v4.0.0: codec 2.60.4 security release, --pq-box sealed-box mode, F-16 fix

Major release. Highlights: - Codec: vendored VaptVupt codec moves to canonical 2.60.4 security release. Fixes a high-severity OOB heap write in the AVX2 decode fast path (reachable on a valid stream sized to exactly content_size, both tail variants). Brings CBMC-formally-verified BCJ filters with automatic ELF/PE/Mach-O detection. Compressed output stays byte-identical (ratio gate Δ 0.00%); wire format unchanged at v1.6. - New --pq-box sealed-box recipient mode (vendored libpqvaptvupt 0.6.0): ML-KEM-768 + X25519 combined via HKDF-SHA256 with domain separation, AES-256-CTR + HMAC-SHA256 EtM. Legacy --pq and --pq-sdk stay readable. - F-16: discloses and fixes a pre-existing data-loss defect in the <= 3.8.0 in-tree BCJ encoder. Full back-compat matrix decodes byte-exact under 4.0.0; every readable pre-4.0 archive remains readable. Repository hygiene: - Sync full 4.0.0 source tree (codec, crypto, SDK, GUI, packaging, tests). - Remove internal scratch files (PROMPT.md, FORMAL_AUDIT_PROMPT.md) and superseded version-specific docs (INTEGRATION_PROTOCOL_2.60.4.md, docs/FINDINGS-2.x.md) and a stray test binary. - Refresh README download/install section to real 4.0.0 release assets; bump version badge to 4.0.0. - Add .gitignore for build outputs (keeps vendored prebuilt libraries).
2026-06-10 18:48:58 -03:00 · 2026-06-10 18:48:58 -03:00 · 544a2cd647
commit 544a2cd647
parent 7619c4c577
98 changed files with 15615 additions and 1397 deletions
--- a/packaging/debian/changelog
+++ b/packaging/debian/changelog
@ -0,0 +1,353 @@
+vaptvupt (4.0.0-1) UNRELEASED; urgency=high
+
+  * Codec upgraded to canonical VaptVupt 2.60.4 (security release):
+    fixes a high-severity OOB heap write in the AVX2 decode fast path
+    on exact-content_size buffers; brings CBMC-verified BCJ filters
+    with automatic ELF/PE/Mach-O detection. Ratio gate verified
+    byte-identical on identical inputs. New regression suite: 80
+    exact-size decode cases under ASan + BCJ roundtrips.
+  * F-16 (data loss, pre-existing, fixed): archives created by <= 3.8.0
+    at -l 8/-l 9 whose inputs included executables may be undecodable
+    by any version (write-time defect in the old divergent BCJ
+    encoder). Re-create such archives with 4.0.0 and verify extraction
+    before deleting sources. Readers <= 3.8.0 cannot open new archives
+    where the auto-filter fired (L3+ on executables).
+  * New --pq-box recipient encryption (envelope 0x05) via vendored
+    libpqvaptvupt 0.6.0: ML-KEM-768 + X25519 combined through
+    HKDF-SHA256 with domain separation; magic-tagged keypair files;
+    13/13 adversarial checks; ASan/UBSan clean. keygen --box generates
+    keypairs. Legacy --pq and --pq-sdk unchanged and re-verified.
+  * SHA-NI measured on capable silicon: SHA-256 5.8x over scalar
+    (204 -> 1184 MB/s); the v3.2.0 [ESTIMATED] label is retired.
+    Encrypted per-block throughput ~2x the 3.8.0-era figure.
+  * Toolchain: clang strict build restored (Jasmin .s assembled with
+    as(1)); vendored codec under explicit upstream warning policy;
+    test-asan link fixed (vv_bcj.c); codec license comment corrected
+    to GPL-3.0-or-later.
+  * Wire format v1.6 unchanged; 8-mode back-compat matrix byte-exact.
+    26 test suites green; NIST/RFC vectors 16/16.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Wed, 10 Jun 2026 12:00:00 +0000
+
+vaptvupt (3.8.0-1) UNRELEASED; urgency=medium
+
+  * Documentation-only release. No source, crypto, or wire-format change
+    (format v1.6); the binary behaves identically to 3.7.0.
