release: prepare ZUPT 5.2.8
This commit is contained in:
Cristian Cezar Moisés
parent
d8668e6d64
commit
7687cfa577
29 changed files with 456 additions and 200 deletions
|
|
@ -11,7 +11,7 @@
|
|||
# Test locally with `makepkg -s` after the release archive is published.
|
||||
|
||||
pkgname=zupt
|
||||
pkgver=5.2.7
|
||||
pkgver=5.2.8
|
||||
pkgrel=1
|
||||
pkgdesc='Pure-C11 post-quantum backup compression utility (AES-256-CTR + HMAC-SHA256 + ML-KEM-768 + X25519)'
|
||||
arch=('x86_64')
|
||||
|
|
@ -22,7 +22,7 @@ makedepends=('gcc' 'git' 'make')
|
|||
checkdepends=('python')
|
||||
|
||||
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/cristiancmoises/zupt/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
|
||||
# Byte-reproducible upstream v5.2.7 source archive.
|
||||
# Byte-reproducible upstream v5.2.8 source archive.
|
||||
sha256sums=('4db1badbb9a62676176829326b6fd4bab5fe67be6631a7f6d341bdc6c7265c04')
|
||||
|
||||
build() {
|
||||
|
|
|
|||
|
|
@ -1,3 +1,17 @@
|
|||
zupt (5.2.8-1) UNRELEASED; urgency=medium
|
||||
|
||||
* Close CodeQL High path-race findings in SDK key publication, disk-restore
|
||||
target handling, and benchmark workspace cleanup.
|
||||
* Treat a filesystem refusal to create the macOS raw-C1 scanner fixture as
|
||||
an explicit skip; reject redirected Windows prompts before _getch; and run
|
||||
sdk-test in the release and hosted Linux gates.
|
||||
* Preserve immutable, unpromoted v5.2.7 run 33445470664: 13 jobs succeeded,
|
||||
macOS failed the raw-C1 fixture, and Windows was cancelled after the hosted
|
||||
job stalled; a MinGW/Wine reproduction isolated redirected _getch entry.
|
||||
Require fresh 5.2.8 evidence.
|
||||
|
||||
-- Cristian Cezar Moisés <sac@securityops.co> Mon, 31 Aug 2026 23:30:00 +0000
|
||||
|
||||
zupt (5.2.7-1) UNRELEASED; urgency=medium
|
||||
|
||||
* Scope SHA-NI test helpers to supported x86 builds so macOS arm64 strict
|
||||
|
|
|
|||
|
|
@ -62,7 +62,7 @@
|
|||
xcb-util-renderutil xcb-util-wm xcb-util-cursor
|
||||
libinput-minimal mtdev libevdev eudev))
|
||||
|
||||
(define %zupt-version "5.2.7")
|
||||
(define %zupt-version "5.2.8")
|
||||
|
||||
(define %zupt-source
|
||||
(origin
|
||||
|
|
|
|||
|
|
@ -22,8 +22,8 @@
|
|||
class Zupt < Formula
|
||||
desc "Post-quantum backup compression utility (ML-KEM-768 + AES-256-CTR + HMAC-SHA256)"
|
||||
homepage "https://github.com/cristiancmoises/zupt"
|
||||
url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.7/zupt-5.2.7.tar.gz"
|
||||
version "5.2.7"
|
||||
url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.8/zupt-5.2.8.tar.gz"
|
||||
version "5.2.8"
|
||||
sha256 "4db1badbb9a62676176829326b6fd4bab5fe67be6631a7f6d341bdc6c7265c04"
|
||||
license all_of: ["AGPL-3.0-or-later", "GPL-3.0-or-later", "BSD-2-Clause", "BSD-3-Clause", "CC0-1.0"]
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
# nix flake check # lint the flake
|
||||
#
|
||||
# To consume from another flake:
|
||||
# inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.7";
|
||||
# inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.8";
|
||||
# ...packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt;
|
||||
#
|
||||
# `make dist` has its own reproducibility gate. This development flake has no
|
||||
|
|
@ -30,7 +30,7 @@
|
|||
|
||||
zupt = pkgs.stdenv.mkDerivation {
|
||||
pname = "zupt";
|
||||
version = "5.2.7";
|
||||
version = "5.2.8";
|
||||
|
||||
# When publishing, replace this with `fetchurl` against the
|
||||
# release tarball. For local development the flake assumes it
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# ZUPT 5.2.7 for openSUSE Build Service
|
||||
# ZUPT 5.2.8 for openSUSE Build Service
|
||||
|
||||
This directory is the upstream, source-only OBS recipe for ZUPT. It is a
|
||||
handoff for the downstream maintainer; its presence does not mean that the
|
||||
|
|
@ -10,14 +10,14 @@ changes in this handoff. Alessandro de Oliveira Faria (Cabelo) is credited only
|
|||
as the openSUSE collaborator and downstream OBS package maintainer: he reviews
|
||||
the handoff, commits it through the portal/project he maintains, and may make
|
||||
the openSUSE-side adjustments he considers necessary. This role does not
|
||||
attribute upstream code or the 5.2.2/5.2.3/5.2.4/5.2.5/5.2.6/5.2.7 upstream changes to
|
||||
Cabelo.
