docs: record audited 5.2.8 release evidence

.github/workflows/ci.yml

@@ -469,6 +469,12 @@ jobs:
           test "$(rpm -qp --qf '%{ARCH}' "$gui_rpm")" = noarch
           rpm -qp --requires "$gui_rpm" | grep -Fx "zupt >= $version"
           test "$(rpm -qp --qf '%{NAME}' "$gui_srpm")" = zupt-gui
+          test "$(rpm -qp --qf '%{VERSION}-%{RELEASE}' "$gui_srpm")" = "$version-1"
+          test "$(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_srpm")" = 1
+          test "$(rpm -qp --qf '%{SOURCERPM}' "$gui_srpm")" = '(none)'
+          test "$(rpm -qpl "$gui_srpm" | wc -l)" -eq 2
+          rpm -qpl "$gui_srpm" | grep -Fx "zupt-gui-$version.tar.gz"
+          rpm -qpl "$gui_srpm" | grep -Fx zupt-gui.spec
       - name: Build the matching Fedora CLI RPM
         run: |
           version=$(sed -n 's/^#define ZUPT_VERSION_STRING "\([^"]*\)".*/\1/p' include/zupt.h)

.github/workflows/promote-release.yml

@@ -389,11 +389,17 @@ jobs:
           [[ $(rpm -qp --qf '%{VERSION}' "$rpm_file") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$rpm_file") == 0 ]]
           [[ $(rpm -qp --qf '%{ARCH}' "$rpm_file") == x86_64 ]]
+          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$rpm_file") == '(none)' ]]
+          [[ $(rpm -qp --qf '%{SOURCERPM}' "$rpm_file") == "$srpm_name" ]]
           srpm=$asset_dir/$srpm_name
           [[ $(rpm -qp --qf '%{NAME}' "$srpm") == zupt ]]
           [[ $(rpm -qp --qf '%{VERSION}' "$srpm") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$srpm") == 0 ]]
-          [[ $(rpm -qp --qf '%{ARCH}' "$srpm") == src ]]
+          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$srpm") == 1 ]]
+          [[ $(rpm -qp --qf '%{SOURCERPM}' "$srpm") == '(none)' ]]
+          [[ $(rpm -qpl "$srpm" | wc -l) -eq 2 ]]
+          rpm -qpl "$srpm" | grep -Fx "zupt-$VERSION.tar.gz"
+          rpm -qpl "$srpm" | grep -Fx zupt.spec
 
           gui_deb=$asset_dir/$gui_deb_name
           dpkg-deb --info "$gui_deb" >/dev/null
@@ -406,12 +412,18 @@ jobs:
           [[ $(rpm -qp --qf '%{VERSION}' "$gui_rpm") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$gui_rpm") == 1 ]]
           [[ $(rpm -qp --qf '%{ARCH}' "$gui_rpm") == noarch ]]
+          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_rpm") == '(none)' ]]
+          [[ $(rpm -qp --qf '%{SOURCERPM}' "$gui_rpm") == "$gui_srpm_name" ]]
           rpm -qp --requires "$gui_rpm" | grep -Fx "zupt >= $VERSION"
           gui_srpm=$asset_dir/$gui_srpm_name
           [[ $(rpm -qp --qf '%{NAME}' "$gui_srpm") == zupt-gui ]]
           [[ $(rpm -qp --qf '%{VERSION}' "$gui_srpm") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$gui_srpm") == 1 ]]
-          [[ $(rpm -qp --qf '%{ARCH}' "$gui_srpm") == src ]]
+          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_srpm") == 1 ]]
+          [[ $(rpm -qp --qf '%{SOURCERPM}' "$gui_srpm") == '(none)' ]]
+          [[ $(rpm -qpl "$gui_srpm" | wc -l) -eq 2 ]]
+          rpm -qpl "$gui_srpm" | grep -Fx "zupt-gui-$VERSION.tar.gz"
+          rpm -qpl "$gui_srpm" | grep -Fx zupt-gui.spec
 
           linux_tar=$asset_dir/$linux_tar_name
           python3 - "$linux_tar" "zupt-$VERSION-linux-x86_64" <<'PY'

AUDIT.md

@@ -223,7 +223,7 @@ its volume and file index against the traversal handle, and marks only that
 identity-checked handle for deletion. The live-workspace
 regression injects a directory symlink and verifies that its external sentinel
 survives. These are reviewed fixes and regression coverage, not independent
-certification or proof that an exact-tag 5.2.8 gate passed.
+certification by themselves; the exact-tag evidence is recorded below.
 
