
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
lua-distiller
Advanced tools
require dependencies分析 lua 代码中的 require 依赖,将分散的n个 lua 文件拼合成一个单一的 lua 文件
npm install coffee-script lua-distiller -g
LuaSrcDiet 是可选依赖。如果如果需要 minify 功能,
请确保 LuaSrcDiet.lua 在 $PATH 中。
Use in command line
lua-distill -i path/to/main.lua -o dist/dist.lua
-h, --help output usage information
-V, --version output the version number
-o, --output [VALUE] output directory
-n, --onlyKeepMinifiedFile only keep minified file
-i, --input [VALUE] path to main entrance lua file
-x, --excludes [VALUE] package names to be excluded, separated by: ","
-m, --minify minify merged lua file by LuaSrcDiet
-j, --luajitify compile merged lua file into luajit binary
这个工具采用和 node-coffee-distiller 相同的工作原理, 用户给定一个入口文件,这个工具自动递归地分析入口文件中的依赖,然后将依赖和入口文件合并到一个输出结果。
当 lua 项目在一个完全嵌入的环境中被执行时,需要有一个方便发布快捷的生产环境发布部署载体。这个工具就是为了满足这个需求而设计的。
类似的工具包括 luac -o, luajit, squish, 但是这3个工具都需要手动维护合并列表,这无疑给始终在变化的项目增加了额外的工作量和出错的可能。
lua 的 require 实现是通过调用 package.preload 来确保一个模块只被加载一次。当分散的 lua 文件合并成一体之后,
不在存在外部需要 require 的文件,因此在合并的文件中采用模拟 require 的方式。
具体而言,使用一个全局变量 __DEFINED table 来保存所有合并入的依赖。
然后对每个被合并入的文件都使用 (function() end)() 来确保入口方法被执行前,被合并入的方法体已经完成自我的静态初始化。
requirerequire(cc.PACKAGE_NAME .. ".functions") 是无法被识别的。并且我个人认为运行时拼合模块名是一种风险相对较大的实现,不推荐这样做。MIT
FAQs
Merge multiple lua file into one single lua file.
We found that lua-distiller demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.