cristiancmoises/zupt
Watch
1
0
Fork
You've already forked zupt
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 3

release: prepare ZUPT 5.2.8

Browse source
This commit is contained in:
Cristian Cezar Moisés 2026-08-31 20:32:42 -03:00
commit 7687cfa577
29 changed files with 456 additions and 200 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.github/workflows/promote-release.yml vendored
View file

@ -11,7 +11,7 @@ on:
required: true
type: number
tag:
description: Existing annotated release tag, for example v5.2.7
description: Existing annotated release tag, for example v5.2.8
required: true
type: string

75
AUDIT.md
View file

@ -1,12 +1,12 @@
<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
# ZUPT 5.2.7 audit guide and finding history
# ZUPT 5.2.8 audit guide and finding history
This document describes review surfaces and reproducible checks. It is an
upstream self-review, not an independent audit, certification, or guarantee.
`SECURITY.md` defines reporting policy and `THREAT_MODEL.md` defines the
security boundary.
## 5.2.7 scope
## 5.2.8 scope
The baseline scope is the source-only CLI and its bundled source codec:
@ -28,7 +28,7 @@ output.
## Source-only review
The 5.2.7 baseline retains the source-only boundary introduced in 5.2.2, which
The 5.2.8 baseline retains the source-only boundary introduced in 5.2.2, which
removed incomplete SDK/PQBOX header snapshots and local precompiled-library
expectations. Git and new upstream source
archives are intended to contain no compiled executable, object, shared/static
@ -42,10 +42,10 @@ scripts/check-source-only.sh
# committed Git tree or immutable tag
scripts/check-source-only.sh --tag HEAD
scripts/check-source-only.sh --tag v5.2.7
scripts/check-source-only.sh --tag v5.2.8
# generated source archive
scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
scripts/check-source-only.sh --archive /path/to/zupt-5.2.8.tar.gz
```
The scanner checks extensions and magic bytes, nested archives, symlink targets,
@ -80,6 +80,7 @@ make -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || printf 1)" \
WITH_SDK=0 WITH_PQBOX=0 V=1
make WITH_SDK=0 WITH_PQBOX=0 check
make WITH_SDK=0 WITH_PQBOX=0 test-all
make sdk-test
```
Relevant review layers include:
@ -92,6 +93,7 @@ Relevant review layers include:
| Archive behavior | quick/regression, traversal, argument-order, block-swap, nonce, and exact-size tests | Exercises current parser, integrity, and round-trip properties |
| Password sources | `tests/test_password_sources.sh` | Exercises password-file, inherited-descriptor and explicit-prompt rejection paths without logging password contents |
| Key files | native key regressions | Exercises no-replace private-file creation, POSIX mode `0600`/Windows current-user-only DACL, failed-partial behavior, checksum, and exact ZKEY/ZPQK version/flags/reserved/size/role validation |
| SDK key publication | `make sdk-test` | Exercises atomic descriptor/handle-backed key copies, POSIX private/public modes, and symlink/hardlink target preservation; this now runs in `release-check` and hosted GCC/Clang Linux CI |
| Terminal output | archive-comment regression | Requires displayed untrusted comments to contain no raw terminal-control sequence |
| Prompt cleanup | PTY signal regression | Requires handled POSIX interruption to restore the saved terminal state |
| Sanitizers | `make test-asan-run` | Builds and executes separate ASan/UBSan/LSan evidence where supported; not a substitute for normal tests |
@ -109,7 +111,7 @@ without evidence.
The following upstream self-audit results apply only to the 5.2.2 candidate at
commit `ff99770` on the recorded local Linux environments. The immutable 5.2.2
tag was not promoted after post-tag CI integration failures. These results are
not independent certification, a 5.2.7 result, or evidence that release assets
not independent certification, a 5.2.8 result, or evidence that release assets
were published.
| Gate | Result | Recorded evidence |
@ -141,7 +143,7 @@ A separate local openSUSE Tumbleweed reproduction resolved the explicit
produced exactly one `zupt-5.2.4.tar.gz`, which passed the source-only scanner.
This isolates a release/test harness defect; it is not evidence of a product,
archive-format, cryptographic, codec, or SDK ABI change. It also does not turn
the skipped native jobs into passes or transfer any result to 5.2.7.
the skipped native jobs into passes or transfer any result to 5.2.8.
## Prior 5.2.5 exact-tag native-gate evidence
@ -164,7 +166,7 @@ GNU Bash 3.2.57 in a clean clone. All four exercised modes completed: the
repository audit reported 609 files and one archive; `--tree` reported 204/0;
`--archive` reported 201/1; and `--root` plus `--tag v5.2.5` reported 810/2.
This is targeted scanner compatibility evidence only, not exact-v5.2.6 or
v5.2.7 hosted CI, package, native-platform, or promotion evidence.
v5.2.8 hosted CI, package, native-platform, or promotion evidence.
## Prior 5.2.6 exact-tag native-gate evidence
@ -178,10 +180,52 @@ archive and diagnostic assertions.
The 5.2.7 changes scope those helper declarations to supported x86 builds and
carry the safe UTF-8 fixture across the Windows argument boundary without
locale-dependent byte conversion. These are test/release integration changes,
not archive-format, cryptographic, codec, or SDK ABI changes. They are not proof
that any v5.2.7 native or hosted gate has passed.
not archive-format, cryptographic, codec, or SDK ABI changes.
The exact 5.2.7 candidate must repeat the required suite. Native Windows and
## Prior 5.2.7 exact-tag native-gate evidence
The immutable `v5.2.7` candidate was not promoted. Exact-tag GitHub Actions run
`33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13
successful jobs, one failed macOS job, and one cancelled Windows job. The macOS
runner filesystem rejected creation of the
raw-C1 filename fixture with `EILSEQ`. The hosted Windows job stalled in `make
check`; a MinGW/Wine reproduction isolated the cause to
`test --password-prompt ... </dev/null` entering `_getch`, and the remaining
native job was cancelled.
The 5.2.8 fixture treats that creation refusal as an explicit `SKIP`; on a
filesystem that accepts the byte, the scanner must still reject the compiled
magic and render the path without emitting the raw C1 byte. No result from the
immutable tag transfers automatically to 5.2.8. The Windows prompt correction
rejects a redirected/non-console standard input before entering `_getch` and
adds a native EOF regression; it also requires fresh exact-candidate evidence.
## 5.2.8 CodeQL High path-race corrections
CodeQL High #5 identified SDK key-copy publication that reopened the output
path and then applied `chmod` to that mutable name. The copy now uses the core
atomic publisher, sets POSIX mode on the open temporary descriptor, checks
read/close/publication failures, and replaces only the destination directory
entry. `sdk-test` covers symlink and hardlink sentinels and expected key modes.
CodeQL High #6 identified the POSIX disk-restore `lstat`-then-`open` sequence.
Restore now opens once with `O_NOFOLLOW` and without truncation, classifies that
descriptor with `fstat`, and retains the same raw-device descriptor through
capacity checks and writes. Regular-file destinations retain the existing
atomic publisher.
CodeQL High #7 identified benchmark cleanup's `lstat`-then-recursive-path
sequence. POSIX cleanup now pins each component with `openat` and removes leaves
with `unlinkat`; Windows pins ancestors/children, opens reparse points without
following them, recurses only into a plain directory held against rename, and
after emptying a directory reopens it relative to the pinned parent, verifies
its volume and file index against the traversal handle, and marks only that
identity-checked handle for deletion. The live-workspace
regression injects a directory symlink and verifies that its external sentinel
survives. These are reviewed fixes and regression coverage,
not independent certification or proof that a 5.2.8 hosted gate passed.
The exact 5.2.8 candidate must repeat the required suite. Native Windows and
macOS gates, hosted GitHub CI and release promotion, authenticated OBS
validation, and resolution of the openSUSE automatic `debugsource` rpmlint
`no-binary` finding remain pending until recorded otherwise.
@ -203,7 +247,7 @@ AES implementation has documented cache-timing risk on hostile shared hardware.
The following entries are retained as release history. Their regression tests
should be rerun, but the historical resolution does not itself constitute a
5.2.7 test result.
5.2.8 test result.
| First corrected | Severity | Finding | Resolution recorded at the time |
|---|---|---|---|
@ -223,6 +267,9 @@ should be rerun, but the historical resolution does not itself constitute a
| 5.2.2 | Medium | A signal during an interactive POSIX password prompt could leave terminal echo/state altered | Restore saved terminal settings on handled interruptions; cover the behavior with a PTY regression |
| 5.2.2 | Test reliability | `tests/regression.sh` used Bash syntax without making the interpreter contract explicit | Execute the suite explicitly with Bash and keep syntax/interpreter checks in release gates |
| 5.2.2 | Documentation/licensing | Current documentation incorrectly denied historical MIT grants visible in published Git history | Added a factual erratum: current source follows current SPDX notices, while earlier grants and immutable tags remain valid and unmodified |
| 5.2.8 | High | CodeQL #5: SDK key copies changed permissions through a re-resolved destination path | Publish through the core atomic output object and apply permissions to its open descriptor; run link-target/mode regressions through `sdk-test` |
| 5.2.8 | High | CodeQL #6: POSIX disk restore classified a pathname before reopening it destructively | Open without truncation or symlink following, classify with `fstat`, and retain the same device descriptor through write |
| 5.2.8 | High | CodeQL #7: benchmark cleanup classified entries before recursively resolving their path | Traverse pinned descriptors/handles, refuse link/reparse traversal, remove entries relative to pinned parents, and verify Windows directory identity before handle deletion |
See `CHANGELOG.md` for the complete per-release history and compatibility notes.
Old tags remain immutable and may contain artifacts or build assumptions removed
@ -244,12 +291,12 @@ include SHA-256 checksums. The gated GUI set adds the architecture-independent
DEB, noarch/source RPM, and source-only portable GUI ZIP. Package gates include
exact payload/dependency and installed off-screen integration checks; the
portable ZIP additionally receives source scans, an exact safe-member allowlist,
and an extracted launcher test. An AppImage is not promoted by the 5.2.7
and an extracted launcher test. An AppImage is not promoted by the 5.2.8
policy; AppDir and Flatpak bundles, GUI platform installers, and bare
Linux/Windows executables are also excluded. Windows ZIP and macOS DMG outputs
remain CLI-only.
No Wine result is retained as release evidence for 5.2.7. Cross-compilation
No Wine result is retained as release evidence for 5.2.8. Cross-compilation
does not establish native-Windows behavior. Extended-length/device namespace
paths, raw UNC output roots, and mapped/network-drive output are unsupported;
the native Windows workflow remains a publication gate for the ZIP containing

