cristiancmoises/zupt
Watch
1
0
Fork
You've already forked zupt
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 3

v4.1.0: source-only build, multithreaded-encryption fix, security hardening

Browse source 
Build from source with no vendored binaries:
- Remove prebuilt libzuptsdk.so / libpqvaptvupt.so (and a stray .pyc). The
  default build needs only a C compiler + make; it links no external library
  and installs no .so. The libzuptsdk-backed modes (Argon2id KDF, --pq-sdk,
  --pq-box) are gated behind an opt-in `make WITH_SDK=1`. The default password
  KDF is PBKDF2-SHA256 and --pq (native ML-KEM-768 + X25519) is the built-in PQ
  mode. openSUSE/RPM/deb/AUR/Homebrew/Nix recipes bumped to 4.1.0; the openSUSE
  spec now builds source-only (%files ships no .so, %build/%install WITH_SDK=0).

Fix: multithreaded encrypted archives were unextractable on the native AEAD
path. The parallel compress/decompress workers skipped the F-09 frame-preface
AAD that the serial path and the archive's AAD_PREFACE flag bind into every
block MAC, so each multithreaded block failed authentication. The workers now
bind the preface via a shared serializer; output is byte-identical across
thread counts and interoperates with single-threaded archives (also fixes
`--kdf pbkdf2 -t N` in any build).

Security hardening (crafted-archive memory safety + crypto):
- LZH raw code-length stack overflow + huff_lut OOB write
- overflow-safe bounds in parse_index and solid-mode extract (heap OOB read)
- SEQ decoder safe-zone heap overflow (litlen+matchlen reserve)
- require the per-block ENCRYPTED flag on encrypted archives (plaintext forgery)
- cap archive-supplied PBKDF2 iteration count (KDF-amplification DoS)
- non-elidable secret wipe in the SDK path; restored disk images created 0600

Docs: remove AUDIT.md / BENCHMARKS.md / ROADMAP.md; trim marketing/AI-styled
text and correct KDF/PQ facts across README, SECURITY, INSTALL, DISTRIBUTION,
THREAT_MODEL, THIRD-PARTY-NOTICES, the man page, and packaging READMEs. Wire
format v1.6 unchanged.
This commit is contained in:
Cristian Cezar Moisés 2026-07-07 19:45:37 -03:00
commit 4874010d0e
39 changed files with 1097 additions and 2770 deletions
Download patch file Download diff file Expand all files Collapse all files

25
packaging/opensuse/vaptvupt.changes
View file

@ -1,3 +1,28 @@
-------------------------------------------------------------------
Tue Jul 7 12:00:00 UTC 2026 - Alessandro de Oliveira Faria <cabelo@opensuse.org>
- Update to 4.1.0:
* Source-only build. The prebuilt vendored libraries (libzuptsdk,
libpqvaptvupt) are removed from the tree; the package now builds
with no external library dependency and ships no .so. The
libzuptsdk-backed modes (Argon2id KDF, --pq-sdk, --pq-box) are
gated behind an optional upstream WITH_SDK=1 build; the default
password KDF is PBKDF2-SHA256 (600k) and --pq (native ML-KEM-768
+ X25519) is unchanged. spec %files no longer lists the .so;
%build/%install pass WITH_SDK=0.
* Fix: multithreaded encrypted archives were unextractable on the
native AEAD path. The parallel compress/decompress workers did not
bind the F-09 frame-preface AAD that the serial path and the
archive's AAD_PREFACE flag require, so every multithreaded block
failed authentication. Now byte-identical across thread counts;
also fixes `--kdf pbkdf2 -t N`.
* Security: LZH raw code-length stack overflow and huff_lut OOB on
crafted archives; integer-overflow heap OOB reads in the index and
solid-mode parsers; SEQ decoder safe-zone heap overflow; per-block
ENCRYPTED-flag authentication gate; PBKDF2 iteration-count DoS cap;
non-elidable secret wipe in the SDK path; restored disk images now
0600. Wire format v1.6 unchanged.
-------------------------------------------------------------------
Wed Jun 10 12:00:00 UTC 2026 - Alessandro de Oliveira Faria <cabelo@opensuse.org>