From e6832d16e1141a2e2018435e5329a0fffe99edc1 Mon Sep 17 00:00:00 2001 From: BinFlip Date: Sun, 9 Aug 2026 17:28:27 -0700 Subject: [PATCH 1/5] fix: use `?` instead of a match, to satisfy current clippy `structures::types` matched on `align_up(...)` and returned None in the None arm, which is exactly what `?` does. Clippy did not flag this when CI last ran, but the workflow pins dtolnay/rust-toolchain@stable, so the lint now fires and fails the `-D warnings` gate on every build. No behaviour change. --- src/structures/types.rs | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/src/structures/types.rs b/src/structures/types.rs index afc3b06..aa6b3cc 100644 --- a/src/structures/types.rs +++ b/src/structures/types.rs @@ -1164,12 +1164,8 @@ fn build_go_type<'a>( // the bare `FuncTypeExtra::SIZE` here would land the `UncommonType` // parse short by the padding, yielding a garbage `mcount`/`moff`. // Mirror `descriptor::descriptor_size`'s accounting. - TypeKind::Func => { - match align_up(base_sz.saturating_add(FuncTypeExtra::SIZE), ps as usize) { - Some(off) => off.saturating_sub(base_sz), - None => return None, - } - } + TypeKind::Func => align_up(base_sz.saturating_add(FuncTypeExtra::SIZE), ps as usize)? + .saturating_sub(base_sz), TypeKind::Interface => InterfaceTypeExtra::size(ps), TypeKind::Map => MapTypeExtra::size(ps), TypeKind::Pointer | TypeKind::Slice => ElemTypeExtra::size(ps), From 27374edd76db0742be384474886fd059a35b9dde Mon Sep 17 00:00:00 2001 From: BinFlip Date: Sun, 9 Aug 2026 17:28:54 -0700 Subject: [PATCH 2/5] chore: assign copyright to ATRAPS LLC Record ATRAPS LLC as copyright holder following the executed IP assignment. The Apache-2.0 appendix named Johann Kempter personally and carried the wrong year: every commit in this repo dates to 2026, not 2025. - LICENSE: appendix now reads "Copyright 2026 ATRAPS LLC" - NOTICE: added, per Apache-2.0 section 4(d) attribution channel - Cargo.toml: drop deprecated `authors`; point `repository` at the org - README: name the holder in the license section --- Cargo.toml | 3 +-- LICENSE | 2 +- NOTICE | 24 ++++++++++++++++++++++++ README.md | 3 ++- 4 files changed, 28 insertions(+), 4 deletions(-) create mode 100644 NOTICE diff --git a/Cargo.toml b/Cargo.toml index 93e2a7e..8572461 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -2,11 +2,10 @@ name = "gobin" version = "0.4.0" edition = "2024" -authors = ["Johann Kempter "] rust-version = "1.88" description = "Static analysis library for Go compiled binaries - identification and metadata extraction" license = "Apache-2.0" -repository = "https://github.com/BinFlip/gobin" +repository = "https://github.com/ATRAPSLLC/gobin" readme = "README.md" keywords = ["golang", "go", "parser", "reverse-engineering", "binary-analysis"] categories = ["parser-implementations"] diff --git a/LICENSE b/LICENSE index 84389ce..c60b058 100644 --- a/LICENSE +++ b/LICENSE @@ -175,7 +175,7 @@ END OF TERMS AND CONDITIONS - Copyright 2025 Johann Kempter + Copyright 2026 ATRAPS LLC Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/NOTICE b/NOTICE new file mode 100644 index 0000000..bed77b8 --- /dev/null +++ b/NOTICE @@ -0,0 +1,24 @@ +gobin +Copyright 2026 ATRAPS LLC + +This product includes software developed by ATRAPS LLC. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +---- + +This project includes the following third-party software: + +Third-party dependencies are listed in Cargo.toml and their licenses +can be found in their respective repositories. All dependencies are +compatible with the Apache 2.0 license. diff --git a/README.md b/README.md index 5fc81ed..efa5c65 100644 --- a/README.md +++ b/README.md @@ -60,4 +60,5 @@ numbers for version detection, but future Go releases may introduce changes. ## License -Apache-2.0 +Copyright 2026 ATRAPS LLC. Licensed under the Apache License, +Version 2.0. See `LICENSE` and `NOTICE`. From de7fc339205a15499451eb3a938c3ba2be57b8e1 Mon Sep 17 00:00:00 2001 From: BinFlip Date: Sun, 9 Aug 2026 17:28:54 -0700 Subject: [PATCH 3/5] ci: publish via trusted publishing, only from tags on main Replace the long-lived CARGO_REGISTRY_TOKEN repo secret with a short-lived OIDC token minted per run by crates-io-auth-action and revoked when the job ends. Also gate the job on the release commit being contained in main: a release can be cut from any commit, including one that never landed on main, so the `release: published` trigger alone does not imply it. --- .github/workflows/publish.yml | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ec51be5..ab6da95 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,14 +7,36 @@ on: env: CARGO_TERM_COLOR: always +permissions: + contents: read + jobs: publish: name: Publish runs-on: ubuntu-latest + permissions: + contents: read + id-token: write # required to mint the crates.io OIDC token steps: - uses: actions/checkout@v4 + with: + fetch-depth: 0 # merge-base needs real history + + # A GitHub release can be cut from any commit, including one that never + # landed on main. Publishing is restricted to release tags