81
CHANGELOG.md
View file

@ -1,5 +1,49 @@
# ZUPT Changelog
## [5.2.8] — 2026-08-31 — Path-race hardening and native-fixture correction
Corrective successor to the immutable, unpromoted `v5.2.7` candidate.
Exact-tag GitHub Actions run `33445470664` reached a macOS failure because the
runner filesystem rejected creation of the raw-C1 filename fixture with
`EILSEQ`. The workflow concluded `cancelled` at `2026-08-31T23:11:19Z`, with
13 successful jobs, one failed macOS job, and one cancelled Windows job.
The hosted Windows job stalled in `make check`; a MinGW/Wine reproduction
isolated the cause to `test --password-prompt ... </dev/null` entering
`_getch` despite redirected standard input. The tag and its evidence remain
unchanged.
- Close CodeQL High #5 in SDK key saving by copying into the core atomic
publisher's already-open private object, applying POSIX key permissions with
`fchmod` on that descriptor, checking read/close/publication failures, and
replacing only the requested directory entry. Symlink and hardlink target
sentinels and private/public key modes are covered by the SDK regression.
- Close CodeQL High #6 in POSIX disk restore by opening the target once without
truncation or final-symlink following, classifying that descriptor with
`fstat`, and retaining the same device descriptor through capacity checks and
writes. Regular-file restores continue to use atomic publication.
- Close CodeQL High #7 in benchmark cleanup by resolving POSIX components with
`openat(..., O_NOFOLLOW)`, deleting relative to pinned descriptors with
`unlinkat`, and using pinned, reparse-point-aware handles for Windows
traversal. The regression injects a directory symlink into a live workspace
and verifies that cleanup does not visit its target.
- Treat inability to create the raw-C1 scanner filename as an explicit fixture
skip on filesystems that reject the byte; when creation succeeds, the unsafe
diagnostic-escaping assertions still run unchanged.
- Reject redirected or otherwise non-console Windows password prompts before
entering `_getch`, handle console EOF as an error, and cover the native
redirected-input path so it cannot hang a release gate.
- Run `sdk-test` from both `release-check` and the hosted GCC/Clang Linux job so
the atomic key-save regression cannot silently fall outside release gates.
- Carry the v5.2.7 archive format, cryptography, bundled codec release, and SDK
ABI forward unchanged. These are implementation and test-integration
corrections, not a wire-format or API change.
- Realign current code, package, workflow, artifact, and documentation
references to 5.2.8. AUR/Homebrew SHA-256 and Guix content pins remain
pending until the final reproducible archive is generated.
- Require fresh exact-`v5.2.8` source, checksum, hosted CI, native-platform,
package, OBS, and promotion evidence. This entry does not claim those gates
passed, and no v5.2.7 result transfers automatically.
## [5.2.7] — 2026-08-31 — Native test-harness portability corrections
Corrective successor to the immutable, unpromoted `v5.2.6` candidate. Exact-tag
@ -2433,7 +2477,7 @@ bump and packaging-syntax test expansion; archive format unchanged.
### `.github/workflows/ci.yml` — 8-job CI matrix
Replaces the prior 4-job CI with a comprehensive matrix that mirrors
the project's local-verification protocol from `PROMPT.md §6`:
the project's historical local-verification protocol:
| Job | What it does |
|---|---|
@ -3156,7 +3200,7 @@ size to run. It needs to be a sprint-protocol step, not a one-off.
### What changed
**`PROMPT.md` — Prompt v2.**
**Historical sprint instructions — version 2.**
- **NEW §3.5: The exhaustive byte-sweep mandate.** Every
format-touching change runs the full byte sweep before claiming
@ -3176,7 +3220,7 @@ size to run. It needs to be a sprint-protocol step, not a one-off.
with the regression-test names that catch each one. The table is
the canonical "things that have shipped and must never recur"
reference; keeping it current is part of every sprint.
- **Footer stamp**: Prompt v2, 2026-05-20.
- **Footer stamp**: historical instruction revision 2, 2026-05-20.
**`Makefile`.** The help-target banner version is now derived
from `include/zupt.h` via a `grep | awk` substitution:
@ -3187,7 +3231,7 @@ help:
include/zupt.h | awk -F'"' '{print $$2}') build targets:"
```
This closes a recurring bug noted in `PROMPT.md §6 step 9` —
This closes a recurring bug noted in the historical sprint checklist —
prior sprints (2.3.0, 2.3.1) left the banner stale even after the
sprint protocol said to bump it. Making it auto-derived removes
the drift opportunity entirely.
@ -3218,7 +3262,6 @@ the drift opportunity entirely.
### Files touched
```
PROMPT.md (§3.5 NEW, §6 step renumber, §10 kickoff, §11 rows, v2 stamp)
Makefile (help banner auto-derives version from header)
include/zupt.h (version 2.3.1 → 2.4.0)
CHANGELOG.md (this entry)
@ -3402,7 +3445,7 @@ the footer.
- **Encrypted modes**: AIT = `HMAC-SHA256(mac_key, hdr[0..63] || footer[0..23])`
- **Plaintext modes**: AIT = `XXH64(...)` in the first 8 bytes, zeros in
the rest. Best-effort (`OPAQUE`-class per PROMPT.md §5).
the rest. Best-effort (`OPAQUE` structural-integrity class).
The MAC input deliberately excludes `footer[24..31]` = `"ZEND" || u32 version`.
Both are structurally validated by the read path (`locate_footer_v15`
@ -3592,7 +3635,7 @@ so flipping it (e.g. from `0x02 INDEX` to `0x03 ENC_HEADER`) did
not cause auth failure; the downstream parser was tolerant.
Severity: low. Fix at `src/zupt_format.c` adds the structural
check immediately after `read_block`. This makes the byte
`OPAQUE`-class per PROMPT.md §5 (tamper detected by parser, not by
`OPAQUE` structural-integrity class (tamper detected by parser, not by
MAC).
**F-02b — RECLASSIFIED.** The 2.2.4 hypothesis that the archive
@ -3629,7 +3672,7 @@ other v2.3.0 changes than as a standalone patch.
### Verification
- `make` — clean on plain GCC and Clang.
- `make` with strict GCC flags (full set from PROMPT.md §6) — clean.
- `make` with the historical strict GCC warning set — clean.
- `make` with strict Clang flags — clean.
- `make test` — **61/61 passing**.
- `make test-vectors` — **14/14 passing**.
@ -3665,8 +3708,8 @@ SECURITY.md (integrity statement reaffirmed)
Patch release. No format changes, no feature changes, no on-disk
compatibility impact. Five findings closed against the v2.2.3 baseline
under the methodology in the new top-level `PROMPT.md` (continuous
improvement prompt) and tracked in `docs/FINDINGS-2.x.md` (durable
under the methodology in the then-current audit instructions and tracked in
`docs/FINDINGS-2.x.md` (durable
numbered ledger that survives between work sessions).
### Findings closed
@ -3738,9 +3781,9 @@ preserved.
### New process artefacts
- **`PROMPT.md`** — top-level "god-tier" continuous-improvement prompt.
Designed to be pasted verbatim into a fresh chat alongside the latest
source tarball. Encodes the methodology that produced this release:
- **Historical continuous-improvement instructions** — removed from the
current source tree after their durable material was consolidated into the
audit and security documents. They encoded the methodology that produced this release:
three-line workflow (survey → fix-with-test → ship), explicit
authentication-coverage invariant (every archive byte covered by
per-block HMAC OR a separate index MAC OR a footer MAC — no third
@ -3788,7 +3831,7 @@ preserved.
### Files touched
```
PROMPT.md (new, top-level)
[historical sprint-instruction file] (removed from the current tree)
docs/FINDINGS-2.x.md (new)
tests/test_audit_flake.sh (new)
src/zupt_main.c (F-01)
@ -3900,20 +3943,20 @@ Two `make test` runs back-to-back, both clean. Cumulative test count:
### Documentation cleanup
Four design/audit-prompt documents that were sprint-internal scratch
Four design/audit-instruction documents that were sprint-internal scratch
have been removed from the source tree (consolidated into the
remaining permanent docs):
| Removed | Where the content lives now |
|---|---|
| `AUDIT_PROMPT.md` | superseded by `FORMAL_AUDIT_PROMPT.md` |
| Two historical audit-instruction files | consolidated into the permanent audit and security documents |
| `ROOT_CAUSE_ANALYSIS.md` | reproducible-bug postmortems are now per-release entries in `CHANGELOG.md` |
| `COMPAT.md` | the table moved into `README.md` § "Architecture & platform support" |
| `DONATIONS.md` | one-liner moved into `README.md` § "Supporting Zupt" |
Surviving canonical docs: `README.md`, `CHANGELOG.md` (this file),
`SECURITY.md`, `INSTALL.md`, `LICENSE`, `THIRD-PARTY-NOTICES.md`,
`AUDIT.md`, `FORMAL_AUDIT_PROMPT.md`, `ROADMAP.md`.
`AUDIT.md` and the then-current roadmap.
## [2.2.2-final2] — 2026-05-01 — CLI help, man pages, deb copyright
@ -4091,7 +4134,7 @@ the github-old → github-new migration sprint) deleted as obsolete.
## [2.2.2] god-tier audit — bug #16 (block-swap attack) fix
Independent formal cryptographic audit (per FORMAL_AUDIT_PROMPT.md two-pass
Independent formal cryptographic audit (using the then-current two-pass
methodology) discovered a critical authenticated-encryption flaw in the
shipped 2.2.2 binary. Investigation, root-cause, fix, regression test, and
final verification documented below.
@ -4290,7 +4333,7 @@ Compile-tested with `-Wpedantic` under GCC. Win32 code paths verified via
- `AUDIT.md`: 2026-04-27 formal audit entry with cumulative test table
- `README.md`: Security section bumped with audit confirmation
- `doc/zupt.1`: SECURITY section mentions path-traversal protection
- `FORMAL_AUDIT_PROMPT.md`: methodology document at repo root for future audits
- the then-current formal-audit methodology document
## [2.2.2] — 2026-04-27

55
DISTRIBUTION.md
View file

@ -1,4 +1,4 @@
# Distributing ZUPT 5.2.7
# Distributing ZUPT 5.2.8
This document describes the packaging material maintained in the ZUPT
source repository. A recipe in `packaging/` is not evidence that a package has
@ -14,8 +14,8 @@ https://github.com/cristiancmoises/zupt
GitHub is the canonical source and release host. Packaging must never fetch
`zupt-web` or substitute an asset from another project.
The `v5.2.2`, `v5.2.3`, `v5.2.4`, `v5.2.5`, and `v5.2.6` tags are immutable
non-promoted candidates.
The `v5.2.2`, `v5.2.3`, `v5.2.4`, `v5.2.5`, `v5.2.6`, and `v5.2.7` tags are
immutable non-promoted candidates.
The v5.2.3 source-policy test assumed LF for a Windows `.bat` file that Git
correctly checks out as CRLF. Exact-tag GitHub Actions run `33431386002` then
recorded 12 successful v5.2.4 jobs, one openSUSE service-harness failure caused
@ -27,11 +27,16 @@ Actions run `33434986357` completed 13 jobs successfully but failed the native
Windows and macOS jobs. Its v5.2.6 corrections reached exact-tag run
`33442264243`, where 13 jobs succeeded but macOS arm64 failed on unused x86
SHA-NI test-helper declarations under `-Werror`, and Windows aborted during safe
UTF-8 fixture argv transcoding. Corrective packages and release assets must use
`v5.2.7`; never move or overwrite an earlier tag or checksum, and never
transfer prior evidence automatically.
This corrective version changes release/test integration only; the product,