 The C/C++ default-branch analysis of commit `69fc26b` closed #5, #6, and #7,
 then reported High #8, #9, and #10 solely in the newly added SDK regression:
@@ -248,12 +248,24 @@ matching, and requires extraction plus a full tree diff. The path-confinement
 regression independently constructs the BMP/non-BMP archive name from ASCII
 hex and requires byte-exact listing and extraction.
 
-Because that pre-tag run failed, it is diagnostic evidence rather than release
-approval. The exact 5.2.8 candidate must repeat the required suite. Exact-tag
-native Windows/macOS, hosted CI, authenticated OBS service execution, and
-release promotion remain pending until recorded otherwise. The pre-tag
-openSUSE Tumbleweed job did build source and binary RPMs, pass `rpmlint` without
-suppressions, and pass install/round-trip/uninstall checks.
+Because that pre-tag run failed, it remains diagnostic evidence rather than
+release approval. The immutable `v5.2.8` tag at
+`ebb9ab3aa1d42c50030ca02883f6162dc4771fe1` repeated the complete suite in
+manually dispatched run `33456209269`: all 15 jobs passed, including native
+Windows/macOS, the pinned local OBS service chain, source reproducibility,
+DEB/RPM/SRPM, installed-package, sanitizer, analyzer, and source-only gates.
+The canonical source archive was reproduced at 798296 bytes with SHA-256
+`378b9506211545b9594cf0d38ac8955d9b1cac34eb6b379ae0ec26b84edb65f7`.
+
+Initial promotion run `33457344882` stopped before release creation because
+its validator incorrectly assumed that an SRPM's `%{ARCH}` must be `src`.
+Both artifacts were genuine source packages: `%{SOURCEPACKAGE}` was `1`,
+`%{SOURCERPM}` was absent, each payload was exactly its Source0 plus spec, and
+each binary RPM referenced the matching SRPM. Commit `33eb904` changed the
+gate to those canonical metadata and payload checks. Corrected promotion run
+`33457868306` then validated the same tag-bound artifacts and published exactly
+13 assets. No asset was rebuilt to pass promotion. These are reproducible
+project records, not independent certification.
 
 ## Cryptographic review boundary
 

CHANGELOG.md

@@ -57,9 +57,13 @@ unchanged.
 - Realign current code, package, workflow, artifact, and documentation
   references to 5.2.8, and pin the AUR/Homebrew SHA-256 and Guix content hash
   to the final reproducible source archive before tagging.
-- Require fresh exact-`v5.2.8` source, checksum, hosted CI, native-platform,
-  package, OBS, and promotion evidence. This entry does not claim those gates
-  passed, and no v5.2.7 result transfers automatically.
+- Exact-tag run `33456209269` passed all 15 source, package, analyzer,
+  sanitizer, OBS, Windows, and macOS jobs at `ebb9ab3`. Promotion initially
+  stopped before publication because its validator treated `%{ARCH}` as the
+  SRPM discriminator; the genuine SRPMs instead correctly carry
+  `%{SOURCEPACKAGE}=1`. Commit `33eb904` corrected and strengthened that gate,
+  and run `33457868306` published the exact 13 tested assets without rebuilding
+  them. No v5.2.7 result transfers to this evidence.
 
