cristiancmoises/zupt
Watch
1
0
Fork
You've already forked zupt
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 3

release: prepare ZUPT 5.2.7 native test gates

Browse source
This commit is contained in:
Cristian Cezar Moisés 2026-08-31 19:05:55 -03:00
commit cb794e100c
29 changed files with 278 additions and 169 deletions
Download patch file Download diff file Expand all files Collapse all files

30
SECURITY.md
View file

@ -1,4 +1,4 @@
# Security Policy — ZUPT 5.2.6
# Security Policy — ZUPT 5.2.7
## Reporting vulnerabilities
@ -66,7 +66,7 @@ partially accepted.
### Optional integrations
The 5.2.6 default is `WITH_SDK=0 WITH_PQBOX=0`:
The 5.2.7 default is `WITH_SDK=0 WITH_PQBOX=0`:
- `WITH_SDK=1` enables libvuptsdk-backed features, including the SDK PQ mode
and Argon2id support, using a separately installed system development package.
@ -133,7 +133,7 @@ can compromise archives encrypted to it.
## Constant-time and side-channel scope
Portable C is the 5.2.6 default. Sensitive comparisons and selections use
Portable C is the 5.2.7 default. Sensitive comparisons and selections use
branchless helpers, but generated machine-code behavior remains dependent on
the compiler and platform. This is not a formal whole-program constant-time
claim. The C AES implementation uses table lookups and is unsuitable for a
@ -204,7 +204,7 @@ media before proceeding.
The Windows handle-relative implementation is scoped to normal local Win32
paths. Win32 extended-length and device-namespace paths, raw UNC output roots,
and mapped/network-drive output are not supported in 5.2.6. Cross-build and
and mapped/network-drive output are not supported in 5.2.7. Cross-build and
Wine results are not native-Windows evidence; the `windows-latest` package gate
must pass its Unicode round trip before Windows assets are published. Restore
to a normal local directory first and move verified output to network storage
@ -247,7 +247,7 @@ shared/static library, or distribution package. Audit them with:
```sh
scripts/check-source-only.sh
scripts/check-source-only.sh --archive /path/to/zupt-5.2.6.tar.gz
scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
```
Nested archive inspection is required to enforce bounded recursion, member
@ -257,13 +257,13 @@ limit violations. On commit `ff99770`, the source-only scanner suite passed
DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI
ZIP, Windows ZIP, and macOS DMG release assets are separate outputs. An
AppImage is not promoted for 5.2.6. A bare Linux or Windows executable is also
AppImage is not promoted for 5.2.7. A bare Linux or Windows executable is also
excluded; executables are distributed only inside their notice-bearing
archives. Trust an artifact only when its exact format has a recorded build,
content/metadata inspection, extracted or installed smoke test, and applicable
archive round trip. Never treat an unexecuted platform as passing.
The gated 5.2.6 set is the CLI package/archive set plus the exact GUI DEB,
The gated 5.2.7 set is the CLI package/archive set plus the exact GUI DEB,
noarch/source RPM, and source-only portable ZIP documented in the README. The
portable GUI ZIP contains no compiled runtime and is scanned as source before
and after extraction. Other GUI packages, AppImage, AppDir and Flatpak bundles,
@ -303,7 +303,7 @@ result.
Post-tag CI integration failures prevented 5.2.2 promotion. Those upstream
self-audit results are not independent certification and do not transfer to
5.2.6. The immutable 5.2.3 candidate was not promoted because its source-policy
5.2.7. The immutable 5.2.3 candidate was not promoted because its source-policy
test assumed LF for a Windows `.bat` file checked out as CRLF. The immutable
v5.2.4 candidate was not promoted after exact-tag GitHub Actions run
`33431386002`: 12 jobs succeeded, the sole openSUSE job failed in its
@ -313,14 +313,18 @@ Tumbleweed reproduction confirmed that `refs/tags/v5.2.4` is valid and that
`os.chdir(service_dir)` lets `obs_scm`, `tar`, and `recompress` complete with a
source-scanned archive. This was a release/test integration defect, not a
product, archive, cryptographic, codec, or SDK ABI change, and its evidence does
not transfer automatically to 5.2.6. The immutable v5.2.5 candidate was also
not transfer automatically to 5.2.7. The immutable v5.2.5 candidate was also
not promoted: exact-tag GitHub Actions run `33434986357` recorded 13 successful
jobs and failed native Windows/macOS jobs. Its Windows fixture-byte and macOS
secure-wipe/Bash 3.2 defects are corrected for 5.2.6, but those changes have not
yet passed exact-5.2.6 hosted or native gates. A targeted clean-clone run of the
corrected scanner under genuine GNU Bash 3.2.57 passed repository, standalone
secure-wipe/Bash 3.2 defects were corrected for 5.2.6. A targeted clean-clone
run of the corrected scanner under genuine GNU Bash 3.2.57 passed repository, standalone
tree, standalone archive, and root-plus-tag modes; that local compatibility
result does not transfer to any other gate. The exact 5.2.6 candidate must
result does not transfer to any other gate. Exact-tag v5.2.6 run `33442264243`
then completed 13 jobs successfully but failed native macOS because x86 SHA-NI
test helpers were unused on arm64 under `-Werror`, and failed native Windows
when argv transcoding aborted the safe UTF-8 fixture. Those are test-harness
integration defects, not product, archive, cryptographic, codec, or SDK ABI
changes; v5.2.6 remained unpromoted. The exact 5.2.7 candidate must
repeat the required suite. Native Windows and macOS, hosted GitHub CI/release
promotion, authenticated OBS, and the openSUSE automatic `debugsource` rpmlint
`no-binary` finding remain pending until recorded otherwise. An unavailable or