|
||||
attribute upstream code or the
|
||||
5.2.2/5.2.3/5.2.4/5.2.5/5.2.6/5.2.7/5.2.8 upstream changes to Cabelo.
|
||||
|
||||
## Files and source policy
|
||||
|
||||
| File | Purpose |
|
||||
|---|---|
|
||||
| `_service` | Fetch the immutable `v5.2.7` tag and create `Source0` at build time. |
|
||||
| `_service` | Fetch the immutable `v5.2.8` tag and create `Source0` at build time. |
|
||||
| `zupt.spec` | Build and test the CLI with optional external system integrations disabled. |
|
||||
| `zupt.changes` | openSUSE-format package history. |
|
||||
| `source-audit.sh` | Handoff wrapper for the repository scanner; run it from the complete handoff tree. |
|
||||
|
|
@ -30,11 +30,11 @@ https://github.com/cristiancmoises/zupt.git
|
|||
```
|
||||
|
||||
`obs_scm` stores an `.obscpio` plus `.obsinfo`. The `tar` and `recompress`
|
||||
services reconstruct `zupt-5.2.7.tar.gz` inside the build environment, which
|
||||
services reconstruct `zupt-5.2.8.tar.gz` inside the build environment, which
|
||||
matches `Source0` in the spec.
|
||||
|
||||
This source policy does not prohibit separately built release-page packages.
|
||||
The upstream 5.2.7 gates may publish the CLI source tarball, DEB, binary RPM,
|
||||
The upstream 5.2.8 gates may publish the CLI source tarball, DEB, binary RPM,
|
||||
SRPM, notice-bearing Linux tar.xz, Windows ZIP, and macOS DMG, together with a
|
||||
GUI DEB, noarch RPM, GUI SRPM, and source-only portable GUI ZIP after each
|
||||
format-specific test succeeds. None of those files is an OBS `Source0` input
|
||||
|
|
@ -139,7 +139,7 @@ reconstructed by the build-time services. Neither `%build` nor `%check` may
|
|||
access the network.
|
||||
|
||||
For a source RPM check outside OBS, place the service-produced
|
||||
`zupt-5.2.7.tar.gz` next to the spec and use a disposable RPM build tree:
|
||||
`zupt-5.2.8.tar.gz` next to the spec and use a disposable RPM build tree:
|
||||
|
||||
```sh
|
||||
rpm_top=$(mktemp -d)
|
||||
|
|
@ -167,7 +167,7 @@ unavailable rather than passing it. Earlier off-screen GUI smoke evidence is
|
|||
supporting evidence, not an exact-commit package result.
