v4.1.0: source-only build, multithreaded-encryption fix, security hardening
Build from source with no vendored binaries: - Remove prebuilt libzuptsdk.so / libpqvaptvupt.so (and a stray .pyc). The default build needs only a C compiler + make; it links no external library and installs no .so. The libzuptsdk-backed modes (Argon2id KDF, --pq-sdk, --pq-box) are gated behind an opt-in `make WITH_SDK=1`. The default password KDF is PBKDF2-SHA256 and --pq (native ML-KEM-768 + X25519) is the built-in PQ mode. openSUSE/RPM/deb/AUR/Homebrew/Nix recipes bumped to 4.1.0; the openSUSE spec now builds source-only (%files ships no .so, %build/%install WITH_SDK=0). Fix: multithreaded encrypted archives were unextractable on the native AEAD path. The parallel compress/decompress workers skipped the F-09 frame-preface AAD that the serial path and the archive's AAD_PREFACE flag bind into every block MAC, so each multithreaded block failed authentication. The workers now bind the preface via a shared serializer; output is byte-identical across thread counts and interoperates with single-threaded archives (also fixes `--kdf pbkdf2 -t N` in any build). Security hardening (crafted-archive memory safety + crypto): - LZH raw code-length stack overflow + huff_lut OOB write - overflow-safe bounds in parse_index and solid-mode extract (heap OOB read) - SEQ decoder safe-zone heap overflow (litlen+matchlen reserve) - require the per-block ENCRYPTED flag on encrypted archives (plaintext forgery) - cap archive-supplied PBKDF2 iteration count (KDF-amplification DoS) - non-elidable secret wipe in the SDK path; restored disk images created 0600 Docs: remove AUDIT.md / BENCHMARKS.md / ROADMAP.md; trim marketing/AI-styled text and correct KDF/PQ facts across README, SECURITY, INSTALL, DISTRIBUTION, THREAT_MODEL, THIRD-PARTY-NOTICES, the man page, and packaging READMEs. Wire format v1.6 unchanged.
This commit is contained in:
Cristian Cezar Moisés
parent
136a96ed20
commit
4874010d0e
39 changed files with 1097 additions and 2770 deletions
|
|
@ -1,54 +1,49 @@
|
|||
# openSUSE Build Service update for `home:cabelo:innovators/vaptvupt`
|
||||
|
||||
This directory contains the three files you need to update your OBS
|
||||
package from `1.5.5` to `2.4.8`:
|
||||
This directory contains the three files needed to build vaptvupt `4.1.0`
|
||||
in OBS:
|
||||
|
||||
| File | Status vs. your current files |
|
||||
|---------------|---------------------------------------------------------------------|
|
||||
| `_service` | Updated `revision` to `v2.4.8`. Format unchanged (still `tar_scm`). |
|
||||
| `vaptvupt.spec` | Version → `2.4.8`. License corrected `MIT` → `AGPL-3.0-or-later`. `%check` now calls `make check` (new distro-safe target). |
|
||||
| `vaptvupt.changes`| 13 new entries prepended (2.0.0 → 2.4.8). Your existing 1.0.0–1.5.4 history is preserved verbatim. |
|
||||
| File | Purpose |
|
||||
|---------------|-------------------------------------------------------------------------|
|
||||
| `_service` | `revision` pinned to `v4.1.0`. Format unchanged (still `tar_scm`). |
|
||||
| `vaptvupt.spec` | `Version: 4.1.0`. `License: AGPL-3.0-or-later`. `%check` calls `make check`. |
|
||||
| `vaptvupt.changes`| Changelog for the 4.x series. Older history preserved verbatim. |
|
||||
|
||||
## What changed in the spec
|
||||
## Spec notes
|
||||
|
||||
1. **License correction** — your spec says `License: MIT`, but the
|
||||
upstream license is **AGPL-3.0-or-later** (dual-licensed
|
||||
AGPL-3.0-or-later + commercial). This was a bug that should
|
||||
probably trigger a rebuild even without the version bump.