 ## [5.2.7] — 2026-08-31 — Native test-harness portability corrections
 

DISTRIBUTION.md

@@ -37,7 +37,13 @@ Windows distribution checks, before an old MSYS `grep` non-BMP pattern failed
 in the later smoke. ZUPT's redirected listing was byte-correct; the corrected
 gate uses byte-exact, locale-independent checks and requires extraction plus a
 full tree diff. The failed run is diagnostic evidence only.
-Corrective packages and release assets must use `v5.2.8`; never move or
+Exact-tag run `33456209269` subsequently passed all 15 jobs at
+`ebb9ab3aa1d42c50030ca02883f6162dc4771fe1`, including the pinned local OBS
+source-service chain, native
+Windows/macOS, and every package gate. Promotion run `33457868306` published
+the exact tested 13-file set; the source archive SHA-256 is
+`378b9506211545b9594cf0d38ac8955d9b1cac34eb6b379ae0ec26b84edb65f7`.
+Corrective packages and release assets use `v5.2.8`; never move or
 overwrite an earlier tag or checksum, and never transfer prior evidence
 automatically. Version 5.2.8 corrects those native test boundaries, hardens
 three path-race boundaries, and adds the SDK regression to release/hosted Linux
@@ -295,9 +301,10 @@ For every published artifact:
 Do not infer multi-architecture compatibility from portable source. Do not add
 precompiled optional libraries to make a package build.
 
-Publish release assets at the canonical GitHub release. If an expected asset is
-absent or has a different checksum, report that target as unpublished rather
-than redirecting consumers to an unverified file.
+The 13 gated assets are published at the
+[canonical GitHub release](https://github.com/cristiancmoises/zupt/releases/tag/v5.2.8).
+If an expected asset is absent or has a different checksum, report that target
+as unpublished rather than redirecting consumers to an unverified file.
 
 ## Downstream checklist
 

INSTALL.md

@@ -38,11 +38,11 @@ check`; a MinGW/Wine reproduction isolated the cause to the non-console
 password-prompt test entering `_getch`. Version 5.2.8 makes both
 fixtures portable, hardens the three CodeQL High path-race boundaries described
 in the security documents, and adds `sdk-test` to release and hosted Linux
-gates. It still requires fresh exact-version validation. Do not treat any prior
-candidate's artifacts or evidence as 5.2.8 packages or validation.
+gates. Exact-tag run `33456209269` passed all 15 jobs, and promotion run
+`33457868306` published the exact tested set. Do not treat any prior candidate's
+artifacts or evidence as 5.2.8 packages or validation.
 
-The 5.2.8 package set eligible for promotion after each target gate succeeds is
-exactly these 13 assets:
+The published 5.2.8 package set is exactly these 13 gated assets:
 
 | Component | Gated artifacts |
 |---|---|

README.md

@@ -19,7 +19,9 @@ POSIX-mode projection. The C/C++ default-branch scan run `33452563116` of
 commit `7a8e5c5` completed successfully after the follow-up changed the new SDK
 regression to no-follow descriptors plus `fstat` and descriptor reads. Alerts
 #5 through #10 are fixed, and the authenticated code-scanning API reported zero
-open alerts. These corrections do not change archive format v1.6,
+open alerts. Final release-commit CodeQL run `33456049125` also completed
+successfully, with the API still reporting zero open alerts. These corrections
+do not change archive format v1.6,
 cryptography, the bundled codec release, or the SDK ABI.
 
 The predecessor `v5.2.7` tag is immutable and was not promoted. Exact-tag run
@@ -39,6 +41,16 @@ gate creates that name from byte escapes, validates Latin-1, BMP, and non-BMP
 listing bytes with Python, and requires extraction plus a full tree diff. The
 failed run is diagnostic evidence, not release-candidate approval.
 
+The immutable `v5.2.8` candidate at commit
+`ebb9ab3aa1d42c50030ca02883f6162dc4771fe1` subsequently passed all 15 jobs in
+manually dispatched exact-tag run `33456209269`. That run includes the pinned
+local OBS source-service chain, reproducible source checks, GCC/Clang, analyzers,
+sanitizers, DEB/RPM/SRPM and portable-package gates, the native Windows ZIP
+round trip, and the mounted macOS arm64 DMG test. Corrected promotion run
+`33457868306` validated and published exactly 13 assets. The canonical source
+archive is 798296 bytes with SHA-256
+`378b9506211545b9594cf0d38ac8955d9b1cac34eb6b379ae0ec26b84edb65f7`.
+
 Version 5.2.2 restored the original ZUPT product name and the `zupt` command.
 The `.zupt` archive extension, format v1.6, magic bytes, codec identifiers, and
 SDK ABI remain unchanged. An optional `vaptvupt` command alias may be provided
@@ -55,8 +67,9 @@ SDK link-target/mode regression, static path-race guards, portable raw-C1
 fixture with Bash 3.2 unsigned-byte normalization, native redirected-prompt
 and protected-DACL regressions, byte-exact BMP/non-BMP Windows list and extract
 checks, and `sdk-test` CI step cover these boundaries. All current release
-paths move to 5.2.8 and require fresh exact-tag hosted CI, package,
-native-platform, source-only, checksum, OBS, and promotion evidence.
+paths moved to 5.2.8 and received fresh exact-tag hosted CI, package,
+native-platform, source-only, checksum, OBS, and promotion evidence in runs
+`33456209269` and `33457868306`.
 