+  * Add BENCHMARKS.md: a consolidated, reproducible, measured benchmark
+    set with the test machine and method stated for every table —
+    compression ratio + encode/decode throughput at level 9 across the
+    5-fixture suite; encode-speed-vs-level trade-off; encryption overhead
+    separating the one-time KDF (Argon2id ~741 ms, PBKDF2 ~1562 ms on the
+    test box) from per-block crypto (~147 MB/s) and plain throughput
+    (~944 MB/s single-threaded); and a head-to-head ratio comparison
+    against zstd-3/zstd-19 that plainly shows where VaptVupt loses.
+  * The SHA-NI speedup is explicitly marked [ESTIMATED] because the test
+    box has no SHA-NI. Previously the only documented benchmarks were
+    codec-ratio numbers dated v3.1.0; the crypto-path data measured
+    across 3.2.0-3.7.0 had never been consolidated.
+  * README benchmark section re-dated v3.1.0 -> v3.8.0 and linked to
+    BENCHMARKS.md. Test surface unchanged: test_vectors 16/0, F-09
+    0/1827, F-06 0/2000.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Sun, 01 Jun 2026 17:30:00 +0000
+
+vaptvupt (3.7.0-1) UNRELEASED; urgency=medium
+
+  * Route the ML-KEM-768 decapsulation implicit-rejection comparison
+    through the single audited constant-time primitive zupt_ct_memeq
+    (introduced in 3.5.0 for the MAC tag compare), replacing an inline
+    byte-OR loop over the 1088-byte ciphertext. A timing leak in this
+    comparison is a KEM decapsulation oracle (distinguishing valid from
+    invalid ciphertexts), which would break IND-CCA2 security; it is now
+    the same measured-constant-time code path as the MAC compare. This
+    was the last security-critical comparison still using a bespoke
+    inline loop.
+  * ML-KEM output semantics are unchanged: zupt_ct_memeq returns equality
+    and the implicit-rejection fail bit is derived as (1 - equal), so a
+    matching ciphertext yields the success shared secret and a mismatched
+    one yields the pseudorandom rejection key, exactly as before.
+    Verified by the FIPS 203 roundtrip (5 trials), the implicit-rejection
+    vector, PQ-hybrid roundtrip, and wrong-key rejection.
+  * Extend tests/test_ct_timing to cover the 1088-byte comparison and add
+    a source-routing guard that fails if the decaps compare stops using
+    zupt_ct_memeq or a raw 1088-byte inline loop reappears. The 1088-byte
+    dudect numbers are reported as INFORMATIONAL, not pass/fail: at that
+    size on a shared vCPU the signal is dominated by memory effects and
+    plain memcmp is no longer a cleanly-leaking control, so the
+    environment-relative ratio that is meaningful at 32 bytes does not
+    transfer. Constant-timeness of the 1088-byte compare instead follows
+    rigorously from the 32-byte pass plus zupt_ct_memeq being
+    length-independent by construction (OR-accumulate, no early exit, no
+    data-dependent branch) plus the source-routing guard.
+  * No cryptographic-correctness change, no wire-format change (v1.6).
+    test_vectors 16/0; F-09 byte sweep 0/1827; F-06 HMAC fuzz 0/2000.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Sun, 01 Jun 2026 16:30:00 +0000
+
+vaptvupt (3.6.0-1) UNRELEASED; urgency=medium
+
+  * Add NIST SP 800-38A AES-256-CTR known-answer vectors (F.5.5 encrypt,
+    F.5.6 decrypt) to the test_vectors suite. AES is the bulk cipher but
+    was previously only tested indirectly via roundtrips; it now has a
+    standards KAT that validates zupt_aes256_ctr on BOTH the Jasmin
+    AES-NI path (zupt_aes256_ctr4 + zupt_aes256_blk, x86_64) and the C
+    T-table fallback. Confirms the Jasmin AES is correct against the
+    standard (closing the stale "stack-offset" concern). userPreferences
+    list SP 800-38A as a required vector; this closes that gap.
+  * Fix an inverted result check in the ML-KEM-768 self-test reporting:
+    zupt_mlkem768_selftest() returns 0 on success / -1 on failure, but
+    test_vectors checked `if (ok)` and so printed "OK" precisely when the
+    self-test FAILED (and would have printed FAIL on success). The check
+    is now `if (rc == 0)`. The test had been passing vacuously.
