chore: preparing v1.4.2 that is about LICENSING (#38)

* misc improvements related to v1.4.0 (#27)

* fix(cli): complete truncated except clause in collect_manual_shares (#28)

* chore(readme): set correct README file

* chore: set version to 1.4.0

* chore: set version to 1.4.0 in README

* content of v1.4.1 (#33)

* fix(arch): unify encrypt path via FileEncryptor, fix test suite (N3)

* fix(crypto): remove plaintext hash (C1), bind metadata as AAD (C2), key as bytearray (M4)

* fix(supply-chain): pin installers with SHA-256 (H1), pin GH Actions by digest (H2), pin Docker image (H3)

* fix(fs): chmod 750 (M1), non-root test user (M2), secure zip cleanup (N2), no-overwrite on decrypt (N4)

* fix(robustness): verify share hash (L5), fix fallback set_id filtering (N5), narrow _read_metadata except (L8), os.urandom RNG (L6)

* fix(opsec): minimal share metadata by default (N10), package integrity verification (M6)

* fix(interactive): repair interactive mode broken by N10 minimal share format

* refactor: remove dead code — verify_shares, save_share, secure_string (batch 2)

* refactor: cohérence, optimisations et fix version check (batch 3)

* security: secure memory hardening — mlock, SecureContext, shares clearing (batch 4)

* test: add coverage for error messages, OS simulation, and UX modes

* test: add edge-case error coverage

* test: add deterministic file corruption coverag

* test(memory): add memory security test suite

* Add realistic test fixtures and cross-platform test fixes

* test: fix fuzzing hash field, add edge-case roundtrip and bootstrap syntax checks

* fix(cli): make --label optional, drop redundant manual-shares prompt

* test: move fixture-based suites to fractum-tests, drop legacy compat tests

* fix(ci): patch zizmor findings in release.yml, anchor gitignore/dockerignore globs

* fix(tests): force UTF-8 stdout on Windows in run_tests.py

* apply ruff format to src/, sync .gitignore

* feat: add --bundle-encrypted, tests, release process and docs edited

* fix(cli): complete truncated except clause in collect_manual_shares

* fix: patch v1.4.1 blockers — offline build, arm64 wheel, version check (M5), zip bomb (L4), label messaging (#32)

* ci: trigger CodeQL workflow on WhiteStarSupreme/misc-sec-improvements-pt1 branch

* ci: point CodeQL workflow at dev/main instead of a feature branch

---------

* chore: set version to 1.4.2

* Say that Fractum splits the AES key, not the file (#49) (#36)

* Split the trademark policy out of LICENSE, and stop calling the project proprietary (#37)

---------

Co-authored-by: WhiteStarSupreme <120492851+WhiteStarSupreme@users.noreply.github.com>
Co-authored-by: S.A.S.U KATVIO <contact@katvio.com>

Author: 3 people

.github/workflows/release.yml

@@ -111,6 +111,8 @@ jobs:
             setup.py \
             README.md \
             LICENSE \
+            TRADEMARK.md \
+            SECURITY.md \
             --exclude="*.pyc" \
             --exclude="__pycache__/*" \
             --exclude="*.DS_Store" \

Dockerfile

@@ -2,7 +2,7 @@ FROM python:3.12.11-slim@sha256:47ae396f09c1303b8653019811a8498470603d7ffefc29cb
 
 WORKDIR /app
 
-COPY setup.py README.md LICENSE bootstrap-linux.sh bootstrap-macos.sh bootstrap-windows.ps1 Dockerfile .dockerignore /app/
+COPY setup.py README.md LICENSE TRADEMARK.md SECURITY.md bootstrap-linux.sh bootstrap-macos.sh bootstrap-windows.ps1 Dockerfile .dockerignore /app/
 COPY src/ /app/src/
 COPY tests/ /app/tests/
 COPY packages/ /app/packages/

LICENSE

@@ -1,10 +1,10 @@
 # Fractum
 
-**Split any sensitive file into encrypted shares** and reconstruct it only when enough shares are pooled → fully offline, no cloud, no single point of failure.
+**Encrypt any sensitive file, then split its encryption key into shares** so the file only comes back when enough shares are pooled → fully offline, no cloud, no single point of failure.
 
 Designed for **long-term cold storage** of critical secrets: recovery credentials, exports of database & password managers, family photos, legal documents, crypto seed phrases.
 
