From a6e330827e3a3341a424ce9c13782a30cab9fb14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cristian=20Cezar=20Mois=C3=A9s?= Date: Mon, 31 Aug 2026 21:25:16 -0300 Subject: [PATCH] docs: record final security gate evidence --- AUDIT.md | 33 +++++++++++++++++++++++++-------- CHANGELOG.md | 8 +++++++- DISTRIBUTION.md | 7 ++++++- README.md | 28 +++++++++++++++++++--------- SECURITY.md | 24 ++++++++++++++++-------- 5 files changed, 73 insertions(+), 27 deletions(-) diff --git a/AUDIT.md b/AUDIT.md index dfe887f..d5d6516 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -222,21 +222,38 @@ after emptying a directory reopens it relative to the pinned parent, verifies its volume and file index against the traversal handle, and marks only that identity-checked handle for deletion. The live-workspace regression injects a directory symlink and verifies that its external sentinel -survives. These are reviewed fixes and regression coverage, -not independent certification or proof that a 5.2.8 hosted gate passed. +survives. These are reviewed fixes and regression coverage, not independent +certification or proof that an exact-tag 5.2.8 gate passed. The C/C++ default-branch analysis of commit `69fc26b` closed #5, #6, and #7, then reported High #8, #9, and #10 solely in the newly added SDK regression: its sentinel and mode checks used `stat`/`lstat` before later path operations. Each individual content or metadata check now opens without following links and uses `fstat` or reads through that already-open descriptor. A static guard -rejects a return to path-level `stat`/`lstat` in this test. A fresh -default-branch scan remains the authoritative closure evidence. +rejects a return to path-level `stat`/`lstat` in this test. The subsequent +C/C++ default-branch scan run `33452563116` completed successfully at commit +`7a8e5c5`; alerts #5 through #10 are fixed, and the authenticated +code-scanning API reported zero open alerts. -The exact 5.2.8 candidate must repeat the required suite. Native Windows and -macOS gates, hosted GitHub CI and release promotion, authenticated OBS -validation, and resolution of the openSUSE automatic `debugsource` rpmlint -`no-binary` finding remain pending until recorded otherwise. +Manual pre-tag CI run `33452602634` at the same functional commit completed 14 +of 15 jobs successfully. Linux compilers, analyzers, sanitizers, source policy, +reproducibility, DEB, RPM/SRPM, portable bundles, and the native macOS DMG gate +passed. On Windows, source audit, build, and `make check` passed; the subsequent +smoke failed only when the old MSYS `grep` tried to match a literal non-BMP +filename after ZUPT had compressed and verified all five inputs. Independent +MinGW/Wine reproduction confirmed that the redirected ZUPT listing contained +the exact UTF-8 bytes. The gate now creates the non-BMP name through byte +escapes, verifies Latin-1/BMP/non-BMP listing bytes without locale-sensitive +matching, and requires extraction plus a full tree diff. The path-confinement +regression independently constructs the BMP/non-BMP archive name from ASCII +hex and requires byte-exact listing and extraction. + +Because that pre-tag run failed, it is diagnostic evidence rather than release +approval. The exact 5.2.8 candidate must repeat the required suite. Exact-tag +native Windows/macOS, hosted CI, authenticated OBS service execution, and +release promotion remain pending until recorded otherwise. The pre-tag +openSUSE Tumbleweed job did build source and binary RPMs, pass `rpmlint` without +suppressions, and pass install/round-trip/uninstall checks. ## Cryptographic review boundary diff --git a/CHANGELOG.md b/CHANGELOG.md index 962b156..a1576d2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,7 +30,8 @@ unchanged. test-only path checks as High #8, #9, and #10 in the new SDK regression. Replace every test-side `stat`/`lstat` sequence with one no-follow `open` followed by `fstat` and descriptor reads, and retain that boundary in the - static regression gate. + static regression gate. Default-branch run `33452563116` completed + successfully with #5 through #10 fixed and zero open code-scanning alerts. - Treat inability