archive format, cryptography, codec, and SDK ABI remain unchanged.
UTF-8 fixture argv transcoding. Version 5.2.7 corrected those failures, but
exact-tag run `33445470664` ended with 13 successful jobs, a macOS raw-C1
fixture failure with `EILSEQ`, and a cancelled Windows job after the hosted job
stalled in `make check`; a MinGW/Wine reproduction isolated a non-console
password-prompt hang in `_getch`.
Corrective packages and release assets must use `v5.2.8`; never move or
overwrite an earlier tag or checksum, and never transfer prior evidence
automatically. Version 5.2.8 corrects those native test boundaries, hardens
three path-race boundaries, and adds the SDK regression to release/hosted Linux
gates. The archive format, cryptography, codec, and SDK ABI remain unchanged.
## Source-only boundary
@ -61,7 +66,7 @@ Audit the current tree or a generated archive with:
```sh
scripts/check-source-only.sh
scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
scripts/check-source-only.sh --archive /path/to/zupt-5.2.8.tar.gz
```
The scanner reports paths, not file contents, and exits nonzero on a violation.
@ -75,8 +80,8 @@ the commit omits Git's commit-ID PAX header:
```sh
SOURCE_DATE_EPOCH="$(git show -s --format=%ct HEAD)" \
make DIST_TARBALL=/tmp/zupt-5.2.7.tar.gz dist
sha256sum /tmp/zupt-5.2.7.tar.gz
make DIST_TARBALL=/tmp/zupt-5.2.8.tar.gz dist
sha256sum /tmp/zupt-5.2.8.tar.gz
```
With identical committed input and `SOURCE_DATE_EPOCH`, repeated exports must
@ -122,12 +127,12 @@ private-library RPATH.
| openSUSE / OBS | `packaging/opensuse/` | source and binary RPM through OBS |
| Debian / Ubuntu | `packaging/debian/`, `packaging/build-deb.sh` | Debian metadata and binary DEB after the target gate |
| RPM release artifact | `packaging/opensuse/zupt.spec`, `packaging/build-rpm.sh` | source and binary RPM after the target gate |
| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.7_all.deb` after payload/dependency and installed integration gates |
| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.7-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.7-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.7-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.8_all.deb` after payload/dependency and installed integration gates |
| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.8-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.8-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.8-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
| Fedora / RPM-based systems | `packaging/rpm/zupt.spec` | downstream RPM starting point |
| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.7 AppImage is promoted |
| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.8 AppImage is promoted |
| Windows | `.github/workflows/cross-platform.yml` | native ZIP (executable plus notices) after the required native gate |
| macOS | `packaging/build-dmg.sh` | native-architecture DMG after the native gate |
| Arch Linux | `packaging/aur/PKGBUILD` | AUR package recipe |
@ -203,17 +208,17 @@ expectations, then test the installed launcher off-screen against the matching
### Portable and native release artifacts
The Linux x86_64 gate packages the tested `zupt` executable as
`zupt-5.2.7-linux-x86_64.tar.xz` beside README, changelog, security guidance,
`zupt-5.2.8-linux-x86_64.tar.xz` beside README, changelog, security guidance,
and every applicable public license and notice. Its dynamic-library allowlist,
archive member allowlist, and extracted CLI functional suite must pass.
The `zupt-gui-5.2.7-portable.zip` artifact is source-only: it contains the GUI
The `zupt-gui-5.2.8-portable.zip` artifact is source-only: it contains the GUI
Python source, shell/macOS/Windows launchers, icons, provenance, changelog, and
licenses, but no Python, Qt, CLI, or compiled runtime. The gate scans both the
assembled and extracted trees, verifies an exact safe member allowlist, and
runs the extracted launcher off-screen against the tested CLI.
AppImage creation is deliberately offline and is not a 5.2.7 release gate.
AppImage creation is deliberately offline and is not a 5.2.8 release gate.
Supply a locally verified `appimagetool`, type-2 runtime, and the complete
license/source-relink compliance notice for those exact runtime bytes; the
helper never downloads any input:
@ -229,7 +234,7 @@ APPIMAGE_RUNTIME_COMPLIANCE_FILE=/verified/path/runtime-compliance.txt \
The runtime inspected while preparing 5.2.2 omitted a linked component from
its notice and did not provide the complete LGPL source/relink handoff required
by this release policy. No AppImage produced by this helper is promoted by the
upstream 5.2.7 workflow. AppDir and Flatpak bundles and GUI platform installers
upstream 5.2.8 workflow. AppDir and Flatpak bundles and GUI platform installers
are also excluded. Bare Linux and Windows executables are not promoted; their
CLI programs appear only inside notice-bearing archives. The Windows ZIP and
macOS DMG remain CLI-only.
@ -244,8 +249,8 @@ DIST_DIR="$release_dir" RUN_CHECKS=1 packaging/build-dmg.sh
The Windows ZIP (including its executable and notices) must be built and tested
by the Windows job in `.github/workflows/cross-platform.yml`; it is not a
cross-compiled release claim from a Linux build. No Wine result is retained as
5.2.7 release evidence. Extended-length/device namespace paths, raw UNC output
roots, and mapped/network-drive output are not supported in 5.2.7. Publish the
5.2.8 release evidence. Extended-length/device namespace paths, raw UNC output
roots, and mapped/network-drive output are not supported in 5.2.8. Publish the
exact architecture recorded by the native job.
These helpers create binary distribution artifacts for the release page, not
content to be committed to Git or included in the source archive.
@ -253,7 +258,7 @@ content to be committed to Git or included in the source archive.
### AUR, Homebrew, Guix, and Nix
After calculating the final reproducible source archive, but before creating or
publishing the immutable tag, update each recipe to version 5.2.7 and to the
publishing the immutable tag, update each recipe to version 5.2.8 and to the
exact digest or content hash expected by its package manager. These recipe
directories are excluded from the source archive, so this does not create a
checksum cycle. Commit the pinned recipes in the tagged tree, then build and
@ -272,7 +277,7 @@ build.
For every published artifact:
1. start from the immutable `v5.2.7` tag;
1. start from the immutable `v5.2.8` tag;
2. keep `WITH_SDK=0 WITH_PQBOX=0` unless system dependencies are declared;
3. record the exact OS, distribution release, architecture, and toolchain;
4. run format validation plus installed `--version`, `--help`, and archive
@ -290,7 +295,7 @@ than redirecting consumers to an unverified file.
## Downstream checklist
- [ ] The source URL resolves to the immutable `v5.2.7` tag.
- [ ] The source URL resolves to the immutable `v5.2.8` tag.
- [ ] The source archive passes `scripts/check-source-only.sh --archive`.
- [ ] The recipe checksum matches the downloaded source exactly.
- [ ] `WITH_SDK=0 WITH_PQBOX=0` is explicit, or system dependencies are complete.

29
INSTALL.md
View file

@ -1,4 +1,4 @@
# Installing ZUPT 5.2.7
# Installing ZUPT 5.2.8
This guide covers the ZUPT command-line program and the optional Python GUI.
The canonical source repository is
@ -30,16 +30,25 @@ archive format, cryptography, codec, and SDK ABI are unchanged. The immutable
The immutable `v5.2.6` candidate was not promoted after run `33442264243`
recorded 13 successful jobs and two native failures: unused x86 SHA-NI helper
declarations on macOS arm64 under `-Werror`, and early Windows abortion while
argv-transcoding a safe UTF-8 fixture. Version 5.2.7 corrects those test-harness
boundaries, but still requires fresh gates. Do not treat any prior candidate's
artifacts or evidence as 5.2.7 packages or validation.
argv-transcoding a safe UTF-8 fixture. Version 5.2.7 corrected those boundaries
but was not promoted after exact-tag run `33445470664`: 13 jobs succeeded,
macOS failed because its filesystem rejected the raw-C1 filename fixture with
`EILSEQ`, and Windows was cancelled after the hosted job stalled in `make
check`; a MinGW/Wine reproduction isolated the cause to the non-console
password-prompt test entering `_getch`. Version 5.2.8 makes both
fixtures portable, hardens the three CodeQL High path-race boundaries described
in the security documents, and adds `sdk-test` to release and hosted Linux
gates. It still requires fresh exact-version validation. Do not treat any prior
candidate's artifacts or evidence as 5.2.8 packages or validation.
The 5.2.7 package set eligible for promotion after each target gate succeeds is:
The 5.2.8 package set eligible for promotion after each target gate succeeds is
exactly these 13 assets:
| Component | Gated artifacts |
|---|---|
| CLI | `zupt-5.2.7.tar.gz`, `zupt_5.2.7_amd64.deb`, openSUSE x86_64 binary/source RPMs, `zupt-5.2.7-linux-x86_64.tar.xz`, `zupt-5.2.7-windows-x86_64.zip`, and `ZUPT-5.2.7-macOS-*.dmg` |
| GUI | `zupt-gui_5.2.7_all.deb`, `zupt-gui-5.2.7-1.noarch.rpm`, `zupt-gui-5.2.7-1.src.rpm`, and `zupt-gui-5.2.7-portable.zip` |
| Source and checksums | `zupt-5.2.8.tar.gz`, `zupt-5.2.8.tar.gz.sha256`, and `SHA256SUMS` |
| CLI | `zupt_5.2.8_amd64.deb`, `zupt-5.2.8-0.x86_64.rpm`, `zupt-5.2.8-0.src.rpm`, `zupt-5.2.8-linux-x86_64.tar.xz`, `zupt-5.2.8-windows-x86_64.zip`, and exactly one `ZUPT-5.2.8-macOS-{x86_64\|arm64}.dmg` |
| GUI | `zupt-gui_5.2.8_all.deb`, `zupt-gui-5.2.8-1.noarch.rpm`, `zupt-gui-5.2.8-1.src.rpm`, and `zupt-gui-5.2.8-portable.zip` |
The GUI packages require the matching `zupt` CLI package and must pass exact
payload/dependency checks plus an installed off-screen GUI/CLI integration
@ -47,7 +56,7 @@ test. The source-only portable GUI ZIP bundles launchers, notices, and GUI
source, but not Python, Qt, or the CLI. The Linux tar.xz carries the tested CLI
beside the complete public license/notice payload. AppImage, AppDir, Flatpak
bundles, GUI platform installers, and bare Linux/Windows executables are not
promoted for 5.2.7. The Windows ZIP and macOS DMG contain the CLI only. Exact
promoted for 5.2.8. The Windows ZIP and macOS DMG contain the CLI only. Exact
target boundaries are listed in `README.md`.
The release's `SHA256SUMS` and validation notes, not the mere presence of a
download link, identify an artifact that completed its gate.
@ -84,7 +93,7 @@ sudo pacman -S base-devel gzip
```
Package names can differ by distribution release. These commands are examples,
not a statement that 5.2.7 has been accepted into each distribution repository.
not a statement that 5.2.8 has been accepted into each distribution repository.
## Build and test from source
@ -104,7 +113,7 @@ From a release archive, run the scanner as follows before extraction or from a
trusted checkout after download:
```sh
scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
scripts/check-source-only.sh --archive /path/to/zupt-5.2.8.tar.gz
```
The default build provides the native password, ML-KEM-768 + X25519 hybrid

