` | Homebrew formula | | macOS | `packaging/homebrew/vaptvupt.rb` | Homebrew formula |
| NixOS / Nix flake | `packaging/nix/flake.nix` | Nix flake | | NixOS / Nix flake | `packaging/nix/flake.nix` | Nix flake |
All recipes: All recipes:
- Install the binary to `$PREFIX/bin/zupt` (default `/usr/bin/zupt`) - Install the binary to `$PREFIX/bin/vaptvupt` (default `/usr/bin/vaptvupt`)
- Install the vendored `libzuptsdk.so*` triple to `$PREFIX/lib/zupt/` - Install the vendored `libzuptsdk.so*` triple to `$PREFIX/lib/vaptvupt/`
(the binary uses relative `rpath` so users don't need `LD_LIBRARY_PATH`) (the binary uses relative `rpath` so users don't need `LD_LIBRARY_PATH`)
- Install manpage to `$PREFIX/share/man/man1/zupt.1.gz` - Install manpage to `$PREFIX/share/man/man1/vaptvupt.1.gz`
- Install docs (README, SECURITY, CHANGELOG, AUDIT) to - Install docs (README, SECURITY, CHANGELOG, AUDIT) to
`$PREFIX/share/doc/zupt/` `$PREFIX/share/doc/vaptvupt/`
- Run the full upstream regression suite (`make test`) during build - Run the full upstream regression suite (`make test`) during build
when the distro's package guidelines allow check-phase execution when the distro's package guidelines allow check-phase execution
@ -70,13 +70,13 @@ Maintainer flow:
```sh ```sh
# 1. Produce the upstream tarball # 1. Produce the upstream tarball
make dist make dist
# → /tmp/zupt-2.4.4.tar.gz # → /tmp/vaptvupt-2.4.4.tar.gz
# 2. Upload to a stable URL (e.g. git.securityops.co releases) # 2. Upload to a stable URL (e.g. git.securityops.co releases)
# 3. Update packaging/aur/PKGBUILD: # 3. Update packaging/aur/PKGBUILD:
# - Set pkgver=2.4.4 # - Set pkgver=2.4.4
# - Set sha256sums=("$(sha256sum /tmp/zupt-2.4.4.tar.gz | awk '{print $1}')") # - Set sha256sums=("$(sha256sum /tmp/vaptvupt-2.4.4.tar.gz | awk '{print $1}')")
# 4. Generate .SRCINFO # 4. Generate .SRCINFO
cd packaging/aur && makepkg --printsrcinfo > .SRCINFO cd packaging/aur && makepkg --printsrcinfo > .SRCINFO
@ -85,15 +85,15 @@ cd packaging/aur && makepkg --printsrcinfo > .SRCINFO
makepkg -s makepkg -s
# 6. Push to AUR # 6. Push to AUR
git clone ssh://aur@aur.archlinux.org/zupt.git aur-zupt git clone ssh://aur@aur.archlinux.org/vaptvupt.git aur-vaptvupt
cp packaging/aur/PKGBUILD packaging/aur/.SRCINFO aur-zupt/ cp packaging/aur/PKGBUILD packaging/aur/.SRCINFO aur-vaptvupt/
cd aur-zupt && git add -A && git commit -m "v2.4.4" && git push cd aur-vaptvupt && git add -A && git commit -m "v2.4.4" && git push
``` ```
User install: User install:
```sh ```sh
yay -S zupt # or paru, pikaur, etc. yay -S vaptvupt # or paru, pikaur, etc.
``` ```
## Shell completions (v2.4.7+) ## Shell completions (v2.4.7+)
@ -103,9 +103,9 @@ files alongside the binary and manpage:
| Shell | Path | | Shell | Path |
|---|---| |---|---|
| Bash | `$PREFIX/share/bash-completion/completions/zupt` | | Bash | `$PREFIX/share/bash-completion/completions/vaptvupt` |
| zsh | `$PREFIX/share/zsh/site-functions/_zupt` | | zsh | `$PREFIX/share/zsh/site-functions/_vaptvupt` |
| fish | `$PREFIX/share/fish/vendor_completions.d/zupt.fish` | | fish | `$PREFIX/share/fish/vendor_completions.d/vaptvupt.fish` |
The source files live under `completions/` in the project tree. The source files live under `completions/` in the project tree.
Distros that prefer a different install location should override Distros that prefer a different install location should override
@ -116,13 +116,13 @@ For per-user installation without root:
```sh ```sh
# Bash # Bash
cp completions/zupt.bash ~/.local/share/bash-completion/completions/zupt cp completions/vaptvupt.bash ~/.local/share/bash-completion/completions/vaptvupt
# zsh (somewhere in $fpath; add the directory to ~/.zshrc if needed) # zsh (somewhere in $fpath; add the directory to ~/.zshrc if needed)
cp completions/_zupt ~/.zsh/completion/_zupt cp completions/_vaptvupt ~/.zsh/completion/_vaptvupt
# fish # fish
cp completions/zupt.fish ~/.config/fish/completions/zupt.fish cp completions/vaptvupt.fish ~/.config/fish/completions/vaptvupt.fish
``` ```
Completions cover every CLI flag the binary actually parses Completions cover every CLI flag the binary actually parses
@ -139,18 +139,18 @@ Maintainer flow:
# 1. Produce the upstream tarball with the standard Debian # 1. Produce the upstream tarball with the standard Debian
# orig.tar.gz naming convention: # orig.tar.gz naming convention:
make dist make dist
cp /tmp/zupt-2.4.4.tar.gz /tmp/zupt_2.4.4.orig.tar.gz cp /tmp/vaptvupt-2.4.4.tar.gz /tmp/vaptvupt_2.4.4.orig.tar.gz
# 2. Unpack and overlay the debian/ tree: # 2. Unpack and overlay the debian/ tree:
cd /tmp && tar xzf zupt_2.4.4.orig.tar.gz && cd zupt-2.4.4 cd /tmp && tar xzf vaptvupt_2.4.4.orig.tar.gz && cd vaptvupt-2.4.4
cp -a /path/to/zupt/packaging/debian ./debian cp -a /path/to/vaptvupt/packaging/debian ./debian
# 3. Build the source package: # 3. Build the source package:
dpkg-buildpackage -S -us -uc # source-only dpkg-buildpackage -S -us -uc # source-only
dpkg-buildpackage -b -us -uc # binary dpkg-buildpackage -b -us -uc # binary
# 4. Lint: # 4. Lint:
lintian zupt_2.4.4-1_*.deb lintian vaptvupt_2.4.4-1_*.deb
# 5. Submit via the standard Debian mentors process: # 5. Submit via the standard Debian mentors process:
# https://mentors.debian.net/intro-maintainers/ # https://mentors.debian.net/intro-maintainers/
@ -159,7 +159,7 @@ lintian zupt_2.4.4-1_*.deb
User install (after the package lands in Debian unstable / Ubuntu): User install (after the package lands in Debian unstable / Ubuntu):
```sh ```sh
sudo apt install zupt sudo apt install vaptvupt
``` ```
## Fedora / RHEL / CentOS ## Fedora / RHEL / CentOS
@ -167,16 +167,16 @@ sudo apt install zupt
```sh ```sh
# 1. Produce the tarball # 1. Produce the tarball
make dist make dist
cp /tmp/zupt-2.4.4.tar.gz ~/rpmbuild/SOURCES/ cp /tmp/vaptvupt-2.4.4.tar.gz ~/rpmbuild/SOURCES/
# 2. Drop the .spec into the SPECS directory: # 2. Drop the .spec into the SPECS directory:
cp packaging/rpm/zupt.spec ~/rpmbuild/SPECS/ cp packaging/rpm/vaptvupt.spec ~/rpmbuild/SPECS/
# 3. Build source + binary RPMs: # 3. Build source + binary RPMs:
cd ~/rpmbuild && rpmbuild -ba SPECS/zupt.spec cd ~/rpmbuild && rpmbuild -ba SPECS/vaptvupt.spec
# 4. Lint: # 4. Lint:
rpmlint RPMS/x86_64/zupt-2.4.4-1.fc*.rpm rpmlint RPMS/x86_64/vaptvupt-2.4.4-1.fc*.rpm
# 5. Submit via the Fedora new-package review process: # 5. Submit via the Fedora new-package review process:
# https://docs.fedoraproject.org/en-US/package-maintainers/Package_Review_Process/ # https://docs.fedoraproject.org/en-US/package-maintainers/Package_Review_Process/
@ -186,8 +186,8 @@ rpmlint RPMS/x86_64/zupt-2.4.4-1.fc*.rpm
User install (after the package lands in Fedora / EPEL): User install (after the package lands in Fedora / EPEL):
```sh ```sh
sudo dnf install zupt # Fedora sudo dnf install vaptvupt # Fedora
sudo dnf install epel-release zupt # RHEL/CentOS via EPEL sudo dnf install epel-release vaptvupt # RHEL/CentOS via EPEL
``` ```
## macOS (Homebrew) ## macOS (Homebrew)
@ -195,14 +195,14 @@ sudo dnf install epel-release zupt # RHEL/CentOS via EPEL
```sh ```sh
# 1. Produce the tarball and upload to a stable release URL. # 1. Produce the tarball and upload to a stable release URL.
# 2. Update packaging/homebrew/zupt.rb: # 2. Update packaging/homebrew/vaptvupt.rb:
# - Set url to the release URL # - Set url to the release URL
# - Set sha256 to the upstream tarball sha256 # - Set sha256 to the upstream tarball sha256
# 3. Test locally: # 3. Test locally:
brew install --build-from-source ./packaging/homebrew/zupt.rb brew install --build-from-source ./packaging/homebrew/vaptvupt.rb
brew test zupt brew test vaptvupt
brew audit --strict --online zupt brew audit --strict --online vaptvupt
# 4. Submit to homebrew-core (preferred, requires popularity threshold): # 4. Submit to homebrew-core (preferred, requires popularity threshold):
# https://docs.brew.sh/Adding-Software-to-Homebrew # https://docs.brew.sh/Adding-Software-to-Homebrew
@ -214,25 +214,25 @@ brew audit --strict --online zupt
User install (after submission lands): User install (after submission lands):
```sh ```sh
brew install zupt brew install vaptvupt
# OR from a custom tap: # OR from a custom tap:
brew install cristiancmoises/tap/zupt brew install cristiancmoises/tap/vaptvupt
``` ```
## NixOS / Nix flake ## NixOS / Nix flake
```sh ```sh
# 1. Build directly from the flake (no central submission needed): # 1. Build directly from the flake (no central submission needed):
nix build github:cristiancmoises/zupt#zupt nix build github:cristiancmoises/vaptvupt#vaptvupt
nix run github:cristiancmoises/zupt#zupt -- version nix run github:cristiancmoises/vaptvupt#vaptvupt -- version
# 2. To consume from another flake: # 2. To consume from another flake:
# inputs.zupt.url = "github:cristiancmoises/zupt?ref=v2.4.4"; # inputs.zupt.url = "github:cristiancmoises/vaptvupt?ref=v2.4.4";
# packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt; # packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt;
# 3. To submit to nixpkgs (https://github.com/NixOS/nixpkgs): # 3. To submit to nixpkgs (https://github.com/NixOS/nixpkgs):
# - Adapt packaging/nix/flake.nix's `zupt` derivation into a # - Adapt packaging/nix/flake.nix's `vaptvupt` derivation into a
# pkgs/by-name/zu/zupt/package.nix using fetchurl and a hash. # pkgs/by-name/zu/vaptvupt/package.nix using fetchurl and a hash.
# - Follow the nixpkgs contribution guide: # - Follow the nixpkgs contribution guide:
# https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md # https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
``` ```
@ -245,10 +245,10 @@ Before pushing any recipe to a distro repository:
`tests/test_dist_reproducible.sh` on every `make test`) `tests/test_dist_reproducible.sh` on every `make test`)
- [ ] The tarball is uploaded to a stable, immutable URL - [ ] The tarball is uploaded to a stable, immutable URL
- [ ] The recipe's checksum field is updated to match - [ ] The recipe's checksum field is updated to match
`sha256sum /tmp/zupt-VERSION.tar.gz` `sha256sum /tmp/vaptvupt-VERSION.tar.gz`
- [ ] The recipe builds and tests pass in a clean chroot/container - [ ] The recipe builds and tests pass in a clean chroot/container
- [ ] The CHANGELOG mentions distro-relevant changes since the last release - [ ] The CHANGELOG mentions distro-relevant changes since the last release
- [ ] The license metadata is correct (AGPL-3.0-or-later for Zupt core; - [ ] The license metadata is correct (AGPL-3.0-or-later for VaptVupt core;
GPL-3.0-or-later for the vendored VaptVupt codec) GPL-3.0-or-later for the vendored VaptVupt codec)
## Security posture for downstream ## Security posture for downstream

