544a2cd647
Some checks failed
CI / build-and-test (clang) (push) Has been cancelled
CI / build-and-test (gcc) (push) Has been cancelled
CI / strict-warnings (clang, -Wall -Wextra -Wpedantic -Wshadow -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wnull-dereference -O2 -std=c11 -Werror) (push) Has been cancelled
CI / strict-warnings (gcc, -Wall -Wextra -Wpedantic -Wshadow -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wnull-dereference -Wformat-security -Wlogical-op -Wjump-misses-init -Wdouble-promotion -O2 -std=c11 -Werror) (push) Has been cancelled
CI / sanitizers (push) Has been cancelled
CI / pie-hardening (push) Has been cancelled
CI / cross-aarch64 (push) Has been cancelled
CI / dist-reproducibility (push) Has been cancelled
CI / packaging-syntax (push) Has been cancelled
CI / release (push) Has been cancelled
Major release. Highlights: - Codec: vendored VaptVupt codec moves to canonical 2.60.4 security release. Fixes a high-severity OOB heap write in the AVX2 decode fast path (reachable on a valid stream sized to exactly content_size, both tail variants). Brings CBMC-formally-verified BCJ filters with automatic ELF/PE/Mach-O detection. Compressed output stays byte-identical (ratio gate Δ 0.00%); wire format unchanged at v1.6. - New --pq-box sealed-box recipient mode (vendored libpqvaptvupt 0.6.0): ML-KEM-768 + X25519 combined via HKDF-SHA256 with domain separation, AES-256-CTR + HMAC-SHA256 EtM. Legacy --pq and --pq-sdk stay readable. - F-16: discloses and fixes a pre-existing data-loss defect in the <= 3.8.0 in-tree BCJ encoder. Full back-compat matrix decodes byte-exact under 4.0.0; every readable pre-4.0 archive remains readable. Repository hygiene: - Sync full 4.0.0 source tree (codec, crypto, SDK, GUI, packaging, tests). - Remove internal scratch files (PROMPT.md, FORMAL_AUDIT_PROMPT.md) and superseded version-specific docs (INTEGRATION_PROTOCOL_2.60.4.md, docs/FINDINGS-2.x.md) and a stray test binary. - Refresh README download/install section to real 4.0.0 release assets; bump version badge to 4.0.0. - Add .gitignore for build outputs (keeps vendored prebuilt libraries).
64 lines
2.6 KiB
Shell
64 lines
2.6 KiB
Shell
# Maintainer: Cristian Cezar Moisés <sac@securityops.co>
|
|
#
|
|
# AUR submission instructions:
|
|
# 1. Run `make dist` upstream to produce zupt-VERSION.tar.gz.
|
|
# 2. Upload that tarball somewhere stable (GitHub release / git.securityops.co).
|
|
# 3. Update `source=()` URL and `sha256sums=()` below.
|
|
# 4. Run `makepkg --printsrcinfo > .SRCINFO` in this directory.
|
|
# 5. Commit and push to ssh://aur@aur.archlinux.org/zupt.git
|
|
#
|
|
# Test locally: `makepkg -s` in this directory after dropping a copy of the
|
|
# zupt-VERSION.tar.gz alongside the PKGBUILD.
|
|
|
|
pkgname=vaptvupt
|
|
pkgver=4.0.0
|
|
pkgrel=1
|
|
provides=('zupt')
|
|
replaces=('zupt')
|
|
conflicts=('zupt')
|
|
pkgdesc='Pure-C11 post-quantum backup compression utility (AES-256-CTR + HMAC-SHA256 + ML-KEM-768 + X25519)'
|
|
arch=('x86_64' 'aarch64')
|
|
url='https://git.securityops.co/cristiancmoises/zupt'
|
|
license=('AGPL-3.0-or-later')
|
|
depends=('glibc')
|
|
makedepends=('gcc')
|
|
checkdepends=('python')
|
|
|
|
# Replace SHA256 placeholder with output of:
|
|
# sha256sum /tmp/zupt-2.4.4.tar.gz
|
|
source=("${pkgname}-${pkgver}.tar.gz::https://git.securityops.co/cristiancmoises/zupt/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
|
|
sha256sums=('SKIP')
|
|
|
|
build() {
|
|
cd "${pkgname}-${pkgver}"
|
|
# Strict-warning build that the project's own §6 verification matrix uses.
|
|
CFLAGS="${CFLAGS:--O2 -std=c11} -Wall -Wextra -Wpedantic" \
|
|
make -j"$(nproc)"
|
|
}
|
|
|
|
check() {
|
|
cd "${pkgname}-${pkgver}"
|
|
# Project regression suite — F-06 HMAC, F-08 top-MAC, F-09 byte sweep, etc.
|
|
make test
|
|
}
|
|
|
|
package() {
|
|
cd "${pkgname}-${pkgver}"
|
|
make DESTDIR="${pkgdir}" PREFIX=/usr install
|
|
|
|
# Docs that aren't part of `make install`
|
|
install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
|
|
install -Dm644 SECURITY.md "${pkgdir}/usr/share/doc/${pkgname}/SECURITY.md"
|
|
install -Dm644 CHANGELOG.md "${pkgdir}/usr/share/doc/${pkgname}/CHANGELOG.md"
|
|
install -Dm644 AUDIT.md "${pkgdir}/usr/share/doc/${pkgname}/AUDIT.md"
|
|
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
|
|
|
|
# Vendored libzuptsdk shipped alongside the binary because the binary
|
|
# is linked with -Wl,-rpath,$ORIGIN/vendor/zuptsdk. For system install
|
|
# we move it to /usr/lib/zupt/ and the binary's rpath remains relative.
|
|
install -d "${pkgdir}/usr/lib/${pkgname}"
|
|
install -Dm755 vendor/zuptsdk/libzuptsdk.so.2.0.0 \
|
|
"${pkgdir}/usr/lib/${pkgname}/libzuptsdk.so.2.0.0"
|
|
ln -sf libzuptsdk.so.2.0.0 "${pkgdir}/usr/lib/${pkgname}/libzuptsdk.so.2"
|
|
ln -sf libzuptsdk.so.2.0.0 "${pkgdir}/usr/lib/${pkgname}/libzuptsdk.so"
|
|
}
|