+  * Fix the ML-KEM-768 NTT roundtrip self-test itself. It asserted
+    ntt∘inv_ntt == identity, which is false for this pqcrystals/Kyber
+    Montgomery convention (forward ntt divides by R without a prior
+    to-Montgomery map, so the roundtrip recovers each coefficient scaled
+    by a fixed constant R^-1 mod q). The self-test now verifies the real
+    invariant — a CONSISTENT linear scaling across all 256 coefficients —
+    which still catches genuine NTT bugs (wrong zeta/index) while no
+    longer emitting a misleading "NTT roundtrip FAILED" line on stderr.
+    ML-KEM correctness end-to-end was never affected: the K-PKE and KEM
+    roundtrips and the FIPS 203 roundtrip vectors all pass.
+  * test_vectors now reports 16 passed, 0 failed (was 14, one vacuous).
+    No source-crypto behaviour change, no wire-format change (v1.6).
+    F-09 byte sweep 0/1827, F-06 HMAC fuzz 0/2000.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Sun, 01 Jun 2026 15:30:00 +0000
+
+vaptvupt (3.5.0-1) UNRELEASED; urgency=medium
+
+  * Measured constant-time MAC comparison (dudect-style). The MAC tag
+    compare — the most timing-sensitive operation, where a leak is a
+    forgery oracle — was previously implemented as three duplicated
+    inline byte-OR loops marked /* CT-REQUIRED */ but never measured.
+    Consolidated into a single audited primitive zupt_ct_memeq() (OR-
+    accumulate, no early exit, volatile sink so the optimiser cannot
+    reintroduce a branch), used by the v1.6 strict decrypt path and the
+    F-08 archive-integrity-trailer check.
+  * New dudect-style timing test tests/test_ct_timing.{c,sh}: Welch's
+    t-test over fixed-equal vs random-differing tag classes, built at
+    -O2 (the shipped optimisation level). Verdict is environment-
+    relative — zupt_ct_memeq's data-dependent timing signal must be a
+    small fraction (<=20%) of leaky memcmp measured in the same
+    environment; it lands near 1%. A positive control (memcmp) confirms
+    the harness can detect a real leak; if the host is too coarse the
+    test reports INCONCLUSIVE rather than passing vacuously. Wired into
+    make check and make test.
+  * Pure internal hardening: turns an asserted constant-time property
+    into a measured one and a regression guard (a future early-return
+    refactor fails the t-test). No cryptographic-correctness change, no
+    wire-format change (v1.6). F-09 byte sweep 0/1827, F-06 HMAC fuzz
+    0/2000. The formally-verified Jasmin zupt_mac_verify_ct path for the
+    v1.4/v1.5 legacy compare is unchanged.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Sun, 01 Jun 2026 14:30:00 +0000
+
+vaptvupt (3.4.0-1) UNRELEASED; urgency=medium
+
+  * F-15: Argon2id KDF parameter transparency. The 0x04 Argon2id
+    enc-header previously recorded only [type|salt|nonce] and nothing
+    about the KDF cost, unlike the PBKDF2 header which records its
+    iteration count — a latent robustness problem for a long-lived
+    archive format (if the Argon2id preset ever changed, old archives
+    could become silently undecryptable). New archives append a one-byte
+    KDF profile descriptor at offset 33 (ZUPT_ARGON2_PROFILE_MODERATE),
+    making the header self-describing. The descriptor is covered by the
+    F-08 archive-integrity trailer, so it cannot be stripped or forged
+    without failing authentication.
+  * Back-compatible (additive): the legacy reader checks enc_hdr_len>=33
+    and reads fixed offsets, so it ignores the trailing byte; existing
+    33-byte Argon2id archives decrypt unchanged. New readers validate the
+    profile and refuse an unknown value (fail-closed) rather than
+    guessing a derivation. Verified byte-exact on pre-3.4.0 encrypted
+    archives.
+  * New regression test tests/test_kdf_transparency.{c,sh} (5 checks),
+    including a build-time KDF cost-floor + determinism guard that fails
+    if the vendored SDK is swapped for a non-memory-hard stand-in. Wired
+    into make check and make test.
