v4.0.0: codec 2.60.4 security release, --pq-box sealed-box mode, F-16 fix

Major release. Highlights: - Codec: vendored VaptVupt codec moves to canonical 2.60.4 security release. Fixes a high-severity OOB heap write in the AVX2 decode fast path (reachable on a valid stream sized to exactly content_size, both tail variants). Brings CBMC-formally-verified BCJ filters with automatic ELF/PE/Mach-O detection. Compressed output stays byte-identical (ratio gate Δ 0.00%); wire format unchanged at v1.6. - New --pq-box sealed-box recipient mode (vendored libpqvaptvupt 0.6.0): ML-KEM-768 + X25519 combined via HKDF-SHA256 with domain separation, AES-256-CTR + HMAC-SHA256 EtM. Legacy --pq and --pq-sdk stay readable. - F-16: discloses and fixes a pre-existing data-loss defect in the <= 3.8.0 in-tree BCJ encoder. Full back-compat matrix decodes byte-exact under 4.0.0; every readable pre-4.0 archive remains readable. Repository hygiene: - Sync full 4.0.0 source tree (codec, crypto, SDK, GUI, packaging, tests). - Remove internal scratch files (PROMPT.md, FORMAL_AUDIT_PROMPT.md) and superseded version-specific docs (INTEGRATION_PROTOCOL_2.60.4.md, docs/FINDINGS-2.x.md) and a stray test binary. - Refresh README download/install section to real 4.0.0 release assets; bump version badge to 4.0.0. - Add .gitignore for build outputs (keeps vendored prebuilt libraries).
2026-06-10 18:48:58 -03:00 · 2026-06-10 18:48:58 -03:00 · 544a2cd647
commit 544a2cd647
parent 7619c4c577
98 changed files with 15615 additions and 1397 deletions
--- a/packaging/build-deb.sh
+++ b/packaging/build-deb.sh
@ -1,16 +1,27 @@
 #!/bin/bash
 # SPDX-License-Identifier: AGPL-3.0-or-later
 # Copyright (c) 2025-2026 Cristian Cezar Moisés
-# Build self-contained zupt CLI .deb package.
-# Bundles libzuptsdk.so.2 under /usr/lib/zupt/ so users do NOT need to
-# separately install the libzuptsdk package.
+#
+# Build self-contained vaptvupt CLI .deb package.
+#
+# v3.0.0 rename: the binary is now `vaptvupt`; we install it at
+# /usr/bin/vaptvupt and create /usr/bin/zupt → /usr/bin/vaptvupt as
+# a legacy symlink for one major version cycle. The package name
+# is `vaptvupt` with Provides/Replaces/Conflicts on `zupt` so
+# `apt install zupt` still resolves cleanly.
+#
+# Bundles libzuptsdk.so.2 under /usr/lib/vaptvupt/ so users do NOT
+# need to separately install the libzuptsdk package.
+
 set -e
 cd "$(dirname "$0")/.."

-VERSION="${VERSION:-2.2.3}"
+VERSION="${VERSION:-3.0.0}"
 ARCH="${ARCH:-amd64}"
+PKGNAME="vaptvupt"
+LEGACY="zupt"

-PKG="zupt_${VERSION}_${ARCH}"
+PKG="${PKGNAME}_${VERSION}_${ARCH}"
 ROOT="/tmp/$PKG"

 # Vendored libzuptsdk path (relative to project root)
@ -19,141 +30,105 @@ if [ ! -f "$SDK_LIB" ]; then
    echo "ERROR: $SDK_LIB not found. Vendor the libzuptsdk shared object first." >&2
    exit 1
 fi
+PQVV_LIB="vendor/pqvaptvupt/libpqvaptvupt.so.0.6.0"
+if [ ! -f "$PQVV_LIB" ]; then
+    echo "ERROR: $PQVV_LIB not found. Vendor the libpqvaptvupt shared object first." >&2
+    exit 1
+fi

-# Rebuild zupt fresh, then patch the rpath to point at /usr/lib/zupt
-echo "[deb] Building zupt"
+echo "[deb] Building vaptvupt"
 make clean >/dev/null 2>&1 || true
 make -j"$(nproc)" >/dev/null

