Release v2.1.7 · cristiancmoises/zupt

[2.1.7] — 2026-04-26

Zupt is now licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later). All previous versions are also retroactively re-licensed under AGPL-3.0-or-later by the sole copyright holder. The MIT license under which v0.1.0 through v2.1.6 were originally released is hereby withdrawn for any future use; cached MIT-licensed copies of those versions remain valid under their original terms but are not authorized for redistribution under MIT going forward.
Rationale. Years of work on post-quantum hybrid encryption (ML-KEM-768 + X25519), formally-verified Jasmin constant-time assembly, authenticated encryption (AES-256-CTR + HMAC-SHA256), and the custom VaptVupt compression codec were given to the world under MIT — and silent absorption into proprietary products is the foreseeable end-state of permissive licensing on infrastructure software. The AGPL closes the SaaS loophole specifically: anyone running a modified Zupt as a network service (cloud backup product, archival backend, etc.) must release the source code of their modifications. Personal use, internal corporate use, sysadmin use, research use, and academic use are unaffected and remain unrestricted.
Commercial licensing channel established. Organizations whose use is incompatible with the AGPL (proprietary embedding, hosted SaaS without source disclosure, redistribution under closed terms, requirement of warranty/indemnification) can obtain a commercial license at: sac@securityops.co.

The VaptVupt compression codec is licensed under GPL-3.0-or-later (src/vv_*.c, src/vaptvupt_api.c, include/vaptvupt.h, include/vaptvupt_api.h, include/vv_huffman.h, include/vv_ans.h, include/vv_platform.h). This matches the canonical upstream at github.com/cristiancmoises/vaptvupt and was not changed in this sprint — VaptVupt has been GPL-3.0-or-later since its initial release.
Why a separate license from Zupt's AGPL-3.0. VaptVupt has independent reuse value as a standalone compression codec. Anyone wishing to embed VaptVupt in another GPL-3.0 project should be able to do so without inheriting the network-clause obligations of Zupt's AGPL.
Compatibility with Zupt. GPL-3.0-or-later is two-way compatible with AGPL-3.0-or-later via the explicit GPL/AGPL combination provision in section 13 of both licenses. The combined Zupt binary remains valid AGPL-3.0.
Earlier sprint drafts briefly considered GPL-2.0-or-later for kernel-mergeability; that path was incorrect (the Linux kernel is GPL-2-only and rejects GPL-3+ code) and was withdrawn before release. VaptVupt is and remains GPL-3.0-or-later.

Pulled in upstream VaptVupt v2.46.1 (April 22, 2026), six minor versions ahead of the previously bundled v2.40.0. All 12 VaptVupt files (src/vv_*.c, src/vaptvupt_api.c, include/vaptvupt*.h, include/vv_*.h) replaced from github.com/cristiancmoises/vaptvupt master.
Public API and on-disk frame format are byte-identical to v2.40.0 — confirmed by diffing the public vv_compress/vv_decompress/vv_default_options/vv_compress_bound declarations and the vv_options_t struct. No caller changes required in zupt_lzh.c, zupt_format.c, zupt_main.c, etc.
Improvements pulled in:
- v2.41–v2.43 internal tightening (covered by upstream's "correctness release" v2.44.0 rollup).
- v2.44.0 — correctness release ships over v2.43.0 (encoder ANS state recovery, decoder bounds tightening).
- v2.45.0 — size-based window-log heuristic (better ratio on small inputs without manual tuning).
- v2.46.0 — Huffman-in-SEQ literal coding (additional ratio gain on text-heavy streams).
- v2.46.1 — memory-safety patch: fixes a 16,384-byte leak on three decoder error paths in vva_decode_sequences_impl (src/vv_ans.c). The dec_ll buffer was not freed on three malformed-input return paths. No behavior change on the success path; output byte-identical to v2.46.0 for valid inputs. This is a correctness/safety fix that closes a denial-of-service vector where an attacker controlling many malformed compressed frames could exhaust memory.