docs: complete zupt → vaptvupt rename; README v4.0.0 refresh
- README: add 'What's new in 4.0.0' section, extend release history v2.2.4 → v4.0.0, fix stale section titles (benchmark/security/feature tables), point fast-install at short.securityops.co/vaptvupt, fix related-project links (vaptvupt-codec, libvuptsdk, real repo names) - install.sh: clone the renamed repo, vaptvupt success message - Rename remaining zupt → vaptvupt across INSTALL.md, DISTRIBUTION.md, SECURITY.md, THREAT_MODEL.md, ROADMAP.md, THIRD-PARTY-NOTICES.md, gui/ + sdk/ + packaging READMEs, doc/vaptvupt.1, spec comments/URLs - New doc/vaptvupt-gui.1 (GUI 1.3.0, VAPTVUPT_BIN/ZUPT_BIN env vars); doc/zupt-gui.1 kept as hardlinked compat copy - Deliberately unchanged: .zupt extension, ZUPT header magic, ZUPT-* crypto domain-separation constants, zupt_*/ZUPT_* code identifiers, libzuptsdk artifact names, legacy symlink notes, CHANGELOG/AUDIT historical entries, Provides/Obsoletes upgrade path - tests/test_packaging_syntax.sh: THREAT_MODEL section titles updated
This commit is contained in:
Cristian Cezar Moisés
parent
544a2cd647
commit
136a96ed20
18 changed files with 471 additions and 306 deletions
|
|
@ -1,4 +1,4 @@
|
|||
# Zupt Changelog
|
||||
# VaptVupt Changelog
|
||||
|
||||
|
||||
## [4.0.0] — 2026-06-10 — Codec 2.60.4 (security), pq-box mode, F-16 disclosure
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# Distributing Zupt
|
||||
# Distributing VaptVupt
|
||||
|
||||
This document describes the upstream packaging recipes shipped under
|
||||
`packaging/` and the path from "local source tree" to "package
|
||||
|
|
@ -10,13 +10,13 @@ work outside this repository.
|
|||
|
||||
## Producing a reproducible source tarball
|
||||
|
||||
Every packaging recipe expects an upstream tarball `zupt-VERSION.tar.gz`
|
||||
Every packaging recipe expects an upstream tarball `vaptvupt-VERSION.tar.gz`
|
||||
produced by the project's `make dist` target. The tarball is
|
||||
**byte-reproducible**:
|
||||
|
||||
```sh
|
||||
make dist
|
||||
# → /tmp/zupt-2.4.4.tar.gz
|
||||
# → /tmp/vaptvupt-2.4.4.tar.gz
|
||||
# → sha256: 407d20ef03e5bf857195b99e04843ef3b07357416a4115add1e8aaa2007a769f
|
||||
# → bytes: 813113
|
||||
```
|
||||
|
|
@ -48,18 +48,18 @@ SOURCE_DATE_EPOCH=1727740800 make dist # 2024-10-01 UTC
|
|||
|-------------------|---------------------------------|----------------|
|
||||
| Arch Linux | `packaging/aur/PKGBUILD` | AUR PKGBUILD |
|
||||
| Debian / Ubuntu | `packaging/debian/` | Source package (`3.0 (quilt)`) |
|
||||
| Fedora / RHEL | `packaging/rpm/zupt.spec` | RPM .spec |
|
||||
| macOS | `packaging/homebrew/zupt.rb` | Homebrew formula |
|
||||
| Fedora / RHEL | `packaging/rpm/vaptvupt.spec` | RPM .spec |
|
||||
| macOS | `packaging/homebrew/vaptvupt.rb` | Homebrew formula |
|
||||
| NixOS / Nix flake | `packaging/nix/flake.nix` | Nix flake |
|
||||
|
||||
All recipes:
|
||||
|
||||
- Install the binary to `$PREFIX/bin/zupt` (default `/usr/bin/zupt`)
|
||||
- Install the vendored `libzuptsdk.so*` triple to `$PREFIX/lib/zupt/`
|
||||
- Install the binary to `$PREFIX/bin/vaptvupt` (default `/usr/bin/vaptvupt`)
|
||||
- Install the vendored `libzuptsdk.so*` triple to `$PREFIX/lib/vaptvupt/`
|
||||
(the binary uses relative `rpath` so users don't need `LD_LIBRARY_PATH`)
|
||||
- Install manpage to `$PREFIX/share/man/man1/zupt.1.gz`
|
||||
- Install manpage to `$PREFIX/share/man/man1/vaptvupt.1.gz`
|
||||
- Install docs (README, SECURITY, CHANGELOG, AUDIT) to
|
||||
`$PREFIX/share/doc/zupt/`
|
||||
`$PREFIX/share/doc/vaptvupt/`
|
||||
- Run the full upstream regression suite (`make test`) during build
|
||||
when the distro's package guidelines allow check-phase execution
|
||||
|
||||
|
|
@ -70,13 +70,13 @@ Maintainer flow:
|
|||
```sh
|
||||
# 1. Produce the upstream tarball
|
||||
make dist
|
||||
# → /tmp/zupt-2.4.4.tar.gz
|
||||
# → /tmp/vaptvupt-2.4.4.tar.gz
|
||||
|
||||
# 2. Upload to a stable URL (e.g. git.securityops.co releases)
|
||||
|
||||
# 3. Update packaging/aur/PKGBUILD:
|
||||
# - Set pkgver=2.4.4
|
||||
# - Set sha256sums=("$(sha256sum /tmp/zupt-2.4.4.tar.gz | awk '{print $1}')")
|
||||
# - Set sha256sums=("$(sha256sum /tmp/vaptvupt-2.4.4.tar.gz | awk '{print $1}')")
|
||||
|
||||
# 4. Generate .SRCINFO
|
||||
cd packaging/aur && makepkg --printsrcinfo > .SRCINFO
|
||||
|
|
@ -85,15 +85,15 @@ cd packaging/aur && makepkg --printsrcinfo > .SRCINFO
|
|||
makepkg -s
|
||||
|
||||
# 6. Push to AUR
|
||||
git clone ssh://aur@aur.archlinux.org/zupt.git aur-zupt
|
||||
cp packaging/aur/PKGBUILD packaging/aur/.SRCINFO aur-zupt/
|
||||
cd aur-zupt && git add -A && git commit -m "v2.4.4" && git push
|
||||
git clone ssh://aur@aur.archlinux.org/vaptvupt.git aur-vaptvupt
|
||||
cp packaging/aur/PKGBUILD packaging/aur/.SRCINFO aur-vaptvupt/
|
||||
cd aur-vaptvupt && git add -A && git commit -m "v2.4.4" && git push
|
||||
```
|
||||
|
||||
User install:
|
||||
|
||||
```sh
|
||||
yay -S zupt # or paru, pikaur, etc.
|
||||
yay -S vaptvupt # or paru, pikaur, etc.
|
||||
```
|
||||
|
||||
## Shell completions (v2.4.7+)
|
||||
|
|
@ -103,9 +103,9 @@ files alongside the binary and manpage:
|
|||
|
||||
| Shell | Path |
|
||||
|---|---|
|
||||
| Bash | `$PREFIX/share/bash-completion/completions/zupt` |
|
||||
| zsh | `$PREFIX/share/zsh/site-functions/_zupt` |
|
||||
| fish | `$PREFIX/share/fish/vendor_completions.d/zupt.fish` |
|
||||
| Bash | `$PREFIX/share/bash-completion/completions/vaptvupt` |
|
||||
| zsh | `$PREFIX/share/zsh/site-functions/_vaptvupt` |
|
||||
| fish | `$PREFIX/share/fish/vendor_completions.d/vaptvupt.fish` |
|
||||
|
||||
The source files live under `completions/` in the project tree.
|
||||
Distros that prefer a different install location should override
|
||||
|
|
@ -116,13 +116,13 @@ For per-user installation without root:
|
|||
|
||||
```sh
|
||||
# Bash
|
||||
cp completions/zupt.bash ~/.local/share/bash-completion/completions/zupt
|
||||
cp completions/vaptvupt.bash ~/.local/share/bash-completion/completions/vaptvupt
|
||||
|
||||
# zsh (somewhere in $fpath; add the directory to ~/.zshrc if needed)
|
||||
cp completions/_zupt ~/.zsh/completion/_zupt
|
||||
cp completions/_vaptvupt ~/.zsh/completion/_vaptvupt
|
||||
|
||||
# fish
|
||||
cp completions/zupt.fish ~/.config/fish/completions/zupt.fish
|
||||
cp completions/vaptvupt.fish ~/.config/fish/completions/vaptvupt.fish
|
||||
```
|
||||
|
||||
Completions cover every CLI flag the binary actually parses
|
||||
|
|
@ -139,18 +139,18 @@ Maintainer flow:
|
|||
# 1. Produce the upstream tarball with the standard Debian
|
||||
# orig.tar.gz naming convention:
|
||||
make dist
|
||||
cp /tmp/zupt-2.4.4.tar.gz /tmp/zupt_2.4.4.orig.tar.gz
|
||||
cp /tmp/vaptvupt-2.4.4.tar.gz /tmp/vaptvupt_2.4.4.orig.tar.gz
|
||||
|
||||
# 2. Unpack and overlay the debian/ tree:
|
||||
cd /tmp && tar xzf zupt_2.4.4.orig.tar.gz && cd zupt-2.4.4
|
||||
cp -a /path/to/zupt/packaging/debian ./debian
|
||||
cd /tmp && tar xzf vaptvupt_2.4.4.orig.tar.gz && cd vaptvupt-2.4.4
|
||||
cp -a /path/to/vaptvupt/packaging/debian ./debian
|
||||
|
||||
# 3. Build the source package:
|
||||
dpkg-buildpackage -S -us -uc # source-only
|
||||
dpkg-buildpackage -b -us -uc # binary
|
||||
|
||||
# 4. Lint:
|
||||
lintian zupt_2.4.4-1_*.deb
|
||||
lintian vaptvupt_2.4.4-1_*.deb
|
||||
|
||||
# 5. Submit via the standard Debian mentors process:
|
||||
# https://mentors.debian.net/intro-maintainers/
|
||||
|
|
@ -159,7 +159,7 @@ lintian zupt_2.4.4-1_*.deb
|
|||
User install (after the package lands in Debian unstable / Ubuntu):
|
||||
|
||||
```sh
|
||||
sudo apt install zupt
|
||||
sudo apt install vaptvupt
|
||||
```
|
||||
|
||||
## Fedora / RHEL / CentOS
|
||||
|
|
@ -167,16 +167,16 @@ sudo apt install zupt
|
|||
```sh
|
||||
# 1. Produce the tarball
|
||||
make dist
|
||||
cp /tmp/zupt-2.4.4.tar.gz ~/rpmbuild/SOURCES/
|
||||
cp /tmp/vaptvupt-2.4.4.tar.gz ~/rpmbuild/SOURCES/
|
||||
|
||||
# 2. Drop the .spec into the SPECS directory:
|
||||
cp packaging/rpm/zupt.spec ~/rpmbuild/SPECS/
|
||||
cp packaging/rpm/vaptvupt.spec ~/rpmbuild/SPECS/
|
||||
|
||||
# 3. Build source + binary RPMs:
|
||||
cd ~/rpmbuild && rpmbuild -ba SPECS/zupt.spec
|
||||
cd ~/rpmbuild && rpmbuild -ba SPECS/vaptvupt.spec
|
||||
|
||||
# 4. Lint:
|
||||
rpmlint RPMS/x86_64/zupt-2.4.4-1.fc*.rpm
|
||||
rpmlint RPMS/x86_64/vaptvupt-2.4.4-1.fc*.rpm
|
||||
|
||||
# 5. Submit via the Fedora new-package review process:
|
||||
# https://docs.fedoraproject.org/en-US/package-maintainers/Package_Review_Process/
|
||||
|
|
@ -186,8 +186,8 @@ rpmlint RPMS/x86_64/zupt-2.4.4-1.fc*.rpm
|
|||
User install (after the package lands in Fedora / EPEL):
|
||||
|
||||
```sh
|
||||
sudo dnf install zupt # Fedora
|
||||
sudo dnf install epel-release zupt # RHEL/CentOS via EPEL
|
||||
sudo dnf install vaptvupt # Fedora
|
||||
sudo dnf install epel-release vaptvupt # RHEL/CentOS via EPEL
|
||||
```
|
||||
|
||||
## macOS (Homebrew)
|
||||
|
|
@ -195,14 +195,14 @@ sudo dnf install epel-release zupt # RHEL/CentOS via EPEL
|
|||
```sh
|
||||
# 1. Produce the tarball and upload to a stable release URL.
|
||||
|
||||
# 2. Update packaging/homebrew/zupt.rb:
|
||||
# 2. Update packaging/homebrew/vaptvupt.rb:
|
||||
# - Set url to the release URL
|
||||
# - Set sha256 to the upstream tarball sha256
|
||||
|
||||
# 3. Test locally:
|
||||
brew install --build-from-source ./packaging/homebrew/zupt.rb
|
||||
brew test zupt
|
||||
brew audit --strict --online zupt
|
||||
brew install --build-from-source ./packaging/homebrew/vaptvupt.rb
|
||||
brew test vaptvupt
|
||||
brew audit --strict --online vaptvupt
|
||||
|
||||
# 4. Submit to homebrew-core (preferred, requires popularity threshold):
|
||||
# https://docs.brew.sh/Adding-Software-to-Homebrew
|
||||
|
|
@ -214,25 +214,25 @@ brew audit --strict --online zupt
|
|||
User install (after submission lands):
|
||||
|
||||
```sh
|
||||
brew install zupt
|
||||
brew install vaptvupt
|
||||
# OR from a custom tap:
|
||||
brew install cristiancmoises/tap/zupt
|
||||
brew install cristiancmoises/tap/vaptvupt
|
||||
```
|
||||
|
||||
## NixOS / Nix flake
|
||||
|
||||
```sh
|
||||
# 1. Build directly from the flake (no central submission needed):
|
||||
nix build github:cristiancmoises/zupt#zupt
|
||||
nix run github:cristiancmoises/zupt#zupt -- version
|
||||
nix build github:cristiancmoises/vaptvupt#vaptvupt
|
||||
nix run github:cristiancmoises/vaptvupt#vaptvupt -- version
|
||||
|
||||
# 2. To consume from another flake:
|
||||
# inputs.zupt.url = "github:cristiancmoises/zupt?ref=v2.4.4";
|
||||
# inputs.zupt.url = "github:cristiancmoises/vaptvupt?ref=v2.4.4";
|
||||
# packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt;
|
||||
|
||||
# 3. To submit to nixpkgs (https://github.com/NixOS/nixpkgs):
|
||||
# - Adapt packaging/nix/flake.nix's `zupt` derivation into a
|
||||
# pkgs/by-name/zu/zupt/package.nix using fetchurl and a hash.
|
||||
# - Adapt packaging/nix/flake.nix's `vaptvupt` derivation into a
|
||||
# pkgs/by-name/zu/vaptvupt/package.nix using fetchurl and a hash.
|
||||
# - Follow the nixpkgs contribution guide:
|
||||
# https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
|
||||
```
|
||||
|
|
@ -245,10 +245,10 @@ Before pushing any recipe to a distro repository:
|
|||
`tests/test_dist_reproducible.sh` on every `make test`)
|
||||
- [ ] The tarball is uploaded to a stable, immutable URL
|
||||
- [ ] The recipe's checksum field is updated to match
|
||||
`sha256sum /tmp/zupt-VERSION.tar.gz`
|
||||
`sha256sum /tmp/vaptvupt-VERSION.tar.gz`
|
||||
- [ ] The recipe builds and tests pass in a clean chroot/container
|
||||
- [ ] The CHANGELOG mentions distro-relevant changes since the last release
|
||||
- [ ] The license metadata is correct (AGPL-3.0-or-later for Zupt core;
|
||||
- [ ] The license metadata is correct (AGPL-3.0-or-later for VaptVupt core;
|
||||
GPL-3.0-or-later for the vendored VaptVupt codec)
|
||||
|
||||
## Security posture for downstream
|
||||
|
|
|
|||
72
INSTALL.md
72
INSTALL.md
|
|
@ -1,17 +1,17 @@
|
|||
# Zupt + Zupt GUI — Install Guide for Linux
|
||||
# VaptVupt + VaptVupt GUI — Install Guide for Linux
|
||||
|
||||
If you're seeing the error:
|
||||
|
||||
```
|
||||
zupt-gui depende de python3-pyqt6 | python3-pyside6; porém:
|
||||
vaptvupt-gui depende de python3-pyqt6 | python3-pyside6; porém:
|
||||
Pacote python3-pyqt6 não está instalado.
