release: prepare ZUPT 5.2.7 native test gates
This commit is contained in:
Cristian Cezar Moisés
parent
6d9f740a2b
commit
cb794e100c
29 changed files with 278 additions and 169 deletions
2
.github/workflows/promote-release.yml
vendored
2
.github/workflows/promote-release.yml
vendored
|
|
@ -11,7 +11,7 @@ on:
|
|||
required: true
|
||||
type: number
|
||||
tag:
|
||||
description: Existing annotated release tag, for example v5.2.6
|
||||
description: Existing annotated release tag, for example v5.2.7
|
||||
required: true
|
||||
type: string
|
||||
|
||||
|
|
|
|||
44
AUDIT.md
44
AUDIT.md
|
|
@ -1,12 +1,12 @@
|
|||
<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
|
||||
# ZUPT 5.2.6 audit guide and finding history
|
||||
# ZUPT 5.2.7 audit guide and finding history
|
||||
|
||||
This document describes review surfaces and reproducible checks. It is an
|
||||
upstream self-review, not an independent audit, certification, or guarantee.
|
||||
`SECURITY.md` defines reporting policy and `THREAT_MODEL.md` defines the
|
||||
security boundary.
|
||||
|
||||
## 5.2.6 scope
|
||||
## 5.2.7 scope
|
||||
|
||||
The baseline scope is the source-only CLI and its bundled source codec:
|
||||
|
||||
|
|
@ -28,7 +28,7 @@ output.
|
|||
|
||||
## Source-only review
|
||||
|
||||
The 5.2.6 baseline retains the source-only boundary introduced in 5.2.2, which
|
||||
The 5.2.7 baseline retains the source-only boundary introduced in 5.2.2, which
|
||||
removed incomplete SDK/PQBOX header snapshots and local precompiled-library
|
||||
expectations. Git and new upstream source
|
||||
archives are intended to contain no compiled executable, object, shared/static
|
||||
|
|
@ -42,10 +42,10 @@ scripts/check-source-only.sh
|
|||
|
||||
# committed Git tree or immutable tag
|
||||
scripts/check-source-only.sh --tag HEAD
|
||||
scripts/check-source-only.sh --tag v5.2.6
|
||||
scripts/check-source-only.sh --tag v5.2.7
|
||||
|
||||
# generated source archive
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.6.tar.gz
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
|
||||
```
|
||||
|
||||
The scanner checks extensions and magic bytes, nested archives, symlink targets,
|
||||
|
|
@ -109,7 +109,7 @@ without evidence.
|
|||
The following upstream self-audit results apply only to the 5.2.2 candidate at
|
||||
commit `ff99770` on the recorded local Linux environments. The immutable 5.2.2
|
||||
tag was not promoted after post-tag CI integration failures. These results are
|
||||
not independent certification, a 5.2.6 result, or evidence that release assets
|
||||
not independent certification, a 5.2.7 result, or evidence that release assets
|
||||
were published.
|
||||
|
||||
| Gate | Result | Recorded evidence |
|
||||
|
|
@ -141,7 +141,7 @@ A separate local openSUSE Tumbleweed reproduction resolved the explicit
|
|||
produced exactly one `zupt-5.2.4.tar.gz`, which passed the source-only scanner.
|
||||
This isolates a release/test harness defect; it is not evidence of a product,
|
||||
archive-format, cryptographic, codec, or SDK ABI change. It also does not turn
|
||||
the skipped native jobs into passes or transfer any result to 5.2.6.
|
||||
the skipped native jobs into passes or transfer any result to 5.2.7.
|
||||
|
||||
## Prior 5.2.5 exact-tag native-gate evidence
|
||||
|
||||
|
|
@ -157,17 +157,31 @@ Darwin and NetBSD, guard every relevant scanner array, and make the Windows
|
|||
fixture accept explicit hexadecimal bytes, verify the full requested path in
|
||||
the archive, and reject each dangerous raw byte fragment anywhere in diagnostic
|
||||
output. These changes do not alter the archive format, cryptography, bundled
|
||||
codec, or SDK ABI. They are proposed corrections, not proof that any 5.2.6
|
||||
native or hosted gate has passed.
|
||||
codec, or SDK ABI.
|
||||
|
||||
A separate local compatibility run executed the corrected scanner with genuine
|
||||
GNU Bash 3.2.57 in a clean clone. All four exercised modes completed: the
|
||||
repository audit reported 609 files and one archive; `--tree` reported 204/0;
|
||||
`--archive` reported 201/1; and `--root` plus `--tag v5.2.5` reported 810/2.
|
||||
This is targeted scanner compatibility evidence only, not exact-v5.2.6 hosted
|
||||
CI, package, native-platform, or promotion evidence.
|
||||
This is targeted scanner compatibility evidence only, not exact-v5.2.6 or
|
||||
v5.2.7 hosted CI, package, native-platform, or promotion evidence.
|
||||
|
||||
The exact 5.2.6 candidate must repeat the required suite. Native Windows and
|
||||
## Prior 5.2.6 exact-tag native-gate evidence
|
||||
|
||||
The immutable `v5.2.6` candidate was not promoted. Exact-tag GitHub Actions run
|
||||
`33442264243` completed 13 jobs successfully and failed two native jobs. On
|
||||
macOS arm64, the strict SHA-NI regression build diagnosed x86-only helper
|
||||
declarations as unused under `-Werror`. On Windows, argv transcoding of the safe
|
||||
printable UTF-8 fixture caused the path regression to abort before its intended
|
||||
archive and diagnostic assertions.
|
||||
|
||||
The 5.2.7 changes scope those helper declarations to supported x86 builds and
|
||||
carry the safe UTF-8 fixture across the Windows argument boundary without
|
||||
locale-dependent byte conversion. These are test/release integration changes,
|
||||
not archive-format, cryptographic, codec, or SDK ABI changes. They are not proof
|
||||
that any v5.2.7 native or hosted gate has passed.
|
||||
|
||||
The exact 5.2.7 candidate must repeat the required suite. Native Windows and
|
||||
macOS gates, hosted GitHub CI and release promotion, authenticated OBS
|
||||
validation, and resolution of the openSUSE automatic `debugsource` rpmlint
|
||||
`no-binary` finding remain pending until recorded otherwise.
|
||||
|
|
@ -189,7 +203,7 @@ AES implementation has documented cache-timing risk on hostile shared hardware.
|
|||
|
||||
The following entries are retained as release history. Their regression tests
|
||||
should be rerun, but the historical resolution does not itself constitute a
|
||||
5.2.6 test result.
|
||||
5.2.7 test result.
|
||||
|
||||
| First corrected | Severity | Finding | Resolution recorded at the time |
|
||||
|---|---|---|---|
|
||||
|
|
@ -230,12 +244,12 @@ include SHA-256 checksums. The gated GUI set adds the architecture-independent
|
|||
DEB, noarch/source RPM, and source-only portable GUI ZIP. Package gates include
|
||||
exact payload/dependency and installed off-screen integration checks; the
|
||||
portable ZIP additionally receives source scans, an exact safe-member allowlist,
|
||||
and an extracted launcher test. An AppImage is not promoted by the 5.2.6
|
||||
and an extracted launcher test. An AppImage is not promoted by the 5.2.7
|
||||
policy; AppDir and Flatpak bundles, GUI platform installers, and bare
|
||||
Linux/Windows executables are also excluded. Windows ZIP and macOS DMG outputs
|
||||
remain CLI-only.
|
||||
|
||||
No Wine result is retained as release evidence for 5.2.6. Cross-compilation
|
||||
No Wine result is retained as release evidence for 5.2.7. Cross-compilation
|
||||
does not establish native-Windows behavior. Extended-length/device namespace
|
||||
paths, raw UNC output roots, and mapped/network-drive output are unsupported;
|
||||
the native Windows workflow remains a publication gate for the ZIP containing
|
||||
|
|
|
|||
22
CHANGELOG.md
22
CHANGELOG.md
|
|
@ -1,5 +1,27 @@
|
|||
# ZUPT Changelog
|
||||
|
||||
## [5.2.7] — 2026-08-31 — Native test-harness portability corrections
|
||||
|
||||
Corrective successor to the immutable, unpromoted `v5.2.6` candidate. Exact-tag
|
||||
GitHub Actions run `33442264243` completed 13 jobs successfully, but the native
|
||||
Windows and macOS jobs failed, so no 5.2.6 assets were promoted. The tag and its
|
||||
recorded evidence remain unchanged.
|
||||
|
||||
- Scope the SHA-NI regression helper declarations to the supported x86 build
|
||||
path so macOS arm64 strict compilation does not diagnose unused declarations
|
||||
under `-Werror`.
|
||||
- Carry the safe printable UTF-8 path fixture through an explicit
|
||||
byte-stable Windows argument representation so argv transcoding cannot abort
|
||||
the regression before its intended archive and diagnostic assertions.
|
||||
- Carry the 5.2.6 source-only and security baseline forward without changing
|
||||
the archive format, cryptography, bundled codec release, or SDK ABI.
|
||||
- Realign current source, package, workflow, artifact, and tag references to
|
||||
5.2.7, then pin the final reproducible release-archive checksum and content
|
||||
hash in the downstream recipes before tagging.
|
||||
- Require fresh exact-`v5.2.7` source, checksum, hosted CI, native-platform,
|
||||
package, OBS, and promotion evidence. No prior candidate result transfers
|
||||
automatically, and this entry does not claim those gates passed.
|
||||
|
||||
## [5.2.6] — 2026-08-31 — Native release-gate portability corrections
|
||||
|
||||
Corrective successor to the immutable, unpromoted `v5.2.5` candidate. Exact-tag
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# Distributing ZUPT 5.2.6
|
||||
# Distributing ZUPT 5.2.7
|
||||
|
||||
This document describes the packaging material maintained in the ZUPT
|
||||
source repository. A recipe in `packaging/` is not evidence that a package has
|
||||
|
|
@ -14,7 +14,7 @@ https://github.com/cristiancmoises/zupt
|
|||
GitHub is the canonical source and release host. Packaging must never fetch
|
||||
`zupt-web` or substitute an asset from another project.
