4874010d0e
Build from source with no vendored binaries: - Remove prebuilt libzuptsdk.so / libpqvaptvupt.so (and a stray .pyc). The default build needs only a C compiler + make; it links no external library and installs no .so. The libzuptsdk-backed modes (Argon2id KDF, --pq-sdk, --pq-box) are gated behind an opt-in `make WITH_SDK=1`. The default password KDF is PBKDF2-SHA256 and --pq (native ML-KEM-768 + X25519) is the built-in PQ mode. openSUSE/RPM/deb/AUR/Homebrew/Nix recipes bumped to 4.1.0; the openSUSE spec now builds source-only (%files ships no .so, %build/%install WITH_SDK=0). Fix: multithreaded encrypted archives were unextractable on the native AEAD path. The parallel compress/decompress workers skipped the F-09 frame-preface AAD that the serial path and the archive's AAD_PREFACE flag bind into every block MAC, so each multithreaded block failed authentication. The workers now bind the preface via a shared serializer; output is byte-identical across thread counts and interoperates with single-threaded archives (also fixes `--kdf pbkdf2 -t N` in any build). Security hardening (crafted-archive memory safety + crypto): - LZH raw code-length stack overflow + huff_lut OOB write - overflow-safe bounds in parse_index and solid-mode extract (heap OOB read) - SEQ decoder safe-zone heap overflow (litlen+matchlen reserve) - require the per-block ENCRYPTED flag on encrypted archives (plaintext forgery) - cap archive-supplied PBKDF2 iteration count (KDF-amplification DoS) - non-elidable secret wipe in the SDK path; restored disk images created 0600 Docs: remove AUDIT.md / BENCHMARKS.md / ROADMAP.md; trim marketing/AI-styled text and correct KDF/PQ facts across README, SECURITY, INSTALL, DISTRIBUTION, THREAT_MODEL, THIRD-PARTY-NOTICES, the man page, and packaging READMEs. Wire format v1.6 unchanged.
52 lines
581 B
Text
52 lines
581 B
Text
# Build outputs
|
|
/vaptvupt
|
|
/zupt
|
|
*.o
|
|
*.a
|
|
*.so
|
|
*.so.*
|
|
*.dylib
|
|
*.exe
|
|
*.obj
|
|
*.lib
|
|
|
|
# Python bytecode caches
|
|
__pycache__/
|
|
*.pyc
|
|
|
|
# Coverage / profiling
|
|
*.gcda
|
|
*.gcno
|
|
*.gcov
|
|
*.profraw
|
|
|
|
# CMake / out-of-tree build dirs
|
|
/build/
|
|
/cmake-build-*/
|
|
CMakeCache.txt
|
|
CMakeFiles/
|
|
|
|
# Distribution tarballs and packages (published as release assets, not committed)
|
|
/*.tar.gz
|
|
/*.tar.xz
|
|
/*.zip
|
|
/*.deb
|
|
/*.rpm
|
|
/*.AppImage
|
|
*.AppDir/
|
|
SHA256SUMS.txt
|
|
|
|
# Test/scratch binaries
|
|
/test_*
|
|
!/tests/test_*.c
|
|
!/tests/test_*.sh
|
|
|
|
# Editor / OS noise
|
|
*.swp
|
|
*~
|
|
.DS_Store
|
|
.idea/
|
|
.vscode/
|
|
|
|
# AI assistant scratch
|
|
.claude/
|