Restore unconditional IgnoreFreeze in VaultWithdraw::doApply when
fixCleanup3_3_0 is enabled. That accountHolds reads the submitter's
share balance, which recurses into the underlying asset, so freeze
gating must stay in preclaim; a dstAcct==issuer guard there wrongly
blocked self-withdrawal under a regular freeze.
Apply issuer-aware freeze handling to LoanBrokerCoverWithdraw::preclaim
so the issuer can redeem their own token from the broker pseudo-account
even under a global freeze, matching AMM and Vault. Here accountHolds
reads the pseudo-account's holdings, so the issuer-only IgnoreFreeze is
both necessary and sufficient.
Rename the checkWithdrawFreeze source parameter to srcAcct to match its
definition, drop a misleading comment, and hoist the fixCleanup feature
flags into named locals.
Migrate AMMDeposit and AMMWithdraw to use the unified freeze helpers
introduced for Vault and LoanBroker, gated on fixCleanup3_3_0.
AMMDeposit: checkDepositFreeze for both pool assets replaces the
two-layer checkAsset + checkAmount freeze logic. If either pool asset
is frozen (depositor or AMM account), all deposits are blocked.
AMMWithdraw: checkWithdrawFreeze per withdrawn amount replaces
checkFrozen(AMM) + checkIndividualFrozen(user). Regular IOU freeze
no longer blocks self-withdrawal; only deep freeze does. The issuer
exemption allows the token issuer to withdraw from a frozen pool;
issuerFreezeHandling() ensures doApply uses IgnoreFreeze so pool
math does not divide by zero.
Rename checkWithdrawFreezes -> checkWithdrawFreeze (singular) and
update all callers. Document both helpers with full freeze semantics.
Extract all IOU freeze and MPT lock tests from testWithIOU and
testWithMPT into two focused test functions covering VaultDeposit
and VaultWithdraw respectively.
Each function tests both IOU (global, depositor regular/deep,
vault-account regular/deep) and MPT (global lock, depositor lock,
vault-account lock) for both pre- and post-fixCleanup3_3_0, plus
clawback-while-frozen assertions.
* refactor: Update RPM version scheme; remove auto-update script; service hardening
- **RPM version scheme**: pre-releases now use `~` in the `Version` field instead of the `0.<release>.<suffix>` `Release`-field hack. Matches Debian's `~` convention, so RPM and DEB version strings are symmetric. Requires rpm ≥ 4.10 (RHEL 9 ships 4.17).
Before/after for a pre-release build:
```
# before
xrpld-3.2.0-0.1.rc3+202606011647.d4cb68d5.el9.x86_64.rpm
# after (symmetric with DEB)
xrpld-3.2.0~rc2+202606010139.7679a310-1.el9.x86_64.rpm
xrpld_3.2.0~rc2+202606010139.7679a310-1_amd64.deb
```
- **Auto-update removed**: `update-xrpld`, `update-xrpld.service`, and `update-xrpld.timer` deleted. The `50-xrpld.preset` `disable` line for the timer is dropped too.
- **Service hardening** (two new `[Service]` directives in `xrpld.service`):
- `CapabilityBoundingSet=CAP_NET_BIND_SERVICE` — drops every Linux capability except `CAP_NET_BIND_SERVICE`, capping the privilege ceiling to least-privilege while still letting operators bind ports <1024 (e.g. WS/HTTPS on 443).
- `SystemCallArchitectures=native` — restricts the service to the native syscall ABI, blocking alternate-ABI (32-bit/x32) syscalls used to evade seccomp filtering.
- [ ] Build RPM from a pre-release version (e.g. `3.2.0-b1`) and confirm `rpm -qi` shows `Version: 3.2.0~b1`, `Release: 1`
- [ ] Confirm `3.2.0~b1` sorts before `3.2.0` via `rpmvercmp`
- [ ] Install package and confirm no `update-xrpld*` units appear in `systemctl list-unit-files`
- [ ] Confirm `systemctl show xrpld` reflects the new `CapabilityBoundingSet` and `SystemCallArchitectures`
* fix: Track tmpfiles-created directories in RPM %files as %ghost
