5050570b23
Version bumped to 5.0.0 across include/zupt.h, all packaging recipes, man page, and docs. Audit fixes (pre-5.0.0 review): - src/zupt_format.c: overflow-safe bound in the solid-mode `test` path (off+sz could wrap and drive an OOB read in zupt_xxh64 on a crafted archive; the extract path was already hardened, the test path was not). - gui: run_async now marshals the completion callback onto the GUI thread with QueuedConnection (a bare functor connected DirectConnection and touched widgets off the worker thread); Extract auto-detect note survives the log clear via a new `info` param. - .github/workflows/ci.yml: trigger on `master` (was main/develop, so CI never ran); `make dist` tarball is vaptvupt-*.tar.gz not zupt-*; the ASAN PQ round-trip uses native --pq (was --pq-sdk, which fails on the source-only build and blocked the release job). Documentation: - New AUDIT.md (methodology, FIPS 203 conformance validation, findings, repro). - CHANGELOG 5.0.0 entry covers the FIPS 203 conformance fix + BREAKING note and the GUI/CLI/security/packaging work. - README "What's new in 5.0.0", download tables (incl. Windows/macOS/BSD + portable GUI), version-history row. - SECURITY.md + THREAT_MODEL.md: ML-KEM-768 documented as FIPS 203, validated byte-for-byte against OpenSSL 3.5. - Accuracy fixes: man page (--kdf default is PBKDF2 on source-only; codec 2.60.4), rpm %description, debian control/copyright, homebrew header (no vendored library on source-only builds). make check 16/16 (FIPS 203 conformance 3/3, all distro-safe checks).
41 lines
1.7 KiB
Text
41 lines
1.7 KiB
Text
Source: vaptvupt
|
|
Section: utils
|
|
Priority: optional
|
|
Maintainer: Cristian Cezar Moisés <sac@securityops.co>
|
|
Build-Depends:
|
|
debhelper-compat (= 13),
|
|
gcc,
|
|
libc6-dev,
|
|
python3 (>= 3.8)
|
|
Standards-Version: 4.6.2
|
|
Homepage: https://git.securityops.co/cristiancmoises/vaptvupt
|
|
Vcs-Browser: https://git.securityops.co/cristiancmoises/vaptvupt
|
|
Vcs-Git: https://git.securityops.co/cristiancmoises/vaptvupt.git
|
|
Rules-Requires-Root: no
|
|
|
|
Package: vaptvupt
|
|
Architecture: any
|
|
Provides: zupt (= ${binary:Version})
|
|
Replaces: zupt
|
|
Conflicts: zupt
|
|
Depends: ${shlibs:Depends}, ${misc:Depends}
|
|
Description: Post-quantum backup compression utility (formerly Zupt)
|
|
VaptVupt (renamed from Zupt in v3.0.0 due to INPI Brasil trademark) is
|
|
a pure-C11 backup compression utility featuring:
|
|
* Post-quantum hybrid encryption (ML-KEM-768 + X25519, FIPS 203)
|
|
* AES-256-CTR + HMAC-SHA256 authenticated encryption (Encrypt-then-MAC)
|
|
* PBKDF2-SHA256 password key derivation (Argon2id in WITH_SDK=1 builds)
|
|
* Multi-threaded compression with the VaptVupt LZ + ANS codec 2.60.4
|
|
* Full-disk backup and restore with sparse-region detection
|
|
* End-to-end byte-level tamper detection on encrypted archives
|
|
(0 silent-accept positions in the v1.6 exhaustive byte sweep)
|
|
* Constant-time cryptographic primitives verified with Jasmin
|
|
* NIST/RFC test vectors for SHA-256, SHA-3, ML-KEM-768, AES-256-CTR,
|
|
HMAC-SHA256, X25519, PBKDF2, Argon2id
|
|
.
|
|
The archive extension stays .zupt for format continuity (header magic
|
|
unchanged). The binary `zupt` is preserved as a symlink to `vaptvupt`.
|
|
.
|
|
The archive format includes an integrity trailer that authenticates the
|
|
header and footer, per-block HMAC with bound frame-preface AAD, and
|
|
optional encrypted comments.
|