|
||||
|
||||
The `v5.2.2`, `v5.2.3`, `v5.2.4`, and `v5.2.5` tags are immutable
|
||||
The `v5.2.2`, `v5.2.3`, `v5.2.4`, `v5.2.5`, and `v5.2.6` tags are immutable
|
||||
non-promoted candidates.
|
||||
The v5.2.3 source-policy test assumed LF for a Windows `.bat` file that Git
|
||||
correctly checks out as CRLF. Exact-tag GitHub Actions run `33431386002` then
|
||||
|
|
@ -24,9 +24,12 @@ Tumbleweed reproduction confirmed that `refs/tags/v5.2.4` is valid and that
|
|||
entering the service directory completes the source-service chain. Corrective
|
||||
working-directory integration was carried by v5.2.5, whose exact-tag GitHub
|
||||
Actions run `33434986357` completed 13 jobs successfully but failed the native
|
||||
Windows and macOS jobs. Corrective packages and release assets must use
|
||||
`v5.2.6`; never move or overwrite an earlier tag or checksum, and never transfer
|
||||
prior evidence automatically.
|
||||
Windows and macOS jobs. Its v5.2.6 corrections reached exact-tag run
|
||||
`33442264243`, where 13 jobs succeeded but macOS arm64 failed on unused x86
|
||||
SHA-NI test-helper declarations under `-Werror`, and Windows aborted during safe
|
||||
UTF-8 fixture argv transcoding. Corrective packages and release assets must use
|
||||
`v5.2.7`; never move or overwrite an earlier tag or checksum, and never
|
||||
transfer prior evidence automatically.
|
||||
This corrective version changes release/test integration only; the product,
|
||||
archive format, cryptography, codec, and SDK ABI remain unchanged.
|
||||
|
||||
|
|
@ -58,7 +61,7 @@ Audit the current tree or a generated archive with:
|
|||
|
||||
```sh
|
||||
scripts/check-source-only.sh
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.6.tar.gz
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
|
||||
```
|
||||
|
||||
The scanner reports paths, not file contents, and exits nonzero on a violation.
|
||||
|
|
@ -72,8 +75,8 @@ the commit omits Git's commit-ID PAX header:
|
|||
|
||||
```sh
|
||||
SOURCE_DATE_EPOCH="$(git show -s --format=%ct HEAD)" \
|
||||
make DIST_TARBALL=/tmp/zupt-5.2.6.tar.gz dist
|
||||
sha256sum /tmp/zupt-5.2.6.tar.gz
|
||||
make DIST_TARBALL=/tmp/zupt-5.2.7.tar.gz dist
|
||||
sha256sum /tmp/zupt-5.2.7.tar.gz
|
||||
```
|
||||
|
||||
With identical committed input and `SOURCE_DATE_EPOCH`, repeated exports must
|
||||
|
|
@ -119,12 +122,12 @@ private-library RPATH.
|
|||
| openSUSE / OBS | `packaging/opensuse/` | source and binary RPM through OBS |
|
||||
| Debian / Ubuntu | `packaging/debian/`, `packaging/build-deb.sh` | Debian metadata and binary DEB after the target gate |
|
||||
| RPM release artifact | `packaging/opensuse/zupt.spec`, `packaging/build-rpm.sh` | source and binary RPM after the target gate |
|
||||
| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.6_all.deb` after payload/dependency and installed integration gates |
|
||||
| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.6-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
|
||||
| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.6-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
|
||||
| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.6-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
|
||||
| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.7_all.deb` after payload/dependency and installed integration gates |
|
||||
| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.7-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
|
||||
| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.7-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
|
||||
| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.7-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
|
||||
| Fedora / RPM-based systems | `packaging/rpm/zupt.spec` | downstream RPM starting point |
|
||||
| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.6 AppImage is promoted |
|
||||
| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.7 AppImage is promoted |
|
||||
| Windows | `.github/workflows/cross-platform.yml` | native ZIP (executable plus notices) after the required native gate |
|
||||
| macOS | `packaging/build-dmg.sh` | native-architecture DMG after the native gate |
|
||||
| Arch Linux | `packaging/aur/PKGBUILD` | AUR package recipe |
|
||||
|
|
@ -200,17 +203,17 @@ expectations, then test the installed launcher off-screen against the matching
|
|||
### Portable and native release artifacts
|
||||
|
||||
The Linux x86_64 gate packages the tested `zupt` executable as
|
||||
`zupt-5.2.6-linux-x86_64.tar.xz` beside README, changelog, security guidance,
|
||||
`zupt-5.2.7-linux-x86_64.tar.xz` beside README, changelog, security guidance,
|
||||
and every applicable public license and notice. Its dynamic-library allowlist,
|
||||
archive member allowlist, and extracted CLI functional suite must pass.
|
||||
|
||||
The `zupt-gui-5.2.6-portable.zip` artifact is source-only: it contains the GUI
|
||||
The `zupt-gui-5.2.7-portable.zip` artifact is source-only: it contains the GUI
|
||||
Python source, shell/macOS/Windows launchers, icons, provenance, changelog, and
|
||||
licenses, but no Python, Qt, CLI, or compiled runtime. The gate scans both the
|
||||
assembled and extracted trees, verifies an exact safe member allowlist, and
|
||||
runs the extracted launcher off-screen against the tested CLI.
|
||||
|
||||
AppImage creation is deliberately offline and is not a 5.2.6 release gate.
|
||||
AppImage creation is deliberately offline and is not a 5.2.7 release gate.
|
||||
Supply a locally verified `appimagetool`, type-2 runtime, and the complete
|
||||
license/source-relink compliance notice for those exact runtime bytes; the
|
||||
helper never downloads any input:
|
||||
|
|
@ -226,7 +229,7 @@ APPIMAGE_RUNTIME_COMPLIANCE_FILE=/verified/path/runtime-compliance.txt \
|
|||
The runtime inspected while preparing 5.2.2 omitted a linked component from
|
||||
its notice and did not provide the complete LGPL source/relink handoff required
|
||||
by this release policy. No AppImage produced by this helper is promoted by the
|
||||
upstream 5.2.6 workflow. AppDir and Flatpak bundles and GUI platform installers
|
||||
upstream 5.2.7 workflow. AppDir and Flatpak bundles and GUI platform installers
|
||||
are also excluded. Bare Linux and Windows executables are not promoted; their
|
||||
CLI programs appear only inside notice-bearing archives. The Windows ZIP and
|
||||
macOS DMG remain CLI-only.
|
||||
|
|
@ -241,8 +244,8 @@ DIST_DIR="$release_dir" RUN_CHECKS=1 packaging/build-dmg.sh
|
|||
The Windows ZIP (including its executable and notices) must be built and tested
|
||||
by the Windows job in `.github/workflows/cross-platform.yml`; it is not a
|
||||
cross-compiled release claim from a Linux build. No Wine result is retained as
|
||||
5.2.6 release evidence. Extended-length/device namespace paths, raw UNC output
|
||||
roots, and mapped/network-drive output are not supported in 5.2.6. Publish the
|
||||
5.2.7 release evidence. Extended-length/device namespace paths, raw UNC output
|
||||
roots, and mapped/network-drive output are not supported in 5.2.7. Publish the
|
||||
exact architecture recorded by the native job.
|
||||
These helpers create binary distribution artifacts for the release page, not
|
||||
content to be committed to Git or included in the source archive.
|
||||
|
|
@ -250,7 +253,7 @@ content to be committed to Git or included in the source archive.
|
|||
### AUR, Homebrew, Guix, and Nix
|
||||
|
||||
After calculating the final reproducible source archive, but before creating or
|
||||
publishing the immutable tag, update each recipe to version 5.2.6 and to the
|
||||
publishing the immutable tag, update each recipe to version 5.2.7 and to the
|
||||
exact digest or content hash expected by its package manager. These recipe
|
||||
directories are excluded from the source archive, so this does not create a
|
||||
checksum cycle. Commit the pinned recipes in the tagged tree, then build and
|
||||
|
|
@ -269,7 +272,7 @@ build.
|
|||
|
||||
For every published artifact:
|
||||
|
||||
1. start from the immutable `v5.2.6` tag;
|
||||
1. start from the immutable `v5.2.7` tag;
|
||||
2. keep `WITH_SDK=0 WITH_PQBOX=0` unless system dependencies are declared;
|
||||
3. record the exact OS, distribution release, architecture, and toolchain;
|
||||
4. run format validation plus installed `--version`, `--help`, and archive
|
||||
|
|
@ -287,7 +290,7 @@ than redirecting consumers to an unverified file.
|
|||
|
||||
## Downstream checklist
|
||||
|
||||
- [ ] The source URL resolves to the immutable `v5.2.6` tag.
|
||||
- [ ] The source URL resolves to the immutable `v5.2.7` tag.
|
||||
- [ ] The source archive passes `scripts/check-source-only.sh --archive`.
|
||||
- [ ] The recipe checksum matches the downloaded source exactly.
|
||||
- [ ] `WITH_SDK=0 WITH_PQBOX=0` is explicit, or system dependencies are complete.
|
||||
|
|
|
|||
24
INSTALL.md
24
INSTALL.md
|
|
@ -1,4 +1,4 @@
|
|||
# Installing ZUPT 5.2.6
|
||||
# Installing ZUPT 5.2.7
|
||||
|
||||
This guide covers the ZUPT command-line program and the optional Python GUI.
|
||||
The canonical source repository is
|
||||
|
|
@ -27,17 +27,19 @@ working-directory contract. This is release/test integration only; the product,
|
|||
archive format, cryptography, codec, and SDK ABI are unchanged. The immutable
|
||||
`v5.2.5` candidate was likewise not promoted: exact-tag GitHub Actions run
|
||||
`33434986357` recorded 13 successful jobs and failed native Windows/macOS jobs.
|
||||
Version 5.2.6 corrects the Windows byte-exact fixture and macOS secure-wipe/Bash
|
||||
3.2 portability defects, but those corrections still require fresh gates. Do
|
||||
not treat any prior candidate's artifacts or evidence as 5.2.6 packages or
|
||||
validation.
