release: correct CRLF policy gate for ZUPT 5.2.4
This commit is contained in:
Cristian Cezar Moisés
parent
f623205f45
commit
cdc08870de
28 changed files with 210 additions and 138 deletions
2
.github/workflows/promote-release.yml
vendored
2
.github/workflows/promote-release.yml
vendored
|
|
@ -11,7 +11,7 @@ on:
|
|||
required: true
|
||||
type: number
|
||||
tag:
|
||||
description: Existing annotated release tag, for example v5.2.3
|
||||
description: Existing annotated release tag, for example v5.2.4
|
||||
required: true
|
||||
type: string
|
||||
|
||||
|
|
|
|||
24
AUDIT.md
24
AUDIT.md
|
|
@ -1,12 +1,12 @@
|
|||
<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
|
||||
# ZUPT 5.2.3 audit guide and finding history
|
||||
# ZUPT 5.2.4 audit guide and finding history
|
||||
|
||||
This document describes review surfaces and reproducible checks. It is an
|
||||
upstream self-review, not an independent audit, certification, or guarantee.
|
||||
`SECURITY.md` defines reporting policy and `THREAT_MODEL.md` defines the
|
||||
security boundary.
|
||||
|
||||
## 5.2.3 scope
|
||||
## 5.2.4 scope
|
||||
|
||||
The baseline scope is the source-only CLI and its bundled source codec:
|
||||
|
||||
|
|
@ -28,7 +28,7 @@ output.
|
|||
|
||||
## Source-only review
|
||||
|
||||
The 5.2.3 baseline retains the source-only boundary introduced in 5.2.2, which
|
||||
The 5.2.4 baseline retains the source-only boundary introduced in 5.2.2, which
|
||||
removed incomplete SDK/PQBOX header snapshots and local precompiled-library
|
||||
expectations. Git and new upstream source
|
||||
archives are intended to contain no compiled executable, object, shared/static
|
||||
|
|
@ -42,10 +42,10 @@ scripts/check-source-only.sh
|
|||
|
||||
# committed Git tree or immutable tag
|
||||
scripts/check-source-only.sh --tag HEAD
|
||||
scripts/check-source-only.sh --tag v5.2.3
|
||||
scripts/check-source-only.sh --tag v5.2.4
|
||||
|
||||
# generated source archive
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.3.tar.gz
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.4.tar.gz
|
||||
```
|
||||
|
||||
The scanner checks extensions and magic bytes, nested archives, symlink targets,
|
||||
|
|
@ -109,7 +109,7 @@ without evidence.
|
|||
The following upstream self-audit results apply only to the 5.2.2 candidate at
|
||||
commit `ff99770` on the recorded local Linux environments. The immutable 5.2.2
|
||||
tag was not promoted after post-tag CI integration failures. These results are
|
||||
not independent certification, a 5.2.3 result, or evidence that release assets
|
||||
not independent certification, a 5.2.4 result, or evidence that release assets
|
||||
were published.
|
||||
|
||||
| Gate | Result | Recorded evidence |
|
||||
|
|
@ -123,8 +123,10 @@ were published.
|
|||
| Mutation fuzzing | PASS | 1,000 mutation iterations completed without a sanitizer-detected crash. |
|
||||
|
||||
An earlier off-screen GUI smoke run remains supporting evidence, but is not
|
||||
represented as an exact-`ff99770` GUI-package result. The exact 5.2.3 candidate
|
||||
must repeat the required suite. Native Windows and macOS gates, hosted GitHub CI
|
||||
represented as an exact-`ff99770` GUI-package result. The immutable 5.2.3
|
||||
candidate was not promoted because its source-policy test assumed LF for a
|
||||
Windows `.bat` checkout that correctly used CRLF. The exact 5.2.4 candidate must
|
||||
repeat the required suite. Native Windows and macOS gates, hosted GitHub CI
|
||||
and release promotion, authenticated OBS validation, and resolution of the
|
||||
openSUSE automatic `debugsource` rpmlint `no-binary` finding remain pending
|
||||
until recorded otherwise.
|
||||
|
|
@ -146,7 +148,7 @@ AES implementation has documented cache-timing risk on hostile shared hardware.
|
|||
|
||||
The following entries are retained as release history. Their regression tests
|
||||
should be rerun, but the historical resolution does not itself constitute a
|
||||
5.2.3 test result.
|
||||
5.2.4 test result.
|
||||
|
||||
| First corrected | Severity | Finding | Resolution recorded at the time |
|
||||
|---|---|---|---|
|
||||
|
|
@ -187,12 +189,12 @@ include SHA-256 checksums. The gated GUI set adds the architecture-independent
|
|||
DEB, noarch/source RPM, and source-only portable GUI ZIP. Package gates include
|
||||
exact payload/dependency and installed off-screen integration checks; the
|
||||
portable ZIP additionally receives source scans, an exact safe-member allowlist,
|
||||
and an extracted launcher test. An AppImage is not promoted by the 5.2.3
|
||||
and an extracted launcher test. An AppImage is not promoted by the 5.2.4
|
||||
policy; AppDir and Flatpak bundles, GUI platform installers, and bare
|
||||
Linux/Windows executables are also excluded. Windows ZIP and macOS DMG outputs
|
||||
remain CLI-only.
|
||||
|
||||
No Wine result is retained as release evidence for 5.2.3. Cross-compilation
|
||||
No Wine result is retained as release evidence for 5.2.4. Cross-compilation
|
||||
does not establish native-Windows behavior. Extended-length/device namespace
|
||||
paths, raw UNC output roots, and mapped/network-drive output are unsupported;
|
||||
the native Windows workflow remains a publication gate for the ZIP containing
|
||||
|
|
|
|||
19
CHANGELOG.md
19
CHANGELOG.md
|
|
@ -1,5 +1,24 @@
|
|||
# ZUPT Changelog
|
||||
|
||||
## [5.2.4] — 2026-08-31 — Source-policy line-ending correction
|
||||
|
||||
Corrective successor to the immutable `v5.2.3` candidate. That candidate was
|
||||
not promoted because its source-policy test assumed LF bytes for a Windows
|
||||
`.bat` file that Git correctly materializes as CRLF according to
|
||||
`.gitattributes`; the tag and its historical record remain unchanged.
|
||||
|
||||
- Correct the release/source-policy integration so the required CRLF checkout
|
||||
form is validated without treating it as source drift.
|
||||
- Carry the 5.2.3 release-integration work and the 5.2.2 security/source-only
|
||||
baseline forward without an archive-format, cryptographic, codec, or SDK ABI
|
||||
change.
|
||||
- Realign current documentation, package, workflow, artifact, and tag references
|
||||
to 5.2.4 while keeping generated binaries outside Git and source archives.
|
||||
- Require fresh exact-`v5.2.4` source, checksum, hosted CI, native-platform,
|
||||
package, and promotion evidence; no 5.2.3 result transfers automatically.
|
||||
- Keep authenticated OBS/Factory validation pending and retain the unresolved,
|
||||
unsuppressed openSUSE automatic `debugsource` rpmlint `no-binary` finding.
|
||||
|
||||
## [5.2.3] — 2026-08-31 — Corrective release integration
|
||||
|
||||
Corrective successor to the immutable `v5.2.2` candidate. Post-tag CI
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# Distributing ZUPT 5.2.3
|
||||
# Distributing ZUPT 5.2.4
|
||||
|
||||
This document describes the packaging material maintained in the ZUPT
|
||||
source repository. A recipe in `packaging/` is not evidence that a package has
|
||||
|
|
@ -14,9 +14,10 @@ https://github.com/cristiancmoises/zupt
|
|||
GitHub is the canonical source and release host. Packaging must never fetch
|
||||
`zupt-web` or substitute an asset from another project.
|
||||
|
||||
The `v5.2.2` tag is immutable but remained a non-promoted candidate after
|
||||
post-tag CI integration failures. Corrective packages and release assets must
|
||||
use `v5.2.3`; never move or overwrite the 5.2.2 tag or its checksums.
|
||||
The `v5.2.2` and `v5.2.3` tags are immutable non-promoted candidates. The latter
|
||||
was not promoted because its source-policy test assumed LF for a Windows `.bat`
|
||||
file that Git correctly checks out as CRLF. Corrective packages and release
|
||||
assets must use `v5.2.4`; never move or overwrite an earlier tag or checksum.
