.github/workflows/ci.yml

@@ -469,12 +469,6 @@ jobs:
           test "$(rpm -qp --qf '%{ARCH}' "$gui_rpm")" = noarch
           rpm -qp --requires "$gui_rpm" | grep -Fx "zupt >= $version"
           test "$(rpm -qp --qf '%{NAME}' "$gui_srpm")" = zupt-gui
-          test "$(rpm -qp --qf '%{VERSION}-%{RELEASE}' "$gui_srpm")" = "$version-1"
-          test "$(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_srpm")" = 1
-          test "$(rpm -qp --qf '%{SOURCERPM}' "$gui_srpm")" = '(none)'
-          test "$(rpm -qpl "$gui_srpm" | wc -l)" -eq 2
-          rpm -qpl "$gui_srpm" | grep -Fx "zupt-gui-$version.tar.gz"
-          rpm -qpl "$gui_srpm" | grep -Fx zupt-gui.spec
       - name: Build the matching Fedora CLI RPM
         run: |
           version=$(sed -n 's/^#define ZUPT_VERSION_STRING "\([^"]*\)".*/\1/p' include/zupt.h)

.github/workflows/promote-release.yml

@@ -389,17 +389,11 @@ jobs:
           [[ $(rpm -qp --qf '%{VERSION}' "$rpm_file") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$rpm_file") == 0 ]]
           [[ $(rpm -qp --qf '%{ARCH}' "$rpm_file") == x86_64 ]]
-          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$rpm_file") == '(none)' ]]
-          [[ $(rpm -qp --qf '%{SOURCERPM}' "$rpm_file") == "$srpm_name" ]]
           srpm=$asset_dir/$srpm_name
           [[ $(rpm -qp --qf '%{NAME}' "$srpm") == zupt ]]
           [[ $(rpm -qp --qf '%{VERSION}' "$srpm") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$srpm") == 0 ]]
-          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$srpm") == 1 ]]
+          [[ $(rpm -qp --qf '%{ARCH}' "$srpm") == src ]]
-          [[ $(rpm -qp --qf '%{SOURCERPM}' "$srpm") == '(none)' ]]
-          [[ $(rpm -qpl "$srpm" | wc -l) -eq 2 ]]
-          rpm -qpl "$srpm" | grep -Fx "zupt-$VERSION.tar.gz"
-          rpm -qpl "$srpm" | grep -Fx zupt.spec
 
           gui_deb=$asset_dir/$gui_deb_name
           dpkg-deb --info "$gui_deb" >/dev/null
@@ -412,18 +406,12 @@ jobs:
           [[ $(rpm -qp --qf '%{VERSION}' "$gui_rpm") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$gui_rpm") == 1 ]]
           [[ $(rpm -qp --qf '%{ARCH}' "$gui_rpm") == noarch ]]
-          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_rpm") == '(none)' ]]
-          [[ $(rpm -qp --qf '%{SOURCERPM}' "$gui_rpm") == "$gui_srpm_name" ]]
           rpm -qp --requires "$gui_rpm" | grep -Fx "zupt >= $VERSION"
           gui_srpm=$asset_dir/$gui_srpm_name
           [[ $(rpm -qp --qf '%{NAME}' "$gui_srpm") == zupt-gui ]]
           [[ $(rpm -qp --qf '%{VERSION}' "$gui_srpm") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$gui_srpm") == 1 ]]
-          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_srpm") == 1 ]]
+          [[ $(rpm -qp --qf '%{ARCH}' "$gui_srpm") == src ]]
-          [[ $(rpm -qp --qf '%{SOURCERPM}' "$gui_srpm") == '(none)' ]]
-          [[ $(rpm -qpl "$gui_srpm" | wc -l) -eq 2 ]]
-          rpm -qpl "$gui_srpm" | grep -Fx "zupt-gui-$VERSION.tar.gz"
-          rpm -qpl "$gui_srpm" | grep -Fx zupt-gui.spec
 
           linux_tar=$asset_dir/$linux_tar_name
           python3 - "$linux_tar" "zupt-$VERSION-linux-x86_64" <<'PY'

AUDIT.md

@@ -223,7 +223,7 @@ its volume and file index against the traversal handle, and marks only that
 identity-checked handle for deletion. The live-workspace
 regression injects a directory symlink and verifies that its external sentinel
 survives. These are reviewed fixes and regression coverage, not independent
-certification by themselves; the exact-tag evidence is recorded below.
+certification or proof that an exact-tag 5.2.8 gate passed.
 