|
||||
The immutable `v5.2.6` candidate was not promoted after run `33442264243`
|
||||
recorded 13 successful jobs and two native failures: unused x86 SHA-NI helper
|
||||
declarations on macOS arm64 under `-Werror`, and early Windows abortion while
|
||||
argv-transcoding a safe UTF-8 fixture. Version 5.2.7 corrects those test-harness
|
||||
boundaries, but still requires fresh gates. Do not treat any prior candidate's
|
||||
artifacts or evidence as 5.2.7 packages or validation.
|
||||
|
||||
The 5.2.6 package set eligible for promotion after each target gate succeeds is:
|
||||
The 5.2.7 package set eligible for promotion after each target gate succeeds is:
|
||||
|
||||
| Component | Gated artifacts |
|
||||
|---|---|
|
||||
| CLI | `zupt-5.2.6.tar.gz`, `zupt_5.2.6_amd64.deb`, openSUSE x86_64 binary/source RPMs, `zupt-5.2.6-linux-x86_64.tar.xz`, `zupt-5.2.6-windows-x86_64.zip`, and `ZUPT-5.2.6-macOS-*.dmg` |
|
||||
| GUI | `zupt-gui_5.2.6_all.deb`, `zupt-gui-5.2.6-1.noarch.rpm`, `zupt-gui-5.2.6-1.src.rpm`, and `zupt-gui-5.2.6-portable.zip` |
|
||||
| CLI | `zupt-5.2.7.tar.gz`, `zupt_5.2.7_amd64.deb`, openSUSE x86_64 binary/source RPMs, `zupt-5.2.7-linux-x86_64.tar.xz`, `zupt-5.2.7-windows-x86_64.zip`, and `ZUPT-5.2.7-macOS-*.dmg` |
|
||||
| GUI | `zupt-gui_5.2.7_all.deb`, `zupt-gui-5.2.7-1.noarch.rpm`, `zupt-gui-5.2.7-1.src.rpm`, and `zupt-gui-5.2.7-portable.zip` |
|
||||
|
||||
The GUI packages require the matching `zupt` CLI package and must pass exact
|
||||
payload/dependency checks plus an installed off-screen GUI/CLI integration
|
||||
|
|
@ -45,7 +47,7 @@ test. The source-only portable GUI ZIP bundles launchers, notices, and GUI
|
|||
source, but not Python, Qt, or the CLI. The Linux tar.xz carries the tested CLI
|
||||
beside the complete public license/notice payload. AppImage, AppDir, Flatpak
|
||||
bundles, GUI platform installers, and bare Linux/Windows executables are not
|
||||
promoted for 5.2.6. The Windows ZIP and macOS DMG contain the CLI only. Exact
|
||||
promoted for 5.2.7. The Windows ZIP and macOS DMG contain the CLI only. Exact
|
||||
target boundaries are listed in `README.md`.
|
||||
The release's `SHA256SUMS` and validation notes, not the mere presence of a
|
||||
download link, identify an artifact that completed its gate.
|
||||
|
|
@ -82,7 +84,7 @@ sudo pacman -S base-devel gzip
|
|||
```
|
||||
|
||||
Package names can differ by distribution release. These commands are examples,
|
||||
not a statement that 5.2.6 has been accepted into each distribution repository.
|
||||
not a statement that 5.2.7 has been accepted into each distribution repository.
|
||||
|
||||
## Build and test from source
|
||||
|
||||
|
|
@ -102,7 +104,7 @@ From a release archive, run the scanner as follows before extraction or from a
|
|||
trusted checkout after download:
|
||||
|
||||
```sh
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.6.tar.gz
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
|
||||
```
|
||||
|
||||
The default build provides the native password, ML-KEM-768 + X25519 hybrid
|
||||
|
|
|
|||
104
README.md
104
README.md
|
|
@ -1,35 +1,41 @@
|
|||
# ZUPT 5.2.6
|
||||
# ZUPT 5.2.7
|
||||
|
||||
ZUPT is a command-line backup archiver written in C11. It combines the
|
||||
bundled VaptVupt compression codec with authenticated AES-256-CTR +
|
||||
HMAC-SHA256 encryption, native ML-KEM-768/X25519 hybrid encryption, archive
|
||||
integrity checks, multithreaded operation, and a Python/Qt graphical frontend.
|
||||
|
||||
Version 5.2.6 corrects portability defects exposed by the native release gates:
|
||||
macOS and NetBSD use the compiler-resistant volatile secure-wipe fallback
|
||||
instead of assuming an `explicit_bzero` symbol, the source-only scanner handles
|
||||
empty arrays under the system Bash 3.2, and the Windows hostile-path regression
|
||||
passes explicitly encoded bytes to its fixture. The immutable `v5.2.5`
|
||||
candidate was not promoted after exact-tag GitHub Actions run `33434986357`:
|
||||
13 jobs succeeded, while the native Windows and macOS jobs failed. This is a
|
||||
release/test integration correction; it does not change the archive format,
|
||||
cryptography, bundled codec, or SDK ABI. No v5.2.5 evidence transfers
|
||||
automatically to v5.2.6.
|
||||
Version 5.2.7 corrects two test-harness portability defects exposed after the
|
||||
immutable `v5.2.6` tag. Exact-tag GitHub Actions run `33442264243` completed 13
|
||||
jobs successfully, but the native macOS job failed because x86 SHA-NI test
|
||||
helper declarations were unused on arm64 under `-Werror`, and the native
|
||||
Windows job aborted while argv transcoding a safe UTF-8 fixture before its
|
||||
intended assertions. No 5.2.6 assets were promoted. These are release/test
|
||||
integration corrections; they do not change the archive format, cryptography,
|
||||
bundled codec, or SDK ABI. No v5.2.6 evidence transfers automatically to
|
||||
v5.2.7.
|
||||
|
||||
Version 5.2.2 restored the original ZUPT product name and the `zupt` command.
|
||||
The `.zupt` archive extension, format v1.6, magic bytes, codec identifiers, and
|
||||
SDK ABI remain unchanged. An optional `vaptvupt` command alias may be provided
|
||||
for scripts written against versions 3.0.0 through 5.2.1.
|
||||
|
||||
## Corrective changes in 5.2.6
|
||||
## Corrective changes in 5.2.7
|
||||
|
||||
Darwin and NetBSD now select the secure volatile wipe fallback supported by the
|
||||
existing portable implementation; scanner option/path arrays are guarded for
|
||||
Bash 3.2; and the Windows path fixture verifies requested bytes in the archive
|
||||
while rejecting each dangerous raw byte fragment from diagnostic output. All
|
||||
current release paths move to 5.2.6 and require fresh
|
||||
exact-tag hosted CI, package, native-platform, source-only, checksum, OBS, and
|
||||
promotion evidence. The `v5.2.5` tag remains immutable and unpromoted.
|
||||
The SHA-NI regression now keeps x86-only helper declarations out of unsupported
|
||||
arm64 builds, and the safe UTF-8 Windows fixture crosses the argv boundary in a
|
||||
byte-stable representation. All current release paths move to 5.2.7 and require
|
||||
fresh exact-tag hosted CI, package, native-platform, source-only, checksum, OBS,
|
||||
and promotion evidence. The `v5.2.6` tag remains immutable and unpromoted.
|
||||
|
||||
## Corrective changes introduced in 5.2.6
|
||||
|
||||
Darwin and NetBSD select the portable compiler-resistant secure-wipe fallback;
|
||||
scanner option/path arrays are guarded for Bash 3.2; and hostile Windows path
|
||||
fixtures use explicit bytes and reject dangerous raw diagnostic fragments.
|
||||
Those corrections changed release/test integration only. The resulting v5.2.6
|
||||
candidate was not promoted because its next exact-tag run exposed the distinct
|
||||
arm64 SHA-NI helper and safe UTF-8 Windows argv failures described above.
|
||||
|
||||
## Corrective changes introduced in 5.2.5
|
||||
|
||||
|
|
@ -145,9 +151,9 @@ users. Those assets must be built from the tagged source, tested on their target
|
|||
environment, and kept outside Git and the source archive. A format that was not
|
||||
built and tested is not presented as supported.
|
||||
|
||||
## 5.2.6 release artifacts
|
||||
## 5.2.7 release artifacts
|
||||
|
||||
The 5.2.6 release workflow is defined to produce the following files only after
|
||||
The 5.2.7 release workflow is defined to produce the following files only after
|
||||
the corresponding target gate succeeds. `SHA256SUMS` records the exact promoted
|
||||
filenames and digests. The release notes identify the tested commit and the
|
||||
manually dispatched CI run; that run's job definitions and logs are the runtime
|
||||
|
|
@ -156,23 +162,23 @@ skips. This table is not a substitute for that evidence.
