cristiancmoises/zupt
Watch
1
0
Fork
You've already forked zupt
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 3
zupt/packaging/opensuse
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Cristian Cezar Moisés 5050570b23 v5.0.0: version bump, audit fixes, documentation overhaul 
Version bumped to 5.0.0 across include/zupt.h, all packaging recipes, man
page, and docs.

Audit fixes (pre-5.0.0 review):
- src/zupt_format.c: overflow-safe bound in the solid-mode `test` path
  (off+sz could wrap and drive an OOB read in zupt_xxh64 on a crafted archive;
  the extract path was already hardened, the test path was not).
- gui: run_async now marshals the completion callback onto the GUI thread with
  QueuedConnection (a bare functor connected DirectConnection and touched
  widgets off the worker thread); Extract auto-detect note survives the log
  clear via a new `info` param.
- .github/workflows/ci.yml: trigger on `master` (was main/develop, so CI never
  ran); `make dist` tarball is vaptvupt-*.tar.gz not zupt-*; the ASAN PQ
  round-trip uses native --pq (was --pq-sdk, which fails on the source-only
  build and blocked the release job).

Documentation:
- New AUDIT.md (methodology, FIPS 203 conformance validation, findings, repro).
- CHANGELOG 5.0.0 entry covers the FIPS 203 conformance fix + BREAKING note and
  the GUI/CLI/security/packaging work.
- README "What's new in 5.0.0", download tables (incl. Windows/macOS/BSD +
  portable GUI), version-history row.
- SECURITY.md + THREAT_MODEL.md: ML-KEM-768 documented as FIPS 203, validated
  byte-for-byte against OpenSSL 3.5.
- Accuracy fixes: man page (--kdf default is PBKDF2 on source-only; codec
  2.60.4), rpm %description, debian control/copyright, homebrew header
  (no vendored library on source-only builds).

make check 16/16 (FIPS 203 conformance 3/3, all distro-safe checks).
2026-07-10 17:22:02 -03:00
..
_service v5.0.0: version bump, audit fixes, documentation overhaul 2026-07-10 17:22:02 -03:00
README.md v5.0.0: version bump, audit fixes, documentation overhaul 2026-07-10 17:22:02 -03:00
vaptvupt.changes v5.0.0: version bump, audit fixes, documentation overhaul 2026-07-10 17:22:02 -03:00
vaptvupt.spec v5.0.0: version bump, audit fixes, documentation overhaul 2026-07-10 17:22:02 -03:00

README.md

openSUSE Build Service update for home:cabelo:innovators/vaptvupt

This directory contains the three files needed to build vaptvupt 5.0.0 in OBS:

File Purpose
_service revision pinned to v5.0.0. Format unchanged (still tar_scm).
vaptvupt.spec Version: 5.0.0. License: AGPL-3.0-or-later. %check calls make check.
vaptvupt.changes Changelog for the 4.x series. Older history preserved verbatim.

Spec notes

  1. License — AGPL-3.0-or-later (dual-licensed AGPL-3.0-or-later

    • commercial).

  2. No BuildRequires beyond the toolchain — the default build needs only gcc gzip make (plus libm/pthread from glibc). There are no system library BuildRequires. The repository is source-only: the previously vendored libzuptsdk.so and libpqvaptvupt.so have been removed from the tree, %build and %install run with WITH_SDK=0, and %files no longer lists any .so. The package installs no shared library. Do not add system crypto BuildRequires.

    The optional SDK modes (--pq-sdk, --pq-box) and the Argon2id KDF require an upstream make WITH_SDK=1 build linked against the separately distributed libzuptsdk/libpqvaptvupt libraries. They are not part of this package.

  3. %check target — the s390x branch falls back to test-vectors; other architectures run make check. This exercises the HMAC tamper detection, archive-integrity trailer, byte-level integrity preface AAD, default-KDF, auth-fail, and encrypted-comment suites, the NIST/RFC vectors (SHA-256, SHA-3, ML-KEM-768, AES-256-CTR, HMAC, X25519, PBKDF2), and the path-traversal, argument-order, and block-swap regressions.

    The default password KDF is PBKDF2-SHA256 (600k iterations). Argon2id test vectors run only in a WITH_SDK=1 build and are not checked here.

  4. URLs — the URL: field points at the canonical project URL https://git.securityops.co/cristiancmoises/vaptvupt. The _service file still fetches from GitHub (https://github.com/cristiancmoises/vaptvupt), which is what the existing tar_scm configuration uses in OBS.

How to apply

# 1. Check out the package
osc checkout home:cabelo:innovators vaptvupt
cd home:cabelo:innovators/vaptvupt

# 2. Drop the new files in (assuming this README is at
#    /path/to/vaptvupt-source/packaging/opensuse/README.md)
cp /path/to/vaptvupt-source/packaging/opensuse/_service     .
cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.spec    .
cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.changes .

# 3. Trigger the service locally to fetch v5.0.0 from GitHub
osc service runall
# Produces vaptvupt-5.0.0.tar.gz in the current directory.

# 4. (Optional) Local build to verify before committing
osc build openSUSE_Tumbleweed x86_64

# 5. Commit upstream
osc status   # confirm vaptvupt-5.0.0.tar.gz is staged alongside the
             # three text files
osc commit -m "Update to 5.0.0"

Notes for future updates

  • The _service revision is pinned to v5.0.0. To track a new release, edit that one line and re-run osc service runall.
  • The spec's Version: field is hard-coded — when you bump _service revision, also bump Version: to match.
  • BuildRequires is intentionally minimal (gcc gzip make). vaptvupt has no external library dependencies in the default build; do not add system crypto BuildRequires.

Reporting issues