Repository navigation
Releases
LispM Auth v0.2.8
LispM Auth v0.2.8
Built and tested by CI from 5be9aeb.
Use the lispm-auth-client archive: its generated lispm-auth.el pins these exact three service archives. The bare git tag is build input and does not contain the post-build pins.
Platforms: macOS 15 ARM64, Ubuntu 22.04 x86_64, Ubuntu 24.04 ARM64 (glibc). Intel macOS is no longer supported. Older systems, musl and Windows are not supported. macOS signatures are ad-hoc, not notarized.
Each platform dependency-sources archive contains SOURCE-PROVENANCE.json, exact vendor sources/patches and BUILD-AND-RELINK.txt. The project source archive contains build scripts and license. Keep these assets together when redistributing. No bit-for-bit reproducibility is claimed.
LispM Auth v0.2.7
LispM Auth v0.2.7
Built and tested by CI from 0aa4b00.
Use the lispm-auth-client archive: its generated lispm-auth.el pins these exact three service archives. The bare git tag is build input and does not contain the post-build pins.
Platforms: macOS 15 ARM64, Ubuntu 22.04 x86_64, Ubuntu 24.04 ARM64 (glibc). Intel macOS is no longer supported. Older systems, musl and Windows are not supported. macOS signatures are ad-hoc, not notarized.
Each platform dependency-sources archive contains SOURCE-PROVENANCE.json, exact vendor sources/patches and BUILD-AND-RELINK.txt. The project source archive contains build scripts and license. Keep these assets together when redistributing. No bit-for-bit reproducibility is claimed.
LispM Auth v0.2.6
LispM Auth v0.2.6
Built and tested by CI from cf36558.
Use the lispm-auth-client archive: its generated lispm-auth.el pins these exact three service archives. The bare git tag is build input and does not contain the post-build pins.
Platforms: macOS 15 ARM64, Ubuntu 22.04 x86_64, Ubuntu 24.04 ARM64 (glibc). Intel macOS is no longer supported. Older systems, musl and Windows are not supported. macOS signatures are ad-hoc, not notarized.
Each platform dependency-sources archive contains SOURCE-PROVENANCE.json, exact vendor sources/patches and BUILD-AND-RELINK.txt. The project source archive contains build scripts and license. Keep these assets together when redistributing. No bit-for-bit reproducibility is claimed.
LispM Auth v0.2.5
LispM Auth v0.2.5
Built and tested by CI from 4c44602.
Use the lispm-auth-client archive: its generated lispm-auth.el pins these exact three service archives. The bare git tag is build input and does not contain the post-build pins.
Platforms: macOS 14 ARM64, Ubuntu 22.04 x86_64, Ubuntu 24.04 ARM64 (glibc). Intel macOS is no longer supported. Older systems, musl and Windows are not supported. macOS signatures are ad-hoc, not notarized.
Each platform dependency-sources archive contains SOURCE-PROVENANCE.json, exact vendor sources/patches and BUILD-AND-RELINK.txt. The project source archive contains build scripts and license. Keep these assets together when redistributing. No bit-for-bit reproducibility is claimed.
LispM Auth v0.2.2
LispM Auth v0.2.2
Built and tested by CI from 5c09d5d.
Use the lispm-auth-client archive: its generated lispm-auth.el pins these exact four service archives. The bare git tag is build input and does not contain the post-build pins.
Platforms: macOS 14 ARM64, macOS 15 Intel, Ubuntu 22.04 x86_64, Ubuntu 24.04 ARM64 (glibc). Older systems, musl and Windows are not supported. macOS signatures are ad-hoc, not notarized.
Each platform dependency-sources archive contains SOURCE-PROVENANCE.json, exact vendor sources/patches and BUILD-AND-RELINK.txt. The project source archive contains build scripts and license. Keep these assets together when redistributing. No bit-for-bit reproducibility is claimed.
LispM Auth client 0.2.1 — Verified service pins
LispM Auth client 0.2.1
The first tagged client containing independently verified SHA256 pins for all three published standalone service v0.2.0 archives.
- Client version: 0.2.1
- Client tag: client-v0.2.1
- Commit: 7f56c31
- Service version pinned by this client: v0.2.0, unchanged.
- Merged update: #4
Install
Extract lispm-auth-client-0.2.1.tar.gz, add its directory to Emacs load-path, and load lispm-auth. With Emacs 30.1 or later built with zlib support, invoke M-x lispm-auth-install-service and confirm the explicit download. The client selects the supported platform, verifies its pinned SHA256 before extraction, probes the service, and activates the versioned installation without overwriting an existing one. Merely loading the package does not download anything.
For Desktop packaging, pin tag client-v0.2.1 (or the exact commit above). The service assets remain at https://github.com/LispMachineLab/lispm-auth/releases/tag/v0.2.0. A distributor may bundle the full verified service tree in prebuilt/PLATFORM/ alongside lispm-auth.el instead of using the explicit downloader. Preserve lib/ and license files, and distribute the corresponding source materials from the service release as required.