 The C/C++ default-branch analysis of commit `69fc26b` closed #5, #6, and #7,
 then reported High #8, #9, and #10 solely in the newly added SDK regression:
@@ -248,24 +248,12 @@ matching, and requires extraction plus a full tree diff. The path-confinement
 regression independently constructs the BMP/non-BMP archive name from ASCII
 hex and requires byte-exact listing and extraction.
 
-Because that pre-tag run failed, it remains diagnostic evidence rather than
+Because that pre-tag run failed, it is diagnostic evidence rather than release
-release approval. The immutable `v5.2.8` tag at
+approval. The exact 5.2.8 candidate must repeat the required suite. Exact-tag
-`ebb9ab3aa1d42c50030ca02883f6162dc4771fe1` repeated the complete suite in
+native Windows/macOS, hosted CI, authenticated OBS service execution, and
-manually dispatched run `33456209269`: all 15 jobs passed, including native
+release promotion remain pending until recorded otherwise. The pre-tag
-Windows/macOS, the pinned local OBS service chain, source reproducibility,
+openSUSE Tumbleweed job did build source and binary RPMs, pass `rpmlint` without
-DEB/RPM/SRPM, installed-package, sanitizer, analyzer, and source-only gates.
+suppressions, and pass install/round-trip/uninstall checks.
-The canonical source archive was reproduced at 798296 bytes with SHA-256
-`378b9506211545b9594cf0d38ac8955d9b1cac34eb6b379ae0ec26b84edb65f7`.
-
-Initial promotion run `33457344882` stopped before release creation because
-its validator incorrectly assumed that an SRPM's `%{ARCH}` must be `src`.
-Both artifacts were genuine source packages: `%{SOURCEPACKAGE}` was `1`,
-`%{SOURCERPM}` was absent, each payload was exactly its Source0 plus spec, and
-each binary RPM referenced the matching SRPM. Commit `33eb904` changed the
-gate to those canonical metadata and payload checks. Corrected promotion run
-`33457868306` then validated the same tag-bound artifacts and published exactly
-13 assets. No asset was rebuilt to pass promotion. These are reproducible
-project records, not independent certification.
 
 ## Cryptographic review boundary
 

CHANGELOG.md

@@ -57,13 +57,9 @@ unchanged.
 - Realign current code, package, workflow, artifact, and documentation
   references to 5.2.8, and pin the AUR/Homebrew SHA-256 and Guix content hash
   to the final reproducible source archive before tagging.
-- Exact-tag run `33456209269` passed all 15 source, package, analyzer,
+- Require fresh exact-`v5.2.8` source, checksum, hosted CI, native-platform,
-  sanitizer, OBS, Windows, and macOS jobs at `ebb9ab3`. Promotion initially
+  package, OBS, and promotion evidence. This entry does not claim those gates
-  stopped before publication because its validator treated `%{ARCH}` as the
+  passed, and no v5.2.7 result transfers automatically.
-  SRPM discriminator; the genuine SRPMs instead correctly carry
-  `%{SOURCEPACKAGE}=1`. Commit `33eb904` corrected and strengthened that gate,
-  and run `33457868306` published the exact 13 tested assets without rebuilding
-  them. No v5.2.7 result transfers to this evidence.
 
