release: restore ZUPT and harden source-only 5.2.2

2026-08-31 14:14:36 -03:00 · 2026-08-31 14:14:36 -03:00 · ff99770bd0
commit ff99770bd0
parent 74e393ba3e
205 changed files with 19627 additions and 13215 deletions
--- a/packaging/rpm/vaptvupt.spec
+++ b/packaging/rpm/vaptvupt.spec
@ -1,72 +1,70 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 #
-# Fedora / RHEL / CentOS RPM spec for vaptvupt.
+# Fedora / RHEL / CentOS RPM spec for zupt.
 #
 # Build with:
-#   spectool -g vaptvupt.spec               # fetches the upstream tarball
-#   rpmbuild -ba vaptvupt.spec              # builds source + binary RPMs
+#   spectool -g zupt.spec                    # fetches the upstream tarball
+#   rpmbuild -ba zupt.spec                   # builds source + binary RPMs
 #
 # To bring a release into production:
-#   1. Run `make dist` upstream → /tmp/vaptvupt-VERSION.tar.gz (reproducible).
-#   2. Upload to a stable release URL (git.securityops.co releases).
+#   1. Run `make dist` upstream → /tmp/zupt-VERSION.tar.gz (reproducible).
+#   2. Upload to the canonical GitHub release.
 #   3. Update %{version} below.
-#   4. Run `sha256sum /tmp/vaptvupt-VERSION.tar.gz` and update Source0
+#   4. Run `sha256sum /tmp/zupt-VERSION.tar.gz` and update Source0
 #      checksum (handled by spectool when configured) or pin via
 #      sha256sum in a separate manifest if your distro requires it.
-#   5. rpmbuild --define '_topdir ~/rpmbuild' -ba zupt.spec
+#   5. rpmbuild --define '_topdir /path/to/rpmbuild' -ba zupt.spec
 #
-# This spec is written for Fedora 38+ and EPEL 9+; it should also work
-# on RHEL 8 (with EPEL) by adjusting BuildRequires if Python 3.8+ isn't
-# in the base.
+# This is an upstream Fedora-family recipe. A target is supported only after
+# that exact distribution release and architecture have built and passed the
+# installed smoke test.

-Name:           vaptvupt
-Version:        5.2.1
+Name:           zupt
+Version:        5.2.2
 Release:        1%{?dist}
-Summary:        Post-quantum backup compression utility (AES-256 + ML-KEM-768 + Argon2id, formerly Zupt)
+Summary:        Backup compression with authenticated and post-quantum encryption

-License:        AGPL-3.0-or-later AND GPL-3.0-or-later
-URL:            https://git.securityops.co/cristiancmoises/vaptvupt
+License:        AGPL-3.0-or-later AND GPL-3.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0
+URL:            https://github.com/cristiancmoises/zupt
 Source0:        %{url}/releases/download/v%{version}/%{name}-%{version}.tar.gz

-# v3.0.0: legacy `zupt` package is superseded. Renaming was forced
-# by a prior INPI Brasil trademark registration on "Zupt". The
-# archive extension (.zupt), wire format, magic bytes, and C ABI
-# are unchanged.
-Provides:       zupt = %{version}-%{release}
-Obsoletes:      zupt < 3.0.0
-Conflicts:      zupt < 3.0.0
-
 BuildRequires:  gcc
+BuildRequires:  git-core
 BuildRequires:  make
 BuildRequires:  glibc-devel
 BuildRequires:  python3 >= 3.8
+BuildRequires:  bash
+BuildRequires:  coreutils
+BuildRequires:  diffutils
+BuildRequires:  file
+BuildRequires:  findutils
+BuildRequires:  gawk
+BuildRequires:  grep
+BuildRequires:  gzip
+BuildRequires:  sed
+BuildRequires:  tar
 # python3 is only needed for the regression-test harness (byte sweeps,
 # tamper injection). The shipped binary has no Python dependency.

-Requires:       glibc
+Provides:       bundled(vaptvupt-codec) = 2.65.3

 %description
-Zupt is a pure-C11 backup compression utility featuring:
+ZUPT is a pure-C11 backup compression utility featuring:

-  * Post-quantum hybrid encryption (ML-KEM-768 + X25519, FIPS 203,
-    validated byte-for-byte against OpenSSL's ML-KEM-768) and full
-    pure ML-KEM-768 (--pq-only)
+  * Post-quantum hybrid encryption (ML-KEM-768 + X25519) and full
+    ML-KEM-768 mode (--pq-only)
  * AES-256-CTR + HMAC-SHA256 authenticated encryption (Encrypt-then-MAC)
  * PBKDF2-SHA256 password key derivation (Argon2id in WITH_SDK=1 builds)
  * Multi-threaded compression with the VaptVupt LZ + ANS codec
  * Full-disk backup and restore with sparse-region detection
-  * End-to-end byte-level tamper detection on encrypted archives
-    (0 silent-accept positions in the v1.6 exhaustive byte sweep)
-  * Constant-time cryptographic primitives verified with Jasmin
+  * Authenticated encrypted-archive metadata and per-block integrity checks
+  * Portable C implementations with optional source-built assembly paths
  * NIST/RFC test vectors for SHA-256, SHA-3, ML-KEM-768, AES-256-CTR,
-    HMAC-SHA256, X25519, PBKDF2, Argon2id
+    HMAC-SHA256, X25519 and PBKDF2

-The archive format includes an integrity trailer that authenticates
-the header and footer, per-block HMAC with bound frame-preface AAD,
-and optional encrypted comments.
-
-%global debug_package %{nil}
-# Single source RPM, no -debuginfo split for the initial release.
+Encrypted archives include an integrity trailer that authenticates the header
+and footer, per-block HMAC with bound frame-preface AAD, and optional encrypted
+comments. Plain archives use non-cryptographic checksums.

 %prep
 %autosetup -n %{name}-%{version}
@ -74,41 +72,41 @@ and optional encrypted comments.
 %build
 # Source-only build (WITH_SDK=0): no vendored libraries, no external crypto
 # dependency. Fedora's default optflags plus the project's warning set.
-%make_build WITH_SDK=0 \
-    CFLAGS="%{optflags} -fPIE -Wall -Wextra -std=c11 -Iinclude -Isrc" \
-    LDFLAGS="%{?build_ldflags} -pie" \
-    LDLIBS="-lm -lpthread"
+%make_build V=1 WITH_SDK=0 WITH_PQBOX=0 \
+    CFLAGS="%{optflags}" \
+    LDFLAGS="%{?build_ldflags}"

 %check
-# Distro-safe regression subset: F-06 HMAC trials, F-08 top-MAC sweep,
-# F-09 byte sweep, F-10..F-12 regressions, the dedup-nonce regression,
-# and NIST/RFC vectors. Skips threaded/dist-reproducibility tests that
-# are sensitive to the build host.
-%make_build WITH_SDK=0 \
-    CFLAGS="%{optflags} -fPIE -Wall -Wextra -std=c11 -Iinclude -Isrc" \
-    LDFLAGS="%{?build_ldflags} -pie" \
-    LDLIBS="-lm -lpthread" \
+# Distro-safe quick, path-traversal, integrity, codec, HMAC and NIST/RFC
+# checks. Full, optional-integration and dist-reproducibility suites remain
+# release gates outside the package build.
+%make_build V=1 WITH_SDK=0 WITH_PQBOX=0 \
+    CFLAGS="%{optflags}" \
+    LDFLAGS="%{?build_ldflags}" \
    check

 %install
-%make_install WITH_SDK=0 DESTDIR=%{buildroot} PREFIX=/usr
+%make_install WITH_SDK=0 WITH_PQBOX=0 INSTALL_LEGACY_ALIAS=0 INSTALL_LICENSES=0 \
+    PREFIX=%{_prefix} BINDIR=%{_bindir} MANDIR=%{_mandir}

 %files
-%license LICENSE
-%doc README.md SECURITY.md CHANGELOG.md
+%license LICENSE LICENSE-AGPL-3.0 LICENSE-GPL-3.0 LICENSE-BSD-2-Clause LICENSE-BSD-3-Clause LICENSE-CC0-1.0 NOTICE THIRD-PARTY-NOTICES.md
+%doc README.md SECURITY.md THREAT_MODEL.md CHANGELOG.md
 %{_bindir}/%{name}
-%{_bindir}/zupt
 %{_datadir}/bash-completion/completions/%{name}
-%{_datadir}/bash-completion/completions/zupt
 %{_datadir}/zsh/site-functions/_%{name}
-%{_datadir}/zsh/site-functions/_zupt
 %{_datadir}/fish/vendor_completions.d/%{name}.fish
 %if 0%{?_mandir:1}
 %{_mandir}/man1/%{name}.1*
-%{_mandir}/man1/zupt.1*
 %endif

 %changelog
+* Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.2-1
+- Source-only release; optional SDK/PQBOX integrations use system development
+  packages only and are disabled for this package.
+- Preserve distribution flags and debuginfo, remove RPATH/vendor-library
+  fallbacks, run the real upstream check target, and restore the zupt command.
+
 * Sat Jul 11 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.1.0-1
 - Codec 2.65.0; large compression-ratio gains (auto format_v2 + level-scaled
  block window); --dedup keeps a small block; GUI compress-hang and