|
||||
|
||||
## Source-only boundary
|
||||
|
||||
|
|
@ -46,7 +47,7 @@ Audit the current tree or a generated archive with:
|
|||
|
||||
```sh
|
||||
scripts/check-source-only.sh
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.3.tar.gz
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.4.tar.gz
|
||||
```
|
||||
|
||||
The scanner reports paths, not file contents, and exits nonzero on a violation.
|
||||
|
|
@ -60,8 +61,8 @@ the commit omits Git's commit-ID PAX header:
|
|||
|
||||
```sh
|
||||
SOURCE_DATE_EPOCH="$(git show -s --format=%ct HEAD)" \
|
||||
make DIST_TARBALL=/tmp/zupt-5.2.3.tar.gz dist
|
||||
sha256sum /tmp/zupt-5.2.3.tar.gz
|
||||
make DIST_TARBALL=/tmp/zupt-5.2.4.tar.gz dist
|
||||
sha256sum /tmp/zupt-5.2.4.tar.gz
|
||||
```
|
||||
|
||||
With identical committed input and `SOURCE_DATE_EPOCH`, repeated exports must
|
||||
|
|
@ -107,12 +108,12 @@ private-library RPATH.
|
|||
| openSUSE / OBS | `packaging/opensuse/` | source and binary RPM through OBS |
|
||||
| Debian / Ubuntu | `packaging/debian/`, `packaging/build-deb.sh` | Debian metadata and binary DEB after the target gate |
|
||||
| RPM release artifact | `packaging/opensuse/zupt.spec`, `packaging/build-rpm.sh` | source and binary RPM after the target gate |
|
||||
| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.3_all.deb` after payload/dependency and installed integration gates |
|
||||
| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.3-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
|
||||
| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.3-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
|
||||
| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.3-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
|
||||
| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.4_all.deb` after payload/dependency and installed integration gates |
|
||||
| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.4-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
|
||||
| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.4-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
|
||||
| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.4-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
|
||||
| Fedora / RPM-based systems | `packaging/rpm/zupt.spec` | downstream RPM starting point |
|
||||
| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.3 AppImage is promoted |
|
||||
| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.4 AppImage is promoted |
|
||||
| Windows | `.github/workflows/cross-platform.yml` | native ZIP (executable plus notices) after the required native gate |
|
||||
| macOS | `packaging/build-dmg.sh` | native-architecture DMG after the native gate |
|
||||
| Arch Linux | `packaging/aur/PKGBUILD` | AUR package recipe |
|
||||
|
|
@ -188,17 +189,17 @@ expectations, then test the installed launcher off-screen against the matching
|
|||
### Portable and native release artifacts
|
||||
|
||||
The Linux x86_64 gate packages the tested `zupt` executable as
|
||||
`zupt-5.2.3-linux-x86_64.tar.xz` beside README, changelog, security guidance,
|
||||
`zupt-5.2.4-linux-x86_64.tar.xz` beside README, changelog, security guidance,
|
||||
and every applicable public license and notice. Its dynamic-library allowlist,
|
||||
archive member allowlist, and extracted CLI functional suite must pass.
|
||||
|
||||
The `zupt-gui-5.2.3-portable.zip` artifact is source-only: it contains the GUI
|
||||
The `zupt-gui-5.2.4-portable.zip` artifact is source-only: it contains the GUI
|
||||
Python source, shell/macOS/Windows launchers, icons, provenance, changelog, and
|
||||
licenses, but no Python, Qt, CLI, or compiled runtime. The gate scans both the
|
||||
assembled and extracted trees, verifies an exact safe member allowlist, and
|
||||
runs the extracted launcher off-screen against the tested CLI.
|
||||
|
||||
AppImage creation is deliberately offline and is not a 5.2.3 release gate.
|
||||
AppImage creation is deliberately offline and is not a 5.2.4 release gate.
|
||||
Supply a locally verified `appimagetool`, type-2 runtime, and the complete
|
||||
license/source-relink compliance notice for those exact runtime bytes; the
|
||||
helper never downloads any input:
|
||||
|
|
@ -214,7 +215,7 @@ APPIMAGE_RUNTIME_COMPLIANCE_FILE=/verified/path/runtime-compliance.txt \
|
|||
The runtime inspected while preparing 5.2.2 omitted a linked component from
|
||||
its notice and did not provide the complete LGPL source/relink handoff required
|
||||
by this release policy. No AppImage produced by this helper is promoted by the
|
||||
upstream 5.2.3 workflow. AppDir and Flatpak bundles and GUI platform installers
|
||||
upstream 5.2.4 workflow. AppDir and Flatpak bundles and GUI platform installers
|
||||
are also excluded. Bare Linux and Windows executables are not promoted; their
|
||||
CLI programs appear only inside notice-bearing archives. The Windows ZIP and
|
||||
macOS DMG remain CLI-only.
|
||||
|
|
@ -229,8 +230,8 @@ DIST_DIR="$release_dir" RUN_CHECKS=1 packaging/build-dmg.sh
|
|||
The Windows ZIP (including its executable and notices) must be built and tested
|
||||
by the Windows job in `.github/workflows/cross-platform.yml`; it is not a
|
||||
cross-compiled release claim from a Linux build. No Wine result is retained as
|
||||
5.2.3 release evidence. Extended-length/device namespace paths, raw UNC output
|
||||
roots, and mapped/network-drive output are not supported in 5.2.3. Publish the
|
||||
5.2.4 release evidence. Extended-length/device namespace paths, raw UNC output
|
||||
roots, and mapped/network-drive output are not supported in 5.2.4. Publish the
|
||||
exact architecture recorded by the native job.
|
||||
These helpers create binary distribution artifacts for the release page, not
|
||||
content to be committed to Git or included in the source archive.
|
||||
|
|
@ -238,7 +239,7 @@ content to be committed to Git or included in the source archive.
|
|||
### AUR, Homebrew, Guix, and Nix
|
||||
|
||||
After calculating the final reproducible source archive, but before creating or
|
||||
publishing the immutable tag, update each recipe to version 5.2.3 and to the
|
||||
publishing the immutable tag, update each recipe to version 5.2.4 and to the
|
||||
exact digest or content hash expected by its package manager. These recipe
|
||||
directories are excluded from the source archive, so this does not create a
|
||||
checksum cycle. Commit the pinned recipes in the tagged tree, then build and
|
||||
|
|
@ -257,7 +258,7 @@ build.
|
|||
|
||||
For every published artifact:
|
||||
|
||||
1. start from the immutable `v5.2.3` tag;
|
||||
1. start from the immutable `v5.2.4` tag;
|
||||
2. keep `WITH_SDK=0 WITH_PQBOX=0` unless system dependencies are declared;
|
||||
3. record the exact OS, distribution release, architecture, and toolchain;
|
||||
4. run format validation plus installed `--version`, `--help`, and archive
|
||||
|
|
@ -275,7 +276,7 @@ than redirecting consumers to an unverified file.
|
|||
|
||||
## Downstream checklist
|
||||
|
||||
- [ ] The source URL resolves to the immutable `v5.2.3` tag.
|
||||
- [ ] The source URL resolves to the immutable `v5.2.4` tag.
|
||||
- [ ] The source archive passes `scripts/check-source-only.sh --archive`.
|
||||
- [ ] The recipe checksum matches the downloaded source exactly.
|
||||
- [ ] `WITH_SDK=0 WITH_PQBOX=0` is explicit, or system dependencies are complete.
|
||||
|
|
|
|||
18
INSTALL.md
18
INSTALL.md
|
|
@ -1,4 +1,4 @@
|
|||
# Installing ZUPT 5.2.3
|
||||
# Installing ZUPT 5.2.4
|
||||
|
||||
This guide covers the ZUPT command-line program and the optional Python GUI.
|
||||
The canonical source repository is
|
||||
|
|
@ -16,14 +16,16 @@ The canonical source repository is
|
|||
record a successful format-specific test for your target.
|
||||
|
||||
The immutable `v5.2.2` candidate was not promoted after CI integration
|
||||
failures. Do not treat a 5.2.2 candidate artifact as a 5.2.3 package.
|
||||
failures. The immutable `v5.2.3` candidate was not promoted because its
|
||||
source-policy test assumed LF for a Windows `.bat` file checked out as the
|
||||
required CRLF. Do not treat either candidate's artifacts as 5.2.4 packages.