|
||||
zupt-gui depende de zupt (>= 2.2.3); porém:
|
||||
Versão de zupt no sistema é 2.1.7-1.
|
||||
vaptvupt-gui depende de vaptvupt (>= 2.2.3); porém:
|
||||
Versão de vaptvupt no sistema é 2.1.7-1.
|
||||
```
|
||||
|
||||
This is correct behavior. The `zupt-gui` deb requires:
|
||||
This is correct behavior. The `vaptvupt-gui` deb requires:
|
||||
- Python 3 with **PyQt6** or **PySide6** (the GUI toolkit)
|
||||
- The **zupt CLI 2.2.3** or newer
|
||||
- The **vaptvupt CLI 2.2.3** or newer
|
||||
|
||||
## The fastest fix — one command (Linux Mint, Ubuntu, Debian)
|
||||
|
||||
|
|
@ -33,11 +33,11 @@ the right order. Done.
|
|||
sudo apt update
|
||||
sudo apt install -y python3-pyqt6
|
||||
|
||||
# 2. Upgrade zupt CLI to 2.2.3
|
||||
sudo dpkg -i zupt_2.2.3_amd64.deb
|
||||
# 2. Upgrade vaptvupt CLI to 4.0.0
|
||||
sudo dpkg -i vaptvupt_4.0.0_amd64.deb
|
||||
|
||||
# 3. Install the GUI
|
||||
sudo dpkg -i zupt-gui_1.1.1_all.deb
|
||||
sudo dpkg -i vaptvupt-gui_1.3.0_all.deb
|
||||
```
|
||||
|
||||
If step 3 still complains about deps, run:
|
||||
|
|
@ -50,10 +50,10 @@ sudo apt --fix-broken install
|
|||
|
||||
```bash
|
||||
sudo dnf install -y python3-pyqt6
|
||||
sudo dnf install -y zupt-2.2.3-1.x86_64.rpm zupt-gui-1.1.1-1.noarch.rpm
|
||||
sudo dnf install -y vaptvupt-4.0.0-1.x86_64.rpm vaptvupt-gui-1.3.0-1.noarch.rpm
|
||||
```
|
||||
|
||||
(Or build the RPM from the SRPM tarball with `rpmbuild -bb SPECS/zupt.spec`)
|
||||
(Or build the RPM from the SRPM tarball with `rpmbuild -bb SPECS/vaptvupt.spec`)
|
||||
|
||||
### openSUSE Leap / Tumbleweed
|
||||
|
||||
|
|
@ -66,7 +66,7 @@ sudo zypper install python3-pyqt6
|
|||
|
||||
```bash
|
||||
sudo pacman -S python-pyqt6
|
||||
# Build zupt from the source tarball
|
||||
# Build vaptvupt from the source tarball
|
||||
```
|
||||
|
||||
### Anything else (or no apt/dnf/pacman handy)
|
||||
|
|
@ -74,8 +74,8 @@ sudo pacman -S python-pyqt6
|
|||
Use the AppImage — no install needed:
|
||||
|
||||
```bash
|
||||
tar xzf Zupt-GUI-1.1.1-x86_64.AppDir.tar.gz
|
||||
cd zupt-gui.AppDir
|
||||
tar xzf VaptVupt-GUI-1.3.0-x86_64.AppDir.tar.gz
|
||||
cd vaptvupt-gui.AppDir
|
||||
./AppRun
|
||||
```
|
||||
|
||||
|
|
@ -86,7 +86,7 @@ PyInstaller-built version (not in this release).
|
|||
|
||||
## Why does the GUI need Qt6?
|
||||
|
||||
The Zupt GUI is written in Python, using either PyQt6 or PySide6 (it
|
||||
The VaptVupt GUI is written in Python, using either PyQt6 or PySide6 (it
|
||||
auto-detects whichever is installed). These are bindings to the Qt 6
|
||||
graphical toolkit — they're how the GUI draws windows, buttons, and
|
||||
dialogs.
|
||||
|
|
@ -99,28 +99,28 @@ We don't bundle Qt6 inside the deb because:
|
|||
- Bundling would make the deb 80 MB+ instead of 35 KB
|
||||
- Distribution-managed Qt gets security updates automatically
|
||||
|
||||
## Why does the GUI need zupt 2.2.3?
|
||||
## Why does the GUI need vaptvupt 2.2.3?
|
||||
|
||||
The GUI calls `zupt --pq-sdk` and `zupt keygen --sdk` for state-of-the-art
|
||||
The GUI calls `vaptvupt --pq-sdk` and `vaptvupt keygen --sdk` for state-of-the-art
|
||||
post-quantum encryption (HKDF-SHA3 hybrid combiner, key commitment, HPKE
|
||||
binding, Argon2id). These flags didn't exist in 2.1.7 — they were added
|
||||
in 2.2.0.
|
||||
|
||||
If you have an older zupt installed, the GUI's compress/extract will fail
|
||||
If you have an older vaptvupt installed, the GUI's compress/extract will fail
|
||||
with "unknown option --pq-sdk".
|
||||
|
||||
## After installing — verify
|
||||
|
||||
```bash
|
||||
zupt version # should show: 2.2.3
|
||||
zupt-gui # should launch the GUI window
|
||||
vaptvupt version # should show: 2.2.3
|
||||
vaptvupt-gui # should launch the GUI window
|
||||
```
|
||||
|
||||
## If the GUI window still doesn't appear
|
||||
|
||||
```bash
|
||||
# Run from terminal to see error messages
|
||||
zupt-gui
|
||||
vaptvupt-gui
|
||||
|
||||
# If you see "ImportError: No module named 'PyQt6'":
|
||||
# The GUI fell back through both PyQt6 and PySide6 imports.
|
||||
|
|
@ -136,20 +136,20 @@ zupt-gui
|
|||
|
||||
## Reporting issues
|
||||
|
||||
If you've tried the above and zupt-gui still won't work, open an issue
|
||||
at https://git.securityops.co/cristiancmoises/zupt/issues with:
|
||||
If you've tried the above and vaptvupt-gui still won't work, open an issue
|
||||
at https://git.securityops.co/cristiancmoises/vaptvupt/issues with:
|
||||
|
||||
1. Output of `lsb_release -a` (or `cat /etc/os-release`)
|
||||
2. Output of `python3 --version`
|
||||
3. Output of `python3 -c 'import PyQt6; print(PyQt6.__version__)' 2>&1`
|
||||
4. Output of `zupt version`
|
||||
5. Output of `zupt-gui` (the error message it printed to terminal)
|
||||
4. Output of `vaptvupt version`
|
||||
5. Output of `vaptvupt-gui` (the error message it printed to terminal)
|
||||
|
||||
---
|
||||
|
||||
## Building from source
|
||||
|
||||
If you want to build Zupt from the source tarball instead of installing
|
||||
If you want to build VaptVupt from the source tarball instead of installing
|
||||
the pre-built `.deb` / `.rpm` packages, you'll need:
|
||||
|
||||
### Build dependencies
|
||||
|
|
@ -160,10 +160,10 @@ the pre-built `.deb` / `.rpm` packages, you'll need:
|
|||
| `make` | build driver |
|
||||
| `libargon2-dev` | Argon2id KDF |
|
||||
| `libssl-dev` | OpenSSL libcrypto (AES, SHA-256) |
|
||||
| **`libzuptsdk-dev` 2.0.0+** | Zupt's cryptographic SDK |
|
||||
| **`libzuptsdk-dev` 2.0.0+** | VaptVupt's cryptographic SDK |
|
||||
|
||||
The `libzuptsdk-dev` package is a separate sister project — it contains
|
||||
the post-quantum hybrid cryptography that Zupt uses on its `--pq-sdk`
|
||||
the post-quantum hybrid cryptography that VaptVupt uses on its `--pq-sdk`
|
||||
path. Both libraries are by the same author (Cristian Cezar Moisés) but
|
||||
are distributed as separate source/binary packages so each can evolve
|
||||
on its own release cadence.
|
||||
|
|
@ -188,20 +188,20 @@ rpmbuild -bb SPECS/libzuptsdk.spec
|
|||
sudo rpm -i ~/rpmbuild/RPMS/x86_64/libzuptsdk-2.0.0-*.rpm
|
||||
```
|
||||
|
||||
### Build Zupt itself
|
||||
### Build VaptVupt itself
|
||||
|
||||
```bash
|
||||
tar -xzf zupt-2.2.3-source.tar.gz
|
||||
cd zupt-2.2.3
|
||||
tar -xzf vaptvupt-2.2.3-source.tar.gz
|
||||
cd vaptvupt-2.2.3
|
||||
|
||||
make # build the `./zupt` binary
|
||||
make # build the `./vaptvupt` binary
|
||||
sudo make install # install to /usr/local/bin (override with PREFIX=/usr)
|
||||
|
||||
./zupt version # verify
|
||||
./vaptvupt version # verify
|
||||
```
|
||||
|
||||
The `make` step takes 10-30 seconds. The build emits the binary as
|
||||
`./zupt`. The default install prefix is `/usr/local`; override with
|
||||
`./vaptvupt`. The default install prefix is `/usr/local`; override with
|
||||
`PREFIX=/usr` for system-wide install.
|
||||
|
||||
### Run the test suite
|
||||
|
|
@ -216,7 +216,7 @@ its own pass/fail count.
|
|||
|
||||
### Cross-compilation
|
||||
|
||||
Zupt builds on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64. To
|
||||
VaptVupt builds on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64. To
|
||||
cross-compile:
|
||||
|
||||
```bash
|
||||
|
|
@ -230,7 +230,7 @@ x86_64).
|
|||
|
||||
### Static linking against libzuptsdk
|
||||
|
||||
If you want a fully self-contained `zupt` binary (no `libzuptsdk.so.2`
|
||||
If you want a fully self-contained `vaptvupt` binary (no `libzuptsdk.so.2`
|
||||
runtime dependency), you can link against the static library:
|
||||
|
||||
```bash
|
||||
|
|
|
|||
194
README.md
194
README.md
|
|
@ -1,4 +1,4 @@
|
|||
<!-- Logo: rehost on git.securityops.co/cristiancmoises/zupt or zupt.securityops.co; old GitHub user-attachments URL no longer in use -->
|
||||
<!-- Logo: rehost on git.securityops.co/cristiancmoises/vaptvupt or zupt.securityops.co; old GitHub user-attachments URL no longer in use -->
|
||||
<!-- <img width="493" height="173" alt="logo" src="https://zupt.securityops.co/assets/logo.png"/> -->
|
||||
|
||||
# VaptVupt
|
||||
|
|
@ -17,6 +17,16 @@
|
|||
> The `zupt` command is preserved as a symlink to `vaptvupt` for one
|
||||
> major version cycle.
|
||||
|
||||
## What's new in 4.0.0
|
||||
|
||||
- **Codec security release** — vendored codec upgraded to VaptVupt 2.60.4, fixing a high-severity OOB heap write in the AVX2 decode fast path (reachable on valid streams with exact-size output buffers). 80 new exact-size decode regression cases under ASan.
|
||||
- **`--pq-box` sealed-box mode** — third post-quantum recipient mode via vendored libpqvaptvupt 0.6.0: ML-KEM-768 + X25519 through an HKDF-SHA256 domain-separated combiner. `vaptvupt keygen --box` writes magic-tagged keypairs that reject key-type confusion.
|
||||
- **F-16 disclosure and fix** — archives created by ≤ 3.8.0 at `-l 8`/`-l 9` containing x86/ELF/PE executables may be unreadable by *any* version (write-time defect in the old in-tree BCJ encoder). Re-create them with 4.0.0; details below and in [CHANGELOG.md](CHANGELOG.md).
|
||||
- **SHA-NI measured** — 5.8× over scalar SHA-256 (204 → 1184 MB/s); encrypted per-block throughput now 293 MB/s.
|
||||
|
||||
Binaries for the CLI (4.0.0) and GUI (1.3.0) are on the
|
||||
[release page](https://git.securityops.co/cristiancmoises/vaptvupt/releases/tag/v4.0.0).
|
||||
|
||||
Backup compression with hardware-adaptive codec selection, AES-256
|
||||
authenticated encryption, post-quantum key encapsulation, and
|
||||
full-disk backup. Pure C11, zero dependencies, ~13,000 lines. Builds
|
||||
|
|
@ -26,14 +36,14 @@ and runs on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64.
|
|||
|
||||
## Why VaptVupt
|
||||
|
||||
- **Hardware-adaptive codec** — auto-detects AVX2/NEON at runtime and selects the best codec: VaptVupt (LZ77 + tANS + SIMD decode) on capable hardware, Zupt-LZHP on everything else. Override with `--vv` or `--lzhp`.
|
||||
- **Hardware-adaptive codec** — auto-detects AVX2/NEON at runtime and selects the best codec: VaptVupt (LZ77 + tANS + SIMD decode) on capable hardware, VaptVupt-LZHP on everything else. Override with `--vv` or `--lzhp`.
|
||||
- **Post-quantum encryption** — `--pq` mode uses ML-KEM-768 + X25519 hybrid KEM (same approach as Signal and iMessage). Protects against "harvest now, decrypt later" quantum attacks.
|
||||
- **AES-NI hardware acceleration** — AES-256-CTR via Jasmin-verified assembly with 4-block interleaved pipeline. Safe AVX detection with OSXSAVE/XCR0 validation — no SIGILL on any CPU. Falls back to C table-based AES on unsupported hardware.
|
||||
- **SHA-NI hardware acceleration** — HMAC-SHA256 (the Encrypt-then-MAC second pass) and PBKDF2 use an Intel SHA-NI compression path (`SHA256RNDS2`/`MSG1`/`MSG2`) when the CPU supports it (Intel Goldmont+/Ice Lake+, AMD Zen+), selected at runtime via CPUID. **measured 5.8×** over the scalar path (204 → 1184 MB/s, 256 MiB, Xeon 2.10 GHz) *and* constant-time by construction. Bit-identical output; scalar C fallback elsewhere (incl. aarch64). `vaptvupt version` prints the live acceleration set for your CPU.
|
||||
- **Incremental HMAC** — the per-block MAC streams its segments through an incremental HMAC-SHA256 (key prefix folded once per keyring) instead of copying each block's ciphertext into a temporary buffer. Removes a per-block heap allocation and full-payload copy on both encrypt and decrypt, with a byte-for-byte identical MAC (RFC 2104).