|
||||
1. **License** — `AGPL-3.0-or-later` (dual-licensed AGPL-3.0-or-later
|
||||
+ commercial).
|
||||
|
||||
2. **`%check` target** — your spec calls `test-all` on non-s390x
|
||||
architectures. In v2.4.x, `test-all` includes threading tests
|
||||
that are flaky on emulated build hosts (3 false positives on
|
||||
x86_64 GitHub-Actions-style sandboxes). The new `make check`
|
||||
target added in 2.4.8 runs a curated subset:
|
||||
2. **No BuildRequires beyond the toolchain** — the default build needs
|
||||
only `gcc gzip make` (plus `libm`/`pthread` from glibc). There are
|
||||
**no system library BuildRequires**. The repository is source-only:
|
||||
the previously vendored `libzuptsdk.so` and `libpqvaptvupt.so` have
|
||||
been removed from the tree, `%build` and `%install` run with
|
||||
`WITH_SDK=0`, and `%files` no longer lists any `.so`. The package
|
||||
installs no shared library. Do not add system crypto BuildRequires.
|
||||
|
||||
* F-06 HMAC tamper detection (2000 trials)
|
||||
* F-08 archive-integrity-trailer
|
||||
* F-09 byte-level integrity preface AAD
|
||||
* F-10 KDF default
|
||||
* F-11 auth-fail message
|
||||
* F-12 encrypted comments
|
||||
* NIST/RFC vectors (SHA-256, SHA-3, ML-KEM-768, AES-256-CTR,
|
||||
HMAC, X25519, PBKDF2, Argon2id)
|
||||
* Path-traversal, argument-order, block-swap regressions
|
||||
* Quick smoke test
|
||||
The optional SDK modes (`--pq-sdk`, `--pq-box`) and the Argon2id KDF
|
||||
require an upstream `make WITH_SDK=1` build linked against the
|
||||
separately distributed `libzuptsdk`/`libpqvaptvupt` libraries. They
|
||||
are not part of this package.
|
||||
|
||||
Total ~91 assertions, runs in <2 minutes, no flakes on emulated
|
||||
hosts. The s390x branch still falls back to just `test-vectors`.
|
||||
3. **`%check` target** — the s390x branch falls back to `test-vectors`;
|
||||
other architectures run `make check`. This exercises the HMAC tamper
|
||||
detection, archive-integrity trailer, byte-level integrity preface
|
||||
AAD, default-KDF, auth-fail, and encrypted-comment suites, the
|
||||
NIST/RFC vectors (SHA-256, SHA-3, ML-KEM-768, AES-256-CTR, HMAC,
|
||||
X25519, PBKDF2), and the path-traversal, argument-order, and
|
||||
block-swap regressions.
|
||||
|
||||
3. **Upstream URL in `URL:` field** updated to
|
||||
`https://git.securityops.co/cristiancmoises/vaptvupt` (the canonical
|
||||
project URL). The `_service` file still pulls from GitHub
|
||||
(`https://github.com/cristiancmoises/vaptvupt`) since that's where
|
||||
your `tar_scm` is already configured and what works in OBS today.
|
||||
The default password KDF is **PBKDF2-SHA256** (600k iterations).
|
||||
Argon2id test vectors run only in a `WITH_SDK=1` build and are not
|
||||
checked here.
|
||||
|
||||
4. **`BuildRequires: make`** added — newer openSUSE chroots don't
|
||||
always pull `make` in transitively. Harmless on older targets.
|
||||
|
||||
5. **Docs** — `%doc README.md SECURITY.md CHANGELOG.md` now ships
|
||||
the security boundary docs as well as the README. THREAT_MODEL.md
|
||||
exists upstream but isn't listed here to keep the package small;
|
||||
add `%doc THREAT_MODEL.md` if you want it included.
|
||||
4. **URLs** — the `URL:` field points at the canonical project URL
|
||||
`https://git.securityops.co/cristiancmoises/vaptvupt`. The `_service`
|
||||
file still fetches from GitHub
|
||||
(`https://github.com/cristiancmoises/vaptvupt`), which is what the
|
||||
existing `tar_scm` configuration uses in OBS.