Supported service platforms and hashes
| Platform | Baseline | Published service archive SHA256 |
|---|---|---|
| darwin-arm64 | macOS 14 ARM64 | f5e5a8308f3ab745bef0654ce07ffaebb9ee1b503f8c83c4bd558224349968bf |
| darwin-x86_64 | macOS 15 Intel | 231924ec7573a575aa51fde23be9318ab198146c51962c16275cb3106589f7bc |
| linux-x86_64 | Ubuntu 22.04/glibc | 77364fa76e1a2ae5f7a5a13b43d3ed6f45479ca84fc844f612481e1fd9e0be33 |
End users do not install ECL, SBCL, ASDF, CFFI, GnuPG, libsodium or Homebrew. macOS service bundles are ad-hoc signed, not Developer ID signed or notarized. Unsupported systems and old OpenPGP stores are rejected without an automatic migration.
Validation
All six latest PR checks passed before merge. Local headless GNU Emacs 30.1 passed all 77 tests and strict warning-as-error byte compilation. Installing the actual publicly downloaded ARM64 service using the production default pin passed. The merged source tree was checked identical to the validated PR head before packaging. This client release does not rebuild or replace service binaries.
Client source is licensed AGPL-3.0-or-later; the archive includes LICENSE. Third-party service dependencies retain their own licenses and source/relinking materials in the separate service release.
LispM Auth 0.2.0 — Standalone Common Lisp service
LispM Auth v0.2.0 — standalone Common Lisp service
This release replaces runtime Lisp source loading with a compiled Common Lisp executable. End users do not install ECL, SBCL, ASDF, CFFI, GnuPG, Homebrew or libsodium. libsodium is linked statically; approved non-system runtime libraries are bundled.
Platform archives
lispm-auth-service-v0.2.0-darwin-arm64.tar.gz: macOS 14 ARM64 baseline.lispm-auth-service-v0.2.0-darwin-x86_64.tar.gz: macOS 15 Intel baseline.lispm-auth-service-v0.2.0-linux-x86_64.tar.gz: Ubuntu 22.04/glibc x86_64 baseline.
Keep the complete extracted archive together, including lib/, license texts and source notices. Point lispm-auth-service-program at its absolute lispm-auth-service executable, or place the archive contents in prebuilt/PLATFORM/ alongside lispm-auth.el. Do not copy just the executable.
macOS archives are ad-hoc signed, not Developer ID signed or notarized. This release does not bypass Gatekeeper or remove quarantine. Windows, Linux ARM64, musl, older macOS and universal macOS binaries are not supported.
Verification and provenance
Binaries are the exact, unmodified artifacts from successful CI run https://github.com/LispMachineLab/lispm-auth/actions/runs/41710011887 at source commit dfa51ac. The relevant source tree is identical to merged release commit f2fae2a. All three CI jobs passed source tests, runtime closure audit, relocated cryptographic tests and actual archive installation tests. The ARM64 CI archive additionally passed local headless Emacs 30.1 installation and restricted-environment cryptographic tests.
SHA256SUMS identifies the actual assets; consumers should pin reviewed expected values rather than trust a checksum fetched alongside a binary as the sole authenticity mechanism.
Compatibility and security
The LAW/LAI native encrypted formats remain compatible. Existing native/items/*.gpg suffixes are retained for compatibility but are not OpenPGP files. Legacy OpenPGP stores are rejected without automatic migration or overwrite. Retain backups and export legacy data using the previous software.
No downloads occur at package load or ordinary store use. The explicit installer requires Emacs zlib support and a reviewed fixed-version SHA256 pin. The source at this release initially leaves client pins empty; use the explicit executable/prebuilt configuration until the reviewed pin update is available.
Source and licenses
Project source is provided in lispm-auth-v0.2.0-source.tar.gz under the included GNU AGPL v3 terms. Third-party dependencies retain their individual licenses. Corresponding dependency source, vendor patches and build metadata are supplied in lispm-auth-v0.2.0-dependency-sources.tar.gz. That archive contains dependency-sources/BUILD-AND-RELINK.md and dependency-sources/SOURCE-PROVENANCE.json. Keep both source archives available alongside the binaries. ABI-compatible shared dependency replacements are permitted; see the relinking instructions. Source packages are distributed under their own licenses, not relicensed under the project's AGPL.
LispM Auth 0.1.0
LispM Auth 0.1.0
Initial release of LispM Auth: password-protected secret storage, application declarations, and Emacs password pages.
- Argon2id and XChaCha20-Poly1305 through a Common Lisp service and libsodium.
- Per-secret authenticated encryption, automatic locking, and password changes that rewrap the data key.
- Migration from legacy OpenPGP stores.
Requires SBCL, ASDF-visible CFFI and libsodium; GnuPG is needed only for legacy OpenPGP migration. See README.org for setup and security limitations.