|
||||
- **Multi-threaded** — Compression and decompression both parallelized. `-t 0` auto-detects cores.
|
||||
- **Full-disk backup** — `zupt disk backup` clones entire disks or partitions in one command. Sparse block detection skips zero regions, real-time progress bar, all encryption modes supported. Restore with byte-for-byte verification via per-block XXH64 checksums.
|
||||
- **Encrypted backups in one command** — `zupt compress -p changeme backup.zupt ~/data/` — AES-256 + HMAC-SHA256, file names hidden.
|
||||
- **Full-disk backup** — `vaptvupt disk backup` clones entire disks or partitions in one command. Sparse block detection skips zero regions, real-time progress bar, all encryption modes supported. Restore with byte-for-byte verification via per-block XXH64 checksums.
|
||||
- **Encrypted backups in one command** — `vaptvupt compress -p changeme backup.zupt ~/data/` — AES-256 + HMAC-SHA256, file names hidden.
|
||||
- **Per-block integrity** — XXH64 checksum + HMAC-SHA256 per block. Wrong password rejected instantly.
|
||||
- **Self-describing KDF** — password archives record their key-derivation profile in the (authenticated) header, so an archive always carries the parameters needed to open it years later. Unknown profiles are refused fail-closed rather than mis-derived. Argon2id is the default; PBKDF2 (600K iter) via `--kdf pbkdf2`.
|
||||
- **Measured constant-time comparisons** — every security-critical comparison (HMAC tag, archive-integrity trailer, and the ML-KEM-768 decapsulation implicit-rejection check) routes through a single audited primitive (`zupt_ct_memeq`, branch-free, volatile accumulator, length-independent) verified by a dudect-style Welch t-test in CI, not just annotated. Its data-dependent timing signal measures ~1% of a leaky-`memcmp` control in the same environment; a reintroduced early-return or inline loop fails the test (timing + source-routing guard).
|
||||
|
|
@ -48,7 +58,7 @@ and runs on x86_64, aarch64, armhf, ppc64le, s390x, and riscv64.
|
|||
|
||||
### Fast installation
|
||||
```
|
||||
curl -fsSL https://short.securityops.co/zupt | bash
|
||||
curl -fsSL https://short.securityops.co/vaptvupt | bash
|
||||
```
|
||||
|
||||
### Build & Install
|
||||
|
|
@ -108,48 +118,48 @@ chmod +x VaptVupt-GUI-1.3.0-x86_64.AppImage
|
|||
### Building from SRPM (Fedora / RHEL / RPM-based distributions)
|
||||
|
||||
```bash
|
||||
tar xzf zupt-2.2.3.srpm.tar.gz
|
||||
tar xzf vaptvupt-4.0.0.srpm.tar.gz
|
||||
cd ~/rpmbuild # or use rpmbuild --define "_topdir $(pwd)"
|
||||
rpmbuild -bb SPECS/zupt.spec
|
||||
sudo rpm -i RPMS/x86_64/zupt-2.2.3-1.*.rpm
|
||||
rpmbuild -bb SPECS/vaptvupt.spec
|
||||
sudo rpm -i RPMS/x86_64/vaptvupt-4.0.0-1.*.rpm
|
||||
```
|
||||
|
||||
### Basic usage
|
||||
|
||||
```bash
|
||||
# Compress a directory (auto-selects best codec for your hardware)
|
||||
zupt compress backup.zupt ~/Documents/
|
||||
vaptvupt compress backup.zupt ~/Documents/
|
||||
|
||||
# Compress at a specific level (1=fast, 5=balanced, 9=extreme)
|
||||
zupt compress -l 9 backup.zupt ~/Documents/
|
||||
vaptvupt compress -l 9 backup.zupt ~/Documents/
|
||||
|
||||
# Force the VaptVupt codec (default on AVX2/NEON hardware)
|
||||
zupt compress --vv -l 5 backup.zupt ~/Documents/
|
||||
vaptvupt compress --vv -l 5 backup.zupt ~/Documents/
|
||||
|
||||
# Compress with multi-threading (-t 0 = auto-detect cores)
|
||||
zupt compress -t 0 -l 5 backup.zupt ~/Documents/
|
||||
vaptvupt compress -t 0 -l 5 backup.zupt ~/Documents/
|
||||
|
||||
# Compress with password encryption (AES-256-CTR + HMAC-SHA256)
|
||||
zupt compress -p "my-strong-password" backup.zupt ~/Documents/
|
||||
vaptvupt compress -p "my-strong-password" backup.zupt ~/Documents/
|
||||
|
||||
# List archive contents
|
||||
zupt list backup.zupt
|
||||
vaptvupt list backup.zupt
|
||||
|
||||
# Show archive metadata (codec, blocks, encryption — no password needed)
|
||||
zupt info backup.zupt
|
||||
vaptvupt info backup.zupt
|
||||
|
||||
# Verify archive integrity (HMAC + per-block checksums)
|
||||
zupt test backup.zupt
|
||||
zupt test -p "my-strong-password" backup.zupt
|
||||
vaptvupt test backup.zupt
|
||||
vaptvupt test -p "my-strong-password" backup.zupt
|
||||
|
||||
# Extract everything
|
||||
zupt extract -o ~/restored/ backup.zupt
|
||||
vaptvupt extract -o ~/restored/ backup.zupt
|
||||
|
||||
# Extract from encrypted archive
|
||||
zupt extract -p "my-strong-password" -o ~/restored/ backup.zupt
|
||||
vaptvupt extract -p "my-strong-password" -o ~/restored/ backup.zupt
|
||||
|
||||
# Benchmark all 9 levels on a file
|
||||
zupt bench big-file.tar
|
||||
vaptvupt bench big-file.tar
|
||||
```
|
||||
|
||||
#### Post-quantum encryption
|
||||
|
|
@ -157,62 +167,62 @@ zupt bench big-file.tar
|
|||
```bash
|
||||
# Recommended: SDK v2 (HKDF combiner + key commitment + HPKE binding + Argon2id).
|
||||
# New archives should use this.
|
||||
zupt keygen --sdk -o mykey.priv # writes mykey.priv and mykey.priv.pub
|
||||
zupt compress --pq-sdk mykey.priv.pub backup.zupt ~/Documents/
|
||||
zupt extract --pq-sdk mykey.priv -o ~/restored/ backup.zupt
|
||||
vaptvupt keygen --sdk -o mykey.priv # writes mykey.priv and mykey.priv.pub
|
||||
vaptvupt compress --pq-sdk mykey.priv.pub backup.zupt ~/Documents/
|
||||
vaptvupt extract --pq-sdk mykey.priv -o ~/restored/ backup.zupt
|
||||
|
||||
# pq-box sealed-box workflow (v4.0.0; HKDF-SHA256 domain-separated combiner)
|
||||
zupt keygen --box -o box.key # writes box.key + box.key.pub
|
||||
zupt compress --pq-box box.key.pub backup.zupt ~/Documents/
|
||||
zupt extract --pq-box box.key -o ~/restored/ backup.zupt
|
||||
vaptvupt keygen --box -o box.key # writes box.key + box.key.pub
|
||||
vaptvupt compress --pq-box box.key.pub backup.zupt ~/Documents/
|
||||
vaptvupt extract --pq-box box.key -o ~/restored/ backup.zupt
|
||||
|
||||
# Legacy --pq mode (XOR+SHA3-512 combiner) — kept for back-compat with
|
||||
# archives created by Zupt 2.0–2.1. Do NOT use for new archives.
|
||||
zupt keygen -o mykey.key
|
||||
zupt keygen --pub -o pub.key -k mykey.key
|
||||
zupt compress --pq pub.key backup.zupt ~/Documents/
|
||||
zupt extract --pq mykey.key -o ~/restored/ backup.zupt
|
||||
vaptvupt keygen -o mykey.key
|
||||
vaptvupt keygen --pub -o pub.key -k mykey.key
|
||||
vaptvupt compress --pq pub.key backup.zupt ~/Documents/
|
||||
vaptvupt extract --pq mykey.key -o ~/restored/ backup.zupt
|
||||
```
|
||||
|
||||
#### Full-disk backup
|
||||
|
||||
```bash
|
||||
# Backup an entire disk or partition (sparse-detection skips zero regions)
|
||||
sudo zupt disk backup -l 5 disk.zupt /dev/sda
|
||||
sudo vaptvupt disk backup -l 5 disk.zupt /dev/sda
|
||||
|
||||
# Backup with encryption
|
||||
sudo zupt disk backup -p "passphrase" -l 5 disk.zupt /dev/sda
|
||||
sudo vaptvupt disk backup -p "passphrase" -l 5 disk.zupt /dev/sda
|
||||
|
||||
# Restore (writes raw bytes back to a block device or file)
|
||||
sudo zupt disk restore disk.zupt /dev/sdb
|
||||
sudo zupt disk restore -p "passphrase" disk.zupt /dev/sdb
|
||||
sudo vaptvupt disk restore disk.zupt /dev/sdb
|
||||
sudo vaptvupt disk restore -p "passphrase" disk.zupt /dev/sdb
|
||||
|
||||
# Backup a partition image file (no root needed)
|
||||
zupt disk backup -l 5 part.zupt /path/to/partition.img
|
||||
vaptvupt disk backup -l 5 part.zupt /path/to/partition.img
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Auto Codec Detection
|
||||
|
||||
Zupt v2.0.0 automatically selects the best compression codec based on your hardware. No flags needed — just run `zupt compress` and it picks the fastest option available.
|
||||
VaptVupt automatically selects the best compression codec based on your hardware (since v2.0.0). No flags needed — just run `vaptvupt compress` and it picks the fastest option available.
|
||||
|
||||
| Architecture | SIMD Available | Default Codec | Decode Throughput |
|
||||
|---|---|---|---|
|
||||
| x86_64 + AVX2 | AVX2 inline SIMD | **VaptVupt** | ~2–3 GB/s |
|
||||
| x86_64 (no AVX2) | Scalar | Zupt-LZHP | ~500 MB/s |
|
||||
| x86_64 (no AVX2) | Scalar | VaptVupt-LZHP | ~500 MB/s |
|
||||
| aarch64 + NEON | NEON SIMD | **VaptVupt** | ~1–2 GB/s |
|
||||
| armhf, ppc64le, s390x, riscv64 | Scalar | Zupt-LZHP | ~300–500 MB/s |
|
||||
| armhf, ppc64le, s390x, riscv64 | Scalar | VaptVupt-LZHP | ~300–500 MB/s |
|
||||
|
||||
**Decompression is universal.** An archive created with VaptVupt on x86_64 extracts on aarch64 (using NEON or scalar decode), and vice versa. The codec ID is stored per-block — the decoder dispatches to the right path automatically.
|
||||
|
||||
Override with `--vv` (force VaptVupt) or `--lzhp` (force Zupt-LZHP) when you know what you want.
|
||||
Override with `--vv` (force VaptVupt) or `--lzhp` (force VaptVupt-LZHP) when you know what you want.
|
||||
|
||||
---
|
||||
|
||||
## VaptVupt Codec
|
||||
|
||||
VaptVupt is Zupt's high-performance compression codec. It combines LZ77 dictionary matching with tANS (table-based Asymmetric Numeral Systems) entropy coding and SIMD-accelerated decompression.
|
||||
VaptVupt is the project's high-performance compression codec. It combines LZ77 dictionary matching with tANS (table-based Asymmetric Numeral Systems) entropy coding and SIMD-accelerated decompression.
|
||||
|
||||
**This release embeds VaptVupt 2.60.4** (security release: fixes an OOB
|
||||
heap write in the AVX2 decode fast path; adds canonical CBMC-verified
|
||||
|
|
@ -243,9 +253,9 @@ Format: v1 frame (default) and v2 frame (T-tag, min_match=3) for binary data
|
|||
| Balanced | `-l 3` to `-l 7` (default) | 48 | 4-way ANS | General backup data |
|
||||
| Extreme | `-l 8` to `-l 9` | 256 | Order-1 context ANS + cost-aware lazy parser | Maximum compression |
|
||||
|
||||
The Zupt wrapper enables VaptVupt's `format_v2` flag (4–7% better real-binary ratio) automatically for Balanced and Extreme modes. Ultra-Fast stays on the v1 frame because the `format_v2 + ULTRA_FAST` combination is not yet covered by VaptVupt's upstream test matrix.
|
||||
The VaptVupt wrapper enables VaptVupt's `format_v2` flag (4–7% better real-binary ratio) automatically for Balanced and Extreme modes. Ultra-Fast stays on the v1 frame because the `format_v2 + ULTRA_FAST` combination is not yet covered by VaptVupt's upstream test matrix.
|
||||
|
||||
### Benchmark Results (v3.8.0, codec 2.60.4)
|
||||
### Benchmark Results (codec 2.60.4)
|
||||
|
||||
> Full, reproducible measured benchmarks — compression ratio/speed
|
||||
> across levels, crypto overhead (KDF vs per-block), and a head-to-head
|
||||
|
|
@ -306,10 +316,10 @@ Honest reading (these are measured numbers, not aspirations):
|
|||
incompressibility wall; the comparison degenerates to
|
||||
framing-overhead measurement.
|
||||
|
||||
### Security Test Results (v3.0.0 release)
|
||||
### Security Test Results (v4.0.0 release)
|
||||
|
||||
Every release re-runs the full security regression matrix. These are
|
||||
the v3.0.0 numbers:
|
||||
the v4.0.0 numbers:
|
||||
|
||||
| Test | Coverage | Result |
|
||||
|---------------------------------|--------------------------------------------------------------------------|-------------------|
|
||||
|
|
@ -376,22 +386,22 @@ Clone entire disks, partitions, or raw images with compression and encryption in
|
|||
### Quick start
|
||||
```bash
|
||||
# Clone a partition (requires read access)
|
||||
sudo zupt disk backup backup.zupt /dev/sda1
|
||||
sudo vaptvupt disk backup backup.zupt /dev/sda1
|
||||
|
||||
# Clone with post-quantum encryption (strongest)
|
||||
zupt keygen -o mykey.key
|
||||
zupt keygen --pub -o pub.key -k mykey.key
|
||||
sudo zupt disk backup --pq pub.key backup.zupt /dev/nvme0n1p2
|
||||
vaptvupt keygen -o mykey.key
|
||||
vaptvupt keygen --pub -o pub.key -k mykey.key
|
||||
sudo vaptvupt disk backup --pq pub.key backup.zupt /dev/nvme0n1p2
|
||||
|
||||
# Clone with password encryption
|
||||
sudo zupt disk backup -p backup.zupt /dev/sda1
|
||||
sudo vaptvupt disk backup -p backup.zupt /dev/sda1
|
||||
|
||||
# Maximum compression (level 9, extreme mode)
|
||||
sudo zupt disk backup -l 9 backup.zupt /dev/sda1
|
||||
sudo vaptvupt disk backup -l 9 backup.zupt /dev/sda1
|
||||
|
||||
# Restore to a device or file
|
||||
sudo zupt disk restore backup.zupt /dev/sda1
|
||||
sudo zupt disk restore --pq mykey.key backup.zupt /dev/sda1
|
||||
sudo vaptvupt disk restore backup.zupt /dev/sda1
|
||||
sudo vaptvupt disk restore --pq mykey.key backup.zupt /dev/sda1
|
||||
```
|
||||
|
||||
### How it works
|
||||
|
|
@ -404,7 +414,7 @@ Source device → Read 4MB blocks → Sparse detection → Compress → Encrypt
|
|||
└─ Zero blocks stored as STORE (near-zero overhead)
|
||||
```
|
||||
|
||||
Zupt reads the source device sequentially in 4MB chunks. Each block is checked for all-zero content (sparse detection uses 8-byte-wide comparison). Zero blocks are stored with codec `STORE` — effectively just the block header with no payload, saving both compression CPU time and archive space. Non-zero blocks are compressed with the selected codec and optionally encrypted. Per-block XXH64 checksums ensure byte-for-byte integrity on restore.