|
||||
|
||||
## How to apply
|
||||
|
||||
|
|
@ -63,50 +58,31 @@ cp /path/to/vaptvupt-source/packaging/opensuse/_service .
|
|||
cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.spec .
|
||||
cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.changes .
|
||||
|
||||
# 3. Trigger the service locally to fetch v2.4.8 from GitHub
|
||||
# 3. Trigger the service locally to fetch v4.1.0 from GitHub
|
||||
osc service runall
|
||||
|
||||
# This produces vaptvupt-2.4.8.tar.gz in the current directory and
|
||||
# updates vaptvupt.changes with a service-generated entry if you have
|
||||
# changesgenerate enabled (you don't, so this is a no-op for
|
||||
# changes; tar_scm just downloads).
|
||||
# Produces vaptvupt-4.1.0.tar.gz in the current directory.
|
||||
|
||||
# 4. (Optional) Local build to verify before committing
|
||||
osc build openSUSE_Tumbleweed x86_64
|
||||
|
||||
# Expected: build succeeds, %check runs `make check`, all 10 suites
|
||||
# (~91 assertions) pass, package is produced.
|
||||
|
||||
# 5. Commit upstream
|
||||
osc status # confirm vaptvupt-2.4.8.tar.gz is staged alongside the
|
||||
osc status # confirm vaptvupt-4.1.0.tar.gz is staged alongside the
|
||||
# three text files
|
||||
osc commit -m "Update to 2.4.8: distro-safe make check target; license fix MIT -> AGPL"
|
||||
osc commit -m "Update to 4.1.0"
|
||||
```
|
||||
|
||||
## Notes for future updates
|
||||
|
||||
* The `_service` `revision` is pinned to `v2.4.8`. To track a new
|
||||
release, just edit that one line and re-run `osc service runall`.
|
||||
* The spec's `Version:` field is hard-coded — when you bump
|
||||
`_service` `revision`, also bump `Version:` to match. The
|
||||
`set_version` service in `_service` will auto-sync at OBS-build
|
||||
time if you want; it's mode="manual" today, which is safer.
|
||||
* `BuildRequires` is intentionally minimal (just `gcc gzip make`).
|
||||
VaptVupt has no external library dependencies — `libargon2`,
|
||||
`libcrypto`, etc. used by other Linux packagers come from
|
||||
*vendored* code that's compiled in. This is a deliberate
|
||||
design choice; don't add system library BuildRequires.
|
||||
* The `_service` `revision` is pinned to `v4.1.0`. To track a new
|
||||
release, edit that one line and re-run `osc service runall`.
|
||||
* The spec's `Version:` field is hard-coded — when you bump `_service`
|
||||
`revision`, also bump `Version:` to match.
|
||||
* `BuildRequires` is intentionally minimal (`gcc gzip make`). vaptvupt
|
||||
has no external library dependencies in the default build; do not add
|
||||
system crypto BuildRequires.
|
||||
|
||||
## Reporting issues
|
||||
|
||||
* Upstream bugs: https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
* openSUSE packaging bugs: https://bugs.opensuse.org/
|
||||
* Cabelo's OBS project: https://build.opensuse.org/project/show/home:cabelo:innovators
|
||||
|
||||
## Author of these update files
|
||||
|
||||
Generated against upstream `vaptvupt-2.4.8` source tree. Spec mirrors
|
||||
cabelo's existing 1.5.5 conventions (minimal `BuildRequires`,
|
||||
`%autosetup -p1`, `V=1` verbose build, `%ifarch s390x` branch in
|
||||
`%check`, no separate libzuptsdk subpackage) — only the necessary
|
||||
fields are changed.
