Watch

Cristian Cezar Moisés 4874010d0e v4.1.0: source-only build, multithreaded-encryption fix, security hardening

Build from source with no vendored binaries:
- Remove prebuilt libzuptsdk.so / libpqvaptvupt.so (and a stray .pyc). The
  default build needs only a C compiler + make; it links no external library
  and installs no .so. The libzuptsdk-backed modes (Argon2id KDF, --pq-sdk,
  --pq-box) are gated behind an opt-in `make WITH_SDK=1`. The default password
  KDF is PBKDF2-SHA256 and --pq (native ML-KEM-768 + X25519) is the built-in PQ
  mode. openSUSE/RPM/deb/AUR/Homebrew/Nix recipes bumped to 4.1.0; the openSUSE
  spec now builds source-only (%files ships no .so, %build/%install WITH_SDK=0).

Fix: multithreaded encrypted archives were unextractable on the native AEAD
path. The parallel compress/decompress workers skipped the F-09 frame-preface
AAD that the serial path and the archive's AAD_PREFACE flag bind into every
block MAC, so each multithreaded block failed authentication. The workers now
bind the preface via a shared serializer; output is byte-identical across
thread counts and interoperates with single-threaded archives (also fixes
`--kdf pbkdf2 -t N` in any build).

Security hardening (crafted-archive memory safety + crypto):
- LZH raw code-length stack overflow + huff_lut OOB write
- overflow-safe bounds in parse_index and solid-mode extract (heap OOB read)
- SEQ decoder safe-zone heap overflow (litlen+matchlen reserve)
- require the per-block ENCRYPTED flag on encrypted archives (plaintext forgery)
- cap archive-supplied PBKDF2 iteration count (KDF-amplification DoS)
- non-elidable secret wipe in the SDK path; restored disk images created 0600

Docs: remove AUDIT.md / BENCHMARKS.md / ROADMAP.md; trim marketing/AI-styled
text and correct KDF/PQ facts across README, SECURITY, INSTALL, DISTRIBUTION,
THREAT_MODEL, THIRD-PARTY-NOTICES, the man page, and packaging READMEs. Wire
format v1.6 unchanged.

2026-07-07 19:45:37 -03:00

3.2 KiB

Raw Permalink Blame History

VaptVupt GUI

Desktop application for vaptvupt backup compression with ML-KEM-768 + X25519 post-quantum hybrid encryption.

Works on GNU/Linux, BSD, macOS, and Windows.

Install

Linux (recommended)

tar xzf vaptvupt-gui.tar.gz && cd vaptvupt-gui
./vaptvupt-gui                      # auto-creates venv, installs PySide6
./install.sh --user              # adds right-click menu integration

Windows

Option A — Installer (recommended):

Download VaptVuptGUI-1.3.0-Setup.exe and run it. Installs to Program Files, adds Start Menu shortcut, desktop shortcut, right-click context menus, and .zupt file association. Includes uninstaller.

Option B — Build from source:

cd packaging\windows
build-windows.bat

Requires Python 3.9+, NSIS 3.x, and a compiled vaptvupt.exe.

Option C — Run directly:

pip install PySide6
python src\zupt_gui.py

macOS / BSD

pip3 install PySide6
python3 src/zupt_gui.py

AppImage (universal Linux)

chmod +x VaptVupt-GUI-1.3.0-x86_64.AppImage
./VaptVupt-GUI-1.3.0-x86_64.AppImage

Flatpak

flatpak-builder --install build packaging/flatpak/dev.zupt.gui.yml
flatpak run dev.zupt.gui

Features

Tab	Function
Keys	Generate ML-KEM-768 + X25519 hybrid keypairs
Compress	All codecs, levels 1-9, dedup, solid, password, PQ keys
Extract	Decrypt and extract .zupt archives
Verify	Check block checksums, view archive metadata
Disk	Full-disk backup and restore
About	Version, cryptographic stack, credits

All tabs support drag-and-drop. Drop a .zupt file anywhere on the window to extract it. Drop any other file to compress it.

System Integration

Linux (Nemo / Cinnamon)

After ./install.sh --user:

Right-click any file: Compress with VaptVupt
Right-click .zupt file: Extract with VaptVupt
Double-click .zupt: opens in VaptVupt GUI

Windows (after installer)

Right-click any file: Compress with VaptVupt
Right-click any folder: Compress with VaptVupt
Double-click .zupt: opens in VaptVupt GUI
Right-click .zupt: Verify Integrity

Architecture

VaptVupt GUI (PySide6, Python)
    |
    |-- subprocess.Popen() with streaming stderr
    |
    v
vaptvupt CLI (Pure C11 binary)
    ML-KEM-768 + X25519 + AES-256-CTR
    VaptVupt / LZHP / Store codecs
    Block deduplication, full-disk backup

The GUI calls the vaptvupt CLI binary — all cryptography runs in native C, not Python.

Packaging

Platform	Format	Tool
Any	pip	`pip install .`
Debian/Ubuntu/Mint	.deb	`packaging/deb/control`
Fedora/RHEL	.rpm	`rpmbuild -ba packaging/rpm/vaptvupt.spec`
Universal Linux	.AppImage	`packaging/appimage/build-appimage.sh`
Sandboxed Linux	.flatpak	`packaging/flatpak/dev.zupt.gui.yml`
Windows	.exe installer	`packaging/windows/build-windows.bat`
Windows	NSIS .exe	`packaging/windows/zupt-installer.nsi`

Credits

vaptvupt v4.1.0 — Cristian Cezar Moisés (github)

License

AGPL-3.0-or-later

3.2 KiB Raw Permalink Blame History