Skip to content

luad 0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Sep 06:19
v0.2.0
cfadac0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

luad 0.2.0

Release 0.2.0 built from accepted revision cfadac0b896cc14969a0771dc9bb63f11e0b5281.

Accepted CI run: https://github.com/dweekly/luad/actions/runs/35313473968

Experimental correctness and firmware-workflow release. No dialect is promoted to
supported, and machine interfaces retain their 0.x compatibility status.

  • Validate declared layouts and numeric canaries for Lua 5.2, 5.3, and 5.5; decode
    implemented widths and refuse unsupported declarations with anchored diagnostics.

  • Expand version-specific operand checks and refuse derived analysis for Lua 5.2,
    5.3, and 5.5 while keeping structural inspection and validation available.

  • Preserve parse-failure provenance through CLI and batch export, distinguish
    unsupported formats from malformed inputs, and handle broken pipes quietly.

  • Bound input reads, string declarations, traversal, diagnostics, and subprocess
    monitoring; cover hostile-input cases and budget breaches with regression tests.

  • Add a public firmware-shaped walkthrough with mixed-input inventory, constants,
    global queries, raw disassembly, and explicit profile boundaries.

  • Publish Linux x86-64 and macOS ARM64 archives with checksums, a deterministic
    CycloneDX source SBOM, and GitHub build-provenance attestations. Publication uses
    accepted CI artifacts and verifies fresh downloads.

  • Keep stdin workers under the subprocess tripwire deadline, including descendants
    that hold only stdin open. Cleanup joins only finished workers after its grace period.

  • Remove the simulated unluac oracle and pinned decompiler requirement from the
    firmware walkthrough. Required tests verify luad facts and refusal behavior;
    third-party decompilation is an optional, separately validated experiment.

  • Correct the walkthrough's input glob, expected manifest exit status, and completeness
    guidance; verify every manifest exit status against the CLI.

Checksums

e2c4d2241c9b06dcc2f755582e6cf2b7e30f257653b24745465a3d46b645e741  evidence-index.json
5e06b73837975b38d33fc7c73ec54150154babbdc13a69d0991021753c6d0fe6  luad-0.2.0-linux-x86_64.tar.gz
2b491dbeb9fbf37dfb0e20c15837043de96628c0743833fbbe1cbd2a88b7c448  luad-0.2.0-macos-aarch64.tar.gz
9312068fb220cc65984c6ce520fd52d1c4c5ed1353514382cd0024d634907303  luad-0.2.0.cdx.json

Build Provenance

Artifact attestations can be verified with:

gh attestation verify luad-0.2.0-<platform>.tar.gz --repo dweekly/luad
Assets 7
Loading