+  * No cryptographic-correctness change, no wire-format change (v1.6);
+    F-09 byte sweep 0/1827, F-06 HMAC fuzz 0/2000. 23/23 suites green.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Sun, 01 Jun 2026 13:30:00 +0000
+
+vaptvupt (3.3.0-1) UNRELEASED; urgency=medium
+
+  * Incremental HMAC-SHA256 for the per-block Encrypt-then-MAC hot path.
+    Adds zupt_hmac_sha256_init/update/final: the ipad/opad key-prefix
+    blocks are folded once per keyring (not once per block), and the
+    MAC is streamed segment-by-segment (aad || nonce || ciphertext ||
+    seq) instead of being concatenated into a freshly malloc'd buffer.
+    Removes a per-block malloc + full-ciphertext memcpy on BOTH the
+    encrypt and decrypt sides (for 4 MB blocks: a 4 MB malloc + 4 MB
+    copy per block per direction), and stops copying secret plaintext-
+    derived ciphertext into a second heap buffer.
+  * Byte-identical MAC: RFC 2104 + SHA-256 Merkle-Damgard make streamed
+    updates equal to a single concatenated hash. Verified by RFC 4231
+    vectors, a new equivalence test, and byte-exact decryption of
+    archives produced by 3.2.0 and earlier. No wire-format change
+    (format v1.6); F-09 byte sweep 0/1827, F-06 HMAC fuzz 0/2000.
+  * The one-shot zupt_hmac_sha256 is now a thin wrapper over the
+    incremental API (single source of truth; used by the AIT and other
+    once-per-archive sites).
+  * New regression test tests/test_hmac_incremental.{c,sh} wired into
+    make check and make test. ASan clean on both KDF paths.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Sun, 01 Jun 2026 12:30:00 +0000
+
+vaptvupt (3.2.0-1) UNRELEASED; urgency=medium
+
+  * SHA-256 hardware acceleration (Intel SHA-NI). Adds an
+    SHA256RNDS2/MSG1/MSG2 compression-function path
+    (src/zupt_sha256_shani.c) with runtime CPUID dispatch
+    (has_shani, CPUID.07H:EBX[29]) and a multi-block update() that
+    feeds full blocks straight to the hardware. Accelerates the
+    Encrypt-then-MAC second pass (HMAC-SHA256) and PBKDF2 on CPUs
+    with the SHA Extensions (Intel Goldmont+/Ice Lake+, AMD Zen+).
+    Bit-identical output to the scalar path; the scalar C fallback
+    runs everywhere SHA-NI is absent (incl. aarch64).
+  * Security: SHA-NI is constant-time by construction (no data-
+    dependent memory access or branches), strengthening the side-
+    channel posture of HMAC verification over attacker-influenced
+    ciphertext relative to the table-free-but-scalar software path.
+  * Validation: the 64 SHA-NI round constants are verified bit-
+    identical to the scalar K[] table; NIST FIPS 180-4 vectors pass
+    on both paths; streaming-split == one-shot across lengths
+    0..4096. New regression test tests/test_sha256_shani.{c,sh}
+    wired into make check and make test.
+  * No wire-format change: same SHA-256, same HMAC, same bytes.
+    Format stays v1.6; 3.1.x archives extract unchanged.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Sun, 01 Jun 2026 11:00:00 +0000
+
+vaptvupt (3.1.0-1) UNRELEASED; urgency=medium
+
+  * Integrate VaptVupt LZ + ANS codec 2.48.5 -> 2.53.3. Codec API is
+    byte-identical (vaptvupt.h and all vv_*.h unchanged); only vv_ans.c,
+    vv_decoder.c, vv_encoder.c changed. Brings the optimal parser
+    (measured: text -1.95%, binary -1.31%, source -4.72% smaller),
+    large-window extreme mode, faster decode (now ~on par with zstd-19),
+    and 6 upstream corrupt-input decoder memory-safety fixes.
+  * F-14: fix heap-buffer-overflow WRITE in the decode wrapper. Decode
+    buffers were malloc(uncompressed_size) with no slack; the codec AVX2
+    over-copy needs >=32 B slack per its documented contract. The old
+    codec never reached it; the 2.53.3 wider AVX2 hot path does (found
+    by ASan on a degenerate all-repeats input at L1). Fixed with a shared
+    ZUPT_VV_DECODE_SLACK (64 B) guard on both the single-threaded
+    (zupt_format.c) and parallel (zupt_parallel.c) decode paths.