72
INSTALL.md
View file

@ -1,17 +1,17 @@
# Zupt + Zupt GUI — Install Guide for Linux # VaptVupt + VaptVupt GUI — Install Guide for Linux
If you're seeing the error: If you're seeing the error:
``` ```
zupt-gui depende de python3-pyqt6 | python3-pyside6; porém: vaptvupt-gui depende de python3-pyqt6 | python3-pyside6; porém:
Pacote python3-pyqt6 não está instalado. Pacote python3-pyqt6 não está instalado.
zupt-gui depende de zupt (>= 2.2.3); porém: vaptvupt-gui depende de vaptvupt (>= 2.2.3); porém:
Versão de zupt no sistema é 2.1.7-1. Versão de vaptvupt no sistema é 2.1.7-1.
``` ```
This is correct behavior. The `zupt-gui` deb requires: This is correct behavior. The `vaptvupt-gui` deb requires:
- Python 3 with **PyQt6** or **PySide6** (the GUI toolkit) - Python 3 with **PyQt6** or **PySide6** (the GUI toolkit)
- The **zupt CLI 2.2.3** or newer - The **vaptvupt CLI 2.2.3** or newer
## The fastest fix — one command (Linux Mint, Ubuntu, Debian) ## The fastest fix — one command (Linux Mint, Ubuntu, Debian)
@ -33,11 +33,11 @@ the right order. Done.
sudo apt update sudo apt update
sudo apt install -y python3-pyqt6 sudo apt install -y python3-pyqt6
# 2. Upgrade zupt CLI to 2.2.3 # 2. Upgrade vaptvupt CLI to 4.0.0
sudo dpkg -i zupt_2.2.3_amd64.deb sudo dpkg -i vaptvupt_4.0.0_amd64.deb
# 3. Install the GUI # 3. Install the GUI
sudo dpkg -i zupt-gui_1.1.1_all.deb sudo dpkg -i vaptvupt-gui_1.3.0_all.deb
``` ```
If step 3 still complains about deps, run: If step 3 still complains about deps, run:
@ -50,10 +50,10 @@ sudo apt --fix-broken install
```bash ```bash
sudo dnf install -y python3-pyqt6 sudo dnf install -y python3-pyqt6
sudo dnf install -y zupt-2.2.3-1.x86_64.rpm zupt-gui-1.1.1-1.noarch.rpm sudo dnf install -y vaptvupt-4.0.0-1.x86_64.rpm vaptvupt-gui-1.3.0-1.noarch.rpm
``` ```
(Or build the RPM from the SRPM tarball with `rpmbuild -bb SPECS/zupt.spec`) (Or build the RPM from the SRPM tarball with `rpmbuild -bb SPECS/vaptvupt.spec`)
### openSUSE Leap / Tumbleweed ### openSUSE Leap / Tumbleweed
@ -66,7 +66,7 @@ sudo zypper install python3-pyqt6
```bash ```bash
sudo pacman -S python-pyqt6 sudo pacman -S python-pyqt6
# Build zupt from the source tarball # Build vaptvupt from the source tarball
``` ```
### Anything else (or no apt/dnf/pacman handy) ### Anything else (or no apt/dnf/pacman handy)
@ -74,8 +74,8 @@ sudo pacman -S python-pyqt6
Use the AppImage — no install needed: Use the AppImage — no install needed:
```bash ```bash
tar xzf Zupt-GUI-1.1.1-x86_64.AppDir.tar.gz tar xzf VaptVupt-GUI-1.3.0-x86_64.AppDir.tar.gz
cd zupt-gui.AppDir cd vaptvupt-gui.AppDir
./AppRun ./AppRun
``` ```
@ -86,7 +86,7 @@ PyInstaller-built version (not in this release).
## Why does the GUI need Qt6? ## Why does the GUI need Qt6?
The Zupt GUI is written in Python, using either PyQt6 or PySide6 (it The VaptVupt GUI is written in Python, using either PyQt6 or PySide6 (it
auto-detects whichever is installed). These are bindings to the Qt 6 auto-detects whichever is installed). These are bindings to the Qt 6
graphical toolkit — they're how the GUI draws windows, buttons, and graphical toolkit — they're how the GUI draws windows, buttons, and
dialogs. dialogs.
@ -99,28 +99,28 @@ We don't bundle Qt6 inside the deb because:
- Bundling would make the deb 80 MB+ instead of 35 KB - Bundling would make the deb 80 MB+ instead of 35 KB
- Distribution-managed Qt gets security updates automatically - Distribution-managed Qt gets security updates automatically
## Why does the GUI need zupt 2.2.3? ## Why does the GUI need vaptvupt 2.2.3?
The GUI calls `zupt --pq-sdk` and `zupt keygen --sdk` for state-of-the-art The GUI calls `vaptvupt --pq-sdk` and `vaptvupt keygen --sdk` for state-of-the-art
post-quantum encryption (HKDF-SHA3 hybrid combiner, key commitment, HPKE post-quantum encryption (HKDF-SHA3 hybrid combiner, key commitment, HPKE
binding, Argon2id). These flags didn't exist in 2.1.7 — they were added binding, Argon2id). These flags didn't exist in 2.1.7 — they were added
in 2.2.0. in 2.2.0.
If you have an older zupt installed, the GUI's compress/extract will fail If you have an older vaptvupt installed, the GUI's compress/extract will fail
with "unknown option --pq-sdk". with "unknown option --pq-sdk".
## After installing — verify ## After installing — verify
```bash ```bash
zupt version # should show: 2.2.3 vaptvupt version # should show: 2.2.3
zupt-gui # should launch the GUI window vaptvupt-gui # should launch the GUI window
``` ```
## If the GUI window still doesn't appear ## If the GUI window still doesn't appear
```bash ```bash
# Run from terminal to see error messages # Run from terminal to see error messages
zupt-gui vaptvupt-gui
# If you see "ImportError: No module named 'PyQt6'": # If you see "ImportError: No module named 'PyQt6'":
# The GUI fell back through both PyQt6 and PySide6 imports. # The GUI fell back through both PyQt6 and PySide6 imports.
@ -136,20 +136,20 @@ zupt-gui
## Reporting issues ## Reporting issues
If you've tried the above and zupt-gui still won't work, open an issue If you've tried the above and vaptvupt-gui still won't work, open an issue
at https://git.securityops.co/cristiancmoises/zupt/issues with: at https://git.securityops.co/cristiancmoises/vaptvupt/issues with:
1. Output of `lsb_release -a` (or `cat /etc/os-release`) 1. Output of `lsb_release -a` (or `cat /etc/os-release`)
2. Output of `python3 --version` 2. Output of `python3 --version`
3. Output of `python3 -c 'import PyQt6; print(PyQt6.__version__)' 2>&1` 3. Output of `python3 -c 'import PyQt6; print(PyQt6.__version__)' 2>&1`
4. Output of `zupt version` 4. Output of `vaptvupt version`
5. Output of `zupt-gui` (the error message it printed to terminal) 5. Output of `vaptvupt-gui` (the error message it printed to terminal)
--- ---
## Building from source ## Building from source
If you want to build Zupt from the source tarball instead of installing If you want to build VaptVupt from the source tarball instead of installing
the pre-built `.deb` / `.rpm` packages, you'll need: the pre-built `.deb` / `.rpm` packages, you'll need:
### Build dependencies ### Build dependencies
@ -160,10 +160,10 @@ the pre-built `.deb` / `.rpm` packages, you'll need:
| `make` | build driver | | `make` | build driver |
| `libargon2-dev` | Argon2id KDF | | `libargon2-dev` | Argon2id KDF |
| `libssl-dev` | OpenSSL libcrypto (AES, SHA-256) | | `libssl-dev` | OpenSSL libcrypto (AES, SHA-256) |
| **`libzuptsdk-dev` 2.0.0+** | Zupt's cryptographic SDK | | **`libzuptsdk-dev` 2.0.0+** | VaptVupt's cryptographic SDK |
The `libzuptsdk-dev` package is a separate sister project — it contains The `libzuptsdk-dev` package is a separate sister project — it contains
the post-quantum hybrid cryptography that Zupt uses on its `--pq-sdk` the post-quantum hybrid cryptography that VaptVupt uses on its `--pq-sdk`
path. Both libraries are by the same author (Cristian Cezar Moisés) but path. Both libraries are by the same author (Cristian Cezar Moisés) but
are distributed as separate source/binary packages so each can evolve are distributed as separate source/binary packages so each can evolve
on its own release cadence. on its own release cadence.
@ -188,20 +188,20 @@ rpmbuild -bb SPECS/libzuptsdk.spec
sudo rpm -i ~/rpmbuild/RPMS/x86_64/libzuptsdk-2.0.0-*.rpm sudo rpm -i ~/rpmbuild/RPMS/x86_64/libzuptsdk-2.0.0-*.rpm
``` ```
### Build Zupt itself ### Build VaptVupt itself
```bash ```bash
tar -xzf zupt-2.2.3-source.tar.gz tar -xzf vaptvupt-2.2.3-source.tar.gz
cd zupt-2.2.3 cd vaptvupt-2.2.3
make # build the `./zupt` binary make # build the `./vaptvupt` binary
sudo make install # install to /usr/local/bin (override with PREFIX=/usr) sudo make install # install to /usr/local/bin (override with PREFIX=/usr)
./zupt version # verify ./vaptvupt version # verify
``` ```
The `make` step takes 10-30 seconds. The build emits the binary as The `make` step takes 10-30 seconds. The build emits the binary as
`./zupt`. The default install prefix is `/usr/local`; override with `./vaptvupt`. The default install prefix is `/usr/local`; override with
`PREFIX=/usr` for system-wide install. `PREFIX=/usr` for system-wide install.
### Run the test suite ### Run the test suite
@ -216,7 +216,7 @@ its own pass/fail count.
### Cross-compilation ### Cross-compilation
Zupt builds on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64. To VaptVupt builds on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64. To
cross-compile: cross-compile:
```bash ```bash
@ -230,7 +230,7 @@ x86_64).
### Static linking against libzuptsdk ### Static linking against libzuptsdk
If you want a fully self-contained `zupt` binary (no `libzuptsdk.so.2` If you want a fully self-contained `vaptvupt` binary (no `libzuptsdk.so.2`
runtime dependency), you can link against the static library: runtime dependency), you can link against the static library:
```bash ```bash

194
README.md
View file

@ -1,4 +1,4 @@
<!-- Logo: rehost on git.securityops.co/cristiancmoises/zupt or zupt.securityops.co; old GitHub user-attachments URL no longer in use --> <!-- Logo: rehost on git.securityops.co/cristiancmoises/vaptvupt or zupt.securityops.co; old GitHub user-attachments URL no longer in use -->
<!-- <img width="493" height="173" alt="logo" src="https://zupt.securityops.co/assets/logo.png"/> --> <!-- <img width="493" height="173" alt="logo" src="https://zupt.securityops.co/assets/logo.png"/> -->
# VaptVupt # VaptVupt
@ -17,6 +17,16 @@
> The `zupt` command is preserved as a symlink to `vaptvupt` for one > The `zupt` command is preserved as a symlink to `vaptvupt` for one
> major version cycle. > major version cycle.
## What's new in 4.0.0
- **Codec security release** — vendored codec upgraded to VaptVupt 2.60.4, fixing a high-severity OOB heap write in the AVX2 decode fast path (reachable on valid streams with exact-size output buffers). 80 new exact-size decode regression cases under ASan.
- **`--pq-box` sealed-box mode** — third post-quantum recipient mode via vendored libpqvaptvupt 0.6.0: ML-KEM-768 + X25519 through an HKDF-SHA256 domain-separated combiner. `vaptvupt keygen --box` writes magic-tagged keypairs that reject key-type confusion.
- **F-16 disclosure and fix** — archives created by ≤ 3.8.0 at `-l 8`/`-l 9` containing x86/ELF/PE executables may be unreadable by *any* version (write-time defect in the old in-tree BCJ encoder). Re-create them with 4.0.0; details below and in [CHANGELOG.md](CHANGELOG.md).
- **SHA-NI measured** — 5.8× over scalar SHA-256 (204 → 1184 MB/s); encrypted per-block throughput now 293 MB/s.
Binaries for the CLI (4.0.0) and GUI (1.3.0) are on the
[release page](https://git.securityops.co/cristiancmoises/vaptvupt/releases/tag/v4.0.0).
Backup compression with hardware-adaptive codec selection, AES-256 Backup compression with hardware-adaptive codec selection, AES-256
authenticated encryption, post-quantum key encapsulation, and authenticated encryption, post-quantum key encapsulation, and
full-disk backup. Pure C11, zero dependencies, ~13,000 lines. Builds full-disk backup. Pure C11, zero dependencies, ~13,000 lines. Builds
@ -26,14 +36,14 @@ and runs on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64.
## Why VaptVupt ## Why VaptVupt
- **Hardware-adaptive codec** — auto-detects AVX2/NEON at runtime and selects the best codec: VaptVupt (LZ77 + tANS + SIMD decode) on capable hardware, Zupt-LZHP on everything else. Override with `--vv` or `--lzhp`. - **Hardware-adaptive codec** — auto-detects AVX2/NEON at runtime and selects the best codec: VaptVupt (LZ77 + tANS + SIMD decode) on capable hardware, VaptVupt-LZHP on everything else. Override with `--vv` or `--lzhp`.
- **Post-quantum encryption** — `--pq` mode uses ML-KEM-768 + X25519 hybrid KEM (same approach as Signal and iMessage). Protects against "harvest now, decrypt later" quantum attacks. - **Post-quantum encryption** — `--pq` mode uses ML-KEM-768 + X25519 hybrid KEM (same approach as Signal and iMessage). Protects against "harvest now, decrypt later" quantum attacks.
- **AES-NI hardware acceleration** — AES-256-CTR via Jasmin-verified assembly with 4-block interleaved pipeline. Safe AVX detection with OSXSAVE/XCR0 validation — no SIGILL on any CPU. Falls back to C table-based AES on unsupported hardware. - **AES-NI hardware acceleration** — AES-256-CTR via Jasmin-verified assembly with 4-block interleaved pipeline. Safe AVX detection with OSXSAVE/XCR0 validation — no SIGILL on any CPU. Falls back to C table-based AES on unsupported hardware.
- **SHA-NI hardware acceleration** — HMAC-SHA256 (the Encrypt-then-MAC second pass) and PBKDF2 use an Intel SHA-NI compression path (`SHA256RNDS2`/`MSG1`/`MSG2`) when the CPU supports it (Intel Goldmont+/Ice Lake+, AMD Zen+), selected at runtime via CPUID. **measured 5.8×** over the scalar path (204 → 1184 MB/s, 256 MiB, Xeon 2.10 GHz) *and* constant-time by construction. Bit-identical output; scalar C fallback elsewhere (incl. aarch64). `vaptvupt version` prints the live acceleration set for your CPU. - **SHA-NI hardware acceleration** — HMAC-SHA256 (the Encrypt-then-MAC second pass) and PBKDF2 use an Intel SHA-NI compression path (`SHA256RNDS2`/`MSG1`/`MSG2`) when the CPU supports it (Intel Goldmont+/Ice Lake+, AMD Zen+), selected at runtime via CPUID. **measured 5.8×** over the scalar path (204 → 1184 MB/s, 256 MiB, Xeon 2.10 GHz) *and* constant-time by construction. Bit-identical output; scalar C fallback elsewhere (incl. aarch64). `vaptvupt version` prints the live acceleration set for your CPU.
- **Incremental HMAC** — the per-block MAC streams its segments through an incremental HMAC-SHA256 (key prefix folded once per keyring) instead of copying each block's ciphertext into a temporary buffer. Removes a per-block heap allocation and full-payload copy on both encrypt and decrypt, with a byte-for-byte identical MAC (RFC 2104). - **Incremental HMAC** — the per-block MAC streams its segments through an incremental HMAC-SHA256 (key prefix folded once per keyring) instead of copying each block's ciphertext into a temporary buffer. Removes a per-block heap allocation and full-payload copy on both encrypt and decrypt, with a byte-for-byte identical MAC (RFC 2104).
- **Multi-threaded** — Compression and decompression both parallelized. `-t 0` auto-detects cores. - **Multi-threaded** — Compression and decompression both parallelized. `-t 0` auto-detects cores.
- **Full-disk backup** — `zupt disk backup` clones entire disks or partitions in one command. Sparse block detection skips zero regions, real-time progress bar, all encryption modes supported. Restore with byte-for-byte verification via per-block XXH64 checksums. - **Full-disk backup** — `vaptvupt disk backup` clones entire disks or partitions in one command. Sparse block detection skips zero regions, real-time progress bar, all encryption modes supported. Restore with byte-for-byte verification via per-block XXH64 checksums.
- **Encrypted backups in one command** — `zupt compress -p changeme backup.zupt ~/data/` — AES-256 + HMAC-SHA256, file names hidden. - **Encrypted backups in one command** — `vaptvupt compress -p changeme backup.zupt ~/data/` — AES-256 + HMAC-SHA256, file names hidden.
- **Per-block integrity** — XXH64 checksum + HMAC-SHA256 per block. Wrong password rejected instantly. - **Per-block integrity** — XXH64 checksum + HMAC-SHA256 per block. Wrong password rejected instantly.
- **Self-describing KDF** — password archives record their key-derivation profile in the (authenticated) header, so an archive always carries the parameters needed to open it years later. Unknown profiles are refused fail-closed rather than mis-derived. Argon2id is the default; PBKDF2 (600K iter) via `--kdf pbkdf2`. - **Self-describing KDF** — password archives record their key-derivation profile in the (authenticated) header, so an archive always carries the parameters needed to open it years later. Unknown profiles are refused fail-closed rather than mis-derived. Argon2id is the default; PBKDF2 (600K iter) via `--kdf pbkdf2`.