that are + # actually contained in main. + - name: Refuse releases not contained in main + run: | + git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main + git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/main \ + || { echo "::error::release commit $GITHUB_SHA is not contained in main"; exit 1; } + - uses: dtolnay/rust-toolchain@stable - run: cargo test + + - uses: rust-lang/crates-io-auth-action@v1 + id: auth + - run: cargo publish env: - CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} + CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} From e58c136c5a5355f60361144a0217f195ccd0b03d Mon Sep 17 00:00:00 2001 From: BinFlip Date: Sun, 9 Aug 2026 17:28:54 -0700 Subject: [PATCH 4/5] build: refresh transitive dependencies `cargo update` within existing constraints. The only direct dependency, goblin, was already at its latest release. --- Cargo.lock | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index ad72508..a93b07a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -22,9 +22,9 @@ dependencies = [ [[package]] name = "log" -version = "0.4.29" +version = "0.4.33" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897" +checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad" [[package]] name = "plain" @@ -34,18 +34,18 @@ checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6" [[package]] name = "proc-macro2" -version = "1.0.106" +version = "1.0.107" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934" +checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9" dependencies = [ "unicode-ident", ] [[package]] name = "quote" -version = "1.0.45" +version = "1.0.47" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924" +checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001" dependencies = [ "proc-macro2", ] @@ -72,9 +72,9 @@ dependencies = [ [[package]] name = "syn" -version = "2.0.117" +version = "2.0.119" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99" +checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297" dependencies = [ "proc-macro2", "quote", From 33ce122da1727ef0028759f17bf22c2827a18b8f Mon Sep 17 00:00:00 2001 From: BinFlip Date: Sun, 9 Aug 2026 17:28:54 -0700 Subject: [PATCH 5/5] chore: release 0.4.1 0.4.0 is already published and its metadata is immutable, so the corrected copyright holder, dropped `authors` field, and organisation repository URL only reach crates.io in a new version. The CHANGELOG compare links are repointed at the org in the same commit. --- CHANGELOG.md | 29 +++++++++++++++++++++++------ Cargo.lock | 2 +- Cargo.toml | 2 +- 3 files changed, 25 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9addb6c..031d7c0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,22 @@ All notable changes to `gobin` are documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.4.1] + +### Fixed + +- Replaced a `match` that current clippy flags as expressible with `?` in + `structures::types`. Behaviour is unchanged; the lint did not exist when CI + last ran, and the workflow pins `@stable`, so it now fails the `-D warnings` + gate on every build. + +### Changed + +- Recorded ATRAPS LLC as copyright holder and added a `NOTICE` file. No functional change. +- Dropped the deprecated `authors` field and repointed `repository` at the organisation. +- Refreshed transitive dependencies (`cargo update`); no direct dependency changed version. +- Publishing now uses crates.io trusted publishing instead of a stored registry token. + ## [0.4.0] ### Added @@ -579,9 +595,10 @@ Initial public release. - Type descriptor extraction via `.typelink` and descriptor walking. - Heuristic confidence scoring (`Confidence` enum). -[0.4.0]: https://github.com/BinFlip/gobin/compare/v0.3.1...v0.4.0 -[0.3.1]: https://github.com/BinFlip/gobin/compare/v0.3.0...v0.3.1 -[0.3.0]: https://github.com/BinFlip/gobin/compare/v0.2.1...v0.3.0 -[0.2.1]: https://github.com/BinFlip/gobin/compare/v0.2.0...v0.2.1 -[0.2.0]: https://github.com/BinFlip/gobin/compare/v0.1.0...v0.2.0 -[0.1.0]: https://github.com/BinFlip/gobin/releases/tag/v0.1.0 +[0.4.1]: https://github.com/ATRAPSLLC/gobin/compare/v0.4.0...v0.4.1 +[0.4.0]: https://github.com/ATRAPSLLC/gobin/compare/v0.3.1...v0.4.0 +[0.3.1]: https://github.com/ATRAPSLLC/gobin/compare/v0.3.0...v0.3.1 +[0.3.0]: https://github.com/ATRAPSLLC/gobin/compare/v0.2.1...v0.3.0 +[0.2.1]: https://github.com/ATRAPSLLC/gobin/compare/v0.2.0...v0.2.1 +[0.2.0]: https://github.com/ATRAPSLLC/gobin/compare/v0.1.0...v0.2.0 +[0.1.0]: https://github.com/ATRAPSLLC/gobin/releases/tag/v0.1.0 diff --git a/Cargo.lock b/Cargo.lock index a93b07a..afd25fb 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4,7 +4,7 @@ version = 4 [[package]] name = "gobin" -version = "0.4.0" +version = "0.4.1" dependencies = [ "goblin", ] diff --git a/Cargo.toml b/Cargo.toml index 8572461..25ad730 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "gobin" -version = "0.4.0" +version = "0.4.1" edition = "2024" rust-version = "1.88" description = "Static analysis library for Go compiled binaries - identification and metadata extraction"