 ## Corrective changes introduced in 5.2.7
 
@@ -177,8 +190,12 @@ See [CHANGELOG.md](CHANGELOG.md) for the release record.
 ## Canonical source
 
 - Canonical: https://github.com/cristiancmoises/zupt
+- Codeberg mirror: https://codeberg.org/berkeley/zupt
+- SecurityOps Brazil mirror: https://git.securityops.com.br/cristiancmoises/zupt
+- SecurityOps global mirror: https://git.securityops.co/cristiancmoises/zupt
 
-Release tags and source archives are published from this repository.
+GitHub remains canonical. The `v5.2.8` tag and its 13 release assets are also
+published byte-for-byte on the three mirrors above.
 
 ## Source-only policy
 
@@ -194,8 +211,8 @@ built and tested is not presented as supported.
 
 ## 5.2.8 release artifacts
 
-The 5.2.8 release workflow is defined to produce exactly the following 13 files only after
-the corresponding target gate succeeds. `SHA256SUMS` records the exact promoted
+The published 5.2.8 release contains exactly the following 13 files after
+every corresponding target gate succeeded. `SHA256SUMS` records the exact promoted
 filenames and digests. The release notes identify the tested commit and the
 manually dispatched CI run; that run's job definitions and logs are the runtime
 evidence for runner image, architecture, toolchain, results, and explicit
@@ -238,9 +255,10 @@ software already installed on the target. Other historical GUI packages and
 platform installers are not carried forward implicitly.
 
 The canonical source repository is
-<https://github.com/cristiancmoises/zupt>. Release assets referenced by the AUR,
-Homebrew, Guix, or generic RPM recipes must exist in the canonical GitHub
-release at their recorded URL before those recipes are published.
+<https://github.com/cristiancmoises/zupt>. The canonical release is
+<https://github.com/cristiancmoises/zupt/releases/tag/v5.2.8>. Assets referenced
+by the AUR, Homebrew, Guix, or generic RPM recipes must exist there at their
+recorded URL before those recipes are published.
 
 Audit the current checkout and its Git archive with:
 
@@ -410,11 +428,12 @@ not promoted. The immutable v5.2.7 tag was also not promoted: exact-tag run
 recorded 13 successful jobs, and cancelled Windows after the hosted job stalled
 in `make check`; a MinGW/Wine reproduction isolated the stall to
 `test --password-prompt ... </dev/null` entering `_getch`. The
-exact 5.2.8 candidate must repeat all required gates. Native Windows and macOS,
-hosted GitHub CI/release promotion, authenticated OBS, and resolution of the
-openSUSE automatic `debugsource` rpmlint `no-binary`
-finding remain pending until recorded otherwise. Unexecuted gates are `SKIP`,
-never `PASS`.
+exact 5.2.8 candidate then repeated all required gates: exact-tag run
+`33456209269` completed 15/15 jobs successfully, including native Windows and
+macOS, the pinned local OBS service chain, source/package gates, and the
+openSUSE RPM checks. Promotion run `33457868306` published the exact tested
+asset allowlist. Unexecuted environments remain `SKIP`, never `PASS`; these
+project-run results are not independent certification.
 