|
||||
VaptVupt reads the source device sequentially in 4MB chunks. Each block is checked for all-zero content (sparse detection uses 8-byte-wide comparison). Zero blocks are stored with codec `STORE` — effectively just the block header with no payload, saving both compression CPU time and archive space. Non-zero blocks are compressed with the selected codec and optionally encrypted. Per-block XXH64 checksums ensure byte-for-byte integrity on restore.
|
||||
|
||||
### Best practices
|
||||
|
||||
|
|
@ -426,16 +436,16 @@ Zupt reads the source device sequentially in 4MB chunks. Each block is checked f
|
|||
|
||||
**Operational guidance:**
|
||||
|
||||
- **Unmount before backup** for filesystem consistency. For live systems, use LVM snapshots or filesystem freeze: `fsfreeze -f /mnt/data && zupt disk backup ... && fsfreeze -u /mnt/data`.
|
||||
- **Unmount before backup** for filesystem consistency. For live systems, use LVM snapshots or filesystem freeze: `fsfreeze -f /mnt/data && vaptvupt disk backup ... && fsfreeze -u /mnt/data`.
|
||||
- **Block devices require root** on Linux. Regular files (disk images, `.img`, `.raw`) do not.
|
||||
- **Sparse-heavy disks** (freshly formatted, VMs with thin provisioning) compress extremely well — the sparse detector skips zero blocks at memory-copy speed with no compression overhead.
|
||||
- **Verify after backup** with `zupt test archive.zupt` — checks every block's XXH64 checksum without extracting.
|
||||
- **Verify after backup** with `vaptvupt test archive.zupt` — checks every block's XXH64 checksum without extracting.
|
||||
- **PQ encryption for long-term** — disk backups stored for years should use `--pq` to resist future quantum attacks. Generate one keypair, store the private key offline, distribute the public key.
|
||||
- **Restore is non-destructive on files** — writing to a regular file creates/overwrites it. Writing to a block device overwrites the raw device. Double-check the target path before restoring to a device.
|
||||
|
||||
### Comparison with other tools
|
||||
|
||||
| Feature | Zupt disk | dd + gzip | Clonezilla | partclone |
|
||||
| Feature | VaptVupt disk | dd + gzip | Clonezilla | partclone |
|
||||
|---------|-----------|-----------|------------|-----------|
|
||||
| Compression | VaptVupt/LZHP (adaptive) | gzip (fixed) | Multiple | Multiple |
|
||||
| Encryption | AES-256 + PQ hybrid | None (pipe to gpg) | None | None |
|
||||
|
|
@ -449,7 +459,7 @@ Zupt reads the source device sequentially in 4MB chunks. Each block is checked f
|
|||
|
||||
## Multi-Architecture Support
|
||||
|
||||
Zupt builds and runs on all major architectures. The Makefile auto-detects the platform and enables the best available features.
|
||||
VaptVupt builds and runs on all major architectures. The Makefile auto-detects the platform and enables the best available features.
|
||||
|
||||
| Feature | x86_64 | aarch64 | armhf | ppc64le | s390x | riscv64 |
|
||||
|---------|--------|---------|-------|---------|-------|---------|
|
||||
|
|
@ -470,10 +480,10 @@ make install DESTDIR=/buildroot
|
|||
|
||||
## Feature Comparison
|
||||
|
||||
| Feature | Zupt v2.1 | gzip | zstd | 7-Zip |
|
||||
| Feature | VaptVupt v4.0 | gzip | zstd | 7-Zip |
|
||||
|---------|-----------|------|------|-------|
|
||||
| Default codec | VaptVupt/LZHP (auto) | DEFLATE | FSE+Huffman | LZMA2 |
|
||||
| Full-disk backup | **`zupt disk`** | — | — | — |
|
||||
| Full-disk backup | **`vaptvupt disk`** | — | — | — |
|
||||
| Post-quantum encryption | **ML-KEM-768** | — | — | — |
|
||||
| Password encryption | AES-256 + HMAC | — | — | AES-256 |
|
||||
| AES-NI hardware accel | **Jasmin-verified** | — | — | — |
|
||||
|
|
@ -507,7 +517,7 @@ Verification: 5 Jasmin CT proofs, 19 ACSL contracts, 16 NIST/RFC test vectors
|
|||
**Audit history:** Three internal audit sprints conducted on the 2.2.x line.
|
||||
**14 bugs** found and fixed across the sprints — including one **HIGH-severity
|
||||
Zip Slip path traversal** caught in the formal audit pass. Cumulative test
|
||||
surface: **265 tests** (47 zupt + 169 SDK + 49 inherited) plus **751,000
|
||||
surface: **265 tests** (47 vaptvupt + 169 SDK + 49 inherited) plus **751,000
|
||||
mutation-fuzz iterations** under ASAN/UBSAN, all passing. No external audit
|
||||
yet — see SECURITY.md for honest scope.
|
||||
|
||||
|
|
@ -520,16 +530,16 @@ methodology used in audit sprints.
|
|||
## Usage
|
||||
|
||||
```
|
||||
zupt compress [OPTIONS] <output.zupt> <files/dirs...>
|
||||
zupt extract [OPTIONS] <archive.zupt>
|
||||
zupt list [OPTIONS] <archive.zupt>
|
||||
zupt test [OPTIONS] <archive.zupt>
|
||||
zupt disk backup [OPTIONS] <output.zupt> <device_or_file>
|
||||
zupt disk restore [OPTIONS] <archive.zupt> <target>
|
||||
zupt bench [--compare] <files/dirs...>
|
||||
zupt keygen [-o file] [--pub] [-k privkey]
|
||||
zupt version
|
||||
zupt help
|
||||
vaptvupt compress [OPTIONS] <output.zupt> <files/dirs...>
|
||||
vaptvupt extract [OPTIONS] <archive.zupt>
|
||||
vaptvupt list [OPTIONS] <archive.zupt>
|
||||
vaptvupt test [OPTIONS] <archive.zupt>
|
||||
vaptvupt disk backup [OPTIONS] <output.zupt> <device_or_file>
|
||||
vaptvupt disk restore [OPTIONS] <archive.zupt> <target>
|
||||
vaptvupt bench [--compare] <files/dirs...>
|
||||
vaptvupt keygen [-o file] [--pub] [-k privkey]
|
||||
vaptvupt version
|
||||
vaptvupt help
|
||||
```
|
||||
|
||||
| Option | Description |
|
||||
|
|
@ -540,9 +550,9 @@ zupt help
|
|||
| `--pq <keyfile>` | Post-quantum hybrid encryption |
|
||||
| `-o <DIR>` | Output directory (extract) |
|
||||
| `-s` | Store without compression |
|
||||
| `-f` | Fast LZ codec (Zupt-LZ) |
|
||||
| `-f` | Fast LZ codec (VaptVupt-LZ) |
|
||||
| `--vv` | Force VaptVupt codec |
|
||||
| `--lzhp` | Force Zupt-LZHP codec |
|
||||
| `--lzhp` | Force VaptVupt-LZHP codec |
|
||||
| `-v` | Verbose |
|
||||
| `--solid` | Solid mode (cross-file LZ context) |
|
||||
| `--compare` | Codec comparison benchmark |
|
||||
|
|
@ -565,9 +575,9 @@ build.bat # Windows (MSVC)
|
|||
|
||||
### Benchmark
|
||||
```bash
|
||||
zupt bench ~/Documents/ # Per-level benchmark (levels 1-9)
|
||||
zupt bench --compare # Cross-codec comparison (auto-generates corpus)
|
||||
zupt bench --compare ~/Documents/ # Compare codecs on your own data
|
||||
vaptvupt bench ~/Documents/ # Per-level benchmark (levels 1-9)
|
||||
vaptvupt bench --compare # Cross-codec comparison (auto-generates corpus)
|
||||
vaptvupt bench --compare ~/Documents/ # Compare codecs on your own data
|
||||
```
|
||||
|
||||
---
|
||||
|
|
@ -577,12 +587,12 @@ zupt bench --compare ~/Documents/ # Compare codecs on your own data
|
|||
| ID | Name | Algorithm | Default on | Override |
|
||||
|----|------|-----------|------------|----------|
|
||||
| `0x0010` | **VaptVupt** | LZ77 + tANS + AVX2/NEON SIMD | x86_64 (AVX2), aarch64 (NEON) | `--vv` |
|
||||
| `0x000A` | **Zupt-LZHP** | LZ77 + Huffman + byte prediction | armhf, ppc64le, s390x, riscv64 | `--lzhp` |
|
||||
| `0x0009` | Zupt-LZH | LZ77 + Huffman | — | — |
|
||||
| `0x0008` | Zupt-LZ | Fast LZ77, 64KB window | — | `-f` |
|
||||
| `0x000A` | **VaptVupt-LZHP** | LZ77 + Huffman + byte prediction | armhf, ppc64le, s390x, riscv64 | `--lzhp` |
|
||||
| `0x0009` | VaptVupt-LZH | LZ77 + Huffman | — | — |
|
||||
| `0x0008` | VaptVupt-LZ | Fast LZ77, 64KB window | — | `-f` |
|
||||
| `0x0000` | Store | No compression | — | `-s` |
|
||||
|
||||
All codecs are forward-compatible: archives created with any codec can be read by any Zupt version that includes that codec, on any architecture. VaptVupt archives require Zupt v2.0+.
|
||||
All codecs are forward-compatible: archives created with any codec can be read by any VaptVupt version that includes that codec, on any architecture. VaptVupt archives require VaptVupt v2.0+.
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -599,12 +609,22 @@ All codecs are forward-compatible: archives created with any codec can be read b
|
|||
| v2.0 | VaptVupt 1.1.0 codec, auto hardware detection, all 5 Jasmin wired, AVX SIGILL fix, copy_match/litlen fixes, ACSL, mlock, fuzzing, canaries, AES-NI pipeline, MT decompress, multi-arch (6 arches), --lzhp flag |
|
||||
| v2.1.0 | VaptVupt 1.4.0: cross-block dictionary carry, context decode prefetch, faster adaptive window (2.6× encode), integration API |
|
||||
| v2.1.1 | Termux/Android build fix, arch-safety guard, Keccak ROL64 UB fix, zero UBSan violations |
|
||||
| v2.1.2 | Full-disk backup/restore (`zupt disk`), sparse detection, all encryption modes, progress bar |
|
||||
| v2.1.2 | Full-disk backup/restore (`disk` subcommand), sparse detection, all encryption modes, progress bar |
|
||||
| v2.1.3 | LZHP prediction encoding fix (data corruption on structured data), shared write_enc_header, SOLID flag removed from disk, 78 tests |
|
||||
| v2.1.4 | CodeQL: 4 security fixes — TOCTOU races eliminated (fstat on fd), X25519 scalar wipe via volatile |
|
||||
| v2.1.5 | Block-level deduplication (`--dedup`), XXH64 fingerprint index, DEDUP_REF block type, 81 tests |
|
||||
| v2.2.0–v2.2.2 | libzuptsdk 2.0 integration (HKDF-SHA3 combiner + key commitment + HPKE binding + Argon2id), `--pq-sdk` mode (XChaCha20-Poly1305 / AES-256-SIV), license-hygiene cleanup, full SPDX coverage |
|
||||
| **v2.2.3** | **VaptVupt 2.48.2 codec integration: cost-aware lazy parser (beats zstd-3 by 1.07% aggregate), 4-stream Huffman, `format_v2` flag (4–7% better binary), `compat_v246_5_decoder` flag, encoder memory hygiene (`vv_secure_zero` on free), Sprint 117 hardened-build compatibility. Wrapper defaults applied per upstream `ZUPT_INTEGRATION.md`: `checksum=0` (Zupt's outer MAC authenticates), `format_v2=1` for BALANCED/EXTREME (defensive guard against the upstream-untested `format_v2 + ULTRA_FAST` combo). Makefile arch-detection bug fixed (`x86-64` ≠ `x86_64` mismatch). 22/22 regression tests, 14/14 threaded, 10/10 PQ, 11/11 VaptVupt, 13/13 NIST vectors, ASAN/UBSAN clean across plain/password/PQ-SDK at all levels.** |
|
||||
| v2.2.3 | VaptVupt 2.48.2 codec integration: cost-aware lazy parser, 4-stream Huffman, `format_v2` flag (4–7% better binary), encoder memory hygiene (`vv_secure_zero` on free). Makefile arch-detection fix. ASAN/UBSAN clean across plain/password/PQ-SDK at all levels |
|
||||
| v2.2.4–v2.2.5 | Audit sprint: findings F-01..F-07 closed, including F-06 (high) HMAC accept-on-disjoint-bits |
|
||||
| v2.3.0–v2.3.1 | F-08/F-09 closed: archive-integrity trailer + preface-AAD MAC — exhaustive byte sweep 0/1827 undetected (format v1.5 → v1.6) |
|
||||
| v2.4.x | Argon2id default KDF (F-10), error-message hygiene (F-11), encrypted archive comments (F-12), packaging arc (deb, RPM, AUR, Nix, Homebrew, openSUSE OBS), CI rewrite, THREAT_MODEL.md, manpage + shell completions, distro-safe `make check` |
|
||||
| v3.0.0 | **Renamed Zupt → VaptVupt** (INPI Brasil trademark), VV codec 2.48.5, GUI binary-discovery fix. Wire format unchanged; `zupt` kept as compat symlink |
|
||||
| v3.0.1–v3.0.3 | GUI license/version-parsing cleanup, F-13 (usage() literal size), static-analysis cleanup |
|
||||
| v3.1.0 | Codec 2.48.5 → 2.53.3, decode over-copy fix |
|
||||
| v3.2.0–v3.3.0 | SHA-256 hardware acceleration (Intel SHA-NI), incremental per-block HMAC (drops a malloc + full copy per block) |
|
||||
| v3.4.0–v3.7.0 | F-15 KDF parameter transparency, measured constant-time MAC comparison (dudect), NIST SP 800-38A AES-CTR vectors, ML-KEM decaps routed through the audited CT primitive |
|
||||
| v3.8.0 | Consolidated measured benchmarks + constant-time test robustness |
|
||||
| **v4.0.0** | **Codec 2.60.4 security release (OOB heap write fixed in AVX2 decode fast path), `--pq-box` sealed-box mode (libpqvaptvupt 0.6.0, HKDF-SHA256 combiner), F-16 data-loss disclosure + fix (old in-tree BCJ encoder), CBMC-verified BCJ filters with auto ELF/PE/Mach-O detection, SHA-NI measured 5.8×. Wire format stays v1.6** |
|
||||
|
||||
See [CHANGELOG.md](CHANGELOG.md) for detailed per-version changes.
|
||||
|
||||
|
|
@ -612,13 +632,13 @@ See [CHANGELOG.md](CHANGELOG.md) for detailed per-version changes.