|
||||
|
||||
The 5.2.3 package set eligible for promotion after each target gate succeeds is:
|
||||
The 5.2.4 package set eligible for promotion after each target gate succeeds is:
|
||||
|
||||
| Component | Gated artifacts |
|
||||
|---|---|
|
||||
| CLI | `zupt-5.2.3.tar.gz`, `zupt_5.2.3_amd64.deb`, openSUSE x86_64 binary/source RPMs, `zupt-5.2.3-linux-x86_64.tar.xz`, `zupt-5.2.3-windows-x86_64.zip`, and `ZUPT-5.2.3-macOS-*.dmg` |
|
||||
| GUI | `zupt-gui_5.2.3_all.deb`, `zupt-gui-5.2.3-1.noarch.rpm`, `zupt-gui-5.2.3-1.src.rpm`, and `zupt-gui-5.2.3-portable.zip` |
|
||||
| CLI | `zupt-5.2.4.tar.gz`, `zupt_5.2.4_amd64.deb`, openSUSE x86_64 binary/source RPMs, `zupt-5.2.4-linux-x86_64.tar.xz`, `zupt-5.2.4-windows-x86_64.zip`, and `ZUPT-5.2.4-macOS-*.dmg` |
|
||||
| GUI | `zupt-gui_5.2.4_all.deb`, `zupt-gui-5.2.4-1.noarch.rpm`, `zupt-gui-5.2.4-1.src.rpm`, and `zupt-gui-5.2.4-portable.zip` |
|
||||
|
||||
The GUI packages require the matching `zupt` CLI package and must pass exact
|
||||
payload/dependency checks plus an installed off-screen GUI/CLI integration
|
||||
|
|
@ -31,7 +33,7 @@ test. The source-only portable GUI ZIP bundles launchers, notices, and GUI
|
|||
source, but not Python, Qt, or the CLI. The Linux tar.xz carries the tested CLI
|
||||
beside the complete public license/notice payload. AppImage, AppDir, Flatpak
|
||||
bundles, GUI platform installers, and bare Linux/Windows executables are not
|
||||
promoted for 5.2.3. The Windows ZIP and macOS DMG contain the CLI only. Exact
|
||||
promoted for 5.2.4. The Windows ZIP and macOS DMG contain the CLI only. Exact
|
||||
target boundaries are listed in `README.md`.
|
||||
The release's `SHA256SUMS` and validation notes, not the mere presence of a
|
||||
download link, identify an artifact that completed its gate.
|
||||
|
|
@ -68,7 +70,7 @@ sudo pacman -S base-devel gzip
|
|||
```
|
||||
|
||||
Package names can differ by distribution release. These commands are examples,
|
||||
not a statement that 5.2.3 has been accepted into each distribution repository.
|
||||
not a statement that 5.2.4 has been accepted into each distribution repository.
|
||||
|
||||
## Build and test from source
|
||||
|
||||
|
|
@ -88,7 +90,7 @@ From a release archive, run the scanner as follows before extraction or from a
|
|||
trusted checkout after download:
|
||||
|
||||
```sh
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.3.tar.gz
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.4.tar.gz
|
||||
```
|
||||
|
||||
The default build provides the native password, ML-KEM-768 + X25519 hybrid
|
||||
|
|
|
|||
73
README.md
73
README.md
|
|
@ -1,21 +1,28 @@
|
|||
# ZUPT 5.2.3
|
||||
# ZUPT 5.2.4
|
||||
|
||||
ZUPT is a command-line backup archiver written in C11. It combines the
|
||||
bundled VaptVupt compression codec with authenticated AES-256-CTR +
|
||||
HMAC-SHA256 encryption, native ML-KEM-768/X25519 hybrid encryption, archive
|
||||
integrity checks, multithreaded operation, and a Python/Qt graphical frontend.
|
||||
|
||||
Version 5.2.3 is the corrective release for the source, package, workflow, and
|
||||
release-integration path. The `v5.2.2` tag remains immutable, but its candidate
|
||||
was not promoted after post-tag CI integration failures; no 5.2.2 binary set is
|
||||
presented as the current release.
|
||||
Version 5.2.4 corrects release/source-policy integration. The immutable
|
||||
`v5.2.3` candidate was not promoted because its source-policy test assumed LF
|
||||
for a Windows `.bat` file that Git correctly checks out as CRLF. This correction
|
||||
does not change the archive format, cryptography, codec, or SDK ABI.
|
||||
|
||||
Version 5.2.2 restored the original ZUPT product name and the `zupt` command.
|
||||
The `.zupt` archive extension, format v1.6, magic bytes, codec identifiers, and
|
||||
SDK ABI remain unchanged. An optional `vaptvupt` command alias may be provided
|
||||
for scripts written against versions 3.0.0 through 5.2.1.
|
||||
|
||||
## Corrective changes in 5.2.3
|
||||
## Corrective changes in 5.2.4
|
||||
|
||||
The release gate now validates the required CRLF checkout form without treating
|
||||
it as source drift. All current release paths move to 5.2.4 and require fresh
|
||||
exact-tag CI, package, native-platform, source-only, and checksum evidence before
|
||||
promotion. The `v5.2.3` tag remains immutable and unpromoted.
|
||||
|
||||
## Corrective changes introduced in 5.2.3
|
||||
|
||||
The corrective release carries the 5.2.2 security and format work forward
|
||||
without a new archive format, codec, or SDK ABI. It realigns every current
|
||||
|
|
@ -113,9 +120,9 @@ users. Those assets must be built from the tagged source, tested on their target
|
|||
environment, and kept outside Git and the source archive. A format that was not
|
||||
built and tested is not presented as supported.
|
||||
|
||||
## 5.2.3 release artifacts
|
||||
## 5.2.4 release artifacts
|
||||
|
||||
The 5.2.3 release workflow is defined to produce the following files only after
|
||||
The 5.2.4 release workflow is defined to produce the following files only after
|
||||
the corresponding target gate succeeds. `SHA256SUMS` records the exact promoted
|
||||
filenames and digests. The release notes identify the tested commit and the
|
||||
manually dispatched CI run; that run's job definitions and logs are the runtime
|
||||
|
|
@ -124,23 +131,23 @@ skips. This table is not a substitute for that evidence.
|
|||
|
||||
| Format | Intended target and validation boundary |
|
||||
| --- | --- |
|
||||
| `zupt-5.2.3.tar.gz` | Reproducible, source-only archive; scanned twice-built input plus SHA-256. |
|
||||
| `zupt_5.2.3_amd64.deb` | Ubuntu 24.04 amd64 package; install, functional round trip, and uninstall gate. |
|
||||
| `zupt-5.2.3-*.x86_64.rpm` and `.src.rpm` | openSUSE Tumbleweed x86_64 source/binary RPM gate; package inspection, install, round trip, and uninstall. |
|
||||
| `zupt-5.2.3-linux-x86_64.tar.xz` | Linux x86_64 CLI plus the complete public license/notice payload; dependency allowlist and extracted-package functional gate. |
|
||||
| `zupt-gui_5.2.3_all.deb` | Architecture-independent Python/Qt GUI package; exact dependency/payload checks plus installed off-screen GUI/CLI integration gate. |
|
||||
| `zupt-gui-5.2.3-1.noarch.rpm` | Architecture-independent Python/Qt GUI RPM; package inspection plus installed off-screen GUI/CLI integration gate. |
|
||||
| `zupt-gui-5.2.3-1.src.rpm` | Source RPM corresponding exactly to the gated noarch GUI RPM. |
|
||||
| `zupt-gui-5.2.3-portable.zip` | Source-only GUI and launchers with licenses/provenance; source scan, exact member allowlist, and extracted off-screen GUI/CLI gate. |
|
||||
| `zupt-5.2.3-windows-x86_64.zip` | Native Windows x86_64 executable with notices; extracted-ZIP round-trip gate. |
|
||||
| `ZUPT-5.2.3-macOS-*.dmg` | Native macOS image; mounted packaged executable round-trip gate, with the actual architecture in the filename. |
|
||||
| `zupt-5.2.4.tar.gz` | Reproducible, source-only archive; scanned twice-built input plus SHA-256. |
|
||||
| `zupt_5.2.4_amd64.deb` | Ubuntu 24.04 amd64 package; install, functional round trip, and uninstall gate. |
|
||||
| `zupt-5.2.4-*.x86_64.rpm` and `.src.rpm` | openSUSE Tumbleweed x86_64 source/binary RPM gate; package inspection, install, round trip, and uninstall. |
|
||||
| `zupt-5.2.4-linux-x86_64.tar.xz` | Linux x86_64 CLI plus the complete public license/notice payload; dependency allowlist and extracted-package functional gate. |
|
||||
| `zupt-gui_5.2.4_all.deb` | Architecture-independent Python/Qt GUI package; exact dependency/payload checks plus installed off-screen GUI/CLI integration gate. |
|
||||
| `zupt-gui-5.2.4-1.noarch.rpm` | Architecture-independent Python/Qt GUI RPM; package inspection plus installed off-screen GUI/CLI integration gate. |
|
||||
| `zupt-gui-5.2.4-1.src.rpm` | Source RPM corresponding exactly to the gated noarch GUI RPM. |
|
||||
| `zupt-gui-5.2.4-portable.zip` | Source-only GUI and launchers with licenses/provenance; source scan, exact member allowlist, and extracted off-screen GUI/CLI gate. |
|
||||
| `zupt-5.2.4-windows-x86_64.zip` | Native Windows x86_64 executable with notices; extracted-ZIP round-trip gate. |
|
||||
| `ZUPT-5.2.4-macOS-*.dmg` | Native macOS image; mounted packaged executable round-trip gate, with the actual architecture in the filename. |
|
||||
|
||||
An asset absent from the release was not promoted through its mandatory gate.
