5050570b23
Version bumped to 5.0.0 across include/zupt.h, all packaging recipes, man page, and docs. Audit fixes (pre-5.0.0 review): - src/zupt_format.c: overflow-safe bound in the solid-mode `test` path (off+sz could wrap and drive an OOB read in zupt_xxh64 on a crafted archive; the extract path was already hardened, the test path was not). - gui: run_async now marshals the completion callback onto the GUI thread with QueuedConnection (a bare functor connected DirectConnection and touched widgets off the worker thread); Extract auto-detect note survives the log clear via a new `info` param. - .github/workflows/ci.yml: trigger on `master` (was main/develop, so CI never ran); `make dist` tarball is vaptvupt-*.tar.gz not zupt-*; the ASAN PQ round-trip uses native --pq (was --pq-sdk, which fails on the source-only build and blocked the release job). Documentation: - New AUDIT.md (methodology, FIPS 203 conformance validation, findings, repro). - CHANGELOG 5.0.0 entry covers the FIPS 203 conformance fix + BREAKING note and the GUI/CLI/security/packaging work. - README "What's new in 5.0.0", download tables (incl. Windows/macOS/BSD + portable GUI), version-history row. - SECURITY.md + THREAT_MODEL.md: ML-KEM-768 documented as FIPS 203, validated byte-for-byte against OpenSSL 3.5. - Accuracy fixes: man page (--kdf default is PBKDF2 on source-only; codec 2.60.4), rpm %description, debian control/copyright, homebrew header (no vendored library on source-only builds). make check 16/16 (FIPS 203 conformance 3/3, all distro-safe checks).
49 lines
2 KiB
Text
49 lines
2 KiB
Text
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
|
Upstream-Name: zupt
|
|
Upstream-Contact: Cristian Cezar Moisés <sac@securityops.co>
|
|
Source: https://git.securityops.co/cristiancmoises/vaptvupt
|
|
|
|
Files: *
|
|
Copyright: 2025-2026 Cristian Cezar Moisés
|
|
License: AGPL-3.0-or-later
|
|
|
|
Files: src/vv_*.c include/vaptvupt*.h include/vv_*.h vendor/zuptsdk/include/vv_*.h vendor/zuptsdk/include/vaptvupt*.h
|
|
Copyright: 2025-2026 Cristian Cezar Moisés (VaptVupt codec)
|
|
License: GPL-3.0-or-later
|
|
|
|
Files: vendor/zuptsdk/*
|
|
Copyright: 2025-2026 Cristian Cezar Moisés (libzuptsdk)
|
|
License: GPL-3.0-or-later
|
|
|
|
Files: debian/*
|
|
Copyright: 2025-2026 Cristian Cezar Moisés <sac@securityops.co>
|
|
License: AGPL-3.0-or-later
|
|
|
|
License: AGPL-3.0-or-later
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU Affero General Public License as
|
|
published by the Free Software Foundation, either version 3 of the
|
|
License, or (at your option) any later version.
|
|
.
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU Affero General Public License for more details.
|
|
.
|
|
On Debian systems, the full text of the GNU Affero General Public
|
|
License version 3 can be found in the file
|
|
`/usr/share/common-licenses/AGPL-3'.
|
|
|
|
License: GPL-3.0-or-later
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
.
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
.
|
|
On Debian systems, the full text of the GNU General Public License
|
|
version 3 can be found in the file `/usr/share/common-licenses/GPL-3'.
|