|
|||
|
||||
## License
|
||||
|
||||
Zupt is **dual-licensed**:
|
||||
VaptVupt is **dual-licensed**:
|
||||
|
||||
- **AGPL-3.0-or-later** — most of the codebase (CLI, libzuptsdk, GUI, Jasmin source). See [`LICENSE`](LICENSE).
|
||||
- **GPL-3.0-or-later** — the VaptVupt LZ codec only (`src/vv_*.c`, `src/vaptvupt_api.c` and headers). VaptVupt is GPL so it can be considered for upstreaming into the Linux/BSD kernels.
|
||||
- **Commercial license** available for relief from AGPL/GPL terms. Contact `sac@securityops.co`.
|
||||
|
||||
Every source file carries an explicit SPDX header. See [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) for full attribution. Zupt contains **no third-party source code** — every line is original work.
|
||||
Every source file carries an explicit SPDX header. See [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) for full attribution. VaptVupt contains **no third-party source code** — every line is original work.
|
||||
|
||||
Security vulnerabilities: see [SECURITY.md](SECURITY.md).
|
||||
|
||||
|
|
@ -626,14 +646,14 @@ Security vulnerabilities: see [SECURITY.md](SECURITY.md).
|
|||
|
||||
All by Cristian Cezar Moisés, hosted on git.securityops.co:
|
||||
|
||||
- [zupt](https://git.securityops.co/cristiancmoises/zupt) — this repo (CLI + GUI)
|
||||
- [vaptvupt](https://git.securityops.co/cristiancmoises/vaptvupt) — this repo (CLI + GUI)
|
||||
- [zupt-android](https://git.securityops.co/cristiancmoises/zupt-android) — Android port
|
||||
- [zupt-web](https://git.securityops.co/cristiancmoises/zupt-web) — Web frontend
|
||||
- [libzuptsdk](https://git.securityops.co/cristiancmoises/libzuptsdk) — Standalone C SDK
|
||||
- [vaptvupt](https://git.securityops.co/cristiancmoises/vaptvupt) — Standalone LZ + tANS codec
|
||||
- [libvuptsdk](https://git.securityops.co/cristiancmoises/libvuptsdk) — Standalone C SDK
|
||||
- [vaptvupt-codec](https://git.securityops.co/cristiancmoises/vaptvupt-codec) — Standalone LZ + tANS codec
|
||||
|
||||
## Support the Project
|
||||
If you find Zupt useful, please consider sharing it or contributing — see the README footer for contact links.
|
||||
If you find VaptVupt useful, please consider sharing it or contributing — see the README footer for contact links.
|
||||
|
||||
---
|
||||
© 2026 Cristian Cezar Moisés — [git.securityops.co/cristiancmoises](https://git.securityops.co/cristiancmoises)
|
||||
|
|
|
|||
14
ROADMAP.md
14
ROADMAP.md
|
|
@ -1,4 +1,4 @@
|
|||
# Zupt — Roadmap
|
||||
# VaptVupt — Roadmap
|
||||
|
||||
## Released
|
||||
|
||||
|
|
@ -6,8 +6,8 @@
|
|||
|---------|--------|-------------|
|
||||
| v0.1 | ✅ | Initial release — LZ77 compression, `.zupt` format, XXH64 checksums |
|
||||
| v0.2 | ✅ | AES-256-CTR + HMAC-SHA256 encryption, PBKDF2, directory recursion |
|
||||
| v0.3 | ✅ | Zupt-LZH codec — LZ77 + Huffman, 1MB window, near-optimal parsing |
|
||||
| v0.4 | ✅ | Byte prediction preprocessor (Zupt-LZHP), solid mode |
|
||||
| v0.3 | ✅ | VaptVupt-LZH codec — LZ77 + Huffman, 1MB window, near-optimal parsing |
|
||||
| v0.4 | ✅ | Byte prediction preprocessor (VaptVupt-LZHP), solid mode |
|
||||
| v0.5 | ✅ | Security hardening — 16 bug fixes, Huffman codec fix, CSPRNG hardened |
|
||||
| v0.6 | ✅ | Multi-threaded compression (`-t N`), batch-parallel pipeline |
|
||||
| v0.7 | ✅ | Post-quantum hybrid encryption (ML-KEM-768 + X25519) |
|
||||
|
|
@ -33,10 +33,10 @@
|
|||
| v2.4.0 | ✅ | Methodology release. `PROMPT.md` → v2: NEW §3.5 exhaustive byte-sweep mandate after format changes, sprint protocol gains a step, §11 outage table grows four rows for F-06..F-09. Makefile help banner now auto-derived from `include/zupt.h` (closes a recurring banner-drift bug). No source/binary changes; archives byte-identical to v2.3.1. |
|
||||
| v2.4.1 | ✅ | F-10: password-mode KDF default flipped from PBKDF2-SHA256 to Argon2id (libzuptsdk). PBKDF2 remains available via `--kdf pbkdf2` for v2.4.0-and-older reader compatibility. No format change; v2.4.0 already supports reading Argon2id archives via existing enc_type dispatch. F-11 (auth-fail vs integrity-fail error message UX) opened, deferred. |
|
||||
| v2.4.2 | ✅ | F-11 closed: wrong-password and tampered-archive error messages collapsed into one uniform `Authentication failed (wrong key, wrong password, or tampered archive)` line. Detailed top-MAC wording moves behind `--verbose`. Plaintext tamper keeps detailed XXH64 wording (no key, no oracle concern). Eliminates a verbal probe-oracle that was leaking which failure cause hit first. No format change. |
|
||||
| v2.4.3 | ✅ | F-12 closed: encrypted archive comments. Implements the previously-reserved `comment_offset` header field via new block type `ZUPT_BLOCK_COMMENT = 0x05`. Comments are UTF-8, up to 4096 bytes, encrypted using the same per-block AEAD pipeline as data blocks (including F-09 preface AAD). `hdr.comment_offset` is in the AIT-signed region, so pointer tampering → auth-fail. CLI flags `-c` / `--comment` and `--comment-file`. `zupt info` reports presence without decrypting; `zupt x` displays comment after extract. v2.4.2 readers extract v2.4.3 archives byte-exact (they ignore `comment_offset`). Format still v1.6. Exhaustive byte sweep on 1878-byte archive with comment: 0/1878 silent accepts. |
|
||||
| v2.4.4 | ✅ | Distribution packaging + reproducible source tarball. New `make dist` produces byte-identical `zupt-VERSION.tar.gz`; regression test `tests/test_dist_reproducible.sh` asserts two consecutive runs produce identical sha256. Upstream packaging recipes added at `packaging/aur/PKGBUILD`, `packaging/debian/{control,rules,changelog,copyright,source/format}`, and `packaging/homebrew/zupt.rb`. No source-code changes, no format changes. |
|
||||
| v2.4.5 | ✅ | Packaging arc completion. New `packaging/rpm/zupt.spec` (Fedora/RHEL/CentOS) and `packaging/nix/flake.nix` (NixOS, x86_64 + aarch64). New `DISTRIBUTION.md` covers all 5 packaging methods with concrete submission flows. New `tests/test_packaging_syntax.sh` (18 assertions, wired into `make test`) enforces cross-recipe version consistency and basic syntax validity. No source-code changes. |
|
||||
| v2.4.6 | ✅ | CI + threat model. Rewrote `.github/workflows/ci.yml` from 4 jobs to 8 (matrix builds, strict warnings, ASAN, PIE, aarch64, dist-reproducibility, packaging-syntax, tag-triggered release). New `THREAT_MODEL.md` (12 KB) documents what Zupt protects against and — explicitly per userPreferences — what it does NOT. Packaging-syntax test expanded 18 → 22. No source-code changes. |
|
||||
| v2.4.3 | ✅ | F-12 closed: encrypted archive comments. Implements the previously-reserved `comment_offset` header field via new block type `ZUPT_BLOCK_COMMENT = 0x05`. Comments are UTF-8, up to 4096 bytes, encrypted using the same per-block AEAD pipeline as data blocks (including F-09 preface AAD). `hdr.comment_offset` is in the AIT-signed region, so pointer tampering → auth-fail. CLI flags `-c` / `--comment` and `--comment-file`. `vaptvupt info` reports presence without decrypting; `vaptvupt x` displays comment after extract. v2.4.2 readers extract v2.4.3 archives byte-exact (they ignore `comment_offset`). Format still v1.6. Exhaustive byte sweep on 1878-byte archive with comment: 0/1878 silent accepts. |
|
||||
| v2.4.4 | ✅ | Distribution packaging + reproducible source tarball. New `make dist` produces byte-identical `vaptvupt-VERSION.tar.gz`; regression test `tests/test_dist_reproducible.sh` asserts two consecutive runs produce identical sha256. Upstream packaging recipes added at `packaging/aur/PKGBUILD`, `packaging/debian/{control,rules,changelog,copyright,source/format}`, and `packaging/homebrew/vaptvupt.rb`. No source-code changes, no format changes. |
|
||||
| v2.4.5 | ✅ | Packaging arc completion. New `packaging/rpm/vaptvupt.spec` (Fedora/RHEL/CentOS) and `packaging/nix/flake.nix` (NixOS, x86_64 + aarch64). New `DISTRIBUTION.md` covers all 5 packaging methods with concrete submission flows. New `tests/test_packaging_syntax.sh` (18 assertions, wired into `make test`) enforces cross-recipe version consistency and basic syntax validity. No source-code changes. |
|
||||
| v2.4.6 | ✅ | CI + threat model. Rewrote `.github/workflows/ci.yml` from 4 jobs to 8 (matrix builds, strict warnings, ASAN, PIE, aarch64, dist-reproducibility, packaging-syntax, tag-triggered release). New `THREAT_MODEL.md` (12 KB) documents what VaptVupt protects against and — explicitly per userPreferences — what it does NOT. Packaging-syntax test expanded 18 → 22. No source-code changes. |
|
||||
| v2.4.7 | ✅ | Manpage refresh + shell completions. |
|
||||
| v2.4.8 | ✅ | Distro-safe `make check` target + binary packages. |
|
||||
| v3.0.0 | ✅ | MAJOR: Zupt → VaptVupt rename, VV codec 2.48.5, GUI binary-discovery fix. |
|
||||
|
|
|
|||
26
SECURITY.md
26
SECURITY.md
|
|
@ -1,4 +1,4 @@
|
|||
# Security Policy — Zupt
|
||||
# Security Policy — VaptVupt
|
||||
|
||||
## Reporting Vulnerabilities
|
||||
|
||||
|
|
@ -108,7 +108,7 @@ These functions are compiled from Jasmin source to x86-64 assembly. The Jasmin c
|
|||
|
||||
## Threat Model
|
||||
|
||||
### What Zupt Protects
|
||||
### What VaptVupt Protects
|
||||
|
||||
| Asset | Protection |
|
||||
|-------|-----------|
|
||||
|
|
@ -123,7 +123,7 @@ These functions are compiled from Jasmin source to x86-64 assembly. The Jasmin c
|
|||
| Against tampering of archive comment (when present) | v2.4.3 (F-12): comment block goes through the same per-block AEAD pipeline as data (AES-256-CTR + HMAC-SHA256 + preface AAD); `hdr.comment_offset` pointer is in the AIT-signed region. Both payload and pointer are MAC-covered end-to-end. |
|
||||
| Against quantum adversary | `--pq` mode: ML-KEM-768 (NIST Level 3) |
|
||||
|
||||
### What Zupt Does NOT Protect Against
|
||||
### What VaptVupt Does NOT Protect Against
|
||||
|
||||
| Threat | Reason | Mitigation Path |
|
||||
|--------|--------|----------------|
|
||||
|
|
@ -132,7 +132,7 @@ These functions are compiled from Jasmin source to x86-64 assembly. The Jasmin c
|
|||
| Memory forensics during operation | Keys on stack during compress/extract | `zupt_secure_wipe()` on completion; `mlock()` planned |
|
||||
| Deniability | Archive header identifies format | `.zupt` magic bytes visible; ENCRYPTED flag in header |
|
||||
| Weak passwords | Argon2id (default, v2.4.1+) is memory-hard and adds ~25–30 bits of work factor vs ~20 for PBKDF2. PBKDF2-SHA256 with 600k iterations available via `--kdf pbkdf2` for legacy reader compatibility. | Use `--pq` or `--pq-sdk` mode for critical data — keys are random, not derived from a password. |
|
||||
| Traffic analysis | Archive size reveals data volume | Outside Zupt's scope |
|
||||
| Traffic analysis | Archive size reveals data volume | Outside VaptVupt's scope |
|
||||
| File permission/ownership | Not stored in archive | Documented in README.md (Architecture & platform support) |
|
||||
|
||||
### Quantum Threat Analysis
|
||||
|
|
@ -156,7 +156,7 @@ In `--pq` mode: even if Shor's algorithm breaks X25519, ML-KEM-768 protects the
|
|||
| macOS | `/dev/urandom` | None | **Hard exit** |
|
||||
| Windows | `RtlGenRandom` | None | **Hard exit** |
|
||||
|
||||
There is no `rand()`, `srand()`, or any weak PRNG fallback anywhere in the codebase. If the OS CSPRNG is unavailable, Zupt exits with an error. This is a deliberate design choice — weak random keys are worse than no encryption.
|
||||
There is no `rand()`, `srand()`, or any weak PRNG fallback anywhere in the codebase. If the OS CSPRNG is unavailable, VaptVupt exits with an error. This is a deliberate design choice — weak random keys are worse than no encryption.
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -202,7 +202,7 @@ make test-asan # Zero ASAN/UBSAN errors
|
|||
make test-vectors && ./test_vectors # 13/13 pass
|
||||
|
||||
# Verify Jasmin symbols are active
|
||||
nm zupt | grep "zupt_mac_verify_ct\|zupt_ct_select_32"
|
||||
nm vaptvupt | grep "zupt_mac_verify_ct\|zupt_ct_select_32"
|
||||
# Expected: T zupt_mac_verify_ct
|
||||
# T zupt_ct_select_32
|
||||
|
||||
|
|
@ -217,7 +217,7 @@ jasminc -arch x86-64 -o /dev/null jasmin/zupt_mlkem_select.jazz
|
|||
|
||||
## Production deployment notes (v2.2.1)
|
||||
|
||||
Zupt is deployed in production environments. The following supported
|
||||
VaptVupt is deployed in production environments. The following supported
|
||||
configurations are considered current and receive security fixes:
|
||||
|
||||
| Channel | Supported | Notes |
|
||||
|
|
@ -232,9 +232,9 @@ configurations are considered current and receive security fixes:
|
|||
For new archives, use the libzuptsdk-backed mode:
|
||||
|
||||
```bash
|
||||
zupt keygen --sdk -o key.priv
|
||||
zupt c --pq-sdk key.priv.pub backup.zupt /path/to/data
|
||||
zupt x --pq-sdk key.priv backup.zupt
|
||||
vaptvupt keygen --sdk -o key.priv
|
||||
vaptvupt c --pq-sdk key.priv.pub backup.zupt /path/to/data
|
||||
vaptvupt x --pq-sdk key.priv backup.zupt
|
||||
```
|
||||
|
||||
This selects:
|
||||
|
|
@ -250,7 +250,7 @@ This selects:
|
|||
|
||||
### Threat model
|
||||
|
||||
Zupt assumes:
|
||||
VaptVupt assumes:
|
||||
|
||||
- The recipient's private key file is kept secret and is not exfiltrated.
|
||||
- The execution environment has a working `getrandom(2)` / `/dev/urandom`.
|
||||
|
|
@ -259,7 +259,7 @@ Zupt assumes:
|
|||
- An attacker may have full write access to the archive in transit; AEAD
|
||||
+ commitment + HPKE binding ensures any modification is detected.
|
||||
|
||||
Zupt does **not** defend against:
|
||||
VaptVupt does **not** defend against:
|
||||
|
||||
- Endpoint compromise (keylogger, malware on the machine where you type
|
||||
the password or hold the private key).
|
||||
|
|
@ -274,7 +274,7 @@ If you find a security issue:
|
|||
|
||||
1. **Do not** open a public issue on the project's git server.
|
||||
2. Email `zupt@riseup.net` with subject `SECURITY: <brief>`.
|
||||
3. Include the version (`zupt --version`), platform, and a
|
||||
3. Include the version (`vaptvupt --version`), platform, and a
|
||||
reproduction (a minimal archive or a code snippet).
|
||||
4. Expect acknowledgement within 7 days. Coordinated disclosure
|
||||
timeline will be discussed case by case.