 ## [5.2.7] — 2026-08-31 — Native test-harness portability corrections
 

DISTRIBUTION.md

@@ -37,13 +37,7 @@ Windows distribution checks, before an old MSYS `grep` non-BMP pattern failed
 in the later smoke. ZUPT's redirected listing was byte-correct; the corrected
 gate uses byte-exact, locale-independent checks and requires extraction plus a
 full tree diff. The failed run is diagnostic evidence only.
-Exact-tag run `33456209269` subsequently passed all 15 jobs at
+Corrective packages and release assets must use `v5.2.8`; never move or
-`ebb9ab3aa1d42c50030ca02883f6162dc4771fe1`, including the pinned local OBS
-source-service chain, native
-Windows/macOS, and every package gate. Promotion run `33457868306` published
-the exact tested 13-file set; the source archive SHA-256 is
-`378b9506211545b9594cf0d38ac8955d9b1cac34eb6b379ae0ec26b84edb65f7`.
-Corrective packages and release assets use `v5.2.8`; never move or
 overwrite an earlier tag or checksum, and never transfer prior evidence
 automatically. Version 5.2.8 corrects those native test boundaries, hardens
 three path-race boundaries, and adds the SDK regression to release/hosted Linux
@@ -301,10 +295,9 @@ For every published artifact:
 Do not infer multi-architecture compatibility from portable source. Do not add
 precompiled optional libraries to make a package build.
 
-The 13 gated assets are published at the
+Publish release assets at the canonical GitHub release. If an expected asset is
-[canonical GitHub release](https://github.com/cristiancmoises/zupt/releases/tag/v5.2.8).
+absent or has a different checksum, report that target as unpublished rather
-If an expected asset is absent or has a different checksum, report that target
+than redirecting consumers to an unverified file.
-as unpublished rather than redirecting consumers to an unverified file.
 
 ## Downstream checklist
 

INSTALL.md

@@ -38,11 +38,11 @@ check`; a MinGW/Wine reproduction isolated the cause to the non-console
 password-prompt test entering `_getch`. Version 5.2.8 makes both
 fixtures portable, hardens the three CodeQL High path-race boundaries described
 in the security documents, and adds `sdk-test` to release and hosted Linux
-gates. Exact-tag run `33456209269` passed all 15 jobs, and promotion run
+gates. It still requires fresh exact-version validation. Do not treat any prior
-`33457868306` published the exact tested set. Do not treat any prior candidate's
+candidate's artifacts or evidence as 5.2.8 packages or validation.
-artifacts or evidence as 5.2.8 packages or validation.
 
-The published 5.2.8 package set is exactly these 13 gated assets:
+The 5.2.8 package set eligible for promotion after each target gate succeeds is
+exactly these 13 assets:
 
 | Component | Gated artifacts |
 |---|---|

README.md

@@ -19,9 +19,7 @@ POSIX-mode projection. The C/C++ default-branch scan run `33452563116` of
 commit `7a8e5c5` completed successfully after the follow-up changed the new SDK
 regression to no-follow descriptors plus `fstat` and descriptor reads. Alerts
 #5 through #10 are fixed, and the authenticated code-scanning API reported zero
-open alerts. Final release-commit CodeQL run `33456049125` also completed
+open alerts. These corrections do not change archive format v1.6,
-successfully, with the API still reporting zero open alerts. These corrections
-do not change archive format v1.6,
 cryptography, the bundled codec release, or the SDK ABI.
 
 The predecessor `v5.2.7` tag is immutable and was not promoted. Exact-tag run
@@ -41,16 +39,6 @@ gate creates that name from byte escapes, validates Latin-1, BMP, and non-BMP
 listing bytes with Python, and requires extraction plus a full tree diff. The
 failed run is diagnostic evidence, not release-candidate approval.
 
-The immutable `v5.2.8` candidate at commit
-`ebb9ab3aa1d42c50030ca02883f6162dc4771fe1` subsequently passed all 15 jobs in
-manually dispatched exact-tag run `33456209269`. That run includes the pinned
-local OBS source-service chain, reproducible source checks, GCC/Clang, analyzers,
-sanitizers, DEB/RPM/SRPM and portable-package gates, the native Windows ZIP
-round trip, and the mounted macOS arm64 DMG test. Corrected promotion run
-`33457868306` validated and published exactly 13 assets. The canonical source
-archive is 798296 bytes with SHA-256
-`378b9506211545b9594cf0d38ac8955d9b1cac34eb6b379ae0ec26b84edb65f7`.
-
 Version 5.2.2 restored the original ZUPT product name and the `zupt` command.
 The `.zupt` archive extension, format v1.6, magic bytes, codec identifiers, and
 SDK ABI remain unchanged. An optional `vaptvupt` command alias may be provided
@@ -67,9 +55,8 @@ SDK link-target/mode regression, static path-race guards, portable raw-C1
 fixture with Bash 3.2 unsigned-byte normalization, native redirected-prompt
 and protected-DACL regressions, byte-exact BMP/non-BMP Windows list and extract
 checks, and `sdk-test` CI step cover these boundaries. All current release
-paths moved to 5.2.8 and received fresh exact-tag hosted CI, package,
+paths move to 5.2.8 and require fresh exact-tag hosted CI, package,
-native-platform, source-only, checksum, OBS, and promotion evidence in runs
+native-platform, source-only, checksum, OBS, and promotion evidence.
-`33456209269` and `33457868306`.
 