|
|||
|
||||
| Format | Intended target and validation boundary |
|
||||
| --- | --- |
|
||||
| `zupt-5.2.6.tar.gz` | Reproducible, source-only archive; scanned twice-built input plus SHA-256. |
|
||||
| `zupt_5.2.6_amd64.deb` | Ubuntu 24.04 amd64 package; install, functional round trip, and uninstall gate. |
|
||||
| `zupt-5.2.6-*.x86_64.rpm` and `.src.rpm` | openSUSE Tumbleweed x86_64 source/binary RPM gate; package inspection, install, round trip, and uninstall. |
|
||||
| `zupt-5.2.6-linux-x86_64.tar.xz` | Linux x86_64 CLI plus the complete public license/notice payload; dependency allowlist and extracted-package functional gate. |
|
||||
| `zupt-gui_5.2.6_all.deb` | Architecture-independent Python/Qt GUI package; exact dependency/payload checks plus installed off-screen GUI/CLI integration gate. |
|
||||
| `zupt-gui-5.2.6-1.noarch.rpm` | Architecture-independent Python/Qt GUI RPM; package inspection plus installed off-screen GUI/CLI integration gate. |
|
||||
| `zupt-gui-5.2.6-1.src.rpm` | Source RPM corresponding exactly to the gated noarch GUI RPM. |
|
||||
| `zupt-gui-5.2.6-portable.zip` | Source-only GUI and launchers with licenses/provenance; source scan, exact member allowlist, and extracted off-screen GUI/CLI gate. |
|
||||
| `zupt-5.2.6-windows-x86_64.zip` | Native Windows x86_64 executable with notices; extracted-ZIP round-trip gate. |
|
||||
| `ZUPT-5.2.6-macOS-*.dmg` | Native macOS image; mounted packaged executable round-trip gate, with the actual architecture in the filename. |
|
||||
| `zupt-5.2.7.tar.gz` | Reproducible, source-only archive; scanned twice-built input plus SHA-256. |
|
||||
| `zupt_5.2.7_amd64.deb` | Ubuntu 24.04 amd64 package; install, functional round trip, and uninstall gate. |
|
||||
| `zupt-5.2.7-*.x86_64.rpm` and `.src.rpm` | openSUSE Tumbleweed x86_64 source/binary RPM gate; package inspection, install, round trip, and uninstall. |
|
||||
| `zupt-5.2.7-linux-x86_64.tar.xz` | Linux x86_64 CLI plus the complete public license/notice payload; dependency allowlist and extracted-package functional gate. |
|
||||
| `zupt-gui_5.2.7_all.deb` | Architecture-independent Python/Qt GUI package; exact dependency/payload checks plus installed off-screen GUI/CLI integration gate. |
|
||||
| `zupt-gui-5.2.7-1.noarch.rpm` | Architecture-independent Python/Qt GUI RPM; package inspection plus installed off-screen GUI/CLI integration gate. |
|
||||
| `zupt-gui-5.2.7-1.src.rpm` | Source RPM corresponding exactly to the gated noarch GUI RPM. |
|
||||
| `zupt-gui-5.2.7-portable.zip` | Source-only GUI and launchers with licenses/provenance; source scan, exact member allowlist, and extracted off-screen GUI/CLI gate. |
|
||||
| `zupt-5.2.7-windows-x86_64.zip` | Native Windows x86_64 executable with notices; extracted-ZIP round-trip gate. |
|
||||
| `ZUPT-5.2.7-macOS-*.dmg` | Native macOS image; mounted packaged executable round-trip gate, with the actual architecture in the filename. |
|
||||
|
||||
An asset absent from the release was not promoted through its mandatory gate.
|
||||
Do not infer support for another distribution release, OS version, CPU
|
||||
architecture, raw UNC/SMB destination, or package manager from a similarly
|
||||
named file. Binary assets are release outputs, never source-build inputs.
|
||||
|
||||
No AppImage is promised for 5.2.6. The inspected upstream type-2 runtime lacked
|
||||
No AppImage is promised for 5.2.7. The inspected upstream type-2 runtime lacked
|
||||
a complete notice/source-relink handoff for every statically linked component,
|
||||
so redistributing it would not meet this release's provenance gate. AppDir and
|
||||
Flatpak bundles and GUI platform installers are likewise outside the promoted
|
||||
|
|
@ -202,8 +208,8 @@ bash tests/test_source_only.sh
|
|||
For a tag or an existing source archive:
|
||||
|
||||
~~~sh
|
||||
bash scripts/check-source-only.sh --tag v5.2.6
|
||||
bash scripts/check-source-only.sh --archive /path/to/zupt-5.2.6.tar.gz
|
||||
bash scripts/check-source-only.sh --tag v5.2.7
|
||||
bash scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
|
||||
~~~
|
||||
|
||||
Unknown `.bin` files fail the scan. A necessary binary data fixture may be
|
||||
|
|
@ -339,7 +345,7 @@ sanitizer-detected crash. An earlier off-screen GUI smoke run remains supporting
|
|||
evidence rather than an exact-candidate package result.
|
||||
|
||||
Those results are historical upstream self-audit evidence, not independent
|
||||
certification and not 5.2.6 results. Post-tag CI integration failures prevented
|
||||
certification and not 5.2.7 results. Post-tag CI integration failures prevented
|
||||
5.2.2 promotion. The immutable 5.2.3 candidate was also not promoted because its
|
||||
source-policy test assumed LF for a `.bat` checkout that correctly used CRLF.
|
||||
The immutable v5.2.4 candidate then recorded 12 successful jobs in exact-tag CI
|
||||
|
|
@ -347,18 +353,20 @@ run `33431386002`; the sole openSUSE service-harness job failed because the
|
|||
standalone executor did not enter its service directory, so dependent Windows
|
||||
and macOS jobs were skipped. A local Tumbleweed reproduction proved the explicit
|
||||
tag ref and corrected working-directory contract, but neither that reproduction
|
||||
nor the successful v5.2.4 jobs are v5.2.6 evidence. The immutable v5.2.5
|
||||
nor the successful v5.2.4 jobs are v5.2.7 evidence. The immutable v5.2.5
|
||||
candidate was not promoted after exact-tag GitHub Actions run `33434986357`:
|
||||
13 jobs succeeded, but the native Windows hostile-path fixture and macOS
|
||||
build/check gate failed. The corrective byte-exact fixture, portable secure-wipe
|
||||
fallback, and Bash 3.2 array handling therefore require new 5.2.6 evidence. The
|
||||
exact 5.2.6 candidate must repeat all required gates. Native Windows and macOS,
|
||||
build/check gate failed. Their 5.2.6 corrections were followed by exact-tag run
|
||||
`33442264243`, which also completed 13 jobs successfully but failed native
|
||||
macOS on arm64-unused SHA-NI helper declarations under `-Werror` and native
|
||||
Windows during safe UTF-8 fixture argv transcoding. The immutable v5.2.6 tag was
|
||||
not promoted. The exact 5.2.7 candidate must repeat all required gates. Native Windows and macOS,
|
||||
hosted GitHub CI/release promotion, authenticated OBS, and resolution of the
|
||||
openSUSE automatic `debugsource` rpmlint `no-binary`
|
||||
finding remain pending until recorded otherwise. Unexecuted gates are `SKIP`,
|
||||
never `PASS`.
|
||||
|
||||
On Windows, 5.2.6 scopes output handling to normal local Win32 paths. A MinGW
|
||||
On Windows, 5.2.7 scopes output handling to normal local Win32 paths. A MinGW
|
||||
cross-build or Wine run is not native-Windows evidence; the `windows-latest`
|
||||
package job, including its Unicode round trip, remains a mandatory publication
|
||||
gate. Win32 extended-length and device-namespace paths, raw UNC output roots
|
||||
|
|
@ -380,7 +388,7 @@ downgrading authentication of header and footer metadata.
|
|||
`disk restore`, and exists only to recover a known, trusted archive created
|
||||
before AIT was introduced. Do not use that override for an archive from
|
||||
untrusted or attacker-writable storage; verify and migrate the recovered data to
|
||||
a newly created 5.2.6 archive. Compression and disk backup never create a
|
||||
a newly created 5.2.7 archive. Compression and disk backup never create a
|
||||
no-AIT archive.
|
||||
|
||||
`info` is deliberately different: it reports unauthenticated framing metadata,
|
||||
|
|
@ -398,7 +406,7 @@ lists, tests, extracts, and restores it byte-exact. The full local Linux gate
|
|||
passed on commit `ff99770`. This is not a claim that a 5.2.1 reader understands every new
|
||||
flag-gated 5.2.2 encoding or that every historical combination was tested.
|
||||
|
||||
The candidate commands and outcome fields for 5.2.6 are maintained in the
|
||||
The candidate commands and outcome fields for 5.2.7 are maintained in the
|
||||
release handoff and
|
||||
[packaging/opensuse/README.md](packaging/opensuse/README.md). They must be
|
||||
updated from the final release candidate before tagging. No architecture or
|
||||
|
|
@ -410,9 +418,9 @@ Generate the reproducible source archive outside the repository:
|
|||
|
||||
~~~sh
|
||||
make dist
|
||||
sha256sum /tmp/zupt-5.2.6.tar.gz
|
||||
sha256sum /tmp/zupt-5.2.7.tar.gz
|
||||
bash scripts/check-source-only.sh \
|
||||
--archive /tmp/zupt-5.2.6.tar.gz
|
||||
--archive /tmp/zupt-5.2.7.tar.gz
|
||||
~~~
|
||||
|
||||
Archive ordering, ownership and timestamps are normalized. The default epoch is
|
||||
|
|
@ -428,7 +436,7 @@ final digest before the tag is published.
|
|||
## openSUSE and OBS
|
||||
|
||||
The maintained upstream recipe is in packaging/opensuse. It is prepared for an
|
||||
immutable v5.2.6 tag, disables submodules and Git LFS, builds with
|
||||
immutable v5.2.7 tag, disables submodules and Git LFS, builds with
|
||||
WITH_SDK=0 WITH_PQBOX=0, runs real checks, and installs without the renamed-era
|
||||
`vaptvupt` alias.
|
||||
|
||||
|
|
@ -471,7 +479,7 @@ The optional GUI is under `gui/`. It invokes the `zupt` CLI and needs Python 3
|
|||
plus PySide6 or PyQt6. GUI image assets are data files whose purpose,
|
||||
provenance and license are recorded in [gui/assets/README.md](gui/assets/README.md).
|
||||
The integrated source and lightweight consistency checks do not constitute a
|
||||
target-native audit of every historical GUI format. The 5.2.6 artifact promise
|
||||
target-native audit of every historical GUI format. The 5.2.7 artifact promise
|
||||
is limited to the gated GUI DEB, noarch/source RPM, and source-only portable ZIP
|
||||
listed above; AppImage, AppDir, Flatpak bundles, and platform GUI installers
|
||||
remain excluded.
|
||||
|
|
@ -481,13 +489,13 @@ remain excluded.
|
|||
Cristian Cezar Moisés is the creator and current upstream maintainer of ZUPT and
|
||||
the author of the current upstream source, build, test, documentation, and
|
||||
packaging changes, including the 5.2.2 baseline and corrective
|
||||
5.2.3/5.2.4/5.2.5/5.2.6 work.
|
||||
5.2.3/5.2.4/5.2.5/5.2.6/5.2.7 work.
