Age	Commit message (Collapse)	Author	Lines
21 hours	Hold signatures to the length SHA-256 gives	Bryce Kwon	-1/+4
	The fake HMAC returned 16 bytes, so the checks signed with signatures half the real length, and a signature cut short passed. tohex's output was never pinned either, so dropping its zero padding stayed consistent with itself and passed.
22 hours	Check that the auth secret is made safely	Bryce Kwon	-3/+30
	The checks replaced get_secret with a constant, so its success path never ran, and the luaposix stand-in had no link or unlink and a umask that ignored its argument. Dropping the tightened mask, which leaves the secret readable by everyone under the usual 022, or accepting a short secret, passed. The real get_secret now makes the secret in the run's directory through stand-ins that behave like the calls they replace, and the checks cover the mask and its restoration, the link race, the temporary file, reuse and a secret written by hand.
24 hours	Give the harness cgit's print and its other sinks	Bryce Kwon	-2/+35
	Lua's own print wrote outside the collected output, so a stray print in a filter passed every check while under cgit it lands on the page. html_url_arg and html_include were missing, which only a filter using them would have found.
25 hours	Time the other filters at two lengths as well	Bryce Kwon	-0/+33
	The avatar checks held a 40000 byte address to half a second, twenty times tighter than the readme budget that already failed on a slow host, and in stub mode nearly all of that time went on the fake digest. Link-commits and link-trailers had no check on a long input at all. The readme checks' method moves into the harness so all four share it. A single timing of each length let a busy host that took the CPU away during the longer one make a linear pass look quadratic. The lengths now take turns and the fastest timing of each counts, since a busy host can slow one timing but rarely all five. A ratio under six ends the turns at once, so only one near the bound of ten waits for all five.
25 hours	Hold the avatar stub checks to an absolute hash	Bryce Kwon	-1/+4
	The stub mode checks only compared hashes with each other, and the stand-in digest took any algorithm name, so md5, a misspelt sha256 or hex in capitals passed everywhere luaossl is missing, which is every machine here. The comparisons also passed with no hash found on either side.
25 hours	Check the log line for lexers that are not found	Bryce Kwon	-0/+19
	Every check set CGIT_SCINTILLUA_PATH, which the filter takes as given, so the line for a server with no Scintillua at all never ran and deleting it passed. The harness can now clear a variable and hide the directories the filter probes. A lexer.lua anywhere on LUA_PATH also loaded in place of the missing one, so the fallback runs now keep every Lua module out of reach.
25 hours	Fail a unit check run that made no check	Bryce Kwon	-0/+5
25 hours	Decide every unit check skip in the shell	Bryce Kwon	-0/+16
	Where a standalone Lua had no lpeg, the harness skipped the markdown and man checks itself, behind a note the test library hides, and the test passed on the six checks left. The real luaossl checks were left out the same way. Each now shows as a skip under a prerequisite named for the interpreter, and a misspelt mode fails rather than running the default.
6 days	Say when logins are unavailable	Bryce Kwon	-0/+21
	The way back was signed part way through the form, so while the secret's directory did not exist, or a library was missing, cgit's error landed inside the hidden input and the page broke off there with no fields.
9 days	Let an unmirrored sink fail the way Lua would	Bryce Kwon	-12/+0
9 days	Drop the auth stubs no check reaches	Bryce Kwon	-20/+6
	Every check replaces get_secret, the only caller of posix.sys.stat, link and unlink, and nothing outside the harness calls preload.
2026-10-04	Spend a missing account's login on a real hash	Bryce Kwon	-0/+17
	The fixed SHA-512 stand-in matched only the documented setup, so a site hashing with yescrypt, other rounds or bcrypt answered for missing and real names in different times, and on OpenBSD it failed at once.
2026-09-29	Lead a readme's relative links into the tree	Bryce Kwon	-2/+9
	A browser resolved them against the about page, where nothing lives now that the page answers 404 below itself. They resolve the way GitHub resolves a readme's links instead, from the readme's directory and on the branch it was read from.
2026-09-07	Clean up the whole tree	Bryce Kwon	-12/+6
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-7/+1
2026-09-04	Add a test suite for the shipped extensions	Bryce Kwon	-0/+268