- **Measured constant-time comparisons** — every security-critical comparison (HMAC tag, archive-integrity trailer, and the ML-KEM-768 decapsulation implicit-rejection check) routes through a single audited primitive (`zupt_ct_memeq`, branch-free, volatile accumulator, length-independent) verified by a dudect-style Welch t-test in CI, not just annotated. Its data-dependent timing signal measures ~1% of a leaky-`memcmp` control in the same environment; a reintroduced early-return or inline loop fails the test (timing + source-routing guard). - **Measured constant-time comparisons** — every security-critical comparison (HMAC tag, archive-integrity trailer, and the ML-KEM-768 decapsulation implicit-rejection check) routes through a single audited primitive (`zupt_ct_memeq`, branch-free, volatile accumulator, length-independent) verified by a dudect-style Welch t-test in CI, not just annotated. Its data-dependent timing signal measures ~1% of a leaky-`memcmp` control in the same environment; a reintroduced early-return or inline loop fails the test (timing + source-routing guard).
@ -48,7 +58,7 @@ and runs on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64.
### Fast installation ### Fast installation
``` ```
curl -fsSL https://short.securityops.co/zupt | bash curl -fsSL https://short.securityops.co/vaptvupt | bash
``` ```
### Build & Install ### Build & Install
@ -108,48 +118,48 @@ chmod +x VaptVupt-GUI-1.3.0-x86_64.AppImage
### Building from SRPM (Fedora / RHEL / RPM-based distributions) ### Building from SRPM (Fedora / RHEL / RPM-based distributions)
```bash ```bash
tar xzf zupt-2.2.3.srpm.tar.gz tar xzf vaptvupt-4.0.0.srpm.tar.gz
cd ~/rpmbuild # or use rpmbuild --define "_topdir $(pwd)" cd ~/rpmbuild # or use rpmbuild --define "_topdir $(pwd)"
rpmbuild -bb SPECS/zupt.spec rpmbuild -bb SPECS/vaptvupt.spec
sudo rpm -i RPMS/x86_64/zupt-2.2.3-1.*.rpm sudo rpm -i RPMS/x86_64/vaptvupt-4.0.0-1.*.rpm
``` ```
### Basic usage ### Basic usage
```bash ```bash
# Compress a directory (auto-selects best codec for your hardware) # Compress a directory (auto-selects best codec for your hardware)
zupt compress backup.zupt ~/Documents/ vaptvupt compress backup.zupt ~/Documents/
# Compress at a specific level (1=fast, 5=balanced, 9=extreme) # Compress at a specific level (1=fast, 5=balanced, 9=extreme)
zupt compress -l 9 backup.zupt ~/Documents/ vaptvupt compress -l 9 backup.zupt ~/Documents/
# Force the VaptVupt codec (default on AVX2/NEON hardware) # Force the VaptVupt codec (default on AVX2/NEON hardware)
zupt compress --vv -l 5 backup.zupt ~/Documents/ vaptvupt compress --vv -l 5 backup.zupt ~/Documents/
# Compress with multi-threading (-t 0 = auto-detect cores) # Compress with multi-threading (-t 0 = auto-detect cores)
zupt compress -t 0 -l 5 backup.zupt ~/Documents/ vaptvupt compress -t 0 -l 5 backup.zupt ~/Documents/
# Compress with password encryption (AES-256-CTR + HMAC-SHA256) # Compress with password encryption (AES-256-CTR + HMAC-SHA256)
zupt compress -p "my-strong-password" backup.zupt ~/Documents/ vaptvupt compress -p "my-strong-password" backup.zupt ~/Documents/
# List archive contents # List archive contents
zupt list backup.zupt vaptvupt list backup.zupt
# Show archive metadata (codec, blocks, encryption — no password needed) # Show archive metadata (codec, blocks, encryption — no password needed)
zupt info backup.zupt vaptvupt info backup.zupt
# Verify archive integrity (HMAC + per-block checksums) # Verify archive integrity (HMAC + per-block checksums)
zupt test backup.zupt vaptvupt test backup.zupt
zupt test -p "my-strong-password" backup.zupt vaptvupt test -p "my-strong-password" backup.zupt
# Extract everything # Extract everything
zupt extract -o ~/restored/ backup.zupt vaptvupt extract -o ~/restored/ backup.zupt
# Extract from encrypted archive # Extract from encrypted archive
zupt extract -p "my-strong-password" -o ~/restored/ backup.zupt vaptvupt extract -p "my-strong-password" -o ~/restored/ backup.zupt
# Benchmark all 9 levels on a file # Benchmark all 9 levels on a file
zupt bench big-file.tar vaptvupt bench big-file.tar
``` ```
#### Post-quantum encryption #### Post-quantum encryption
@ -157,62 +167,62 @@ zupt bench big-file.tar
```bash ```bash
# Recommended: SDK v2 (HKDF combiner + key commitment + HPKE binding + Argon2id). # Recommended: SDK v2 (HKDF combiner + key commitment + HPKE binding + Argon2id).
# New archives should use this. # New archives should use this.
zupt keygen --sdk -o mykey.priv # writes mykey.priv and mykey.priv.pub vaptvupt keygen --sdk -o mykey.priv # writes mykey.priv and mykey.priv.pub
zupt compress --pq-sdk mykey.priv.pub backup.zupt ~/Documents/ vaptvupt compress --pq-sdk mykey.priv.pub backup.zupt ~/Documents/
zupt extract --pq-sdk mykey.priv -o ~/restored/ backup.zupt vaptvupt extract --pq-sdk mykey.priv -o ~/restored/ backup.zupt
# pq-box sealed-box workflow (v4.0.0; HKDF-SHA256 domain-separated combiner) # pq-box sealed-box workflow (v4.0.0; HKDF-SHA256 domain-separated combiner)
zupt keygen --box -o box.key # writes box.key + box.key.pub vaptvupt keygen --box -o box.key # writes box.key + box.key.pub
zupt compress --pq-box box.key.pub backup.zupt ~/Documents/ vaptvupt compress --pq-box box.key.pub backup.zupt ~/Documents/
zupt extract --pq-box box.key -o ~/restored/ backup.zupt vaptvupt extract --pq-box box.key -o ~/restored/ backup.zupt
# Legacy --pq mode (XOR+SHA3-512 combiner) — kept for back-compat with # Legacy --pq mode (XOR+SHA3-512 combiner) — kept for back-compat with
# archives created by Zupt 2.0–2.1. Do NOT use for new archives. # archives created by Zupt 2.0–2.1. Do NOT use for new archives.
zupt keygen -o mykey.key vaptvupt keygen -o mykey.key
zupt keygen --pub -o pub.key -k mykey.key vaptvupt keygen --pub -o pub.key -k mykey.key
zupt compress --pq pub.key backup.zupt ~/Documents/ vaptvupt compress --pq pub.key backup.zupt ~/Documents/
zupt extract --pq mykey.key -o ~/restored/ backup.zupt vaptvupt extract --pq mykey.key -o ~/restored/ backup.zupt
``` ```
#### Full-disk backup #### Full-disk backup
```bash ```bash
# Backup an entire disk or partition (sparse-detection skips zero regions) # Backup an entire disk or partition (sparse-detection skips zero regions)
sudo zupt disk backup -l 5 disk.zupt /dev/sda sudo vaptvupt disk backup -l 5 disk.zupt /dev/sda
# Backup with encryption # Backup with encryption
sudo zupt disk backup -p "passphrase" -l 5 disk.zupt /dev/sda sudo vaptvupt disk backup -p "passphrase" -l 5 disk.zupt /dev/sda
# Restore (writes raw bytes back to a block device or file) # Restore (writes raw bytes back to a block device or file)
sudo zupt disk restore disk.zupt /dev/sdb sudo vaptvupt disk restore disk.zupt /dev/sdb
sudo zupt disk restore -p "passphrase" disk.zupt /dev/sdb sudo vaptvupt disk restore -p "passphrase" disk.zupt /dev/sdb
# Backup a partition image file (no root needed) # Backup a partition image file (no root needed)
zupt disk backup -l 5 part.zupt /path/to/partition.img vaptvupt disk backup -l 5 part.zupt /path/to/partition.img
``` ```
--- ---
## Auto Codec Detection ## Auto Codec Detection
Zupt v2.0.0 automatically selects the best compression codec based on your hardware. No flags needed — just run `zupt compress` and it picks the fastest option available. VaptVupt automatically selects the best compression codec based on your hardware (since v2.0.0). No flags needed — just run `vaptvupt compress` and it picks the fastest option available.
| Architecture | SIMD Available | Default Codec | Decode Throughput | | Architecture | SIMD Available | Default Codec | Decode Throughput |
|---|---|---|---| |---|---|---|---|
| x86_64 + AVX2 | AVX2 inline SIMD | **VaptVupt** | ~2–3 GB/s | | x86_64 + AVX2 | AVX2 inline SIMD | **VaptVupt** | ~2–3 GB/s |
| x86_64 (no AVX2) | Scalar | Zupt-LZHP | ~500 MB/s | | x86_64 (no AVX2) | Scalar | VaptVupt-LZHP | ~500 MB/s |
| aarch64 + NEON | NEON SIMD | **VaptVupt** | ~1–2 GB/s | | aarch64 + NEON | NEON SIMD | **VaptVupt** | ~1–2 GB/s |
| armhf, ppc64le, s390x, riscv64 | Scalar | Zupt-LZHP | ~300–500 MB/s | | armhf, ppc64le, s390x, riscv64 | Scalar | VaptVupt-LZHP | ~300–500 MB/s |
**Decompression is universal.** An archive created with VaptVupt on x86_64 extracts on aarch64 (using NEON or scalar decode), and vice versa. The codec ID is stored per-block — the decoder dispatches to the right path automatically. **Decompression is universal.** An archive created with VaptVupt on x86_64 extracts on aarch64 (using NEON or scalar decode), and vice versa. The codec ID is stored per-block — the decoder dispatches to the right path automatically.
Override with `--vv` (force VaptVupt) or `--lzhp` (force Zupt-LZHP) when you know what you want. Override with `--vv` (force VaptVupt) or `--lzhp` (force VaptVupt-LZHP) when you know what you want.
--- ---
## VaptVupt Codec ## VaptVupt Codec
VaptVupt is Zupt's high-performance compression codec. It combines LZ77 dictionary matching with tANS (table-based Asymmetric Numeral Systems) entropy coding and SIMD-accelerated decompression. VaptVupt is the project's high-performance compression codec. It combines LZ77 dictionary matching with tANS (table-based Asymmetric Numeral Systems) entropy coding and SIMD-accelerated decompression.
**This release embeds VaptVupt 2.60.4** (security release: fixes an OOB **This release embeds VaptVupt 2.60.4** (security release: fixes an OOB
heap write in the AVX2 decode fast path; adds canonical CBMC-verified heap write in the AVX2 decode fast path; adds canonical CBMC-verified
@ -243,9 +253,9 @@ Format: v1 frame (default) and v2 frame (T-tag, min_match=3) for binary data
| Balanced | `-l 3` to `-l 7` (default) | 48 | 4-way ANS | General backup data | | Balanced | `-l 3` to `-l 7` (default) | 48 | 4-way ANS | General backup data |
| Extreme | `-l 8` to `-l 9` | 256 | Order-1 context ANS + cost-aware lazy parser | Maximum compression | | Extreme | `-l 8` to `-l 9` | 256 | Order-1 context ANS + cost-aware lazy parser | Maximum compression |
The Zupt wrapper enables VaptVupt's `format_v2` flag (4–7% better real-binary ratio) automatically for Balanced and Extreme modes. Ultra-Fast stays on the v1 frame because the `format_v2 + ULTRA_FAST` combination is not yet covered by VaptVupt's upstream test matrix. The VaptVupt wrapper enables VaptVupt's `format_v2` flag (4–7% better real-binary ratio) automatically for Balanced and Extreme modes. Ultra-Fast stays on the v1 frame because the `format_v2 + ULTRA_FAST` combination is not yet covered by VaptVupt's upstream test matrix.
### Benchmark Results (v3.8.0, codec 2.60.4) ### Benchmark Results (codec 2.60.4)
> Full, reproducible measured benchmarks — compression ratio/speed > Full, reproducible measured benchmarks — compression ratio/speed
> across levels, crypto overhead (KDF vs per-block), and a head-to-head > across levels, crypto overhead (KDF vs per-block), and a head-to-head
@ -306,10 +316,10 @@ Honest reading (these are measured numbers, not aspirations):
incompressibility wall; the comparison degenerates to incompressibility wall; the comparison degenerates to
framing-overhead measurement. framing-overhead measurement.
### Security Test Results (v3.0.0 release) ### Security Test Results (v4.0.0 release)
Every release re-runs the full security regression matrix. These are Every release re-runs the full security regression matrix. These are
the v3.0.0 numbers: the v4.0.0 numbers:
| Test | Coverage | Result | | Test | Coverage | Result |
|---------------------------------|--------------------------------------------------------------------------|-------------------| |---------------------------------|--------------------------------------------------------------------------|-------------------|
@ -376,22 +386,22 @@ Clone entire disks, partitions, or raw images with compression and encryption in
### Quick start ### Quick start
```bash ```bash
# Clone a partition (requires read access) # Clone a partition (requires read access)
sudo zupt disk backup backup.zupt /dev/sda1 sudo vaptvupt disk backup backup.zupt /dev/sda1
# Clone with post-quantum encryption (strongest) # Clone with post-quantum encryption (strongest)
zupt keygen -o mykey.key vaptvupt keygen -o mykey.key
zupt keygen --pub -o pub.key -k mykey.key vaptvupt keygen --pub -o pub.key -k mykey.key
sudo zupt disk backup --pq pub.key backup.zupt /dev/nvme0n1p2 sudo vaptvupt disk backup --pq pub.key backup.zupt /dev/nvme0n1p2
# Clone with password encryption # Clone with password encryption
sudo zupt disk backup -p backup.zupt /dev/sda1 sudo vaptvupt disk backup -p backup.zupt /dev/sda1
# Maximum compression (level 9, extreme mode) # Maximum compression (level 9, extreme mode)
sudo zupt disk backup -l 9 backup.zupt /dev/sda1 sudo vaptvupt disk backup -l 9 backup.zupt /dev/sda1
# Restore to a device or file # Restore to a device or file
sudo zupt disk restore backup.zupt /dev/sda1 sudo vaptvupt disk restore backup.zupt /dev/sda1
sudo zupt disk restore --pq mykey.key backup.zupt /dev/sda1 sudo vaptvupt disk restore --pq mykey.key backup.zupt /dev/sda1
``` ```
### How it works ### How it works
@ -404,7 +414,7 @@ Source device → Read 4MB blocks → Sparse detection → Compress → Encrypt
└─ Zero blocks stored as STORE (near-zero overhead) └─ Zero blocks stored as STORE (near-zero overhead)
``` ```
Zupt reads the source device sequentially in 4MB chunks. Each block is checked for all-zero content (sparse detection uses 8-byte-wide comparison). Zero blocks are stored with codec `STORE` — effectively just the block header with no payload, saving both compression CPU time and archive space. Non-zero blocks are compressed with the selected codec and optionally encrypted. Per-block XXH64 checksums ensure byte-for-byte integrity on restore. VaptVupt reads the source device sequentially in 4MB chunks. Each block is checked for all-zero content (sparse detection uses 8-byte-wide comparison). Zero blocks are stored with codec `STORE` — effectively just the block header with no payload, saving both compression CPU time and archive space. Non-zero blocks are compressed with the selected codec and optionally encrypted. Per-block XXH64 checksums ensure byte-for-byte integrity on restore.
### Best practices ### Best practices
@ -426,16 +436,16 @@ Zupt reads the source device sequentially in 4MB chunks. Each block is checked f
**Operational guidance:** **Operational guidance:**
- **Unmount before backup** for filesystem consistency. For live systems, use LVM snapshots or filesystem freeze: `fsfreeze -f /mnt/data && zupt disk backup ... && fsfreeze -u /mnt/data`. - **Unmount before backup** for filesystem consistency. For live systems, use LVM snapshots or filesystem freeze: `fsfreeze -f /mnt/data && vaptvupt disk backup ... && fsfreeze -u /mnt/data`.
- **Block devices require root** on Linux. Regular files (disk images, `.img`, `.raw`) do not. - **Block devices require root** on Linux. Regular files (disk images, `.img`, `.raw`) do not.
- **Sparse-heavy disks** (freshly formatted, VMs with thin provisioning) compress extremely well — the sparse detector skips zero blocks at memory-copy speed with no compression overhead. - **Sparse-heavy disks** (freshly formatted, VMs with thin provisioning) compress extremely well — the sparse detector skips zero blocks at memory-copy speed with no compression overhead.
- **Verify after backup** with `zupt test archive.zupt` — checks every block's XXH64 checksum without extracting. - **Verify after backup** with `vaptvupt test archive.zupt` — checks every block's XXH64 checksum without extracting.