 ## Corrective changes introduced in 5.2.7
 
@@ -190,12 +177,8 @@ See [CHANGELOG.md](CHANGELOG.md) for the release record.
 ## Canonical source
 
 - Canonical: https://github.com/cristiancmoises/zupt
-- Codeberg mirror: https://codeberg.org/berkeley/zupt
-- SecurityOps Brazil mirror: https://git.securityops.com.br/cristiancmoises/zupt
-- SecurityOps global mirror: https://git.securityops.co/cristiancmoises/zupt
 
-GitHub remains canonical. The `v5.2.8` tag and its 13 release assets are also
+Release tags and source archives are published from this repository.
-published byte-for-byte on the three mirrors above.
 
 ## Source-only policy
 
@@ -211,8 +194,8 @@ built and tested is not presented as supported.
 
 ## 5.2.8 release artifacts
 
-The published 5.2.8 release contains exactly the following 13 files after
+The 5.2.8 release workflow is defined to produce exactly the following 13 files only after
-every corresponding target gate succeeded. `SHA256SUMS` records the exact promoted
+the corresponding target gate succeeds. `SHA256SUMS` records the exact promoted
 filenames and digests. The release notes identify the tested commit and the
 manually dispatched CI run; that run's job definitions and logs are the runtime
 evidence for runner image, architecture, toolchain, results, and explicit
@@ -255,10 +238,9 @@ software already installed on the target. Other historical GUI packages and
 platform installers are not carried forward implicitly.
 
 The canonical source repository is
-<https://github.com/cristiancmoises/zupt>. The canonical release is
+<https://github.com/cristiancmoises/zupt>. Release assets referenced by the AUR,
-<https://github.com/cristiancmoises/zupt/releases/tag/v5.2.8>. Assets referenced
+Homebrew, Guix, or generic RPM recipes must exist in the canonical GitHub
-by the AUR, Homebrew, Guix, or generic RPM recipes must exist there at their
+release at their recorded URL before those recipes are published.
-recorded URL before those recipes are published.
 
 Audit the current checkout and its Git archive with:
 
@@ -428,12 +410,11 @@ not promoted. The immutable v5.2.7 tag was also not promoted: exact-tag run
 recorded 13 successful jobs, and cancelled Windows after the hosted job stalled
 in `make check`; a MinGW/Wine reproduction isolated the stall to
 `test --password-prompt ... </dev/null` entering `_getch`. The
-exact 5.2.8 candidate then repeated all required gates: exact-tag run
+exact 5.2.8 candidate must repeat all required gates. Native Windows and macOS,
-`33456209269` completed 15/15 jobs successfully, including native Windows and
+hosted GitHub CI/release promotion, authenticated OBS, and resolution of the
-macOS, the pinned local OBS service chain, source/package gates, and the
+openSUSE automatic `debugsource` rpmlint `no-binary`
-openSUSE RPM checks. Promotion run `33457868306` published the exact tested
+finding remain pending until recorded otherwise. Unexecuted gates are `SKIP`,
-asset allowlist. Unexecuted environments remain `SKIP`, never `PASS`; these
+never `PASS`.
-project-run results are not independent certification.
 