-echo "[deb] Patching rpath -> /usr/lib/zupt:/usr/lib64/zupt"
-patchelf --set-rpath '/usr/lib/zupt:/usr/lib64/zupt' zupt
+echo "[deb] Patching rpath -> /usr/lib/$PKGNAME:/usr/lib64/$PKGNAME"
+patchelf --set-rpath "/usr/lib/$PKGNAME:/usr/lib64/$PKGNAME" $PKGNAME

-# Verify rpath was applied
-if ! readelf -d zupt | grep -q "RUNPATH.*\[/usr/lib/zupt:/usr/lib64/zupt\]"; then
-    echo "ERROR: built zupt does not have correct RUNPATH" >&2
-    readelf -d zupt | grep -E "RPATH|RUNPATH"
+if ! readelf -d $PKGNAME | grep -q "RUNPATH.*\[/usr/lib/$PKGNAME:/usr/lib64/$PKGNAME\]"; then
+    echo "ERROR: built $PKGNAME does not have correct RUNPATH" >&2
+    readelf -d $PKGNAME | grep -E "RPATH|RUNPATH"
    exit 1
 fi

 rm -rf "$ROOT"
 mkdir -p "$ROOT/DEBIAN" \
         "$ROOT/usr/bin" \
-         "$ROOT/usr/lib/zupt" \
-         "$ROOT/usr/share/doc/zupt" \
-         "$ROOT/usr/share/man/man1"
+         "$ROOT/usr/lib/$PKGNAME" \
+         "$ROOT/usr/share/doc/$PKGNAME" \
+         "$ROOT/usr/share/man/man1" \
+         "$ROOT/usr/share/bash-completion/completions" \
+         "$ROOT/usr/share/zsh/site-functions" \
+         "$ROOT/usr/share/fish/vendor_completions.d"

-# Binary
-install -m 755 zupt "$ROOT/usr/bin/zupt"
+# Binary + legacy symlink
+install -m 755 $PKGNAME "$ROOT/usr/bin/$PKGNAME"
+ln -sf $PKGNAME "$ROOT/usr/bin/$LEGACY"

 # Bundled libzuptsdk
-install -m 755 "$SDK_LIB" "$ROOT/usr/lib/zupt/libzuptsdk.so.2.0.0"
-ln -sf libzuptsdk.so.2.0.0 "$ROOT/usr/lib/zupt/libzuptsdk.so.2"
-ln -sf libzuptsdk.so.2.0.0 "$ROOT/usr/lib/zupt/libzuptsdk.so"
+install -m 755 "$SDK_LIB" "$ROOT/usr/lib/$PKGNAME/libzuptsdk.so.2.0.0"
+ln -sf libzuptsdk.so.2.0.0 "$ROOT/usr/lib/$PKGNAME/libzuptsdk.so.2"
+ln -sf libzuptsdk.so.2.0.0 "$ROOT/usr/lib/$PKGNAME/libzuptsdk.so"
+install -m 755 "$PQVV_LIB" "$ROOT/usr/lib/$PKGNAME/libpqvaptvupt.so.0.6.0"
+ln -sf libpqvaptvupt.so.0.6.0 "$ROOT/usr/lib/$PKGNAME/libpqvaptvupt.so.0"
+ln -sf libpqvaptvupt.so.0.6.0 "$ROOT/usr/lib/$PKGNAME/libpqvaptvupt.so"
+
+# Manpage (gzip-compressed); install + legacy alias
+if [ -f doc/vaptvupt.1 ]; then
+    gzip -9n -c doc/vaptvupt.1 > "$ROOT/usr/share/man/man1/$PKGNAME.1.gz"
+    ln -sf $PKGNAME.1.gz "$ROOT/usr/share/man/man1/$LEGACY.1.gz"
+fi
+
+# Shell completions
+if [ -f completions/vaptvupt.bash ]; then
+    install -m 0644 completions/vaptvupt.bash "$ROOT/usr/share/bash-completion/completions/$PKGNAME"
+    ln -sf $PKGNAME "$ROOT/usr/share/bash-completion/completions/$LEGACY"
+fi
+if [ -f completions/_vaptvupt ]; then
+    install -m 0644 completions/_vaptvupt "$ROOT/usr/share/zsh/site-functions/_$PKGNAME"
+    ln -sf _$PKGNAME "$ROOT/usr/share/zsh/site-functions/_$LEGACY"
+fi
+if [ -f completions/vaptvupt.fish ]; then
+    install -m 0644 completions/vaptvupt.fish "$ROOT/usr/share/fish/vendor_completions.d/$PKGNAME.fish"
+fi