to create the raw-C1 scanner filename as an explicit fixture skip on filesystems that reject the byte; when creation succeeds, the unsafe diagnostic-escaping assertions still run unchanged. Normalize Bash 3.2's @@ -43,6 +44,11 @@ unchanged. current-user-only DACL that the implementation creates; do not treat MSYS's synthetic `stat` mode as a POSIX `0600` result. POSIX continues to require the real descriptor mode `0600` under multiple umasks. +- Replace the old MSYS `grep` non-BMP boundary exposed after 14 successful jobs + in pre-tag run `33452602634` with byte-exact Python checks for Latin-1, BMP, + and non-BMP UTF-8 listing output. Construct the emoji fixture from ASCII byte + escapes and require list, extract, and full-tree equality; the independent + path regression also creates its BMP/non-BMP name from ASCII hex. - Run `sdk-test` from both `release-check` and the hosted GCC/Clang Linux job so the atomic key-save regression cannot silently fall outside release gates. - Carry the v5.2.7 archive format, cryptography, bundled codec release, and SDK diff --git a/DISTRIBUTION.md b/DISTRIBUTION.md index 30962e9..0acdb76 100644 --- a/DISTRIBUTION.md +++ b/DISTRIBUTION.md @@ -31,7 +31,12 @@ UTF-8 fixture argv transcoding. Version 5.2.7 corrected those failures, but exact-tag run `33445470664` ended with 13 successful jobs, a macOS raw-C1 fixture failure with `EILSEQ`, and a cancelled Windows job after the hosted job stalled in `make check`; a MinGW/Wine reproduction isolated a non-console -password-prompt hang in `_getch`. +password-prompt hang in `_getch`. Manual 5.2.8 pre-tag run `33452602634` +subsequently passed 14 of 15 jobs, including native macOS and the complete +Windows distribution checks, before an old MSYS `grep` non-BMP pattern failed +in the later smoke. ZUPT's redirected listing was byte-correct; the corrected +gate uses byte-exact, locale-independent checks and requires extraction plus a +full tree diff. The failed run is diagnostic evidence only. Corrective packages and release assets must use `v5.2.8`; never move or overwrite an earlier tag or checksum, and never transfer prior evidence automatically. Version 5.2.8 corrects those native test boundaries, hardens diff --git a/README.md b/README.md index a845804..0d33c50 100644 --- a/README.md +++ b/README.md @@ -15,12 +15,12 @@ diagnostics, and brings `sdk-test` into the release and hosted Linux gates. Windows password prompts now reject redirected input before entering `_getch` and treat console EOF as an error; its key-file regression validates the protected current-user-only DACL rather than an MSYS -POSIX-mode projection. The C/C++ default-branch scan of commit `69fc26b` -closed #5, #6, and #7 and exposed test-only #8, #9, and #10 in the new SDK -regression. Their follow-up uses no-follow descriptors plus `fstat`/descriptor -reads and requires a fresh default-branch scan for closure. These -corrections do not change archive format v1.6, cryptography, the bundled codec -release, or the SDK ABI. +POSIX-mode projection. The C/C++ default-branch scan run `33452563116` of +commit `7a8e5c5` completed successfully after the follow-up changed the new SDK +regression to no-follow descriptors plus `fstat` and descriptor reads. Alerts +#5 through #10 are fixed, and the authenticated code-scanning API reported zero +open alerts. These corrections do not change archive format v1.6, +cryptography, the bundled codec release, or the SDK ABI. The predecessor `v5.2.7` tag is immutable and was not promoted. Exact-tag run `33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13 @@ -29,6 +29,16 @@ job. The hosted Windows job stalled in `make check`; a MinGW/Wine reproduction attributed the stall to a non-console password prompt entering `_getch`. No v5.2.7 evidence transfers automatically to v5.2.8. +Manual pre-tag run `33452602634` then completed 14 of 15 jobs successfully at +`7a8e5c5`, including the native macOS DMG gate and the Windows build and full +distribution checks. Its Windows smoke test failed only when the old MSYS +`grep` matched a literal non-BMP filename after the product had already +compressed and verified all five files. MinGW/Wine reproduction