|
||||
Do not infer support for another distribution release, OS version, CPU
|
||||
architecture, raw UNC/SMB destination, or package manager from a similarly
|
||||
named file. Binary assets are release outputs, never source-build inputs.
|
||||
|
||||
No AppImage is promised for 5.2.3. The inspected upstream type-2 runtime lacked
|
||||
No AppImage is promised for 5.2.4. The inspected upstream type-2 runtime lacked
|
||||
a complete notice/source-relink handoff for every statically linked component,
|
||||
so redistributing it would not meet this release's provenance gate. AppDir and
|
||||
Flatpak bundles and GUI platform installers are likewise outside the promoted
|
||||
|
|
@ -170,8 +177,8 @@ bash tests/test_source_only.sh
|
|||
For a tag or an existing source archive:
|
||||
|
||||
~~~sh
|
||||
bash scripts/check-source-only.sh --tag v5.2.3
|
||||
bash scripts/check-source-only.sh --archive /path/to/zupt-5.2.3.tar.gz
|
||||
bash scripts/check-source-only.sh --tag v5.2.4
|
||||
bash scripts/check-source-only.sh --archive /path/to/zupt-5.2.4.tar.gz
|
||||
~~~
|
||||
|
||||
Unknown `.bin` files fail the scan. A necessary binary data fixture may be
|
||||
|
|
@ -307,14 +314,16 @@ sanitizer-detected crash. An earlier off-screen GUI smoke run remains supporting
|
|||
evidence rather than an exact-candidate package result.
|
||||
|
||||
Those results are historical upstream self-audit evidence, not independent
|
||||
certification and not 5.2.3 results. Post-tag CI integration failures prevented
|
||||
5.2.2 promotion. The exact 5.2.3 candidate must repeat all required gates;
|
||||
certification and not 5.2.4 results. Post-tag CI integration failures prevented
|
||||
5.2.2 promotion. The immutable 5.2.3 candidate was also not promoted because its
|
||||
source-policy test assumed LF for a `.bat` checkout that correctly used CRLF.
|
||||
The exact 5.2.4 candidate must repeat all required gates;
|
||||
native Windows and macOS, hosted GitHub CI/release promotion, authenticated OBS,
|
||||
and resolution of the openSUSE automatic `debugsource` rpmlint `no-binary`
|
||||
finding remain pending until recorded otherwise. Unexecuted gates are `SKIP`,
|
||||
never `PASS`.
|
||||
|
||||
On Windows, 5.2.3 scopes output handling to normal local Win32 paths. A MinGW
|
||||
On Windows, 5.2.4 scopes output handling to normal local Win32 paths. A MinGW
|
||||
cross-build or Wine run is not native-Windows evidence; the `windows-latest`
|
||||
package job, including its Unicode round trip, remains a mandatory publication
|
||||
gate. Win32 extended-length and device-namespace paths, raw UNC output roots
|
||||
|
|
@ -336,7 +345,7 @@ downgrading authentication of header and footer metadata.
|
|||
`disk restore`, and exists only to recover a known, trusted archive created
|
||||
before AIT was introduced. Do not use that override for an archive from
|
||||
untrusted or attacker-writable storage; verify and migrate the recovered data to
|
||||
a newly created 5.2.3 archive. Compression and disk backup never create a
|
||||
a newly created 5.2.4 archive. Compression and disk backup never create a
|
||||
no-AIT archive.
|
||||
|
||||
`info` is deliberately different: it reports unauthenticated framing metadata,
|
||||
|
|
@ -354,7 +363,7 @@ lists, tests, extracts, and restores it byte-exact. The full local Linux gate
|
|||
passed on commit `ff99770`. This is not a claim that a 5.2.1 reader understands every new
|
||||
flag-gated 5.2.2 encoding or that every historical combination was tested.
|
||||
|
||||
The candidate commands and outcome fields for 5.2.3 are maintained in the
|
||||
The candidate commands and outcome fields for 5.2.4 are maintained in the
|
||||
release handoff and
|
||||
[packaging/opensuse/README.md](packaging/opensuse/README.md). They must be
|
||||
updated from the final release candidate before tagging. No architecture or
|
||||
|
|
@ -366,9 +375,9 @@ Generate the reproducible source archive outside the repository:
|
|||
|
||||
~~~sh
|
||||
make dist
|
||||
sha256sum /tmp/zupt-5.2.3.tar.gz
|
||||
sha256sum /tmp/zupt-5.2.4.tar.gz
|
||||
bash scripts/check-source-only.sh \
|
||||
--archive /tmp/zupt-5.2.3.tar.gz
|
||||
--archive /tmp/zupt-5.2.4.tar.gz
|
||||
~~~
|
||||
|
||||
Archive ordering, ownership and timestamps are normalized. The default epoch is
|
||||
|
|
@ -384,7 +393,7 @@ final digest before the tag is published.
|
|||
## openSUSE and OBS
|
||||
|
||||
The maintained upstream recipe is in packaging/opensuse. It is prepared for an
|
||||
immutable v5.2.3 tag, disables submodules and Git LFS, builds with
|
||||
immutable v5.2.4 tag, disables submodules and Git LFS, builds with
|
||||
WITH_SDK=0 WITH_PQBOX=0, runs real checks, and installs without the renamed-era
|
||||
`vaptvupt` alias.
|
||||
|
||||
|
|
@ -427,7 +436,7 @@ The optional GUI is under `gui/`. It invokes the `zupt` CLI and needs Python 3
|
|||
plus PySide6 or PyQt6. GUI image assets are data files whose purpose,
|
||||
provenance and license are recorded in [gui/assets/README.md](gui/assets/README.md).
|
||||
The integrated source and lightweight consistency checks do not constitute a
|
||||
target-native audit of every historical GUI format. The 5.2.3 artifact promise
|
||||
target-native audit of every historical GUI format. The 5.2.4 artifact promise
|
||||
is limited to the gated GUI DEB, noarch/source RPM, and source-only portable ZIP
|
||||
listed above; AppImage, AppDir, Flatpak bundles, and platform GUI installers
|
||||
remain excluded.
|
||||
|
|
@ -436,13 +445,13 @@ remain excluded.
|
|||
|
||||
Cristian Cezar Moisés is the creator and current upstream maintainer of ZUPT and
|
||||
the author of the current upstream source, build, test, documentation, and
|
||||
packaging changes, including the 5.2.2 baseline and corrective 5.2.3 work.
|
||||
packaging changes, including the 5.2.2 baseline and corrective 5.2.3/5.2.4 work.
|
||||
|
||||
Alessandro de Oliveira Faria (Cabelo) is credited as the openSUSE collaborator
|
||||
and downstream package maintainer. He reviews the handoff, commits it in the
|
||||
OBS project he maintains, and may make the additional openSUSE-side adjustments
|
||||
he considers necessary. That downstream role is not attribution of ZUPT source
|
||||
authorship or of the upstream 5.2.2 or 5.2.3 changes.
|
||||
authorship or of the upstream 5.2.2, 5.2.3, or 5.2.4 changes.