|
||||
|
||||
Alessandro de Oliveira Faria (Cabelo) is credited as the openSUSE collaborator
|
||||
and downstream package maintainer. He reviews the handoff, commits it in the
|
||||
OBS project he maintains, and may make the additional openSUSE-side adjustments
|
||||
he considers necessary. That downstream role is not attribution of ZUPT source
|
||||
authorship or of the upstream 5.2.2, 5.2.3, 5.2.4, 5.2.5, or 5.2.6 changes.
|
||||
authorship or of the upstream 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, or 5.2.7 changes.
|
||||
|
||||
## License
|
||||
|
||||
|
|
|
|||
30
SECURITY.md
30
SECURITY.md
|
|
@ -1,4 +1,4 @@
|
|||
# Security Policy — ZUPT 5.2.6
|
||||
# Security Policy — ZUPT 5.2.7
|
||||
|
||||
## Reporting vulnerabilities
|
||||
|
||||
|
|
@ -66,7 +66,7 @@ partially accepted.
|
|||
|
||||
### Optional integrations
|
||||
|
||||
The 5.2.6 default is `WITH_SDK=0 WITH_PQBOX=0`:
|
||||
The 5.2.7 default is `WITH_SDK=0 WITH_PQBOX=0`:
|
||||
|
||||
- `WITH_SDK=1` enables libvuptsdk-backed features, including the SDK PQ mode
|
||||
and Argon2id support, using a separately installed system development package.
|
||||
|
|
@ -133,7 +133,7 @@ can compromise archives encrypted to it.
|
|||
|
||||
## Constant-time and side-channel scope
|
||||
|
||||
Portable C is the 5.2.6 default. Sensitive comparisons and selections use
|
||||
Portable C is the 5.2.7 default. Sensitive comparisons and selections use
|
||||
branchless helpers, but generated machine-code behavior remains dependent on
|
||||
the compiler and platform. This is not a formal whole-program constant-time
|
||||
claim. The C AES implementation uses table lookups and is unsuitable for a
|
||||
|
|
@ -204,7 +204,7 @@ media before proceeding.
|
|||
|
||||
The Windows handle-relative implementation is scoped to normal local Win32
|
||||
paths. Win32 extended-length and device-namespace paths, raw UNC output roots,
|
||||
and mapped/network-drive output are not supported in 5.2.6. Cross-build and
|
||||
and mapped/network-drive output are not supported in 5.2.7. Cross-build and
|
||||
Wine results are not native-Windows evidence; the `windows-latest` package gate
|
||||
must pass its Unicode round trip before Windows assets are published. Restore
|
||||
to a normal local directory first and move verified output to network storage
|
||||
|
|
@ -247,7 +247,7 @@ shared/static library, or distribution package. Audit them with:
|
|||
|
||||
```sh
|
||||
scripts/check-source-only.sh
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.6.tar.gz
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
|
||||
```
|
||||
|
||||
Nested archive inspection is required to enforce bounded recursion, member
|
||||
|
|
@ -257,13 +257,13 @@ limit violations. On commit `ff99770`, the source-only scanner suite passed
|
|||
|
||||
DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI
|
||||
ZIP, Windows ZIP, and macOS DMG release assets are separate outputs. An
|
||||
AppImage is not promoted for 5.2.6. A bare Linux or Windows executable is also
|
||||
AppImage is not promoted for 5.2.7. A bare Linux or Windows executable is also
|
||||
excluded; executables are distributed only inside their notice-bearing
|
||||
archives. Trust an artifact only when its exact format has a recorded build,
|
||||
content/metadata inspection, extracted or installed smoke test, and applicable
|
||||
archive round trip. Never treat an unexecuted platform as passing.
|
||||
|
||||
The gated 5.2.6 set is the CLI package/archive set plus the exact GUI DEB,
|
||||
The gated 5.2.7 set is the CLI package/archive set plus the exact GUI DEB,
|
||||
noarch/source RPM, and source-only portable ZIP documented in the README. The
|
||||
portable GUI ZIP contains no compiled runtime and is scanned as source before
|
||||
and after extraction. Other GUI packages, AppImage, AppDir and Flatpak bundles,
|
||||
|
|
@ -303,7 +303,7 @@ result.
|
|||
|
||||
Post-tag CI integration failures prevented 5.2.2 promotion. Those upstream
|
||||
self-audit results are not independent certification and do not transfer to
|
||||
5.2.6. The immutable 5.2.3 candidate was not promoted because its source-policy
|
||||
5.2.7. The immutable 5.2.3 candidate was not promoted because its source-policy
|
||||
test assumed LF for a Windows `.bat` file checked out as CRLF. The immutable
|
||||
v5.2.4 candidate was not promoted after exact-tag GitHub Actions run
|
||||
`33431386002`: 12 jobs succeeded, the sole openSUSE job failed in its
|
||||
|
|
@ -313,14 +313,18 @@ Tumbleweed reproduction confirmed that `refs/tags/v5.2.4` is valid and that
|
|||
`os.chdir(service_dir)` lets `obs_scm`, `tar`, and `recompress` complete with a
|
||||
source-scanned archive. This was a release/test integration defect, not a
|
||||
product, archive, cryptographic, codec, or SDK ABI change, and its evidence does
|
||||
not transfer automatically to 5.2.6. The immutable v5.2.5 candidate was also
|
||||
not transfer automatically to 5.2.7. The immutable v5.2.5 candidate was also
|
||||
not promoted: exact-tag GitHub Actions run `33434986357` recorded 13 successful
|
||||
jobs and failed native Windows/macOS jobs. Its Windows fixture-byte and macOS
|
||||
secure-wipe/Bash 3.2 defects are corrected for 5.2.6, but those changes have not
|
||||
yet passed exact-5.2.6 hosted or native gates. A targeted clean-clone run of the
|
||||
corrected scanner under genuine GNU Bash 3.2.57 passed repository, standalone
|
||||
secure-wipe/Bash 3.2 defects were corrected for 5.2.6. A targeted clean-clone
|
||||
run of the corrected scanner under genuine GNU Bash 3.2.57 passed repository, standalone
|
||||
tree, standalone archive, and root-plus-tag modes; that local compatibility
|
||||
result does not transfer to any other gate. The exact 5.2.6 candidate must
|
||||
result does not transfer to any other gate. Exact-tag v5.2.6 run `33442264243`
|
||||
then completed 13 jobs successfully but failed native macOS because x86 SHA-NI
|
||||
test helpers were unused on arm64 under `-Werror`, and failed native Windows
|
||||
when argv transcoding aborted the safe UTF-8 fixture. Those are test-harness
|
||||
integration defects, not product, archive, cryptographic, codec, or SDK ABI
|
||||
changes; v5.2.6 remained unpromoted. The exact 5.2.7 candidate must
|
||||
repeat the required suite. Native Windows and macOS, hosted GitHub CI/release
|
||||
promotion, authenticated OBS, and the openSUSE automatic `debugsource` rpmlint
|
||||
`no-binary` finding remain pending until recorded otherwise. An unavailable or
|
||||
|
|
|
|||
|
|
@ -159,7 +159,7 @@ grant attached to their unchanged Git blobs, are recorded in
|
|||
|
||||
## AppImage type-2 runtime
|
||||
|
||||
No AppImage is a promised or promoted 5.2.6 release asset. The upstream
|
||||
No AppImage is a promised or promoted 5.2.7 release asset. The upstream
|
||||
type-2 runtime inspected during the 5.2.2 review statically linked musl, libfuse,
|
||||
squashfuse, zstd, zlib, and mimalloc, but its own license notice did not list
|
||||
mimalloc and the available release inputs did not provide a complete
|
||||
|
|
@ -171,7 +171,7 @@ no network input and requires the operator to supply both a locally verified
|
|||
runtime and `APPIMAGE_RUNTIME_COMPLIANCE_FILE`, containing the license notices,
|
||||
source correspondence or offer, and relink information applicable to those
|
||||
exact runtime bytes. An artifact produced independently with that helper is
|
||||
not covered by the 5.2.6 upstream release gates.
|
||||
not covered by the 5.2.7 upstream release gates.
|
||||
|
||||
## Reporting attribution issues
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# ZUPT 5.2.6 threat model
|
||||
# ZUPT 5.2.7 threat model
|
||||
|
||||
This document defines the security boundary of the ZUPT archive tool. It is
|
||||
not a certification, a guarantee against every hostile input, or a substitute
|
||||
|
|
@ -17,7 +17,7 @@ plausibly deniable.
|
|||
|
||||
## Baseline considered here
|
||||
|
||||
The upstream baseline is built from the 5.2.6 source with:
|
||||
The upstream baseline is built from the 5.2.7 source with:
|
||||
|
||||
```sh
|
||||
make WITH_SDK=0 WITH_PQBOX=0
|
||||
|
|
@ -175,7 +175,7 @@ temporary through its descriptor or handle. These controls reduce traversal,
|
|||
link, race, and partial-output risks, but do not establish that no parser or
|
||||
filesystem bug can exist.
|
||||
|
||||
The Windows handle-relative boundary in 5.2.6 covers normal local Win32 paths.
|
||||
The Windows handle-relative boundary in 5.2.7 covers normal local Win32 paths.
|
||||
Win32 extended-length and device-namespace paths, raw UNC output roots, and
|
||||
mapped/network-drive output are not supported. Cross-build and Wine results are
|
||||
not a substitute for the required native `windows-latest` Unicode package
|
||||
|
|
@ -250,9 +250,9 @@ tagged source. Each artifact extends the trust boundary to its builder,
|
|||
toolchain, runner image, and packaging scripts. Treat it as validated only when
|
||||
the exact target has a recorded build, content/package inspection, extracted or
|
||||
installed smoke test, and applicable archive round trip. An AppImage is not
|
||||
promoted for 5.2.6; bare Linux and Windows executables are also excluded.
|
||||
promoted for 5.2.7; bare Linux and Windows executables are also excluded.