 On Windows, 5.2.8 scopes output handling to normal local Win32 paths. A MinGW
 cross-build or Wine run is not native-Windows evidence; the `windows-latest`
@@ -456,10 +475,9 @@ lists, tests, extracts, and restores it byte-exact. The full local Linux gate
 passed on commit `ff99770`. This is not a claim that a 5.2.1 reader understands every new
 flag-gated 5.2.2 encoding or that every historical combination was tested.
 
-The candidate commands and outcome fields for 5.2.8 are maintained in the
-release handoff and
-[packaging/opensuse/README.md](packaging/opensuse/README.md). They must be
-updated from the final release candidate before tagging. No architecture or
+The build/audit commands and recorded 5.2.8 outcomes are maintained in the
+release evidence and
+[packaging/opensuse/README.md](packaging/opensuse/README.md). No architecture or
 distribution is claimed merely because the code has a fallback path.
 
 ## Source archive
@@ -480,12 +498,12 @@ the same SHA-256. The AUR, Homebrew and Guix recipes are `export-ignore` so
 their checksum fields do not make the archive self-referential. `make dist`
 archives the verified `HEAD` tree object rather than embedding the commit ID,
 so a commit changing only those ignored recipes leaves the fixed-epoch archive
-byte-identical. The recipes remain versioned in Git and must be filled with the
-final digest before the tag is published.
+byte-identical. The recipes remain versioned in Git and pin the final tagged
+digest `378b9506211545b9594cf0d38ac8955d9b1cac34eb6b379ae0ec26b84edb65f7`.
 
 ## openSUSE and OBS
 
-The maintained upstream recipe is in packaging/opensuse. It is prepared for an
+The maintained upstream recipe is in packaging/opensuse. It targets the
 immutable v5.2.8 tag, disables submodules and Git LFS, builds with
 WITH_SDK=0 WITH_PQBOX=0, runs real checks, and installs without the renamed-era
 `vaptvupt` alias.

SECURITY.md

@@ -226,7 +226,8 @@ media before proceeding.
 These changes address the three 5.2.8 CodeQL High reports: #5 at SDK key
 publication, #6 at POSIX disk-target classification/use, and #7 at benchmark
 workspace cleanup. The regressions and source review are project evidence, not
-an independent certification or a claim that exact-v5.2.8 CI has passed.
+an independent certification. Exact-tag run `33456209269` subsequently passed
+all 15 jobs at `ebb9ab3aa1d42c50030ca02883f6162dc4771fe1`.
 
 The C/C++ default-branch analysis of commit `69fc26b` closed #5, #6, and #7,
 then opened test-only High #8, #9, and #10 because the new SDK regression used
@@ -236,6 +237,9 @@ static gate rejects reintroduction of path-level metadata checks there. The
 subsequent C/C++ default-branch scan run `33452563116` completed successfully at
 commit `7a8e5c5`; alerts #5 through #10 are fixed, and the authenticated
 code-scanning API reported zero open alerts.
+The final release-commit CodeQL run `33456049125` also completed successfully;
+the authenticated API again reported zero open alerts, with #5 through #10
+recorded as fixed rather than dismissed.
 
 The Windows handle-relative implementation is scoped to normal local Win32
 paths. Win32 extended-length and device-namespace paths, raw UNC output roots,
@@ -360,8 +364,8 @@ then completed 13 jobs successfully but failed native macOS because x86 SHA-NI
 test helpers were unused on arm64 under `-Werror`, and failed native Windows
 when argv transcoding aborted the safe UTF-8 fixture. Those are test-harness
 integration defects, not product, archive, cryptographic, codec, or SDK ABI
-changes; v5.2.6 remained unpromoted. The exact 5.2.8 candidate must
-repeat the required suite. The immutable v5.2.7 candidate was likewise not
+changes; v5.2.6 remained unpromoted, so its results did not transfer to the
+required 5.2.8 suite. The immutable v5.2.7 candidate was likewise not
 promoted: exact-tag run `33445470664` concluded `cancelled` at
 `2026-08-31T23:11:19Z`, with 13 successful jobs, one failed macOS job after
 raw-C1 fixture creation returned `EILSEQ`, and one cancelled Windows job after
@@ -375,9 +379,13 @@ after ZUPT had compressed and verified all inputs; MinGW/Wine confirmed ZUPT's
 byte-exact UTF-8 listing. The corrected gate validates Latin-1, BMP, and
 non-BMP listing bytes without locale-sensitive matching, then requires
 extraction and a full tree diff. The failed run is not exact-candidate
-evidence. Exact-tag native gates, hosted CI, authenticated OBS service
-execution, and release promotion remain pending. An unavailable or unexecuted
-environment remains `SKIP`, never `PASS`.
+evidence. Exact-tag run `33456209269` then completed 15/15 jobs successfully,
+including native Windows/macOS, the pinned local OBS service chain, package
+installation/round trips, source-only checks, analyzers, and sanitizers.
+Promotion run `33457868306` published the exact 13-file allowlist after
+format, metadata, payload, and checksum validation. An unavailable or
+unexecuted environment remains `SKIP`, never `PASS`; successful project CI is
+still not independent security certification.
 
