Skip to content

Conversation

@veger
Copy link
Collaborator

@veger veger commented Aug 13, 2025

As discussed in #506 we have (in theory) no idea what liblua52.so contains, and even worse there is no way to reproduce this binary blob to check if we ship/release the expected one.

So this PR adds a build-linux.sh script that downloads and rebuilds the liblua52.so.
In order to know for sure the correct archive is downloaded it checks the sha256 as provided by the Lua project (https://www.lua.org/ftp/). So with this, the whole chain is traceable from source to the binary blob in the commit I guess (I am not an expert on this).

Besides this, it is now much easier to recompile with debug symbols included, which might be needed to fixgure out what is going on with #506.

The recompiled liblua52.so is included in this PR and is tested with a pyanodon save file, which still loads fine.

Finally, I also removed the liblua52.a, it is available after running build-linux.sh, but it is not used by Yafc.

Note that I only made the Linux script and changes, as I do not have a Mac or experience with it. But if someone is willing we can add an OS X script and update the OS X binaries as well.

@veger veger requested a review from shpaass as a code owner August 13, 2025 20:25
Copy link
Owner

@shpaass shpaass left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the reproducibility!

Note that liblua.so.patch is taken from Arch Linux package source.
@shpaass
Copy link
Owner

shpaass commented Aug 14, 2025

Rebased on fresh master.

@shpaass shpaass merged commit eab1f07 into shpaass:master Aug 14, 2025
1 check passed
@veger veger deleted the rebuild-lua branch August 19, 2025 11:59
shpaass added a commit that referenced this pull request Aug 25, 2025
Related to #515, liblua52.so can be built using the system CFLAGS
variable. I noticed when building/modifying the AUR package that running
the build script only included `-fPIC`, and built using only `-O2 -Wall
-DLUA_COMPAT_ALL -DLUA_USE_LINUX -fPIC`. This didn't compile using the
debug options set by makepkg.

Adding `${CFLAGS}` to MYCFLAGS in the build script allowed the library
to compile with those symbols, as well as other security mitigations.
SYSCFLAGS is set explicitly in Lua's Makefile, so it's safer to change
MYCFLAGS and MYLDFLAGS instead without patching.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants