v4.0.0: codec 2.60.4 security release, --pq-box sealed-box mode, F-16 fix

Major release. Highlights:

- Codec: vendored VaptVupt codec moves to canonical 2.60.4 security
  release. Fixes a high-severity OOB heap write in the AVX2 decode fast
  path (reachable on a valid stream sized to exactly content_size, both
  tail variants). Brings CBMC-formally-verified BCJ filters with
  automatic ELF/PE/Mach-O detection. Compressed output stays
  byte-identical (ratio gate Δ 0.00%); wire format unchanged at v1.6.
- New --pq-box sealed-box recipient mode (vendored libpqvaptvupt 0.6.0):
  ML-KEM-768 + X25519 combined via HKDF-SHA256 with domain separation,
  AES-256-CTR + HMAC-SHA256 EtM. Legacy --pq and --pq-sdk stay readable.
- F-16: discloses and fixes a pre-existing data-loss defect in the
  <= 3.8.0 in-tree BCJ encoder. Full back-compat matrix decodes
  byte-exact under 4.0.0; every readable pre-4.0 archive remains readable.

Repository hygiene:
- Sync full 4.0.0 source tree (codec, crypto, SDK, GUI, packaging, tests).
- Remove internal scratch files (PROMPT.md, FORMAL_AUDIT_PROMPT.md)
  and superseded version-specific docs (INTEGRATION_PROTOCOL_2.60.4.md,
  docs/FINDINGS-2.x.md) and a stray test binary.
- Refresh README download/install section to real 4.0.0 release assets;
  bump version badge to 4.0.0.
- Add .gitignore for build outputs (keeps vendored prebuilt libraries).

packaging/build-gui-rpm.sh

@@ -5,37 +5,40 @@
 set -e
 cd "$(dirname "$0")/.."
 
-VERSION="${VERSION:-1.1.1}"
-RPMROOT="/tmp/rpmbuild-zupt-gui"
+VERSION="${VERSION:-1.2.0}"
+RPMROOT="/tmp/rpmbuild-vaptvupt-gui"
 rm -rf "$RPMROOT"
 mkdir -p "$RPMROOT"/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
 
-TMP="/tmp/zupt-gui-$VERSION"
+TMP="/tmp/vaptvupt-gui-$VERSION"
 rm -rf "$TMP" && mkdir -p "$TMP/src" "$TMP/doc" "$TMP/assets"
 cp gui/src/zupt_gui.py "$TMP/src/"
-cp doc/zupt-gui.1 "$TMP/doc/" 2>/dev/null || true
+cp doc/vaptvupt-gui.1 "$TMP/doc/" 2>/dev/null || true
 cp gui/README.md "$TMP/" 2>/dev/null || true
 cp LICENSE "$TMP/" 2>/dev/null || true
 [ -f gui/assets/zupt-icon.png ] && cp gui/assets/zupt-icon.png "$TMP/assets/"
-tar -czf "$RPMROOT/SOURCES/zupt-gui-$VERSION.tar.gz" -C /tmp "zupt-gui-$VERSION"
+tar -czf "$RPMROOT/SOURCES/vaptvupt-gui-$VERSION.tar.gz" -C /tmp "vaptvupt-gui-$VERSION"
 
-cat > "$RPMROOT/SPECS/zupt-gui.spec" <<EOF
-Name:           zupt-gui
+cat > "$RPMROOT/SPECS/vaptvupt-gui.spec" <<EOF
+Name:           vaptvupt-gui
 Version:        $VERSION
 Release:        1%{?dist}
-Summary:        Graphical interface for the Zupt post-quantum backup utility
+Summary:        Graphical interface for VaptVupt post-quantum backup utility (formerly zupt-gui)
 License:        AGPL-3.0-or-later
 URL:            https://git.securityops.co/cristiancmoises/zupt
-Source0:        zupt-gui-%{version}.tar.gz
+Source0:        vaptvupt-gui-%{version}.tar.gz
 BuildArch:      noarch
 
 BuildRequires:  python3 >= 3.9
 Requires:       python3 >= 3.9
 Requires:       (python3-qt6 or python3-pyside6 or python3-pyqt6)
-Requires:       zupt >= 2.2.3
+Requires:       (vaptvupt >= 3.0.0 or zupt >= 2.2.3)
+Provides:       zupt-gui = %{version}-%{release}
+Obsoletes:      zupt-gui < 1.2.0
+Conflicts:      zupt-gui < 1.2.0
 
 %description
-PySide6/PyQt6 frontend for Zupt. Supports compression, extraction, key
+PySide6/PyQt6 frontend for VaptVupt (renamed from zupt-gui in 1.x). Supports compression, extraction, key
 management, and full disk backup/restore. Exposes both legacy --pq and
 new --pq-sdk (libzuptsdk: HKDF combiner, key commitment, HPKE binding,
 Argon2id) encryption modes. Auto-detects whichever Qt6 binding is
@@ -49,44 +52,46 @@ installed at startup.
 
 %install
 mkdir -p %{buildroot}%{_bindir}
-mkdir -p %{buildroot}%{_libdir}/zupt-gui
+mkdir -p %{buildroot}%{_libdir}/vaptvupt-gui
 mkdir -p %{buildroot}%{_datadir}/applications
 mkdir -p %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
 mkdir -p %{buildroot}%{_mandir}/man1
 
-install -m 644 src/zupt_gui.py %{buildroot}%{_libdir}/zupt-gui/
+install -m 644 src/zupt_gui.py %{buildroot}%{_libdir}/vaptvupt-gui/
 
-cat > %{buildroot}%{_bindir}/zupt-gui <<'WRAP'
+cat > %{buildroot}%{_bindir}/vaptvupt-gui <<'WRAP'
 #!/bin/sh
-exec python3 %{_libdir}/zupt-gui/zupt_gui.py "\$@"
+exec python3 %{_libdir}/vaptvupt-gui/zupt_gui.py "\$@"
 WRAP
-chmod 755 %{buildroot}%{_bindir}/zupt-gui
+chmod 755 %{buildroot}%{_bindir}/vaptvupt-gui
+# v3.0.0: legacy zupt-gui symlink for one major version cycle
+ln -sf vaptvupt-gui %{buildroot}%{_bindir}/zupt-gui
 
-cat > %{buildroot}%{_datadir}/applications/zupt-gui.desktop <<'DESKTOP'
+cat > %{buildroot}%{_datadir}/applications/vaptvupt-gui.desktop <<'DESKTOP'
 [Desktop Entry]
 Type=Application
-Name=Zupt GUI
+Name=VaptVupt GUI
 GenericName=Backup and Compression Utility
 Comment=Post-quantum backup with HKDF combiner, key commitment, HPKE binding
-Exec=zupt-gui %f
-Icon=zupt-gui
+Exec=vaptvupt-gui %f
+Icon=vaptvupt-gui
 Terminal=false
 Categories=Utility;Archiving;Compression;Security;
 StartupNotify=true
 DESKTOP
 
-[ -f doc/zupt-gui.1 ] && install -m 644 doc/zupt-gui.1 %{buildroot}%{_mandir}/man1/
-[ -f assets/zupt-icon.png ] && install -m 644 assets/zupt-icon.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/zupt-gui.png || true
+[ -f doc/vaptvupt-gui.1 ] && install -m 644 doc/vaptvupt-gui.1 %{buildroot}%{_mandir}/man1/
+[ -f assets/zupt-icon.png ] && install -m 644 assets/zupt-icon.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/vaptvupt-gui.png || true
 
