release: restore ZUPT and harden source-only 5.2.2
This commit is contained in:
Cristian Cezar Moisés
parent
74e393ba3e
commit
ff99770bd0
205 changed files with 19627 additions and 13215 deletions
|
|
@ -1,3 +1,30 @@
|
|||
zupt (5.2.2-1) UNRELEASED; urgency=medium
|
||||
|
||||
* Prepare a source-only upstream release and remove incomplete vendored SDK
|
||||
and PQBOX inputs together with every precompiled-library fallback.
|
||||
* Make optional integrations explicit system dependencies, disabled by
|
||||
default, and preserve distribution compiler/linker flags and DESTDIR.
|
||||
* Add the reusable source scanner and openSUSE/OBS source packaging.
|
||||
* Restore the ZUPT/zupt application, package, executable, documentation, and
|
||||
artifact names; build and test with WITH_SDK=0 WITH_PQBOX=0.
|
||||
* Add explicit password prompt, file, and inherited-descriptor inputs.
|
||||
* Correct the licensing record without revoking historical MIT grants present
|
||||
in earlier repository revisions; current files follow current SPDX notices.
|
||||
* Preserve Yann Collet's BSD-2-Clause notice for the two xxHash-derived
|
||||
XXH64 source units and include it in package license metadata.
|
||||
* Record the CC0-1.0 option for pq-crystals/kyber-derived ML-KEM portions
|
||||
and ship the complete license text in every binary bundle.
|
||||
* Preserve the BSD-3-Clause notice for curve25519-donna-derived X25519
|
||||
portions and document their provenance without inventing a revision.
|
||||
* Promote only license-complete release assets: Windows is ZIP-only and the
|
||||
AppImage remains downstream-only pending a complete runtime source/relink
|
||||
compliance handoff.
|
||||
* Qualify older changelog statements about formally verified or
|
||||
constant-time assembly: 5.2.2 retains source, generated output and runtime
|
||||
regressions, but no reproducible formal-proof certificate for those paths.
|
||||
|
||||
-- Cristian Cezar Moisés <sac@securityops.co> Mon, 31 Aug 2026 00:00:00 +0000
|
||||
|
||||
vaptvupt (5.0.0-1) UNRELEASED; urgency=high
|
||||
|
||||
* ML-KEM-768 is now genuinely FIPS 203-conformant. Earlier releases shipped
|
||||
|
|
@ -377,12 +404,10 @@ vaptvupt (3.0.2-1) UNRELEASED; urgency=medium
|
|||
|
||||
vaptvupt (3.0.1-1) UNRELEASED; urgency=medium
|
||||
|
||||
* GUI license cleanup: removed MIT-license credit line from the
|
||||
about panel (the GUI is AGPL-3.0-or-later with commercial dual-
|
||||
licensing; the MIT reference was a templating mistake). Replaced
|
||||
gui/LICENSE-GUI (was MIT) with AGPL-3.0-or-later, mirroring the
|
||||
top-level LICENSE. Top-level LICENSE preamble updated to reflect
|
||||
the v3.0.0 Zupt → VaptVupt rename.
|
||||
* GUI license metadata changed to AGPL-3.0-or-later for the then-current
|
||||
source. The original entry incorrectly called earlier MIT notices a
|
||||
templating mistake; the 5.2.2 erratum records that historical grants remain
|
||||
valid for the exact material distributed under them.