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
<service name="tar_scm" mode="manual">
|
||||
<param name="url">https://github.com/cristiancmoises/zupt</param>
|
||||
<param name="scm">git</param>
|
||||
<param name="revision">v4.0.0</param>
|
||||
<param name="revision">v4.1.0</param>
|
||||
<param name="versionformat">@PARENT_TAG@</param>
|
||||
<param name="versionrewrite-pattern">v(.*)</param>
|
||||
<param name="submodules">enable</param>
|
||||
|
|
|
|||
|
|
@ -1,3 +1,28 @@
|
|||
-------------------------------------------------------------------
|
||||
Tue Jul 7 12:00:00 UTC 2026 - Alessandro de Oliveira Faria <cabelo@opensuse.org>
|
||||
|
||||
- Update to 4.1.0:
|
||||
* Source-only build. The prebuilt vendored libraries (libzuptsdk,
|
||||
libpqvaptvupt) are removed from the tree; the package now builds
|
||||
with no external library dependency and ships no .so. The
|
||||
libzuptsdk-backed modes (Argon2id KDF, --pq-sdk, --pq-box) are
|
||||
gated behind an optional upstream WITH_SDK=1 build; the default
|
||||
password KDF is PBKDF2-SHA256 (600k) and --pq (native ML-KEM-768
|
||||
+ X25519) is unchanged. spec %files no longer lists the .so;
|
||||
%build/%install pass WITH_SDK=0.
|
||||
* Fix: multithreaded encrypted archives were unextractable on the
|
||||
native AEAD path. The parallel compress/decompress workers did not
|
||||
bind the F-09 frame-preface AAD that the serial path and the
|
||||
archive's AAD_PREFACE flag require, so every multithreaded block
|
||||
failed authentication. Now byte-identical across thread counts;
|
||||
also fixes `--kdf pbkdf2 -t N`.
|
||||
* Security: LZH raw code-length stack overflow and huff_lut OOB on
|
||||
crafted archives; integer-overflow heap OOB reads in the index and
|
||||
solid-mode parsers; SEQ decoder safe-zone heap overflow; per-block
|
||||
ENCRYPTED-flag authentication gate; PBKDF2 iteration-count DoS cap;
|
||||
non-elidable secret wipe in the SDK path; restored disk images now
|
||||
0600. Wire format v1.6 unchanged.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Jun 10 12:00:00 UTC 2026 - Alessandro de Oliveira Faria <cabelo@opensuse.org>
|
||||
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@
|
|||
|
||||
|
||||
Name: vaptvupt
|
||||
Version: 4.0.0
|
||||
Version: 4.1.0
|
||||
Release: 0
|
||||
Summary: Post-quantum backup compression with AES-256 + ML-KEM-768 hybrid encryption
|
||||
License: AGPL-3.0-or-later
|
||||
|
|
@ -38,25 +38,29 @@ Obsoletes: zupt < 3.0.0
|
|||
|
||||
%description
|
||||
VaptVupt (formerly Zupt; renamed in v3.0.0 due to a prior INPI Brasil
|
||||
trademark on the name "Zupt") compresses and encrypts backup archives. LZ77+Huffman compression
|
||||
(VaptVupt codec, ~2-3 GB/s decompression on x86_64 with AVX2 / aarch64
|
||||
with NEON), AES-256-CTR + HMAC-SHA256 per-block authenticated
|
||||
encryption, multi-threaded, with optional ML-KEM-768 + X25519
|
||||
post-quantum hybrid key encapsulation (FIPS 203 + RFC 7748). The
|
||||
default password KDF is Argon2id; PBKDF2-SHA256 remains available
|
||||
via --kdf pbkdf2 for backward compatibility.
|
||||
trademark on the name "Zupt") compresses and encrypts backup archives.
|
||||
LZ + ANS compression (VaptVupt codec, ~2-3 GB/s decompression on x86_64
|
||||
with AVX2 / aarch64 with NEON), AES-256-CTR + HMAC-SHA256 per-block
|
||||
authenticated encryption, multi-threaded, with ML-KEM-768 + X25519
|
||||
post-quantum hybrid key encapsulation (FIPS 203 + RFC 7748) via --pq.