+  * vv_decoder.c scalar/non-AVX2 build is now -Wall -Wextra -Werror clean
+    (3 AVX2-only safe-zone vars guarded with #if VV_INLINE_AVX2) — fixes
+    a -Werror break on the aarch64/Termux scalar target.
+  * Removed the unverified "1.27x zstd-3 decode" claim from help/version
+    output and README; replaced with our own measured numbers.
+  * New regression test tests/test_vv_decode_slack.sh (7 assertions),
+    wired into make check and make test.
+  * Wire format unchanged (v1.6); 3.0.3 archives extract byte-exact.
+    19/19 suites green; ASan 24/24 single-threaded + 15/15 multi-threaded;
+    300-trial bit-flip fuzz: 0 crashes. F-09 byte sweep 0/1827.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Sat, 31 May 2026 12:00:00 +0000
+
+vaptvupt (3.0.3-1) UNRELEASED; urgency=medium
+
+  * Static-analysis cleanup pass:
+    - Removed dead AND-branch in zupt_decode_varint() and
+      zupt_read_varint() (the `&& (x&0x80)` part of the s>=64
+      overflow check was unreachable since the preceding
+      `if(!(x&0x80))return n;` already handles the terminator
+      case). Behaviour identical; flagged by cppcheck as
+      `knownConditionTrueFalse`.
+    - Explicit (tcflag_t) cast on the ECHO bit-clear in
+      prompt_password() to silence -Wsign-conversion.
+    - Explicit (size_t) cast on zupt_encode_varint return value
+      in zupt_disk_backup() — matches the convention used in
+      zupt_format.c.
+  * Our (non-vendored) C source now compiles cleanly under:
+      gcc -Wall -Wextra -Wpedantic -Wshadow -Wcast-align
+          -Wstrict-prototypes -Wmissing-prototypes -Wnull-dereference
+          -Wformat=2 -Wlogical-op -Wjump-misses-init -Wdouble-promotion
+          -Woverlength-strings -Wconversion -Wsign-conversion -Werror
+    on 9 source files. Vendored vv_*.c, fips202.c, and zupt_mlkem.c
+    are kept under the upstream warning policy.
+  * New regression test tests/test_static_analysis.sh (7 assertions)
+    wires up cppcheck warning+performance level, error-level, and
+    pattern-level checks for the v3.0.3 dead-code findings.
+    Skipped gracefully if cppcheck is not installed. Wired into
+    make check and make test.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Mon, 26 May 2026 15:00:00 +0000
+
+vaptvupt (3.0.2-1) UNRELEASED; urgency=medium
+
+  * F-13: split usage() string literal to stay under C99's 4095-char
+    limit (was 4121 chars, triggering -Woverlength-strings). Five
+    logical fprintf sections (synopsis, compress opts, extract opts,
+    examples, footer) — readable and maintainable.
+  * Help text refreshed: examples now use `vaptvupt` (not legacy
+    `zupt`), default codec described as "VaptVupt LZ + ANS 2.48.5"
+    (was stale "LZ77 + Huffman"), license attribution corrected to
+    "AGPL-3.0-or-later (VaptVupt)" (was "(Zupt)"), commercial-
+    licensing contact added, format-version line added.
+  * -Woverlength-strings now in the default CFLAGS — F-13 type
+    regressions caught at compile time.
+  * New regression test tests/test_help_consistency.sh (10 assertions):
+    parses src/zupt_main.c for the longest fprintf string-literal,
+    checks help output for command-name consistency, codec naming,
+    license attribution, KDF default, and format-version reporting.
+    Wired into make check and make test.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Mon, 26 May 2026 14:00:00 +0000
+
+vaptvupt (3.0.1-1) UNRELEASED; urgency=medium
+
+  * GUI license cleanup: removed MIT-license credit line from the
+    about panel (the GUI is AGPL-3.0-or-later with commercial dual-
+    licensing; the MIT reference was a templating mistake). Replaced
+    gui/LICENSE-GUI (was MIT) with AGPL-3.0-or-later, mirroring the
+    top-level LICENSE. Top-level LICENSE preamble updated to reflect
+    the v3.0.0 Zupt → VaptVupt rename.
