packaging: correct 4.2.0 changelog weekday and make Fedora rpm spec source-only

- 2026-07-09 is a Thursday; fix the weekday in the rpm, debian, and
  openSUSE 4.2.0 changelog entries (was "Wed").
- packaging/rpm/vaptvupt.spec: drop the stale vendored-library install
  and %files entries (the libraries were removed in 4.1.0's source-only
  switch), build with WITH_SDK=0, and list the actual vaptvupt binary
  and shell completions. Mirrors the already-source-only openSUSE spec.

packaging/debian/changelog

@@ -20,7 +20,7 @@ vaptvupt (4.2.0-1) UNRELEASED; urgency=high
     message pointing to native --pq / --pq-only (or a WITH_SDK=1 build).
   * Wire format v1.6 unchanged; the 0x06 envelope is additive.
 
- -- Cristian Cezar Moisés <sac@securityops.co>  Wed, 09 Jul 2026 12:00:00 +0000
+ -- Cristian Cezar Moisés <sac@securityops.co>  Thu, 09 Jul 2026 12:00:00 +0000
 
 vaptvupt (4.1.0-1) UNRELEASED; urgency=high
 

packaging/opensuse/vaptvupt.changes

@@ -1,5 +1,5 @@
 -------------------------------------------------------------------
-Wed Jul  9 12:00:00 UTC 2026 - Alessandro de Oliveira Faria <cabelo@opensuse.org>
+Thu Jul  9 12:00:00 UTC 2026 - Alessandro de Oliveira Faria <cabelo@opensuse.org>
 
 - Update to 4.2.0:
   * New native full (pure) post-quantum mode --pq-only: ML-KEM-768

packaging/rpm/vaptvupt.spec

@@ -70,49 +70,44 @@ and optional encrypted comments.
 %autosetup -n %{name}-%{version}
 
 %build
-# Use Fedora's default optflags but with the project's preferred warning set.
+# Source-only build (WITH_SDK=0): no vendored libraries, no external crypto
-CFLAGS="%{optflags} -Wall -Wextra -Wpedantic -std=c11" \
+# dependency. Fedora's default optflags plus the project's warning set.
-LDFLAGS="%{?build_ldflags}" \
+%make_build WITH_SDK=0 \
-%make_build
+    CFLAGS="%{optflags} -fPIE -Wall -Wextra -std=c11 -Iinclude -Isrc" \
+    LDFLAGS="%{?build_ldflags} -pie" \
+    LDLIBS="-lm -lpthread"
 
 %check
-# Run the upstream regression suite. F-06 HMAC trials, F-08 top-MAC sweep,
+# Distro-safe regression subset: F-06 HMAC trials, F-08 top-MAC sweep,
-# F-09 byte sweep (1827 positions), F-10..F-12 regressions, dist
+# F-09 byte sweep, F-10..F-12 regressions, the dedup-nonce regression,
-# reproducibility. ~3 minutes on modern hardware.
+# and NIST/RFC vectors. Skips threaded/dist-reproducibility tests that
-%make_build test
+# are sensitive to the build host.
+%make_build WITH_SDK=0 \
+    CFLAGS="%{optflags} -fPIE -Wall -Wextra -std=c11 -Iinclude -Isrc" \
+    LDFLAGS="%{?build_ldflags} -pie" \
+    LDLIBS="-lm -lpthread" \
+    check
 
 %install
-%make_install DESTDIR=%{buildroot} PREFIX=/usr
+%make_install WITH_SDK=0 DESTDIR=%{buildroot} PREFIX=/usr
-
-# Install the vendored libzuptsdk into /usr/lib/zupt/ — the binary is
-# linked with -Wl,-rpath,$ORIGIN/vendor/zuptsdk so we preserve the same
-# layout under /usr/.
-install -d %{buildroot}%{_libdir}/%{name}
-install -m 0755 vendor/zuptsdk/libzuptsdk.so.2.0.0 \
-    %{buildroot}%{_libdir}/%{name}/libzuptsdk.so.2.0.0
-ln -sf libzuptsdk.so.2.0.0 %{buildroot}%{_libdir}/%{name}/libzuptsdk.so.2
-ln -sf libzuptsdk.so.2.0.0 %{buildroot}%{_libdir}/%{name}/libzuptsdk.so
-install -m 0755 vendor/pqvaptvupt/libpqvaptvupt.so.0.6.0 \
-    %{buildroot}%{_libdir}/%{name}/libpqvaptvupt.so.0.6.0
-ln -sf libpqvaptvupt.so.0.6.0 %{buildroot}%{_libdir}/%{name}/libpqvaptvupt.so.0
-ln -sf libpqvaptvupt.so.0.6.0 %{buildroot}%{_libdir}/%{name}/libpqvaptvupt.so
 
 %files
 %license LICENSE
 %doc README.md SECURITY.md CHANGELOG.md
+%{_bindir}/%{name}
 %{_bindir}/zupt
-%{_libdir}/%{name}/libzuptsdk.so.2.0.0
+%{_datadir}/bash-completion/completions/%{name}
-%{_libdir}/%{name}/libzuptsdk.so.2
+%{_datadir}/bash-completion/completions/zupt
-%{_libdir}/%{name}/libzuptsdk.so
+%{_datadir}/zsh/site-functions/_%{name}
-%{_libdir}/%{name}/libpqvaptvupt.so.0.6.0
+%{_datadir}/zsh/site-functions/_zupt
-%{_libdir}/%{name}/libpqvaptvupt.so.0
+%{_datadir}/fish/vendor_completions.d/%{name}.fish
-%{_libdir}/%{name}/libpqvaptvupt.so
 %if 0%{?_mandir:1}
+%{_mandir}/man1/%{name}.1*
 %{_mandir}/man1/zupt.1*
 %endif
 
 %changelog
-* Wed Jul 09 2026 Cristian Cezar Moisés <sac@securityops.co> - 4.2.0-1
+* Thu Jul 09 2026 Cristian Cezar Moisés <sac@securityops.co> - 4.2.0-1
 - New native full (pure) post-quantum mode --pq-only: ML-KEM-768 as the
   sole KEM, no classical X25519 (envelope 0x06). For "PQ-only" compliance
   postures; hybrid --pq remains the recommended default. In-tree crypto.