118
README.md
View file

@ -1,32 +1,56 @@
# ZUPT 5.2.7
# ZUPT 5.2.8
ZUPT is a command-line backup archiver written in C11. It combines the
bundled VaptVupt compression codec with authenticated AES-256-CTR +
HMAC-SHA256 encryption, native ML-KEM-768/X25519 hybrid encryption, archive
integrity checks, multithreaded operation, and a Python/Qt graphical frontend.
Version 5.2.7 corrects two test-harness portability defects exposed after the
immutable `v5.2.6` tag. Exact-tag GitHub Actions run `33442264243` completed 13
jobs successfully, but the native macOS job failed because x86 SHA-NI test
helper declarations were unused on arm64 under `-Werror`, and the native
Windows job aborted while argv transcoding a safe UTF-8 fixture before its
intended assertions. No 5.2.6 assets were promoted. These are release/test
integration corrections; they do not change the archive format, cryptography,
bundled codec, or SDK ABI. No v5.2.6 evidence transfers automatically to
v5.2.7.
Version 5.2.8 closes three CodeQL High path-race findings: SDK key copies now
publish atomically through an already-open private object, POSIX disk restore
classifies and retains the descriptor it actually opened, and benchmark cleanup
traverses only pinned descriptors or handles without following links or Windows
reparse points. It also makes the raw-C1 scanner fixture explicitly skip a
filesystem that rejects creation with `EILSEQ`, and brings `sdk-test` into the
release and hosted Linux gates. Windows password prompts now reject redirected
input before entering `_getch` and treat console EOF as an error. These
corrections do not change archive format v1.6, cryptography, the bundled codec
release, or the SDK ABI.
The predecessor `v5.2.7` tag is immutable and was not promoted. Exact-tag run
`33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13
successful jobs, a macOS raw-C1/EILSEQ fixture failure, and a cancelled Windows
job. The hosted Windows job stalled in `make check`; a MinGW/Wine reproduction
attributed the stall to a non-console password prompt entering `_getch`. No
v5.2.7 evidence transfers automatically to v5.2.8.
Version 5.2.2 restored the original ZUPT product name and the `zupt` command.
The `.zupt` archive extension, format v1.6, magic bytes, codec identifiers, and
SDK ABI remain unchanged. An optional `vaptvupt` command alias may be provided
for scripts written against versions 3.0.0 through 5.2.1.
## Corrective changes in 5.2.7
## Corrective changes in 5.2.8
The SHA-NI regression now keeps x86-only helper declarations out of unsupported
SDK key saves use atomic descriptor/handle-backed publication and preserve the
requested private/public modes without reopening the destination. Disk restore
opens a POSIX target once before its type, identity, and device-capacity
decisions, and benchmark cleanup is descriptor-relative on POSIX and
handle/reparse-point aware on Windows. The live-workspace symlink regression,
SDK link-target/mode regression, static path-race guards, portable raw-C1
fixture, native redirected-prompt regression, and `sdk-test` CI step cover
these boundaries. All current release paths move to 5.2.8 and require fresh
exact-tag hosted CI, package,
native-platform, source-only, checksum, OBS, and promotion evidence.
## Corrective changes introduced in 5.2.7
The SHA-NI regression keeps x86-only helper declarations out of unsupported
arm64 builds, and the safe UTF-8 Windows fixture crosses the argv boundary in a
byte-stable representation. All current release paths move to 5.2.7 and require
fresh exact-tag hosted CI, package, native-platform, source-only, checksum, OBS,
and promotion evidence. The `v5.2.6` tag remains immutable and unpromoted.
byte-stable representation. Those test-harness changes did not alter the
archive format, cryptography, codec, or SDK ABI. Exact-tag run `33445470664`
subsequently exposed the separate macOS raw-C1/EILSEQ fixture failure; Windows
was cancelled after the hosted job stalled in `make check`; MinGW/Wine then
isolated the stall to a non-console password prompt entering `_getch`. The run recorded 13 successful jobs, one
failure, and one cancellation; v5.2.7 remained unpromoted.
## Corrective changes introduced in 5.2.6
@ -151,9 +175,9 @@ users. Those assets must be built from the tagged source, tested on their target
environment, and kept outside Git and the source archive. A format that was not
built and tested is not presented as supported.
## 5.2.7 release artifacts
## 5.2.8 release artifacts
The 5.2.7 release workflow is defined to produce the following files only after
The 5.2.8 release workflow is defined to produce exactly the following 13 files only after
the corresponding target gate succeeds. `SHA256SUMS` records the exact promoted
filenames and digests. The release notes identify the tested commit and the
manually dispatched CI run; that run's job definitions and logs are the runtime
@ -162,23 +186,26 @@ skips. This table is not a substitute for that evidence.
| Format | Intended target and validation boundary |
| --- | --- |
| `zupt-5.2.7.tar.gz` | Reproducible, source-only archive; scanned twice-built input plus SHA-256. |
| `zupt_5.2.7_amd64.deb` | Ubuntu 24.04 amd64 package; install, functional round trip, and uninstall gate. |
| `zupt-5.2.7-*.x86_64.rpm` and `.src.rpm` | openSUSE Tumbleweed x86_64 source/binary RPM gate; package inspection, install, round trip, and uninstall. |
| `zupt-5.2.7-linux-x86_64.tar.xz` | Linux x86_64 CLI plus the complete public license/notice payload; dependency allowlist and extracted-package functional gate. |
| `zupt-gui_5.2.7_all.deb` | Architecture-independent Python/Qt GUI package; exact dependency/payload checks plus installed off-screen GUI/CLI integration gate. |
| `zupt-gui-5.2.7-1.noarch.rpm` | Architecture-independent Python/Qt GUI RPM; package inspection plus installed off-screen GUI/CLI integration gate. |
| `zupt-gui-5.2.7-1.src.rpm` | Source RPM corresponding exactly to the gated noarch GUI RPM. |
| `zupt-gui-5.2.7-portable.zip` | Source-only GUI and launchers with licenses/provenance; source scan, exact member allowlist, and extracted off-screen GUI/CLI gate. |
| `zupt-5.2.7-windows-x86_64.zip` | Native Windows x86_64 executable with notices; extracted-ZIP round-trip gate. |
| `ZUPT-5.2.7-macOS-*.dmg` | Native macOS image; mounted packaged executable round-trip gate, with the actual architecture in the filename. |
| `zupt-5.2.8.tar.gz` | Reproducible, source-only archive; scanned twice-built input plus SHA-256. |
| `zupt-5.2.8.tar.gz.sha256` | SHA-256 sidecar for the reproducible source archive. |
| `zupt_5.2.8_amd64.deb` | Ubuntu 24.04 amd64 package; install, functional round trip, and uninstall gate. |
| `zupt-5.2.8-0.x86_64.rpm` | openSUSE Tumbleweed x86_64 binary RPM; package inspection, install, round trip, and uninstall gate. |
| `zupt-5.2.8-0.src.rpm` | Source RPM corresponding exactly to the gated openSUSE binary RPM. |
| `zupt-5.2.8-linux-x86_64.tar.xz` | Linux x86_64 CLI plus the complete public license/notice payload; dependency allowlist and extracted-package functional gate. |
| `zupt-gui_5.2.8_all.deb` | Architecture-independent Python/Qt GUI package; exact dependency/payload checks plus installed off-screen GUI/CLI integration gate. |
| `zupt-gui-5.2.8-1.noarch.rpm` | Architecture-independent Python/Qt GUI RPM; package inspection plus installed off-screen GUI/CLI integration gate. |
| `zupt-gui-5.2.8-1.src.rpm` | Source RPM corresponding exactly to the gated noarch GUI RPM. |
| `zupt-gui-5.2.8-portable.zip` | Source-only GUI and launchers with licenses/provenance; source scan, exact member allowlist, and extracted off-screen GUI/CLI gate. |
| `zupt-5.2.8-windows-x86_64.zip` | Native Windows x86_64 executable with notices; extracted-ZIP round-trip gate. |
| Exactly one `ZUPT-5.2.8-macOS-{x86_64\|arm64}.dmg` | Native macOS image; mounted packaged executable round-trip gate, with the actual runner architecture in the filename. |
| `SHA256SUMS` | Deterministic manifest covering the other 12 promoted files. |
An asset absent from the release was not promoted through its mandatory gate.
Do not infer support for another distribution release, OS version, CPU
architecture, raw UNC/SMB destination, or package manager from a similarly
named file. Binary assets are release outputs, never source-build inputs.
No AppImage is promised for 5.2.7. The inspected upstream type-2 runtime lacked
No AppImage is promised for 5.2.8. The inspected upstream type-2 runtime lacked
a complete notice/source-relink handoff for every statically linked component,
so redistributing it would not meet this release's provenance gate. AppDir and
Flatpak bundles and GUI platform installers are likewise outside the promoted
@ -208,8 +235,8 @@ bash tests/test_source_only.sh
For a tag or an existing source archive:
~~~sh
bash scripts/check-source-only.sh --tag v5.2.7
bash scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
bash scripts/check-source-only.sh --tag v5.2.8
bash scripts/check-source-only.sh --archive /path/to/zupt-5.2.8.tar.gz
~~~
Unknown `.bin` files fail the scan. A necessary binary data fixture may be
@ -313,6 +340,7 @@ The principal source-only gates are:
~~~sh
make WITH_SDK=0 WITH_PQBOX=0 check
make WITH_SDK=0 WITH_PQBOX=0 test-all
make sdk-test
make test-asan
make test-asan-run
make audit-licenses
@ -345,7 +373,7 @@ sanitizer-detected crash. An earlier off-screen GUI smoke run remains supporting
evidence rather than an exact-candidate package result.
Those results are historical upstream self-audit evidence, not independent
certification and not 5.2.7 results. Post-tag CI integration failures prevented
certification and not 5.2.8 results. Post-tag CI integration failures prevented
5.2.2 promotion. The immutable 5.2.3 candidate was also not promoted because its
source-policy test assumed LF for a `.bat` checkout that correctly used CRLF.
The immutable v5.2.4 candidate then recorded 12 successful jobs in exact-tag CI
@ -353,20 +381,25 @@ run `33431386002`; the sole openSUSE service-harness job failed because the
standalone executor did not enter its service directory, so dependent Windows
and macOS jobs were skipped. A local Tumbleweed reproduction proved the explicit
tag ref and corrected working-directory contract, but neither that reproduction
nor the successful v5.2.4 jobs are v5.2.7 evidence. The immutable v5.2.5
nor the successful v5.2.4 jobs are v5.2.8 evidence. The immutable v5.2.5
candidate was not promoted after exact-tag GitHub Actions run `33434986357`:
13 jobs succeeded, but the native Windows hostile-path fixture and macOS
build/check gate failed. Their 5.2.6 corrections were followed by exact-tag run
`33442264243`, which also completed 13 jobs successfully but failed native
macOS on arm64-unused SHA-NI helper declarations under `-Werror` and native
Windows during safe UTF-8 fixture argv transcoding. The immutable v5.2.6 tag was
not promoted. The exact 5.2.7 candidate must repeat all required gates. Native Windows and macOS,
not promoted. The immutable v5.2.7 tag was also not promoted: exact-tag run
`33445470664` reached the macOS raw-C1 filename-creation failure with `EILSEQ`,
recorded 13 successful jobs, and cancelled Windows after the hosted job stalled
in `make check`; a MinGW/Wine reproduction isolated the stall to
`test --password-prompt ... </dev/null` entering `_getch`. The
exact 5.2.8 candidate must repeat all required gates. Native Windows and macOS,
hosted GitHub CI/release promotion, authenticated OBS, and resolution of the
openSUSE automatic `debugsource` rpmlint `no-binary`
finding remain pending until recorded otherwise. Unexecuted gates are `SKIP`,
never `PASS`.
On Windows, 5.2.7 scopes output handling to normal local Win32 paths. A MinGW
On Windows, 5.2.8 scopes output handling to normal local Win32 paths. A MinGW
cross-build or Wine run is not native-Windows evidence; the `windows-latest`
package job, including its Unicode round trip, remains a mandatory publication
gate. Win32 extended-length and device-namespace paths, raw UNC output roots
@ -388,7 +421,7 @@ downgrading authentication of header and footer metadata.
`disk restore`, and exists only to recover a known, trusted archive created
before AIT was introduced. Do not use that override for an archive from
untrusted or attacker-writable storage; verify and migrate the recovered data to
a newly created 5.2.7 archive. Compression and disk backup never create a
a newly created 5.2.8 archive. Compression and disk backup never create a