 Run target-native static analyzers and package checks as additional evidence.
 Do not infer x86_64, aarch64, ppc64le, s390x, riscv64, macOS, Windows, Leap, or

THREAT_MODEL.md

@@ -213,8 +213,10 @@ large device, power loss, or hardware failure.
 
 The SDK publication, POSIX disk-target, and benchmark-cleanup changes address
 CodeQL High #5, #6, and #7 respectively. Their source review and regressions
-are project evidence, not independent certification or proof that the exact
-5.2.8 hosted/native gates passed.
+alone are project evidence, not independent certification. Exact-tag run
+`33456209269` subsequently passed all 15 hosted jobs at
+`ebb9ab3aa1d42c50030ca02883f6162dc4771fe1`; final release-commit CodeQL run
+`33456049125` completed successfully with zero open alerts.
 
 For an untrusted archive:
 
@@ -312,12 +314,14 @@ successful jobs, one failed macOS job after raw-C1 filename creation returned
 `EILSEQ`, and one cancelled Windows job after the hosted job stalled in `make
 check`; a MinGW/Wine reproduction isolated the cause to a redirected password
 prompt entering `_getch`.
-The corresponding 5.2.8 fixture and prompt corrections do not establish their
-own test result. CI now exercises `sdk-test`, but its inclusion is not a pass.
-Hosted GitHub CI and release promotion, native
-Windows/macOS, authenticated OBS, and the openSUSE automatic `debugsource`
-rpmlint `no-binary` finding remain pending until an exact 5.2.8 candidate
-records them.
+The corresponding 5.2.8 fixture and prompt corrections alone did not establish
+a result. Exact-tag run `33456209269` then passed 15/15 jobs, including
+`sdk-test`, native Windows/macOS, the pinned local OBS source-service chain,
+and the package/source gates. Promotion run `33457868306` published the exact
+13 tested assets. Official authenticated OBS/Factory acceptance, the full
+automatic debug-package result, and untested architectures remain unclaimed;
+the earlier `debugsource` rpmlint `no-binary` finding remains unresolved and
+unsuppressed.
 
 ## Historical compatibility notes
 

packaging/build-gui-rpm.sh

@@ -124,20 +124,49 @@ mapfile -t source_rpms < <(find "$top/SRPMS" -type f -name "zupt-gui-$version-*.
 [[ ${#main_rpms[@]} -eq 1 ]] || die "expected one GUI RPM, found ${#main_rpms[@]}"
 [[ ${#source_rpms[@]} -eq 1 ]] || die "expected one GUI source RPM, found ${#source_rpms[@]}"
 