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
THIRD-PARTY NOTICES
|
||||
===================
|
||||
|
||||
**Zupt contains no third-party source code.** Every line of source in
|
||||
**VaptVupt contains no third-party source code.** Every line of source in
|
||||
this repository is the work of Cristian Cezar Moisés. This document
|
||||
exists for transparency about runtime dependencies and build-time
|
||||
tools.
|
||||
|
||||
If you redistribute Zupt, you must preserve this attribution document
|
||||
If you redistribute VaptVupt, you must preserve this attribution document
|
||||
along with the LICENSE file.
|
||||
|
||||
-------------------------------------------------------------------------
|
||||
|
|
@ -15,20 +15,20 @@ Components shipped in this repository (all original work)
|
|||
|
||||
| Component | Location | License | Author |
|
||||
|---|---|---|---|
|
||||
| zupt CLI | src/, include/ | AGPL-3.0-or-later | Cristian Cezar Moisés |
|
||||
| vaptvupt CLI | src/, include/ | AGPL-3.0-or-later | Cristian Cezar Moisés |
|
||||
| libzuptsdk | sdk/, vendor/zuptsdk/include/ | AGPL-3.0-or-later | Cristian Cezar Moisés |
|
||||
| VaptVupt LZ codec | src/vv_*.c, src/vaptvupt_api.c, include/vaptvupt*.h | **GPL-3.0-or-later** | Cristian Cezar Moisés |
|
||||
| Jasmin constant-time crypto | jasmin/*.jazz, jasmin/*.s | AGPL-3.0-or-later | Cristian Cezar Moisés |
|
||||
| Zupt GUI (Python) | gui/ | AGPL-3.0-or-later | Cristian Cezar Moisés |
|
||||
| VaptVupt GUI (Python) | gui/ | AGPL-3.0-or-later | Cristian Cezar Moisés |
|
||||
|
||||
**Note on VaptVupt licensing**: VaptVupt is licensed GPL-3.0-or-later
|
||||
(not AGPL like the rest of Zupt) so that, with sufficient maturity, it
|
||||
(not AGPL like the rest of VaptVupt) so that, with sufficient maturity, it
|
||||
can be considered for upstreaming into the Linux or BSD kernels, which
|
||||
require GPL-compatible licenses. The author retains the right to dual-
|
||||
license VaptVupt under other terms for commercial use; contact
|
||||
sac@securityops.co for inquiries.
|
||||
|
||||
The rest of the project (zupt CLI, libzuptsdk, Jasmin source, GUI) is
|
||||
The rest of the project (vaptvupt CLI, libzuptsdk, Jasmin source, GUI) is
|
||||
licensed AGPL-3.0-or-later. Commercial licenses (relief from AGPL
|
||||
network-use clause) are available; contact sac@securityops.co.
|
||||
|
||||
|
|
@ -40,12 +40,12 @@ Build-time tool (not redistributed)
|
|||
|
||||
The constant-time cryptographic primitives in jasmin/*.jazz are
|
||||
compiled to native assembly (jasmin/*.s) using the external `jasminc`
|
||||
compiler. The jasminc tool is not bundled with Zupt; the AGPL .jazz
|
||||
compiler. The jasminc tool is not bundled with VaptVupt; the AGPL .jazz
|
||||
source files and their AGPL-licensed .s assembly output are bundled.
|
||||
|
||||
Upstream: https://github.com/jasmin-lang/jasmin
|
||||
License: MIT (the compiler itself; not relevant to Zupt's licensing)
|
||||
Used by: Zupt's build system, only when re-generating jasmin/*.s
|
||||
License: MIT (the compiler itself; not relevant to VaptVupt's licensing)
|
||||
Used by: VaptVupt's build system, only when re-generating jasmin/*.s
|
||||
from jasmin/*.jazz (most users won't need to do this —
|
||||
pre-built .s files ship in this repo).
|
||||
|
||||
|
|
@ -55,7 +55,7 @@ Runtime system libraries (linked from the OS, never bundled)
|
|||
|
||||
These are standard system libraries provided by the operating system's
|
||||
package manager (apt, dnf, pacman, etc.). They are dynamically linked
|
||||
at runtime and are NOT redistributed as part of Zupt.
|
||||
at runtime and are NOT redistributed as part of VaptVupt.
|
||||
|
||||
**libargon2** — Argon2id password hashing function (RFC 9106)
|
||||
|
||||
|
|
@ -79,7 +79,7 @@ at runtime and are NOT redistributed as part of Zupt.
|
|||
Compatibility with public standards
|
||||
-------------------------------------------------------------------------
|
||||
|
||||
Where Zupt implements public standards, it does so independently
|
||||
Where VaptVupt implements public standards, it does so independently
|
||||
from any reference implementation. No code has been copied from
|
||||
external projects. Standards followed:
|
||||
|
||||
|
|
@ -94,16 +94,16 @@ external projects. Standards followed:
|
|||
- RFC 9106 (Argon2)
|
||||
- RFC 9180 (HPKE)
|
||||
|
||||
The Zupt project was designed independently. Other projects in the
|
||||
The VaptVupt project was designed independently. Other projects in the
|
||||
post-quantum hybrid encryption space (libsodium, age, Tink, rustls,
|
||||
etc.) were referenced as prior art during design but no code was
|
||||
copied. Zupt does not include any code from these projects.
|
||||
copied. VaptVupt does not include any code from these projects.
|
||||
|
||||
-------------------------------------------------------------------------
|
||||
Reporting attribution issues
|
||||
-------------------------------------------------------------------------
|
||||
|
||||
If you believe Zupt redistributes code from a project not listed here,
|
||||
If you believe VaptVupt redistributes code from a project not listed here,
|
||||
or if attribution information is incomplete, please email:
|
||||
|
||||
sac@securityops.co
|
||||
|
|
@ -114,8 +114,8 @@ with the subject "[third-party]" and details of the issue.
|
|||
License summary
|
||||
-------------------------------------------------------------------------
|
||||
|
||||
Zupt CLI, libzuptsdk, Jasmin source, GUI: AGPL-3.0-or-later
|
||||
VaptVupt CLI, libzuptsdk, Jasmin source, GUI: AGPL-3.0-or-later
|
||||
VaptVupt LZ codec: GPL-3.0-or-later
|
||||
Commercial license (any component): contact sac@securityops.co
|
||||
|
||||
Project home: https://git.securityops.co/cristiancmoises/zupt
|
||||
Project home: https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
|
|
|
|||
|
|
@ -1,21 +1,21 @@
|
|||
# Zupt threat model
|
||||
# VaptVupt threat model
|
||||
|
||||
Plain-English description of what Zupt protects against, what it
|
||||
Plain-English description of what VaptVupt protects against, what it
|
||||
doesn't, and what assumptions you're making when you use it.
|
||||
|
||||
This document is for users and downstream packagers. Read it before
|
||||
trusting Zupt with anything you can't afford to lose.
|
||||
trusting VaptVupt with anything you can't afford to lose.
|
||||
|
||||
---
|
||||
|
||||
## TL;DR
|
||||
|
||||
Zupt is designed for **at-rest backup encryption** by someone who
|
||||
VaptVupt is designed for **at-rest backup encryption** by someone who
|
||||
controls the machine doing the encryption and the machine doing the
|
||||
extraction. It is **not** a network protocol, a multi-party scheme, or
|
||||
a substitute for full-disk encryption.
|
||||
|
||||
| Use case | Zupt is appropriate? |
|
||||
| Use case | VaptVupt is appropriate? |
|
||||
|---|---|
|
||||
| Backing up files to an untrusted cloud (S3, Backblaze, Google Drive) | **Yes** |
|
||||
| Backing up a disk image to external media you might lose | **Yes** |
|
||||
|
|
@ -28,7 +28,7 @@ a substitute for full-disk encryption.
|
|||
|
||||
---
|
||||
|
||||
## What Zupt protects against
|
||||
## What VaptVupt protects against
|
||||
|
||||
### 1. Confidentiality of archive contents (encrypted mode)
|
||||
|
||||
|
|
@ -109,14 +109,14 @@ accesses where feasible — but **without formal proof**.
|
|||
|
||||
---
|
||||
|
||||
## What Zupt does NOT protect against
|
||||
## What VaptVupt does NOT protect against
|
||||
|
||||
This list is **exhaustive of the major omissions** — if you have a
|
||||
concern that doesn't appear here, please file an issue.
|
||||
|
||||
### 1. Compromised endpoints
|
||||
|
||||
Zupt cannot protect against:
|
||||
VaptVupt cannot protect against:
|
||||
|
||||
- Malware on the machine doing the encryption (it sees plaintext
|
||||
before any crypto is applied)
|
||||
|
|
@ -127,14 +127,14 @@ Zupt cannot protect against:
|
|||
`~/.zupt-key` directly
|
||||
- Cold-boot attacks on running machines
|
||||
|
||||
If you don't trust the machine, Zupt cannot help.
|
||||
If you don't trust the machine, VaptVupt cannot help.
|
||||
|
||||
### 2. Key compromise
|
||||
|
||||
If the password or `~/.zupt-key` is leaked:
|
||||
|
||||
- All archives encrypted with that key are decryptable
|
||||
- Zupt has **no forward secrecy across archives** — each archive
|
||||
- VaptVupt has **no forward secrecy across archives** — each archive
|
||||
is encrypted under a single static key derived from the password
|
||||
or stored in the key file
|
||||
- There is no key-rotation feature; rotate by re-encrypting
|
||||
|
|
@ -160,7 +160,7 @@ clusters or cloud compute.
|
|||
| Random 16-char with full alphabet | Infeasible without quantum breakthrough |
|
||||
|
||||
For critical data, use `--pq-sdk` mode with a random key file
|
||||
generated by `zupt keygen --sdk` — the key is 64 bytes of CSPRNG
|
||||
generated by `vaptvupt keygen --sdk` — the key is 64 bytes of CSPRNG
|
||||
output, not derived from human-typed text.
|
||||
|
||||
### 4. Metadata leakage from archive structure
|
||||
|
|
@ -180,13 +180,13 @@ can infer:
|
|||
- **A random 16-byte UUID per archive** (no information leak, but
|
||||
globally identifies the archive across copies)
|
||||
|
||||
If metadata privacy matters, layer Zupt under another tool that
|
||||
If metadata privacy matters, layer VaptVupt under another tool that
|
||||
hides bulk metadata (e.g., put the `.zupt` file inside a fixed-size
|
||||
encrypted container).
|
||||
|
||||
### 5. Network attacks
|
||||
|
||||
Zupt is not a network protocol. There is no:
|
||||
VaptVupt is not a network protocol. There is no:
|
||||
|
||||
- Forward-secure session establishment (use TLS or Noise)
|
||||
- Mutual authentication of remote parties (use signed messages or
|
||||
|
|
@ -205,9 +205,9 @@ they must share the password or the key file.
|
|||
|
||||
### 7. Plausible deniability / hidden volumes
|
||||
|
||||
Zupt archives have a fixed 6-byte magic `\x90\x5a\x55\x50\x54\x01`
|
||||
at offset 0. Anyone scanning the bytes can see it's a Zupt
|
||||
archive. Zupt has **no hidden-volume or duress-password feature**.
|
||||
VaptVupt archives have a fixed 6-byte magic `\x90\x5a\x55\x50\x54\x01`
|
||||
at offset 0. Anyone scanning the bytes can see it's a VaptVupt
|
||||
archive. VaptVupt has **no hidden-volume or duress-password feature**.
|
||||
|
||||
### 8. Side channels we don't claim to address
|
||||
|
||||
|
|
@ -241,7 +241,7 @@ primary mitigation; report bugs.
|
|||
|
||||
### 11. Compression-side-channel attacks (CRIME / BREACH style)
|
||||
|
||||
Zupt compresses **before** encryption. If an attacker can:
|
||||
VaptVupt compresses **before** encryption. If an attacker can:
|
||||
|
||||
- Influence part of the plaintext (e.g. inject a known prefix)
|
||||
- Observe the resulting archive size precisely
|
||||
|
|
@ -250,7 +250,7 @@ then they can use the compression ratio to learn information about
|
|||
the rest of the plaintext — this is the classic CRIME/BREACH attack
|
||||
against TLS compression.
|
||||
|
||||
Zupt is designed for offline backup, where attacker-controlled
|
||||
VaptVupt is designed for offline backup, where attacker-controlled
|
||||
plaintext injection is rare. **If your threat model includes
|
||||
attacker-chosen plaintext mixed with secret plaintext in the same
|
||||
archive**, use `--no-compress` (codec 0 = STORE) to disable the
|
||||
|
|
@ -260,7 +260,7 @@ LZ codec and eliminate this side channel.
|
|||
|
||||
## Cryptographic assumptions
|
||||
|
||||
Zupt's security rests on the following standard assumptions:
|
||||
VaptVupt's security rests on the following standard assumptions:
|
||||
|
||||
| Assumption | What breaks if it fails |
|
||||
|---|---|
|
||||
|
|
@ -272,7 +272,7 @@ Zupt's security rests on the following standard assumptions:
|
|||
| HKDF-SHA256 is a secure key-derivation construction | Combined PQ + classical keys may be predictable |
|
||||
| SHA3 / SHAKE retain pre-image and collision resistance | Auxiliary protocol bindings may be forged |
|
||||
|
||||
If you don't trust one of these primitives, Zupt cannot protect
|
||||
If you don't trust one of these primitives, VaptVupt cannot protect
|
||||
you. We rely on the same primitives the broader cryptographic
|
||||
community has standardized.
|
||||
|
||||
|
|
@ -280,7 +280,7 @@ community has standardized.
|
|||
|
||||
## Reporting security issues
|
||||
|
||||
Email `sac@securityops.co` with the subject `Zupt security report`.
|
||||
Email `sac@securityops.co` with the subject `VaptVupt security report`.
|
||||
PGP key available on request.
|
||||
|
||||
We will:
|
||||
|
|
|
|||
127
doc/vaptvupt-gui.1
Normal file
127
doc/vaptvupt-gui.1
Normal file
|
|
@ -0,0 +1,127 @@
|
|||
.\" Manpage for vaptvupt-gui (formerly zupt-gui; INPI Brasil trademark rename in v3.0.0)
|
||||
.\" SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
.\" Copyright (c) 2025-2026 Cristian Cezar Moisés
|
||||
.TH VAPTVUPT-GUI 1 "2026-06-11" "vaptvupt-gui 1.3.0" "User Commands"
|
||||
.SH NAME
|
||||
vaptvupt-gui \- graphical interface for the VaptVupt post-quantum backup utility
|
||||
.SH SYNOPSIS
|
||||
.B vaptvupt-gui
|
||||
.RI [ ARCHIVE ]
|
||||
.SH DESCRIPTION
|
||||
.B vaptvupt-gui
|
||||
is a graphical frontend for
|
||||
.BR vaptvupt (1).