no-AIT archive.
`info` is deliberately different: it reports unauthenticated framing metadata,
@ -406,7 +439,7 @@ lists, tests, extracts, and restores it byte-exact. The full local Linux gate
passed on commit `ff99770`. This is not a claim that a 5.2.1 reader understands every new
flag-gated 5.2.2 encoding or that every historical combination was tested.
The candidate commands and outcome fields for 5.2.7 are maintained in the
The candidate commands and outcome fields for 5.2.8 are maintained in the
release handoff and
[packaging/opensuse/README.md](packaging/opensuse/README.md). They must be
updated from the final release candidate before tagging. No architecture or
@ -418,9 +451,9 @@ Generate the reproducible source archive outside the repository:
~~~sh
make dist
sha256sum /tmp/zupt-5.2.7.tar.gz
sha256sum /tmp/zupt-5.2.8.tar.gz
bash scripts/check-source-only.sh \
--archive /tmp/zupt-5.2.7.tar.gz
--archive /tmp/zupt-5.2.8.tar.gz
~~~
Archive ordering, ownership and timestamps are normalized. The default epoch is
@ -436,7 +469,7 @@ final digest before the tag is published.
## openSUSE and OBS
The maintained upstream recipe is in packaging/opensuse. It is prepared for an
immutable v5.2.7 tag, disables submodules and Git LFS, builds with
immutable v5.2.8 tag, disables submodules and Git LFS, builds with
WITH_SDK=0 WITH_PQBOX=0, runs real checks, and installs without the renamed-era
`vaptvupt` alias.
@ -479,7 +512,7 @@ The optional GUI is under `gui/`. It invokes the `zupt` CLI and needs Python 3
plus PySide6 or PyQt6. GUI image assets are data files whose purpose,
provenance and license are recorded in [gui/assets/README.md](gui/assets/README.md).
The integrated source and lightweight consistency checks do not constitute a
target-native audit of every historical GUI format. The 5.2.7 artifact promise
target-native audit of every historical GUI format. The 5.2.8 artifact promise
is limited to the gated GUI DEB, noarch/source RPM, and source-only portable ZIP
listed above; AppImage, AppDir, Flatpak bundles, and platform GUI installers
remain excluded.
@ -489,13 +522,14 @@ remain excluded.
Cristian Cezar Moisés is the creator and current upstream maintainer of ZUPT and
the author of the current upstream source, build, test, documentation, and
packaging changes, including the 5.2.2 baseline and corrective
5.2.3/5.2.4/5.2.5/5.2.6/5.2.7 work.
5.2.3/5.2.4/5.2.5/5.2.6/5.2.7/5.2.8 work.
Alessandro de Oliveira Faria (Cabelo) is credited as the openSUSE collaborator
and downstream package maintainer. He reviews the handoff, commits it in the
OBS project he maintains, and may make the additional openSUSE-side adjustments
he considers necessary. That downstream role is not attribution of ZUPT source
authorship or of the upstream 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, or 5.2.7 changes.
authorship or of the upstream 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, or
5.2.8 changes.
## License

70
SECURITY.md
View file

@ -1,4 +1,4 @@
# Security Policy — ZUPT 5.2.7
# Security Policy — ZUPT 5.2.8
## Reporting vulnerabilities
@ -49,6 +49,9 @@ On POSIX terminals, the explicit prompt saves terminal state and installs
signal-aware cleanup so a handled interruption restores echo and other changed
settings before termination. This behavior is covered by a PTY regression and
passed in the full local Linux gate for commit `ff99770`.
On Windows, the prompt requires a real console input handle before entering
`_getch`; redirected input and console EOF fail instead of blocking a native
release gate.
## Native key files
@ -66,7 +69,7 @@ partially accepted.
### Optional integrations
The 5.2.7 default is `WITH_SDK=0 WITH_PQBOX=0`:
The 5.2.8 default is `WITH_SDK=0 WITH_PQBOX=0`:
- `WITH_SDK=1` enables libvuptsdk-backed features, including the SDK PQ mode
and Argon2id support, using a separately installed system development package.
@ -78,6 +81,13 @@ downloads it. A missing requested dependency is a build error. Security
properties of these optional libraries are outside the source-only CLI audit
unless their exact source package and version are reviewed separately.
The in-repository SDK adapter saves copied keys through the core atomic output
publisher. POSIX permissions are applied to its already-open temporary
descriptor, and publication replaces only the requested directory entry after
copy/close checks succeed. `make sdk-test` exercises private/public modes and
preservation of pre-existing symlink and hardlink targets. This covers the
adapter boundary; it does not certify the separately installed SDK library.
## Cryptographic construction
Encrypted blocks use a fresh 128-bit nonce, AES-256-CTR, and HMAC-SHA256. The
@ -133,7 +143,7 @@ can compromise archives encrypted to it.
## Constant-time and side-channel scope
Portable C is the 5.2.7 default. Sensitive comparisons and selections use
Portable C is the 5.2.8 default. Sensitive comparisons and selections use
branchless helpers, but generated machine-code behavior remains dependent on
the compiler and platform. This is not a formal whole-program constant-time
claim. The C AES implementation uses table lookups and is unsuitable for a
@ -190,21 +200,37 @@ appropriate. Extract untrusted archives as a dedicated unprivileged user into
a new empty directory, inspect the result before moving it, and apply OS
sandboxing where available.
Benchmark workspaces are random private directories. POSIX cleanup opens each
directory component without following links and removes entries relative to
pinned descriptors. Windows retains no-delete-sharing handles for the resolved
ancestors and refuses reparse-point recursion. After emptying a directory, it
reopens that entry relative to the pinned parent, verifies the volume and file
index against the traversal handle, and marks only the identity-checked handle
for deletion. An injected link is removed as a link rather than traversed to
its target.
Disk restore has a separate destructive-device boundary. It measures and
copies the compacted archive to an exclusively created, auto-deleted private
scratch file before opening the target, then performs both validation and
restoration from that same snapshot. `ZUPT_TMPDIR` is an explicit existing
scratch-directory override; an invalid override fails without fallback. Raw
block devices are opened only after their capacity has been determined and
shown sufficient on supported Linux, macOS, or FreeBSD interfaces. Unknown
device capacity, an undersized device, a source/destination identity match, or
a snapshot failure stops before the first target write. These checks do not
scratch file, then performs validation and restoration from that same snapshot.
`ZUPT_TMPDIR` is an explicit existing scratch-directory override; an invalid
override fails without fallback. On POSIX, the target is opened once without
truncation or final-symlink following, classified with `fstat`, and—when it is
a supported Linux, macOS, or FreeBSD raw block device—the same descriptor is
retained through capacity checks and writes. Regular files continue through
atomic publication. Unknown device capacity, an undersized device, a
source/destination identity match, or a snapshot failure stops before the
first target write. These checks do not
make raw-device restore non-destructive: verify both operands and keep recovery
media before proceeding.
These changes address the three 5.2.8 CodeQL High reports: #5 at SDK key
publication, #6 at POSIX disk-target classification/use, and #7 at benchmark
workspace cleanup. The regressions and source review are project evidence, not
an independent certification or a claim that exact-v5.2.8 CI has passed.
The Windows handle-relative implementation is scoped to normal local Win32
paths. Win32 extended-length and device-namespace paths, raw UNC output roots,
and mapped/network-drive output are not supported in 5.2.7. Cross-build and
and mapped/network-drive output are not supported in 5.2.8. Cross-build and
Wine results are not native-Windows evidence; the `windows-latest` package gate
must pass its Unicode round trip before Windows assets are published. Restore
to a normal local directory first and move verified output to network storage
@ -247,7 +273,7 @@ shared/static library, or distribution package. Audit them with:
```sh
scripts/check-source-only.sh
scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
scripts/check-source-only.sh --archive /path/to/zupt-5.2.8.tar.gz
```
Nested archive inspection is required to enforce bounded recursion, member
@ -257,13 +283,13 @@ limit violations. On commit `ff99770`, the source-only scanner suite passed
DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI
ZIP, Windows ZIP, and macOS DMG release assets are separate outputs. An
AppImage is not promoted for 5.2.7. A bare Linux or Windows executable is also
AppImage is not promoted for 5.2.8. A bare Linux or Windows executable is also
excluded; executables are distributed only inside their notice-bearing
archives. Trust an artifact only when its exact format has a recorded build,
content/metadata inspection, extracted or installed smoke test, and applicable
archive round trip. Never treat an unexecuted platform as passing.
The gated 5.2.7 set is the CLI package/archive set plus the exact GUI DEB,
The gated 5.2.8 set is the CLI package/archive set plus the exact GUI DEB,
noarch/source RPM, and source-only portable ZIP documented in the README. The
portable GUI ZIP contains no compiled runtime and is scanned as source before
and after extraction. Other GUI packages, AppImage, AppDir and Flatpak bundles,
@ -280,6 +306,7 @@ make -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || printf 1)" \
WITH_SDK=0 WITH_PQBOX=0 V=1
make WITH_SDK=0 WITH_PQBOX=0 check
make WITH_SDK=0 WITH_PQBOX=0 test-all
make sdk-test
```
Where the compiler supports them, run the sanitizer target separately:
@ -303,7 +330,7 @@ result.
Post-tag CI integration failures prevented 5.2.2 promotion. Those upstream
self-audit results are not independent certification and do not transfer to
5.2.7. The immutable 5.2.3 candidate was not promoted because its source-policy
5.2.8. The immutable 5.2.3 candidate was not promoted because its source-policy
test assumed LF for a Windows `.bat` file checked out as CRLF. The immutable
v5.2.4 candidate was not promoted after exact-tag GitHub Actions run
`33431386002`: 12 jobs succeeded, the sole openSUSE job failed in its
@ -313,7 +340,7 @@ Tumbleweed reproduction confirmed that `refs/tags/v5.2.4` is valid and that
`os.chdir(service_dir)` lets `obs_scm`, `tar`, and `recompress` complete with a
source-scanned archive. This was a release/test integration defect, not a
product, archive, cryptographic, codec, or SDK ABI change, and its evidence does
not transfer automatically to 5.2.7. The immutable v5.2.5 candidate was also
not transfer automatically to 5.2.8. The immutable v5.2.5 candidate was also
not promoted: exact-tag GitHub Actions run `33434986357` recorded 13 successful
jobs and failed native Windows/macOS jobs. Its Windows fixture-byte and macOS
secure-wipe/Bash 3.2 defects were corrected for 5.2.6. A targeted clean-clone
@ -324,8 +351,15 @@ then completed 13 jobs successfully but failed native macOS because x86 SHA-NI
test helpers were unused on arm64 under `-Werror`, and failed native Windows
when argv transcoding aborted the safe UTF-8 fixture. Those are test-harness
integration defects, not product, archive, cryptographic, codec, or SDK ABI
changes; v5.2.6 remained unpromoted. The exact 5.2.7 candidate must
repeat the required suite. Native Windows and macOS, hosted GitHub CI/release
changes; v5.2.6 remained unpromoted. The exact 5.2.8 candidate must
repeat the required suite. The immutable v5.2.7 candidate was likewise not
promoted: exact-tag run `33445470664` concluded `cancelled` at
`2026-08-31T23:11:19Z`, with 13 successful jobs, one failed macOS job after
raw-C1 fixture creation returned `EILSEQ`, and one cancelled Windows job after
the hosted job stalled in `make check`; a MinGW/Wine reproduction isolated the
cause to a redirected password prompt entering `_getch`. Version 5.2.8 makes both test boundaries fail
or skip without hanging, but this is not exact-candidate evidence. Native
Windows and macOS, hosted GitHub CI/release
promotion, authenticated OBS, and the openSUSE automatic `debugsource` rpmlint
`no-binary` finding remain pending until recorded otherwise. An unavailable or
unexecuted environment remains `SKIP`, never `PASS`.