-rpm -qpl "${main_rpms[0]}" >"$work/contents.txt"
+main_rpm=${main_rpms[0]}
+source_rpm=${source_rpms[0]}
+[[ $(rpm -qp --qf '%{NAME}' "$main_rpm") == zupt-gui ]] || \
+    die 'GUI binary RPM name metadata is not zupt-gui'
+[[ $(rpm -qp --qf '%{VERSION}' "$main_rpm") == "$version" ]] || \
+    die 'GUI binary RPM version metadata does not match the release'
+[[ $(rpm -qp --qf '%{RELEASE}' "$main_rpm") == 1 ]] || \
+    die 'GUI binary RPM release metadata is not 1'
+[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$main_rpm") == '(none)' ]] || \
+    die 'GUI binary RPM is marked as a source package'
+[[ $(rpm -qp --qf '%{SOURCERPM}' "$main_rpm") == "$(basename -- "$source_rpm")" ]] || \
+    die 'GUI binary RPM does not reference the matching source RPM'
+[[ $(rpm -qp --qf '%{NAME}' "$source_rpm") == zupt-gui ]] || \
+    die 'GUI source RPM name metadata is not zupt-gui'
+[[ $(rpm -qp --qf '%{VERSION}' "$source_rpm") == "$version" ]] || \
+    die 'GUI source RPM version metadata does not match the release'
+[[ $(rpm -qp --qf '%{RELEASE}' "$source_rpm") == 1 ]] || \
+    die 'GUI source RPM release metadata is not 1'
+[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$source_rpm") == 1 ]] || \
+    die 'GUI source RPM is not marked as a source package'
+[[ $(rpm -qp --qf '%{SOURCERPM}' "$source_rpm") == '(none)' ]] || \
+    die 'GUI source RPM unexpectedly references another source RPM'
+mapfile -t source_members < <(rpm -qpl "$source_rpm" | sort)
+expected_source_members=("zupt-gui-${version}.tar.gz" zupt-gui.spec)
+mapfile -t expected_source_members < <(printf '%s\n' "${expected_source_members[@]}" | sort)
+[[ ${#source_members[@]} -eq 2 && \
+    ${source_members[*]} == "${expected_source_members[*]}" ]] || \
+    die 'GUI source RPM payload is not the exact Source0/spec pair'
+
+rpm -qpl "$main_rpm" >"$work/contents.txt"
 grep -q '^/usr/bin/zupt-gui$' "$work/contents.txt" || die 'GUI launcher missing from RPM'
 if grep -Eq '(^/usr/bin/vaptvupt-gui$|\.(o|obj|a|so|so\.[^/]+|dll|dylib|exe)$)' "$work/contents.txt"; then
     cat "$work/contents.txt" >&2
     die 'forbidden compatibility alias or compiled artifact in GUI RPM'
 fi
-(cd -- "$extract" && rpm2cpio "${main_rpms[0]}" | cpio -idm --quiet)
+(cd -- "$extract" && rpm2cpio "$main_rpm" | cpio -idm --quiet)
 PYTHONDONTWRITEBYTECODE=1 python3 - <<PY
 from pathlib import Path
 p = Path("$extract/usr/share/zupt-gui/zupt_gui.py")
 compile(p.read_text(encoding="utf-8"), str(p), "exec")
 PY
 
-for artifact in "${main_rpms[0]}" "${source_rpms[0]}"; do
+for artifact in "$main_rpm" "$source_rpm"; do
     destination=$dist_dir/$(basename -- "$artifact")
     [[ ! -e $destination ]] || die "refusing to overwrite existing output: $destination"
     cp -- "$artifact" "$destination"

packaging/build-rpm.sh

@@ -80,6 +80,33 @@ mapfile -t source_rpms < <(find "$top/SRPMS" -type f -name "zupt-${version}-*.sr
 [[ ${#source_rpms[@]} -eq 1 ]] || die "expected one source RPM, found ${#source_rpms[@]}"
 source_rpm=${source_rpms[0]}
 