- **PQ encryption for long-term** — disk backups stored for years should use `--pq` to resist future quantum attacks. Generate one keypair, store the private key offline, distribute the public key. - **PQ encryption for long-term** — disk backups stored for years should use `--pq` to resist future quantum attacks. Generate one keypair, store the private key offline, distribute the public key.
- **Restore is non-destructive on files** — writing to a regular file creates/overwrites it. Writing to a block device overwrites the raw device. Double-check the target path before restoring to a device. - **Restore is non-destructive on files** — writing to a regular file creates/overwrites it. Writing to a block device overwrites the raw device. Double-check the target path before restoring to a device.
### Comparison with other tools ### Comparison with other tools
| Feature | Zupt disk | dd + gzip | Clonezilla | partclone | | Feature | VaptVupt disk | dd + gzip | Clonezilla | partclone |
|---------|-----------|-----------|------------|-----------| |---------|-----------|-----------|------------|-----------|
| Compression | VaptVupt/LZHP (adaptive) | gzip (fixed) | Multiple | Multiple | | Compression | VaptVupt/LZHP (adaptive) | gzip (fixed) | Multiple | Multiple |
| Encryption | AES-256 + PQ hybrid | None (pipe to gpg) | None | None | | Encryption | AES-256 + PQ hybrid | None (pipe to gpg) | None | None |
@ -449,7 +459,7 @@ Zupt reads the source device sequentially in 4MB chunks. Each block is checked f
## Multi-Architecture Support ## Multi-Architecture Support
Zupt builds and runs on all major architectures. The Makefile auto-detects the platform and enables the best available features. VaptVupt builds and runs on all major architectures. The Makefile auto-detects the platform and enables the best available features.
| Feature | x86_64 | aarch64 | armhf | ppc64le | s390x | riscv64 | | Feature | x86_64 | aarch64 | armhf | ppc64le | s390x | riscv64 |
|---------|--------|---------|-------|---------|-------|---------| |---------|--------|---------|-------|---------|-------|---------|
@ -470,10 +480,10 @@ make install DESTDIR=/buildroot
## Feature Comparison ## Feature Comparison
| Feature | Zupt v2.1 | gzip | zstd | 7-Zip | | Feature | VaptVupt v4.0 | gzip | zstd | 7-Zip |
|---------|-----------|------|------|-------| |---------|-----------|------|------|-------|
| Default codec | VaptVupt/LZHP (auto) | DEFLATE | FSE+Huffman | LZMA2 | | Default codec | VaptVupt/LZHP (auto) | DEFLATE | FSE+Huffman | LZMA2 |
| Full-disk backup | **`zupt disk`** | — | — | — | | Full-disk backup | **`vaptvupt disk`** | — | — | — |
| Post-quantum encryption | **ML-KEM-768** | — | — | — | | Post-quantum encryption | **ML-KEM-768** | — | — | — |
| Password encryption | AES-256 + HMAC | — | — | AES-256 | | Password encryption | AES-256 + HMAC | — | — | AES-256 |
| AES-NI hardware accel | **Jasmin-verified** | — | — | — | | AES-NI hardware accel | **Jasmin-verified** | — | — | — |
@ -507,7 +517,7 @@ Verification: 5 Jasmin CT proofs, 19 ACSL contracts, 16 NIST/RFC test vectors
**Audit history:** Three internal audit sprints conducted on the 2.2.x line. **Audit history:** Three internal audit sprints conducted on the 2.2.x line.
**14 bugs** found and fixed across the sprints — including one **HIGH-severity **14 bugs** found and fixed across the sprints — including one **HIGH-severity
Zip Slip path traversal** caught in the formal audit pass. Cumulative test Zip Slip path traversal** caught in the formal audit pass. Cumulative test
surface: **265 tests** (47 zupt + 169 SDK + 49 inherited) plus **751,000 surface: **265 tests** (47 vaptvupt + 169 SDK + 49 inherited) plus **751,000
mutation-fuzz iterations** under ASAN/UBSAN, all passing. No external audit mutation-fuzz iterations** under ASAN/UBSAN, all passing. No external audit
yet — see SECURITY.md for honest scope. yet — see SECURITY.md for honest scope.
@ -520,16 +530,16 @@ methodology used in audit sprints.
## Usage ## Usage
``` ```
zupt compress [OPTIONS] <output.zupt> <files/dirs...> vaptvupt compress [OPTIONS] <output.zupt> <files/dirs...>
zupt extract [OPTIONS] <archive.zupt> vaptvupt extract [OPTIONS] <archive.zupt>
zupt list [OPTIONS] <archive.zupt> vaptvupt list [OPTIONS] <archive.zupt>
zupt test [OPTIONS] <archive.zupt> vaptvupt test [OPTIONS] <archive.zupt>
zupt disk backup [OPTIONS] <output.zupt> <device_or_file> vaptvupt disk backup [OPTIONS] <output.zupt> <device_or_file>
zupt disk restore [OPTIONS] <archive.zupt> <target> vaptvupt disk restore [OPTIONS] <archive.zupt> <target>
zupt bench [--compare] <files/dirs...> vaptvupt bench [--compare] <files/dirs...>
zupt keygen [-o file] [--pub] [-k privkey] vaptvupt keygen [-o file] [--pub] [-k privkey]
zupt version vaptvupt version
zupt help vaptvupt help
``` ```
| Option | Description | | Option | Description |
@ -540,9 +550,9 @@ zupt help
| `--pq <keyfile>` | Post-quantum hybrid encryption | | `--pq <keyfile>` | Post-quantum hybrid encryption |
| `-o <DIR>` | Output directory (extract) | | `-o <DIR>` | Output directory (extract) |
| `-s` | Store without compression | | `-s` | Store without compression |
| `-f` | Fast LZ codec (Zupt-LZ) | | `-f` | Fast LZ codec (VaptVupt-LZ) |
| `--vv` | Force VaptVupt codec | | `--vv` | Force VaptVupt codec |
| `--lzhp` | Force Zupt-LZHP codec | | `--lzhp` | Force VaptVupt-LZHP codec |
| `-v` | Verbose | | `-v` | Verbose |
| `--solid` | Solid mode (cross-file LZ context) | | `--solid` | Solid mode (cross-file LZ context) |
| `--compare` | Codec comparison benchmark | | `--compare` | Codec comparison benchmark |
@ -565,9 +575,9 @@ build.bat # Windows (MSVC)
### Benchmark ### Benchmark
```bash ```bash
zupt bench ~/Documents/ # Per-level benchmark (levels 1-9) vaptvupt bench ~/Documents/ # Per-level benchmark (levels 1-9)
zupt bench --compare # Cross-codec comparison (auto-generates corpus) vaptvupt bench --compare # Cross-codec comparison (auto-generates corpus)
zupt bench --compare ~/Documents/ # Compare codecs on your own data vaptvupt bench --compare ~/Documents/ # Compare codecs on your own data
``` ```
--- ---
@ -577,12 +587,12 @@ zupt bench --compare ~/Documents/ # Compare codecs on your own data
| ID | Name | Algorithm | Default on | Override | | ID | Name | Algorithm | Default on | Override |
|----|------|-----------|------------|----------| |----|------|-----------|------------|----------|
| `0x0010` | **VaptVupt** | LZ77 + tANS + AVX2/NEON SIMD | x86_64 (AVX2), aarch64 (NEON) | `--vv` | | `0x0010` | **VaptVupt** | LZ77 + tANS + AVX2/NEON SIMD | x86_64 (AVX2), aarch64 (NEON) | `--vv` |
| `0x000A` | **Zupt-LZHP** | LZ77 + Huffman + byte prediction | armhf, ppc64le, s390x, riscv64 | `--lzhp` | | `0x000A` | **VaptVupt-LZHP** | LZ77 + Huffman + byte prediction | armhf, ppc64le, s390x, riscv64 | `--lzhp` |
| `0x0009` | Zupt-LZH | LZ77 + Huffman | — | — | | `0x0009` | VaptVupt-LZH | LZ77 + Huffman | — | — |
| `0x0008` | Zupt-LZ | Fast LZ77, 64KB window | — | `-f` | | `0x0008` | VaptVupt-LZ | Fast LZ77, 64KB window | — | `-f` |
| `0x0000` | Store | No compression | — | `-s` | | `0x0000` | Store | No compression | — | `-s` |
All codecs are forward-compatible: archives created with any codec can be read by any Zupt version that includes that codec, on any architecture. VaptVupt archives require Zupt v2.0+. All codecs are forward-compatible: archives created with any codec can be read by any VaptVupt version that includes that codec, on any architecture. VaptVupt archives require VaptVupt v2.0+.
--- ---
@ -599,12 +609,22 @@ All codecs are forward-compatible: archives created with any codec can be read b
| v2.0 | VaptVupt 1.1.0 codec, auto hardware detection, all 5 Jasmin wired, AVX SIGILL fix, copy_match/litlen fixes, ACSL, mlock, fuzzing, canaries, AES-NI pipeline, MT decompress, multi-arch (6 arches), --lzhp flag | | v2.0 | VaptVupt 1.1.0 codec, auto hardware detection, all 5 Jasmin wired, AVX SIGILL fix, copy_match/litlen fixes, ACSL, mlock, fuzzing, canaries, AES-NI pipeline, MT decompress, multi-arch (6 arches), --lzhp flag |
| v2.1.0 | VaptVupt 1.4.0: cross-block dictionary carry, context decode prefetch, faster adaptive window (2.6× encode), integration API | | v2.1.0 | VaptVupt 1.4.0: cross-block dictionary carry, context decode prefetch, faster adaptive window (2.6× encode), integration API |
| v2.1.1 | Termux/Android build fix, arch-safety guard, Keccak ROL64 UB fix, zero UBSan violations | | v2.1.1 | Termux/Android build fix, arch-safety guard, Keccak ROL64 UB fix, zero UBSan violations |
| v2.1.2 | Full-disk backup/restore (`zupt disk`), sparse detection, all encryption modes, progress bar | | v2.1.2 | Full-disk backup/restore (`disk` subcommand), sparse detection, all encryption modes, progress bar |
| v2.1.3 | LZHP prediction encoding fix (data corruption on structured data), shared write_enc_header, SOLID flag removed from disk, 78 tests | | v2.1.3 | LZHP prediction encoding fix (data corruption on structured data), shared write_enc_header, SOLID flag removed from disk, 78 tests |
| v2.1.4 | CodeQL: 4 security fixes — TOCTOU races eliminated (fstat on fd), X25519 scalar wipe via volatile | | v2.1.4 | CodeQL: 4 security fixes — TOCTOU races eliminated (fstat on fd), X25519 scalar wipe via volatile |
| v2.1.5 | Block-level deduplication (`--dedup`), XXH64 fingerprint index, DEDUP_REF block type, 81 tests | | v2.1.5 | Block-level deduplication (`--dedup`), XXH64 fingerprint index, DEDUP_REF block type, 81 tests |
| v2.2.0–v2.2.2 | libzuptsdk 2.0 integration (HKDF-SHA3 combiner + key commitment + HPKE binding + Argon2id), `--pq-sdk` mode (XChaCha20-Poly1305 / AES-256-SIV), license-hygiene cleanup, full SPDX coverage | | v2.2.0–v2.2.2 | libzuptsdk 2.0 integration (HKDF-SHA3 combiner + key commitment + HPKE binding + Argon2id), `--pq-sdk` mode (XChaCha20-Poly1305 / AES-256-SIV), license-hygiene cleanup, full SPDX coverage |
| **v2.2.3** | **VaptVupt 2.48.2 codec integration: cost-aware lazy parser (beats zstd-3 by 1.07% aggregate), 4-stream Huffman, `format_v2` flag (4–7% better binary), `compat_v246_5_decoder` flag, encoder memory hygiene (`vv_secure_zero` on free), Sprint 117 hardened-build compatibility. Wrapper defaults applied per upstream `ZUPT_INTEGRATION.md`: `checksum=0` (Zupt's outer MAC authenticates), `format_v2=1` for BALANCED/EXTREME (defensive guard against the upstream-untested `format_v2 + ULTRA_FAST` combo). Makefile arch-detection bug fixed (`x86-64` ≠ `x86_64` mismatch). 22/22 regression tests, 14/14 threaded, 10/10 PQ, 11/11 VaptVupt, 13/13 NIST vectors, ASAN/UBSAN clean across plain/password/PQ-SDK at all levels.** | | v2.2.3 | VaptVupt 2.48.2 codec integration: cost-aware lazy parser, 4-stream Huffman, `format_v2` flag (4–7% better binary), encoder memory hygiene (`vv_secure_zero` on free). Makefile arch-detection fix. ASAN/UBSAN clean across plain/password/PQ-SDK at all levels |
| v2.2.4–v2.2.5 | Audit sprint: findings F-01..F-07 closed, including F-06 (high) HMAC accept-on-disjoint-bits |
| v2.3.0–v2.3.1 | F-08/F-09 closed: archive-integrity trailer + preface-AAD MAC — exhaustive byte sweep 0/1827 undetected (format v1.5 → v1.6) |
| v2.4.x | Argon2id default KDF (F-10), error-message hygiene (F-11), encrypted archive comments (F-12), packaging arc (deb, RPM, AUR, Nix, Homebrew, openSUSE OBS), CI rewrite, THREAT_MODEL.md, manpage + shell completions, distro-safe `make check` |
| v3.0.0 | **Renamed Zupt → VaptVupt** (INPI Brasil trademark), VV codec 2.48.5, GUI binary-discovery fix. Wire format unchanged; `zupt` kept as compat symlink |
| v3.0.1–v3.0.3 | GUI license/version-parsing cleanup, F-13 (usage() literal size), static-analysis cleanup |
| v3.1.0 | Codec 2.48.5 → 2.53.3, decode over-copy fix |
| v3.2.0–v3.3.0 | SHA-256 hardware acceleration (Intel SHA-NI), incremental per-block HMAC (drops a malloc + full copy per block) |
| v3.4.0–v3.7.0 | F-15 KDF parameter transparency, measured constant-time MAC comparison (dudect), NIST SP 800-38A AES-CTR vectors, ML-KEM decaps routed through the audited CT primitive |
| v3.8.0 | Consolidated measured benchmarks + constant-time test robustness |
| **v4.0.0** | **Codec 2.60.4 security release (OOB heap write fixed in AVX2 decode fast path), `--pq-box` sealed-box mode (libpqvaptvupt 0.6.0, HKDF-SHA256 combiner), F-16 data-loss disclosure + fix (old in-tree BCJ encoder), CBMC-verified BCJ filters with auto ELF/PE/Mach-O detection, SHA-NI measured 5.8×. Wire format stays v1.6** |
See [CHANGELOG.md](CHANGELOG.md) for detailed per-version changes. See [CHANGELOG.md](CHANGELOG.md) for detailed per-version changes.
@ -612,13 +632,13 @@ See [CHANGELOG.md](CHANGELOG.md) for detailed per-version changes.
## License ## License
Zupt is **dual-licensed**: VaptVupt is **dual-licensed**:
- **AGPL-3.0-or-later** — most of the codebase (CLI, libzuptsdk, GUI, Jasmin source). See [`LICENSE`](LICENSE). - **AGPL-3.0-or-later** — most of the codebase (CLI, libzuptsdk, GUI, Jasmin source). See [`LICENSE`](LICENSE).
- **GPL-3.0-or-later** — the VaptVupt LZ codec only (`src/vv_*.c`, `src/vaptvupt_api.c` and headers). VaptVupt is GPL so it can be considered for upstreaming into the Linux/BSD kernels. - **GPL-3.0-or-later** — the VaptVupt LZ codec only (`src/vv_*.c`, `src/vaptvupt_api.c` and headers). VaptVupt is GPL so it can be considered for upstreaming into the Linux/BSD kernels.
- **Commercial license** available for relief from AGPL/GPL terms. Contact `sac@securityops.co`. - **Commercial license** available for relief from AGPL/GPL terms. Contact `sac@securityops.co`.
Every source file carries an explicit SPDX header. See [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) for full attribution. Zupt contains **no third-party source code** — every line is original work. Every source file carries an explicit SPDX header. See [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) for full attribution. VaptVupt contains **no third-party source code** — every line is original work.
Security vulnerabilities: see [SECURITY.md](SECURITY.md). Security vulnerabilities: see [SECURITY.md](SECURITY.md).
@ -626,14 +646,14 @@ Security vulnerabilities: see [SECURITY.md](SECURITY.md).
All by Cristian Cezar Moisés, hosted on git.securityops.co: All by Cristian Cezar Moisés, hosted on git.securityops.co:
- [zupt](https://git.securityops.co/cristiancmoises/zupt) — this repo (CLI + GUI) - [vaptvupt](https://git.securityops.co/cristiancmoises/vaptvupt) — this repo (CLI + GUI)
- [zupt-android](https://git.securityops.co/cristiancmoises/zupt-android) — Android port - [zupt-android](https://git.securityops.co/cristiancmoises/zupt-android) — Android port
- [zupt-web](https://git.securityops.co/cristiancmoises/zupt-web) — Web frontend - [zupt-web](https://git.securityops.co/cristiancmoises/zupt-web) — Web frontend
- [libzuptsdk](https://git.securityops.co/cristiancmoises/libzuptsdk) — Standalone C SDK - [libvuptsdk](https://git.securityops.co/cristiancmoises/libvuptsdk) — Standalone C SDK
- [vaptvupt](https://git.securityops.co/cristiancmoises/vaptvupt) — Standalone LZ + tANS codec - [vaptvupt-codec](https://git.securityops.co/cristiancmoises/vaptvupt-codec) — Standalone LZ + tANS codec
## Support the Project ## Support the Project
If you find Zupt useful, please consider sharing it or contributing — see the README footer for contact links. If you find VaptVupt useful, please consider sharing it or contributing — see the README footer for contact links.
--- ---
© 2026 Cristian Cezar Moisés — [git.securityops.co/cristiancmoises](https://git.securityops.co/cristiancmoises) © 2026 Cristian Cezar Moisés — [git.securityops.co/cristiancmoises](https://git.securityops.co/cristiancmoises)