|
||||
|
||||
Post-tag CI integration failures prevented 5.2.2 promotion. These historical
|
||||
local results do not establish 5.2.7, native Windows or macOS success, hosted
|
||||
local results do not establish 5.2.8, native Windows or macOS success, hosted
|
||||
GitHub CI/release promotion, authenticated OBS acceptance, or resolution of the
|
||||
automatic openSUSE `debugsource` rpmlint `no-binary` finding. The immutable
|
||||
5.2.3 candidate was not promoted because its source-policy test assumed LF for
|
||||
|
|
@ -194,7 +194,7 @@ This result establishes that the explicit tag revision works and isolates a
|
|||
release/test harness defect. It does not change the product, archive format,
|
||||
cryptography, codec, or SDK ABI; it does not make skipped native jobs pass or
|
||||
establish authenticated OBS/Factory acceptance. No v5.2.4 evidence transfers
|
||||
automatically to v5.2.7. The exact v5.2.7 candidate must repeat every applicable
|
||||
automatically to v5.2.8. The exact v5.2.8 candidate must repeat every applicable
|
||||
gate, and the automatic openSUSE `debugsource` rpmlint `no-binary` finding
|
||||
remains unresolved and unsuppressed.
|
||||
|
||||
|
|
@ -216,9 +216,23 @@ macOS arm64 SHA-NI test build treated unused x86-only helper declarations as
|
|||
errors under `-Werror`; Windows argv transcoding aborted the safe printable
|
||||
UTF-8 fixture before its intended path assertions. The 5.2.7 changes correct
|
||||
those test-harness boundaries without an archive-format, cryptographic, codec,
|
||||
or SDK ABI change. They do not establish 5.2.7 hosted, native, OBS, or promotion
|
||||
or SDK ABI change. They do not establish 5.2.8 hosted, native, OBS, or promotion
|
||||
evidence.
|
||||
|
||||
## Prior 5.2.7 exact-tag native-gate evidence
|
||||
|
||||
The immutable v5.2.7 candidate was not promoted. Exact-tag GitHub Actions run
|
||||
`33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13
|
||||
successful jobs, one failed macOS job, and one cancelled Windows job. macOS
|
||||
rejected creation of the raw-C1 scanner fixture
|
||||
with `EILSEQ`; the hosted Windows job stalled in `make check`, and a MinGW/Wine
|
||||
reproduction isolated the cause to a redirected password prompt entering
|
||||
`_getch`. Version 5.2.8 makes those test
|
||||
boundaries fail or skip without hanging, addresses CodeQL High #5/#6/#7 in SDK
|
||||
key publication, disk restore, and benchmark cleanup, and adds `sdk-test` to
|
||||
release and hosted Linux gates. None of those changes establishes an exact
|
||||
5.2.8 OBS, native, hosted-CI, or promotion result.
|
||||
|
||||
## Prior openSUSE packaging validation
|
||||
|
||||
The local results below were produced on 2026-08-24 from the 5.2.2 candidate
|
||||
|
|
@ -256,11 +270,11 @@ gate.
|
|||
## Handoff procedure for Alessandro/Cabelo
|
||||
|
||||
1. Upstream completes every applicable pre-tag source and local audit gate,
|
||||
then creates and verifies the annotated `v5.2.7` tag. Exact-tag hosted,
|
||||
then creates and verifies the annotated `v5.2.8` tag. Exact-tag hosted,
|
||||
native-platform, package, and promotion gates must pass before release or
|
||||
downstream handoff; the tag itself is never moved to repair a failure.
|
||||
2. With Git, `file`, bsdtar, tar, zip, unzip and SHA-256 tools installed, run
|
||||
`scripts/export-opensuse-package.sh v5.2.7`. Verify the reported ZIP and
|
||||
`scripts/export-opensuse-package.sh v5.2.8`. Verify the reported ZIP and
|
||||
SHA-256 outside the Git index. The handoff includes both
|
||||
`packaging/opensuse/source-audit.sh` and its required
|
||||
`scripts/check-source-only.sh`; keep that relative layout while auditing.
|
||||
|
|
@ -272,7 +286,7 @@ gate.
|
|||
```
|
||||
|
||||
4. From the extracted handoff root, run
|
||||
`packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.7.tar.gz`.
|
||||
`packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.8.tar.gz`.