|
||||
* GUI version-string parsing bug fix: the v3.0.0 GUI used
|
||||
`replace("zupt ", "")` to peel the product name out of the CLI's
|
||||
version banner, but that substring also appears inside the v3.0.0
|
||||
|
|
|
|||
|
|
@ -1,41 +1,49 @@
|
|||
Source: vaptvupt
|
||||
Source: zupt
|
||||
Section: utils
|
||||
Priority: optional
|
||||
Maintainer: Cristian Cezar Moisés <sac@securityops.co>
|
||||
Build-Depends:
|
||||
bash,
|
||||
coreutils,
|
||||
debhelper-compat (= 13),
|
||||
diffutils,
|
||||
file,
|
||||
findutils,
|
||||
gcc,
|
||||
gawk,
|
||||
git,
|
||||
grep,
|
||||
gzip,
|
||||
libarchive-tools,
|
||||
make,
|
||||
libc6-dev,
|
||||
python3 (>= 3.8)
|
||||
python3 (>= 3.8),
|
||||
sed,
|
||||
tar
|
||||
Standards-Version: 4.6.2
|
||||
Homepage: https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
Vcs-Browser: https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
Vcs-Git: https://git.securityops.co/cristiancmoises/vaptvupt.git
|
||||
Homepage: https://github.com/cristiancmoises/zupt
|
||||
Vcs-Browser: https://github.com/cristiancmoises/zupt
|
||||
Vcs-Git: https://github.com/cristiancmoises/zupt.git
|
||||
Rules-Requires-Root: no
|
||||
|
||||
Package: vaptvupt
|
||||
Package: zupt
|
||||
Architecture: any
|
||||
Provides: zupt (= ${binary:Version})
|
||||
Replaces: zupt
|
||||
Conflicts: zupt
|
||||
Depends: ${shlibs:Depends}, ${misc:Depends}
|
||||
Description: Post-quantum backup compression utility (formerly Zupt)
|
||||
VaptVupt (renamed from Zupt in v3.0.0 due to INPI Brasil trademark) is
|
||||
a pure-C11 backup compression utility featuring:
|
||||
Description: Post-quantum backup compression utility
|
||||
ZUPT is a pure-C11 backup compression utility featuring:
|
||||
* Post-quantum hybrid encryption (ML-KEM-768 + X25519, FIPS 203)
|
||||
* AES-256-CTR + HMAC-SHA256 authenticated encryption (Encrypt-then-MAC)
|
||||
* PBKDF2-SHA256 password key derivation (Argon2id in WITH_SDK=1 builds)
|
||||
* Multi-threaded compression with the VaptVupt LZ + ANS codec 2.60.4
|
||||
* Multi-threaded compression with the VaptVupt LZ + ANS codec 2.65.3
|
||||
* Full-disk backup and restore with sparse-region detection
|
||||
* End-to-end byte-level tamper detection on encrypted archives
|
||||
(0 silent-accept positions in the v1.6 exhaustive byte sweep)
|
||||
* Constant-time cryptographic primitives verified with Jasmin
|
||||
* Authenticated encrypted-archive metadata and per-block integrity checks
|
||||
* Portable C implementations with optional source-built assembly paths
|
||||
* NIST/RFC test vectors for SHA-256, SHA-3, ML-KEM-768, AES-256-CTR,
|
||||
HMAC-SHA256, X25519, PBKDF2, Argon2id
|
||||
HMAC-SHA256, X25519 and PBKDF2
|
||||
.
|
||||
The archive extension stays .zupt for format continuity (header magic
|
||||
unchanged). The binary `zupt` is preserved as a symlink to `vaptvupt`.
|
||||
unchanged). The package installs only /usr/bin/zupt.
|
||||
.
|
||||
The archive format includes an integrity trailer that authenticates the
|
||||
header and footer, per-block HMAC with bound frame-preface AAD, and
|
||||
optional encrypted comments.
|
||||
Encrypted archives include an integrity trailer that authenticates the
|
||||
header and footer, per-block HMAC with bound frame-preface AAD, and optional
|
||||
encrypted comments. Plain archives use non-cryptographic checksums.
|
||||
|
|
|
|||
|
|
@ -1,19 +1,35 @@
|
|||
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
||||
Upstream-Name: zupt
|
||||
Upstream-Name: ZUPT
|
||||
Upstream-Contact: Cristian Cezar Moisés <sac@securityops.co>
|
||||
Source: https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
Source: https://github.com/cristiancmoises/zupt
|
||||
|
||||
Files: *
|
||||
Copyright: 2025-2026 Cristian Cezar Moisés
|
||||
License: AGPL-3.0-or-later
|
||||
|
||||
Files: src/vv_*.c include/vaptvupt*.h include/vv_*.h vendor/zuptsdk/include/vv_*.h vendor/zuptsdk/include/vaptvupt*.h
|
||||
Files: src/vaptvupt_api.c src/vv_*.c include/vaptvupt*.h include/vv_*.h
|
||||
Copyright: 2025-2026 Cristian Cezar Moisés (VaptVupt codec)
|
||||
License: GPL-3.0-or-later
|
||||
|
||||
Files: vendor/zuptsdk/*
|
||||
Copyright: 2025-2026 Cristian Cezar Moisés (libzuptsdk)
|
||||
License: GPL-3.0-or-later
|
||||
Files: src/zupt_xxh.c
|
||||
Copyright: 2012-2021 Yann Collet
|
||||
2025-2026 Cristian Cezar Moisés
|
||||
License: AGPL-3.0-or-later and BSD-2-Clause
|
||||
|
||||
Files: src/zupt_mlkem.c
|
||||
Copyright: 2025-2026 Cristian Cezar Moisés
|
||||
pq-crystals/kyber contributors (adapted portions)
|
||||
License: AGPL-3.0-or-later and CC0-1.0
|
||||
|
||||
Files: src/zupt_x25519.c
|
||||
Copyright: 2008 Google Inc.