 # Docs
-install -m 644 README.md CHANGELOG.md SECURITY.md AUDIT.md "$ROOT/usr/share/doc/zupt/"
-gzip -9n -c CHANGELOG.md > "$ROOT/usr/share/doc/zupt/changelog.gz"
+install -m 0644 README.md "$ROOT/usr/share/doc/$PKGNAME/README.md"
+install -m 0644 LICENSE   "$ROOT/usr/share/doc/$PKGNAME/copyright"
+[ -f SECURITY.md ]      && install -m 0644 SECURITY.md      "$ROOT/usr/share/doc/$PKGNAME/SECURITY.md"
+[ -f CHANGELOG.md ]     && install -m 0644 CHANGELOG.md     "$ROOT/usr/share/doc/$PKGNAME/CHANGELOG.md"
+[ -f THREAT_MODEL.md ]  && install -m 0644 THREAT_MODEL.md  "$ROOT/usr/share/doc/$PKGNAME/THREAT_MODEL.md"

-# Man page
-if [ -f doc/zupt.1 ]; then
-    install -m 644 doc/zupt.1 "$ROOT/usr/share/man/man1/zupt.1"
-else
-    cat > "$ROOT/usr/share/man/man1/zupt.1" <<MAN
-.TH ZUPT 1 "May 2026" "zupt $VERSION" "User Commands"
-.SH NAME
-zupt \\- post-quantum backup compression utility
-.SH SYNOPSIS
-.B zupt
-[\\fIcommand\\fR] [\\fIoptions\\fR] \\fIarchive\\fR [\\fIfiles...\\fR]
-.SH SEE ALSO
-Run \\fBzupt help\\fR for the full options reference.
-MAN
-fi
-gzip -9n "$ROOT/usr/share/man/man1/zupt.1"
-
-# Copyright
-cat > "$ROOT/usr/share/doc/zupt/copyright" <<'COPYRIGHT'
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: zupt
-Upstream-Contact: Cristian Cezar Moisés <zupt@riseup.net>
-Source: https://git.securityops.co/cristiancmoises/zupt
-
-Files: *
-Copyright: 2025-2026 Cristian Cezar Moisés
-License: AGPL-3.0+
- This program is free software: you can redistribute it and/or modify
- it under the terms of the GNU Affero General Public License as
- published by the Free Software Foundation, either version 3 of the
- License, or (at your option) any later version.
- .
- On Debian systems, the complete text of the GNU Affero General Public
- License version 3 can be found in /usr/share/common-licenses/AGPL-3.
-
-Files: src/vv_*.c src/vaptvupt_api.c include/vv_*.h include/vaptvupt*.h
-Copyright: 2025-2026 Cristian Cezar Moisés
-License: GPL-3.0+
- The VaptVupt LZ codec is licensed under the GNU General Public License
- version 3 or later (NOT AGPL like the rest of the project). VaptVupt
- is GPL so that, with sufficient maturity, it can be considered for
- upstreaming into the Linux or BSD kernels.
- .
- On Debian systems, the complete text of the GNU General Public
- License version 3 can be found in /usr/share/common-licenses/GPL-3.
-
-Files: usr/lib/zupt/libzuptsdk.so.*
-Copyright: 2025-2026 Cristian Cezar Moisés
-License: AGPL-3.0+
- Bundled libzuptsdk shared object is part of the upstream libzuptsdk
- project, AGPL-3.0+. Source: https://git.securityops.co/cristiancmoises/libzuptsdk
-
-Comment:
- Commercial licenses (relief from AGPL/GPL copyleft terms) are
- available for both components. Contact sac@securityops.co for
- commercial inquiries.