|
||||
Then copy `_service`, `zupt.spec`, `zupt.changes` and `README.md`
|
||||
into the flat OBS package checkout. The audit wrapper is not an OBS build
|
||||
source and must not be copied without its companion `scripts/` directory.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
<service name="obs_scm" mode="manual">
|
||||
<param name="url">https://github.com/cristiancmoises/zupt.git</param>
|
||||
<param name="scm">git</param>
|
||||
<param name="revision">refs/tags/v5.2.7</param>
|
||||
<param name="revision">refs/tags/v5.2.8</param>
|
||||
<param name="versionformat">@PARENT_TAG@</param>
|
||||
<param name="versionrewrite-pattern">^v(.*)$</param>
|
||||
<param name="versionrewrite-replacement">\1</param>
|
||||
|
|
|
|||
|
|
@ -1,3 +1,18 @@
|
|||
-------------------------------------------------------------------
|
||||
Mon Aug 31 23:30:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>
|
||||
|
||||
- Update to 5.2.8:
|
||||
* Close CodeQL High path-race findings in SDK key publication,
|
||||
descriptor-first disk restore, and benchmark workspace cleanup.
|
||||
* Make the raw-C1 scanner fixture explicitly skip filesystems that reject
|
||||
the byte with EILSEQ, reject redirected Windows prompts before _getch, and
|
||||
add sdk-test to release/hosted Linux gates.
|
||||
* Preserve immutable, unpromoted v5.2.7 run 33445470664: 13 jobs succeeded,
|
||||
macOS failed the raw-C1 fixture, and Windows was cancelled after the hosted
|
||||
job stalled; a MinGW/Wine reproduction isolated redirected _getch entry.
|
||||
* Pin the OBS source service to the immutable v5.2.8 tag and require fresh
|
||||
exact-candidate evidence before promotion.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Aug 31 23:00:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>
|
||||
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@
|
|||
#
|
||||
|
||||
Name: zupt
|
||||
Version: 5.2.7
|
||||
Version: 5.2.8
|
||||
Release: 0
|
||||
Summary: Backup compression with authenticated and post-quantum encryption
|
||||
License: AGPL-3.0-or-later AND GPL-3.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ Requirements
|
|||
------------
|
||||
1. Python 3.9 or newer.
|
||||
2. PySide6 6.5 or newer, or a compatible PyQt6 package.
|
||||
3. ZUPT 5.2.7, installed as `zupt` on PATH or placed beside the launcher
|
||||
3. ZUPT 5.2.8, installed as `zupt` on PATH or placed beside the launcher
|
||||
(`zupt.exe` on Windows). A local command must have been built
|
||||
and tested independently; this bundle never downloads one.
|
||||
|
||||
|
|
@ -46,7 +46,7 @@ Troubleshooting
|
|||
---------------
|
||||
* "requires PySide6 or PyQt6": install one Qt binding through your operating
|
||||
system package manager or another trusted, preconfigured Python source.
|
||||
* "zupt not found": install ZUPT 5.2.7 or place its command beside
|
||||
* "zupt not found": install ZUPT 5.2.8 or place its command beside
|
||||
the launcher.
|
||||
* Set ZUPT_DEBUG=1 to print command-discovery diagnostics to stderr.
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@
|
|||
# installed smoke test.
|
||||
|
||||
Name: zupt
|
||||
Version: 5.2.7
|
||||
Version: 5.2.8
|
||||
Release: 1%{?dist}
|
||||
Summary: Backup compression with authenticated and post-quantum encryption
|
||||
|
||||
|
|
@ -101,6 +101,15 @@ comments. Plain archives use non-cryptographic checksums.
|
|||
%endif
|
||||
|
||||
%changelog
|
||||
* Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.8-1
|
||||
- Close CodeQL High path-race findings in SDK key save, disk restore, and
|
||||
benchmark cleanup; add the SDK gate, portable raw-C1 fixture handling, and
|
||||
redirected Windows password-prompt rejection.
|
||||
- Preserve immutable, unpromoted v5.2.7 run 33445470664: 13 jobs succeeded,
|
||||
macOS failed the raw-C1 fixture, and Windows was cancelled after the hosted
|
||||
job stalled; a MinGW/Wine reproduction isolated redirected _getch entry.
|
||||
- Require fresh 5.2.8 gates.
|
||||
|
||||
* Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.7-1
|
||||
- Correct native test integration: scope SHA-NI helpers away from macOS arm64
|
||||
and preserve safe UTF-8 fixture bytes across the Windows argv boundary.
|
||||
|
|
|
|||
Loading…
Reference in a new issue