|
||||
It provides tabs for compression, extraction, key management, and
|
||||
full-disk backup. Both PQ encryption modes are exposed:
|
||||
.B legacy --pq
|
||||
and
|
||||
.B SDK v2 --pq-sdk
|
||||
(HKDF combiner, key commitment, HPKE binding, Argon2id).
|
||||
|
||||
The legacy command name
|
||||
.B zupt-gui
|
||||
is preserved as a symlink for backward compatibility; both invocations
|
||||
behave identically.
|
||||
|
||||
If
|
||||
.I ARCHIVE
|
||||
is given on the command line, the GUI opens directly on the
|
||||
extract tab with that archive preloaded.
|
||||
|
||||
.B vaptvupt-gui
|
||||
uses Qt 6. It works with either of the following Python Qt bindings,
|
||||
auto-detected at startup in this order:
|
||||
.IP \(bu 2
|
||||
PySide6 (Qt for Python)
|
||||
.IP \(bu 2
|
||||
PyQt6
|
||||
.PP
|
||||
If neither is installed, the GUI prints an instructive error and exits.
|
||||
|
||||
.SH TABS
|
||||
.TP
|
||||
.B Compress
|
||||
Select files or directories, choose codec, level, password and/or PQ
|
||||
key. The
|
||||
.B Mode
|
||||
panel controls whether the SDK v2 path or the legacy path is used.
|
||||
.TP
|
||||
.B Extract
|
||||
Open a .zupt archive, select output directory, provide password
|
||||
and/or PQ private key.
|
||||
.TP
|
||||
.B Keygen
|
||||
Generate ML-KEM-768 + X25519 keypair. The
|
||||
.B SDK v2 format
|
||||
checkbox controls whether the keypair is generated via
|
||||
.B vaptvupt keygen --sdk
|
||||
(producing
|
||||
.IR file
|
||||
and
|
||||
.IR file.pub
|
||||
in one step) or via the legacy
|
||||
.BR "vaptvupt keygen" .
|
||||
.TP
|
||||
.B Disk
|
||||
Full-disk backup and restore. Enumerates block devices with
|
||||
human-readable sizes. Same encryption mode controls as Compress.
|
||||
|
||||
.SH FILES
|
||||
.TP
|
||||
.I /usr/bin/vaptvupt-gui
|
||||
Wrapper script that invokes the Python entry point (and the symlinked
|
||||
legacy
|
||||
.IR /usr/bin/zupt-gui ).
|
||||
.TP
|
||||
.I /usr/lib/vaptvupt-gui/zupt_gui.py
|
||||
Main Python source.
|
||||
.TP
|
||||
.I /usr/share/applications/vaptvupt-gui.desktop
|
||||
Desktop entry for menu integration.
|
||||
.TP
|
||||
.I /usr/share/icons/hicolor/256x256/apps/vaptvupt-gui.png
|
||||
Application icon.
|
||||
|
||||
.SH ENVIRONMENT
|
||||
.TP
|
||||
.B VAPTVUPT_BIN
|
||||
Override the path to the
|
||||
.B vaptvupt
|
||||
binary (default: search
|
||||
.IR PATH ).
|
||||
The legacy name
|
||||
.B ZUPT_BIN
|
||||
is also honoured.
|
||||
.TP
|
||||
.B VAPTVUPT_DEBUG
|
||||
Enable binary-discovery debug logging on stderr. The legacy name
|
||||
.B ZUPT_DEBUG
|
||||
is also honoured.
|
||||
|
||||
.SH BUGS
|
||||
Report at
|
||||
.UR https://git.securityops.co/cristiancmoises/vaptvupt/issues
|
||||
.UE .
|
||||
|
||||
.SH AUTHOR
|
||||
Cristian Cezar Moisés
|
||||
.MT zupt@riseup.net
|
||||
.ME
|
||||
|
||||
.SH SEE ALSO
|
||||
.BR vaptvupt (1).
|
||||
|
||||
.SH LICENSE
|
||||
.PP
|
||||
vaptvupt-gui is licensed under the
|
||||
.B GNU Affero General Public License version 3 or later
|
||||
(AGPL-3.0-or-later). Commercial license available for relief from
|
||||
copyleft terms; contact
|
||||
.MT sac@securityops.co
|
||||
.ME .
|
||||
|
||||
.SH PROJECT
|
||||
.PP
|
||||
Home page:
|
||||
.UR https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
.UE
|
||||
|
|
@ -197,9 +197,9 @@ extreme (optimal parsing, ~5\(en10\(mu slower encode, best ratio).
|
|||
.B --codec \fIid\fR
|
||||
Force a specific codec by id. Accepted values:
|
||||
.BR store " (0x0000), "
|
||||
.BR zupt-lz " (0x0008), "
|
||||
.BR zupt-lzh " (0x0009), "
|
||||
.BR zupt-lzhp " (0x000A), "
|
||||
.BR vaptvupt-lz " (0x0008), "
|
||||
.BR vaptvupt-lzh " (0x0009), "
|
||||
.BR vaptvupt-lzhp " (0x000A), "
|
||||
.BR vaptvupt " (0x0010 — default), "
|
||||
.BR auto " (0xFFFF — pick at runtime)."
|
||||
|
||||
|
|
@ -588,7 +588,7 @@ in the source distribution.
|
|||
Cristian Cezar Moisés <zupt@riseup.net> — primary author and maintainer.
|
||||
|
||||
.SH BUGS
|
||||
Report bugs at https://git.securityops.co/cristiancmoises/zupt/issues
|
||||
Report bugs at https://git.securityops.co/cristiancmoises/vaptvupt/issues
|
||||
or by email to <zupt@riseup.net>.
|
||||
|
||||
.SH LICENSE
|
||||
|
|
@ -605,7 +605,7 @@ available from <sac@securityops.co>.
|
|||
.BR cryptsetup (8),
|
||||
.BR jasminc (1).
|
||||
.PP
|
||||
Project home: https://git.securityops.co/cristiancmoises/zupt
|
||||
Project home: https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
.br
|
||||
Threat model: see
|
||||
.B THREAT_MODEL.md
|
||||
|
|
|
|||
|
|
@ -1,13 +1,16 @@
|
|||
.TH ZUPT-GUI 1 "2026-04-27" "zupt-gui 1.1.1" "User Commands"
|
||||
.\" Manpage for vaptvupt-gui (formerly zupt-gui; INPI Brasil trademark rename in v3.0.0)
|
||||
.\" SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
.\" Copyright (c) 2025-2026 Cristian Cezar Moisés
|
||||
.TH VAPTVUPT-GUI 1 "2026-06-11" "vaptvupt-gui 1.3.0" "User Commands"
|
||||
.SH NAME
|
||||
zupt-gui \- graphical interface for the Zupt post-quantum backup utility
|
||||
vaptvupt-gui \- graphical interface for the VaptVupt post-quantum backup utility
|
||||
.SH SYNOPSIS
|
||||
.B zupt-gui
|
||||
.B vaptvupt-gui
|
||||
.RI [ ARCHIVE ]
|
||||
.SH DESCRIPTION
|
||||
.B zupt-gui
|
||||
.B vaptvupt-gui
|
||||
is a graphical frontend for
|
||||
.BR zupt (1).
|
||||
.BR vaptvupt (1).
|
||||
It provides tabs for compression, extraction, key management, and
|
||||
full-disk backup. Both PQ encryption modes are exposed:
|
||||
.B legacy --pq
|
||||
|
|
@ -15,12 +18,17 @@ and
|
|||
.B SDK v2 --pq-sdk
|
||||
(HKDF combiner, key commitment, HPKE binding, Argon2id).
|
||||
|
||||
The legacy command name
|
||||
.B zupt-gui
|
||||
is preserved as a symlink for backward compatibility; both invocations
|
||||
behave identically.
|
||||
|
||||
If
|
||||
.I ARCHIVE
|
||||
is given on the command line, the GUI opens directly on the
|
||||
extract tab with that archive preloaded.
|
||||
|
||||
.B zupt-gui
|
||||
.B vaptvupt-gui
|
||||
uses Qt 6. It works with either of the following Python Qt bindings,
|
||||
auto-detected at startup in this order:
|
||||
.IP \(bu 2
|
||||
|
|
@ -46,13 +54,13 @@ and/or PQ private key.
|
|||
Generate ML-KEM-768 + X25519 keypair. The
|
||||
.B SDK v2 format
|
||||
checkbox controls whether the keypair is generated via
|
||||
.B zupt keygen --sdk
|
||||
.B vaptvupt keygen --sdk
|
||||
(producing
|
||||
.IR file
|
||||
and
|
||||
.IR file.pub
|
||||
in one step) or via the legacy
|
||||
.BR "zupt keygen" .
|
||||
.BR "vaptvupt keygen" .
|
||||
.TP
|
||||
.B Disk
|
||||
Full-disk backup and restore. Enumerates block devices with
|
||||
|
|
@ -60,29 +68,39 @@ human-readable sizes. Same encryption mode controls as Compress.
|
|||
|
||||
.SH FILES
|
||||
.TP
|
||||
.I /usr/bin/zupt-gui
|
||||
Wrapper script that invokes the Python entry point.
|
||||
.I /usr/bin/vaptvupt-gui
|
||||
Wrapper script that invokes the Python entry point (and the symlinked
|
||||
legacy
|
||||
.IR /usr/bin/zupt-gui ).
|
||||
.TP
|
||||
.I /usr/lib/zupt-gui/zupt_gui.py
|
||||
.I /usr/lib/vaptvupt-gui/zupt_gui.py
|
||||
Main Python source.
|
||||
.TP
|
||||
.I /usr/share/applications/zupt-gui.desktop
|
||||
.I /usr/share/applications/vaptvupt-gui.desktop
|
||||
Desktop entry for menu integration.
|
||||
.TP
|
||||
.I /usr/share/icons/hicolor/256x256/apps/zupt-gui.png
|
||||
.I /usr/share/icons/hicolor/256x256/apps/vaptvupt-gui.png
|
||||
Application icon.
|
||||
|
||||
.SH ENVIRONMENT
|
||||
.TP
|
||||
.B ZUPT_BINARY
|
||||
.B VAPTVUPT_BIN
|
||||
Override the path to the
|
||||
.B zupt
|
||||
.B vaptvupt
|
||||
binary (default: search
|
||||
.IR PATH ).
|
||||
The legacy name
|
||||
.B ZUPT_BIN
|
||||
is also honoured.
|
||||
.TP
|
||||
.B VAPTVUPT_DEBUG
|
||||
Enable binary-discovery debug logging on stderr. The legacy name
|
||||
.B ZUPT_DEBUG
|
||||
is also honoured.
|
||||
|
||||
.SH BUGS
|
||||
Report at
|
||||
.UR https://git.securityops.co/cristiancmoises/zupt/issues
|
||||
.UR https://git.securityops.co/cristiancmoises/vaptvupt/issues
|
||||
.UE .
|
||||
|
||||
.SH AUTHOR
|
||||
|
|
@ -91,11 +109,11 @@ Cristian Cezar Moisés
|
|||
.ME
|
||||
|
||||
.SH SEE ALSO
|
||||
.BR zupt (1).
|
||||
.BR vaptvupt (1).
|
||||
|
||||
.SH LICENSE
|
||||
.PP
|
||||
zupt-gui is licensed under the
|
||||
vaptvupt-gui is licensed under the
|
||||
.B GNU Affero General Public License version 3 or later
|
||||
(AGPL-3.0-or-later). Commercial license available for relief from
|
||||
copyleft terms; contact
|
||||
|
|
@ -105,5 +123,5 @@ copyleft terms; contact
|
|||
.SH PROJECT
|
||||
.PP
|
||||
Home page:
|
||||
.UR https://git.securityops.co/cristiancmoises/zupt
|
||||
.UR https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
.UE
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Zupt GUI — Cross-Platform Post-Quantum Backup
|
||||
# VaptVupt GUI — Cross-Platform Post-Quantum Backup
|
||||
|
||||
Desktop application for [zupt](https://git.securityops.co/cristiancmoises/zupt) backup compression with ML-KEM-768 + X25519 post-quantum hybrid encryption.
|
||||
Desktop application for [vaptvupt](https://git.securityops.co/cristiancmoises/vaptvupt) backup compression with ML-KEM-768 + X25519 post-quantum hybrid encryption.
|
||||
|
||||
Works on GNU/Linux, BSD, macOS, and Windows.
|
||||
|
||||
|
|
@ -9,19 +9,19 @@ Works on GNU/Linux, BSD, macOS, and Windows.
|
|||
### Linux (recommended)
|
||||
|
||||
```bash
|
||||
tar xzf zupt-gui.tar.gz && cd zupt-gui
|
||||
./zupt-gui # auto-creates venv, installs PySide6
|
||||
tar xzf vaptvupt-gui.tar.gz && cd vaptvupt-gui
|
||||
./vaptvupt-gui # auto-creates venv, installs PySide6
|
||||
./install.sh --user # adds right-click menu integration
|
||||
```
|
||||
|
||||
After install, right-click any file in Nemo/Nautilus to see "Compress with Zupt".
|
||||
After install, right-click any file in Nemo/Nautilus to see "Compress with VaptVupt".
|
||||
Double-click any .zupt file to open it in the GUI.
|
||||
|
||||
### Windows
|
||||
|
||||
**Option A — Installer (recommended):**
|
||||
|
||||
Download `ZuptGUI-2.1.6-Setup.exe` and run it. Installs to Program Files, adds Start Menu shortcut, desktop shortcut, right-click context menus, and .zupt file association. Includes uninstaller.
|
||||
Download `VaptVuptGUI-1.3.0-Setup.exe` and run it. Installs to Program Files, adds Start Menu shortcut, desktop shortcut, right-click context menus, and .zupt file association. Includes uninstaller.
|
||||
|
||||
**Option B — Build from source:**
|
||||
|
||||
|
|
@ -30,7 +30,7 @@ cd packaging\windows
|
|||
build-windows.bat
|
||||
```
|
||||
|
||||
Requires Python 3.9+, NSIS 3.x, and a compiled `zupt.exe`.
|
||||
Requires Python 3.9+, NSIS 3.x, and a compiled `vaptvupt.exe`.
