Security open software

And now the pippone-spiegone! :-D

zpaqfranz-open

zpaqfranz is fully open source. All its components (including binary SFX modules) are published on GitHub and can be rebuilt from source.

However, not everything is immediately human-readable — some parts involve embedded binaries or external modules. This is standard in open-source projects (fonts, libraries, etc.).

External Dependencies

If enabled, zpaqfranz can load external libraries (e.g., libcurl). These are not statically linked due to cross-platform complexity — static linking works on some systems (e.g., Debian), but fails on others where libcurl isn’t available.

Scripts

To interact with the OS (e.g., VSS on Windows or ZFS on Unix), zpaqfranz uses shell scripts. These are plain text in the C++ source and written to the temporary folder at runtime.

Risky commands: Windows Long Path Deletion, pruning etc

The Windows version includes logic to delete folders containing files with paths >255 characters — normally very difficult to do Pruning: widely used in backup: keeps newest file versions in a folder, deletes older ones.

---

Too Dangerous Features (By Design: Excluded)

Over the years, I’ve seriously considered adding a feature that’s useful but risky: “Delete source files after archiving” — similar to what 7z offers.

While convenient, this feature is also commonly abused by ransomware: encrypt + delete = damage. It’s been used to wipe NAS devices from a well-known vendor that ships with 7z.

So, despite its usefulness, I’ve chosen not to implement it. Same goes for things like reverse dd — writing raw images to disks.

You may have noticed: zpaqfranz can backup, but it doesn't restore. Why? That’s not an oversight — it’s a deliberate safety decision.

---

Security Note

Some behaviors (e.g., loading external DLLs/so) could increase the attack surface on already compromised systems.

To mitigate this (for libcurl.dll):

• DLL downloads are only allowed from my own website
• SHA-256 hashes are verified before use

If you have malware running on your system, nothing is truly safe — but this setup is more secure than most.

---

Windows: Executable Transparency

On Windows, executables are inherently "closed" — you can't easily inspect their internals. That's just the norm. However, in my case, you can rebuild zpaqfranz.exe bit-for-bit from source to verify it’s "clean".

How?

Use zpaqbuilder https://github.com/fcorbelli/zpaqfranz-stuff/releases/tag/V02, which includes all the tools and instructions needed for a reproducible build.

If you're truly paranoid, you can set up your own clean build environment. Just make sure to use exactly the same compiler versions I used — especially the correct g++ version — and compare your results with those from zpaqbuilder.

---

Update Signatures

Automatic update files are digitally signed with a legally valid signature (Italy), allowing you to verify that they were signed by me.

Instructions are provided on how to verify these signatures independently, using standard hardware tokens (commonly used in Italian legal contexts).

If you'd like Microsoft-approved code signing... feel free to donate €1000/year for the certificates 😉. As for me — I’m not paying for that out of pocket.

OK, Two Versions, One Source

There is one single source tree, in my usual style, from which you can build either version:

• zpaqfranz – Full version (default, with all features; used by me)
• zpaqfranz-open – Reduced version (no scripts, no SFX, no external calls, no temp writes...)

---

How to Build the Open Version

You can generate zpaqfranz-open in two ways:

1. Do Not Define ZPAQFULL

Simply compile without defining the ZPAQFULL macro. All non-human-readable or external sections (e.g. SFX) will be excluded.

2. Use sed to Remove Sections

Alternatively, strip the optional parts using:

sed -i "/NOSFTPSTART/,/NOSFTPEND/d" zpaqfranz-open.cpp

This removes all code between those two markers, producing a fully "clean" source file.

Differences (so far)

Windows

• Stripped SFX modules Contains binary code (on GitHub) not human-readable.
• Stripped VSS support Can’t delete existing VSS snapshots.
• Stripped adminrun Admin shell not auto-elevated.
• Stripped internet download No built-in file download; use wget or similar.
• Stripped Thunderbird No specific Thunderbird backup.
• Stripped reset ACL Won’t help unlock “Highlander” files.
• Stripped rd Can’t delete folders with >255 char filenames.

Non-Windows

• Stripped zfs interface ZFS support disabled.
• Stripped zfs dataset ZFS support disabled.
• Stripped zfs backup ZFS support disabled.
• Stripped versum-zfs ZFS support disabled.
• Stripped proxmox backup Proxmox support disabled.

Both

• Stripped SFTP support No SFTP.
• Stripped cloud support No cloud features.
• Stripped MySQL dump No mysqldump support.
• Stripped auto testfile Binary test files not included.
• Stripped the (n) Prune command removed.
• Stripped update Cannot download updates (Windows) or check (*nix) for new versions
• Stripped isopen Can’t detect if a file is open.
• Stripped Turboboost Can’t limit CPU to save power (overnight runs).
• Stripped shutting down Can’t shut down PC after job.
• Stripped embedded list No precomputed file lists (l must re-scan each time).
• Stripped scripts Do not execute script on error / warning / OK.
• Stripped temp Writes nothing to temp folder.