-![Fractum splits a file into N encrypted shares, K of which reconstruct it](assets/images/encrypt-overview.png)
+![Fractum encrypts a file and splits its AES key into N shares, K of which recover the key](assets/images/encrypt-overview.png)
 
 **When to use it:**
 
@@ -17,7 +17,7 @@ Designed for **long-term cold storage** of critical secrets: recovery credential
 
 **Why distributed?**
 
-- Fewer than K shares reveal **nothing**: information-theoretic security *(same as Trezor SLIP-39, ICANN DNSSEC ceremonies)*
+- Fewer than K shares reveal **nothing**: the key-split has information-theoretic security *(same as Trezor SLIP-39, ICANN DNSSEC ceremonies)*; the file itself stays sealed under AES-256-GCM
 - No single point of failure: distribute shares across people, locations, media. No $5 Wrench Attack
 - Works completely offline in air-gapped environments
 
@@ -39,7 +39,7 @@ Docker is the recommended way to run Fractum. The `--network=none` flag guarante
 
 ```bash
 git clone https://github.com/katvio/fractum.git
-cd fractum && git checkout tags/v1.4.1
+cd fractum && git checkout tags/v1.4.2
 mkdir -p data shares
 docker build -t fractum-secure .
 ```
@@ -55,7 +55,7 @@ docker run --rm -it \
   --threshold 3 --shares 5 --label "bitwarden-backup"
 ```
 
-![Fractum splits a file into N encrypted shares, K of which reconstruct it](assets/images/encrypt-example.png)
+![Fractum encrypts a file and splits its AES key into N shares, K of which recover the key](assets/images/encrypt-example.png)
 
 
 ## Decrypt:
@@ -83,7 +83,7 @@ Inside the container (or after a manual install), the binary is `fractum`. Prefi
 fractum -i                  # interactive mode — guided menu, no flags needed
 fractum --version           # print the version
 
-# Encrypt: split FILE into N shares, K of which are needed to recover it
+# Encrypt: encrypt FILE, split its key into N shares, K of which are needed to recover it
 fractum encrypt FILE -t <threshold> -n <shares> [OPTIONS]
   -t, --threshold <int>      shares required to reconstruct (required)
   -n, --shares <int>         total shares to generate (required)
@@ -118,6 +118,8 @@ Submit a pull request or open an issue.
 
 ## License
 
-Fractum is licensed under a Custom Proprietary Software License that permits personal, non-commercial use. Commercial use is not permitted.
+Fractum is **Apache-2.0**. You may use it, modify it, redistribute it and use it commercially, without asking anyone.
 
-📄 **[View Full License](LICENSE)**
+The name is separate: Apache-2.0 grants no trademark rights (section 6), so "Fractum", the logos and the associated marks stay with S.A.S.U. KATVIO. Fork the code freely, give your fork its own name.
+
+📄 **[LICENSE](LICENSE)** · **[TRADEMARK.md](TRADEMARK.md)** · **[SECURITY.md](SECURITY.md)**

README.md

@@ -0,0 +1,53 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Report privately, not in a public issue: **contact@katvio.com**, with
+`SECURITY` in the subject line.
+
+A dedicated `security@katvio.com` alias would be better, and does not exist
+today; `contact@katvio.com` is the only address the project publishes.
+
+Include the version, the platform, and the smallest set of steps that
+reproduces the problem. A proof of concept helps but is not required.
+
+What to expect:
+
+| Step | Delay |
+|---|---|
+| Acknowledgement of receipt | 3 working days |
+| First assessment, severity and whether it is accepted | 10 working days |
+| Fix or documented mitigation for an accepted critical report | 90 days |
+
+If you get no acknowledgement within the first delay, the address may be
+failing; open a public issue saying only that you are trying to reach the
+security contact, without any detail of the finding.
+
+We ask for the usual restraint in return: no disclosure before a fix is
+available or the 90 days have passed, whichever comes first, and no testing
+against systems you do not own.
+
+## Supported versions
+
+Fixes land on the latest released minor version. Older versions receive nothing,
+so an upgrade is part of any remediation.
+
+## What this software does and does not claim
+
+Fractum encrypts a file with AES-256-GCM and splits the encryption key into
+shares using Shamir's Secret Sharing. It is a command line tool that runs
+offline, by design.
+
+Two limits are worth stating plainly, because they are the ones that surprise
+people:
+
+- **The share files are only as safe as where you put them.** The threshold
+  protects against losing some of them, not against an attacker who collects
+  enough of them. Storing several shares in one place removes the protection
+  entirely.
+- **The machine that runs the tool sees the key in memory.** Fractum is designed
+  for an offline, trusted workstation. Running it on a shared or compromised
+  host defeats the point.
+
+Cryptographic export and import rules vary by country. Using or redistributing
+this software is the user's responsibility in their own jurisdiction.