 On Windows, 5.2.8 scopes output handling to normal local Win32 paths. A MinGW
 cross-build or Wine run is not native-Windows evidence; the `windows-latest`
@@ -475,9 +456,10 @@ lists, tests, extracts, and restores it byte-exact. The full local Linux gate
 passed on commit `ff99770`. This is not a claim that a 5.2.1 reader understands every new
 flag-gated 5.2.2 encoding or that every historical combination was tested.
 
-The build/audit commands and recorded 5.2.8 outcomes are maintained in the
+The candidate commands and outcome fields for 5.2.8 are maintained in the
-release evidence and
+release handoff and
-[packaging/opensuse/README.md](packaging/opensuse/README.md). No architecture or
+[packaging/opensuse/README.md](packaging/opensuse/README.md). They must be
+updated from the final release candidate before tagging. No architecture or
 distribution is claimed merely because the code has a fallback path.
 
 ## Source archive
@@ -498,12 +480,12 @@ the same SHA-256. The AUR, Homebrew and Guix recipes are `export-ignore` so
 their checksum fields do not make the archive self-referential. `make dist`
 archives the verified `HEAD` tree object rather than embedding the commit ID,
 so a commit changing only those ignored recipes leaves the fixed-epoch archive
-byte-identical. The recipes remain versioned in Git and pin the final tagged
+byte-identical. The recipes remain versioned in Git and must be filled with the
-digest `378b9506211545b9594cf0d38ac8955d9b1cac34eb6b379ae0ec26b84edb65f7`.
+final digest before the tag is published.
 
 ## openSUSE and OBS
 
-The maintained upstream recipe is in packaging/opensuse. It targets the
+The maintained upstream recipe is in packaging/opensuse. It is prepared for an
 immutable v5.2.8 tag, disables submodules and Git LFS, builds with
 WITH_SDK=0 WITH_PQBOX=0, runs real checks, and installs without the renamed-era
 `vaptvupt` alias.

SECURITY.md

@@ -226,8 +226,7 @@ media before proceeding.
 These changes address the three 5.2.8 CodeQL High reports: #5 at SDK key
 publication, #6 at POSIX disk-target classification/use, and #7 at benchmark
 workspace cleanup. The regressions and source review are project evidence, not
-an independent certification. Exact-tag run `33456209269` subsequently passed
+an independent certification or a claim that exact-v5.2.8 CI has passed.
-all 15 jobs at `ebb9ab3aa1d42c50030ca02883f6162dc4771fe1`.
 
 The C/C++ default-branch analysis of commit `69fc26b` closed #5, #6, and #7,
 then opened test-only High #8, #9, and #10 because the new SDK regression used
@@ -237,9 +236,6 @@ static gate rejects reintroduction of path-level metadata checks there. The
 subsequent C/C++ default-branch scan run `33452563116` completed successfully at
 commit `7a8e5c5`; alerts #5 through #10 are fixed, and the authenticated
 code-scanning API reported zero open alerts.
-The final release-commit CodeQL run `33456049125` also completed successfully;
-the authenticated API again reported zero open alerts, with #5 through #10
-recorded as fixed rather than dismissed.
 
 The Windows handle-relative implementation is scoped to normal local Win32
 paths. Win32 extended-length and device-namespace paths, raw UNC output roots,
@@ -364,8 +360,8 @@ then completed 13 jobs successfully but failed native macOS because x86 SHA-NI
 test helpers were unused on arm64 under `-Werror`, and failed native Windows
 when argv transcoding aborted the safe UTF-8 fixture. Those are test-harness
 integration defects, not product, archive, cryptographic, codec, or SDK ABI
-changes; v5.2.6 remained unpromoted, so its results did not transfer to the
+changes; v5.2.6 remained unpromoted. The exact 5.2.8 candidate must
-required 5.2.8 suite. The immutable v5.2.7 candidate was likewise not
+repeat the required suite. The immutable v5.2.7 candidate was likewise not
 promoted: exact-tag run `33445470664` concluded `cancelled` at
 `2026-08-31T23:11:19Z`, with 13 successful jobs, one failed macOS job after
 raw-C1 fixture creation returned `EILSEQ`, and one cancelled Windows job after
@@ -379,13 +375,9 @@ after ZUPT had compressed and verified all inputs; MinGW/Wine confirmed ZUPT's
 byte-exact UTF-8 listing. The corrected gate validates Latin-1, BMP, and
 non-BMP listing bytes without locale-sensitive matching, then requires
 extraction and a full tree diff. The failed run is not exact-candidate
-evidence. Exact-tag run `33456209269` then completed 15/15 jobs successfully,
+evidence. Exact-tag native gates, hosted CI, authenticated OBS service
-including native Windows/macOS, the pinned local OBS service chain, package
+execution, and release promotion remain pending. An unavailable or unexecuted
-installation/round trips, source-only checks, analyzers, and sanitizers.
+environment remains `SKIP`, never `PASS`.
-Promotion run `33457868306` published the exact 13-file allowlist after
-format, metadata, payload, and checksum validation. An unavailable or
-unexecuted environment remains `SKIP`, never `PASS`; successful project CI is
-still not independent security certification.
 