4
THIRD-PARTY-NOTICES.md
View file

@ -159,7 +159,7 @@ grant attached to their unchanged Git blobs, are recorded in
## AppImage type-2 runtime
No AppImage is a promised or promoted 5.2.7 release asset. The upstream
No AppImage is a promised or promoted 5.2.8 release asset. The upstream
type-2 runtime inspected during the 5.2.2 review statically linked musl, libfuse,
squashfuse, zstd, zlib, and mimalloc, but its own license notice did not list
mimalloc and the available release inputs did not provide a complete
@ -171,7 +171,7 @@ no network input and requires the operator to supply both a locally verified
runtime and `APPIMAGE_RUNTIME_COMPLIANCE_FILE`, containing the license notices,
source correspondence or offer, and relink information applicable to those
exact runtime bytes. An artifact produced independently with that helper is
not covered by the 5.2.7 upstream release gates.
not covered by the 5.2.8 upstream release gates.
## Reporting attribution issues

73
THREAT_MODEL.md
View file

@ -1,4 +1,4 @@
# ZUPT 5.2.7 threat model
# ZUPT 5.2.8 threat model
This document defines the security boundary of the ZUPT archive tool. It is
not a certification, a guarantee against every hostile input, or a substitute
@ -17,7 +17,7 @@ plausibly deniable.
## Baseline considered here
The upstream baseline is built from the 5.2.7 source with:
The upstream baseline is built from the 5.2.8 source with:
```sh
make WITH_SDK=0 WITH_PQBOX=0
@ -88,6 +88,8 @@ duplicates but shares the underlying stream/offset and may buffer beyond the
line, so callers should provide a descriptor dedicated to that password read.
On POSIX, handled prompt interruptions restore the saved terminal state before
termination; an exact-candidate PTY regression is required before release.
On Windows, a prompt is entered only for a real console input handle;
redirected input and console EOF fail instead of blocking in `_getch`.
Native private-key generation uses no-replace creation with POSIX mode `0600`
or a Windows current-user-only DACL. A failed write, flush/fsync, or close leaves
@ -99,6 +101,13 @@ and public/private role validation. This prevents role confusion and
partial/trailing-key acceptance; it does not protect a key after endpoint or
account compromise.
When the optional system SDK is enabled, the in-repository adapter copies a key
through the core atomic publisher, applies POSIX mode through the already-open
temporary descriptor, and publishes only after copy/close checks succeed. Its
`sdk-test` regression preserves existing symlink/hardlink targets and verifies
private/public modes. This narrows the adapter boundary; it does not extend the
baseline assessment to the external SDK implementation.
### Encrypted archive integrity
Current encrypted archives authenticate ciphertext, canonical block metadata,
@ -175,22 +184,37 @@ temporary through its descriptor or handle. These controls reduce traversal,
link, race, and partial-output risks, but do not establish that no parser or
filesystem bug can exist.
The Windows handle-relative boundary in 5.2.7 covers normal local Win32 paths.
Benchmark scratch data lives in a random private directory. Cleanup resolves
POSIX components without following links and deletes relative to pinned
descriptors. On Windows it retains no-delete-sharing ancestor handles, refuses
reparse-point recursion, then reopens each emptied directory relative to its
pinned parent and verifies its filesystem identity before handle-based
deletion. An attacker who inserts a link can cause cleanup failure, but the
cleanup must not traverse to the link target.
The Windows handle-relative boundary in 5.2.8 covers normal local Win32 paths.
Win32 extended-length and device-namespace paths, raw UNC output roots, and
mapped/network-drive output are not supported. Cross-build and Wine results are
not a substitute for the required native `windows-latest` Unicode package
gate. Restore locally before moving verified output to network storage.
Disk restore copies the measured compacted archive into one exclusively
created, auto-deleted scratch file before it opens a destructive destination.
Preflight and restoration consume that same open snapshot. An explicit
`ZUPT_TMPDIR` selects an existing scratch directory; failure there does not
fall back to consuming the mutable source pathname. On supported Linux, macOS,
and FreeBSD interfaces, a raw block-device target is rejected before writing if
its capacity is unknown or smaller than the image. These controls reduce source
exchange and immediate overrun risk but do not protect against a compromised
kernel/device, a wrongly selected sufficiently large device, power loss, or
hardware failure.
created, auto-deleted scratch file. Preflight and restoration consume that same
open snapshot. An explicit `ZUPT_TMPDIR` selects an existing scratch directory;
failure there does not fall back to consuming the mutable source pathname. On
POSIX, the destination is opened once without truncation or final-symlink
following, classified with `fstat`, and the same raw-device descriptor is
retained for supported Linux, macOS, and FreeBSD capacity checks and writes.
Regular-file output retains atomic publication. A raw target is rejected before
writing if its capacity is unknown or smaller than the image. These controls
reduce source exchange, target exchange, and immediate overrun risk but do not
protect against a compromised kernel/device, a wrongly selected sufficiently
large device, power loss, or hardware failure.
The SDK publication, POSIX disk-target, and benchmark-cleanup changes address
CodeQL High #5, #6, and #7 respectively. Their source review and regressions
are project evidence, not independent certification or proof that the exact
5.2.8 hosted/native gates passed.
For an untrusted archive:
@ -250,9 +274,9 @@ tagged source. Each artifact extends the trust boundary to its builder,
toolchain, runner image, and packaging scripts. Treat it as validated only when
the exact target has a recorded build, content/package inspection, extracted or
installed smoke test, and applicable archive round trip. An AppImage is not
promoted for 5.2.7; bare Linux and Windows executables are also excluded.
promoted for 5.2.8; bare Linux and Windows executables are also excluded.
For 5.2.7, that gated artifact scope covers the CLI files plus the exact GUI
For 5.2.8, that gated artifact scope covers the CLI files plus the exact GUI
DEB, noarch/source RPM, and source-only portable ZIP named in the README. The
portable ZIP contains no compiled runtime and crosses the release boundary only
after source scans and an exact safe-member check. AppDir and Flatpak bundles
@ -265,7 +289,7 @@ strict Clang, GCC `-fanalyzer`, the 9/9 tool-enabled static-analysis run,
ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations passed. Earlier off-screen
GUI smoke evidence is retained separately. Post-tag CI integration failures
prevented 5.2.2 promotion. This upstream self-review is not an independent
certification and is not 5.2.7 evidence. The immutable 5.2.3 candidate was not
certification and is not 5.2.8 evidence. The immutable 5.2.3 candidate was not
promoted because its source-policy test assumed LF for a Windows `.bat` checkout
that correctly used CRLF. The immutable v5.2.4 candidate was not promoted after
exact-tag GitHub Actions run `33431386002`: 12 jobs succeeded, the sole openSUSE
@ -275,17 +299,24 @@ Tumbleweed reproduction established that the explicit `refs/tags/v5.2.4`
revision works and that `os.chdir(service_dir)` completes the source-service
chain. This narrows the failure to release/test integration; it changes no
product, archive, cryptographic, codec, or SDK ABI boundary and supplies no
automatic 5.2.7 evidence. The immutable v5.2.5 candidate was not promoted after
automatic 5.2.8 evidence. The immutable v5.2.5 candidate was not promoted after
exact-tag GitHub Actions run `33434986357`: 13 jobs succeeded, but native
Windows and macOS failed on fixture-byte preservation and Darwin/Bash 3.2
portability respectively. The corresponding 5.2.6 corrections were followed by
exact-tag run `33442264243`: 13 jobs succeeded, while native macOS failed on
x86-only SHA-NI helper declarations unused on arm64 under `-Werror`, and native
Windows aborted during safe UTF-8 fixture argv transcoding. The v5.2.6 tag was
not promoted. The corresponding 5.2.7 test-harness corrections do not establish
their own test result. Hosted GitHub CI and release promotion, native
not promoted. Version 5.2.7 corrected those two boundaries, but its exact-tag
run `33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13
successful jobs, one failed macOS job after raw-C1 filename creation returned
`EILSEQ`, and one cancelled Windows job after the hosted job stalled in `make
check`; a MinGW/Wine reproduction isolated the cause to a redirected password
prompt entering `_getch`.
The corresponding 5.2.8 fixture and prompt corrections do not establish their
own test result. CI now exercises `sdk-test`, but its inclusion is not a pass.
Hosted GitHub CI and release promotion, native
Windows/macOS, authenticated OBS, and the openSUSE automatic `debugsource`
rpmlint `no-binary` finding remain pending until an exact 5.2.7 candidate
rpmlint `no-binary` finding remain pending until an exact 5.2.8 candidate
records them.
## Historical compatibility notes
@ -313,7 +344,7 @@ These are historical facts about earlier releases, retained to support recovery:
combinations remain unclaimed.
Historical test counts in the changelog describe those releases. They do not
automatically become 5.2.7 results; current outcomes belong in the release
automatically become 5.2.8 results; current outcomes belong in the release
validation record, with unavailable environments marked `SKIP`. In particular,
runs made before the final positional-AAD and mandatory-AIT changes are not
final release gates for the resulting candidate.
@ -324,4 +355,4 @@ Email **zupt@riseup.net** with `[security]` in the subject. Include the version,
platform, impact, and a minimal non-sensitive reproducer. Do not disclose the
issue publicly until a coordinated timeline has been agreed.
Document version: 5.2.7, 2026-08-31.
Document version: 5.2.8, 2026-08-31.

4
doc/zupt-gui.1
View file

@ -1,6 +1,6 @@
.\" SPDX-License-Identifier: AGPL-3.0-or-later
.\" Copyright (c) 2025-2026 Cristian Cezar Moisés
.TH ZUPT-GUI 1 "2026-08-31" "ZUPT 5.2.7" "User Commands"
.TH ZUPT-GUI 1 "2026-08-31" "ZUPT 5.2.8" "User Commands"
.SH NAME
zupt-gui \- Qt interface for the ZUPT backup utility
.SH SYNOPSIS
@ -47,7 +47,7 @@ or
only when libvuptsdk or libpqvaptvupt is independently reported enabled.
These two optional integrations are detected separately.
.PP
The gated 5.2.7 GUI release set is limited to the architecture-independent DEB,
The gated 5.2.8 GUI release set is limited to the architecture-independent DEB,
noarch/source RPM, and source-only portable ZIP named in the project README.
Package gates require exact checks and installed off-screen GUI/CLI integration.
The portable ZIP receives source scans, an exact safe-member allowlist, and an

8
doc/zupt.1
View file

@ -1,6 +1,6 @@
.\" SPDX-License-Identifier: AGPL-3.0-or-later
.\" Copyright (c) 2025-2026 Cristian Cezar Moisés
.TH ZUPT 1 "2026-08-31" "ZUPT 5.2.7" "User Commands"
.TH ZUPT 1 "2026-08-31" "ZUPT 5.2.8" "User Commands"
.
.SH NAME
zupt \- source-built backup compression and authenticated-encryption utility
@ -89,7 +89,7 @@ Git and the upstream source tarball are source-only. Separately built CLI DEB,
binary RPM, SRPM, notice-bearing Linux tar.xz, Windows ZIP, and macOS DMG assets
may be published from the immutable tag only after their target-specific gates
pass; they never enter Git or the source tarball. An AppImage is not promoted
for 5.2.7; neither are AppDir/Flatpak bundles, GUI platform installers, or bare
for 5.2.8; neither are AppDir/Flatpak bundles, GUI platform installers, or bare
Linux/Windows executables. The Python/Qt frontend remains available as source;
its gated architecture-independent DEB, noarch/source RPM, and source-only
portable ZIP are included in the release claim. The portable ZIP contains no
@ -477,7 +477,7 @@ then traverse below a pinned directory descriptor with no-follow operations.
Windows builds use handle-relative traversal and
no-replace publication for normal local Win32 destinations. Extended-length and
device-namespace paths, raw UNC output roots, and mapped/network-drive output
are not supported in 5.2.7. Cross-compilation and Wine results are not native
are not supported in 5.2.8. Cross-compilation and Wine results are not native
Windows evidence; the native Windows package gate, including its Unicode round
trip, is separate and mandatory before publication.
.
@ -577,7 +577,7 @@ and the encrypted-dedup linear AAD sequence published through 5.2.1. The narrow
compatibility fixture is an actual v5.2.1 password-encrypted
DATA/DATA/REF/DATA disk archive stored as hexadecimal text with source and hash
provenance. The candidate lists, tests, extracts, and restores that fixture
byte-exact. The exact 5.2.7 candidate must repeat the gate. It does not imply
byte-exact. The exact 5.2.8 candidate must repeat the gate. It does not imply