|
||||
|
||||
For 5.2.6, that gated artifact scope covers the CLI files plus the exact GUI
|
||||
For 5.2.7, that gated artifact scope covers the CLI files plus the exact GUI
|
||||
DEB, noarch/source RPM, and source-only portable ZIP named in the README. The
|
||||
portable ZIP contains no compiled runtime and crosses the release boundary only
|
||||
after source scans and an exact safe-member check. AppDir and Flatpak bundles
|
||||
|
|
@ -265,7 +265,7 @@ strict Clang, GCC `-fanalyzer`, the 9/9 tool-enabled static-analysis run,
|
|||
ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations passed. Earlier off-screen
|
||||
GUI smoke evidence is retained separately. Post-tag CI integration failures
|
||||
prevented 5.2.2 promotion. This upstream self-review is not an independent
|
||||
certification and is not 5.2.6 evidence. The immutable 5.2.3 candidate was not
|
||||
certification and is not 5.2.7 evidence. The immutable 5.2.3 candidate was not
|
||||
promoted because its source-policy test assumed LF for a Windows `.bat` checkout
|
||||
that correctly used CRLF. The immutable v5.2.4 candidate was not promoted after
|
||||
exact-tag GitHub Actions run `33431386002`: 12 jobs succeeded, the sole openSUSE
|
||||
|
|
@ -275,13 +275,17 @@ Tumbleweed reproduction established that the explicit `refs/tags/v5.2.4`
|
|||
revision works and that `os.chdir(service_dir)` completes the source-service
|
||||
chain. This narrows the failure to release/test integration; it changes no
|
||||
product, archive, cryptographic, codec, or SDK ABI boundary and supplies no
|
||||
automatic 5.2.6 evidence. The immutable v5.2.5 candidate was not promoted after
|
||||
automatic 5.2.7 evidence. The immutable v5.2.5 candidate was not promoted after
|
||||
exact-tag GitHub Actions run `33434986357`: 13 jobs succeeded, but native
|
||||
Windows and macOS failed on fixture-byte preservation and Darwin/Bash 3.2
|
||||
portability respectively. The corresponding 5.2.6 corrections do not establish
|
||||
portability respectively. The corresponding 5.2.6 corrections were followed by
|
||||
exact-tag run `33442264243`: 13 jobs succeeded, while native macOS failed on
|
||||
x86-only SHA-NI helper declarations unused on arm64 under `-Werror`, and native
|
||||
Windows aborted during safe UTF-8 fixture argv transcoding. The v5.2.6 tag was
|
||||
not promoted. The corresponding 5.2.7 test-harness corrections do not establish
|
||||
their own test result. Hosted GitHub CI and release promotion, native
|
||||
Windows/macOS, authenticated OBS, and the openSUSE automatic `debugsource`
|
||||
rpmlint `no-binary` finding remain pending until an exact 5.2.6 candidate
|
||||
rpmlint `no-binary` finding remain pending until an exact 5.2.7 candidate
|
||||
records them.
|
||||
|
||||
## Historical compatibility notes
|
||||
|
|
@ -309,7 +313,7 @@ These are historical facts about earlier releases, retained to support recovery:
|
|||
combinations remain unclaimed.
|
||||
|
||||
Historical test counts in the changelog describe those releases. They do not
|
||||
automatically become 5.2.6 results; current outcomes belong in the release
|
||||
automatically become 5.2.7 results; current outcomes belong in the release
|
||||
validation record, with unavailable environments marked `SKIP`. In particular,
|
||||
runs made before the final positional-AAD and mandatory-AIT changes are not
|
||||
final release gates for the resulting candidate.
|
||||
|
|
@ -320,4 +324,4 @@ Email **zupt@riseup.net** with `[security]` in the subject. Include the version,
|
|||
platform, impact, and a minimal non-sensitive reproducer. Do not disclose the
|
||||
issue publicly until a coordinated timeline has been agreed.
|
||||
|
||||
Document version: 5.2.6, 2026-08-31.
|
||||
Document version: 5.2.7, 2026-08-31.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
.\" SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
.\" Copyright (c) 2025-2026 Cristian Cezar Moisés
|
||||
.TH ZUPT-GUI 1 "2026-08-31" "ZUPT 5.2.6" "User Commands"
|
||||
.TH ZUPT-GUI 1 "2026-08-31" "ZUPT 5.2.7" "User Commands"
|
||||
.SH NAME
|
||||
zupt-gui \- Qt interface for the ZUPT backup utility
|
||||
.SH SYNOPSIS
|
||||
|
|
@ -47,7 +47,7 @@ or
|
|||
only when libvuptsdk or libpqvaptvupt is independently reported enabled.
|
||||
These two optional integrations are detected separately.
|
||||
.PP
|
||||
The gated 5.2.6 GUI release set is limited to the architecture-independent DEB,
|
||||
The gated 5.2.7 GUI release set is limited to the architecture-independent DEB,
|
||||
noarch/source RPM, and source-only portable ZIP named in the project README.
|
||||
Package gates require exact checks and installed off-screen GUI/CLI integration.
|
||||
The portable ZIP receives source scans, an exact safe-member allowlist, and an
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
.\" SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
.\" Copyright (c) 2025-2026 Cristian Cezar Moisés
|
||||
.TH ZUPT 1 "2026-08-31" "ZUPT 5.2.6" "User Commands"
|
||||
.TH ZUPT 1 "2026-08-31" "ZUPT 5.2.7" "User Commands"
|
||||
.
|
||||
.SH NAME
|
||||
zupt \- source-built backup compression and authenticated-encryption utility
|
||||
|
|
@ -89,7 +89,7 @@ Git and the upstream source tarball are source-only. Separately built CLI DEB,
|
|||
binary RPM, SRPM, notice-bearing Linux tar.xz, Windows ZIP, and macOS DMG assets
|
||||
may be published from the immutable tag only after their target-specific gates
|
||||
pass; they never enter Git or the source tarball. An AppImage is not promoted
|
||||
for 5.2.6; neither are AppDir/Flatpak bundles, GUI platform installers, or bare
|
||||
for 5.2.7; neither are AppDir/Flatpak bundles, GUI platform installers, or bare
|
||||
Linux/Windows executables. The Python/Qt frontend remains available as source;
|
||||
its gated architecture-independent DEB, noarch/source RPM, and source-only
|
||||
portable ZIP are included in the release claim. The portable ZIP contains no
|
||||
|
|
@ -477,7 +477,7 @@ then traverse below a pinned directory descriptor with no-follow operations.
|
|||
Windows builds use handle-relative traversal and
|
||||
no-replace publication for normal local Win32 destinations. Extended-length and
|
||||
device-namespace paths, raw UNC output roots, and mapped/network-drive output
|
||||
are not supported in 5.2.6. Cross-compilation and Wine results are not native
|
||||
are not supported in 5.2.7. Cross-compilation and Wine results are not native
|
||||
Windows evidence; the native Windows package gate, including its Unicode round
|
||||
trip, is separate and mandatory before publication.
|
||||
.
|
||||
|
|
@ -577,7 +577,7 @@ and the encrypted-dedup linear AAD sequence published through 5.2.1. The narrow
|
|||
compatibility fixture is an actual v5.2.1 password-encrypted
|
||||
DATA/DATA/REF/DATA disk archive stored as hexadecimal text with source and hash
|
||||
provenance. The candidate lists, tests, extracts, and restores that fixture
|
||||
byte-exact. The exact 5.2.6 candidate must repeat the gate. It does not imply
|
||||
byte-exact. The exact 5.2.7 candidate must repeat the gate. It does not imply
|
||||
that a 5.2.1 reader
|
||||
accepts every new 5.2.2 archive or that every historical encrypted mode was
|
||||
retested.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# ZUPT GUI
|
||||
|
||||
The ZUPT GUI is a Python/Qt front end for the ZUPT 5.2.6 command-line
|
||||
The ZUPT GUI is a Python/Qt front end for the ZUPT 5.2.7 command-line
|
||||
program. It starts the CLI as a subprocess; compression, archive parsing, and
|
||||
cryptography remain in the C program.
|
||||
|
||||
|
|
@ -83,10 +83,10 @@ operating systems and must be tested on the target system.
|
|||
Release pages provide only these GUI artifacts after their separate package and
|
||||
installed off-screen GUI/CLI integration gates pass:
|
||||
|
||||
- `zupt-gui_5.2.6_all.deb`;
|
||||
- `zupt-gui-5.2.6-1.noarch.rpm`;
|
||||
- `zupt-gui-5.2.6-1.src.rpm`;
|
||||
- `zupt-gui-5.2.6-portable.zip`.
|
||||
- `zupt-gui_5.2.7_all.deb`;
|
||||
- `zupt-gui-5.2.7-1.noarch.rpm`;
|
||||
- `zupt-gui-5.2.7-1.src.rpm`;
|
||||
- `zupt-gui-5.2.7-portable.zip`.
|
||||
|
||||
The DEB/RPM packages install the Python/Qt source and depend on the matching
|
||||
`zupt` CLI package. The portable ZIP contains source, launchers, icons, licenses,
|
||||
|
|
@ -97,7 +97,7 @@ An absent artifact did not pass its gate and must not be inferred from another
|
|||
format's result.
|
||||
|
||||
GUI AppImage, AppDir and Flatpak bundles, and Windows/macOS GUI installers are
|
||||
not promoted by the upstream 5.2.6 release gates.
|
||||
not promoted by the upstream 5.2.7 release gates.
|
||||
`packaging/build-gui-appimage.sh` is a downstream-only helper and fails unless
|
||||
its operator supplies the exact verified runtime plus a complete
|
||||
license/source-relink notice through `APPIMAGE_RUNTIME_COMPLIANCE_FILE`; that
|
||||
|
|
@ -110,7 +110,7 @@ notices. It fails unless the directory also has non-empty
|
|||
`PYTHON-NOTICE.txt`, `PYINSTALLER-NOTICE.txt`, `QT-NOTICE.txt`, and either
|
||||
`PYSIDE6-NOTICE.txt` or `PYQT6-NOTICE.txt`. The installer includes that
|
||||
directory together with every ZUPT license and notice. This requirement does
|
||||
not make the untested GUI installer a 5.2.6 release asset. The promoted Windows
|
||||
not make the untested GUI installer a 5.2.7 release asset. The promoted Windows
|
||||
ZIP and macOS DMG are CLI-only.