 Run target-native static analyzers and package checks as additional evidence.
 Do not infer x86_64, aarch64, ppc64le, s390x, riscv64, macOS, Windows, Leap, or

THREAT_MODEL.md

@@ -213,10 +213,8 @@ large device, power loss, or hardware failure.
 
 The SDK publication, POSIX disk-target, and benchmark-cleanup changes address
 CodeQL High #5, #6, and #7 respectively. Their source review and regressions
-alone are project evidence, not independent certification. Exact-tag run
+are project evidence, not independent certification or proof that the exact
-`33456209269` subsequently passed all 15 hosted jobs at
+5.2.8 hosted/native gates passed.
-`ebb9ab3aa1d42c50030ca02883f6162dc4771fe1`; final release-commit CodeQL run
-`33456049125` completed successfully with zero open alerts.
 
 For an untrusted archive:
 
@@ -314,14 +312,12 @@ successful jobs, one failed macOS job after raw-C1 filename creation returned
 `EILSEQ`, and one cancelled Windows job after the hosted job stalled in `make
 check`; a MinGW/Wine reproduction isolated the cause to a redirected password
 prompt entering `_getch`.
-The corresponding 5.2.8 fixture and prompt corrections alone did not establish
+The corresponding 5.2.8 fixture and prompt corrections do not establish their
-a result. Exact-tag run `33456209269` then passed 15/15 jobs, including
+own test result. CI now exercises `sdk-test`, but its inclusion is not a pass.
-`sdk-test`, native Windows/macOS, the pinned local OBS source-service chain,
+Hosted GitHub CI and release promotion, native
-and the package/source gates. Promotion run `33457868306` published the exact
+Windows/macOS, authenticated OBS, and the openSUSE automatic `debugsource`
-13 tested assets. Official authenticated OBS/Factory acceptance, the full
+rpmlint `no-binary` finding remain pending until an exact 5.2.8 candidate
-automatic debug-package result, and untested architectures remain unclaimed;
+records them.
-the earlier `debugsource` rpmlint `no-binary` finding remains unresolved and
-unsuppressed.
 
 ## Historical compatibility notes
 

packaging/build-gui-rpm.sh

@@ -124,49 +124,20 @@ mapfile -t source_rpms < <(find "$top/SRPMS" -type f -name "zupt-gui-$version-*.
 [[ ${#main_rpms[@]} -eq 1 ]] || die "expected one GUI RPM, found ${#main_rpms[@]}"
 [[ ${#source_rpms[@]} -eq 1 ]] || die "expected one GUI source RPM, found ${#source_rpms[@]}"
 