 # Generate placeholder icon if no real one exists
-if [ ! -f %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/zupt-gui.png ]; then
+if [ ! -f %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/vaptvupt-gui.png ]; then
     python3 -c "
 import struct, zlib
 def png(w, h, color):
     raw = b''.join(b'\\0' + bytes(color) * w for _ in range(h))
     def chunk(t, d): return struct.pack('>I', len(d)) + t + d + struct.pack('>I', zlib.crc32(t+d) & 0xffffffff)
     return b'\\x89PNG\\r\\n\\x1a\\n' + chunk(b'IHDR', struct.pack('>IIBBBBB', w, h, 8, 2, 0, 0, 0)) + chunk(b'IDAT', zlib.compress(raw)) + chunk(b'IEND', b'')
-open('%{buildroot}%{_datadir}/icons/hicolor/256x256/apps/zupt-gui.png','wb').write(png(256, 256, (88, 92, 215)))
+open('%{buildroot}%{_datadir}/icons/hicolor/256x256/apps/vaptvupt-gui.png','wb').write(png(256, 256, (88, 92, 215)))
 "
 fi
 
@@ -108,21 +113,35 @@ fi
 %files
 %doc README.md
 %license LICENSE
+%{_bindir}/vaptvupt-gui
 %{_bindir}/zupt-gui
-%{_libdir}/zupt-gui/zupt_gui.py
-%{_datadir}/applications/zupt-gui.desktop
-%{_datadir}/icons/hicolor/256x256/apps/zupt-gui.png
-%{_mandir}/man1/zupt-gui.1*
+%{_libdir}/vaptvupt-gui/zupt_gui.py
+%{_datadir}/applications/vaptvupt-gui.desktop
+%{_datadir}/icons/hicolor/256x256/apps/vaptvupt-gui.png
 
 %changelog
-* Mon Apr 27 2026 Cristian Cezar Moisés <zupt@riseup.net> - $VERSION-1
+* Sun May 25 2026 Cristian Cezar Moisés <zupt@riseup.net> - $VERSION-1
+- v1.2.0: package renamed zupt-gui → vaptvupt-gui (parent CLI also
+  renamed; INPI Brasil trademark on "Zupt"). Legacy /usr/bin/zupt-gui
+  symlink preserved. GUI binary-discovery bug fix: _find_vaptvupt
+  with liveness check + discovery log via VAPTVUPT_DEBUG=1.
+* Mon Apr 27 2026 Cristian Cezar Moisés <zupt@riseup.net> - 1.1.1-1
 - Cross-binding (PySide6 OR PyQt6 auto-detected)
 - SDK v2 mode toggles in compress/extract/keygen tabs
 - Man page added
 EOF
 
 if command -v rpmbuild >/dev/null 2>&1; then
-    rpmbuild --define "_topdir $RPMROOT" -bb "$RPMROOT/SPECS/zupt-gui.spec" 2>&1 | tail -3
+    # On Debian/Ubuntu, the host's `rpm` doesn't see `python3` as an RPM
+    # (it's a deb), so the BuildRequires check would fail. Use --nodeps
+    # since the runtime check on the target system is what actually
+    # matters. The Requires: lines still apply on install.
+    rpmbuild --define "_topdir $RPMROOT" --nodeps -bb "$RPMROOT/SPECS/vaptvupt-gui.spec" 2>&1 | tail -3
+    if [ -f "$RPMROOT/RPMS/noarch/vaptvupt-gui-${VERSION}-1.noarch.rpm" ]; then
+        cp "$RPMROOT/RPMS/noarch/vaptvupt-gui-${VERSION}-1.noarch.rpm" \
+           "/tmp/vaptvupt-gui-${VERSION}-1.noarch.rpm"
+        echo "Built: /tmp/vaptvupt-gui-${VERSION}-1.noarch.rpm"
+    fi
     cp "$RPMROOT/RPMS/noarch/zupt-gui-$VERSION-1."*.rpm /tmp/ 2>/dev/null || true
     ls /tmp/zupt-gui-$VERSION-*.rpm 2>/dev/null
 else