-COPYRIGHT
-
-# Control
-INSTALLED_SIZE=$(du -sk "$ROOT" | cut -f1)
+# DEBIAN/control
+INSTALLED_KB=$(du -sk "$ROOT/usr" | awk '{print $1}')
 cat > "$ROOT/DEBIAN/control" <<EOF
-Package: zupt
+Package: $PKGNAME
 Version: $VERSION
 Section: utils
 Priority: optional
 Architecture: $ARCH
-Depends: libc6 (>= 2.28), libargon2-1, libssl3
-Maintainer: Cristian Cezar Moisés <zupt@riseup.net>
-Installed-Size: $INSTALLED_SIZE
+Provides: $LEGACY (= $VERSION)
+Replaces: $LEGACY (<< 3.0.0)
+Conflicts: $LEGACY (<< 3.0.0)
+Depends: libargon2-1, libssl3 | libssl3t64
+Installed-Size: $INSTALLED_KB
+Maintainer: Cristian Cezar Moisés <sac@securityops.co>
 Homepage: https://git.securityops.co/cristiancmoises/zupt
-Description: Post-quantum backup compression utility
- Zupt is a backup-oriented compression utility with hybrid post-quantum
- encryption (ML-KEM-768 + X25519). It provides AES-256-CTR + HMAC-SHA256
- authenticated encryption, multi-threaded compression, full-disk
- backup/restore, block-level deduplication, and embeds the VaptVupt
- 2.48.2 codec for high-throughput LZ77 + tANS compression with AVX2
- and NEON SIMD acceleration. The libzuptsdk shared library is bundled
- under /usr/lib/zupt -- no separate package required.
+Description: Post-quantum backup compression utility (formerly zupt)
+ VaptVupt (renamed from Zupt in v3.0.0 due to a prior INPI Brasil
+ trademark on the name) is a pure-C11 backup compression utility
+ featuring post-quantum hybrid encryption (ML-KEM-768 + X25519,
+ FIPS 203), AES-256-CTR + HMAC-SHA256 authenticated encryption,
+ Argon2id KDF (PBKDF2-SHA256 via --kdf pbkdf2), multi-threaded
+ compression with the VaptVupt LZ + ANS codec 2.48.5, full-disk
+ backup with sparse-region detection, and end-to-end byte-level
+ tamper detection on encrypted archives (F-09: 0/1827 silent
+ accepts).
+ .
+ The .zupt archive extension is unchanged; v2.x and v3.0.0
+ archives are bidirectionally compatible. The legacy /usr/bin/zupt
+ symlink is preserved for one major version cycle.
 EOF

-# Postinst / Postrm: nothing needed; libzuptsdk is found via RPATH
-cat > "$ROOT/DEBIAN/postinst" <<'POSTINST'
-#!/bin/sh
-set -e
-exit 0
-POSTINST
-chmod 755 "$ROOT/DEBIAN/postinst"
-
-cat > "$ROOT/DEBIAN/postrm" <<'POSTRM'
-#!/bin/sh
-set -e
-exit 0
-POSTRM
-chmod 755 "$ROOT/DEBIAN/postrm"
-
-# Build
-dpkg-deb -Zxz --build --root-owner-group "$ROOT" "/tmp/$PKG.deb"
-echo ""
-echo "Built: /tmp/$PKG.deb ($(du -h /tmp/$PKG.deb | cut -f1))"
-dpkg-deb --info "/tmp/$PKG.deb" | head -20
-echo ""
-echo "Contents:"
-dpkg-deb --contents "/tmp/$PKG.deb" | head -20
+DEB_OUT="/tmp/${PKGNAME}_${VERSION}_${ARCH}.deb"
+dpkg-deb --build --root-owner-group "$ROOT" "$DEB_OUT" >/dev/null
+echo "Built: $DEB_OUT ($(du -h "$DEB_OUT" | cut -f1))"
+dpkg-deb -I "$DEB_OUT" | sed -n '1,20p'