|
||||
|
||||
Pure C11, vendored libzuptsdk, ~5,000 lines of core code. Constant-
|
||||
time cryptographic primitives are formally verified with Jasmin on
|
||||
x86_64 (zupt_mac_verify_ct, zupt_ct_select_32); a clean C fallback
|
||||
runs on aarch64 and other architectures.
|
||||
This package builds entirely from source with no external library
|
||||
dependency. The password KDF is PBKDF2-SHA256 (600k iterations). The
|
||||
optional libzuptsdk-backed modes (Argon2id KDF, --pq-sdk, --pq-box) are
|
||||
not built here; they require an upstream WITH_SDK=1 build against the
|
||||
separately distributed libzuptsdk/libpqvaptvupt.
|
||||
|
||||
Pure C11, ~5,000 lines of core code. Constant-time cryptographic
|
||||
primitives are formally verified with Jasmin on x86_64
|
||||
(zupt_mac_verify_ct, zupt_ct_select_32); a clean C fallback runs on
|
||||
aarch64 and other architectures.
|
||||
|
||||
%prep
|
||||
%autosetup -p1
|
||||
chmod +x tests/*.sh
|
||||
|
||||
%build
|
||||
%make_build V=1 \
|
||||
%make_build V=1 WITH_SDK=0 \
|
||||
CFLAGS="%{optflags} -fPIE -Wall -Wextra -std=c11 -Iinclude -Isrc" \
|
||||
LDFLAGS="%{?build_ldflags} -pie" \
|
||||
LDLIBS="-lm -lpthread"
|
||||
|
|
@ -71,14 +75,14 @@ chmod +x tests/*.sh
|
|||
# On s390x, fall back to just the vector tests (Jasmin assembly is
|
||||
# x86_64-only; threading harness has been flaky on big-endian).
|
||||
%ifarch s390x
|
||||
%make_build V=1 \
|
||||
%make_build V=1 WITH_SDK=0 \
|
||||
CFLAGS="%{optflags} -fPIE -Wall -Wextra -std=c11 -Iinclude -Isrc" \
|
||||
LDFLAGS="%{?build_ldflags} -pie" \
|
||||
LDLIBS="-lm -lpthread" \
|
||||
test-vectors
|
||||
./test_vectors
|
||||
%else
|
||||
%make_build V=1 \
|
||||
%make_build V=1 WITH_SDK=0 \
|
||||
CFLAGS="%{optflags} -fPIE -Wall -Wextra -std=c11 -Iinclude -Isrc" \
|
||||
LDFLAGS="%{?build_ldflags} -pie" \
|
||||
LDLIBS="-lm -lpthread" \
|
||||
|
|
@ -86,7 +90,7 @@ chmod +x tests/*.sh
|
|||
%endif
|
||||
|
||||
%install
|
||||
%make_install PREFIX=%{_prefix}
|
||||
%make_install WITH_SDK=0 PREFIX=%{_prefix}
|
||||
|
||||
%files
|
||||
%license LICENSE
|
||||
|
|
@ -95,12 +99,5 @@ chmod +x tests/*.sh
|
|||
%{_bindir}/zupt
|
||||
%{_mandir}/man1/vaptvupt.1%{?ext_man}
|
||||
%{_mandir}/man1/zupt.1%{?ext_man}
|
||||
%dir %{_prefix}/lib/vaptvupt
|
||||
%{_prefix}/lib/vaptvupt/libzuptsdk.so
|
||||
%{_prefix}/lib/vaptvupt/libzuptsdk.so.2
|
||||
%{_prefix}/lib/vaptvupt/libzuptsdk.so.2.0.0
|
||||
%{_prefix}/lib/vaptvupt/libpqvaptvupt.so
|
||||
%{_prefix}/lib/vaptvupt/libpqvaptvupt.so.0
|
||||
%{_prefix}/lib/vaptvupt/libpqvaptvupt.so.0.6.0
|
||||
|
||||
%changelog
|
||||
|
|
|
|||
Loading…
Reference in a new issue