cristiancmoises/zupt
Watch
1
0
Fork
You've already forked zupt
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 3
zupt/packaging/opensuse
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Cristian Cezar Moisés 43d6306a06 GUI rework for source-only builds + CLI security fixes + packaging + cross-platform scaffolding 
Fixes the "GUI functions don't work on GNU Guix" report and a batch of
adversarial-audit findings across the CLI, decoder, crypto and packaging.

GUI (gui/src/zupt_gui.py)
- Root cause of the broken GUI: every encryption path defaulted to the
  libzuptsdk "SDK v2" modes, which are absent from the source-only build and
  exit 1. Reworked Keys/Compress/Extract around the native modes with a
  build-aware PQ-mode selector: Hybrid (--pq, default), Full PQ (--pq-only),
  and SDK v2 only when the binary reports WITH_SDK support. Capability is
  detected from `version` ("Build:"/"KDF:" lines) with a `help` fallback.
- Extract/Verify gain a PQ private-key input with auto-detect (reads the
  archive via `info` to pick --pq vs --pq-only). Verify could not verify any
  PQ archive before (password field only).
- run_async now holds a LIST of in-flight (thread, worker) refs; DiskTab's two
  buttons previously shared one slot, so a second op GC'd the first QThread
  mid-run. About tab corrected (codec 2.60.4, PBKDF2 default, --pq-only, URL).

CLI (src/zupt_main.c)
- compress -p <archive> <files> swallowed the archive name as the password and
  truncated the first input file (silent data loss, exit 0). Added a
  data-loss guard: refuse to overwrite an existing non-.zupt file as the output
  archive unless -y/--force; plus a self-overwrite guard.
- compress <archive> <src> -p <pw> wrote an UNENCRYPTED archive (exit 0)
  because options after the first positional were treated as files. Now errors
  on a misplaced option (with a `--` escape for real dashed filenames).
- Removed duplicated dead --pq-box/--pq-sdk branches. version/banner/usage now
  state the build's real KDF (PBKDF2 on source-only) and repo URL; examples
  lead with native --pq / --pq-only.

Security (audit findings)
- vv_decoder.c: the two AVX2 fast-path token decoders read a 2-/3-byte match
  offset after only checking 1 byte remained -> heap over-read on a crafted
  archive. Added the `ip + off_bytes > ip_end` guard the tail path already had.
- zupt_crypto.c: wipe ML-KEM/X25519 secret-key buffers when hybrid decrypt
  init fails on key read (matches the pq-only path).
- zupt_format.c: bound attacker-controlled encryption_header_off before the
  (off_t)+7 arithmetic in the info enc_type reader (avoid signed-overflow UB).

Packaging (would fail source-only)
- debian/rules (staged into debian/zupt, installed vendored .so), aur/PKGBUILD,
  nix/flake.nix, homebrew (vendored .so + nonexistent AUDIT.md, stale /zupt
  URLs) now build source-only. opensuse spec %files ships the shell completions
  make install writes (rpmbuild no longer fails on unpackaged files);
  _service + debian/control point at the vaptvupt repo; KDF claim corrected.

Cross-platform GUI packaging (new)
- packaging/portable/: OS-agnostic GUI package (zupt_gui.py + .bat/.command/.sh
  launchers + README) that runs on Windows/macOS/Linux/BSD with Python+PySide6.
- .github/workflows/cross-platform.yml: builds real native binaries on
  windows-latest + macos-latest runners (CLI, PyInstaller GUI, Inno Setup
  installer, .dmg) and the portable zip, attaching them to the release on tag.
- packaging/windows/vaptvupt-gui.iss: Inno Setup installer script.

Validation: make check 16/16 (all distro-safe checks), GUI imports + command
contracts verified against the fixed CLI. test_help_consistency updated to
assert the truthful (build-aware) default KDF.
2026-07-10 12:45:46 -03:00
..
_service GUI rework for source-only builds + CLI security fixes + packaging + cross-platform scaffolding 2026-07-10 12:45:46 -03:00
README.md v4.2.1: bump packaging recipes and docs to 4.2.1 2026-07-10 07:00:09 -03:00
vaptvupt.changes v4.2.1: bump packaging recipes and docs to 4.2.1 2026-07-10 07:00:09 -03:00
vaptvupt.spec GUI rework for source-only builds + CLI security fixes + packaging + cross-platform scaffolding 2026-07-10 12:45:46 -03:00

README.md

openSUSE Build Service update for home:cabelo:innovators/vaptvupt

This directory contains the three files needed to build vaptvupt 4.2.1 in OBS:

File Purpose
_service revision pinned to v4.2.1. Format unchanged (still tar_scm).
vaptvupt.spec Version: 4.2.1. License: AGPL-3.0-or-later. %check calls make check.
vaptvupt.changes Changelog for the 4.x series. Older history preserved verbatim.

Spec notes

  1. License — AGPL-3.0-or-later (dual-licensed AGPL-3.0-or-later

    • commercial).

  2. No BuildRequires beyond the toolchain — the default build needs only gcc gzip make (plus libm/pthread from glibc). There are no system library BuildRequires. The repository is source-only: the previously vendored libzuptsdk.so and libpqvaptvupt.so have been removed from the tree, %build and %install run with WITH_SDK=0, and %files no longer lists any .so. The package installs no shared library. Do not add system crypto BuildRequires.

    The optional SDK modes (--pq-sdk, --pq-box) and the Argon2id KDF require an upstream make WITH_SDK=1 build linked against the separately distributed libzuptsdk/libpqvaptvupt libraries. They are not part of this package.

  3. %check target — the s390x branch falls back to test-vectors; other architectures run make check. This exercises the HMAC tamper detection, archive-integrity trailer, byte-level integrity preface AAD, default-KDF, auth-fail, and encrypted-comment suites, the NIST/RFC vectors (SHA-256, SHA-3, ML-KEM-768, AES-256-CTR, HMAC, X25519, PBKDF2), and the path-traversal, argument-order, and block-swap regressions.

    The default password KDF is PBKDF2-SHA256 (600k iterations). Argon2id test vectors run only in a WITH_SDK=1 build and are not checked here.

  4. URLs — the URL: field points at the canonical project URL https://git.securityops.co/cristiancmoises/vaptvupt. The _service file still fetches from GitHub (https://github.com/cristiancmoises/vaptvupt), which is what the existing tar_scm configuration uses in OBS.

How to apply

# 1. Check out the package
osc checkout home:cabelo:innovators vaptvupt
cd home:cabelo:innovators/vaptvupt

# 2. Drop the new files in (assuming this README is at
#    /path/to/vaptvupt-source/packaging/opensuse/README.md)
cp /path/to/vaptvupt-source/packaging/opensuse/_service     .
cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.spec    .
cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.changes .

# 3. Trigger the service locally to fetch v4.2.1 from GitHub
osc service runall
# Produces vaptvupt-4.2.1.tar.gz in the current directory.

# 4. (Optional) Local build to verify before committing
osc build openSUSE_Tumbleweed x86_64

# 5. Commit upstream
osc status   # confirm vaptvupt-4.2.1.tar.gz is staged alongside the
             # three text files
osc commit -m "Update to 4.2.1"

Notes for future updates

  • The _service revision is pinned to v4.2.1. To track a new release, edit that one line and re-run osc service runall.
  • The spec's Version: field is hard-coded — when you bump _service revision, also bump Version: to match.
  • BuildRequires is intentionally minimal (gcc gzip make). vaptvupt has no external library dependencies in the default build; do not add system crypto BuildRequires.

Reporting issues