5050570b23
Version bumped to 5.0.0 across include/zupt.h, all packaging recipes, man page, and docs. Audit fixes (pre-5.0.0 review): - src/zupt_format.c: overflow-safe bound in the solid-mode `test` path (off+sz could wrap and drive an OOB read in zupt_xxh64 on a crafted archive; the extract path was already hardened, the test path was not). - gui: run_async now marshals the completion callback onto the GUI thread with QueuedConnection (a bare functor connected DirectConnection and touched widgets off the worker thread); Extract auto-detect note survives the log clear via a new `info` param. - .github/workflows/ci.yml: trigger on `master` (was main/develop, so CI never ran); `make dist` tarball is vaptvupt-*.tar.gz not zupt-*; the ASAN PQ round-trip uses native --pq (was --pq-sdk, which fails on the source-only build and blocked the release job). Documentation: - New AUDIT.md (methodology, FIPS 203 conformance validation, findings, repro). - CHANGELOG 5.0.0 entry covers the FIPS 203 conformance fix + BREAKING note and the GUI/CLI/security/packaging work. - README "What's new in 5.0.0", download tables (incl. Windows/macOS/BSD + portable GUI), version-history row. - SECURITY.md + THREAT_MODEL.md: ML-KEM-768 documented as FIPS 203, validated byte-for-byte against OpenSSL 3.5. - Accuracy fixes: man page (--kdf default is PBKDF2 on source-only; codec 2.60.4), rpm %description, debian control/copyright, homebrew header (no vendored library on source-only builds). make check 16/16 (FIPS 203 conformance 3/3, all distro-safe checks).
56 lines
2.1 KiB
Ruby
56 lines
2.1 KiB
Ruby
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
#
|
|
# Homebrew formula for zupt.
|
|
#
|
|
# To publish:
|
|
# 1. Run `make dist` upstream to produce zupt-VERSION.tar.gz (reproducible).
|
|
# 2. Upload to a stable release URL.
|
|
# 3. Update `url`, `version`, and `sha256` below.
|
|
# 4. Submit to homebrew-core via PR OR host in your own tap
|
|
# (e.g. cristiancmoises/homebrew-tap).
|
|
#
|
|
# Local test:
|
|
# brew install --build-from-source ./zupt.rb
|
|
# brew test zupt
|
|
# brew audit --strict --online zupt
|
|
#
|
|
# Notes for macOS:
|
|
# * Jasmin assembly is disabled at build time on Darwin (no jasminc dep);
|
|
# the C fallback for AES-256-CTR / HMAC compare paths is shipped.
|
|
# * Source-only build: no vendored libraries; native crypto only.
|
|
|
|
class Vaptvupt < Formula
|
|
desc "Post-quantum backup compression utility (ML-KEM-768 + AES-256-CTR + HMAC-SHA256)"
|
|
homepage "https://git.securityops.co/cristiancmoises/vaptvupt"
|
|
url "https://git.securityops.co/cristiancmoises/vaptvupt/releases/download/v5.0.0/vaptvupt-5.0.0.tar.gz"
|
|
version "5.0.0"
|
|
sha256 "REPLACE_WITH_SHA256_OF_RELEASE_TARBALL"
|
|
license "AGPL-3.0-or-later"
|
|
|
|
depends_on "python@3.12" => :test # only for test-suite tamper harness
|
|
|
|
def install
|
|
# Source-only build (WITH_SDK=0): native crypto only, no vendored libraries.
|
|
# macOS uses the C-fallback crypto paths (no Jasmin); the Makefile detects
|
|
# this and falls back cleanly.
|
|
ENV["CFLAGS"] = "#{ENV.cflags} -O2 -std=c11 -Wall -Wextra"
|
|
|
|
system "make", "WITH_SDK=0", "-j#{ENV.make_jobs}"
|
|
system "make", "DESTDIR=#{prefix}", "PREFIX=", "WITH_SDK=0", "install"
|
|
|
|
# Docs (no vendored .so/.dylib in the source-only build).
|
|
doc.install "README.md", "SECURITY.md", "CHANGELOG.md"
|
|
end
|
|
|
|
test do
|
|
# End-to-end sanity check: build a real archive, extract it, byte-compare.
|
|
(testpath/"input.txt").write("homebrew formula test payload\n")
|
|
system bin/"zupt", "c", "-p", "test", "out.zupt", "input.txt"
|
|
system bin/"zupt", "info", "out.zupt"
|
|
mkdir "extracted"
|
|
cd "extracted" do
|
|
system bin/"zupt", "x", "-p", "test", "../out.zupt"
|
|
end
|
|
system "diff", "-q", "input.txt", "extracted/input.txt"
|
|
end
|
|
end
|