|
||||
|
||||
## License
|
||||
|
||||
|
|
|
|||
18
SECURITY.md
18
SECURITY.md
|
|
@ -1,4 +1,4 @@
|
|||
# Security Policy — ZUPT 5.2.3
|
||||
# Security Policy — ZUPT 5.2.4
|
||||
|
||||
## Reporting vulnerabilities
|
||||
|
||||
|
|
@ -66,7 +66,7 @@ partially accepted.
|
|||
|
||||
### Optional integrations
|
||||
|
||||
The 5.2.3 default is `WITH_SDK=0 WITH_PQBOX=0`:
|
||||
The 5.2.4 default is `WITH_SDK=0 WITH_PQBOX=0`:
|
||||
|
||||
- `WITH_SDK=1` enables libvuptsdk-backed features, including the SDK PQ mode
|
||||
and Argon2id support, using a separately installed system development package.
|
||||
|
|
@ -133,7 +133,7 @@ can compromise archives encrypted to it.
|
|||
|
||||
## Constant-time and side-channel scope
|
||||
|
||||
Portable C is the 5.2.3 default. Sensitive comparisons and selections use
|
||||
Portable C is the 5.2.4 default. Sensitive comparisons and selections use
|
||||
branchless helpers, but generated machine-code behavior remains dependent on
|
||||
the compiler and platform. This is not a formal whole-program constant-time
|
||||
claim. The C AES implementation uses table lookups and is unsuitable for a
|
||||
|
|
@ -197,7 +197,7 @@ media before proceeding.
|
|||
|
||||
The Windows handle-relative implementation is scoped to normal local Win32
|
||||
paths. Win32 extended-length and device-namespace paths, raw UNC output roots,
|
||||
and mapped/network-drive output are not supported in 5.2.3. Cross-build and
|
||||
and mapped/network-drive output are not supported in 5.2.4. Cross-build and
|
||||
Wine results are not native-Windows evidence; the `windows-latest` package gate
|
||||
must pass its Unicode round trip before Windows assets are published. Restore
|
||||
to a normal local directory first and move verified output to network storage
|
||||
|
|
@ -240,7 +240,7 @@ shared/static library, or distribution package. Audit them with:
|
|||
|
||||
```sh
|
||||
scripts/check-source-only.sh
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.3.tar.gz
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.4.tar.gz
|
||||
```
|
||||
|
||||
Nested archive inspection is required to enforce bounded recursion, member
|
||||
|
|
@ -250,13 +250,13 @@ limit violations. On commit `ff99770`, the source-only scanner suite passed
|
|||
|
||||
DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI
|
||||
ZIP, Windows ZIP, and macOS DMG release assets are separate outputs. An
|
||||
AppImage is not promoted for 5.2.3. A bare Linux or Windows executable is also
|
||||
AppImage is not promoted for 5.2.4. A bare Linux or Windows executable is also
|
||||
excluded; executables are distributed only inside their notice-bearing
|
||||
archives. Trust an artifact only when its exact format has a recorded build,
|
||||
content/metadata inspection, extracted or installed smoke test, and applicable
|
||||
archive round trip. Never treat an unexecuted platform as passing.
|
||||
|
||||
The gated 5.2.3 set is the CLI package/archive set plus the exact GUI DEB,
|
||||
The gated 5.2.4 set is the CLI package/archive set plus the exact GUI DEB,
|
||||
noarch/source RPM, and source-only portable ZIP documented in the README. The
|
||||
portable GUI ZIP contains no compiled runtime and is scanned as source before
|
||||
and after extraction. Other GUI packages, AppImage, AppDir and Flatpak bundles,
|
||||
|
|
@ -296,7 +296,9 @@ result.
|
|||
|
||||
Post-tag CI integration failures prevented 5.2.2 promotion. Those upstream
|
||||
self-audit results are not independent certification and do not transfer to
|
||||
5.2.3. The exact 5.2.3 candidate must repeat the required suite. Native Windows
|
||||
5.2.4. The immutable 5.2.3 candidate was not promoted because its source-policy
|
||||
test assumed LF for a Windows `.bat` file checked out as CRLF. The exact 5.2.4
|
||||
candidate must repeat the required suite. Native Windows
|
||||
and macOS, hosted GitHub CI/release promotion, authenticated OBS, and the
|
||||
openSUSE automatic `debugsource` rpmlint `no-binary` finding remain pending
|
||||
until recorded otherwise. An unavailable or unexecuted environment remains
|
||||
|
|
|
|||
|
|
@ -159,7 +159,7 @@ grant attached to their unchanged Git blobs, are recorded in
|
|||
|
||||
## AppImage type-2 runtime
|
||||
|
||||
No AppImage is a promised or promoted 5.2.3 release asset. The upstream
|
||||
No AppImage is a promised or promoted 5.2.4 release asset. The upstream
|
||||
type-2 runtime inspected during the 5.2.2 review statically linked musl, libfuse,
|
||||
squashfuse, zstd, zlib, and mimalloc, but its own license notice did not list
|
||||
mimalloc and the available release inputs did not provide a complete
|
||||
|
|
@ -171,7 +171,7 @@ no network input and requires the operator to supply both a locally verified
|
|||
runtime and `APPIMAGE_RUNTIME_COMPLIANCE_FILE`, containing the license notices,
|
||||
source correspondence or offer, and relink information applicable to those
|
||||
exact runtime bytes. An artifact produced independently with that helper is
|
||||
not covered by the 5.2.3 upstream release gates.
|
||||
not covered by the 5.2.4 upstream release gates.
|
||||
|
||||
## Reporting attribution issues
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# ZUPT 5.2.3 threat model
|
||||
# ZUPT 5.2.4 threat model
|
||||
|
||||
This document defines the security boundary of the ZUPT archive tool. It is
|
||||
not a certification, a guarantee against every hostile input, or a substitute
|
||||
|
|
@ -17,7 +17,7 @@ plausibly deniable.
|
|||
|
||||
## Baseline considered here
|
||||
|
||||
The upstream baseline is built from the 5.2.3 source with:
|
||||
The upstream baseline is built from the 5.2.4 source with:
|
||||
|
||||
```sh
|
||||
make WITH_SDK=0 WITH_PQBOX=0
|
||||
|
|
@ -175,7 +175,7 @@ temporary through its descriptor or handle. These controls reduce traversal,
|
|||
link, race, and partial-output risks, but do not establish that no parser or
|
||||
filesystem bug can exist.
|
||||
|
||||
The Windows handle-relative boundary in 5.2.3 covers normal local Win32 paths.
|
||||
The Windows handle-relative boundary in 5.2.4 covers normal local Win32 paths.
|
||||
Win32 extended-length and device-namespace paths, raw UNC output roots, and
|
||||
mapped/network-drive output are not supported. Cross-build and Wine results are
|
||||
not a substitute for the required native `windows-latest` Unicode package
|
||||
|
|
@ -250,9 +250,9 @@ tagged source. Each artifact extends the trust boundary to its builder,
|
|||
toolchain, runner image, and packaging scripts. Treat it as validated only when
|
||||
the exact target has a recorded build, content/package inspection, extracted or
|
||||
installed smoke test, and applicable archive round trip. An AppImage is not
|
||||
promoted for 5.2.3; bare Linux and Windows executables are also excluded.
|
||||
promoted for 5.2.4; bare Linux and Windows executables are also excluded.
|
||||
|
||||
For 5.2.3, that gated artifact scope covers the CLI files plus the exact GUI
|
||||
For 5.2.4, that gated artifact scope covers the CLI files plus the exact GUI
|
||||
DEB, noarch/source RPM, and source-only portable ZIP named in the README. The
|
||||
portable ZIP contains no compiled runtime and crosses the release boundary only
|
||||
after source scans and an exact safe-member check. AppDir and Flatpak bundles
|
||||
|
|
@ -265,7 +265,9 @@ strict Clang, GCC `-fanalyzer`, the 9/9 tool-enabled static-analysis run,
|
|||
ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations passed. Earlier off-screen
|
||||
GUI smoke evidence is retained separately. Post-tag CI integration failures
|
||||
prevented 5.2.2 promotion. This upstream self-review is not an independent
|
||||
certification and is not 5.2.3 evidence. Native Windows/macOS, hosted GitHub CI
|
||||
certification and is not 5.2.4 evidence. The immutable 5.2.3 candidate was not
|
||||
promoted because its source-policy test assumed LF for a Windows `.bat` checkout
|
||||
that correctly used CRLF. Native Windows/macOS, hosted GitHub CI
|
||||
and release promotion, authenticated OBS, and the openSUSE automatic
|
||||
`debugsource` rpmlint `no-binary` finding remain pending until recorded
|
||||
otherwise.
