luad 0.4.1

luad 0.4.1

Release 0.4.1 built from accepted revision 4e6857d2c561e1373276ee30ff443cc6d8945ccb.

Accepted CI run: https://github.com/dweekly/luad/actions/runs/40745387413

• New opt-in --link-convention luci-module-trusted-init for callers and export.
  The strict luci-module-setglobal convention only indexes a LuCI module whose top
  level does nothing but define functions, which leaves out most real modules: they
  call require, build tables or read fields first. The new convention indexes those
  too, by assuming something instead of proving it. The assumption, trusted-init, is
  that code run while a module loads doesn't replace, remove or alias any module's
  exported functions, or change a module's environment. That covers the module's own
  top-level code, functions in the same file, and anything reached through values luad
  can't identify.

  luad still checks what it can see directly in the module's top-level bytecode:

  • it refuses a module with no module declaration, a second one, or a direct
    setfenv/getfenv call;
  • a name that isn't assigned exactly one function, unconditionally, comes back
    dynamic.

  Every definite link (resolved, absent or duplicate) carries
  assumptions: ["trusted-init"]. So do the caller bases
  and the callers summary, which also lists assumed_providers. These fields are new
  and only appear under trusted-init; strict-mode output is byte-for-byte unchanged. If
  you validate against a saved copy of the schema, refresh it.

  On the 13 LuCI files in the repository, tests check all 70 cross-file callers against
  the source, and find all 39 literal luci.x.f( calls.

• The export reference consumer's offline callers now refuses a bundle captured under
  luci-module-trusted-init, and any link record that carries assumptions. Before
  this, its library entry point would answer such a bundle and drop the assumption
  label. (Its capture command never offered the convention.) It remains strict-only.

• Gates now identify a Lua compiler by the bytecode it produces, not by a hash of the
  luac executable (#119). A luac built from the same verified source changes with
  every C toolchain update, even though its output doesn't, and that broke 17 gates on
  a current macOS toolchain. GateSpec version 3 drops the executable hash. Instead, the
  runner compiles pinned reference sources (the committed fixtures: 10 per stock
  dialect, 2 for the LNUM32 compiler), requires the exact output bytes, records them in
  the GateResult, and checks them again during verification. All 26 compiler-pinned
  gates use version 3. Version 1 and 2 specs and results serialize as before. RC1's four
  prerequisite specs are archived byte for byte under
  tests/candidates/lua51-lnum32-rc1-prerequisites/ and checked against the hashes RC1
  recorded, so the RC1 candidate file itself is unchanged.

Checksums

93c8401584cf6a345c4e34182e74170a64bc1023e3c4adb877178928dceb10a4  evidence-index.json
57a2d70b87caef80b74a7bb8a4dda058330112c95581248d8e4759f2afd590d9  luad-0.4.1-linux-x86_64.tar.gz
cd46d29a4ad42792176edbdc3d18229026afbf94ebcbe464f3611a0cba07ada0  luad-0.4.1-macos-aarch64.tar.gz
a2b885d3c631d9efc64d7339ddf237a11fefeccbe4d3a4f226ac78b2b515957f  luad-0.4.1.cdx.json

Build Provenance

Artifact attestations can be verified with:

gh attestation verify luad-0.4.1-<platform>.tar.gz --repo dweekly/luad