14
ROADMAP.md
View file

@ -1,4 +1,4 @@
# Zupt — Roadmap # VaptVupt — Roadmap
## Released ## Released
@ -6,8 +6,8 @@
|---------|--------|-------------| |---------|--------|-------------|
| v0.1 | ✅ | Initial release — LZ77 compression, `.zupt` format, XXH64 checksums | | v0.1 | ✅ | Initial release — LZ77 compression, `.zupt` format, XXH64 checksums |
| v0.2 | ✅ | AES-256-CTR + HMAC-SHA256 encryption, PBKDF2, directory recursion | | v0.2 | ✅ | AES-256-CTR + HMAC-SHA256 encryption, PBKDF2, directory recursion |
| v0.3 | ✅ | Zupt-LZH codec — LZ77 + Huffman, 1MB window, near-optimal parsing | | v0.3 | ✅ | VaptVupt-LZH codec — LZ77 + Huffman, 1MB window, near-optimal parsing |
| v0.4 | ✅ | Byte prediction preprocessor (Zupt-LZHP), solid mode | | v0.4 | ✅ | Byte prediction preprocessor (VaptVupt-LZHP), solid mode |
| v0.5 | ✅ | Security hardening — 16 bug fixes, Huffman codec fix, CSPRNG hardened | | v0.5 | ✅ | Security hardening — 16 bug fixes, Huffman codec fix, CSPRNG hardened |
| v0.6 | ✅ | Multi-threaded compression (`-t N`), batch-parallel pipeline | | v0.6 | ✅ | Multi-threaded compression (`-t N`), batch-parallel pipeline |
| v0.7 | ✅ | Post-quantum hybrid encryption (ML-KEM-768 + X25519) | | v0.7 | ✅ | Post-quantum hybrid encryption (ML-KEM-768 + X25519) |
@ -33,10 +33,10 @@
| v2.4.0 | ✅ | Methodology release. `PROMPT.md` → v2: NEW §3.5 exhaustive byte-sweep mandate after format changes, sprint protocol gains a step, §11 outage table grows four rows for F-06..F-09. Makefile help banner now auto-derived from `include/zupt.h` (closes a recurring banner-drift bug). No source/binary changes; archives byte-identical to v2.3.1. | | v2.4.0 | ✅ | Methodology release. `PROMPT.md` → v2: NEW §3.5 exhaustive byte-sweep mandate after format changes, sprint protocol gains a step, §11 outage table grows four rows for F-06..F-09. Makefile help banner now auto-derived from `include/zupt.h` (closes a recurring banner-drift bug). No source/binary changes; archives byte-identical to v2.3.1. |
| v2.4.1 | ✅ | F-10: password-mode KDF default flipped from PBKDF2-SHA256 to Argon2id (libzuptsdk). PBKDF2 remains available via `--kdf pbkdf2` for v2.4.0-and-older reader compatibility. No format change; v2.4.0 already supports reading Argon2id archives via existing enc_type dispatch. F-11 (auth-fail vs integrity-fail error message UX) opened, deferred. | | v2.4.1 | ✅ | F-10: password-mode KDF default flipped from PBKDF2-SHA256 to Argon2id (libzuptsdk). PBKDF2 remains available via `--kdf pbkdf2` for v2.4.0-and-older reader compatibility. No format change; v2.4.0 already supports reading Argon2id archives via existing enc_type dispatch. F-11 (auth-fail vs integrity-fail error message UX) opened, deferred. |
| v2.4.2 | ✅ | F-11 closed: wrong-password and tampered-archive error messages collapsed into one uniform `Authentication failed (wrong key, wrong password, or tampered archive)` line. Detailed top-MAC wording moves behind `--verbose`. Plaintext tamper keeps detailed XXH64 wording (no key, no oracle concern). Eliminates a verbal probe-oracle that was leaking which failure cause hit first. No format change. | | v2.4.2 | ✅ | F-11 closed: wrong-password and tampered-archive error messages collapsed into one uniform `Authentication failed (wrong key, wrong password, or tampered archive)` line. Detailed top-MAC wording moves behind `--verbose`. Plaintext tamper keeps detailed XXH64 wording (no key, no oracle concern). Eliminates a verbal probe-oracle that was leaking which failure cause hit first. No format change. |
| v2.4.3 | ✅ | F-12 closed: encrypted archive comments. Implements the previously-reserved `comment_offset` header field via new block type `ZUPT_BLOCK_COMMENT = 0x05`. Comments are UTF-8, up to 4096 bytes, encrypted using the same per-block AEAD pipeline as data blocks (including F-09 preface AAD). `hdr.comment_offset` is in the AIT-signed region, so pointer tampering → auth-fail. CLI flags `-c` / `--comment` and `--comment-file`. `zupt info` reports presence without decrypting; `zupt x` displays comment after extract. v2.4.2 readers extract v2.4.3 archives byte-exact (they ignore `comment_offset`). Format still v1.6. Exhaustive byte sweep on 1878-byte archive with comment: 0/1878 silent accepts. | | v2.4.3 | ✅ | F-12 closed: encrypted archive comments. Implements the previously-reserved `comment_offset` header field via new block type `ZUPT_BLOCK_COMMENT = 0x05`. Comments are UTF-8, up to 4096 bytes, encrypted using the same per-block AEAD pipeline as data blocks (including F-09 preface AAD). `hdr.comment_offset` is in the AIT-signed region, so pointer tampering → auth-fail. CLI flags `-c` / `--comment` and `--comment-file`. `vaptvupt info` reports presence without decrypting; `vaptvupt x` displays comment after extract. v2.4.2 readers extract v2.4.3 archives byte-exact (they ignore `comment_offset`). Format still v1.6. Exhaustive byte sweep on 1878-byte archive with comment: 0/1878 silent accepts. |
| v2.4.4 | ✅ | Distribution packaging + reproducible source tarball. New `make dist` produces byte-identical `zupt-VERSION.tar.gz`; regression test `tests/test_dist_reproducible.sh` asserts two consecutive runs produce identical sha256. Upstream packaging recipes added at `packaging/aur/PKGBUILD`, `packaging/debian/{control,rules,changelog,copyright,source/format}`, and `packaging/homebrew/zupt.rb`. No source-code changes, no format changes. | | v2.4.4 | ✅ | Distribution packaging + reproducible source tarball. New `make dist` produces byte-identical `vaptvupt-VERSION.tar.gz`; regression test `tests/test_dist_reproducible.sh` asserts two consecutive runs produce identical sha256. Upstream packaging recipes added at `packaging/aur/PKGBUILD`, `packaging/debian/{control,rules,changelog,copyright,source/format}`, and `packaging/homebrew/vaptvupt.rb`. No source-code changes, no format changes. |
| v2.4.5 | ✅ | Packaging arc completion. New `packaging/rpm/zupt.spec` (Fedora/RHEL/CentOS) and `packaging/nix/flake.nix` (NixOS, x86_64 + aarch64). New `DISTRIBUTION.md` covers all 5 packaging methods with concrete submission flows. New `tests/test_packaging_syntax.sh` (18 assertions, wired into `make test`) enforces cross-recipe version consistency and basic syntax validity. No source-code changes. | | v2.4.5 | ✅ | Packaging arc completion. New `packaging/rpm/vaptvupt.spec` (Fedora/RHEL/CentOS) and `packaging/nix/flake.nix` (NixOS, x86_64 + aarch64). New `DISTRIBUTION.md` covers all 5 packaging methods with concrete submission flows. New `tests/test_packaging_syntax.sh` (18 assertions, wired into `make test`) enforces cross-recipe version consistency and basic syntax validity. No source-code changes. |
| v2.4.6 | ✅ | CI + threat model. Rewrote `.github/workflows/ci.yml` from 4 jobs to 8 (matrix builds, strict warnings, ASAN, PIE, aarch64, dist-reproducibility, packaging-syntax, tag-triggered release). New `THREAT_MODEL.md` (12 KB) documents what Zupt protects against and — explicitly per userPreferences — what it does NOT. Packaging-syntax test expanded 18 → 22. No source-code changes. | | v2.4.6 | ✅ | CI + threat model. Rewrote `.github/workflows/ci.yml` from 4 jobs to 8 (matrix builds, strict warnings, ASAN, PIE, aarch64, dist-reproducibility, packaging-syntax, tag-triggered release). New `THREAT_MODEL.md` (12 KB) documents what VaptVupt protects against and — explicitly per userPreferences — what it does NOT. Packaging-syntax test expanded 18 → 22. No source-code changes. |
| v2.4.7 | ✅ | Manpage refresh + shell completions. | | v2.4.7 | ✅ | Manpage refresh + shell completions. |
| v2.4.8 | ✅ | Distro-safe `make check` target + binary packages. | | v2.4.8 | ✅ | Distro-safe `make check` target + binary packages. |
| v3.0.0 | ✅ | MAJOR: Zupt → VaptVupt rename, VV codec 2.48.5, GUI binary-discovery fix. | | v3.0.0 | ✅ | MAJOR: Zupt → VaptVupt rename, VV codec 2.48.5, GUI binary-discovery fix. |

26
SECURITY.md
View file

@ -1,4 +1,4 @@
# Security Policy — Zupt # Security Policy — VaptVupt
## Reporting Vulnerabilities ## Reporting Vulnerabilities
@ -108,7 +108,7 @@ These functions are compiled from Jasmin source to x86-64 assembly. The Jasmin c
## Threat Model ## Threat Model
### What Zupt Protects ### What VaptVupt Protects
| Asset | Protection | | Asset | Protection |
|-------|-----------| |-------|-----------|
@ -123,7 +123,7 @@ These functions are compiled from Jasmin source to x86-64 assembly. The Jasmin c
| Against tampering of archive comment (when present) | v2.4.3 (F-12): comment block goes through the same per-block AEAD pipeline as data (AES-256-CTR + HMAC-SHA256 + preface AAD); `hdr.comment_offset` pointer is in the AIT-signed region. Both payload and pointer are MAC-covered end-to-end. | | Against tampering of archive comment (when present) | v2.4.3 (F-12): comment block goes through the same per-block AEAD pipeline as data (AES-256-CTR + HMAC-SHA256 + preface AAD); `hdr.comment_offset` pointer is in the AIT-signed region. Both payload and pointer are MAC-covered end-to-end. |
| Against quantum adversary | `--pq` mode: ML-KEM-768 (NIST Level 3) | | Against quantum adversary | `--pq` mode: ML-KEM-768 (NIST Level 3) |
### What Zupt Does NOT Protect Against ### What VaptVupt Does NOT Protect Against
| Threat | Reason | Mitigation Path | | Threat | Reason | Mitigation Path |
|--------|--------|----------------| |--------|--------|----------------|
@ -132,7 +132,7 @@ These functions are compiled from Jasmin source to x86-64 assembly. The Jasmin c
| Memory forensics during operation | Keys on stack during compress/extract | `zupt_secure_wipe()` on completion; `mlock()` planned | | Memory forensics during operation | Keys on stack during compress/extract | `zupt_secure_wipe()` on completion; `mlock()` planned |
| Deniability | Archive header identifies format | `.zupt` magic bytes visible; ENCRYPTED flag in header | | Deniability | Archive header identifies format | `.zupt` magic bytes visible; ENCRYPTED flag in header |
| Weak passwords | Argon2id (default, v2.4.1+) is memory-hard and adds ~25–30 bits of work factor vs ~20 for PBKDF2. PBKDF2-SHA256 with 600k iterations available via `--kdf pbkdf2` for legacy reader compatibility. | Use `--pq` or `--pq-sdk` mode for critical data — keys are random, not derived from a password. | | Weak passwords | Argon2id (default, v2.4.1+) is memory-hard and adds ~25–30 bits of work factor vs ~20 for PBKDF2. PBKDF2-SHA256 with 600k iterations available via `--kdf pbkdf2` for legacy reader compatibility. | Use `--pq` or `--pq-sdk` mode for critical data — keys are random, not derived from a password. |
| Traffic analysis | Archive size reveals data volume | Outside Zupt's scope | | Traffic analysis | Archive size reveals data volume | Outside VaptVupt's scope |
| File permission/ownership | Not stored in archive | Documented in README.md (Architecture & platform support) | | File permission/ownership | Not stored in archive | Documented in README.md (Architecture & platform support) |
### Quantum Threat Analysis ### Quantum Threat Analysis
@ -156,7 +156,7 @@ In `--pq` mode: even if Shor's algorithm breaks X25519, ML-KEM-768 protects the
| macOS | `/dev/urandom` | None | **Hard exit** | | macOS | `/dev/urandom` | None | **Hard exit** |
| Windows | `RtlGenRandom` | None | **Hard exit** | | Windows | `RtlGenRandom` | None | **Hard exit** |
There is no `rand()`, `srand()`, or any weak PRNG fallback anywhere in the codebase. If the OS CSPRNG is unavailable, Zupt exits with an error. This is a deliberate design choice — weak random keys are worse than no encryption. There is no `rand()`, `srand()`, or any weak PRNG fallback anywhere in the codebase. If the OS CSPRNG is unavailable, VaptVupt exits with an error. This is a deliberate design choice — weak random keys are worse than no encryption.
--- ---
@ -202,7 +202,7 @@ make test-asan # Zero ASAN/UBSAN errors
make test-vectors && ./test_vectors # 13/13 pass make test-vectors && ./test_vectors # 13/13 pass
# Verify Jasmin symbols are active # Verify Jasmin symbols are active
nm zupt | grep "zupt_mac_verify_ct\|zupt_ct_select_32" nm vaptvupt | grep "zupt_mac_verify_ct\|zupt_ct_select_32"
# Expected: T zupt_mac_verify_ct # Expected: T zupt_mac_verify_ct
# T zupt_ct_select_32 # T zupt_ct_select_32
@ -217,7 +217,7 @@ jasminc -arch x86-64 -o /dev/null jasmin/zupt_mlkem_select.jazz
## Production deployment notes (v2.2.1) ## Production deployment notes (v2.2.1)
Zupt is deployed in production environments. The following supported VaptVupt is deployed in production environments. The following supported
configurations are considered current and receive security fixes: configurations are considered current and receive security fixes:
| Channel | Supported | Notes | | Channel | Supported | Notes |
@ -232,9 +232,9 @@ configurations are considered current and receive security fixes:
For new archives, use the libzuptsdk-backed mode: For new archives, use the libzuptsdk-backed mode:
```bash ```bash
zupt keygen --sdk -o key.priv vaptvupt keygen --sdk -o key.priv
zupt c --pq-sdk key.priv.pub backup.zupt /path/to/data vaptvupt c --pq-sdk key.priv.pub backup.zupt /path/to/data
zupt x --pq-sdk key.priv backup.zupt vaptvupt x --pq-sdk key.priv backup.zupt
``` ```
This selects: This selects:
@ -250,7 +250,7 @@ This selects:
### Threat model ### Threat model
Zupt assumes: VaptVupt assumes:
- The recipient's private key file is kept secret and is not exfiltrated. - The recipient's private key file is kept secret and is not exfiltrated.
- The execution environment has a working `getrandom(2)` / `/dev/urandom`. - The execution environment has a working `getrandom(2)` / `/dev/urandom`.
@ -259,7 +259,7 @@ Zupt assumes:
- An attacker may have full write access to the archive in transit; AEAD - An attacker may have full write access to the archive in transit; AEAD
+ commitment + HPKE binding ensures any modification is detected. + commitment + HPKE binding ensures any modification is detected.
Zupt does **not** defend against: VaptVupt does **not** defend against:
- Endpoint compromise (keylogger, malware on the machine where you type - Endpoint compromise (keylogger, malware on the machine where you type
the password or hold the private key). the password or hold the private key).
@ -274,7 +274,7 @@ If you find a security issue:
1. **Do not** open a public issue on the project's git server. 1. **Do not** open a public issue on the project's git server.
2. Email `zupt@riseup.net` with subject `SECURITY: <brief>`. 2. Email `zupt@riseup.net` with subject `SECURITY: <brief>`.
3. Include the version (`zupt --version`), platform, and a 3. Include the version (`vaptvupt --version`), platform, and a
reproduction (a minimal archive or a code snippet). reproduction (a minimal archive or a code snippet).
4. Expect acknowledgement within 7 days. Coordinated disclosure 4. Expect acknowledgement within 7 days. Coordinated disclosure
timeline will be discussed case by case. timeline will be discussed case by case.