that a 5.2.1 reader
accepts every new 5.2.2 archive or that every historical encrypted mode was
retested.

14
gui/README.md
View file

@ -1,6 +1,6 @@
# ZUPT GUI
The ZUPT GUI is a Python/Qt front end for the ZUPT 5.2.7 command-line
The ZUPT GUI is a Python/Qt front end for the ZUPT 5.2.8 command-line
program. It starts the CLI as a subprocess; compression, archive parsing, and
cryptography remain in the C program.
@ -83,10 +83,10 @@ operating systems and must be tested on the target system.
Release pages provide only these GUI artifacts after their separate package and
installed off-screen GUI/CLI integration gates pass:
- `zupt-gui_5.2.7_all.deb`;
- `zupt-gui-5.2.7-1.noarch.rpm`;
- `zupt-gui-5.2.7-1.src.rpm`;
- `zupt-gui-5.2.7-portable.zip`.
- `zupt-gui_5.2.8_all.deb`;
- `zupt-gui-5.2.8-1.noarch.rpm`;
- `zupt-gui-5.2.8-1.src.rpm`;
- `zupt-gui-5.2.8-portable.zip`.
The DEB/RPM packages install the Python/Qt source and depend on the matching
`zupt` CLI package. The portable ZIP contains source, launchers, icons, licenses,
@ -97,7 +97,7 @@ An absent artifact did not pass its gate and must not be inferred from another
format's result.
GUI AppImage, AppDir and Flatpak bundles, and Windows/macOS GUI installers are
not promoted by the upstream 5.2.7 release gates.
not promoted by the upstream 5.2.8 release gates.
`packaging/build-gui-appimage.sh` is a downstream-only helper and fails unless
its operator supplies the exact verified runtime plus a complete
license/source-relink notice through `APPIMAGE_RUNTIME_COMPLIANCE_FILE`; that
@ -110,7 +110,7 @@ notices. It fails unless the directory also has non-empty
`PYTHON-NOTICE.txt`, `PYINSTALLER-NOTICE.txt`, `QT-NOTICE.txt`, and either
`PYSIDE6-NOTICE.txt` or `PYQT6-NOTICE.txt`. The installer includes that
directory together with every ZUPT license and notice. This requirement does
not make the untested GUI installer a 5.2.7 release asset. The promoted Windows
not make the untested GUI installer a 5.2.8 release asset. The promoted Windows
ZIP and macOS DMG are CLI-only.
Packaging recipes and scripts under `gui/packaging/` and `packaging/` are build

4
gui/packaging/deb/control
View file

@ -1,9 +1,9 @@
Package: zupt-gui
Version: 5.2.7
Version: 5.2.8
Section: utils
Priority: optional
Architecture: all
Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= 5.2.7)
Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= 5.2.8)
Maintainer: Cristian Cezar Moisés <sac@securityops.co>
Homepage: https://github.com/cristiancmoises/zupt
Description: Qt graphical interface for the ZUPT backup utility

2
gui/packaging/windows/build-windows.bat
View file

@ -13,7 +13,7 @@ rem runtime files embedded by this local build.
setlocal EnableExtensions
for %%I in ("%~dp0\..\..\..") do set "REPO_ROOT=%%~fI"
set "VERSION=%~1"
if not defined VERSION set "VERSION=5.2.7"
if not defined VERSION set "VERSION=5.2.8"
if not defined ZUPT_DIST_DIR set "ZUPT_DIST_DIR=%TEMP%\zupt-release"
if not defined ZUPT_CLI_EXE set "ZUPT_CLI_EXE=%REPO_ROOT%\zupt.exe"
set "WORK=%TEMP%\zupt-gui-build-%RANDOM%-%RANDOM%"

3
include/zupt.h
View file

@ -122,7 +122,8 @@ static inline int zupt_win_mkdir_utf8(const char *path) {
/* v5.2.5 corrects the OBS service harness cwd; format remains v1.6. */
/* v5.2.6 corrects native release-gate portability; format remains v1.6. */
/* v5.2.7 corrects native test-harness portability; format remains v1.6. */
#define ZUPT_VERSION_STRING "5.2.7"
/* v5.2.8 hardens three path-race boundaries; format remains v1.6. */
#define ZUPT_VERSION_STRING "5.2.8"
/* Vendored codec release (upstream tag) — single source for display strings.
* The codec's own VV_VERSION_* is its internal API version, not the release. */
#define ZUPT_CODEC_RELEASE "2.65.3"

2
install.sh
View file

@ -6,7 +6,7 @@
set -Eeuo pipefail
umask 077
VERSION=${VERSION:-5.2.7}
VERSION=${VERSION:-5.2.8}
PREFIX=${PREFIX:-/usr/local}
echo "🔧 Installing ZUPT..."

4
packaging/aur/PKGBUILD
View file

@ -11,7 +11,7 @@
# Test locally with `makepkg -s` after the release archive is published.
pkgname=zupt
pkgver=5.2.7
pkgver=5.2.8
pkgrel=1
pkgdesc='Pure-C11 post-quantum backup compression utility (AES-256-CTR + HMAC-SHA256 + ML-KEM-768 + X25519)'
arch=('x86_64')
@ -22,7 +22,7 @@ makedepends=('gcc' 'git' 'make')
checkdepends=('python')
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/cristiancmoises/zupt/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
# Byte-reproducible upstream v5.2.7 source archive.
# Byte-reproducible upstream v5.2.8 source archive.
sha256sums=('4db1badbb9a62676176829326b6fd4bab5fe67be6631a7f6d341bdc6c7265c04')
build() {

14
packaging/debian/changelog
View file

@ -1,3 +1,17 @@
zupt (5.2.8-1) UNRELEASED; urgency=medium
* Close CodeQL High path-race findings in SDK key publication, disk-restore
target handling, and benchmark workspace cleanup.
* Treat a filesystem refusal to create the macOS raw-C1 scanner fixture as
an explicit skip; reject redirected Windows prompts before _getch; and run
sdk-test in the release and hosted Linux gates.
* Preserve immutable, unpromoted v5.2.7 run 33445470664: 13 jobs succeeded,
macOS failed the raw-C1 fixture, and Windows was cancelled after the hosted
job stalled; a MinGW/Wine reproduction isolated redirected _getch entry.
Require fresh 5.2.8 evidence.
-- Cristian Cezar Moisés <sac@securityops.co> Mon, 31 Aug 2026 23:30:00 +0000
zupt (5.2.7-1) UNRELEASED; urgency=medium
* Scope SHA-NI test helpers to supported x86 builds so macOS arm64 strict

2
packaging/guix/zupt.scm
View file

@ -62,7 +62,7 @@
xcb-util-renderutil xcb-util-wm xcb-util-cursor
libinput-minimal mtdev libevdev eudev))
(define %zupt-version "5.2.7")
(define %zupt-version "5.2.8")
(define %zupt-source
(origin

4
packaging/homebrew/zupt.rb
View file

@ -22,8 +22,8 @@
class Zupt < Formula
desc "Post-quantum backup compression utility (ML-KEM-768 + AES-256-CTR + HMAC-SHA256)"
homepage "https://github.com/cristiancmoises/zupt"
url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.7/zupt-5.2.7.tar.gz"
version "5.2.7"
url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.8/zupt-5.2.8.tar.gz"
version "5.2.8"
sha256 "4db1badbb9a62676176829326b6fd4bab5fe67be6631a7f6d341bdc6c7265c04"
license all_of: ["AGPL-3.0-or-later", "GPL-3.0-or-later", "BSD-2-Clause", "BSD-3-Clause", "CC0-1.0"]

4
packaging/nix/flake.nix
View file

@ -9,7 +9,7 @@
# nix flake check # lint the flake
#
# To consume from another flake:
# inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.7";
# inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.8";
# ...packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt;
#
# `make dist` has its own reproducibility gate. This development flake has no
@ -30,7 +30,7 @@
zupt = pkgs.stdenv.mkDerivation {
pname = "zupt";
version = "5.2.7";
version = "5.2.8";
# When publishing, replace this with `fetchurl` against the
# release tarball. For local development the flake assumes it

40
packaging/opensuse/README.md
View file

@ -1,4 +1,4 @@
# ZUPT 5.2.7 for openSUSE Build Service
# ZUPT 5.2.8 for openSUSE Build Service
This directory is the upstream, source-only OBS recipe for ZUPT. It is a
handoff for the downstream maintainer; its presence does not mean that the
@ -10,14 +10,14 @@ changes in this handoff. Alessandro de Oliveira Faria (Cabelo) is credited only
as the openSUSE collaborator and downstream OBS package maintainer: he reviews
the handoff, commits it through the portal/project he maintains, and may make
the openSUSE-side adjustments he considers necessary. This role does not
attribute upstream code or the 5.2.2/5.2.3/5.2.4/5.2.5/5.2.6/5.2.7 upstream changes to
Cabelo.
attribute upstream code or the
5.2.2/5.2.3/5.2.4/5.2.5/5.2.6/5.2.7/5.2.8 upstream changes to Cabelo.
## Files and source policy
| File | Purpose |
|---|---|
| `_service` | Fetch the immutable `v5.2.7` tag and create `Source0` at build time. |
| `_service` | Fetch the immutable `v5.2.8` tag and create `Source0` at build time. |
| `zupt.spec` | Build and test the CLI with optional external system integrations disabled. |
| `zupt.changes` | openSUSE-format package history. |
| `source-audit.sh` | Handoff wrapper for the repository scanner; run it from the complete handoff tree. |
@ -30,11 +30,11 @@ https://github.com/cristiancmoises/zupt.git
```
`obs_scm` stores an `.obscpio` plus `.obsinfo`. The `tar` and `recompress`
services reconstruct `zupt-5.2.7.tar.gz` inside the build environment, which
services reconstruct `zupt-5.2.8.tar.gz` inside the build environment, which
matches `Source0` in the spec.
This source policy does not prohibit separately built release-page packages.
The upstream 5.2.7 gates may publish the CLI source tarball, DEB, binary RPM,
The upstream 5.2.8 gates may publish the CLI source tarball, DEB, binary RPM,
SRPM, notice-bearing Linux tar.xz, Windows ZIP, and macOS DMG, together with a
GUI DEB, noarch RPM, GUI SRPM, and source-only portable GUI ZIP after each
format-specific test succeeds. None of those files is an OBS `Source0` input
@ -139,7 +139,7 @@ reconstructed by the build-time services. Neither `%build` nor `%check` may
access the network.
For a source RPM check outside OBS, place the service-produced
`zupt-5.2.7.tar.gz` next to the spec and use a disposable RPM build tree:
`zupt-5.2.8.tar.gz` next to the spec and use a disposable RPM build tree:
```sh
rpm_top=$(mktemp -d)
@ -167,7 +167,7 @@ unavailable rather than passing it. Earlier off-screen GUI smoke evidence is
supporting evidence, not an exact-commit package result.
Post-tag CI integration failures prevented 5.2.2 promotion. These historical
local results do not establish 5.2.7, native Windows or macOS success, hosted
local results do not establish 5.2.8, native Windows or macOS success, hosted
GitHub CI/release promotion, authenticated OBS acceptance, or resolution of the
automatic openSUSE `debugsource` rpmlint `no-binary` finding. The immutable
5.2.3 candidate was not promoted because its source-policy test assumed LF for
@ -194,7 +194,7 @@ This result establishes that the explicit tag revision works and isolates a
release/test harness defect. It does not change the product, archive format,
cryptography, codec, or SDK ABI; it does not make skipped native jobs pass or
establish authenticated OBS/Factory acceptance. No v5.2.4 evidence transfers
automatically to v5.2.7. The exact v5.2.7 candidate must repeat every applicable
automatically to v5.2.8. The exact v5.2.8 candidate must repeat every applicable
gate, and the automatic openSUSE `debugsource` rpmlint `no-binary` finding
remains unresolved and unsuppressed.
@ -216,9 +216,23 @@ macOS arm64 SHA-NI test build treated unused x86-only helper declarations as
errors under `-Werror`; Windows argv transcoding aborted the safe printable
UTF-8 fixture before its intended path assertions. The 5.2.7 changes correct
those test-harness boundaries without an archive-format, cryptographic, codec,
or SDK ABI change. They do not establish 5.2.7 hosted, native, OBS, or promotion
or SDK ABI change. They do not establish 5.2.8 hosted, native, OBS, or promotion
evidence.
## Prior 5.2.7 exact-tag native-gate evidence
The immutable v5.2.7 candidate was not promoted. Exact-tag GitHub Actions run
`33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13
successful jobs, one failed macOS job, and one cancelled Windows job. macOS
rejected creation of the raw-C1 scanner fixture
with `EILSEQ`; the hosted Windows job stalled in `make check`, and a MinGW/Wine
reproduction isolated the cause to a redirected password prompt entering
`_getch`. Version 5.2.8 makes those test
boundaries fail or skip without hanging, addresses CodeQL High #5/#6/#7 in SDK
key publication, disk restore, and benchmark cleanup, and adds `sdk-test` to
release and hosted Linux gates. None of those changes establishes an exact
5.2.8 OBS, native, hosted-CI, or promotion result.
## Prior openSUSE packaging validation
The local results below were produced on 2026-08-24 from the 5.2.2 candidate
@ -256,11 +270,11 @@ gate.
## Handoff procedure for Alessandro/Cabelo
1. Upstream completes every applicable pre-tag source and local audit gate,
then creates and verifies the annotated `v5.2.7` tag. Exact-tag hosted,
then creates and verifies the annotated `v5.2.8` tag. Exact-tag hosted,
native-platform, package, and promotion gates must pass before release or
downstream handoff; the tag itself is never moved to repair a failure.
2. With Git, `file`, bsdtar, tar, zip, unzip and SHA-256 tools installed, run
`scripts/export-opensuse-package.sh v5.2.7`. Verify the reported ZIP and
`scripts/export-opensuse-package.sh v5.2.8`. Verify the reported ZIP and
SHA-256 outside the Git index. The handoff includes both
`packaging/opensuse/source-audit.sh` and its required
`scripts/check-source-only.sh`; keep that relative layout while auditing.
@ -272,7 +286,7 @@ gate.
```
4. From the extracted handoff root, run
`packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.7.tar.gz`.
`packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.8.tar.gz`.
Then copy `_service`, `zupt.spec`, `zupt.changes` and `README.md`
into the flat OBS package checkout. The audit wrapper is not an OBS build
source and must not be copied without its companion `scripts/` directory.

