5050570b23
Version bumped to 5.0.0 across include/zupt.h, all packaging recipes, man page, and docs. Audit fixes (pre-5.0.0 review): - src/zupt_format.c: overflow-safe bound in the solid-mode `test` path (off+sz could wrap and drive an OOB read in zupt_xxh64 on a crafted archive; the extract path was already hardened, the test path was not). - gui: run_async now marshals the completion callback onto the GUI thread with QueuedConnection (a bare functor connected DirectConnection and touched widgets off the worker thread); Extract auto-detect note survives the log clear via a new `info` param. - .github/workflows/ci.yml: trigger on `master` (was main/develop, so CI never ran); `make dist` tarball is vaptvupt-*.tar.gz not zupt-*; the ASAN PQ round-trip uses native --pq (was --pq-sdk, which fails on the source-only build and blocked the release job). Documentation: - New AUDIT.md (methodology, FIPS 203 conformance validation, findings, repro). - CHANGELOG 5.0.0 entry covers the FIPS 203 conformance fix + BREAKING note and the GUI/CLI/security/packaging work. - README "What's new in 5.0.0", download tables (incl. Windows/macOS/BSD + portable GUI), version-history row. - SECURITY.md + THREAT_MODEL.md: ML-KEM-768 documented as FIPS 203, validated byte-for-byte against OpenSSL 3.5. - Accuracy fixes: man page (--kdf default is PBKDF2 on source-only; codec 2.60.4), rpm %description, debian control/copyright, homebrew header (no vendored library on source-only builds). make check 16/16 (FIPS 203 conformance 3/3, all distro-safe checks).
56 lines
2.1 KiB
Shell
56 lines
2.1 KiB
Shell
# Maintainer: Cristian Cezar Moisés <sac@securityops.co>
|
|
#
|
|
# AUR submission instructions:
|
|
# 1. Run `make dist` upstream to produce zupt-VERSION.tar.gz.
|
|
# 2. Upload that tarball somewhere stable (GitHub release / git.securityops.co).
|
|
# 3. Update `source=()` URL and `sha256sums=()` below.
|
|
# 4. Run `makepkg --printsrcinfo > .SRCINFO` in this directory.
|
|
# 5. Commit and push to ssh://aur@aur.archlinux.org/zupt.git
|
|
#
|
|
# Test locally: `makepkg -s` in this directory after dropping a copy of the
|
|
# zupt-VERSION.tar.gz alongside the PKGBUILD.
|
|
|
|
pkgname=vaptvupt
|
|
pkgver=5.0.0
|
|
pkgrel=1
|
|
provides=('zupt')
|
|
replaces=('zupt')
|
|
conflicts=('zupt')
|
|
pkgdesc='Pure-C11 post-quantum backup compression utility (AES-256-CTR + HMAC-SHA256 + ML-KEM-768 + X25519)'
|
|
arch=('x86_64' 'aarch64')
|
|
url='https://git.securityops.co/cristiancmoises/vaptvupt'
|
|
license=('AGPL-3.0-or-later')
|
|
depends=('glibc')
|
|
makedepends=('gcc')
|
|
checkdepends=('python')
|
|
|
|
# Replace SHA256 placeholder with output of:
|
|
# sha256sum /tmp/zupt-2.4.4.tar.gz
|
|
source=("${pkgname}-${pkgver}.tar.gz::https://git.securityops.co/cristiancmoises/vaptvupt/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
|
|
sha256sums=('SKIP')
|
|
|
|
build() {
|
|
cd "${pkgname}-${pkgver}"
|
|
# Source-only build (WITH_SDK=0) with the project's strict warning set.
|
|
CFLAGS="${CFLAGS:--O2 -std=c11} -Wall -Wextra -Wpedantic" \
|
|
make WITH_SDK=0 -j"$(nproc)"
|
|
}
|
|
|
|
check() {
|
|
cd "${pkgname}-${pkgver}"
|
|
# Distro-safe regression subset (F-06..F-12, dedup-nonce, NIST/RFC vectors).
|
|
make WITH_SDK=0 check
|
|
}
|
|
|
|
package() {
|
|
cd "${pkgname}-${pkgver}"
|
|
# Source-only build (no vendored libraries); `make install` places the
|
|
# binary, the zupt symlink, the man pages and the shell completions.
|
|
make DESTDIR="${pkgdir}" PREFIX=/usr WITH_SDK=0 install
|
|
|
|
# Docs that aren't part of `make install`
|
|
install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
|
|
install -Dm644 SECURITY.md "${pkgdir}/usr/share/doc/${pkgname}/SECURITY.md"
|
|
install -Dm644 CHANGELOG.md "${pkgdir}/usr/share/doc/${pkgname}/CHANGELOG.md"
|
|
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
|
|
}
|