|
||||
2025-2026 Cristian Cezar Moisés
|
||||
License: AGPL-3.0-or-later and BSD-3-Clause
|
||||
|
||||
Files: src/vv_xxh64.c
|
||||
Copyright: 2012-2021 Yann Collet
|
||||
2025-2026 Cristian Cezar Moisés (VaptVupt codec adaptation)
|
||||
License: GPL-3.0-or-later and BSD-2-Clause
|
||||
|
||||
Files: debian/*
|
||||
Copyright: 2025-2026 Cristian Cezar Moisés <sac@securityops.co>
|
||||
|
|
@ -47,3 +63,41 @@ License: GPL-3.0-or-later
|
|||
.
|
||||
On Debian systems, the full text of the GNU General Public License
|
||||
version 3 can be found in the file `/usr/share/common-licenses/GPL-3'.
|
||||
|
||||
License: BSD-2-Clause
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions are met:
|
||||
.
|
||||
* Redistributions of source code must retain the copyright notice, this list
|
||||
of conditions and the disclaimer.
|
||||
* Redistributions in binary form must reproduce the copyright notice, this
|
||||
list of conditions and the disclaimer in the documentation and/or other
|
||||
materials provided with the distribution.
|
||||
.
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
||||
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
|
||||
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
||||
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
||||
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
License: CC0-1.0
|
||||
To the extent possible under law, the upstream affirmer has waived all
|
||||
copyright and related or neighboring rights to the adapted portions.
|
||||
.
|
||||
The complete CC0 1.0 Universal legal text is shipped in
|
||||
`/usr/share/doc/zupt/LICENSE-CC0-1.0`.
|
||||
|
||||
License: BSD-3-Clause
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the copyright notice, conditions,
|
||||
and disclaimer are retained; neither the name of Google Inc. nor contributor
|
||||
names may be used to endorse derived products without prior permission.
|
||||
.
|
||||
The complete BSD-3-Clause notice and disclaimer are shipped in
|
||||
`/usr/share/doc/zupt/LICENSE-BSD-3-Clause`.
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
# Honour Debian's reproducible-build epoch when set by dpkg-buildpackage.
|
||||
export SOURCE_DATE_EPOCH ?= 1747699200
|
||||
export SOURCE_DATE_EPOCH ?= 1788134400
|
||||
|
||||
# Hardening flags — Debian's defaults are already strong, this adds project-
|
||||
# specific ones.
|
||||
|
|
@ -15,21 +15,18 @@ export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
|
|||
|
||||
override_dh_auto_build:
|
||||
# Source-only build: no vendored libraries, native crypto only.
|
||||
$(MAKE) WITH_SDK=0 -j$$(nproc)
|
||||
$(MAKE) WITH_SDK=0 WITH_PQBOX=0 -j$$(nproc)
|
||||
|
||||
override_dh_auto_test:
|
||||
# Distro-safe regression subset (F-06..F-12, dedup-nonce, NIST/RFC vectors).
|
||||
$(MAKE) WITH_SDK=0 check
|
||||
# Distro-safe quick, traversal, integrity, codec and NIST/RFC checks.
|
||||
$(MAKE) WITH_SDK=0 WITH_PQBOX=0 check
|
||||
|
||||
override_dh_auto_install:
|
||||
# Binary package is `vaptvupt` -> stage into debian/vaptvupt (dh derives the
|
||||
# Binary package is `zupt` -> stage into debian/zupt (dh derives the
|
||||
# staging dir from the Package: name in debian/control). Source-only: nothing
|
||||
# to install beyond `make install` (no .so).
|
||||
$(MAKE) DESTDIR=$(CURDIR)/debian/vaptvupt PREFIX=/usr WITH_SDK=0 install
|
||||
$(MAKE) DESTDIR=$(CURDIR)/debian/zupt PREFIX=/usr \
|
||||
WITH_SDK=0 WITH_PQBOX=0 INSTALL_LEGACY_ALIAS=0 install
|
||||
|
||||
override_dh_auto_clean:
|
||||
$(MAKE) clean
|
||||
|
||||
# Skip dh_strip's separate -dbgsym packages for a single-source-package layout.
|
||||
override_dh_strip:
|
||||
dh_strip --no-automatic-dbgsym
|
||||
|
|
|
|||
12
packaging/debian/zupt.docs
Normal file
12
packaging/debian/zupt.docs
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
README.md
|
||||
CHANGELOG.md
|
||||
SECURITY.md
|
||||
THREAT_MODEL.md
|
||||
NOTICE
|
||||
THIRD-PARTY-NOTICES.md
|
||||
LICENSE
|
||||
LICENSE-AGPL-3.0
|
||||
LICENSE-GPL-3.0
|
||||
LICENSE-BSD-2-Clause
|
||||
LICENSE-BSD-3-Clause
|
||||
LICENSE-CC0-1.0
|
||||
Loading…
Reference in a new issue