|
||||
|
|
@ -295,7 +297,7 @@ These are historical facts about earlier releases, retained to support recovery:
|
|||
combinations remain unclaimed.
|
||||
|
||||
Historical test counts in the changelog describe those releases. They do not
|
||||
automatically become 5.2.3 results; current outcomes belong in the release
|
||||
automatically become 5.2.4 results; current outcomes belong in the release
|
||||
validation record, with unavailable environments marked `SKIP`. In particular,
|
||||
runs made before the final positional-AAD and mandatory-AIT changes are not
|
||||
final release gates for the resulting candidate.
|
||||
|
|
@ -306,4 +308,4 @@ Email **zupt@riseup.net** with `[security]` in the subject. Include the version,
|
|||
platform, impact, and a minimal non-sensitive reproducer. Do not disclose the
|
||||
issue publicly until a coordinated timeline has been agreed.
|
||||
|
||||
Document version: 5.2.3, 2026-08-31.
|
||||
Document version: 5.2.4, 2026-08-31.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
.\" SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
.\" Copyright (c) 2025-2026 Cristian Cezar Moisés
|
||||
.TH ZUPT-GUI 1 "2026-08-31" "ZUPT 5.2.3" "User Commands"
|
||||
.TH ZUPT-GUI 1 "2026-08-31" "ZUPT 5.2.4" "User Commands"
|
||||
.SH NAME
|
||||
zupt-gui \- Qt interface for the ZUPT backup utility
|
||||
.SH SYNOPSIS
|
||||
|
|
@ -47,7 +47,7 @@ or
|
|||
only when libvuptsdk or libpqvaptvupt is independently reported enabled.
|
||||
These two optional integrations are detected separately.
|
||||
.PP
|
||||
The gated 5.2.3 GUI release set is limited to the architecture-independent DEB,
|
||||
The gated 5.2.4 GUI release set is limited to the architecture-independent DEB,
|
||||
noarch/source RPM, and source-only portable ZIP named in the project README.
|
||||
Package gates require exact checks and installed off-screen GUI/CLI integration.
|
||||
The portable ZIP receives source scans, an exact safe-member allowlist, and an
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
.\" SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
.\" Copyright (c) 2025-2026 Cristian Cezar Moisés
|
||||
.TH ZUPT 1 "2026-08-31" "ZUPT 5.2.3" "User Commands"
|
||||
.TH ZUPT 1 "2026-08-31" "ZUPT 5.2.4" "User Commands"
|
||||
.
|
||||
.SH NAME
|
||||
zupt \- source-built backup compression and authenticated-encryption utility
|
||||
|
|
@ -89,7 +89,7 @@ Git and the upstream source tarball are source-only. Separately built CLI DEB,
|
|||
binary RPM, SRPM, notice-bearing Linux tar.xz, Windows ZIP, and macOS DMG assets
|
||||
may be published from the immutable tag only after their target-specific gates
|
||||
pass; they never enter Git or the source tarball. An AppImage is not promoted
|
||||
for 5.2.3; neither are AppDir/Flatpak bundles, GUI platform installers, or bare
|
||||
for 5.2.4; neither are AppDir/Flatpak bundles, GUI platform installers, or bare
|
||||
Linux/Windows executables. The Python/Qt frontend remains available as source;
|
||||
its gated architecture-independent DEB, noarch/source RPM, and source-only
|
||||
portable ZIP are included in the release claim. The portable ZIP contains no
|
||||
|
|
@ -477,7 +477,7 @@ then traverse below a pinned directory descriptor with no-follow operations.
|
|||
Windows builds use handle-relative traversal and
|
||||
no-replace publication for normal local Win32 destinations. Extended-length and
|
||||
device-namespace paths, raw UNC output roots, and mapped/network-drive output
|
||||
are not supported in 5.2.3. Cross-compilation and Wine results are not native
|
||||
are not supported in 5.2.4. Cross-compilation and Wine results are not native
|
||||
Windows evidence; the native Windows package gate, including its Unicode round
|
||||
trip, is separate and mandatory before publication.
|
||||
.
|
||||
|
|
@ -577,7 +577,7 @@ and the encrypted-dedup linear AAD sequence published through 5.2.1. The narrow
|
|||
compatibility fixture is an actual v5.2.1 password-encrypted
|
||||
DATA/DATA/REF/DATA disk archive stored as hexadecimal text with source and hash
|
||||
provenance. The candidate lists, tests, extracts, and restores that fixture
|
||||
byte-exact. The exact 5.2.3 candidate must repeat the gate. It does not imply
|
||||
byte-exact. The exact 5.2.4 candidate must repeat the gate. It does not imply
|
||||
that a 5.2.1 reader
|
||||
accepts every new 5.2.2 archive or that every historical encrypted mode was
|
||||
retested.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# ZUPT GUI
|
||||
|
||||
The ZUPT GUI is a Python/Qt front end for the ZUPT 5.2.3 command-line
|
||||
The ZUPT GUI is a Python/Qt front end for the ZUPT 5.2.4 command-line
|
||||
program. It starts the CLI as a subprocess; compression, archive parsing, and
|
||||
cryptography remain in the C program.
|
||||
|
||||
|
|
@ -83,10 +83,10 @@ operating systems and must be tested on the target system.
|
|||
Release pages provide only these GUI artifacts after their separate package and
|
||||
installed off-screen GUI/CLI integration gates pass:
|
||||
|
||||
- `zupt-gui_5.2.3_all.deb`;
|
||||
- `zupt-gui-5.2.3-1.noarch.rpm`;
|
||||
- `zupt-gui-5.2.3-1.src.rpm`;
|
||||
- `zupt-gui-5.2.3-portable.zip`.
|
||||
- `zupt-gui_5.2.4_all.deb`;
|
||||
- `zupt-gui-5.2.4-1.noarch.rpm`;
|
||||
- `zupt-gui-5.2.4-1.src.rpm`;
|
||||
- `zupt-gui-5.2.4-portable.zip`.
|
||||
|
||||
The DEB/RPM packages install the Python/Qt source and depend on the matching
|
||||
`zupt` CLI package. The portable ZIP contains source, launchers, icons, licenses,
|
||||
|
|
@ -97,7 +97,7 @@ An absent artifact did not pass its gate and must not be inferred from another
|
|||
format's result.
|
||||
|
||||
GUI AppImage, AppDir and Flatpak bundles, and Windows/macOS GUI installers are
|
||||
not promoted by the upstream 5.2.3 release gates.
|
||||
not promoted by the upstream 5.2.4 release gates.
|
||||
`packaging/build-gui-appimage.sh` is a downstream-only helper and fails unless
|
||||
its operator supplies the exact verified runtime plus a complete
|
||||
license/source-relink notice through `APPIMAGE_RUNTIME_COMPLIANCE_FILE`; that
|
||||
|
|
@ -110,7 +110,7 @@ notices. It fails unless the directory also has non-empty
|
|||
`PYTHON-NOTICE.txt`, `PYINSTALLER-NOTICE.txt`, `QT-NOTICE.txt`, and either
|
||||
`PYSIDE6-NOTICE.txt` or `PYQT6-NOTICE.txt`. The installer includes that
|
||||
directory together with every ZUPT license and notice. This requirement does
|
||||
not make the untested GUI installer a 5.2.3 release asset. The promoted Windows
|
||||
not make the untested GUI installer a 5.2.4 release asset. The promoted Windows
|
||||
ZIP and macOS DMG are CLI-only.
|
||||
|
||||
Packaging recipes and scripts under `gui/packaging/` and `packaging/` are build
|
||||
|
|
|
|||
|
|
@ -1,9 +1,9 @@
|
|||
Package: zupt-gui
|
||||
Version: 5.2.3
|
||||
Version: 5.2.4
|
||||
Section: utils
|
||||
Priority: optional
|
||||
Architecture: all
|
||||
Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= 5.2.3)
|
||||
Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= 5.2.4)
|
||||
Maintainer: Cristian Cezar Moisés <sac@securityops.co>
|
||||
Homepage: https://github.com/cristiancmoises/zupt
|
||||
Description: Qt graphical interface for the ZUPT backup utility
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ rem runtime files embedded by this local build.