|
||||
|
||||
**Option C — Run directly:**
|
||||
|
||||
|
|
@ -49,8 +49,8 @@ python3 src/zupt_gui.py
|
|||
### AppImage (universal Linux)
|
||||
|
||||
```bash
|
||||
chmod +x zupt-gui-1.0.0-x86_64.AppImage
|
||||
./zupt-gui-1.0.0-x86_64.AppImage
|
||||
chmod +x VaptVupt-GUI-1.3.0-x86_64.AppImage
|
||||
./VaptVupt-GUI-1.3.0-x86_64.AppImage
|
||||
```
|
||||
|
||||
### Flatpak
|
||||
|
|
@ -78,32 +78,32 @@ All tabs support drag-and-drop. Drop a .zupt file anywhere on the window to extr
|
|||
### Linux (Nemo / Cinnamon)
|
||||
|
||||
After `./install.sh --user`:
|
||||
- Right-click any file: **Compress with Zupt**
|
||||
- Right-click .zupt file: **Extract with Zupt**
|
||||
- Double-click .zupt: opens in Zupt GUI
|
||||
- Right-click any file: **Compress with VaptVupt**
|
||||
- Right-click .zupt file: **Extract with VaptVupt**
|
||||
- Double-click .zupt: opens in VaptVupt GUI
|
||||
|
||||
### Windows (after installer)
|
||||
|
||||
- Right-click any file: **Compress with Zupt**
|
||||
- Right-click any folder: **Compress with Zupt**
|
||||
- Double-click .zupt: opens in Zupt GUI
|
||||
- Right-click any file: **Compress with VaptVupt**
|
||||
- Right-click any folder: **Compress with VaptVupt**
|
||||
- Double-click .zupt: opens in VaptVupt GUI
|
||||
- Right-click .zupt: **Verify Integrity**
|
||||
|
||||
## Architecture
|
||||
|
||||
```
|
||||
Zupt GUI (PySide6, Python)
|
||||
VaptVupt GUI (PySide6, Python)
|
||||
|
|
||||
|-- subprocess.Popen() with streaming stderr
|
||||
|
|
||||
v
|
||||
zupt CLI (Pure C11 binary)
|
||||
vaptvupt CLI (Pure C11 binary)
|
||||
ML-KEM-768 + X25519 + AES-256-CTR
|
||||
VaptVupt / LZHP / Store codecs
|
||||
Block deduplication, full-disk backup
|
||||
```
|
||||
|
||||
The GUI calls the zupt CLI binary — all cryptography runs in native C, not Python.
|
||||
The GUI calls the vaptvupt CLI binary — all cryptography runs in native C, not Python.
|
||||
|
||||
## Packaging
|
||||
|
||||
|
|
@ -111,7 +111,7 @@ The GUI calls the zupt CLI binary — all cryptography runs in native C, not Pyt
|
|||
|----------|--------|------|
|
||||
| Any | pip | `pip install .` |
|
||||
| Debian/Ubuntu/Mint | .deb | `packaging/deb/control` |
|
||||
| Fedora/RHEL | .rpm | `rpmbuild -ba packaging/rpm/zupt-gui.spec` |
|
||||
| Fedora/RHEL | .rpm | `rpmbuild -ba packaging/rpm/vaptvupt.spec` |
|
||||
| Universal Linux | .AppImage | `packaging/appimage/build-appimage.sh` |
|
||||
| Sandboxed Linux | .flatpak | `packaging/flatpak/dev.zupt.gui.yml` |
|
||||
| Windows | .exe installer | `packaging/windows/build-windows.bat` |
|
||||
|
|
@ -119,7 +119,7 @@ The GUI calls the zupt CLI binary — all cryptography runs in native C, not Pyt
|
|||
|
||||
## Credits
|
||||
|
||||
- **zupt** v2.2.3 — Cristian Cezar Moisés ([github](https://git.securityops.co/cristiancmoises/zupt))
|
||||
- **vaptvupt** v2.2.3 — Cristian Cezar Moisés ([github](https://git.securityops.co/cristiancmoises/vaptvupt))
|
||||
|
||||
## License
|
||||
|
||||
|
|
|
|||
12
install.sh
12
install.sh
|
|
@ -1,18 +1,18 @@
|
|||
#!/usr/bin/env bash
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
# Copyright (c) 2025-2026 Cristian Cezar Moisés
|
||||
# Fast Installer for Zupt - GNU/Linux
|
||||
# Fast Installer for VaptVupt - GNU/Linux
|
||||
|
||||
set -e
|
||||
|
||||
echo "🔧 Installing Zupt..."
|
||||
echo "🔧 Installing VaptVupt..."
|
||||
|
||||
# Create temporary directory
|
||||
TMP_DIR=$(mktemp -d)
|
||||
|
||||
# Clone and build
|
||||
git clone https://git.securityops.co/cristiancmoises/zupt.git "$TMP_DIR/zupt"
|
||||
cd "$TMP_DIR/zupt"
|
||||
git clone https://git.securityops.co/cristiancmoises/vaptvupt.git "$TMP_DIR/vaptvupt"
|
||||
cd "$TMP_DIR/vaptvupt"
|
||||
|
||||
make clean
|
||||
make
|
||||
|
|
@ -20,8 +20,8 @@ make
|
|||
# Install
|
||||
sudo make install
|
||||
|
||||
echo "✅ Zupt successfully installed to /usr/local/bin/zupt"
|
||||
echo "🔒 You can now run: zupt"
|
||||
echo "✅ VaptVupt successfully installed to /usr/local/bin/vaptvupt"
|
||||
echo "🔒 You can now run: vaptvupt (legacy 'zupt' symlink also installed)"
|
||||
|
||||
# Cleanup
|
||||
cd ~
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# openSUSE Build Service update for `home:cabelo:innovators/zupt`
|
||||
# openSUSE Build Service update for `home:cabelo:innovators/vaptvupt`
|
||||
|
||||
This directory contains the three files you need to update your OBS
|
||||
package from `1.5.5` to `2.4.8`:
|
||||
|
|
@ -6,8 +6,8 @@ package from `1.5.5` to `2.4.8`:
|
|||
| File | Status vs. your current files |
|
||||
|---------------|---------------------------------------------------------------------|
|
||||
| `_service` | Updated `revision` to `v2.4.8`. Format unchanged (still `tar_scm`). |
|
||||
| `zupt.spec` | Version → `2.4.8`. License corrected `MIT` → `AGPL-3.0-or-later`. `%check` now calls `make check` (new distro-safe target). |
|
||||
| `zupt.changes`| 13 new entries prepended (2.0.0 → 2.4.8). Your existing 1.0.0–1.5.4 history is preserved verbatim. |
|
||||
| `vaptvupt.spec` | Version → `2.4.8`. License corrected `MIT` → `AGPL-3.0-or-later`. `%check` now calls `make check` (new distro-safe target). |
|
||||
| `vaptvupt.changes`| 13 new entries prepended (2.0.0 → 2.4.8). Your existing 1.0.0–1.5.4 history is preserved verbatim. |
|
||||
|
||||
## What changed in the spec
|
||||
|
||||
|
|
@ -37,9 +37,9 @@ package from `1.5.5` to `2.4.8`:
|
|||
hosts. The s390x branch still falls back to just `test-vectors`.
|
||||
|
||||
3. **Upstream URL in `URL:` field** updated to
|
||||
`https://git.securityops.co/cristiancmoises/zupt` (the canonical
|
||||
`https://git.securityops.co/cristiancmoises/vaptvupt` (the canonical
|
||||
project URL). The `_service` file still pulls from GitHub
|
||||
(`https://github.com/cristiancmoises/zupt`) since that's where
|
||||
(`https://github.com/cristiancmoises/vaptvupt`) since that's where
|
||||
your `tar_scm` is already configured and what works in OBS today.
|
||||
|
||||
4. **`BuildRequires: make`** added — newer openSUSE chroots don't
|
||||
|
|
@ -54,20 +54,20 @@ package from `1.5.5` to `2.4.8`:
|
|||
|
||||
```sh
|
||||
# 1. Check out the package
|
||||
osc checkout home:cabelo:innovators zupt
|
||||
cd home:cabelo:innovators/zupt
|
||||
osc checkout home:cabelo:innovators vaptvupt
|
||||
cd home:cabelo:innovators/vaptvupt
|
||||
|
||||
# 2. Drop the new files in (assuming this README is at
|
||||
# /path/to/zupt-source/packaging/opensuse/README.md)
|
||||
cp /path/to/zupt-source/packaging/opensuse/_service .
|
||||
cp /path/to/zupt-source/packaging/opensuse/zupt.spec .
|
||||
cp /path/to/zupt-source/packaging/opensuse/zupt.changes .
|
||||
# /path/to/vaptvupt-source/packaging/opensuse/README.md)
|
||||
cp /path/to/vaptvupt-source/packaging/opensuse/_service .
|
||||
cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.spec .
|
||||
cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.changes .
|
||||
|
||||
# 3. Trigger the service locally to fetch v2.4.8 from GitHub
|
||||
osc service runall
|
||||
|
||||
# This produces zupt-2.4.8.tar.gz in the current directory and
|
||||
# updates zupt.changes with a service-generated entry if you have
|
||||
# This produces vaptvupt-2.4.8.tar.gz in the current directory and
|
||||
# updates vaptvupt.changes with a service-generated entry if you have
|
||||
# changesgenerate enabled (you don't, so this is a no-op for
|
||||
# changes; tar_scm just downloads).
|
||||
|
||||
|
|
@ -78,7 +78,7 @@ osc build openSUSE_Tumbleweed x86_64
|
|||
# (~91 assertions) pass, package is produced.
|
||||
|
||||
# 5. Commit upstream
|
||||
osc status # confirm zupt-2.4.8.tar.gz is staged alongside the
|
||||
osc status # confirm vaptvupt-2.4.8.tar.gz is staged alongside the
|
||||
# three text files
|
||||
osc commit -m "Update to 2.4.8: distro-safe make check target; license fix MIT -> AGPL"
|
||||
```
|
||||
|
|
@ -92,20 +92,20 @@ osc commit -m "Update to 2.4.8: distro-safe make check target; license fix MIT -
|
|||
`set_version` service in `_service` will auto-sync at OBS-build
|
||||
time if you want; it's mode="manual" today, which is safer.
|
||||
* `BuildRequires` is intentionally minimal (just `gcc gzip make`).
|
||||
Zupt has no external library dependencies — `libargon2`,
|
||||
VaptVupt has no external library dependencies — `libargon2`,
|
||||
`libcrypto`, etc. used by other Linux packagers come from
|
||||
*vendored* code that's compiled in. This is a deliberate
|
||||
design choice; don't add system library BuildRequires.
|
||||
|
||||
## Reporting issues
|
||||
|
||||
* Upstream bugs: https://git.securityops.co/cristiancmoises/zupt
|
||||
* Upstream bugs: https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
* openSUSE packaging bugs: https://bugs.opensuse.org/
|
||||
* Cabelo's OBS project: https://build.opensuse.org/project/show/home:cabelo:innovators
|
||||
|
||||
## Author of these update files
|
||||
|
||||
Generated against upstream `zupt-2.4.8` source tree. Spec mirrors
|
||||
Generated against upstream `vaptvupt-2.4.8` source tree. Spec mirrors
|
||||
cabelo's existing 1.5.5 conventions (minimal `BuildRequires`,
|
||||
`%autosetup -p1`, `V=1` verbose build, `%ifarch s390x` branch in
|
||||
`%check`, no separate libzuptsdk subpackage) — only the necessary
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ Release: 0
|
|||
Summary: Post-quantum backup compression with AES-256 + ML-KEM-768 hybrid encryption
|
||||
License: AGPL-3.0-or-later
|
||||
Group: Productivity/Archiving/Compression
|
||||
URL: https://git.securityops.co/cristiancmoises/zupt
|
||||
URL: https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
Source0: %{name}-%{version}.tar.gz
|
||||
BuildRequires: gcc
|
||||
BuildRequires: gzip
|
||||
|
|
|
|||
|
|
@ -1,16 +1,16 @@
|
|||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
#
|
||||
# Fedora / RHEL / CentOS RPM spec for zupt.
|
||||
# Fedora / RHEL / CentOS RPM spec for vaptvupt.
|
||||
#
|
||||
# Build with:
|
||||
# spectool -g zupt.spec # fetches the upstream tarball
|
||||
# rpmbuild -ba zupt.spec # builds source + binary RPMs
|
||||
# spectool -g vaptvupt.spec # fetches the upstream tarball
|
||||
# rpmbuild -ba vaptvupt.spec # builds source + binary RPMs
|
||||
#
|
||||
# To bring a release into production:
|
||||
# 1. Run `make dist` upstream → /tmp/zupt-VERSION.tar.gz (reproducible).
|
||||
# 1. Run `make dist` upstream → /tmp/vaptvupt-VERSION.tar.gz (reproducible).
|
||||
# 2. Upload to a stable release URL (git.securityops.co releases).
|
||||
# 3. Update %{version} below.
|
||||
# 4. Run `sha256sum /tmp/zupt-VERSION.tar.gz` and update Source0
|
||||
# 4. Run `sha256sum /tmp/vaptvupt-VERSION.tar.gz` and update Source0
|
||||
# checksum (handled by spectool when configured) or pin via
|
||||
# sha256sum in a separate manifest if your distro requires it.
|
||||
# 5. rpmbuild --define '_topdir ~/rpmbuild' -ba zupt.spec
|
||||
|
|
@ -25,7 +25,7 @@ Release: 1%{?dist}
|
|||
Summary: Post-quantum backup compression utility (AES-256 + ML-KEM-768 + Argon2id, formerly Zupt)
|
||||
|
||||
License: AGPL-3.0-or-later AND GPL-3.0-or-later
|
||||
URL: https://git.securityops.co/cristiancmoises/zupt
|
||||
URL: https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
Source0: %{url}/releases/download/v%{version}/%{name}-%{version}.tar.gz
|
||||
|
||||
# v3.0.0: legacy `zupt` package is superseded. Renaming was forced
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
# libzuptsdk
|
||||
|
||||
Public C ABI for the [Zupt](https://git.securityops.co/cristiancmoises/zupt) backup compression library.
|
||||
Public C ABI for the [VaptVupt](https://git.securityops.co/cristiancmoises/vaptvupt) backup compression library.
|
||||
|
||||
Provides post-quantum encrypted compression as a stable, embeddable shared library — completely independent of the `zupt` CLI.No dependency on any other compression library; everything is built from Zupt's own implementations.
|
||||
Provides post-quantum encrypted compression as a stable, embeddable shared library — completely independent of the `vaptvupt` CLI.No dependency on any other compression library; everything is built from VaptVupt's own implementations.
|
||||
|
||||
- **Version:** 1.0.0
|
||||
- **License:** AGPL-3.0-or-later
|
||||
|
|
@ -87,8 +87,8 @@ with zuptsdk.Context() as ctx:
|
|||
## Build & install
|
||||
|
||||
```sh
|
||||
git clone https://git.securityops.co/cristiancmoises/zupt
|
||||
cd zupt
|
||||
git clone https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
cd vaptvupt
|
||||
make # builds CLI (required: produces jasmin/*.o assembly objects)
|
||||
make sdk # builds libzuptsdk.so.1.0.0 + libzuptsdk.a + zuptsdk.pc
|
||||
make sdk-test # runs C roundtrip suite (15 tests)
|
||||
|
|
@ -178,6 +178,6 @@ The AGPL allows everyone to use the library freely, but anyone running it as a n
|
|||
|
||||
## Contact
|
||||
|
||||
- Repository: https://git.securityops.co/cristiancmoises/zupt
|
||||
- Repository: https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
- Website: https://zupt.securityops.co
|
||||
- Email: zupt@riseup.net
|
||||
|
|
|
|||
|
|
@ -320,7 +320,7 @@ if [ -f THREAT_MODEL.md ]; then
|
|||
else
|
||||
F "THREAT_MODEL.md: too short ($SZ bytes, expected >= 3000)"
|
||||
fi
|
||||
for section in "What Zupt protects against" "What Zupt does NOT protect against" "Cryptographic assumptions"; do
|
||||
for section in "What VaptVupt protects against" "What VaptVupt does NOT protect against" "Cryptographic assumptions"; do
|
||||
if grep -qF "$section" THREAT_MODEL.md; then
|
||||
:
|
||||
else
|
||||
|
|
|
|||
Loading…
Reference in a new issue