+[[ $(rpm -qp --qf '%{NAME}' "$main_rpm") == zupt ]] || \
+    die 'binary RPM name metadata is not zupt'
+[[ $(rpm -qp --qf '%{VERSION}' "$main_rpm") == "$version" ]] || \
+    die 'binary RPM version metadata does not match the release'
+[[ $(rpm -qp --qf '%{RELEASE}' "$main_rpm") == 0 ]] || \
+    die 'binary RPM release metadata is not 0'
+[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$main_rpm") == '(none)' ]] || \
+    die 'binary RPM is marked as a source package'
+[[ $(rpm -qp --qf '%{SOURCERPM}' "$main_rpm") == "$(basename -- "$source_rpm")" ]] || \
+    die 'binary RPM does not reference the matching source RPM'
+[[ $(rpm -qp --qf '%{NAME}' "$source_rpm") == zupt ]] || \
+    die 'source RPM name metadata is not zupt'
+[[ $(rpm -qp --qf '%{VERSION}' "$source_rpm") == "$version" ]] || \
+    die 'source RPM version metadata does not match the release'
+[[ $(rpm -qp --qf '%{RELEASE}' "$source_rpm") == 0 ]] || \
+    die 'source RPM release metadata is not 0'
+[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$source_rpm") == 1 ]] || \
+    die 'source RPM is not marked as a source package'
+[[ $(rpm -qp --qf '%{SOURCERPM}' "$source_rpm") == '(none)' ]] || \
+    die 'source RPM unexpectedly references another source RPM'
+mapfile -t source_members < <(rpm -qpl "$source_rpm" | sort)
+expected_source_members=("zupt-${version}.tar.gz" zupt.spec)
+mapfile -t expected_source_members < <(printf '%s\n' "${expected_source_members[@]}" | sort)
+[[ ${#source_members[@]} -eq 2 && \
+    ${source_members[*]} == "${expected_source_members[*]}" ]] || \
+    die 'source RPM payload is not the exact Source0/spec pair'
+
 rpm -qpi "$main_rpm" >/dev/null
 rpm -qpl "$main_rpm" > "$work/contents.txt"
 if grep -Eq '(^/usr/bin/vaptvupt$|\.(o|obj|a|so|so\.[^/]+|dll|dylib)$)' "$work/contents.txt"; then

packaging/opensuse/README.md

@@ -193,10 +193,10 @@ source scanner reported `PASS source-only: 204 files, 1 archives`.
 This result establishes that the explicit tag revision works and isolates a
 release/test harness defect. It does not change the product, archive format,
 cryptography, codec, or SDK ABI; it does not make skipped native jobs pass or
-establish authenticated OBS/Factory acceptance. No v5.2.4 evidence transfers
-automatically to v5.2.8. The exact v5.2.8 candidate must repeat every applicable
-gate, and the automatic openSUSE `debugsource` rpmlint `no-binary` finding
-remains unresolved and unsuppressed.
+establish authenticated OBS/Factory acceptance. No v5.2.4 evidence transferred
+automatically to v5.2.8; the exact candidate later repeated every applicable
+upstream gate in run `33456209269`, as recorded below. The automatic openSUSE
+`debugsource` rpmlint `no-binary` finding remains unresolved and unsuppressed.
 
 ## Prior 5.2.5 exact-tag native-gate evidence
 
@@ -233,6 +233,28 @@ key publication, disk restore, and benchmark cleanup, and adds `sdk-test` to
 release and hosted Linux gates. None of those changes establishes an exact
 5.2.8 OBS, native, hosted-CI, or promotion result.
 
+## 5.2.8 exact-tag upstream package evidence
+
+Manually dispatched exact-tag GitHub Actions run `33456209269` passed all 15
+jobs at `ebb9ab3aa1d42c50030ca02883f6162dc4771fe1`. Its openSUSE Tumbleweed
+x86_64 job parsed and normalized the spec, executed the pinned standalone OBS
+source-service chain, source-scanned the resulting archive, built the binary
+RPM and genuine SRPM, ran `rpmlint` without suppressions, and completed the
+install/round-trip/uninstall test. The canonical source archive is 798296 bytes
+with SHA-256
+`378b9506211545b9594cf0d38ac8955d9b1cac34eb6b379ae0ec26b84edb65f7`.
+
+Promotion run `33457868306` published the exact tested binary RPM and SRPM with
+the other gated assets. The source package is identified by
+`%{SOURCEPACKAGE}=1` and an absent `%{SOURCERPM}`; its `%{ARCH}` legitimately
+reflects the spec's build architecture and is not the SRPM discriminator.
+Repository, Git archive, and upstream source tarball scans remain binary-free.
+
+This is upstream local-service and package evidence, not a claim that the
+package was submitted to or accepted by openSUSE Factory, nor a result for the
+full set of automatically generated OBS debug packages or any untested
+architecture.
+
 ## Prior openSUSE packaging validation
 
 The local results below were produced on 2026-08-24 from the 5.2.2 candidate