|
|||
setlocal EnableExtensions
|
||||
for %%I in ("%~dp0\..\..\..") do set "REPO_ROOT=%%~fI"
|
||||
set "VERSION=%~1"
|
||||
if not defined VERSION set "VERSION=5.2.3"
|
||||
if not defined VERSION set "VERSION=5.2.4"
|
||||
if not defined ZUPT_DIST_DIR set "ZUPT_DIST_DIR=%TEMP%\zupt-release"
|
||||
if not defined ZUPT_CLI_EXE set "ZUPT_CLI_EXE=%REPO_ROOT%\zupt.exe"
|
||||
set "WORK=%TEMP%\zupt-gui-build-%RANDOM%-%RANDOM%"
|
||||
|
|
|
|||
|
|
@ -118,7 +118,8 @@ static inline int zupt_win_mkdir_utf8(const char *path) {
|
|||
#define ZUPT_PRODUCT_TAGLINE "Post-quantum backup compression"
|
||||
|
||||
/* v5.2.3 corrects release packaging and CI; archive format remains v1.6. */
|
||||
#define ZUPT_VERSION_STRING "5.2.3"
|
||||
/* v5.2.4 makes package metadata checks CRLF-safe; format remains v1.6. */
|
||||
#define ZUPT_VERSION_STRING "5.2.4"
|
||||
/* Vendored codec release (upstream tag) — single source for display strings.
|
||||
* The codec's own VV_VERSION_* is its internal API version, not the release. */
|
||||
#define ZUPT_CODEC_RELEASE "2.65.3"
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
set -Eeuo pipefail
|
||||
umask 077
|
||||
|
||||
VERSION=${VERSION:-5.2.3}
|
||||
VERSION=${VERSION:-5.2.4}
|
||||
PREFIX=${PREFIX:-/usr/local}
|
||||
|
||||
echo "🔧 Installing ZUPT..."
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
# Test locally with `makepkg -s` after the release archive is published.
|
||||
|
||||
pkgname=zupt
|
||||
pkgver=5.2.3
|
||||
pkgver=5.2.4
|
||||
pkgrel=1
|
||||
pkgdesc='Pure-C11 post-quantum backup compression utility (AES-256-CTR + HMAC-SHA256 + ML-KEM-768 + X25519)'
|
||||
arch=('x86_64')
|
||||
|
|
@ -22,8 +22,8 @@ makedepends=('gcc' 'git' 'make')
|
|||
checkdepends=('python')
|
||||
|
||||
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/cristiancmoises/zupt/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
|
||||
# Byte-reproducible upstream v5.2.3 source archive.
|
||||
sha256sums=('062f008751a4333bd88ad8a826b98066704b4cb9bc08a016f2f5083365b449d4')
|
||||
# Final byte-reproducible upstream v5.2.4 archive checksum (pending).
|
||||
sha256sums=('REPLACE_AFTER_FINAL_ARCHIVE_SHA256')
|
||||
|
||||
build() {
|
||||
cd "${pkgname}-${pkgver}"
|
||||
|
|
|
|||
|
|
@ -1,3 +1,11 @@
|
|||
zupt (5.2.4-1) UNRELEASED; urgency=medium
|
||||
|
||||
* Make the static Windows GUI package-version check robust to canonical
|
||||
CRLF checkouts.
|
||||
* Advance source-only package metadata and prepare final archive checksums.
|
||||
|
||||
-- Cristian Cezar Moisés <sac@securityops.co> Mon, 31 Aug 2026 18:55:00 +0000
|
||||
|
||||
zupt (5.2.3-1) UNRELEASED; urgency=medium
|
||||
|
||||
* Derive package checks from the upstream version header and stabilize the
|
||||
|
|
|
|||
|
|
@ -62,7 +62,7 @@
|
|||
xcb-util-renderutil xcb-util-wm xcb-util-cursor
|
||||
libinput-minimal mtdev libevdev eudev))
|
||||
|
||||
(define %zupt-version "5.2.3")
|
||||
(define %zupt-version "5.2.4")
|
||||
|
||||
(define %zupt-source
|
||||
(origin
|
||||
|
|
@ -72,7 +72,7 @@
|
|||
"/releases/download/v" %zupt-version
|
||||
"/zupt-" %zupt-version ".tar.gz"))
|
||||
(sha256
|
||||
(base32 "1m29nijk627my8ba025wp564nw36h2wjda6qibc3ncx4a63h0bq6"))))
|
||||
(base32 "REPLACE_AFTER_FINAL_ARCHIVE_GUIX_BASE32"))))
|
||||
|
||||
(define-public zupt
|
||||
(package
|
||||
|
|
|
|||
|
|
@ -22,9 +22,9 @@
|
|||
class Zupt < Formula
|
||||
desc "Post-quantum backup compression utility (ML-KEM-768 + AES-256-CTR + HMAC-SHA256)"
|
||||
homepage "https://github.com/cristiancmoises/zupt"
|
||||
url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.3/zupt-5.2.3.tar.gz"
|
||||
version "5.2.3"
|
||||
sha256 "062f008751a4333bd88ad8a826b98066704b4cb9bc08a016f2f5083365b449d4"
|
||||
url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.4/zupt-5.2.4.tar.gz"
|
||||
version "5.2.4"
|
||||
sha256 "REPLACE_AFTER_FINAL_ARCHIVE_SHA256"
|
||||
license all_of: ["AGPL-3.0-or-later", "GPL-3.0-or-later", "BSD-2-Clause", "BSD-3-Clause", "CC0-1.0"]
|
||||
|
||||
depends_on "python@3.12" => :test # only for test-suite tamper harness
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
# nix flake check # lint the flake
|
||||
#
|
||||
# To consume from another flake:
|
||||
# inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.3";
|
||||
# inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.4";
|
||||
# ...packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt;
|
||||
#
|
||||
# `make dist` has its own reproducibility gate. This development flake has no
|
||||
|
|
@ -30,7 +30,7 @@
|
|||
|
||||
zupt = pkgs.stdenv.mkDerivation {
|
||||
pname = "zupt";
|
||||
version = "5.2.3";
|
||||
version = "5.2.4";
|
||||
|
||||
# When publishing, replace this with `fetchurl` against the
|
||||
# release tarball. For local development the flake assumes it
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# ZUPT 5.2.3 for openSUSE Build Service
|
||||
# ZUPT 5.2.4 for openSUSE Build Service
|
||||
|
||||
This directory is the upstream, source-only OBS recipe for ZUPT. It is a
|
||||
handoff for the downstream maintainer; its presence does not mean that the
|
||||
|
|
@ -10,13 +10,13 @@ changes in this handoff. Alessandro de Oliveira Faria (Cabelo) is credited only
|
|||
as the openSUSE collaborator and downstream OBS package maintainer: he reviews
|
||||
the handoff, commits it through the portal/project he maintains, and may make
|
||||
the openSUSE-side adjustments he considers necessary. This role does not
|
||||
attribute upstream code or the 5.2.2/5.2.3 upstream changes to Cabelo.
|
||||
attribute upstream code or the 5.2.2/5.2.3/5.2.4 upstream changes to Cabelo.
|
||||
|
||||
## Files and source policy
|
||||
|
||||
| File | Purpose |
|
||||
|---|---|
|
||||
| `_service` | Fetch the immutable `v5.2.3` tag and create `Source0` at build time. |
|
||||
| `_service` | Fetch the immutable `v5.2.4` tag and create `Source0` at build time. |
|
||||
| `zupt.spec` | Build and test the CLI with optional external system integrations disabled. |
|
||||
| `zupt.changes` | openSUSE-format package history. |
|
||||
| `source-audit.sh` | Handoff wrapper for the repository scanner; run it from the complete handoff tree. |
|
||||
|
|
@ -29,11 +29,11 @@ https://github.com/cristiancmoises/zupt.git
|
|||
```
|
||||
|
||||
`obs_scm` stores an `.obscpio` plus `.obsinfo`. The `tar` and `recompress`
|
||||
services reconstruct `zupt-5.2.3.tar.gz` inside the build environment, which
|
||||
services reconstruct `zupt-5.2.4.tar.gz` inside the build environment, which
|
||||
matches `Source0` in the spec.
|
||||
|
||||
This source policy does not prohibit separately built release-page packages.
|
||||
The upstream 5.2.3 gates may publish the CLI source tarball, DEB, binary RPM,
|
||||
The upstream 5.2.4 gates may publish the CLI source tarball, DEB, binary RPM,
|
||||
SRPM, notice-bearing Linux tar.xz, Windows ZIP, and macOS DMG, together with a
|
||||
GUI DEB, noarch RPM, GUI SRPM, and source-only portable GUI ZIP after each
|
||||
format-specific test succeeds. None of those files is an OBS `Source0` input
|
||||
|
|
@ -138,7 +138,7 @@ reconstructed by the build-time services. Neither `%build` nor `%check` may
|
|||
access the network.