-main_rpm=${main_rpms[0]}
+rpm -qpl "${main_rpms[0]}" >"$work/contents.txt"
-source_rpm=${source_rpms[0]}
-[[ $(rpm -qp --qf '%{NAME}' "$main_rpm") == zupt-gui ]] || \
-    die 'GUI binary RPM name metadata is not zupt-gui'
-[[ $(rpm -qp --qf '%{VERSION}' "$main_rpm") == "$version" ]] || \
-    die 'GUI binary RPM version metadata does not match the release'
-[[ $(rpm -qp --qf '%{RELEASE}' "$main_rpm") == 1 ]] || \
-    die 'GUI binary RPM release metadata is not 1'
-[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$main_rpm") == '(none)' ]] || \
-    die 'GUI binary RPM is marked as a source package'
-[[ $(rpm -qp --qf '%{SOURCERPM}' "$main_rpm") == "$(basename -- "$source_rpm")" ]] || \
-    die 'GUI binary RPM does not reference the matching source RPM'
-[[ $(rpm -qp --qf '%{NAME}' "$source_rpm") == zupt-gui ]] || \
-    die 'GUI source RPM name metadata is not zupt-gui'
-[[ $(rpm -qp --qf '%{VERSION}' "$source_rpm") == "$version" ]] || \
-    die 'GUI source RPM version metadata does not match the release'
-[[ $(rpm -qp --qf '%{RELEASE}' "$source_rpm") == 1 ]] || \
-    die 'GUI source RPM release metadata is not 1'
-[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$source_rpm") == 1 ]] || \
-    die 'GUI source RPM is not marked as a source package'
-[[ $(rpm -qp --qf '%{SOURCERPM}' "$source_rpm") == '(none)' ]] || \
-    die 'GUI source RPM unexpectedly references another source RPM'
-mapfile -t source_members < <(rpm -qpl "$source_rpm" | sort)
-expected_source_members=("zupt-gui-${version}.tar.gz" zupt-gui.spec)
-mapfile -t expected_source_members < <(printf '%s\n' "${expected_source_members[@]}" | sort)
-[[ ${#source_members[@]} -eq 2 && \
-    ${source_members[*]} == "${expected_source_members[*]}" ]] || \
-    die 'GUI source RPM payload is not the exact Source0/spec pair'
-
-rpm -qpl "$main_rpm" >"$work/contents.txt"
 grep -q '^/usr/bin/zupt-gui$' "$work/contents.txt" || die 'GUI launcher missing from RPM'
 if grep -Eq '(^/usr/bin/vaptvupt-gui$|\.(o|obj|a|so|so\.[^/]+|dll|dylib|exe)$)' "$work/contents.txt"; then
     cat "$work/contents.txt" >&2
     die 'forbidden compatibility alias or compiled artifact in GUI RPM'
 fi
-(cd -- "$extract" && rpm2cpio "$main_rpm" | cpio -idm --quiet)
+(cd -- "$extract" && rpm2cpio "${main_rpms[0]}" | cpio -idm --quiet)
 PYTHONDONTWRITEBYTECODE=1 python3 - <<PY
 from pathlib import Path
 p = Path("$extract/usr/share/zupt-gui/zupt_gui.py")
 compile(p.read_text(encoding="utf-8"), str(p), "exec")
 PY
 
-for artifact in "$main_rpm" "$source_rpm"; do
+for artifact in "${main_rpms[0]}" "${source_rpms[0]}"; do
     destination=$dist_dir/$(basename -- "$artifact")
     [[ ! -e $destination ]] || die "refusing to overwrite existing output: $destination"
     cp -- "$artifact" "$destination"

packaging/build-rpm.sh

@@ -80,33 +80,6 @@ mapfile -t source_rpms < <(find "$top/SRPMS" -type f -name "zupt-${version}-*.sr
 [[ ${#source_rpms[@]} -eq 1 ]] || die "expected one source RPM, found ${#source_rpms[@]}"
 source_rpm=${source_rpms[0]}
 