32
THIRD-PARTY-NOTICES.md
View file

@ -1,12 +1,12 @@
THIRD-PARTY NOTICES THIRD-PARTY NOTICES
=================== ===================
**Zupt contains no third-party source code.** Every line of source in **VaptVupt contains no third-party source code.** Every line of source in
this repository is the work of Cristian Cezar Moisés. This document this repository is the work of Cristian Cezar Moisés. This document
exists for transparency about runtime dependencies and build-time exists for transparency about runtime dependencies and build-time
tools. tools.
If you redistribute Zupt, you must preserve this attribution document If you redistribute VaptVupt, you must preserve this attribution document
along with the LICENSE file. along with the LICENSE file.
------------------------------------------------------------------------- -------------------------------------------------------------------------
@ -15,20 +15,20 @@ Components shipped in this repository (all original work)
| Component | Location | License | Author | | Component | Location | License | Author |
|---|---|---|---| |---|---|---|---|
| zupt CLI | src/, include/ | AGPL-3.0-or-later | Cristian Cezar Moisés | | vaptvupt CLI | src/, include/ | AGPL-3.0-or-later | Cristian Cezar Moisés |
| libzuptsdk | sdk/, vendor/zuptsdk/include/ | AGPL-3.0-or-later | Cristian Cezar Moisés | | libzuptsdk | sdk/, vendor/zuptsdk/include/ | AGPL-3.0-or-later | Cristian Cezar Moisés |
| VaptVupt LZ codec | src/vv_*.c, src/vaptvupt_api.c, include/vaptvupt*.h | **GPL-3.0-or-later** | Cristian Cezar Moisés | | VaptVupt LZ codec | src/vv_*.c, src/vaptvupt_api.c, include/vaptvupt*.h | **GPL-3.0-or-later** | Cristian Cezar Moisés |
| Jasmin constant-time crypto | jasmin/*.jazz, jasmin/*.s | AGPL-3.0-or-later | Cristian Cezar Moisés | | Jasmin constant-time crypto | jasmin/*.jazz, jasmin/*.s | AGPL-3.0-or-later | Cristian Cezar Moisés |
| Zupt GUI (Python) | gui/ | AGPL-3.0-or-later | Cristian Cezar Moisés | | VaptVupt GUI (Python) | gui/ | AGPL-3.0-or-later | Cristian Cezar Moisés |
**Note on VaptVupt licensing**: VaptVupt is licensed GPL-3.0-or-later **Note on VaptVupt licensing**: VaptVupt is licensed GPL-3.0-or-later
(not AGPL like the rest of Zupt) so that, with sufficient maturity, it (not AGPL like the rest of VaptVupt) so that, with sufficient maturity, it
can be considered for upstreaming into the Linux or BSD kernels, which can be considered for upstreaming into the Linux or BSD kernels, which
require GPL-compatible licenses. The author retains the right to dual- require GPL-compatible licenses. The author retains the right to dual-
license VaptVupt under other terms for commercial use; contact license VaptVupt under other terms for commercial use; contact
sac@securityops.co for inquiries. sac@securityops.co for inquiries.
The rest of the project (zupt CLI, libzuptsdk, Jasmin source, GUI) is The rest of the project (vaptvupt CLI, libzuptsdk, Jasmin source, GUI) is
licensed AGPL-3.0-or-later. Commercial licenses (relief from AGPL licensed AGPL-3.0-or-later. Commercial licenses (relief from AGPL
network-use clause) are available; contact sac@securityops.co. network-use clause) are available; contact sac@securityops.co.
@ -40,12 +40,12 @@ Build-time tool (not redistributed)
The constant-time cryptographic primitives in jasmin/*.jazz are The constant-time cryptographic primitives in jasmin/*.jazz are
compiled to native assembly (jasmin/*.s) using the external `jasminc` compiled to native assembly (jasmin/*.s) using the external `jasminc`
compiler. The jasminc tool is not bundled with Zupt; the AGPL .jazz compiler. The jasminc tool is not bundled with VaptVupt; the AGPL .jazz
source files and their AGPL-licensed .s assembly output are bundled. source files and their AGPL-licensed .s assembly output are bundled.
Upstream: https://github.com/jasmin-lang/jasmin Upstream: https://github.com/jasmin-lang/jasmin
License: MIT (the compiler itself; not relevant to Zupt's licensing) License: MIT (the compiler itself; not relevant to VaptVupt's licensing)
Used by: Zupt's build system, only when re-generating jasmin/*.s Used by: VaptVupt's build system, only when re-generating jasmin/*.s
from jasmin/*.jazz (most users won't need to do this — from jasmin/*.jazz (most users won't need to do this —
pre-built .s files ship in this repo). pre-built .s files ship in this repo).
@ -55,7 +55,7 @@ Runtime system libraries (linked from the OS, never bundled)
These are standard system libraries provided by the operating system's These are standard system libraries provided by the operating system's
package manager (apt, dnf, pacman, etc.). They are dynamically linked package manager (apt, dnf, pacman, etc.). They are dynamically linked
at runtime and are NOT redistributed as part of Zupt. at runtime and are NOT redistributed as part of VaptVupt.
**libargon2** — Argon2id password hashing function (RFC 9106) **libargon2** — Argon2id password hashing function (RFC 9106)
@ -79,7 +79,7 @@ at runtime and are NOT redistributed as part of Zupt.
Compatibility with public standards Compatibility with public standards
------------------------------------------------------------------------- -------------------------------------------------------------------------
Where Zupt implements public standards, it does so independently Where VaptVupt implements public standards, it does so independently
from any reference implementation. No code has been copied from from any reference implementation. No code has been copied from
external projects. Standards followed: external projects. Standards followed:
@ -94,16 +94,16 @@ external projects. Standards followed:
- RFC 9106 (Argon2) - RFC 9106 (Argon2)
- RFC 9180 (HPKE) - RFC 9180 (HPKE)
The Zupt project was designed independently. Other projects in the The VaptVupt project was designed independently. Other projects in the
post-quantum hybrid encryption space (libsodium, age, Tink, rustls, post-quantum hybrid encryption space (libsodium, age, Tink, rustls,
etc.) were referenced as prior art during design but no code was etc.) were referenced as prior art during design but no code was
copied. Zupt does not include any code from these projects. copied. VaptVupt does not include any code from these projects.
------------------------------------------------------------------------- -------------------------------------------------------------------------
Reporting attribution issues Reporting attribution issues
------------------------------------------------------------------------- -------------------------------------------------------------------------
If you believe Zupt redistributes code from a project not listed here, If you believe VaptVupt redistributes code from a project not listed here,
or if attribution information is incomplete, please email: or if attribution information is incomplete, please email:
sac@securityops.co sac@securityops.co
@ -114,8 +114,8 @@ with the subject "[third-party]" and details of the issue.
License summary License summary
------------------------------------------------------------------------- -------------------------------------------------------------------------
Zupt CLI, libzuptsdk, Jasmin source, GUI: AGPL-3.0-or-later VaptVupt CLI, libzuptsdk, Jasmin source, GUI: AGPL-3.0-or-later
VaptVupt LZ codec: GPL-3.0-or-later VaptVupt LZ codec: GPL-3.0-or-later
Commercial license (any component): contact sac@securityops.co Commercial license (any component): contact sac@securityops.co
Project home: https://git.securityops.co/cristiancmoises/zupt Project home: https://git.securityops.co/cristiancmoises/vaptvupt

42
THREAT_MODEL.md
View file

@ -1,21 +1,21 @@
# Zupt threat model # VaptVupt threat model
Plain-English description of what Zupt protects against, what it Plain-English description of what VaptVupt protects against, what it
doesn't, and what assumptions you're making when you use it. doesn't, and what assumptions you're making when you use it.
This document is for users and downstream packagers. Read it before This document is for users and downstream packagers. Read it before
trusting Zupt with anything you can't afford to lose. trusting VaptVupt with anything you can't afford to lose.
--- ---
## TL;DR ## TL;DR
Zupt is designed for **at-rest backup encryption** by someone who VaptVupt is designed for **at-rest backup encryption** by someone who
controls the machine doing the encryption and the machine doing the controls the machine doing the encryption and the machine doing the
extraction. It is **not** a network protocol, a multi-party scheme, or extraction. It is **not** a network protocol, a multi-party scheme, or
a substitute for full-disk encryption. a substitute for full-disk encryption.
| Use case | Zupt is appropriate? | | Use case | VaptVupt is appropriate? |
|---|---| |---|---|
| Backing up files to an untrusted cloud (S3, Backblaze, Google Drive) | **Yes** | | Backing up files to an untrusted cloud (S3, Backblaze, Google Drive) | **Yes** |
| Backing up a disk image to external media you might lose | **Yes** | | Backing up a disk image to external media you might lose | **Yes** |
@ -28,7 +28,7 @@ a substitute for full-disk encryption.
--- ---
## What Zupt protects against ## What VaptVupt protects against
### 1. Confidentiality of archive contents (encrypted mode) ### 1. Confidentiality of archive contents (encrypted mode)
@ -109,14 +109,14 @@ accesses where feasible — but **without formal proof**.
--- ---
## What Zupt does NOT protect against ## What VaptVupt does NOT protect against
This list is **exhaustive of the major omissions** — if you have a This list is **exhaustive of the major omissions** — if you have a
concern that doesn't appear here, please file an issue. concern that doesn't appear here, please file an issue.
### 1. Compromised endpoints ### 1. Compromised endpoints
Zupt cannot protect against: VaptVupt cannot protect against:
- Malware on the machine doing the encryption (it sees plaintext - Malware on the machine doing the encryption (it sees plaintext
before any crypto is applied) before any crypto is applied)
@ -127,14 +127,14 @@ Zupt cannot protect against:
`~/.zupt-key` directly `~/.zupt-key` directly
- Cold-boot attacks on running machines - Cold-boot attacks on running machines
If you don't trust the machine, Zupt cannot help. If you don't trust the machine, VaptVupt cannot help.
### 2. Key compromise ### 2. Key compromise
If the password or `~/.zupt-key` is leaked: If the password or `~/.zupt-key` is leaked:
- All archives encrypted with that key are decryptable - All archives encrypted with that key are decryptable
- Zupt has **no forward secrecy across archives** — each archive - VaptVupt has **no forward secrecy across archives** — each archive
is encrypted under a single static key derived from the password is encrypted under a single static key derived from the password
or stored in the key file or stored in the key file
- There is no key-rotation feature; rotate by re-encrypting - There is no key-rotation feature; rotate by re-encrypting
@ -160,7 +160,7 @@ clusters or cloud compute.
| Random 16-char with full alphabet | Infeasible without quantum breakthrough | | Random 16-char with full alphabet | Infeasible without quantum breakthrough |
For critical data, use `--pq-sdk` mode with a random key file For critical data, use `--pq-sdk` mode with a random key file
generated by `zupt keygen --sdk` — the key is 64 bytes of CSPRNG generated by `vaptvupt keygen --sdk` — the key is 64 bytes of CSPRNG
output, not derived from human-typed text. output, not derived from human-typed text.
### 4. Metadata leakage from archive structure ### 4. Metadata leakage from archive structure
@ -180,13 +180,13 @@ can infer:
- **A random 16-byte UUID per archive** (no information leak, but - **A random 16-byte UUID per archive** (no information leak, but
globally identifies the archive across copies) globally identifies the archive across copies)
If metadata privacy matters, layer Zupt under another tool that If metadata privacy matters, layer VaptVupt under another tool that
hides bulk metadata (e.g., put the `.zupt` file inside a fixed-size hides bulk metadata (e.g., put the `.zupt` file inside a fixed-size
encrypted container). encrypted container).
### 5. Network attacks ### 5. Network attacks
Zupt is not a network protocol. There is no: VaptVupt is not a network protocol. There is no:
- Forward-secure session establishment (use TLS or Noise) - Forward-secure session establishment (use TLS or Noise)
- Mutual authentication of remote parties (use signed messages or - Mutual authentication of remote parties (use signed messages or
@ -205,9 +205,9 @@ they must share the password or the key file.
### 7. Plausible deniability / hidden volumes ### 7. Plausible deniability / hidden volumes
Zupt archives have a fixed 6-byte magic `\x90\x5a\x55\x50\x54\x01` VaptVupt archives have a fixed 6-byte magic `\x90\x5a\x55\x50\x54\x01`
at offset 0. Anyone scanning the bytes can see it's a Zupt at offset 0. Anyone scanning the bytes can see it's a VaptVupt
archive. Zupt has **no hidden-volume or duress-password feature**. archive. VaptVupt has **no hidden-volume or duress-password feature**.
### 8. Side channels we don't claim to address ### 8. Side channels we don't claim to address
@ -241,7 +241,7 @@ primary mitigation; report bugs.
### 11. Compression-side-channel attacks (CRIME / BREACH style) ### 11. Compression-side-channel attacks (CRIME / BREACH style)
Zupt compresses **before** encryption. If an attacker can: VaptVupt compresses **before** encryption. If an attacker can:
- Influence part of the plaintext (e.g. inject a known prefix) - Influence part of the plaintext (e.g. inject a known prefix)
- Observe the resulting archive size precisely - Observe the resulting archive size precisely
@ -250,7 +250,7 @@ then they can use the compression ratio to learn information about
the rest of the plaintext — this is the classic CRIME/BREACH attack the rest of the plaintext — this is the classic CRIME/BREACH attack
against TLS compression. against TLS compression.
Zupt is designed for offline backup, where attacker-controlled VaptVupt is designed for offline backup, where attacker-controlled
plaintext injection is rare. **If your threat model includes plaintext injection is rare. **If your threat model includes
attacker-chosen plaintext mixed with secret plaintext in the same attacker-chosen plaintext mixed with secret plaintext in the same
archive**, use `--no-compress` (codec 0 = STORE) to disable the archive**, use `--no-compress` (codec 0 = STORE) to disable the
@ -260,7 +260,7 @@ LZ codec and eliminate this side channel.
## Cryptographic assumptions ## Cryptographic assumptions
Zupt's security rests on the following standard assumptions: VaptVupt's security rests on the following standard assumptions:
| Assumption | What breaks if it fails | | Assumption | What breaks if it fails |
|---|---| |---|---|
@ -272,7 +272,7 @@ Zupt's security rests on the following standard assumptions:
| HKDF-SHA256 is a secure key-derivation construction | Combined PQ + classical keys may be predictable | | HKDF-SHA256 is a secure key-derivation construction | Combined PQ + classical keys may be predictable |
| SHA3 / SHAKE retain pre-image and collision resistance | Auxiliary protocol bindings may be forged | | SHA3 / SHAKE retain pre-image and collision resistance | Auxiliary protocol bindings may be forged |
If you don't trust one of these primitives, Zupt cannot protect If you don't trust one of these primitives, VaptVupt cannot protect
you. We rely on the same primitives the broader cryptographic you. We rely on the same primitives the broader cryptographic
community has standardized. community has standardized.
@ -280,7 +280,7 @@ community has standardized.
## Reporting security issues ## Reporting security issues
Email `sac@securityops.co` with the subject `Zupt security report`. Email `sac@securityops.co` with the subject `VaptVupt security report`.
PGP key available on request. PGP key available on request.
We will: We will:

127
doc/vaptvupt-gui.1 Normal file
View file

@ -0,0 +1,127 @@
.\" Manpage for vaptvupt-gui (formerly zupt-gui; INPI Brasil trademark rename in v3.0.0)
.\" SPDX-License-Identifier: AGPL-3.0-or-later
.\" Copyright (c) 2025-2026 Cristian Cezar Moisés
.TH VAPTVUPT-GUI 1 "2026-06-11" "vaptvupt-gui 1.3.0" "User Commands"
.SH NAME
vaptvupt-gui \- graphical interface for the VaptVupt post-quantum backup utility
.SH SYNOPSIS
.B vaptvupt-gui
.RI [ ARCHIVE ]
.SH DESCRIPTION
.B vaptvupt-gui
is a graphical frontend for
.BR vaptvupt (1).
It provides tabs for compression, extraction, key management, and
full-disk backup. Both PQ encryption modes are exposed:
.B legacy --pq
and
.B SDK v2 --pq-sdk
(HKDF combiner, key commitment, HPKE binding, Argon2id).
The legacy command name
.B zupt-gui
is preserved as a symlink for backward compatibility; both invocations
behave identically.
If
.I ARCHIVE
is given on the command line, the GUI opens directly on the
extract tab with that archive preloaded.
.B vaptvupt-gui
uses Qt 6. It works with either of the following Python Qt bindings,
auto-detected at startup in this order:
.IP \(bu 2
PySide6 (Qt for Python)
.IP \(bu 2
PyQt6
.PP
If neither is installed, the GUI prints an instructive error and exits.
.SH TABS
.TP
.B Compress
Select files or directories, choose codec, level, password and/or PQ
key. The
.B Mode
panel controls whether the SDK v2 path or the legacy path is used.
.TP
.B Extract
Open a .zupt archive, select output directory, provide password
and/or PQ private key.
.TP
.B Keygen
Generate ML-KEM-768 + X25519 keypair. The
.B SDK v2 format
checkbox controls whether the keypair is generated via
.B vaptvupt keygen --sdk
(producing
.IR file
and
.IR file.pub
in one step) or via the legacy
.BR "vaptvupt keygen" .
.TP
.B Disk
Full-disk backup and restore. Enumerates block devices with
human-readable sizes. Same encryption mode controls as Compress.
.SH FILES
.TP
.I /usr/bin/vaptvupt-gui
Wrapper script that invokes the Python entry point (and the symlinked
legacy
.IR /usr/bin/zupt-gui ).
.TP
.I /usr/lib/vaptvupt-gui/zupt_gui.py
Main Python source.
.TP
.I /usr/share/applications/vaptvupt-gui.desktop
Desktop entry for menu integration.
.TP
.I /usr/share/icons/hicolor/256x256/apps/vaptvupt-gui.png
Application icon.
.SH ENVIRONMENT
.TP
.B VAPTVUPT_BIN
Override the path to the
.B vaptvupt
binary (default: search
.IR PATH ).
The legacy name
.B ZUPT_BIN
is also honoured.
.TP
.B VAPTVUPT_DEBUG
Enable binary-discovery debug logging on stderr. The legacy name
.B ZUPT_DEBUG
is also honoured.
.SH BUGS
Report at
.UR https://git.securityops.co/cristiancmoises/vaptvupt/issues
.UE .
.SH AUTHOR
Cristian Cezar Moisés
.MT zupt@riseup.net
.ME
.SH SEE ALSO
.BR vaptvupt (1).
.SH LICENSE
.PP
vaptvupt-gui is licensed under the
.B GNU Affero General Public License version 3 or later
(AGPL-3.0-or-later). Commercial license available for relief from
copyleft terms; contact
.MT sac@securityops.co
.ME .
.SH PROJECT
.PP
Home page:
.UR https://git.securityops.co/cristiancmoises/vaptvupt
.UE

10
doc/vaptvupt.1
View file

@ -197,9 +197,9 @@ extreme (optimal parsing, ~5\(en10\(mu slower encode, best ratio).
.B --codec \fIid\fR .B --codec \fIid\fR
Force a specific codec by id. Accepted values: Force a specific codec by id. Accepted values:
.BR store " (0x0000), " .BR store " (0x0000), "
.BR zupt-lz " (0x0008), " .BR vaptvupt-lz " (0x0008), "
.BR zupt-lzh " (0x0009), " .BR vaptvupt-lzh " (0x0009), "
.BR zupt-lzhp " (0x000A), " .BR vaptvupt-lzhp " (0x000A), "
.BR vaptvupt " (0x0010 — default), " .BR vaptvupt " (0x0010 — default), "
.BR auto " (0xFFFF — pick at runtime)." .BR auto " (0xFFFF — pick at runtime)."
@ -588,7 +588,7 @@ in the source distribution.
Cristian Cezar Moisés <zupt@riseup.net> — primary author and maintainer. Cristian Cezar Moisés <zupt@riseup.net> — primary author and maintainer.
.SH BUGS .SH BUGS
Report bugs at https://git.securityops.co/cristiancmoises/zupt/issues Report bugs at https://git.securityops.co/cristiancmoises/vaptvupt/issues
or by email to <zupt@riseup.net>. or by email to <zupt@riseup.net>.
.SH LICENSE .SH LICENSE
@ -605,7 +605,7 @@ available from <sac@securityops.co>.
.BR cryptsetup (8), .BR cryptsetup (8),
.BR jasminc (1). .BR jasminc (1).
.PP .PP
Project home: https://git.securityops.co/cristiancmoises/zupt Project home: https://git.securityops.co/cristiancmoises/vaptvupt
.br .br
Threat model: see Threat model: see
.B THREAT_MODEL.md .B THREAT_MODEL.md

56
doc/zupt-gui.1
View file

@ -1,13 +1,16 @@
.TH ZUPT-GUI 1 "2026-04-27" "zupt-gui 1.1.1" "User Commands" .\" Manpage for vaptvupt-gui (formerly zupt-gui; INPI Brasil trademark rename in v3.0.0)
.\" SPDX-License-Identifier: AGPL-3.0-or-later
.\" Copyright (c) 2025-2026 Cristian Cezar Moisés
.TH VAPTVUPT-GUI 1 "2026-06-11" "vaptvupt-gui 1.3.0" "User Commands"
.SH NAME .SH NAME
zupt-gui \- graphical interface for the Zupt post-quantum backup utility vaptvupt-gui \- graphical interface for the VaptVupt post-quantum backup utility
.SH SYNOPSIS .SH SYNOPSIS
.B zupt-gui .B vaptvupt-gui
.RI [ ARCHIVE ] .RI [ ARCHIVE ]
.SH DESCRIPTION .SH DESCRIPTION
.B zupt-gui .B vaptvupt-gui
is a graphical frontend for is a graphical frontend for
.BR zupt (1). .BR vaptvupt (1).
It provides tabs for compression, extraction, key management, and It provides tabs for compression, extraction, key management, and
full-disk backup. Both PQ encryption modes are exposed: full-disk backup. Both PQ encryption modes are exposed:
.B legacy --pq .B legacy --pq
@ -15,12 +18,17 @@ and
.B SDK v2 --pq-sdk .B SDK v2 --pq-sdk
(HKDF combiner, key commitment, HPKE binding, Argon2id). (HKDF combiner, key commitment, HPKE binding, Argon2id).
The legacy command name
.B zupt-gui
is preserved as a symlink for backward compatibility; both invocations
behave identically.
If If
.I ARCHIVE .I ARCHIVE
is given on the command line, the GUI opens directly on the is given on the command line, the GUI opens directly on the
extract tab with that archive preloaded. extract tab with that archive preloaded.
.B zupt-gui .B vaptvupt-gui
uses Qt 6. It works with either of the following Python Qt bindings, uses Qt 6. It works with either of the following Python Qt bindings,
auto-detected at startup in this order: auto-detected at startup in this order:
.IP \(bu 2 .IP \(bu 2
@ -46,13 +54,13 @@ and/or PQ private key.
Generate ML-KEM-768 + X25519 keypair. The Generate ML-KEM-768 + X25519 keypair. The
.B SDK v2 format .B SDK v2 format
checkbox controls whether the keypair is generated via checkbox controls whether the keypair is generated via
.B zupt keygen --sdk .B vaptvupt keygen --sdk
(producing (producing
.IR file .IR file
and and
.IR file.pub .IR file.pub
in one step) or via the legacy in one step) or via the legacy
.BR "zupt keygen" . .BR "vaptvupt keygen" .
.TP .TP
.B Disk .B Disk
Full-disk backup and restore. Enumerates block devices with Full-disk backup and restore. Enumerates block devices with
@ -60,29 +68,39 @@ human-readable sizes. Same encryption mode controls as Compress.
.SH FILES .SH FILES
.TP .TP
.I /usr/bin/zupt-gui .I /usr/bin/vaptvupt-gui
Wrapper script that invokes the Python entry point. Wrapper script that invokes the Python entry point (and the symlinked
legacy
.IR /usr/bin/zupt-gui ).
.TP .TP
.I /usr/lib/zupt-gui/zupt_gui.py .I /usr/lib/vaptvupt-gui/zupt_gui.py
Main Python source. Main Python source.
.TP .TP
.I /usr/share/applications/zupt-gui.desktop .I /usr/share/applications/vaptvupt-gui.desktop
Desktop entry for menu integration. Desktop entry for menu integration.
.TP .TP
.I /usr/share/icons/hicolor/256x256/apps/zupt-gui.png .I /usr/share/icons/hicolor/256x256/apps/vaptvupt-gui.png
Application icon. Application icon.
.SH ENVIRONMENT .SH ENVIRONMENT
.TP .TP
.B ZUPT_BINARY .B VAPTVUPT_BIN
Override the path to the Override the path to the
.B zupt .B vaptvupt
binary (default: search binary (default: search
.IR PATH ). .IR PATH ).
The legacy name
.B ZUPT_BIN
is also honoured.
.TP
.B VAPTVUPT_DEBUG
Enable binary-discovery debug logging on stderr. The legacy name
.B ZUPT_DEBUG
is also honoured.
.SH BUGS .SH BUGS
Report at Report at
.UR https://git.securityops.co/cristiancmoises/zupt/issues .UR https://git.securityops.co/cristiancmoises/vaptvupt/issues
.UE . .UE .
.SH AUTHOR .SH AUTHOR
@ -91,11 +109,11 @@ Cristian Cezar Moisés
.ME .ME
.SH SEE ALSO .SH SEE ALSO
.BR zupt (1). .BR vaptvupt (1).
.SH LICENSE .SH LICENSE
.PP .PP
zupt-gui is licensed under the vaptvupt-gui is licensed under the
.B GNU Affero General Public License version 3 or later .B GNU Affero General Public License version 3 or later
(AGPL-3.0-or-later). Commercial license available for relief from (AGPL-3.0-or-later). Commercial license available for relief from
copyleft terms; contact copyleft terms; contact
@ -105,5 +123,5 @@ copyleft terms; contact
.SH PROJECT .SH PROJECT
.PP .PP
Home page: Home page:
.UR https://git.securityops.co/cristiancmoises/zupt .UR https://git.securityops.co/cristiancmoises/vaptvupt
.UE .UE