confirmed the +exact `F0 9F 98 80` UTF-8 bytes in ZUPT's redirected listing. The corrected +gate creates that name from byte escapes, validates Latin-1, BMP, and non-BMP +listing bytes with Python, and requires extraction plus a full tree diff. The +failed run is diagnostic evidence, not release-candidate approval. + Version 5.2.2 restored the original ZUPT product name and the `zupt` command. The `.zupt` archive extension, format v1.6, magic bytes, codec identifiers, and SDK ABI remain unchanged. An optional `vaptvupt` command alias may be provided @@ -43,9 +53,9 @@ decisions, and benchmark cleanup is descriptor-relative on POSIX and handle/reparse-point aware on Windows. The live-workspace symlink regression, SDK link-target/mode regression, static path-race guards, portable raw-C1 fixture with Bash 3.2 unsigned-byte normalization, native redirected-prompt -and protected-DACL regressions, and `sdk-test` CI step cover -these boundaries. All current release paths move to 5.2.8 and require fresh -exact-tag hosted CI, package, +and protected-DACL regressions, byte-exact BMP/non-BMP Windows list and extract +checks, and `sdk-test` CI step cover these boundaries. All current release +paths move to 5.2.8 and require fresh exact-tag hosted CI, package, native-platform, source-only, checksum, OBS, and promotion evidence. ## Corrective changes introduced in 5.2.7 diff --git a/SECURITY.md b/SECURITY.md index 44c52ff..7b6c3e3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -232,8 +232,10 @@ The C/C++ default-branch analysis of commit `69fc26b` closed #5, #6, and #7, then opened test-only High #8, #9, and #10 because the new SDK regression used path-level `stat`/`lstat` before later reads or cleanup. Each individual test check now uses a no-follow descriptor with `fstat` or descriptor reads; the -static gate rejects reintroduction of path-level metadata checks there. A -subsequent default-branch scan is required as closure evidence. +static gate rejects reintroduction of path-level metadata checks there. The +subsequent C/C++ default-branch scan run `33452563116` completed successfully at +commit `7a8e5c5`; alerts #5 through #10 are fixed, and the authenticated +code-scanning API reported zero open alerts. The Windows handle-relative implementation is scoped to normal local Win32 paths. Win32 extended-length and device-namespace paths, raw UNC output roots, @@ -364,12 +366,18 @@ promoted: exact-tag run `33445470664` concluded `cancelled` at `2026-08-31T23:11:19Z`, with 13 successful jobs, one failed macOS job after raw-C1 fixture creation returned `EILSEQ`, and one cancelled Windows job after the hosted job stalled in `make check`; a MinGW/Wine reproduction isolated the -cause to a redirected password prompt entering `_getch`. Version 5.2.8 makes both test boundaries fail -or skip without hanging, but this is not exact-candidate evidence. Native -Windows and macOS, hosted GitHub CI/release -promotion, authenticated OBS, and the openSUSE automatic `debugsource` rpmlint -`no-binary` finding remain pending until recorded otherwise. An unavailable or -unexecuted environment remains `SKIP`, never `PASS`. +cause to a redirected password prompt entering `_getch`. Version 5.2.8 makes +both test boundaries fail or skip without hanging. Manual pre-tag run +`33452602634` subsequently passed 14 of 15 jobs, including the native macOS +DMG and the Windows source audit, build, and full distribution checks. The +remaining Windows smoke failure was an old MSYS `grep` non-BMP pattern boundary +after ZUPT had compressed and verified all inputs; MinGW/Wine confirmed ZUPT's +byte-exact UTF-8 listing. The corrected gate validates Latin-1, BMP, and +non-BMP listing bytes without locale-sensitive matching, then requires +extraction and a full tree diff. The failed run is not exact-candidate +evidence. Exact-tag native gates, hosted CI, authenticated OBS service +execution, and release promotion remain pending. An unavailable or unexecuted +environment remains `SKIP`, never `PASS`. Run target-native static analyzers and package checks as additional evidence. Do not infer x86_64, aarch64, ppc64le, s390x, riscv64, macOS, Windows, Leap, or