-[[ $(rpm -qp --qf '%{NAME}' "$main_rpm") == zupt ]] || \
-    die 'binary RPM name metadata is not zupt'
-[[ $(rpm -qp --qf '%{VERSION}' "$main_rpm") == "$version" ]] || \
-    die 'binary RPM version metadata does not match the release'
-[[ $(rpm -qp --qf '%{RELEASE}' "$main_rpm") == 0 ]] || \
-    die 'binary RPM release metadata is not 0'
-[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$main_rpm") == '(none)' ]] || \
-    die 'binary RPM is marked as a source package'
-[[ $(rpm -qp --qf '%{SOURCERPM}' "$main_rpm") == "$(basename -- "$source_rpm")" ]] || \
-    die 'binary RPM does not reference the matching source RPM'
-[[ $(rpm -qp --qf '%{NAME}' "$source_rpm") == zupt ]] || \
-    die 'source RPM name metadata is not zupt'
-[[ $(rpm -qp --qf '%{VERSION}' "$source_rpm") == "$version" ]] || \
-    die 'source RPM version metadata does not match the release'
-[[ $(rpm -qp --qf '%{RELEASE}' "$source_rpm") == 0 ]] || \
-    die 'source RPM release metadata is not 0'
-[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$source_rpm") == 1 ]] || \
-    die 'source RPM is not marked as a source package'
-[[ $(rpm -qp --qf '%{SOURCERPM}' "$source_rpm") == '(none)' ]] || \
-    die 'source RPM unexpectedly references another source RPM'
-mapfile -t source_members < <(rpm -qpl "$source_rpm" | sort)
-expected_source_members=("zupt-${version}.tar.gz" zupt.spec)
-mapfile -t expected_source_members < <(printf '%s\n' "${expected_source_members[@]}" | sort)
-[[ ${#source_members[@]} -eq 2 && \
-    ${source_members[*]} == "${expected_source_members[*]}" ]] || \
-    die 'source RPM payload is not the exact Source0/spec pair'
-
 rpm -qpi "$main_rpm" >/dev/null
 rpm -qpl "$main_rpm" > "$work/contents.txt"
 if grep -Eq '(^/usr/bin/vaptvupt$|\.(o|obj|a|so|so\.[^/]+|dll|dylib)$)' "$work/contents.txt"; then

packaging/opensuse/README.md

@@ -193,10 +193,10 @@ source scanner reported `PASS source-only: 204 files, 1 archives`.
 This result establishes that the explicit tag revision works and isolates a
 release/test harness defect. It does not change the product, archive format,
 cryptography, codec, or SDK ABI; it does not make skipped native jobs pass or
-establish authenticated OBS/Factory acceptance. No v5.2.4 evidence transferred
+establish authenticated OBS/Factory acceptance. No v5.2.4 evidence transfers
-automatically to v5.2.8; the exact candidate later repeated every applicable
+automatically to v5.2.8. The exact v5.2.8 candidate must repeat every applicable
-upstream gate in run `33456209269`, as recorded below. The automatic openSUSE
+gate, and the automatic openSUSE `debugsource` rpmlint `no-binary` finding
-`debugsource` rpmlint `no-binary` finding remains unresolved and unsuppressed.
+remains unresolved and unsuppressed.
 
 ## Prior 5.2.5 exact-tag native-gate evidence
 
@@ -233,28 +233,6 @@ key publication, disk restore, and benchmark cleanup, and adds `sdk-test` to
 release and hosted Linux gates. None of those changes establishes an exact
 5.2.8 OBS, native, hosted-CI, or promotion result.
 
-## 5.2.8 exact-tag upstream package evidence
-
-Manually dispatched exact-tag GitHub Actions run `33456209269` passed all 15
-jobs at `ebb9ab3aa1d42c50030ca02883f6162dc4771fe1`. Its openSUSE Tumbleweed
-x86_64 job parsed and normalized the spec, executed the pinned standalone OBS
-source-service chain, source-scanned the resulting archive, built the binary
-RPM and genuine SRPM, ran `rpmlint` without suppressions, and completed the
-install/round-trip/uninstall test. The canonical source archive is 798296 bytes
-with SHA-256
-`378b9506211545b9594cf0d38ac8955d9b1cac34eb6b379ae0ec26b84edb65f7`.
-
-Promotion run `33457868306` published the exact tested binary RPM and SRPM with
-the other gated assets. The source package is identified by
-`%{SOURCEPACKAGE}=1` and an absent `%{SOURCERPM}`; its `%{ARCH}` legitimately
-reflects the spec's build architecture and is not the SRPM discriminator.
-Repository, Git archive, and upstream source tarball scans remain binary-free.
-
-This is upstream local-service and package evidence, not a claim that the
-package was submitted to or accepted by openSUSE Factory, nor a result for the
-full set of automatically generated OBS debug packages or any untested
-architecture.
-
 ## Prior openSUSE packaging validation
 
 The local results below were produced on 2026-08-24 from the 5.2.2 candidate