40
gui/README.md
View file

@ -1,6 +1,6 @@
# Zupt GUI — Cross-Platform Post-Quantum Backup # VaptVupt GUI — Cross-Platform Post-Quantum Backup
Desktop application for [zupt](https://git.securityops.co/cristiancmoises/zupt) backup compression with ML-KEM-768 + X25519 post-quantum hybrid encryption. Desktop application for [vaptvupt](https://git.securityops.co/cristiancmoises/vaptvupt) backup compression with ML-KEM-768 + X25519 post-quantum hybrid encryption.
Works on GNU/Linux, BSD, macOS, and Windows. Works on GNU/Linux, BSD, macOS, and Windows.
@ -9,19 +9,19 @@ Works on GNU/Linux, BSD, macOS, and Windows.
### Linux (recommended) ### Linux (recommended)
```bash ```bash
tar xzf zupt-gui.tar.gz && cd zupt-gui tar xzf vaptvupt-gui.tar.gz && cd vaptvupt-gui
./zupt-gui # auto-creates venv, installs PySide6 ./vaptvupt-gui # auto-creates venv, installs PySide6
./install.sh --user # adds right-click menu integration ./install.sh --user # adds right-click menu integration
``` ```
After install, right-click any file in Nemo/Nautilus to see "Compress with Zupt". After install, right-click any file in Nemo/Nautilus to see "Compress with VaptVupt".
Double-click any .zupt file to open it in the GUI. Double-click any .zupt file to open it in the GUI.
### Windows ### Windows
**Option A — Installer (recommended):** **Option A — Installer (recommended):**
Download `ZuptGUI-2.1.6-Setup.exe` and run it. Installs to Program Files, adds Start Menu shortcut, desktop shortcut, right-click context menus, and .zupt file association. Includes uninstaller. Download `VaptVuptGUI-1.3.0-Setup.exe` and run it. Installs to Program Files, adds Start Menu shortcut, desktop shortcut, right-click context menus, and .zupt file association. Includes uninstaller.
**Option B — Build from source:** **Option B — Build from source:**
@ -30,7 +30,7 @@ cd packaging\windows
build-windows.bat build-windows.bat
``` ```
Requires Python 3.9+, NSIS 3.x, and a compiled `zupt.exe`. Requires Python 3.9+, NSIS 3.x, and a compiled `vaptvupt.exe`.
**Option C — Run directly:** **Option C — Run directly:**
@ -49,8 +49,8 @@ python3 src/zupt_gui.py
### AppImage (universal Linux) ### AppImage (universal Linux)
```bash ```bash
chmod +x zupt-gui-1.0.0-x86_64.AppImage chmod +x VaptVupt-GUI-1.3.0-x86_64.AppImage
./zupt-gui-1.0.0-x86_64.AppImage ./VaptVupt-GUI-1.3.0-x86_64.AppImage
``` ```
### Flatpak ### Flatpak
@ -78,32 +78,32 @@ All tabs support drag-and-drop. Drop a .zupt file anywhere on the window to extr
### Linux (Nemo / Cinnamon) ### Linux (Nemo / Cinnamon)
After `./install.sh --user`: After `./install.sh --user`:
- Right-click any file: **Compress with Zupt** - Right-click any file: **Compress with VaptVupt**
- Right-click .zupt file: **Extract with Zupt** - Right-click .zupt file: **Extract with VaptVupt**
- Double-click .zupt: opens in Zupt GUI - Double-click .zupt: opens in VaptVupt GUI
### Windows (after installer) ### Windows (after installer)
- Right-click any file: **Compress with Zupt** - Right-click any file: **Compress with VaptVupt**
- Right-click any folder: **Compress with Zupt** - Right-click any folder: **Compress with VaptVupt**
- Double-click .zupt: opens in Zupt GUI - Double-click .zupt: opens in VaptVupt GUI
- Right-click .zupt: **Verify Integrity** - Right-click .zupt: **Verify Integrity**
## Architecture ## Architecture
``` ```
Zupt GUI (PySide6, Python) VaptVupt GUI (PySide6, Python)
| |
|-- subprocess.Popen() with streaming stderr |-- subprocess.Popen() with streaming stderr
| |
v v
zupt CLI (Pure C11 binary) vaptvupt CLI (Pure C11 binary)
ML-KEM-768 + X25519 + AES-256-CTR ML-KEM-768 + X25519 + AES-256-CTR
VaptVupt / LZHP / Store codecs VaptVupt / LZHP / Store codecs
Block deduplication, full-disk backup Block deduplication, full-disk backup
``` ```
The GUI calls the zupt CLI binary — all cryptography runs in native C, not Python. The GUI calls the vaptvupt CLI binary — all cryptography runs in native C, not Python.
## Packaging ## Packaging
@ -111,7 +111,7 @@ The GUI calls the zupt CLI binary — all cryptography runs in native C, not Pyt
|----------|--------|------| |----------|--------|------|
| Any | pip | `pip install .` | | Any | pip | `pip install .` |
| Debian/Ubuntu/Mint | .deb | `packaging/deb/control` | | Debian/Ubuntu/Mint | .deb | `packaging/deb/control` |
| Fedora/RHEL | .rpm | `rpmbuild -ba packaging/rpm/zupt-gui.spec` | | Fedora/RHEL | .rpm | `rpmbuild -ba packaging/rpm/vaptvupt.spec` |
| Universal Linux | .AppImage | `packaging/appimage/build-appimage.sh` | | Universal Linux | .AppImage | `packaging/appimage/build-appimage.sh` |
| Sandboxed Linux | .flatpak | `packaging/flatpak/dev.zupt.gui.yml` | | Sandboxed Linux | .flatpak | `packaging/flatpak/dev.zupt.gui.yml` |
| Windows | .exe installer | `packaging/windows/build-windows.bat` | | Windows | .exe installer | `packaging/windows/build-windows.bat` |
@ -119,7 +119,7 @@ The GUI calls the zupt CLI binary — all cryptography runs in native C, not Pyt
## Credits ## Credits
- **zupt** v2.2.3 — Cristian Cezar Moisés ([github](https://git.securityops.co/cristiancmoises/zupt)) - **vaptvupt** v2.2.3 — Cristian Cezar Moisés ([github](https://git.securityops.co/cristiancmoises/vaptvupt))
## License ## License

12
install.sh
View file

@ -1,18 +1,18 @@
#!/usr/bin/env bash #!/usr/bin/env bash
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
# Copyright (c) 2025-2026 Cristian Cezar Moisés # Copyright (c) 2025-2026 Cristian Cezar Moisés
# Fast Installer for Zupt - GNU/Linux # Fast Installer for VaptVupt - GNU/Linux
set -e set -e
echo "🔧 Installing Zupt..." echo "🔧 Installing VaptVupt..."
# Create temporary directory # Create temporary directory
TMP_DIR=$(mktemp -d) TMP_DIR=$(mktemp -d)
# Clone and build # Clone and build
git clone https://git.securityops.co/cristiancmoises/zupt.git "$TMP_DIR/zupt" git clone https://git.securityops.co/cristiancmoises/vaptvupt.git "$TMP_DIR/vaptvupt"
cd "$TMP_DIR/zupt" cd "$TMP_DIR/vaptvupt"
make clean make clean
make make
@ -20,8 +20,8 @@ make
# Install # Install
sudo make install sudo make install
echo "✅ Zupt successfully installed to /usr/local/bin/zupt" echo "✅ VaptVupt successfully installed to /usr/local/bin/vaptvupt"
echo "🔒 You can now run: zupt" echo "🔒 You can now run: vaptvupt (legacy 'zupt' symlink also installed)"
# Cleanup # Cleanup
cd ~ cd ~

34
packaging/opensuse/README.md
View file

@ -1,4 +1,4 @@
# openSUSE Build Service update for `home:cabelo:innovators/zupt` # openSUSE Build Service update for `home:cabelo:innovators/vaptvupt`
This directory contains the three files you need to update your OBS This directory contains the three files you need to update your OBS
package from `1.5.5` to `2.4.8`: package from `1.5.5` to `2.4.8`:
@ -6,8 +6,8 @@ package from `1.5.5` to `2.4.8`:
| File | Status vs. your current files | | File | Status vs. your current files |
|---------------|---------------------------------------------------------------------| |---------------|---------------------------------------------------------------------|
| `_service` | Updated `revision` to `v2.4.8`. Format unchanged (still `tar_scm`). | | `_service` | Updated `revision` to `v2.4.8`. Format unchanged (still `tar_scm`). |
| `zupt.spec` | Version → `2.4.8`. License corrected `MIT` → `AGPL-3.0-or-later`. `%check` now calls `make check` (new distro-safe target). | | `vaptvupt.spec` | Version → `2.4.8`. License corrected `MIT` → `AGPL-3.0-or-later`. `%check` now calls `make check` (new distro-safe target). |
| `zupt.changes`| 13 new entries prepended (2.0.0 → 2.4.8). Your existing 1.0.0–1.5.4 history is preserved verbatim. | | `vaptvupt.changes`| 13 new entries prepended (2.0.0 → 2.4.8). Your existing 1.0.0–1.5.4 history is preserved verbatim. |
## What changed in the spec ## What changed in the spec
@ -37,9 +37,9 @@ package from `1.5.5` to `2.4.8`:
hosts. The s390x branch still falls back to just `test-vectors`. hosts. The s390x branch still falls back to just `test-vectors`.
3. **Upstream URL in `URL:` field** updated to 3. **Upstream URL in `URL:` field** updated to
`https://git.securityops.co/cristiancmoises/zupt` (the canonical `https://git.securityops.co/cristiancmoises/vaptvupt` (the canonical
project URL). The `_service` file still pulls from GitHub project URL). The `_service` file still pulls from GitHub
(`https://github.com/cristiancmoises/zupt`) since that's where (`https://github.com/cristiancmoises/vaptvupt`) since that's where
your `tar_scm` is already configured and what works in OBS today. your `tar_scm` is already configured and what works in OBS today.
4. **`BuildRequires: make`** added — newer openSUSE chroots don't 4. **`BuildRequires: make`** added — newer openSUSE chroots don't
@ -54,20 +54,20 @@ package from `1.5.5` to `2.4.8`:
```sh ```sh
# 1. Check out the package # 1. Check out the package
osc checkout home:cabelo:innovators zupt osc checkout home:cabelo:innovators vaptvupt
cd home:cabelo:innovators/zupt cd home:cabelo:innovators/vaptvupt
# 2. Drop the new files in (assuming this README is at # 2. Drop the new files in (assuming this README is at
# /path/to/zupt-source/packaging/opensuse/README.md) # /path/to/vaptvupt-source/packaging/opensuse/README.md)
cp /path/to/zupt-source/packaging/opensuse/_service . cp /path/to/vaptvupt-source/packaging/opensuse/_service .
cp /path/to/zupt-source/packaging/opensuse/zupt.spec . cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.spec .
cp /path/to/zupt-source/packaging/opensuse/zupt.changes . cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.changes .
# 3. Trigger the service locally to fetch v2.4.8 from GitHub # 3. Trigger the service locally to fetch v2.4.8 from GitHub
osc service runall osc service runall
# This produces zupt-2.4.8.tar.gz in the current directory and # This produces vaptvupt-2.4.8.tar.gz in the current directory and
# updates zupt.changes with a service-generated entry if you have # updates vaptvupt.changes with a service-generated entry if you have
# changesgenerate enabled (you don't, so this is a no-op for # changesgenerate enabled (you don't, so this is a no-op for
# changes; tar_scm just downloads). # changes; tar_scm just downloads).
@ -78,7 +78,7 @@ osc build openSUSE_Tumbleweed x86_64
# (~91 assertions) pass, package is produced. # (~91 assertions) pass, package is produced.
# 5. Commit upstream # 5. Commit upstream
osc status # confirm zupt-2.4.8.tar.gz is staged alongside the osc status # confirm vaptvupt-2.4.8.tar.gz is staged alongside the
# three text files # three text files
osc commit -m "Update to 2.4.8: distro-safe make check target; license fix MIT -> AGPL" osc commit -m "Update to 2.4.8: distro-safe make check target; license fix MIT -> AGPL"
``` ```
@ -92,20 +92,20 @@ osc commit -m "Update to 2.4.8: distro-safe make check target; license fix MIT -
`set_version` service in `_service` will auto-sync at OBS-build `set_version` service in `_service` will auto-sync at OBS-build
time if you want; it's mode="manual" today, which is safer. time if you want; it's mode="manual" today, which is safer.
* `BuildRequires` is intentionally minimal (just `gcc gzip make`). * `BuildRequires` is intentionally minimal (just `gcc gzip make`).
Zupt has no external library dependencies — `libargon2`, VaptVupt has no external library dependencies — `libargon2`,
`libcrypto`, etc. used by other Linux packagers come from `libcrypto`, etc. used by other Linux packagers come from
*vendored* code that's compiled in. This is a deliberate *vendored* code that's compiled in. This is a deliberate
design choice; don't add system library BuildRequires. design choice; don't add system library BuildRequires.
## Reporting issues ## Reporting issues
* Upstream bugs: https://git.securityops.co/cristiancmoises/zupt * Upstream bugs: https://git.securityops.co/cristiancmoises/vaptvupt
* openSUSE packaging bugs: https://bugs.opensuse.org/ * openSUSE packaging bugs: https://bugs.opensuse.org/
* Cabelo's OBS project: https://build.opensuse.org/project/show/home:cabelo:innovators * Cabelo's OBS project: https://build.opensuse.org/project/show/home:cabelo:innovators
## Author of these update files ## Author of these update files
Generated against upstream `zupt-2.4.8` source tree. Spec mirrors Generated against upstream `vaptvupt-2.4.8` source tree. Spec mirrors
cabelo's existing 1.5.5 conventions (minimal `BuildRequires`, cabelo's existing 1.5.5 conventions (minimal `BuildRequires`,
`%autosetup -p1`, `V=1` verbose build, `%ifarch s390x` branch in `%autosetup -p1`, `V=1` verbose build, `%ifarch s390x` branch in
`%check`, no separate libzuptsdk subpackage) — only the necessary `%check`, no separate libzuptsdk subpackage) — only the necessary

2
packaging/opensuse/vaptvupt.spec
View file

@ -24,7 +24,7 @@ Release: 0
Summary: Post-quantum backup compression with AES-256 + ML-KEM-768 hybrid encryption Summary: Post-quantum backup compression with AES-256 + ML-KEM-768 hybrid encryption
License: AGPL-3.0-or-later License: AGPL-3.0-or-later
Group: Productivity/Archiving/Compression Group: Productivity/Archiving/Compression
URL: https://git.securityops.co/cristiancmoises/zupt URL: https://git.securityops.co/cristiancmoises/vaptvupt
Source0: %{name}-%{version}.tar.gz Source0: %{name}-%{version}.tar.gz
BuildRequires: gcc BuildRequires: gcc
BuildRequires: gzip BuildRequires: gzip

12
packaging/rpm/vaptvupt.spec
View file

@ -1,16 +1,16 @@
# SPDX-License-Identifier: AGPL-3.0-or-later # SPDX-License-Identifier: AGPL-3.0-or-later
# #
# Fedora / RHEL / CentOS RPM spec for zupt. # Fedora / RHEL / CentOS RPM spec for vaptvupt.
# #
# Build with: # Build with:
# spectool -g zupt.spec # fetches the upstream tarball # spectool -g vaptvupt.spec # fetches the upstream tarball
# rpmbuild -ba zupt.spec # builds source + binary RPMs # rpmbuild -ba vaptvupt.spec # builds source + binary RPMs
# #
# To bring a release into production: # To bring a release into production:
# 1. Run `make dist` upstream → /tmp/zupt-VERSION.tar.gz (reproducible). # 1. Run `make dist` upstream → /tmp/vaptvupt-VERSION.tar.gz (reproducible).
# 2. Upload to a stable release URL (git.securityops.co releases). # 2. Upload to a stable release URL (git.securityops.co releases).
# 3. Update %{version} below. # 3. Update %{version} below.
# 4. Run `sha256sum /tmp/zupt-VERSION.tar.gz` and update Source0 # 4. Run `sha256sum /tmp/vaptvupt-VERSION.tar.gz` and update Source0
# checksum (handled by spectool when configured) or pin via # checksum (handled by spectool when configured) or pin via
# sha256sum in a separate manifest if your distro requires it. # sha256sum in a separate manifest if your distro requires it.
# 5. rpmbuild --define '_topdir ~/rpmbuild' -ba zupt.spec # 5. rpmbuild --define '_topdir ~/rpmbuild' -ba zupt.spec
@ -25,7 +25,7 @@ Release: 1%{?dist}
Summary: Post-quantum backup compression utility (AES-256 + ML-KEM-768 + Argon2id, formerly Zupt) Summary: Post-quantum backup compression utility (AES-256 + ML-KEM-768 + Argon2id, formerly Zupt)
License: AGPL-3.0-or-later AND GPL-3.0-or-later License: AGPL-3.0-or-later AND GPL-3.0-or-later
URL: https://git.securityops.co/cristiancmoises/zupt URL: https://git.securityops.co/cristiancmoises/vaptvupt
Source0: %{url}/releases/download/v%{version}/%{name}-%{version}.tar.gz Source0: %{url}/releases/download/v%{version}/%{name}-%{version}.tar.gz
# v3.0.0: legacy `zupt` package is superseded. Renaming was forced # v3.0.0: legacy `zupt` package is superseded. Renaming was forced

10
sdk/README.md
View file

@ -1,8 +1,8 @@
# libzuptsdk # libzuptsdk
Public C ABI for the [Zupt](https://git.securityops.co/cristiancmoises/zupt) backup compression library. Public C ABI for the [VaptVupt](https://git.securityops.co/cristiancmoises/vaptvupt) backup compression library.
Provides post-quantum encrypted compression as a stable, embeddable shared library — completely independent of the `zupt` CLI.No dependency on any other compression library; everything is built from Zupt's own implementations. Provides post-quantum encrypted compression as a stable, embeddable shared library — completely independent of the `vaptvupt` CLI.No dependency on any other compression library; everything is built from VaptVupt's own implementations.
- **Version:** 1.0.0 - **Version:** 1.0.0
- **License:** AGPL-3.0-or-later - **License:** AGPL-3.0-or-later
@ -87,8 +87,8 @@ with zuptsdk.Context() as ctx:
## Build & install ## Build & install
```sh ```sh
git clone https://git.securityops.co/cristiancmoises/zupt git clone https://git.securityops.co/cristiancmoises/vaptvupt
cd zupt cd vaptvupt
make # builds CLI (required: produces jasmin/*.o assembly objects) make # builds CLI (required: produces jasmin/*.o assembly objects)
make sdk # builds libzuptsdk.so.1.0.0 + libzuptsdk.a + zuptsdk.pc make sdk # builds libzuptsdk.so.1.0.0 + libzuptsdk.a + zuptsdk.pc
make sdk-test # runs C roundtrip suite (15 tests) make sdk-test # runs C roundtrip suite (15 tests)
@ -178,6 +178,6 @@ The AGPL allows everyone to use the library freely, but anyone running it as a n
## Contact ## Contact
- Repository: https://git.securityops.co/cristiancmoises/zupt - Repository: https://git.securityops.co/cristiancmoises/vaptvupt
- Website: https://zupt.securityops.co - Website: https://zupt.securityops.co
- Email: zupt@riseup.net - Email: zupt@riseup.net

2
tests/test_packaging_syntax.sh
View file

@ -320,7 +320,7 @@ if [ -f THREAT_MODEL.md ]; then
else else
F "THREAT_MODEL.md: too short ($SZ bytes, expected >= 3000)" F "THREAT_MODEL.md: too short ($SZ bytes, expected >= 3000)"
fi fi
for section in "What Zupt protects against" "What Zupt does NOT protect against" "Cryptographic assumptions"; do for section in "What VaptVupt protects against" "What VaptVupt does NOT protect against" "Cryptographic assumptions"; do
if grep -qF "$section" THREAT_MODEL.md; then if grep -qF "$section" THREAT_MODEL.md; then
: :
else else