|
||||
|
||||
Packaging recipes and scripts under `gui/packaging/` and `packaging/` are build
|
||||
|
|
|
|||
|
|
@ -1,9 +1,9 @@
|
|||
Package: zupt-gui
|
||||
Version: 5.2.6
|
||||
Version: 5.2.7
|
||||
Section: utils
|
||||
Priority: optional
|
||||
Architecture: all
|
||||
Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= 5.2.6)
|
||||
Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= 5.2.7)
|
||||
Maintainer: Cristian Cezar Moisés <sac@securityops.co>
|
||||
Homepage: https://github.com/cristiancmoises/zupt
|
||||
Description: Qt graphical interface for the ZUPT backup utility
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ rem runtime files embedded by this local build.
|
|||
setlocal EnableExtensions
|
||||
for %%I in ("%~dp0\..\..\..") do set "REPO_ROOT=%%~fI"
|
||||
set "VERSION=%~1"
|
||||
if not defined VERSION set "VERSION=5.2.6"
|
||||
if not defined VERSION set "VERSION=5.2.7"
|
||||
if not defined ZUPT_DIST_DIR set "ZUPT_DIST_DIR=%TEMP%\zupt-release"
|
||||
if not defined ZUPT_CLI_EXE set "ZUPT_CLI_EXE=%REPO_ROOT%\zupt.exe"
|
||||
set "WORK=%TEMP%\zupt-gui-build-%RANDOM%-%RANDOM%"
|
||||
|
|
|
|||
|
|
@ -121,7 +121,8 @@ static inline int zupt_win_mkdir_utf8(const char *path) {
|
|||
/* v5.2.4 makes package metadata checks CRLF-safe; format remains v1.6. */
|
||||
/* v5.2.5 corrects the OBS service harness cwd; format remains v1.6. */
|
||||
/* v5.2.6 corrects native release-gate portability; format remains v1.6. */
|
||||
#define ZUPT_VERSION_STRING "5.2.6"
|
||||
/* v5.2.7 corrects native test-harness portability; format remains v1.6. */
|
||||
#define ZUPT_VERSION_STRING "5.2.7"
|
||||
/* Vendored codec release (upstream tag) — single source for display strings.
|
||||
* The codec's own VV_VERSION_* is its internal API version, not the release. */
|
||||
#define ZUPT_CODEC_RELEASE "2.65.3"
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
set -Eeuo pipefail
|
||||
umask 077
|
||||
|
||||
VERSION=${VERSION:-5.2.6}
|
||||
VERSION=${VERSION:-5.2.7}
|
||||
PREFIX=${PREFIX:-/usr/local}
|
||||
|
||||
echo "🔧 Installing ZUPT..."
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
# Test locally with `makepkg -s` after the release archive is published.
|
||||
|
||||
pkgname=zupt
|
||||
pkgver=5.2.6
|
||||
pkgver=5.2.7
|
||||
pkgrel=1
|
||||
pkgdesc='Pure-C11 post-quantum backup compression utility (AES-256-CTR + HMAC-SHA256 + ML-KEM-768 + X25519)'
|
||||
arch=('x86_64')
|
||||
|
|
@ -22,7 +22,7 @@ makedepends=('gcc' 'git' 'make')
|
|||
checkdepends=('python')
|
||||
|
||||
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/cristiancmoises/zupt/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
|
||||
# Byte-reproducible upstream v5.2.6 source archive.
|
||||
# Byte-reproducible upstream v5.2.7 source archive.
|
||||
sha256sums=('e64bd92aac1b50018efd3c8b678c70771320a2069d47f32c03349c569100b27c')
|
||||
|
||||
build() {
|
||||
|
|
|
|||
|
|
@ -1,3 +1,13 @@
|
|||
zupt (5.2.7-1) UNRELEASED; urgency=medium
|
||||
|
||||
* Scope SHA-NI test helpers to supported x86 builds so macOS arm64 strict
|
||||
compilation does not fail on unused declarations.
|
||||
* Preserve safe UTF-8 fixture bytes across the Windows argv boundary.
|
||||
* Preserve the immutable, unpromoted 5.2.6 history and require fresh 5.2.7
|
||||
package, checksum, native-platform, OBS, and promotion gates.
|
||||
|
||||
-- Cristian Cezar Moisés <sac@securityops.co> Mon, 31 Aug 2026 23:00:00 +0000
|
||||
|
||||
zupt (5.2.6-1) UNRELEASED; urgency=medium
|
||||
|
||||
* Use the compiler-resistant volatile wipe fallback on macOS and NetBSD, and
|
||||
|
|
|
|||
|
|
@ -62,7 +62,7 @@
|
|||
xcb-util-renderutil xcb-util-wm xcb-util-cursor
|
||||
libinput-minimal mtdev libevdev eudev))
|
||||
|
||||
(define %zupt-version "5.2.6")
|
||||
(define %zupt-version "5.2.7")
|
||||
|
||||
(define %zupt-source
|
||||
(origin
|
||||
|
|
|
|||
|
|
@ -22,8 +22,8 @@
|
|||
class Zupt < Formula
|
||||
desc "Post-quantum backup compression utility (ML-KEM-768 + AES-256-CTR + HMAC-SHA256)"
|
||||
homepage "https://github.com/cristiancmoises/zupt"
|
||||
url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.6/zupt-5.2.6.tar.gz"
|
||||
version "5.2.6"
|
||||
url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.7/zupt-5.2.7.tar.gz"
|
||||
version "5.2.7"
|
||||
sha256 "e64bd92aac1b50018efd3c8b678c70771320a2069d47f32c03349c569100b27c"
|
||||
license all_of: ["AGPL-3.0-or-later", "GPL-3.0-or-later", "BSD-2-Clause", "BSD-3-Clause", "CC0-1.0"]
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
# nix flake check # lint the flake
|
||||
#
|
||||
# To consume from another flake:
|
||||
# inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.6";
|
||||
# inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.7";
|
||||
# ...packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt;
|
||||
#
|
||||
# `make dist` has its own reproducibility gate. This development flake has no
|
||||
|
|
@ -30,7 +30,7 @@
|
|||
|
||||
zupt = pkgs.stdenv.mkDerivation {
|
||||
pname = "zupt";
|
||||
version = "5.2.6";
|
||||
version = "5.2.7";
|
||||
|
||||
# When publishing, replace this with `fetchurl` against the
|
||||
# release tarball. For local development the flake assumes it
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# ZUPT 5.2.6 for openSUSE Build Service
|
||||
# ZUPT 5.2.7 for openSUSE Build Service
|
||||
|
||||
This directory is the upstream, source-only OBS recipe for ZUPT. It is a
|
||||
handoff for the downstream maintainer; its presence does not mean that the
|
||||
|
|
@ -10,14 +10,14 @@ changes in this handoff. Alessandro de Oliveira Faria (Cabelo) is credited only
|
|||
as the openSUSE collaborator and downstream OBS package maintainer: he reviews
|
||||
the handoff, commits it through the portal/project he maintains, and may make
|
||||
the openSUSE-side adjustments he considers necessary. This role does not
|
||||
attribute upstream code or the 5.2.2/5.2.3/5.2.4/5.2.5/5.2.6 upstream changes to
|
||||
attribute upstream code or the 5.2.2/5.2.3/5.2.4/5.2.5/5.2.6/5.2.7 upstream changes to
|
||||
Cabelo.
|
||||
|
||||
## Files and source policy
|
||||
|
||||
| File | Purpose |
|
||||
|---|---|
|
||||
| `_service` | Fetch the immutable `v5.2.6` tag and create `Source0` at build time. |
|
||||
| `_service` | Fetch the immutable `v5.2.7` tag and create `Source0` at build time. |
|
||||
| `zupt.spec` | Build and test the CLI with optional external system integrations disabled. |
|
||||
| `zupt.changes` | openSUSE-format package history. |
|
||||
| `source-audit.sh` | Handoff wrapper for the repository scanner; run it from the complete handoff tree. |
|
||||
|
|
@ -30,11 +30,11 @@ https://github.com/cristiancmoises/zupt.git
|
|||
```
|
||||
|
||||
`obs_scm` stores an `.obscpio` plus `.obsinfo`. The `tar` and `recompress`
|
||||
services reconstruct `zupt-5.2.6.tar.gz` inside the build environment, which
|
||||
services reconstruct `zupt-5.2.7.tar.gz` inside the build environment, which
|
||||
matches `Source0` in the spec.
|
||||
|
||||
This source policy does not prohibit separately built release-page packages.
|
||||
The upstream 5.2.6 gates may publish the CLI source tarball, DEB, binary RPM,
|
||||
The upstream 5.2.7 gates may publish the CLI source tarball, DEB, binary RPM,
|
||||
SRPM, notice-bearing Linux tar.xz, Windows ZIP, and macOS DMG, together with a
|
||||
GUI DEB, noarch RPM, GUI SRPM, and source-only portable GUI ZIP after each
|
||||
format-specific test succeeds. None of those files is an OBS `Source0` input
|
||||
|
|
@ -139,7 +139,7 @@ reconstructed by the build-time services. Neither `%build` nor `%check` may
|
|||
access the network.
|
||||
|
||||
For a source RPM check outside OBS, place the service-produced
|
||||
`zupt-5.2.6.tar.gz` next to the spec and use a disposable RPM build tree:
|
||||
`zupt-5.2.7.tar.gz` next to the spec and use a disposable RPM build tree:
|
||||
|
||||
```sh
|
||||
rpm_top=$(mktemp -d)
|
||||
|
|
@ -167,7 +167,7 @@ unavailable rather than passing it. Earlier off-screen GUI smoke evidence is
|
|||
supporting evidence, not an exact-commit package result.