+  * GUI version-string parsing bug fix: the v3.0.0 GUI used
+    `replace("zupt ", "")` to peel the product name out of the CLI's
+    version banner, but that substring also appears inside the v3.0.0
+    parenthetical "formerly zupt; renamed in v3.0.0", so the parser
+    produced garbage. Window title, splash header, status bar and
+    about-panel hero number all now display "3.0.1" cleanly. New
+    anchored regex `_VERSION_RE` matches the version number only.
+  * GUI about-panel enhanced: header "ZUPT" → "VAPTVUPT", crypto
+    stack expanded to include Argon2id (default since v2.4.1), HKDF,
+    and the VaptVupt LZ + ANS codec attribution as a separate row
+    with its own copyright + license. Commercial-licensing contact
+    (sac@securityops.co) now visible.
+  * New regression test `tests/test_gui_branding.sh` catches future
+    MIT-line resurgence, the broken `replace("zupt ", ...)` parser
+    pattern, and the about-panel header still saying "ZUPT".
+    Wired into `make check` and `make test`. 11 assertions.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Mon, 26 May 2026 13:00:00 +0000
+
+vaptvupt (3.0.0-1) UNRELEASED; urgency=medium
+
+  * Renamed from zupt → vaptvupt: prior INPI Brasil trademark on
+    "Zupt" required a product rename. Archive extension stays .zupt
+    for format continuity (header magic unchanged). The binary
+    `zupt` is preserved as a symlink to `vaptvupt` for one major
+    version cycle.
+  * Integrated VaptVupt LZ + ANS codec 2.48.5: fixes csz==0 heap-
+    buffer-overflow READ in vv_dstream_decompress_chunk (fuzzer-
+    found, medium severity), UBSan-safe pointer arithmetic in
+    vv_copy_match.
+  * Enhanced manpage covering all v3.0.0 surface (rename rationale,
+    PERFORMANCE table, threat model summary, exit codes, ENV vars).
+  * GUI binary-discovery bug fix: GUI launched from desktop
+    sessions with minimal PATH (no /usr/bin) now finds the binary
+    correctly. Discovery log available via VAPTVUPT_DEBUG=1.
+  * Format unchanged at v1.6. Bidirectional compat with 2.4.x.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Sun, 25 May 2026 13:00:00 +0000
+
+zupt (2.4.8-1) UNRELEASED; urgency=medium
+
+  * Initial Debian source package.
+  * Closes F-12 (encrypted comments), continues from upstream's
+    no-open-findings security baseline.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Tue, 20 May 2025 12:00:00 +0000
--- a/packaging/debian/control
+++ b/packaging/debian/control
@ -0,0 +1,41 @@
+Source: vaptvupt
+Section: utils
+Priority: optional
+Maintainer: Cristian Cezar Moisés <sac@securityops.co>
+Build-Depends:
+ debhelper-compat (= 13),
+ gcc,
+ libc6-dev,
+ python3 (>= 3.8)
+Standards-Version: 4.6.2
+Homepage: https://git.securityops.co/cristiancmoises/zupt
+Vcs-Browser: https://git.securityops.co/cristiancmoises/zupt
+Vcs-Git: https://git.securityops.co/cristiancmoises/zupt.git
+Rules-Requires-Root: no
+
+Package: vaptvupt
+Architecture: any
+Provides: zupt (= ${binary:Version})
+Replaces: zupt
+Conflicts: zupt
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: Post-quantum backup compression utility (formerly Zupt)
+ VaptVupt (renamed from Zupt in v3.0.0 due to INPI Brasil trademark) is
+ a pure-C11 backup compression utility featuring:
+  * Post-quantum hybrid encryption (ML-KEM-768 + X25519, FIPS 203)
+  * AES-256-CTR + HMAC-SHA256 authenticated encryption (Encrypt-then-MAC)
+  * Argon2id password-based key derivation (default since 2.4.1)
+  * Multi-threaded compression with the VaptVupt LZ + ANS codec 2.48.5
+  * Full-disk backup and restore with sparse-region detection
+  * End-to-end byte-level tamper detection on encrypted archives
+    (0 silent-accept positions in the v1.6 exhaustive byte sweep)
+  * Constant-time cryptographic primitives verified with Jasmin
+  * NIST/RFC test vectors for SHA-256, SHA-3, ML-KEM-768, AES-256-CTR,
+    HMAC-SHA256, X25519, PBKDF2, Argon2id
+ .
