* refactor: Update RPM version scheme; remove auto-update script; service hardening
- **RPM version scheme**: pre-releases now use `~` in the `Version` field instead of the `0.<release>.<suffix>` `Release`-field hack. Matches Debian's `~` convention, so RPM and DEB version strings are symmetric. Requires rpm ≥ 4.10 (RHEL 9 ships 4.17).
Before/after for a pre-release build:
```
# before
xrpld-3.2.0-0.1.rc3+202606011647.d4cb68d5.el9.x86_64.rpm
# after (symmetric with DEB)
xrpld-3.2.0~rc2+202606010139.7679a310-1.el9.x86_64.rpm
xrpld_3.2.0~rc2+202606010139.7679a310-1_amd64.deb
```
- **Auto-update removed**: `update-xrpld`, `update-xrpld.service`, and `update-xrpld.timer` deleted. The `50-xrpld.preset` `disable` line for the timer is dropped too.
- **Service hardening** (two new `[Service]` directives in `xrpld.service`):
- `CapabilityBoundingSet=CAP_NET_BIND_SERVICE` — drops every Linux capability except `CAP_NET_BIND_SERVICE`, capping the privilege ceiling to least-privilege while still letting operators bind ports <1024 (e.g. WS/HTTPS on 443).
- `SystemCallArchitectures=native` — restricts the service to the native syscall ABI, blocking alternate-ABI (32-bit/x32) syscalls used to evade seccomp filtering.
- [ ] Build RPM from a pre-release version (e.g. `3.2.0-b1`) and confirm `rpm -qi` shows `Version: 3.2.0~b1`, `Release: 1`
- [ ] Confirm `3.2.0~b1` sorts before `3.2.0` via `rpmvercmp`
- [ ] Install package and confirm no `update-xrpld*` units appear in `systemctl list-unit-files`
- [ ] Confirm `systemctl show xrpld` reflects the new `CapabilityBoundingSet` and `SystemCallArchitectures`
* fix: Track tmpfiles-created directories in RPM %files as %ghost
* XRPLF/develop:
test: Add null check unit test for `Oracle::aggregatePrice` (7306)
ci: Patch conan recipe for Nix to be able to use on macOS (7532)
ci: Run sanitizers on release builds too (7527)
fix: Correct hybrid offer deletion on credential expiry (6843)
ci: Make sanitizer flags lists in the profile, not a string (7449)
ci: Make configurations launch on certain event types (7447)
fix: Add [[maybe_unused]] to fix320Enabled for assert=OFF builds (7446)
ci: Add `gh` and `file` to nix packages (7444)
fix: Disable transaction invariants (7409)
perf: Dispatch "hasInvalidAmount()" on type tag instead of dynamic_cast (7402)
refactor: Retire fixUniversalNumber amendment (5962)
test: Do not create data directory for memory databases (7323)
ci: Launch upload-conan-deps on profile change (7442)
- Expand documentation.
- Refactor Number::Guard::round() to simplify.
- Set the Guard sign correctly in += for numbers with the same exponent.
- Only really relevant if both values are negative.
- In +=, when needed, expand one mantissa to a size large enough to have
a few extra digits, which can be used to determine rounding.
- If the exponents are still different, trim the other mantissa as
before until the exponents match.
- For subtraction (where the values' signs are different), pop digits
out of the Guard as necessary, but go far enough to have a few extra
digits again for rounding later.
- Finally, don't discard any "leftover" digits in the Guard when
normalizing, to avoid the 0.5....nnn problem.
- NumberAddDirectedSignWrong
- Addition of two negative numbers with the same exponent rounds
ToNearest in the wrong direction.
- Also include unit test cases with same exponent, and mixed signs.
- No rounding issues in any combination, because the exponent can't
change.
- NumberAddToNearestPicksFarther
- In scenarios where the two operands have different signs, and
significantly different exponents, you can end up in a situation
where the rounding looks like 0.5, which may round down to even, but
is actually 0.5....nnn, which should always round up, you get the
wrong result.