|
||||
|
||||
Post-tag CI integration failures prevented 5.2.2 promotion. These historical
|
||||
local results do not establish 5.2.6, native Windows or macOS success, hosted
|
||||
local results do not establish 5.2.7, native Windows or macOS success, hosted
|
||||
GitHub CI/release promotion, authenticated OBS acceptance, or resolution of the
|
||||
automatic openSUSE `debugsource` rpmlint `no-binary` finding. The immutable
|
||||
5.2.3 candidate was not promoted because its source-policy test assumed LF for
|
||||
|
|
@ -194,7 +194,7 @@ This result establishes that the explicit tag revision works and isolates a
|
|||
release/test harness defect. It does not change the product, archive format,
|
||||
cryptography, codec, or SDK ABI; it does not make skipped native jobs pass or
|
||||
establish authenticated OBS/Factory acceptance. No v5.2.4 evidence transfers
|
||||
automatically to v5.2.6. The exact v5.2.6 candidate must repeat every applicable
|
||||
automatically to v5.2.7. The exact v5.2.7 candidate must repeat every applicable
|
||||
gate, and the automatic openSUSE `debugsource` rpmlint `no-binary` finding
|
||||
remains unresolved and unsuppressed.
|
||||
|
||||
|
|
@ -206,8 +206,18 @@ macOS jobs. Windows exposed a hostile-path fixture that did not preserve its
|
|||
requested bytes across the command-line boundary; macOS exposed the unsupported
|
||||
`explicit_bzero` assumption and Bash 3.2 empty-array handling. The 5.2.6
|
||||
corrections address those release/test integration defects without an archive,
|
||||
cryptographic, codec, or SDK ABI change. They do not establish 5.2.6 hosted,
|
||||
native, OBS, or promotion evidence.
|
||||
cryptographic, codec, or SDK ABI change.
|
||||
|
||||
## Prior 5.2.6 exact-tag native-gate evidence
|
||||
|
||||
The immutable v5.2.6 candidate was not promoted. Exact-tag GitHub Actions run
|
||||
`33442264243` completed 13 jobs successfully and failed two native jobs. The
|
||||
macOS arm64 SHA-NI test build treated unused x86-only helper declarations as
|
||||
errors under `-Werror`; Windows argv transcoding aborted the safe printable
|
||||
UTF-8 fixture before its intended path assertions. The 5.2.7 changes correct
|
||||
those test-harness boundaries without an archive-format, cryptographic, codec,
|
||||
or SDK ABI change. They do not establish 5.2.7 hosted, native, OBS, or promotion
|
||||
evidence.
|
||||
|
||||
## Prior openSUSE packaging validation
|
||||
|
||||
|
|
@ -246,11 +256,11 @@ gate.
|
|||
## Handoff procedure for Alessandro/Cabelo
|
||||
|
||||
1. Upstream completes every applicable pre-tag source and local audit gate,
|
||||
then creates and verifies the annotated `v5.2.6` tag. Exact-tag hosted,
|
||||
then creates and verifies the annotated `v5.2.7` tag. Exact-tag hosted,
|
||||
native-platform, package, and promotion gates must pass before release or
|
||||
downstream handoff; the tag itself is never moved to repair a failure.
|
||||
2. With Git, `file`, bsdtar, tar, zip, unzip and SHA-256 tools installed, run
|
||||
`scripts/export-opensuse-package.sh v5.2.6`. Verify the reported ZIP and
|
||||
`scripts/export-opensuse-package.sh v5.2.7`. Verify the reported ZIP and
|
||||
SHA-256 outside the Git index. The handoff includes both
|
||||
`packaging/opensuse/source-audit.sh` and its required
|
||||
`scripts/check-source-only.sh`; keep that relative layout while auditing.
|
||||
|
|
@ -262,7 +272,7 @@ gate.
|
|||
```
|
||||
|
||||
4. From the extracted handoff root, run
|
||||
`packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.6.tar.gz`.
|
||||
`packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.7.tar.gz`.
|
||||
Then copy `_service`, `zupt.spec`, `zupt.changes` and `README.md`
|
||||
into the flat OBS package checkout. The audit wrapper is not an OBS build
|
||||
source and must not be copied without its companion `scripts/` directory.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
<service name="obs_scm" mode="manual">
|
||||
<param name="url">https://github.com/cristiancmoises/zupt.git</param>
|
||||
<param name="scm">git</param>
|
||||
<param name="revision">refs/tags/v5.2.6</param>
|
||||
<param name="revision">refs/tags/v5.2.7</param>
|
||||
<param name="versionformat">@PARENT_TAG@</param>
|
||||
<param name="versionrewrite-pattern">^v(.*)$</param>
|
||||
<param name="versionrewrite-replacement">\1</param>
|
||||
|
|
|
|||
|
|
@ -1,3 +1,12 @@
|
|||
-------------------------------------------------------------------
|
||||
Mon Aug 31 23:00:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>
|
||||
|
||||
- Update to 5.2.7:
|
||||
* Scope SHA-NI test helpers away from unsupported macOS arm64 builds.
|
||||
* Preserve safe UTF-8 fixture bytes across the Windows argv boundary.
|
||||
* Preserve immutable, unpromoted 5.2.6 history and require fresh 5.2.7 gates.
|
||||
* Pin the OBS source service to the immutable v5.2.7 tag.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Aug 31 21:30:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>
|
||||
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@
|
|||
#
|
||||
|
||||
Name: zupt
|
||||
Version: 5.2.6
|
||||
Version: 5.2.7
|
||||
Release: 0
|
||||
Summary: Backup compression with authenticated and post-quantum encryption
|
||||
License: AGPL-3.0-or-later AND GPL-3.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ Requirements
|
|||
------------
|
||||
1. Python 3.9 or newer.
|
||||
2. PySide6 6.5 or newer, or a compatible PyQt6 package.
|
||||
3. ZUPT 5.2.6, installed as `zupt` on PATH or placed beside the launcher
|
||||
3. ZUPT 5.2.7, installed as `zupt` on PATH or placed beside the launcher
|
||||
(`zupt.exe` on Windows). A local command must have been built
|
||||
and tested independently; this bundle never downloads one.
|
||||
|
||||
|
|
@ -46,7 +46,7 @@ Troubleshooting
|
|||
---------------
|
||||
* "requires PySide6 or PyQt6": install one Qt binding through your operating
|
||||
system package manager or another trusted, preconfigured Python source.
|
||||
* "zupt not found": install ZUPT 5.2.6 or place its command beside
|
||||
* "zupt not found": install ZUPT 5.2.7 or place its command beside
|
||||
the launcher.
|
||||
* Set ZUPT_DEBUG=1 to print command-discovery diagnostics to stderr.
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@
|
|||
# installed smoke test.
|
||||
|
||||
Name: zupt
|
||||
Version: 5.2.6
|
||||
Version: 5.2.7
|
||||
Release: 1%{?dist}
|
||||
Summary: Backup compression with authenticated and post-quantum encryption
|
||||
|
||||
|
|
@ -101,6 +101,11 @@ comments. Plain archives use non-cryptographic checksums.
|
|||
%endif
|
||||
|
||||
%changelog
|
||||
* Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.7-1
|
||||
- Correct native test integration: scope SHA-NI helpers away from macOS arm64
|
||||
and preserve safe UTF-8 fixture bytes across the Windows argv boundary.
|
||||
- Preserve immutable, unpromoted 5.2.6 history and require fresh 5.2.7 gates.
|
||||
|
||||
* Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.6-1
|
||||
- Correct native release gates: use the secure volatile wipe fallback on
|
||||
macOS and NetBSD, support Bash 3.2 empty arrays in the source scanner, and
|
||||
|
|
|
|||
|
|
@ -248,11 +248,26 @@ else
|
|||
fail 'backslash separators are normalized within the extraction root'
|
||||
fi
|
||||
|
||||
make_fixture "$TEST_ROOT/legitimate.zupt" 'safe dir/ação.txt'
|
||||
legitimate_entry_hex=73616665206469722f61c3a7c3a36f2e747874
|
||||
MSYS2_ARG_CONV_EXCL='--entry-hex=' \
|
||||
"$FIXTURE" "$TEST_ROOT/legitimate.zupt" \
|
||||
"--entry-hex=$legitimate_entry_hex"
|
||||
mkdir "$TEST_ROOT/legitimate-out"
|
||||
if "$ZUPT_BIN" extract -o "$TEST_ROOT/legitimate-out" \
|
||||
if file_contains_hex_bytes "$TEST_ROOT/legitimate.zupt" \
|
||||
"$legitimate_entry_hex" &&
|
||||
"$ZUPT_BIN" extract -o "$TEST_ROOT/legitimate-out" \
|
||||
"$TEST_ROOT/legitimate.zupt" > "$TEST_ROOT/legitimate.log" 2>&1 &&
|
||||
[[ $(<"$TEST_ROOT/legitimate-out/safe dir/ação.txt") == 'fixture content' ]]; then
|
||||
python3 - "$TEST_ROOT/legitimate-out" "$legitimate_entry_hex" <<'PY'
|
||||
import pathlib
|
||||
import sys
|
||||
|
||||
# All process arguments are ASCII. Decode the exact UTF-8 archive bytes here
|
||||
# so the native MinGW fixture's narrow-argv transcoding cannot affect the test.
|
||||
relative_path = bytes.fromhex(sys.argv[2]).decode("utf-8")
|
||||
extracted = pathlib.Path(sys.argv[1]).joinpath(*relative_path.split("/"))
|
||||
raise SystemExit(0 if extracted.read_bytes() == b"fixture content\n" else 1)
|
||||
PY
|
||||
then
|
||||
pass 'safe nested UTF-8 path extracts normally'
|
||||
else
|
||||
fail 'safe nested UTF-8 path extracts normally'
|
||||
|
|
|
|||
|
|
@ -30,6 +30,7 @@
|
|||
#define HAVE_SHANI_BUILD 1
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_SHANI_BUILD
|
||||
static const uint32_t IV[8] = {
|
||||
0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
|
||||
0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
|
||||
|
|
@ -45,6 +46,7 @@ static void bad(const char *m) { printf(" \xE2\x9C\x97 %s\n", m); fail++; }
|
|||
static void hex(const uint8_t *b, int n, char *out) {
|
||||
for (int i = 0; i < n; i++) sprintf(out + i*2, "%02x", b[i]);
|
||||
}
|
||||
#endif
|
||||
|
||||
int main(void) {
|
||||
zupt_detect_cpu(&zupt_cpu);
|
||||
|
|
|
|||
Loading…
Reference in a new issue