5050570b23
Version bumped to 5.0.0 across include/zupt.h, all packaging recipes, man page, and docs. Audit fixes (pre-5.0.0 review): - src/zupt_format.c: overflow-safe bound in the solid-mode `test` path (off+sz could wrap and drive an OOB read in zupt_xxh64 on a crafted archive; the extract path was already hardened, the test path was not). - gui: run_async now marshals the completion callback onto the GUI thread with QueuedConnection (a bare functor connected DirectConnection and touched widgets off the worker thread); Extract auto-detect note survives the log clear via a new `info` param. - .github/workflows/ci.yml: trigger on `master` (was main/develop, so CI never ran); `make dist` tarball is vaptvupt-*.tar.gz not zupt-*; the ASAN PQ round-trip uses native --pq (was --pq-sdk, which fails on the source-only build and blocked the release job). Documentation: - New AUDIT.md (methodology, FIPS 203 conformance validation, findings, repro). - CHANGELOG 5.0.0 entry covers the FIPS 203 conformance fix + BREAKING note and the GUI/CLI/security/packaging work. - README "What's new in 5.0.0", download tables (incl. Windows/macOS/BSD + portable GUI), version-history row. - SECURITY.md + THREAT_MODEL.md: ML-KEM-768 documented as FIPS 203, validated byte-for-byte against OpenSSL 3.5. - Accuracy fixes: man page (--kdf default is PBKDF2 on source-only; codec 2.60.4), rpm %description, debian control/copyright, homebrew header (no vendored library on source-only builds). make check 16/16 (FIPS 203 conformance 3/3, all distro-safe checks).
110 lines
3.5 KiB
Nix
110 lines
3.5 KiB
Nix
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
#
|
|
# Nix flake for zupt.
|
|
#
|
|
# Usage (with flakes enabled):
|
|
# nix build .#zupt # build the package
|
|
# nix run .#zupt -- version # run zupt directly
|
|
# nix develop # drop into a dev shell
|
|
# nix flake check # lint the flake
|
|
#
|
|
# To consume from another flake:
|
|
# inputs.zupt.url = "git+https://git.securityops.co/cristiancmoises/zupt?ref=v2.4.4";
|
|
# ...packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt;
|
|
#
|
|
# Reproducibility:
|
|
# * Nix already pins the source tree by hash.
|
|
# * `make dist` is also reproducible (tests/test_dist_reproducible.sh).
|
|
# * Together, two independent Nix evaluations of the same flake.lock
|
|
# produce byte-identical /nix/store outputs.
|
|
|
|
{
|
|
description = "Zupt — post-quantum backup compression utility (C11)";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, flake-utils }:
|
|
flake-utils.lib.eachSystem [ "x86_64-linux" "aarch64-linux" ] (system:
|
|
let
|
|
pkgs = import nixpkgs { inherit system; };
|
|
|
|
zupt = pkgs.stdenv.mkDerivation {
|
|
pname = "vaptvupt";
|
|
version = "5.0.0";
|
|
|
|
# When publishing, replace this with `fetchurl` against the
|
|
# release tarball. For local development the flake assumes it
|
|
# lives in the same directory as the source.
|
|
src = ./.;
|
|
|
|
nativeBuildInputs = with pkgs; [
|
|
gcc
|
|
gnumake
|
|
];
|
|
|
|
# python3 is only used by the regression-test harness.
|
|
checkInputs = [ pkgs.python3 ];
|
|
|
|
# Build with the project's preferred warning set on top of Nix's
|
|
# hardening flags. Don't override -O2 from stdenv.
|
|
NIX_CFLAGS_COMPILE = "-Wall -Wextra -Wpedantic -std=c11";
|
|
|
|
# Source-only build (WITH_SDK=0): native crypto, no vendored libraries.
|
|
buildPhase = ''
|
|
runHook preBuild
|
|
make WITH_SDK=0 -j$NIX_BUILD_CORES
|
|
runHook postBuild
|
|
'';
|
|
|
|
# Distro-safe regression subset. Disable with doCheck = false;.
|
|
doCheck = true;
|
|
checkPhase = ''
|
|
runHook preCheck
|
|
make WITH_SDK=0 check
|
|
runHook postCheck
|
|
'';
|
|
|
|
installPhase = ''
|
|
runHook preInstall
|
|
make DESTDIR=$out PREFIX= WITH_SDK=0 install
|
|
|
|
# Docs
|
|
mkdir -p $out/share/doc/vaptvupt
|
|
cp README.md SECURITY.md CHANGELOG.md $out/share/doc/vaptvupt/
|
|
runHook postInstall
|
|
'';
|
|
|
|
meta = with pkgs.lib; {
|
|
description = "Post-quantum backup compression utility (ML-KEM-768 + X25519 + AES-256-CTR + HMAC-SHA256)";
|
|
homepage = "https://git.securityops.co/cristiancmoises/vaptvupt";
|
|
license = with licenses; [ agpl3Plus gpl3Plus ];
|
|
maintainers = [ ];
|
|
platforms = [ "x86_64-linux" "aarch64-linux" ];
|
|
mainProgram = "vaptvupt";
|
|
};
|
|
};
|
|
in {
|
|
packages = {
|
|
zupt = zupt;
|
|
default = zupt;
|
|
};
|
|
|
|
apps.default = {
|
|
type = "app";
|
|
program = "${zupt}/bin/zupt";
|
|
};
|
|
|
|
devShells.default = pkgs.mkShell {
|
|
buildInputs = with pkgs; [
|
|
gcc
|
|
gnumake
|
|
python3
|
|
valgrind
|
|
gdb
|
|
];
|
|
};
|
|
});
|
|
}
|