2
packaging/opensuse/_service
View file

@ -4,7 +4,7 @@
<service name="obs_scm" mode="manual">
<param name="url">https://github.com/cristiancmoises/zupt.git</param>
<param name="scm">git</param>
<param name="revision">refs/tags/v5.2.7</param>
<param name="revision">refs/tags/v5.2.8</param>
<param name="versionformat">@PARENT_TAG@</param>
<param name="versionrewrite-pattern">^v(.*)$</param>
<param name="versionrewrite-replacement">\1</param>

15
packaging/opensuse/zupt.changes
View file

@ -1,3 +1,18 @@
-------------------------------------------------------------------
Mon Aug 31 23:30:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>
- Update to 5.2.8:
* Close CodeQL High path-race findings in SDK key publication,
descriptor-first disk restore, and benchmark workspace cleanup.
* Make the raw-C1 scanner fixture explicitly skip filesystems that reject
the byte with EILSEQ, reject redirected Windows prompts before _getch, and
add sdk-test to release/hosted Linux gates.
* Preserve immutable, unpromoted v5.2.7 run 33445470664: 13 jobs succeeded,
macOS failed the raw-C1 fixture, and Windows was cancelled after the hosted
job stalled; a MinGW/Wine reproduction isolated redirected _getch entry.
* Pin the OBS source service to the immutable v5.2.8 tag and require fresh
exact-candidate evidence before promotion.
-------------------------------------------------------------------
Mon Aug 31 23:00:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>

2
packaging/opensuse/zupt.spec
View file

@ -18,7 +18,7 @@
#
Name: zupt
Version: 5.2.7
Version: 5.2.8
Release: 0
Summary: Backup compression with authenticated and post-quantum encryption
License: AGPL-3.0-or-later AND GPL-3.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0

4
packaging/portable/README.txt
View file

@ -27,7 +27,7 @@ Requirements
------------
1. Python 3.9 or newer.
2. PySide6 6.5 or newer, or a compatible PyQt6 package.
3. ZUPT 5.2.7, installed as `zupt` on PATH or placed beside the launcher
3. ZUPT 5.2.8, installed as `zupt` on PATH or placed beside the launcher
(`zupt.exe` on Windows). A local command must have been built
and tested independently; this bundle never downloads one.
@ -46,7 +46,7 @@ Troubleshooting
---------------
* "requires PySide6 or PyQt6": install one Qt binding through your operating
system package manager or another trusted, preconfigured Python source.
* "zupt not found": install ZUPT 5.2.7 or place its command beside
* "zupt not found": install ZUPT 5.2.8 or place its command beside
the launcher.
* Set ZUPT_DEBUG=1 to print command-discovery diagnostics to stderr.

11
packaging/rpm/zupt.spec
View file

@ -20,7 +20,7 @@
# installed smoke test.
Name: zupt
Version: 5.2.7
Version: 5.2.8
Release: 1%{?dist}
Summary: Backup compression with authenticated and post-quantum encryption
@ -101,6 +101,15 @@ comments. Plain archives use non-cryptographic checksums.
%endif
%changelog
* Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.8-1
- Close CodeQL High path-race findings in SDK key save, disk restore, and
benchmark cleanup; add the SDK gate, portable raw-C1 fixture handling, and
redirected Windows password-prompt rejection.
- Preserve immutable, unpromoted v5.2.7 run 33445470664: 13 jobs succeeded,
macOS failed the raw-C1 fixture, and Windows was cancelled after the hosted
job stalled; a MinGW/Wine reproduction isolated redirected _getch entry.
- Require fresh 5.2.8 gates.
* Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.7-1
- Correct native test integration: scope SHA-NI helpers away from macOS arm64
and preserve safe UTF-8 fixture bytes across the Windows argv boundary.

2
src/zupt_format.c
View file

@ -4221,7 +4221,7 @@ static zupt_error_t open_archive(FILE *f, zupt_options_t *opts,
* parser ignored block_type at this position and decoded whatever it
* found — making the byte truly unauthenticated. Now it is structurally
* validated (rejected at parse time on mismatch), which is the
* OPAQUE-class coverage promised by PROMPT.md §5. */
* OPAQUE-class structural coverage recorded in the audit history. */
if (ib.block_type != ZUPT_BLOCK_INDEX) {
free(ib.payload);
return ZUPT_ERR_CORRUPT;

4
tests/test_audit_flake.sh
View file

@ -2,7 +2,7 @@
# SPDX-License-Identifier: AGPL-3.0-or-later
# Copyright (c) 2025-2026 Cristian Cezar Moisés
#
# Flake-stress harness — §3 of PROMPT.md.
# Repeated-suite flake-stress harness.
#
# Runs every short test suite N times (default 50) and aborts on the
# first non-deterministic outcome. Specifically targeted at the audit
@ -21,7 +21,7 @@ set -u
# F-02's repro needed 50 runs to be statistically convincing (~10%
# baseline flake rate), but at 20 runs we still have ~88% chance of
# catching a 10%-flake — fine for routine CI. For a hardened audit
# pass, invoke with 50 or 100 (see PROMPT.md §3).
# pass, invoke with 50 or 100 for a deeper audit run.
N="${1:-20}"
ZUPT_BIN="${ZUPT_BIN:-./zupt}"