release: restore ZUPT and harden source-only 5.2.2

tests/test_benchmark_temp_safety.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -Eeuo pipefail
+
+bin=${1:-./zupt}
+tmp=$(mktemp -d "${TMPDIR:-/tmp}/zupt-bench-safety.XXXXXXXX")
+trap 'rm -rf -- "$tmp"' EXIT HUP INT TERM
+
+fail() {
+    printf 'FAIL: %s\n' "$*" >&2
+    exit 1
+}
+
+case $(uname -s 2>/dev/null || printf unknown) in
+    MINGW*|MSYS*|CYGWIN*)
+        printf 'SKIP: historical POSIX /tmp symlink benchmark test is not native on Windows\n'
+        exit 0
+        ;;
+esac
+
+printf 'benchmark sentinel must remain unchanged\n' > "$tmp/sentinel"
+cp "$tmp/sentinel" "$tmp/sentinel.expected"
+
+# The historical implementation derived this public directory from its PID
+# and followed a precreated text.txt symlink. A fresh Bash process has `$$`
+# equal to the PID retained by exec, including on macOS Bash 3.2, so the test
+# recreates that exact attack without guessing another process.
+bash -c '
+    set -e
+    old_directory="/tmp/zupt_bench_corpus_$$"
+    printf "%s\n" "$old_directory" > "$2/old-directory"
+    mkdir "$old_directory"
+    ln -s "$2/sentinel" "$old_directory/text.txt"
+    test -L "$old_directory/text.txt"
+    exec "$1" bench --compare >/dev/null 2>&1
+' zupt-benchmark-test "$bin" "$tmp" || fail 'benchmark comparison failed'
+
+cmp "$tmp/sentinel.expected" "$tmp/sentinel" ||
+    fail 'benchmark followed the historical predictable temporary symlink'
+old_directory=$(sed -n '1p' "$tmp/old-directory")
+case $old_directory in
+    /tmp/zupt_bench_corpus_[0-9]*) ;;
+    *) fail 'unexpected historical temporary path' ;;
+esac
+if [[ -d $old_directory ]]; then
+    mv "$old_directory" "$tmp/historical-remnant"
+fi
+
+printf 'private benchmark workspace: PASS\n'