|
||||
|
||||
For a source RPM check outside OBS, place the service-produced
|
||||
`zupt-5.2.3.tar.gz` next to the spec and use a disposable RPM build tree:
|
||||
`zupt-5.2.4.tar.gz` next to the spec and use a disposable RPM build tree:
|
||||
|
||||
```sh
|
||||
rpm_top=$(mktemp -d)
|
||||
|
|
@ -166,11 +166,12 @@ unavailable rather than passing it. Earlier off-screen GUI smoke evidence is
|
|||
supporting evidence, not an exact-commit package result.
|
||||
|
||||
Post-tag CI integration failures prevented 5.2.2 promotion. These historical
|
||||
local results do not establish 5.2.3, native Windows or macOS success, hosted
|
||||
local results do not establish 5.2.4, native Windows or macOS success, hosted
|
||||
GitHub CI/release promotion, authenticated OBS acceptance, or resolution of the
|
||||
automatic openSUSE `debugsource` rpmlint `no-binary` finding. The exact 5.2.3
|
||||
candidate must repeat every applicable gate; those gates remain pending until
|
||||
recorded otherwise.
|
||||
automatic openSUSE `debugsource` rpmlint `no-binary` finding. The immutable
|
||||
5.2.3 candidate was not promoted because its source-policy test assumed LF for
|
||||
a Windows `.bat` file checked out as CRLF. The exact 5.2.4 candidate must repeat
|
||||
every applicable gate; those gates remain pending until recorded otherwise.
|
||||
|
||||
## Prior openSUSE packaging validation
|
||||
|
||||
|
|
@ -209,11 +210,11 @@ gate.
|
|||
## Handoff procedure for Alessandro/Cabelo
|
||||
|
||||
1. Upstream completes every applicable pre-tag source and local audit gate,
|
||||
then creates and verifies the annotated `v5.2.3` tag. Exact-tag hosted,
|
||||
then creates and verifies the annotated `v5.2.4` tag. Exact-tag hosted,
|
||||
native-platform, package, and promotion gates must pass before release or
|
||||
downstream handoff; the tag itself is never moved to repair a failure.
|
||||
2. With Git, `file`, bsdtar, tar, zip, unzip and SHA-256 tools installed, run
|
||||
`scripts/export-opensuse-package.sh v5.2.3`. Verify the reported ZIP and
|
||||
`scripts/export-opensuse-package.sh v5.2.4`. Verify the reported ZIP and
|
||||
SHA-256 outside the Git index. The handoff includes both
|
||||
`packaging/opensuse/source-audit.sh` and its required
|
||||
`scripts/check-source-only.sh`; keep that relative layout while auditing.
|
||||
|
|
@ -225,7 +226,7 @@ gate.
|
|||
```
|
||||
|
||||
4. From the extracted handoff root, run
|
||||
`packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.3.tar.gz`.
|
||||
`packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.4.tar.gz`.
|
||||
Then copy `_service`, `zupt.spec`, `zupt.changes` and `README.md`
|
||||
into the flat OBS package checkout. The audit wrapper is not an OBS build
|
||||
source and must not be copied without its companion `scripts/` directory.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
<service name="obs_scm" mode="manual">
|
||||
<param name="url">https://github.com/cristiancmoises/zupt.git</param>
|
||||
<param name="scm">git</param>
|
||||
<param name="revision">refs/tags/v5.2.3</param>
|
||||
<param name="revision">refs/tags/v5.2.4</param>
|
||||
<param name="versionformat">@PARENT_TAG@</param>
|
||||
<param name="versionrewrite-pattern">^v(.*)$</param>
|
||||
<param name="versionrewrite-replacement">\1</param>
|
||||
|
|
|
|||
|
|
@ -1,3 +1,12 @@
|
|||
-------------------------------------------------------------------
|
||||
Mon Aug 31 18:55:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>
|
||||
|
||||
- Update to 5.2.4:
|
||||
* Make the static Windows GUI package-version check robust to canonical
|
||||
CRLF checkouts.
|
||||
* Advance source-only package metadata and prepare final archive hashes.
|
||||
* Pin the OBS source service to the immutable v5.2.4 tag.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Aug 31 18:15:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>
|
||||
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@
|
|||
#
|
||||
|
||||
Name: zupt
|
||||
Version: 5.2.3
|
||||
Version: 5.2.4
|
||||
Release: 0
|
||||
Summary: Backup compression with authenticated and post-quantum encryption
|
||||
License: AGPL-3.0-or-later AND GPL-3.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ Requirements
|
|||
------------
|
||||
1. Python 3.9 or newer.
|
||||
2. PySide6 6.5 or newer, or a compatible PyQt6 package.
|
||||
3. ZUPT 5.2.3, installed as `zupt` on PATH or placed beside the launcher
|
||||
3. ZUPT 5.2.4, installed as `zupt` on PATH or placed beside the launcher
|
||||
(`zupt.exe` on Windows). A local command must have been built
|
||||
and tested independently; this bundle never downloads one.
|
||||
|
||||
|
|
@ -46,7 +46,7 @@ Troubleshooting
|
|||
---------------
|
||||
* "requires PySide6 or PyQt6": install one Qt binding through your operating
|
||||
system package manager or another trusted, preconfigured Python source.
|
||||
* "zupt not found": install ZUPT 5.2.3 or place its command beside
|
||||
* "zupt not found": install ZUPT 5.2.4 or place its command beside
|
||||
the launcher.
|
||||
* Set ZUPT_DEBUG=1 to print command-discovery diagnostics to stderr.
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@
|
|||
# installed smoke test.
|
||||
|
||||
Name: zupt
|
||||
Version: 5.2.3
|
||||
Version: 5.2.4
|
||||
Release: 1%{?dist}
|
||||
Summary: Backup compression with authenticated and post-quantum encryption
|
||||
|
||||
|
|
@ -101,6 +101,10 @@ comments. Plain archives use non-cryptographic checksums.
|
|||
%endif
|
||||
|
||||
%changelog
|
||||
* Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.4-1
|
||||
- Make the static Windows GUI package-version check robust to canonical CRLF
|
||||
checkouts, advance source-only package metadata, and prepare final hashes.
|
||||
|
||||
* Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.3-1
|
||||
- Correct the release-package CI version checks and portable GUI version
|
||||
contract, and make the openSUSE container replace busybox-gawk before
|
||||
|
|
|
|||
|
|
@ -15,6 +15,17 @@ pass() { pass_count=$((pass_count + 1)); printf 'PASS: %s\n' "$*"; }
|
|||
fail() { fail_count=$((fail_count + 1)); printf 'FAIL: %s\n' "$*" >&2; }
|
||||
skip() { skip_count=$((skip_count + 1)); printf 'SKIP: %s\n' "$*"; }
|
||||
|
||||
has_exact_line_crlf_safe() {
|
||||
local expected=$1 path=$2 line
|
||||
while IFS= read -r line || [[ -n $line ]]; do
|
||||
line=${line%$'\r'}
|
||||
if [[ $line == "$expected" ]]; then
|
||||
return 0
|
||||
fi
|
||||
done < "$path"
|
||||
return 1
|
||||
}
|
||||
|
||||
version=$(sed -n 's/^#define ZUPT_VERSION_STRING "\([^"]*\)".*/\1/p' include/zupt.h)
|
||||
[[ -n $version ]] || { printf 'FAIL: cannot determine upstream version\n' >&2; exit 1; }
|
||||
|
||||
|
|
@ -62,7 +73,8 @@ check_recipe_version GUI-Deb-Control \
|
|||
"$(awk '/^Version:/{print $2; exit}' gui/packaging/deb/control)"
|
||||
|
||||
if grep -Fqx "VERSION=\${VERSION:-$version}" install.sh && \
|
||||
grep -Fqx "if not defined VERSION set \"VERSION=$version\"" \
|
||||
has_exact_line_crlf_safe \
|
||||
"if not defined VERSION set \"VERSION=$version\"" \
|
||||
gui/packaging/windows/build-windows.bat && \
|
||||
grep -Fqx "Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= $version)" \
|
||||
gui/packaging/deb/control; then
|
||||
|
|
|
|||
Loading…
Reference in a new issue