+ The archive extension stays .zupt for format continuity (header magic
+ unchanged). The binary `zupt` is preserved as a symlink to `vaptvupt`.
+ .
+ The archive format includes an integrity trailer that authenticates the
+ header and footer, per-block HMAC with bound frame-preface AAD, and
+ optional encrypted comments.
--- a/packaging/debian/copyright
+++ b/packaging/debian/copyright
@ -0,0 +1,49 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: zupt
+Upstream-Contact: Cristian Cezar Moisés <sac@securityops.co>
+Source: https://git.securityops.co/cristiancmoises/zupt
+
+Files: *
+Copyright: 2025-2026 Cristian Cezar Moisés
+License: AGPL-3.0-or-later
+
+Files: src/vv_*.c include/vaptvupt*.h include/vv_*.h vendor/zuptsdk/include/vv_*.h vendor/zuptsdk/include/vaptvupt*.h
+Copyright: 2025-2026 Cristian Cezar Moisés (VaptVupt codec)
+License: GPL-3.0-or-later
+
+Files: vendor/zuptsdk/*
+Copyright: 2025-2026 Cristian Cezar Moisés (libzuptsdk)
+License: GPL-3.0-or-later
+
+Files: debian/*
+Copyright: 2025-2026 Cristian Cezar Moisés <sac@securityops.co>
+License: AGPL-3.0-or-later
+
+License: AGPL-3.0-or-later
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as
+ published by the Free Software Foundation, either version 3 of the
+ License, or (at your option) any later version.
+ .
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+ .
+ On Debian systems, the full text of the GNU Affero General Public
+ License version 3 can be found in the file
+ `/usr/share/common-licenses/AGPL-3'.
+
+License: GPL-3.0-or-later
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ .
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+ .
+ On Debian systems, the full text of the GNU General Public License
+ version 3 can be found in the file `/usr/share/common-licenses/GPL-3'.
--- a/packaging/debian/rules
+++ b/packaging/debian/rules
@ -0,0 +1,37 @@
+#!/usr/bin/make -f
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+# Honour Debian's reproducible-build epoch when set by dpkg-buildpackage.
+export SOURCE_DATE_EPOCH ?= 1747699200
+
+# Hardening flags — Debian's defaults are already strong, this adds project-
+# specific ones.
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+export DEB_CFLAGS_MAINT_APPEND = -Wall -Wextra -Wpedantic
+export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
+
+%:
+	dh $@
+
+override_dh_auto_build:
+	$(MAKE) -j$$(nproc)
+
+override_dh_auto_test:
+	# Project's own regression suite covers F-06..F-12.
+	$(MAKE) test
+
+override_dh_auto_install:
+	$(MAKE) DESTDIR=$(CURDIR)/debian/zupt PREFIX=/usr install
+	# Vendored libzuptsdk goes alongside the binary at a relative rpath.
+	install -d $(CURDIR)/debian/zupt/usr/lib/zupt
+	install -m 0755 vendor/zuptsdk/libzuptsdk.so.2.0.0 \
+		$(CURDIR)/debian/zupt/usr/lib/zupt/libzuptsdk.so.2.0.0
+	ln -sf libzuptsdk.so.2.0.0 $(CURDIR)/debian/zupt/usr/lib/zupt/libzuptsdk.so.2
+	ln -sf libzuptsdk.so.2.0.0 $(CURDIR)/debian/zupt/usr/lib/zupt/libzuptsdk.so
+
+override_dh_auto_clean:
+	$(MAKE) clean
+
+# Skip dh_strip's separate -dbgsym packages for a single-source-package layout.
+override_dh_strip:
+	dh_strip --no-automatic-dbgsym
--- a/packaging/debian/source/format
+++ b/packaging/debian/source/format
@ -0,0 +1 @@
+3.0 (quilt)