Skip to content

Release v1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Sep 09:37
· 2 commits to main since this release
v1.0.0
e68500d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

  • Add seven Plinth inspections mapped from the
    Cardano-CWE-Research
    rule set:

    • PLU-STAN-21 — credentials baked immutably into validators, both as
      top-level constants and specialised into compiled code via
      applyCode / unsafeApplyCode / liftCode.
    • PLU-STAN-22 — TxOut validation that constrains other fields but
      never the output address, so the output can be paid anywhere.
    • PLU-STAN-23 — unstableMakeIsData, whose positional constructor
      indices change the on-chain encoding when a type gains or reorders a
      constructor.
    • PLU-STAN-24 — an empty-string literal standing in for ADA instead of
      adaSymbol / adaToken.
    • PLU-STAN-25 — validation that depends on the transaction's other
      script inputs without inspecting a redeemer.
    • PLU-STAN-26 — zip without comparing the two lists' lengths, which
      silently drops the tail of the longer one.
    • PLU-STAN-27 — an input spent only to be recreated identically, where
      a reference input would do.

  • Add TRACEABILITY.csv and scripts/gen-traceability.py: a matrix mapping
    all 23 upstream research rules to Plu-Stan inspections in both directions,
    with a divergence note and the tests backing each link. Inspection facts
    are derived from the source tree, so they cannot drift; the generator also
    renders the README matrix and fails if a registered inspection has no
    README row.

  • Fix the release workflow: it created the GitHub release as a draft, which
    is untagged until published, so every binary upload failed to resolve the
    tag. Releases are now created as prereleases (published, tag resolvable,
    and excluded from /releases/latest) and promoted once assets exist.

Which binary do I need?

plustan reads .hie files, whose on-disk format is stable within a GHC
minor series but changes between them. Pick the asset matching your
project's GHC series, not the latest:

Your project's GHC Linux macOS (arm64) Windows
9.6.x plustan-1.0.0-linux-x64-ghc9.6 plustan-1.0.0-darwin-arm64-ghc9.6 plustan-1.0.0-windows-x64-ghc9.6.exe
9.12.x plustan-1.0.0-linux-x64-ghc9.12 plustan-1.0.0-darwin-arm64-ghc9.12 plustan-1.0.0-windows-x64-ghc9.12.exe

Intel macOS runs the arm64 build under Rosetta. The VS Code extension picks
the right asset automatically — run Plu-Stan: Check for Updates to pull
this release.

Full changelog: CHANGELOG.md

Assets 8
Loading