Skip to content

LispM Auth 0.2.0 — Standalone Common Lisp service

Choose a tag to compare

View all tags
@RyanKung RyanKung released this 03 Nov 22:14
v0.2.0
f2fae2a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

LispM Auth v0.2.0 — standalone Common Lisp service

This release replaces runtime Lisp source loading with a compiled Common Lisp executable. End users do not install ECL, SBCL, ASDF, CFFI, GnuPG, Homebrew or libsodium. libsodium is linked statically; approved non-system runtime libraries are bundled.

Platform archives

  • lispm-auth-service-v0.2.0-darwin-arm64.tar.gz: macOS 14 ARM64 baseline.
  • lispm-auth-service-v0.2.0-darwin-x86_64.tar.gz: macOS 15 Intel baseline.
  • lispm-auth-service-v0.2.0-linux-x86_64.tar.gz: Ubuntu 22.04/glibc x86_64 baseline.

Keep the complete extracted archive together, including lib/, license texts and source notices. Point lispm-auth-service-program at its absolute lispm-auth-service executable, or place the archive contents in prebuilt/PLATFORM/ alongside lispm-auth.el. Do not copy just the executable.

macOS archives are ad-hoc signed, not Developer ID signed or notarized. This release does not bypass Gatekeeper or remove quarantine. Windows, Linux ARM64, musl, older macOS and universal macOS binaries are not supported.

Verification and provenance

Binaries are the exact, unmodified artifacts from successful CI run https://github.com/LispMachineLab/lispm-auth/actions/runs/41710011887 at source commit dfa51ac. The relevant source tree is identical to merged release commit f2fae2a. All three CI jobs passed source tests, runtime closure audit, relocated cryptographic tests and actual archive installation tests. The ARM64 CI archive additionally passed local headless Emacs 30.1 installation and restricted-environment cryptographic tests.

SHA256SUMS identifies the actual assets; consumers should pin reviewed expected values rather than trust a checksum fetched alongside a binary as the sole authenticity mechanism.

Compatibility and security

The LAW/LAI native encrypted formats remain compatible. Existing native/items/*.gpg suffixes are retained for compatibility but are not OpenPGP files. Legacy OpenPGP stores are rejected without automatic migration or overwrite. Retain backups and export legacy data using the previous software.

No downloads occur at package load or ordinary store use. The explicit installer requires Emacs zlib support and a reviewed fixed-version SHA256 pin. The source at this release initially leaves client pins empty; use the explicit executable/prebuilt configuration until the reviewed pin update is available.

Source and licenses

Project source is provided in lispm-auth-v0.2.0-source.tar.gz under the included GNU AGPL v3 terms. Third-party dependencies retain their individual licenses. Corresponding dependency source, vendor patches and build metadata are supplied in lispm-auth-v0.2.0-dependency-sources.tar.gz. That archive contains dependency-sources/BUILD-AND-RELINK.md and dependency-sources/SOURCE-PROVENANCE.json. Keep both source archives available alongside the binaries. ABI-compatible shared dependency replacements are permitted; see the relinking instructions. Source packages are distributed under their own licenses, not relicensed under the project's AGPL.

Assets 9
Loading